Installing 389-DS on CentOS 7

389-DS is a simple ldap server with a nice management interface and the upstream project for redhat directory server. This ldapserver is also part of the freeipa identity management framework. But before we set up the ldapserver, we need to do some preparations.

First edit your /etc/hosts file to have local name resolution in case your dns fails:

 [root@ldap01~]# echo "$(hostname -I | awk '{print $1}') $(hostname --fqdn) $(hostname -s)" >> /etc/hosts  

next set the following parameters in the /etc/sysctl.conf:

 [root@ldap01 ~]# vim /etc/sysctl.conf  
 net.ipv4.tcp_keepalive_time = 300  
 net.ipv4.ip_local_port_range = 1024 65000  
 fs.file-max = 64000  

changes active by reading the file

 [root@ldap01 ~]# sysctl -p  

make pam considering the limits:

 [root@ldap01 ~]# vim /etc/pam.d/login  
 session  required  /usr/lib64/security/pam_limits.so  

install the epel-release:

 [root@ldap01 ~]# yum -y install epel-release  

install the 389-ds packages and some dependencies:

 [root@ldap01 ~]# yum -y install 389-admin 389-admin-console 389-admin-console-doc 389-adminutil 389-console 389-ds 389-ds-base 389-ds-base-libs 389-ds-console 389-ds-console-doc 389-dsgw openldap-clients nss-pam-ldapd  

Next we need to set up the directory. RedHat provides a script that'll walk you through the process which is started by running:

 [root@ldap01 ~]# setup-ds-admin.pl  

 389 Directory Server system tuning analysis version 06-JULY-2018.  
 NOTICE : System is x86_64-unknown-linux3.10.0-862.6.3.el7.x86_64 (2 processors).  
 WARNING: There are only 1024 file descriptors (soft limit) available, which  
 limit the number of simultaneous connections.  
 WARNING : The warning messages above should be reviewed before proceeding.  
 Would you like to continue? [no]: yes  
 1. Express  
     Allows you to quickly set up the servers using the most  
     common options and pre-defined defaults. Useful for quick  
     evaluation of the products.  
   2. Typical  
     Allows you to specify common defaults and options.  
   3. Custom  
     Allows you to specify more advanced options. This is  
     recommended for experienced server administrators only.  
 To accept the default shown in brackets, press the Enter key.  
 Choose a setup type [2]: 2  
 Computer name [ldap01.archyslife.lan]:  
 System User [dirsrv]:  
 System Group [dirsrv]:  
 Do you want to register this software with an existing  
 configuration directory server? [no]:  
 Configuration directory server  
 administrator ID [admin]:  
 Password:  
 Password (confirm):  
 Administration Domain [archyslife.lan]:  
 Directory server network port [389]:  
 Directory server identifier [ldap01]:  
 Suffix [dc=archyslife,dc=lan]:  
 Directory Manager DN [cn=Directory Manager]:  
 Password:  
 Password (confirm):  
 Administration port [9830]:  
 Are you ready to set up your servers? [yes]:  
 Creating directory server . . .  
 Your new DS instance 'deploy' was successfully created.  
 Creating the configuration directory server . . .  
 Beginning Admin Server creation . . .  
 Creating Admin Server files and directories . . .  
 Updating adm.conf . . .  
 Updating admpw . . .  
 Registering admin server with the configuration directory server  
 Updating adm.conf with information from configuration directory server  
 Updating the configuration for the httpd engine . . .  
 ..  
 ..  
 Starting admin server . . .  
 The admin server was successfully started.  
 Admin server was successfully created, configured, and started.  
 Exiting . . .  

The setup-script has run successfully and the directory is ready. Now we can start the services and enable them so that they start on boot.

 [root@ldap01 ~]# systemctl start dirsrv.target  
 [root@ldap01 ~]# systemctl enable dirsrv.target  
 [root@ldap01 ~]# systemctl start dirsrv-admin  
 [root@ldap01 ~]# systemctl enable dirsrv-admin  

To allow traffic from our network to that ldap-service, we'll have to make it accessable through the firewall.

 [root@ldap01 ~]# firewall-cmd --add-port={389/tcp,636/tcp,9830/tcp} --permanent  
 [root@ldap01 ~]# firewall-cmd --reload  

Now configure our server to use our ldapservice for authentication. This can be easily done via authconfig.

 [root@ldap01 ~]# authconfig --enableldap --enableldapauth --ldapserver=ldap://ldap01.archyslife.lan --ldapbasedn="dc=archyslife,dc=lan" --updateall  

The server is now configured to use ldap as its authentication source. Users that are set up as posix users in the directory tree and have a valid shell are now able to log in to that server.

Feel free to comment and / or suggest a topic.