Configure phpldapadmin for OpenLDAP Server (CentOS 7)

A. Server Configuration
    192.168.100.195  ldapserver.geekonline.in
    192.168.100.196  client1.geekonline.in
    For detailed LDAP configuration please visit this post.

B. Install phpldapadmin on same server

1.  Install epel repository on the server
    # rpm -ivh  https://download1.rpmfusion.org/nonfree/el/rpmfusion-nonfree-release-7.noarch.rpm

2.  Install phpldapadmin package
     #yum install phpldapadmin
     

3. Take backup of phpldapadmin config file and make the necessary changes
    # cp config.php config.php.orig
    # vi config.php
    Go to line 397 comment it and uncomment line 398
     $servers->setValue('login','attr','dn');
     // $servers->setValue('login','attr','uid');
     

4. Enable httpd service and add firewall rules for httpd service
    #systemctl enable httpd
    #firewall-cmd --permanent --add-port=80/tcp
    #firewall-cmd --reload

5. Try to access phpldapadmin page
    http://192.168.100.195
    while accessing the page It gives below error
    

6. To resolve this Edit the apache configuration file for phpldapadmin
    #cd /etc/httpd/conf.d/
    #vi phpldapadmin.conf
    change the entry from "require local" to "require all granted"
    Save config file and reload apache service
    #systemctl reload httpd
    

7. Now open the page 192.168.100.195/phpldapadmin
    
8. Login on the server
    

9. Now edit the phpldapadmin config file and change The name from Local LDAP server to Geekonline.in LDAP server on Line no 291
    #cd /etc/phpldapadmin
    #vi config.php
    

10. Refresh the page without restarting/reloading httpd service
    

B. Install phpldapadmin on different server 
1. All steps will be same for installation and configuration phpldapadmin on different server.
    Only below additional change in phpldapadmin config is required  on line no 298 
    Change IP address from 127.0.0.1 to OpenLDAP server IP address
        

2. Access the phpldapadmin webpage on the server 
    http://192.168.100.196/phplapadmin
    

Summary:
1. We can configure  phpldapadmin on same server or another server.
2. Managing users and groups on OpenLDAP server becomes easy.  
  
    
    



 

OpenLDAP Server Configuration (CentOS 7)

OpenLDAP is a directory Server and is configured by using LDAP Data Interchange Format files (.ldif). 
Manually Editing config files results in checksum error
Space is considered as a junk character and causes error while importing .ldif files

A. Server Configuration

1. Edit /etc/hosts/ file to for name resolution on both Server and Client Systems
    192.168.100.195  ldapserver.geekonline.in
    192.168.100.196  client1.geekonline.in

    

2. Install necessary packages
     #yum -y install strace net-tools
     #yum install openldap* migrationtools
     #systemctl enable slapd
     #systemctl start slapd

3. Change log settings
     #echo "####Custom Logs for LDAP###" >> /etc/rsyslog.conf
     #echo "local4.* /var/log/slapd/ldap.log" >> /etc/rsyslog.conf
     #tail -n2 /etc/rsyslog.conf
     #systemctl restart rsyslog   or # systemctl reload rsyslog
     It will automatically create directory and files and LDAP logs will be redirected to /var/log/slapd/ldap.log
     

4. Open ports in firewall
     #firewall-cmd --permanent --add-port=389/tcp
     #firewall-cmd --permanent --add-port=636/tcp
     #firewall-cmd --permanent --add-port=9830/tcp
     #firewall-cmd --reload


5.  list the config files
     #cd /etc/openldap/slapd.d/cn\=config
     #ls
     

6.  #cat olcDatabase\=\{2\}hdb.ldif (Before any changes)
     

7   Create a admin password in SSHA hash algorithm and copy the output to notepad for further configuration. 
     # slappasswd
     

8.  Create ldif to modify olcDatabase={2}hdb.ldif
      #vi /opt/ldap/db.ldif

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=geekonline,dc=in

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=admin,dc=geekonline,dc=in

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: {SSHA}ULNvNmPZNyCNqlU5E/9DftThZzF4aAEE

     

9. Make sure no extra spaces are present in the file and Import the DB file
     #cd /opt/ldap/
    #ls
    #ldapmodify -Y EXTERNAL -H ldapi:/// -f db.ldif
    #slaptest -u
    

