ããã«ã¡ã¯ã ã€ã³ãã©ã¹ãã©ã¯ãã£ãŒéšã®å±±äžã§ãã æè¿ãããŒã ã®ãªãŒããŒã«ãªã£ãŠããããŸãã¿ãŒããã«ãè§Šã£ãŠããªãã£ãã®ã§ãããä¹
ã
ã«ãã£ã€ãè§Šããã®ã§èšäºã«ããŠã¿ãŸããã ïŒãã®èšäºã¯ mediba Advent Calendar 2016 ã®15æ¥ç®ã§ããïŒ å
¥é瀟ãé
å±ã®å€æŽãªã©ããããEC2ã®ãŠãŒã¶ã¢ã«ãŠã³ãã®ç®¡çã¯é ãçãåé¡ã§ãã åŒç€Ÿã§ã¯ãæè£œã®ããŒã«ã䜿ã£ãŠç®¡çãè¡ã£ãŠããŸãããä»åã¯EC2äžã«LDAPãµãŒããç«ãŠãŠLDAPèªèšŒã§åEC2ã«ãã°ã€ã³ããæ€èšŒãè¡ã£ãã®ã§ã玹ä»ããŸãã LDAPãšã¯ïŒ Lightweight Directory Access Protoclã®ç¥ã§ããã£ã¬ã¯ããªãµãŒãã¹ã«ã¢ã¯ã»ã¹ããããã®ãããã³ã«ã§ãã LDAPãµãŒãå
ã«ããããŒã¿ããŒã¹ã§ãŠãŒã¶ãªã©ãäžå
管çã§ããŸãã èŠä»¶ ã¯ã©ã€ã¢ã³ãã®EC2(以éã¯ã©ã€ã¢ã³ã)ã«ã¯SSHã®éµããŠãŒã¶ãç»é²ãããLDAPã®ã¹ããŒãå
ã«ããSSHéµã䜿çšããŠãã°ã€ã³ãã ãŠãŒã¶ã«ãã£ãŠå
¥ããã€ã³ã¹ã¿ã³ã¹ãå¶åŸ¡ãã sudoãå¯èœãªã°ã«ãŒããLDAPã§ç®¡çãã æ§æ ä»åã¯æ€èšŒç®çãªã®ã§åé·åãªã©ã¯èæ
®ããŠããŸããã åäžVPCå
ã«LDAPãµãŒããšã¯ã©ã€ã¢ã³ã3ã€ã³ã¹ã¿ã³ã¹ãããã ãã§ãã åã€ã³ã¹ã¿ã³ã¹å士ã§LDAPã®ããŒã(389/tcp)ã®éä¿¡ãèš±å¯ããŠãããã®ãšããŸãã ç°å¢ AmazonLinux 2016.09 slapd 2.4.40 OpenSSH_6.6.1p1 Sudo version 1.8.6p3 æ§ç¯ ã§ã¯ãå®éã«æ§ç¯ããŠãããŸãããã LDAPãµãŒãåŽ 1. ããã±ãŒãžã®ã€ã³ã¹ããŒã« $ sudo yum install openldap-servers openldap-clients pam_ldap openssh-ldap 2. ããã©ã«ãããŒã¿ã®åé€ $ sudo rm -rf /etc/openldap/slapd.d/* /var/lib/ldap/* 3. slapd.confãã¡ã€ã«ã®äœæ OpenLDAP2.4以éslapd.confã䜿çšããèšå®ã¯éæšå¥šãšãªã£ãŠãããOLC(On-Line Config)ã«ãŠèšå®ããããšãæšå¥šãšãªããŸããã OLCãçšãããšãåèµ·åãªãã§LDAPã®èšå®å€æŽãå¯èœãšãªããŸãããã¹ããŒãã®è¿œå /ä¿®æ£ãªã©è¡ãéã«LDIFãäœæããŠã€ã³ããŒãããå¿
èŠãããæéãªã®ã§ã ä»åã¯slapd.confã䜿çšããŠèšå®ãè¡ããŸãã $ sudo cp /usr/share/openldap-servers/slapd.conf.obsolete /etc/openldap/slapd.conf ä¿®æ£ããç®æã¯ä»¥äžã®ãšããã§ãã $ diff -u /usr/share/openldap-servers/slapd.conf.obsolete /etc/openldap/slapd.conf --- /usr/share/openldap-servers/slapd.conf.obsolete 2016-08-16 21:31:54.000000000 +0000 +++ /etc/openldap/slapd.conf 2016-12-09 06:19:30.004239349 +0000 @@ -15,6 +15,8 @@ include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema +include /etc/openldap/schema/sudo.schema +include /etc/openldap/schema/openssh-lpk-openldap.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 @@ -77,6 +79,14 @@ # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: +access to attrs=userPassword + by dn="cn=Manager,dc=example,dc=com" write + by self write + by anonymous auth + by * none +access to * + by self write + by * read # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: @@ -98,16 +108,16 @@ # rootdn can always read and write EVERYTHING! # enable on-the-fly configuration (cn=config) -database config -access to * - by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage - by * none +#database config +#access to * +# by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage +# by * none # enable server status monitoring (cn=monitor) database monitor access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read - by dn.exact="cn=Manager,dc=my-domain,dc=com" read + by dn.exact="cn=Manager,dc=example,dc=com" read by * none ####################################################################### @@ -115,16 +125,16 @@ ####################################################################### database bdb -suffix "dc=my-domain,dc=com" +suffix "dc=example,dc=com" checkpoint 1024 15 -rootdn "cn=Manager,dc=my-domain,dc=com" +rootdn "cn=Manager,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret -# rootpw {crypt}ijFYNcSNctBYg +rootpw {SSHA}xxxxxxxxxxxxxxx â» rootpwã¯slappasswdã³ãã³ãã§çæãããã¹ã¯ãŒããèšè¿°ããŸãã 4. slapd.confãèªã¿èŸŒãããã«ãã /etc/sysconfig/ldap ã«ä»¥äžã®æååã远å ããŸãã SLAPD_OPTIONS="-f /etc/openldap/slapd.conf" 5. ldap.confã®ç·šé 以äžã®èšè¿°ãè¡ãããšã§ãldapaddãldapsearchæã«ãã¹ãåã®æå®ãªã©ãäžèŠã«ãªããŸãã /etc/openldap/ldap.conf ã«ä»¥äžã远å ããŸãã BASE dc=example,dc=com URI ldapi://xx.xx.xx.xx/ 6. ã¹ããŒããã¡ã€ã«ã®é
眮 ã¹ããŒããé
眮ããŠincludeããããšã«ãããSSHã®éµãsudoã®å±æ§ãªã©ãç»é²ããäºãã§ããããã«ãªããŸãã $ sudo cp /usr/share/doc/openssh-ldap-6.6.1p1/openssh-lpk-openldap.schema /etc/openldap/schema/. $ sudo cp /usr/share/doc/sudo-1.8.6p3/schema.OpenLDAP /etc/openldap/schema/sudo.schema 7. slapdã®èµ·å $ sudo service slapd start $ sudo chkconfig slapd on 8. åæããŒã¿ã®äœæ $ vim init.ldif # ããŒã¹ãã¡ã€ã³ dn: dc=example,dc=com dc: example o: example objectClass: dcObject objectClass: organization # User OU dn: ou=Users,dc=example,dc=com ou: Users objectClass: organizationalUnit # 管çè
dn: cn=Manager,dc=example,dc=com objectClass: organizationalRole objectClass: simpleSecurityObject cn: Manager userPassword: {SSHA}xxxxxxxxx # Group OU dn: ou=Group,dc=example,dc=com objectClass: organizationalUnit ou: Group # admin Unix Group dn: cn=admin,ou=Group,dc=example,dc=com objectclass: posixGroup cn: admin gidNumber: 1000 # developer Unix Group dn: cn=developer,ou=Group,dc=example,dc=com objectclass: posixGroup cn: developer gidNumber: 1001 # sudo OU dn: ou=SUDOers,dc=example,dc=com objectClass: organizationalUnit ou: SUDOers # sudo defaults setting dn: cn=defaults,ou=SUDOers,dc=example,dc=com objectclass: top objectclass: sudoRole cn: defaults sudoOption: !root_sudo sudoOption: !lecture sudoOption: log_host