{"id":9232,"date":"2021-06-20T23:42:15","date_gmt":"2021-06-20T20:42:15","guid":{"rendered":"https:\/\/kifarunix.com\/?p=9232"},"modified":"2024-03-18T20:34:51","modified_gmt":"2024-03-18T17:34:51","slug":"install-phpldapadmin-on-rocky-linux-8","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/install-phpldapadmin-on-rocky-linux-8\/","title":{"rendered":"Install phpLDAPadmin on Rocky Linux 8"},"content":{"rendered":"\n
In this guide, we are going to learn how to install phpLDAPadmin on Rocky Linux 8. phpLDAPadmin<\/a> is web application written in PHP for administering LDAP and thus it comes in very handy for system administrators who are gui centric. With it, you can administer LDAP via the browser.<\/p>\n\n\n\n Before you can proceed, learn how to install OpenLDAP on Rocky Linux 8 by following the link below;<\/p>\n\n\n\n Install and Setup OpenLDAP on Rocky Linux 8<\/a><\/p>\n\n\n\n Some of the required packages such phpLDAPadmin and php-ldap module, are not available on the default Rocky Linux 8 repositories.<\/p>\n\n\n\n As such, you need to install some third party repo.<\/p>\n\n\n\n Enable PHP 7.4 Remi module<\/p>\n\n\n\n Once the repos are in place, then run the command below to install phpLDAPadmin.<\/p>\n\n\n\n After installing phpLDAPadmin, proceed to configure it to connect to your openLDAP server.<\/p>\n\n\n\n To begin with, backup the default configuration file provided;<\/p>\n\n\n\n Open the configuration file, Scroll down the configuration file to the section;<\/p>\n\n\n\n Define a suitable name for your LDAP server. This name will appear on phpLDAPadmin web interface.<\/p>\n\n\n\n Set your OpenLDAP address, this can be a resolvable hostname or an IP address.<\/p>\n\n\n\n If your OpenLDAP server is listening on non default port, uncomment the highlighted line below and define the port. (Default port, 389\/tcp is used here)<\/p>\n\n\n\n Define your OpenLDAP base DNs.<\/p>\n\n\n\n If you want to define a static bind DN, set it under the section;<\/p>\n\n\n\n In this guide, we have chosen not define a static bind DN. Read the highlighted section above.<\/p>\n\n\n\n Define phpLDAPadmin login attribute. We use dn in this guide. You can use uid, if you want.<\/p>\n\n\n\n This will require a full DN for logging in.<\/p>\n\n\n\n Those are just but a few phpLDAPadmin configurations made in this guide. Be sure to make configurations to suit your needs.<\/p>\n\n\n\n First, you need a web server, which can be Apache or Nginx to be able to access phpLDAPadmin from the web browser.<\/p>\n\n\n\n We use Apache in this setup. Thus install it.<\/p>\n\n\n\n Next, you need to create web configuration for phpLDAPadmin to define how it is going to be access from the browser.<\/p>\n\n\n\n Save and exit the configuration file.<\/p>\n\n\n\n With this configuration, you will have to access phpLDAPadmin on browser using the URL, On the other hand, you can create an Apache VirtualHost for phpLDAPadmin as shown below. Be sure to make appropriate replacements in the configurations.<\/p>\n\n\n\n With this configuration, you can access phpLDAPadmin using the URL, Set the proper ownership of the document root as shown below;<\/p>\n\n\n\n Check apache for syntax errors.<\/p>\n\n\n\n If you get the output, Allow external access to Apache on firewalld, if it is running.<\/p>\n\n\n\n If SELinux is running, run the following commands to;<\/p>\n\n\n\n Allow httpd to connect to the network.<\/p>\n\n\n\n Allow httpd to connect to OpenLDAP server.<\/p>\n\n\n\n Resolve user passwd entries directly from ldap<\/p>\n\n\n\n To allow system to run with NIS.<\/p>\n\n\n\n Start and enable Apache to run on system boot.<\/p>\n\n\n\n You can now access phpLDAPadmin from any browser using the url. This will take you the phpLDAPadmin web interface.<\/p>\n\n\n\n Click login<\/strong> just below the name of your LDAP server to get a login interface. To login, you can specify your DN for example, Upon successful login, you should be able to see your LDAP structure.<\/p>\n\n\n\n If by clicking the schema you get the error below;<\/p>\n\n\n\n Our attempts to find your SCHEMA have failed (objectclasses)<\/strong><\/p>\n\n\n\n Then you need to enable anonymous read access to Subschema on the frontend LDAP database in order to fix this.<\/p>\n\n\n\n If you followed our guide to install and setup OpenLDAP server on Rocky Linux 8 whose link is provided above, then our current access control lists on the frontend database are;<\/p>\n\n\n\n To allow anyone to read the LDAP schema, you simply need to add the ACL below to frontend database as the first ACL.<\/p>\n\n\n\n Use LDIF file to implement this change.<\/p>\n\n\n\n Update the database.<\/p>\n\n\n\n List the access control lists again.<\/p>\n\n\n\n Restart both LDAP and Apache Service.<\/p>\n\n\n\n You should now be able to read your OpenLDAP schema and directory tree as well as administer OpenLDAP server from web using phpLDAPadmin.<\/p>\n\n\n\n That marks the end of our guide on how to install phpLDAPadmin.<\/p>\n\n\n\n Related OpenLDAP Tutorials<\/p>\n\n\n\n Configure SSSD for LDAP Authentication on Rocky Linux 8<\/a><\/p>\n\n\n\n Setup Apache Guacamole OpenLDAP Authentication<\/a><\/p>\n\n\n\nInstalling phpLDAPadmin on Rocky Linux 8<\/h2>\n\n\n\n