10. Note the change in file
     #cat olcDatabase\=\{2\}hdb.ldif (Before any changes)
    
11. Now check the file 
    #cat olcDatabase={1}monitor,cn=config
    


12. Create monitor.ldif file
     #vi monitor.ldif
     
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=admin,dc=geekonline,dc=in" read by * none

    


13.Make sure no extra spaces are present in the file and Import the DB file
    #ldapmodify -Y EXTERNAL -H ldapi:/// -f monitor.ldif
    #slatptest -u
    

14  Now check file olcDatabase={1}monitor,cn=config for changes
   #cat olcDatabase={1}monitor,cn=config
    

15. Crease SSL Certificates for 10 years
   #openssl req -nodes -new -x509 -keyout /etc/openldap/certs/ldapkey.pem -out /etc/openldap/certs/ldapcert.pem -days 3650
    

16. Create certs.ldif file
      #vi certs.ldif

dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/ldapkey.pem

dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/ldapcert.pem
 
    

 17. Make sure no extra spaces are present in the file and  Import the DB file
    #ldapmodify -Y EXTERNAL -H ldapi:/// -f certs.ldif
    #slaptest -u
   

18. Verify the changes
    #cd /etc/openldap/slapd.d
    #cat cn=config.ldif
   

19. Copy DB_CONFIG file and add external schemas (used for storing data)
    #cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
    #chown ldap:ldap /var/lib/ldap/DB_CONFIG
    #ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif 
    #ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif 
    #ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
  
    

20.create a base.ldif file
     #vi base.ldif

dn: dc=geekonline,dc=in
dc: geekonline
objectClass: top
objectClass: domain

dn: cn=admin,dc=geekonline,dc=in
objectClass: organizationalRole
cn: admin
description: LDAP Manager

dn: ou=People,dc=geekonline,dc=in
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=geekonline,dc=in
objectClass: organizationalUnit
ou: Group

   

21. Add base ldif to LDAP Configuration
   #ldapadd -x -W -D "cn=admin,dc=geekonline,dc=in" -f base.ldif
   #slaptest -u
   


22.Check ldap object classes
    #ldapsearch -xb "dc=geekonline,dc=in" "(objectClass=*)"
   

23. check password 
   #ldapsearch -H ldap://127.0.0.1 -D "cn=admin,dc=geekonline,dc=in" -w "pass"
   
 
24.Create OS Users.
   #useradd osuser1
   #useradd osuser2
   #echo "pass1" | passwd --stdin osuser1
   #echo "pass2" | passwd --stdin osuser2

   #mkdir /opt/ldap/migrated_users
   #grep "osuser" /etc/passwd >> /opt/ldap/migrated_users/users
   #grep "osuser" /etc/group >> /opt/ldap/migrated_users/groups
   verify the files

   #cat /opt/ldap/migrated_users/users 
   #cat /opt/ldap/migrated_users/groups

  

25. Using migration tool
     #cd /usr/share/migrationtools/
     #cp migrate_common.ph migrate_common.ph.orig
     #vi migrate_common.ph
     #search and change below entries

     $DEFAULT_MAIL_DOMAIN = "geekonline.in";
     $DEFAULT_BASE = "dc=geekonline,dc=in"; 
     $EXTENDED_SCHEMA = 1;



26. Migrate OS users and groups using migration tool
   #/usr/share/migrationtools/migrate_passwd.pl /opt/ldap/migrated_users/users /opt/ldap/migrated_users/users.ldif
   #/usr/share/migrationtools/migrate_group.pl /opt/ldap/migrated_users/groups /opt/ldap/migrated_users/groups.ldif
   #ldapadd -x -W -D "cn=admin,dc=geekonline,dc=in" -f /opt/ldap/migrated_users/users.ldif
   #ldapadd -x -W -D "cn=admin,dc=geekonline,dc=in" -f /opt/ldap/migrated_users/groups.ldif

   

27.  Search that added user in ldap also check for 
   #ldapsearch -x cn=osuser1 -b dc=geekonline,dc=in
    
  
    #  ldapsearch -x cn=osuser2 -b dc=geekonline,dc=in
  

28 Create password for LDAP users which we are going to create using openssl
    #openssl passwd -crypt pass1
    uSMQbmjkzJzBw
    #openssl passwd -crypt pass2
    195EbQnuDDzcA
    note down the  output
   

29 create ldif file for user ldapuser1
   #vi ldapuser1.ldif

dn: cn=ldapuser1,ou=People,dc=geekonline,dc=in
cn: ldapuser1
gidnumber: 100
givenname: ldapuser1
homedirectory: /home/users/ldapuser1
loginshell: /bin/bash
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: top
sn: Surname
uid: ldapuser1
uidnumber: 5001
userpassword: {CRYPT}uSMQbmjkzJzBw
   