sudoOption: log_year sudoOption: syslog=local3 sudoOption: logfile=/var/log/sudo.log sudoOption: ignore_dot sudoOption: ignore_local_sudoers sudoOption: timestamp_timeout=0 # %adminã°ã«ãŒãã®sudoèš±å¯ dn: cn=%admin,ou=SUDOers,dc=example,dc=com objectClass: top objectClass: sudoRole cn: %admin sudoUser: %admin sudoHost: ALL sudoCommand: ALL # yu-yamashita dn: uid=yu-yamashita,ou=Users,dc=example,dc=com objectClass: account objectClass: posixAccount objectClass: ldapPublickey uid: yu-yamashita cn: Yuki Yamashita uidNumber: 1000 gidNumber: 1000 homeDirectory: /home/yu-yamashita userPassword: {SSHA}xxxxxxxxx sshPublicKey: ssh-rsa AAAABxxxxxxxxxxxxxxx description: system_a_admin description: system_b_admin loginShell: /bin/bash # numasawa dn: uid=numasawa,ou=Users,dc=example,dc=com objectClass: account objectClass: posixAccount objectClass: ldapPublickey uid: numasawa cn: numasawa uidNumber: 1001 gidNumber: 1001 homeDirectory: /home/numasawa userPassword: {SSHA}xxxxxxxxx sshPublicKey: ssh-rsa AAAABxxxxxxxxxxxxxxx description: system_a_admin loginShell: /bin/bash # r-adachi dn: uid=r-adachi,ou=Users,dc=example,dc=com objectClass: account objectClass: posixAccount objectClass: ldapPublickey uid: r-adachi cn: r-adachi uidNumber: 1002 gidNumber: 1001 homeDirectory: /home/r-adachi userPassword: {SSHA}xxxxxxxxx sshPublicKey: ssh-rsa AAAABxxxxxxxxxxxxxxx description: system_b_admin loginShell: /bin/bash ãã®LDIFã§ã¯ ããŒã¹ãã¡ã€ã³(倧å
ã®å
¥ãç©)ãäœæ Userãšããçµç¹åäœ(OU)ãäœæ LDAP管çè
ãŠãŒã¶ãäœæ Groupãšããçµç¹åäœ(OU)ãäœæ adminãšããUnixã°ã«ãŒã developerãšããUnixã°ã«ãŒã sudoãšããçµç¹åäœ(OU) sudoã®èšå®(ããã§ã¯adminã°ã«ãŒãã«å±ããŠãŒã¶ã®ã¿sudoå¯èœ) ã€ãã§ã«yu-yamashitaãŠãŒã¶ãäœæããadminã°ã«ãŒãã«æå±ãããsystem_a_adminãšsystem_b_adminãšããdescriptionãä»äžãã ã€ãã§ã«numasawaãŠãŒã¶ãäœæããdeveloperã°ã«ãŒãã«æå±ãããsystem_a_adminãšããdescriptionãä»äžãã ã€ãã§ã«r-adachiãŠãŒã¶ãäœæããdeveloperã°ã«ãŒãã«æå±ãããsystem_b_adminãšããdescriptionãä»äžãã ãšããããŒã¿ãèšè¿°ããŠããŸãã 9. LDIFã®æå
¥ äžèšã§äœæããããŒã¿ãLDAPã«ç»é²ããŸãã $ sudo ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f init.ldif 10. ããŒã¿ã®ç¢ºèª ããšããªã®ã§GUIãã確èªããŸãã Apache Directory Studio ãšããããŒã«ãã€ã³ã¹ããŒã«ãéããŸãã SecurityGroupã§389/tcpãéããã®ããå¿ããªãã File -> New ãéžæããLDAP ConnectionãéžæãNextãã¯ãªã㯠ConnectionNameã¯ä»»æã®å€ãHostNameã«ã€ã³ã¹ã¿ã³ã¹ã®IPãå
¥åãNextãã¯ãªã㯠Bind DN or User ã« cn=Manager,dc=example,dc=com ãå
¥å Passwordã¯ldifãäœæããéã«èšè¿°ãããã¹ã¯ãŒããå
