Configuring LDAP Authentication on CentOS 7

This guide will walk you through setting up CentOS 7 to use an LDAP directory server for authentication. This guide will not work with CentOS 8. If you want to use LDAP authentication with CentOS 8, click here. I am assuming you have a directory server up and running. If you don’t, you can follow these two guides to install and configure OpenLDAP:

Install Packages

First, you need to install and configure a LDAP pluggable authentication module (PAM), a LDAP name service switch (NSS) module, and a caching service. I prefer nss-pam-ldapd because it is available in the OS repositories and straightforward to configure. It is what the examples in this guide will use. Install the necessary packages by running the following command:

yum install nss-pam-ldapd openssl nscd

TLS CA Certificates

I recommend using TLS for your connections to your directory server(s). If you don’t, user names and passwords will be sent through the network unencrypted. If you opt to not use TLS, then skip this section. If your directory server certificate was obtained from one of the well known certificate authorities, you can probably use your system’s trusted certificate authority (CA) certificate list. On CentOS 7, this is /etc/ssl/certs/ca-bundle.crt. If you are using a self-signed certificate or an in-house certificate authority, you will need to get a copy of the certificate used to sign the directory server(s) server certificates.

Well Known CA

If your directory server is using a certificate issued by one of the well known CAs, then you are done with this section. Read the comment regarding tls_cacertfile in the example nslcd.conf file.

Local CA

Contact your CA administrator and ask them for the CA certificate in PEM format. I keep CA certificates that don’t ship with the OS in/pki/cacerts.pem. Append the CA certificate to this file, or if you like, a location of your choosing.

Self-Signed Certificate

Create a directory to store your certificate files in and obtain the certificates from your directory server. I recommend keeping self-signed certificates in a separate file. If possible, ask your directory server administrator for the certificate in PEM format. If this isn’t possible, it can be obtained with OpenSSL. Run the following openssl command on the directory server, if possible. If you run it on the client, you are susceptible to a man in the middle attack.

openssl s_client -connect ldap.tylersguides.com:636 -showcerts < /dev/null

From the output of the openssl command, copy and paste the certificate text into /pki/ldap_server_certs.pem or a location of your choosing. Do this for each server. The certificate text will look something like this:

Configure nss-pam-ldapd

Nss-pam-ldapd uses the same file,/etc/nslcd.conf, for the NSS and PAM modules. I have included an example file with comments explaining what the various options do. There are many more options than the ones in the example. It wouldn’t hurt to skim through the official documentation to see what options are available. Replace the highlighted values in the example below with what is relevant to your system.

# The user and group name the cache daemon will run as.
uid nslcd
gid ldap

# Make sure to use the fully qualified domain name or the TLS handshake
# will fail and you won't be able to connect.

# The URI if your directory server(s). Multiple servers can be specified.
uri ldaps://ldap.tylersguides.com/
# uri ldaps://ldap2.tylersguides.com

# This should be your suffix.
base dc=tylersguides,dc=com

# The LDAP user the cache daemon and modules will use for looking
# up entries
binddn cn=osproxy,ou=system,dc=tylersguides,dc=com

# The password for the aforementioned account
bindpw osproxy_password

# Where to look for groups and users, respectively.
base   group  ou=groups,dc=tylersguides,dc=com
base   passwd ou=users,dc=tylersguides,dc=com

# How long, in seconds, to wait for the server to respond when logging in
# as the aforementioned user before giving up
bind_timelimit 30

# How long to wait for the server when searching for entries.
timelimit 30

# TLS  configuration. tls_reqcert demand will prevent the daemon and modules
# using the server if the server certificate does not have a signing chain
# that ends with a root certificate listed in the file set by tls_cacertfile
ssl on
tls_reqcert demand
# If your directory server uses a certificate from a well known CA,
# comment out the next line and uncomment the one below it.
tls_cacertfile /pki/cacerts.pem
#tls_cacertfile /etc/ssl/certs/ca-bundle.crt
tls_ciphers HIGH:TLSv1.2:!aNULL:!eNULL

You may want or need to adjust the tls_ciphers. The CentOS 7 nss-pam-ldapd package uses OpenSSL. See the OpenSSL ciphers man page for guidance.

If you use self-signed certificates or a local CA, set the SELinux¹ label. If SELinux is enforcing, nslcd won’t be able to read /pki/cacerts.pem:

chcon system_u:object_r:cert_t:s0 /pki/cacerts.pem

Nss-pam-ldapd uses a daemon to lookup directory entries. Set nslcd to automatically start on boot and restart it.

systemctl enable nslcd
systemctl restart nslcd

Enable and Test LDAP

Before you enable and test your configuration, create a home directory for your test user. If you used my guide on configuring the server, the commands below will work as is.

mkdir /home/testuser
chown 5000:5000 /home/testuser

The authconfig program will update your /etc/nsswitch.conf and /etc/pam.d/ for you. Run the following command to make the changes necessary to enable LDAP:

authconfig --updateall --enableldap --enableldapauth

If you run into problems and need to disable LDAP:

authconfig --updateall --disableldap --disableldapauth

Restart nscd² and ensure it is set to start when the system boots:

systemctl restart nscd
systemctl enable nscd

Now test the configuration by trying to resolve UIDs and GIDs.

ls -l /home

Working configuration:

root@ldap:~# ls -l /home
total 8
drwxr-xr-x 2 testuser testgroup 4096 Jul 24 16:03 testuser
drwxr-xr-x 2 tyler    tyler     4096 May 22  2016 tyler

Broken configuration:

root@ldap:~# ls -l /home
total 8
drwxr-xr-x 2  5000  5000 4096 Jul 24 16:03 testuser
drwxr-xr-x 2 tyler tyler 4096 May 22  2016 tyler

If your ls command shows /home is owned by your test user and group instead of the numeric UID and GID, your configuration is working. If it isn’t working, try restarting nslcd. Then I would check /var/log/messages for clues. You could also try running nslcd in debug mode. The following command will do this. Press Ctrl+C to stop nslcd when you are finished:

systemctl stop nslcd
nslcd -d

Some potential causes:

The client and server(s) fail to negotiate a cipher suite. Adjust tls_ciphers in nslcd.conf
The certificate authority certificate(s) that signed the server certs is not in your tls_cacertfile. Obtain the necessary certificates and add them to your file.
The TLS certificate subject does not match the host name of the server. Make sure you use fully qualified domain names (FQDN)s on your uri lines. You may be able to add /etc/hosts entries if you cannot resolve the FQDNs via DNS.
You are suppling incorrect credentials on your binddn and bindpw lines.
Your search base lines don’t match your directory servers.
Nslcd can’t read the CA certificates file.

Test LDAP Authentication

Try logging in with your testuser:

ssh -l testuser

Notes

SELinux is a form of mandatory access control. SELinux permissions can override discretionary access control (DAC) permissions typically covered by Linux permissions guides. In other words, even if the DAC permissions allow access, SELinux can still block access. RHEL based distributions, such as CentOS, enforce SELinux labels by default.
The name service cache daemon (nscd) caches resolver requests. I.e., it prevents excessive name service lookups. When the data source is on a remote server, such as an OpenLDAP server, caching the lookups can drastically improve name resolution performance. For example, if you were to list a directory’s contents with ls -l, the resolver would only have to reach out to the directory server the first time it encounters a new UID or GID rather than once for every file in the directory.

References

nss-pam-ldapd Documentation