   

30 create ldif file for user ldapuser2
   #vi ldapuser1.ldif
 
dn: cn=ldapuser2,ou=People,dc=geekonline,dc=in
cn: ldapuser2
gidnumber: 100
givenname: ldapuser2
homedirectory: /home/users/ldapuser2
loginshell: /bin/bash
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: top
sn: Surname
uid: ldapuser2
uidnumber: 5002
userpassword: {CRYPT}195EbQnuDDzcA

   

31. Import both users in LDAP using ldif files
     #ldapadd -x -D "cn=admin,dc=geekonline,dc=in" -W -f ldapuser1.ldif
     #ldapadd -x -D "cn=admin,dc=geekonline,dc=in" -W -f ldapuser2.ldif
   

32. Verify the users in  LDAP
  #ldapsearch -x cn=ldapuser1 -b dc=geekonline,dc=in
   
  
  #ldapsearch -x cn=ldapuser2 -b dc=geekonline,dc=in
   

B. Client Configuration 
  
     
1. Install the necessary packages
  #yum install openldap-clients nss-pam-ldapd

2. Edit /etc/hosts/ file to for name resolution on both Server and Client Systems 
    192.168.100.195 ldapserver.geekonline.in 
    192.168.100.196 client1.geekonline.in

   

3. Enter below command on the client
    #authconfig --enableldap --enableldapauth --ldapserver=ldapserver.geekonline.in --ldapbasedn="dc=geekonline,dc=in" --enablemkhomedir --update
    
    This will automatically create home directory on client machine at first login

    

   Above command automatically configures ldap client,nsswitch file and PAM  
   #cat /etc/nslcd.conf |grep -v \#
   
  
   #cat /etc/nsswitch.conf |grep -i ldap
   

   #grep -ir home /etc/pam.d/*
   

  

Thus We can Configure LDAP server

C: Deleting LDAP user
   1. Gather the required information from LDAP using below command
   #ldapsearch -x cn=ldapuser1 -b dc=geekonline,dc=in

  2. Delete the user using below command
  #ldapdelete -v -c -D "cn=admin,dc=geekonline,dc=in" -w pass "cn=ldapuser1,ou=People,dc=geekonline,dc=in"



Summary
1. Never edit configuration files manually. 
2. LDAP configuration is easy if you avoid copy paste/typing mistakes (unnecessary spaces are considered as junk characters)
3. You can import existing OS users to LDAP
4. You can create LDAP user directly without creating it on OS
5. Client configuration can be done using fqdn instead of IPs
6. You can Create/modify/delete users easily






 
         

create swap partition using swapfile

  1. On the server there is 4GB memory and 4GB swap file on TEST server which is not enough.
  2. Now the existing swap partition is created in lvm and there is no scope to increase the size
    
    
  3. To overcome this problem create a swapfile using dd command with permission 0600
    
  4. Change the file permission to 0600
  5. Set the file as swap area
  6. Test by enabling the swap on swapfile
  7. Make this boot persistent by adding the entry in fstab
  8. Always run mount -a command to check if any error in fstab file
  9. Now disable swap on /swapfile which we have enabled manually and check swap partitions
    
    
  10. Now check boot persistence by swapon command 

Configure WIFI Without GUI in Linux

1) Find out the wireless device name.

#iw dev

2) check wireless device status up or down

#ip link show wlan0

3) scan wireless networks

#iw wlan0 scan

Now to configure and connect wireless without GUI we will require package wpa_supplicant-0.7.3-9.el6.i686


4) Create a configuration file

#wpa_passphrase >> /etc/wpa_supplicant/wpa_supplicant.conf

5) To start the device through command line

#wpa_supplicant -B -D wext -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf

where -B means run wpa_supplicant in the background.
-D specifies the wireless driver. wext is the generic driver.
-c specifies the path for the configuration file.

put above command in /etc/rc.local so that after booting it will automatically connect to wireless device.

Enabling usb wifi on CentOS 7

Enabling usb wifi  on Centos is really a difficult job. most of the times it requires drivers compilation and adding /removing modules which may be time consuming.