¥åãFinishãã¯ãªã㯠RootDSE -> dc=example,dc=com ã蟿ã£ãŠãããšãããŒã¿ãç»é²ãããŠããããšãããããŸãã 以äžã§ãµãŒãåŽã®èšå®ã¯å®äºã§ãã LDAPã¯ã©ã€ã¢ã³ãåŽ 1. LDAPã¯ã©ã€ã¢ã³ãã€ã³ã¹ããŒã« $ sudo yum install openldap-clients nss-pam-ldapd openssh-ldap 2. LDAPèªèšŒã«ãã $ sudo authconfig --enableldap --enableldapauth --ldapserver=xx.xx.xx.xx --ldapbasedn="dc=example,dc=com" --enablemkhomedir --update 3. Groupæ
å ±ãLDAPããååŸããããã«ãã /etc/nslcd.conf ã«ä»¥äžã远å ãã base group ou=Group,dc=example,dc=com 4. SSHã®éµãLDAPãµãŒãããååŸãã /etc/ssh/sshd_config ã«ä»¥äžã®èšè¿°ãè¡ã AuthorizedKeysCommand /usr/libexec/openssh/ssh-ldap-wrapper AuthorizedKeysCommandUser root 5. sudoã§ããããã«ãã /etc/sudo-ldap.conf ã«ä»¥äžã远å ãã uri ldap://xx.xx.xx.xx/ sudoers_base ou=SUDOers,dc=example,dc=com bind_timelimit 120 host xx.xx.xx.xx base dc=example,dc=com 次㫠/etc/pam.d/su å
ã® auth required pam_wheel.so use_uid ã®ã³ã¡ã³ããå€ãã æåŸã« /etc/nsswitch.conf ã«ä»¥äžã远å ãã sudoers: ldap files 6. SSHã®èªèšŒã«LDAPã䜿ãããã«ãã $ vim /etc/ssh/ldap.conf uri ldap://localhost/ base dc=example-dev,dc=com ssl no 7. sshdã®åèµ·å $ sudo service sshd restart ãããŸã§è¡ãã°ãSSHã®éµããŠãŒã¶ãã¯ã©ã€ã¢ã³ãã«äœãããã°ã€ã³åºæ¥ãããã«ãªããŸãã ãŸããadminã°ã«ãŒãã«æå±ãããŠãŒã¶ã®ã¿sudoãå¯èœã§ãã ãã°ã€ã³ã§ãããã¹ãã«å¶éãããã æ¬¡ã«ããŠãŒã¶ã«ãã£ãŠãã°ã€ã³ã§ãããã¹ããåããŠã¿ãããšæããŸãã äžè¿°ã®LDIFã§ã¯system_a_admin, system_b_adminãšãã3çš®é¡ã®attributeãèšè¿°ããŠããŸãã ããã§ã¯ã以äžã®ãããªã«ãŒã«ã§å¶éãè¡ããŸãã system_a_admin: system_aã®ã€ã³ã¹ã¿ã³ã¹ã®ã¿ãã°ã€ã³ã§ãã system_b_admin: system_bã®ã€ã³ã¹ã¿ã³ã¹ã®ã¿ãã°ã€ã³ã§ãã äžèšã®ã«ãŒã«ã®å Žåãå
ã»ã©äœã£ããŠãŒã¶ã¯ä»¥äžã®ããã«ãªããŸãã yu-yamashita: å
šãŠã®ã€ã³ã¹ã¿ã³ã¹ã«ãã°ã€ã³ã§ãã numasawa: system_aã®ã€ã³ã¹ã¿ã³ã¹ã®ã¿ãã°ã€ã³ã§ãã r-adachi: system_bã®ã€ã³ã¹ã¿ã³ã¹ã®ã¿ãã°ã€ã³ã§ãã 以äžã¯system_aã®ã€ã³ã¹ã¿ã³ã¹ã®èšå®ãè¡ããŸãã system_bãåãèŠé ã§èšå®ãè¡ãªããŸãã 1. /etc/pam_ldap.confã®ç·šé /etc/pam_ldap.conf ã«ä»¥äžã远èšãã pam_filter description=system_a_admin nss_base_passwd ou=Users,dc=example,dc=com?sub?description=system_a_admin nss_base_shadow ou=Users,dc=example,dc=com?sub?description=system_a_admin nss_base_group ou=Group,dc=example,dc=com?sub?objectClass=posixGroup 2. /etc/ssh/ldap.confã®ç·šé /etc/ssh/ldap.conf ã«ä»¥äžã远èšãã pam_filter description=system_a_admin 3. /etc/nslcd.confã®ç·šé /etc/nslcd.conf ã«ä»¥äžã远èšãã filter passwd (description=system_a_admin) filter shadow (description=system_a_admin) filter group (objectClass=posixGroup) äžèšã®èšå®ãè¡ãããšã§ãyu-yamashita,numasawaã¯ãã°ã€ã³å¯èœãr-adachiã¯ãã°ã€ã³äžå¯èœãšãªããŸãã ãŸãšã ãããæ§ç¯æé ã®ããã«ãªã£ãŠããŸããŸããâŠã OSã¢ã«ãŠã³ã管çã¯çµæ§é ã®çã課é¡ã§ããããã®èšäºãå°ãã§ãã圹ã«ç«ãŠã°å¹žãã§ãã