Named after Alan Turing.
See also: System naming
Access is limited to Trustees only since it contains the membership db.
Turing has an LDAP db on it that is replicated to denning for use on machines in the space.
It sort of works.
on denning we get these errors in the logs:
Sep 11 21:53:33 denning slapd: slap_client_connect: URI=ldaps://turing.hackspace.org.uk DN="cn=admin,dc=london,dc=hackspace,dc=org,dc=uk" ldap_sasl_bind_s failed (-1) Sep 11 21:53:33 denning slapd: do_syncrepl: rid=000 rc -1 retrying Sep 11 22:37:37 denning slapd: do_syncrep2: rid=000 (-1) Can't contact LDAP server Sep 11 22:37:37 denning slapd: do_syncrepl: rid=000 rc -1 retrying Sep 11 22:50:27 denning slapd: do_syncrep2: rid=000 (-1) Can't contact LDAP server Sep 11 22:50:27 denning slapd: do_syncrepl: rid=000 rc -1 retrying
They appear to be harmless.
Turing has iptables rules that allow access to the LDAP server from denning.
The LDAP server uses an ssl cert from startcom, it expires on Mar 25 2015.
We use a schema that is compatible with samba for 2 reason:
- We might want user logins to samba at some point
- The sambaNTPassword attribute is understood by freeradius and is needed for MS-CHAP auth for spacefed.
however the sambaNTPassword hash is quite weak, and the sambaLMPassword hash is silly, so ideally:
- the sambaLMPassword attribute would contain nonsense that can never be authenticated against
- the sambaNTPassword attribute would be for a different password from the userPassword
Currently we're using '!' for the sambaLMPassword attribute value.
cheat sheet at the moment
list a users details
smbldap-userinfo -l <username>
add a user to a group
smbldap-usermod -G +<groupname> <username>
List the members of a group
smbldap-groupshow <group name>
Remove a member from a group
smbldap-usermod -G -<groupname> <username>
- might need to add an index to memberUid
Changes to tools on turing
The smbldap tools were patched with these patches
... and a few others, you can see them all here:
184.108.40.206 220.127.116.11 (hackspace.vps.bitfolk.com)
These run as daemons automatically:
- mjpegproxy-webcams (in screen, no logging)