Login as root
1. install sssd sssd-ldap
apt update
apt install sssd sssd-ldap
2. Check /etc/nsswitch make sure that sss is indicated for passwd and group
passwd: files systemd sss
group: files systemd sss
shadow: files systemd sss
gshadow: files systemd sss
3. create /etc/sssd/sssd.conf
[sssd]
#config_file_version = 2
services = nss, pam
domains = x-act.ph
debug_level = 7
[domain/x-act.ph]
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
cache_credentials = True
ldap_tls_reqcert = never
ldap_id_use_start_tls = True
ldap_tls_cacert = /etc/ssl/certs/ldap.x-act.ph.crt
ldap_uri = ldap://ldap.x-act.ph
ldap_search_base = dc=x-act,dc=ph
Note:
Save the ldap server certificate below to /etc/ssl/certs/ldap.x-act.ph.crt. This is the ldap server self-signed certificate referenced in tls_tls
-----BEGIN CERTIFICATE-----
MIIDhzCCAm+gAwIBAgIUWhgpbmp/XBIQnt/yCQWTHYs/TQ8wDQYJKoZIhvcNAQEL
BQAwUzEWMBQGA1UEAwwNbGRhcC54LWFjdC5waDEsMCoGA1UECgwjWC1BY3QgQWN0
aXZlIENvcmUgVGVjaG5vbG9naWVzIEluYy4xCzAJBgNVBAsMAklUMB4XDTI2MDkx
MzExMDA1MVoXDTI5MDkxMjExMDA1MVowUzEWMBQGA1UEAwwNbGRhcC54LWFjdC5w
aDEsMCoGA1UECgwjWC1BY3QgQWN0aXZlIENvcmUgVGVjaG5vbG9naWVzIEluYy4x
CzAJBgNVBAsMAklUMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwwwQ
srA7um+LtW54qYMhfYHyZs15M478CKqcS9njo2PVrxtDtS43PjpU/TI9B1Mxmveh
P8dE63iPioeuNuqRXUsg3n7JjzN7DtGToO4oRtgl9wZl4Iuryvb2SvVs3mgeVA1U
V+O7VMN8gScyLux+OD1xi7LhHmHvfFoItT9hZs7eeADrMTj4ZETuyQ4QHR9pe2Ug
yr6j9G3bNlf0gIEcaEaAzYQIDqQ5XL+BhHlptY6DX9T9jHgxM7jbtiitf56NGhid
zD3hldjMAKXP0bJVZLPO1uwdd222BjGJDAXvz8SQfclIXyHiYS1wImR5x51VhR2W
3w++BYGvHJ2dXC0qSQIDAQABo1MwUTAdBgNVHQ4EFgQU6XVwuyTI+0sTYkmiZtB2
4v83EiowHwYDVR0jBBgwFoAU6XVwuyTI+0sTYkmiZtB24v83EiowDwYDVR0TAQH/
BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAgVSL4Y0PMGze+BubhOei4zGEP8P1
o9FKSQIbQMGp1ZwDCHgGpSS+43NXyqlpYF4oE7FWFo2M1Qkptqinh7zcd3tR2XC+
rnDmV3lcyoRUBR4BYWc6o5QJsyr5FNWo1ZyAX84igeI9xxESkENPx/bD2TdE4/Py
npeZ9JPjvENvRWy6FiYwFo8ky/cSKHxoX65oTNCDaYFyOKjG7uP9jN/SPE+YA4+k
Cr5LMp00wNZ5XP3Is1kiuFC5KXbXaCPdptfmVpBje0zYudsfj5uCLUDnVTxuAa6P
dWWoRtek9QbF/2rWAOnVGfXvS1CK9zG8cVxzNuO8kQgo9123oFyuPN/U5w==
-----END CERTIFICATE-----
4. change permissions of sssd.conf
chmod 600 /etc/sssd/sssd.conf
5. Enable and start sssd daemon
systemctl enable sssd
systemctl start sssd
Check if sssd is working run by checking id on a user other than what you have in /etc/passwd , e.g. :
id cajucom
output should be something like this below:
uid=1016(cajucoma) gid=1016(cajucoma) groups=1016(cajucoma)
6. Use ldap as passwd and group database so
comment out your userid in /etc/passwd and /etc/group
7. use ldap userid and groupid for your home directory
chown -R madridn:madridn /home/madridn