Its better to upgrade kernel to the latest release

To upgrade the kernel without kernel compilation follow below steps

Step 1: Install elrepo to your CentOS 7 system

# rpm –import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org

# rpm -ivh http://www.elrepo.org/elrepo-release-7.0-3.el7.elrepo.noarch.rpm

# yum –enablerepo=elrepo-kernel list available |grep kernel

# yum –enablerepo=elrepo-kernel install kernel-ml*  (select kernel-ml as they are the stable release kernels)

# grub2-set-default “CentOS Linux (4.18.1-1.el7.elrepo.x86_64) 7 (Core)”

reboot your system and configure network to the wireless usb card.

 

Country settings in AWStats



By implementing this setting in AWStats you can track the Geo location of visitor of your website.

Follow the procedure to implement the settings
#mkdir /usr/local/share/GeoIP
#cd /tmp wget -N http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz
#gunzip GeoIP.dat.gz mv GeoIP.dat /usr/share/GeoIP
#wget -N http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz

or or or

#yum install mod_geoip
#yum install geoipdate
#yum install geoip-devel

Now Edit the file configuration file for your website in /etc/awstats  and  search below lines

#LoadPlugin="geoip_city_maxmind GEOIP_STANDARD /pathto/GeoIPCity.dat"
#LoadPlugin="geoip GEOIP_STANDARD /pathto/GeoIP.dat"

and change to

GeoIPCity.dat LoadPlugin="geoip GEOIP_STANDARD /usr/share/GeoIP/GeoIP.dat"
LoadPlugin="geoip_city_maxmind GEOIP_STANDARD /usr/share/GeoIP/"

It may give you error like below



















To Fix this error run below commands
#yum install perl-CPAN
#cpan YAML
#cpan Geo::IP::PurePerl Geo::IP
#ldconfig -v

  

How to setup AWStats for apache log analyzer (CentOS 6.8)

 awstats
 
1) Installation
 
 #yum install epel-release
 #yum install httpd
 #chkconfig httpd on
 #service httpd start
 #yum install awstats

2) Configuration

 a) Changes in log format in httpd.conf
 
 check the below entry for log format. if it does not exist then add it.    
 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    

 b) changes in virtualhosts 

 change your log configuration like below
 CustomLog logs/yourdomain.com-access_log combined
 
 c) configuring awstats.conf for apache 
 
 #vim /etc/httpd/conf.d/awstats.conf

  add below entries in <Directory "/usr/share/awstats/wwwroot">
  </Directory> container

  AuthUserFile "/path-to-file/.htpasswd"
  AuthName "Restriceted Access"
  AuthType Basic
  Require user "htuser"


 Then create password file by below command
 #htpasswd -c /path-to-file/.htpasswd htuser
 #chmod 404 /path-to-file/.htpasswd htuser

d) creating configuation file for awstat

 #cp /etc/awstats/awstats.localhost.localdomain.conf /etc/awstats/yourdomain.com.conf
 
 then edit the file /etc/awstats/yourdomain.com.conf

# vim /etc/awstats/yourdomain.com.conf and change the below entries according to domain

LogFile="/var/log/httpd/yourdomain.com-access_log"
SiteDomain="yourdomain.com"
HostAliases="yourdomain.com www.yourdomain.com"
( for multiple domains its better to create seperate files for each domain)

e) setting permissions 


now change permissions for the awstat folder

#find  /usr/share/awstats -type d -exec chmod 701 '{}' \;
#find /usr/share/awstats  -type f  -exec chmod 404 '{}' \;

#chmod +x  /usr/share/awstats/wwwroot/cgi-bin/awstats.pl
#chmod 400 /etc/awstats/*.conf


Once you make all the changes make sure to restart apache to get configuration changes into effect

#/etc/init.d/httpd stop
#/etc/init.d/httpd start

or #/etc/init.d/httpd restart

make necessary changes according to your domain in below url  to check the statistics
http://www.yourdomain.com/awstats/awstats.pl?config=yourdomain.com

YUM repository configuration in RHEL 7

Adding local repository ( Using DVD )

1) mkdir /media/cdrom

2 ) mount /dev/cdrom /media/cdrom

3 ) create a repofile by following command

vi /etc/yum.repos.d/rhel.repo

name=Local Repository
baseurl=file:///media/cdrom
enabled=1
gpgcheck=0
#gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

Adding external repositories

1 ) cd /tmp

2) wget https://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-5.noarch.rpm

wget http://rpms.famillecollet.com/enterprise/remi-release-7.rpm

wget http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el7.rf.x86_64.rpm
3) install the downloaded rpms

4)  sudo sed -i ‘s/enabled=0/enabled=1/g’ /etc/yum.repos.d/remi.repo

5) (optional )vi /etc/yum.repos.d/remi.repo

disable all test repositories  by setting value enabled=0

type command yum repolist to view list of repositories

Configuring apache mariadb and phpmyadmin on RHEL 7

1 ) Install apache mariadb php and phpmyadmin on server by using following command

#yum install php phpmyadmin httpd mariadb

2)  type below command and set the password for root

#mysql_secure_installation

3) #vim  /etc/httpd/conf.d/phpMyAdmin.conf

in the section/container <Directory /usr/share/phpMyAdmin/> </Directory>

add the following two lines.

