...
| Variable | Description | Recommended Value |
|---|---|---|
| SSHLDAP_BASE_DN | This defines the base location to search for Users, Groups, and Hosts. | dc=${ziD},dc=com, where zID is the ziNet ID |
| SSHLDAP_BASE_TENANT_DN | This is the location of the tenant container. This allows SSHLDAP to support multi-tenant applications. | dc=tenants,${SSHLDAP_BASE_DN} |
| SSHLDAP_BASE_OPS_DN | This is the location of the base LDAP container that holds SSH-specific LDAP Groups (for example a Host is an LDAP group). | dc=ops,${SSHLDAP_BASE_DN} |
| SSHLDAP_USERS_TENANT_DN | This is the location of the User accounts for a specific tenant. | ou=People,ou=${localTenantId},${SSHLDAP_BASE_TENANT_DN}, where localTenantId is the current tenantID. |
| SSHLDAP_GROUPS_TENANT_DN | This is the location of Groups for a specific tenant. | ou=Groups,ou=${localTenantId},${SSHLDAP_BASE_TENANT_DN} |
| SSHLDAP_GROUPS_OPS_DN | This is the location of SSHLDAP Groups entities. | ou=Groups,${SSHLDAP_BASE_OPS_DN} |
| SSHLDAP_LAYERS_OPS_DN | This is the location of SSHLDAP Layer entities. | ou=Layers,${SSHLDAP_BASE_OPS_DN} |
| SSHLDAP_HOSTS_OPS_DN | This is the location of SSHLDAP Host entities. | ou=Hosts,${SSHLDAP_BASE_OPS_DN} |
| SSHLDAP_SVCS_OPS_DN | This is the location that the SSHLDAP admin service account should be placed. | ou=ServiceAccounts,${SSHLDAP_BASE_OPS_DN} |
| SSHLDAP_SUDO_OPS_DN | This is the location of SSHLDAP Sudo entities. This provides sudo access to a server. | ou=Sudoers,${SSHLDAP_BASE_OPS_DN} |
| SSHLDAP_VARS_OPS_DN | This is the location of SSHLDAP variables for keeping track of the next available posixGroup or posixAccount counters. This helps to keep unique IDs. | ou=Variables,${SSHLDAP_BASE_OPS_DN} |
| SSHLDAP_POSIX_UID_UPPER | This is the upper limit that local Linux accounts are assigned. As new SSHLDAP entities are created this counter will be the first available ID to be assigned to that entity. | Must be a unique number greater than the highest uidNumber for all servers that will be setup using SSHLDAP. Normally 2000 is sufficient. But this depends on your specific environment. |
| SSHLDAP_POSIX_GUID_UPPER | This is the upper limit that local Linux groups are assigned. As new SSHLDAP entities are created this counter will be the first available ID to be assigned to that entity. | Must be a unique number greater than the highest gidNumber for all servers that will be setup using SSHLDAP. Normally 2000 is sufficient. But this depends on your specific environment. |
| SSHLDAP_LDAP_FMT_OPTIONS | LDAP search options | "-LLL -o nettimeout=10 -o ldif-wrap=no" |
| SSHLDAP_LDAP_SERVER_URI | This is the location of the SSHLDAP LDAP server. | ldaps://prod-ds1.ops.<your domain>.com:1636 |
| SSHLDAP_SECURITY_GRPS | This is a comma separated list of local (NOT LDAP) Linux groups that should be allowed access to server. This variable enables existing legacy groups which have local logins to continue to have access to the server after SSHLDAP is isntalled. | Varies. For Amazon Web Services EC2 Ubuntu instances, this value should be "ubuntu". That user account that all EC2 instances are spun up with. |
| SSHLDAP_PASSWD_SERVER_URI | This is the URI of a server that will be used for password changes rather than ldappasswd. | |
| SSHLDAP_ACI_DN_TYPE | This variable is used to construct a LDAP ACI that provides access to the LDAP password attributes. This allows for suppression of these attributes within the directory, but then provide a limited set of users access to the attributes. This is used on conjunction with SSHLDAP_ACI_DN. | "userdn" or "groupdn" See: https://backstage.forgerock.com/#!/docs/opendj/2.6.0/admin-guide/chap-privileges-acis |
| SSHLDAP_ACI_DN | The following is an example: dn: dc=${ziD},dc=com | "anyone" or an LDAP DN. See: https://backstage.forgerock.com/#!/docs/opendj/2.6.0/admin-guide/chap-privileges-acis
|
Scripts
Script: install-sshldap.sh
This script sets up SSHLDAP on a server.
Result: 0 for success
Prerequisite: The install-zinet.sh and install-pki.sh scripts must have been run.
...
Prerequisite: SSHLDAP must have been installed with install-sshldap.sh
USAGE=" Usage: `basename $0` -l fabric config file -D Directory Manager DN ( -w Directory Manager Passwd | -W [ Prompt ] | -y Directory Manager Passwd File )"
Result: 0 for success
| Parameter | Description | Default | Mandatory |
|---|---|---|---|
| -l fabric config | A file containing a Fabric config | ||
| -D admin user DN | An admin user bind DN. This user must be able to perform modifies to any parts of the directory dpecified in the fabric config file. | N/A | Yes |
| -w admin user password | Admin user password. | N/A | No |
| -W | Prompt for a password. The default behavior will be to prompt for a password. | true | No |
| -y admin user password file | A file containing the admin user's password | N/A | Np |
...