Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

We have LDAP and NFS setup in the lab. The lab has 16 machines and a server. All the LDAP users home directory is present in the server. Whenever, the LDAP user logs in from any of the 16 machines, his home is presented from the server in the client machine through the NFS automounting.

In all the client machines, we have installed virtualbox and created a group as vboxusers which has all the LDAP users. So, whenever the LDAP user logs in any of the client machine and runs virtual box, he will be able to use the Virtual Box.

However, in one of the machine after the fresh installation of RHEL and VirtualBox, when I run the VirtualBox as the LDAP user, I am getting the "guest OS inaccessible" error. I thought it might be some permission issue and so, I reset the permissions to the vboxusers in that machine.

However, on further investigation, we found out that the LDAP users are actually not assigned to the group "vboxusers" but rather to some other group. How can this be possible, as I copied the LDAP and NFS configuration files from the working machines in the lab and used the same files in the newly installed machine?

EDIT:

ldap.conf contents

#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE   dc=example, dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT  12
#TIMELIMIT  15
#DEREF      never
URI ldap://192.168.1.10/
BASE dc=xxx,dc=xxx
#TLS_CACERTDIR /etc/openldap/cacerts
share|improve this question
    
can you please post the content of your config files and ldifs? Which ldap distribution do you use? –  vfbsilva Oct 10 '13 at 21:41
    
LDAP Version: ldapsearch: @(#) $OpenLDAP: ldapsearch 2.3.43 (Jun 26 2012 06:37:13) $ mockbuild@hs20-bc2-4.build.redhat.com:/builddir/build/BUILD/openldap-2.3.43/open‌​ldap-2.3.43/build-clients/clients/tools (LDAP library: OpenLDAP 20343) –  Ramesh Oct 10 '13 at 21:43
    
I have updated the answer with the contents of ldap.conf file.. –  Ramesh Oct 10 '13 at 21:45
    
Means at the end you want to Replicate LDAP Server in your Test Lab, am I correct ? –  Rahul Patil Oct 10 '13 at 22:08
    
you want same LDAP Setup in your LAB ? –  Rahul Patil Oct 10 '13 at 22:09
show 2 more comments

2 Answers

How can this be possible, as I copied the LDAP and NFS configuration
files from the working machines in the lab and used the same files in
the newly installed machine?

As I understand you need Same LDAP Server Setup in your LAB, SO we need to export Master LDAP Server database, and then import into New LDAP Server. if I'm correct then you can follow this setup.

Installation

Note: this Guide based on RHEL5.x/CentOS 5.x

Install OpenLDAP Packages using :

yum install openldap

Configure server, Edit /etc/openldap/slapd.conf, you can configure this settings same as your Master

database        bdb
suffix          "dc=example,dc=com"
rootdn          "cn=Manager,dc=example,dc=com"
rootpw          secrete # or you can use encrypted pass using slappasswd

copy required file

install -o ldap -g ldap /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

On your Master Server, export all details into LDIF file.

slapcat -l master.ldif

Copy master.ldif into New LDAP Server.

Now on your New LDAP Server.

To import the entries specified in file master.ldif into your LDAP data-base give the command:

slapadd -l ldif

Now Start LDAP Service using :

/etc/init.d/ldap start

On Client Machine : Mount NFS on HOME, add required entries in /etc/fstab

Then enable LDAP Auth using :

authconfig --enableldap --enableldapauth --ldapserver=NEW_LDAPSERVER_IP --
ldapbasedn="dc=example,dc=com" –update

Trouble shooting

By Default ldap Logs is disabled you can Enable LDAP Logs on your LDAP Server using :

Edit /etc/syslog.conf

local4.*    /var/log/ldap.log

Once restart syslog service

/etc/init.d/syslog restart
share|improve this answer
    
Hi Rahul, thanks a lot for replying back. I am relatively new to system administration. I am not sure if I am following you. I have a LDAP server (centralized server) which authenticates all the users logging to the client using NFS. For this setup, do I have to modify the above mentioned files too? Because, we never encountered such a strange scenario before. Thanks again! –  Ramesh Oct 10 '13 at 23:20
    
We can't copy files one server to another server to make thing work, since by default ldap save DIT in burkly database so we need to export and import in new server. So if you have test server then you can test this steps, there is no impact on running ldap server. –  Rahul Patil Oct 11 '13 at 0:17
add comment
up vote 0 down vote accepted

This was due to the incorrect group ID being assigned. When the system was installed freshly, the system arbitrarily assigned the group ID 501 to another group.

In all the remaining machines of the lab, we had the group ID 501 assigned to vboxusers. That was the reason, the LDAP users were unable to access the VirtualBox in that particular machine.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.