Options Indexes FollowSymLinks
Require all granted

4) add firewall rules  and reload firewall

#firewall-cmd –permanent –add-port=80/tcp
#firewall-cmd –permanent –add-port=80/udp
#firewall-cmd –permanent –add-port=443/tcp
#firewall-cmd –permanent –add-port=443/udp

#firewall-cmd –reload

OR

#firewall-cmd –permanent –add-service=http

#systemctl restart firewalld

5) Now restart apache service by typing

#service httpd restart or

#systemctl restart httpd.service

6) checking and adding apache and mariadb services to startup

#systemctl is-enabled httpd

#systemctl is-enabled mariadb

if it says its disabled then enable it by following command.

#systemctl enable httpd

#systemctl enable mariadb

Ethernet Bonding ( Centos 6.8 )

Step 1 :

Create the file /etc/sysconfig/network-scripts/ifcfg-bond0 and specify the ip address,netmask & gateway

# vi /etc/sysconfig/network-scripts/ifcfg-bond0
 DEVICE=bond0
 IPADDR=192.168.100.10
 NETMASK=255.255.255.0
 GATEWAY=192.168.100.1
 TYPE=Bond
 ONBOOT=yes
 NM_CONTROLLED=no
 BOOTPROTO=static

Step:2 

Edit the files of eth0 & eth1 and make sure you enter the master and slave entry, as shown below
 # vi /etc/sysconfig/network-scripts/ifcfg-eth0
 DEVICE=eth0
 HWADDR=90:2b:34:7b:df:a4
 TYPE=Ethernet
 ONBOOT=yes
 NM_CONTROLLED=no
 MASTER=bond0
 SLAVE=yes

# vi /etc/sysconfig/network-scripts/ifcfg-eth1
 DEVICE=eth1
 TYPE=Ethernet
 HWADDR=e2:5b:f0:60:ba:d8
 ONBOOT=yes
 NM_CONTROLLED=no
 MASTER=bond0
 SLAVE=yes

 Step:3 

Create the Bond file(bonding.conf)
 # vi /etc/modprobe.d/bonding.conf ( for old versions use modprobe.conf )
 alias bond0 bonding
 options bond0 mode=1 miimon=100  <--- This can be defined in  ifcfg-bond0  the line will be BONDING_OPTS="mode=1 miimon=100"
change above line to
options bond0 mode=1 miimon=100 fail_over_mac=1  if you are configuring bonding under vmware workstation.



Step:4 

service network restart

Important Things to know

A ) Different Modes used in bonding
 balance-rr or 0 -- round-robin mode for fault tolerance and load balancing.
 active-backup or 1 -- Sets active-backup mode for fault tolerance.
 balance-xor or 2 -- Sets an XOR (exclusive-or) mode for fault tolerance and load balancing.
 broadcast or 3 -- Sets a broadcast mode for fault tolerance. All transmissions are sent on all slave interfaces.
 802.3ad or 4 -- Sets an IEEE 802.3ad dynamic link aggregation mode. Creates aggregation groups that share the same speed & duplex settings.
 balance-tlb or 5 -- Sets a Transmit Load Balancing (TLB) mode for fault tolerance & load balancing.
 balance-alb or 6 -- Sets an Active Load Balancing (ALB) mode for fault tolerance & load balancing.




B ) Commands

To check the bonding status

watch -n .1 cat /proc/net/bonding/bond0   

or

cat /proc/net/bonding/bond0


To Change active interface in bondig 1 ) remove active interface from bonding by command  echo -eth0 > /sys/class/net/bond0/bonding/slaves this will make the other slave active then add it again into the bonding. by running command echo +eth0 > /sys/class/net/bond0/bonding/slaves or use inenslave to change the active slave in bond To make eth0 active use below command ifenslave -c bond0 eth0 eth1