Install Required Third Party Repositories<\/h3>\n\n\n\n
\n
dnf install epel-release<\/code><\/pre>\n\n\n\n
\n
dnf install http:\/\/repo.iotti.biz\/CentOS\/8\/noarch\/lux-release-8-1.noarch.rpm<\/code><\/pre>\n\n\n\n
\n
dnf install https:\/\/rpms.remirepo.net\/enterprise\/remi-release-8.rpm<\/code><\/pre>\n\n\n\n
dnf module reset php<\/code><\/pre>\n\n\n\n
dnf module enable php:remi-7.4<\/code><\/pre>\n\n\n\n
Install phpLDAPadmin<\/h3>\n\n\n\n
dnf install phpldapadmin<\/code><\/pre>\n\n\n\n
\nDependencies resolved.\n============================================================================================================================================================================\n Package Architecture Version Repository Size\n============================================================================================================================================================================\nInstalling:\n phpldapadmin noarch 1.2.6.2-1.el8.lux lux 799 k\nInstalling dependencies:\n oniguruma5php x86_64 6.9.7.1-1.el8.remi remi-safe 210 k\n php-common x86_64 7.4.20-1.el8.remi remi-modular 1.2 M\n php-fpm x86_64 7.4.20-1.el8.remi remi-modular 1.6 M\n php-gd x86_64 7.4.20-1.el8.remi remi-modular 93 k\n php-json x86_64 7.4.20-1.el8.remi remi-modular 77 k\n php-ldap x86_64 7.4.20-1.el8.remi remi-modular 97 k\n php-mbstring x86_64 7.4.20-1.el8.remi remi-modular 529 k\n php-xml x86_64 7.4.20-1.el8.remi remi-modular 215 k\n\nTransaction Summary\n============================================================================================================================================================================\nInstall 9 Packages\n\nTotal download size: 4.8 M\nInstalled size: 26 M\nIs this ok [y\/N]: y\n<\/code><\/pre>\n\n\n\n
Configure phpLDAPadmin on Rocky Linux 8<\/h3>\n\n\n\n
cp \/etc\/phpldapadmin\/config.php{,.orig}<\/code><\/pre>\n\n\n\n
\/etc\/phpldapadmin\/config.php<\/strong><\/code> for editing;<\/p>\n\n\n\n
vim \/etc\/phpldapadmin\/config.php<\/code><\/pre>\n\n\n\n
\/*********************************************\n * Define your LDAP servers in this section *\n *********************************************\/<\/code><\/pre>\n\n\n\n
$servers->setValue('server','name','Kifarunix-demo LDAP master');<\/code><\/pre>\n\n\n\n
$servers->setValue('server','host','192.168.60.29');<\/code><\/pre>\n\n\n\n
\/* The port your LDAP server listens on (no quotes). 389 is standard. *\/\n\/\/ $servers->setValue('server','port',389);<\/strong><\/code><\/pre>\n\n\n\n
$servers->setValue('server','base',array('dc=ldapmaster,dc=kifarunix-demo,dc=com'));<\/code><\/pre>\n\n\n\n
\n\/* The DN of the user for phpLDAPadmin to bind with. For anonymous binds or\n 'cookie','session' or 'sasl' auth_types, LEAVE THE LOGIN_DN AND LOGIN_PASS\n BLANK. If you specify a login_attr in conjunction with a cookie or session\n auth_type, then you can also specify the bind_id\/bind_pass here for searching\n the directory for users (ie, if your LDAP server does not allow anonymous\n binds. *\/\n \/\/ $servers->setValue('login','bind_id','');\n# $servers->setValue('login','bind_id','cn=Manager,dc=example,dc=com');\n\n\/* Your LDAP password. If you specified an empty bind_id above, this MUST also\n be blank. *\/\n\/\/ $servers->setValue('login','bind_pass','');\n# $servers->setValue('login','bind_pass','secret');\n<\/code><\/pre>\n\n\n\n
\/\/ $servers->setValue('login','attr','uid');\n$servers->setValue('login','attr','dn');<\/strong><\/code><\/pre>\n\n\n\n
Create Web Server configuration for phpLDAPadmin<\/h3>\n\n\n\n
dnf install httpd<\/code><\/pre>\n\n\n\n
cat > \/etc\/httpd\/conf.d\/phpldapadmin.conf << 'EOL'\nAlias \/phpldapadmin \/usr\/share\/phpldapadmin\/htdocs\n\n<Directory \/usr\/share\/phpldapadmin\/htdocs>\n <IfModule mod_authz_core.c>\n Require all granted\n <\/IfModule>\n<\/Directory>\nEOL<\/code><\/pre>\n\n\n\n
http:\/\/ldap-server-hostname-OR-IP\/phpldapadmin<\/code><\/strong>.<\/p>\n\n\n\n
cat > \/etc\/httpd\/conf.d\/phpldapadmin.conf 'EOL'\n<VirtualHost *:80>\n ServerName ldapmaster.kifarunix-demo.com\n DocumentRoot \/usr\/share\/phpldapadmin\/htdocs\n \n <Directory \/usr\/share\/phpldapadmin\/htdocs>\n <IfModule mod_authz_core.c>\n # Apache 2.4\n Require all granted\n <\/IfModule>\n <\/Directory>\n ErrorLog \/var\/log\/httpd\/phpldapadmin.error.log\n CustomLog \/var\/log\/httpd\/phpldapadmin.access.log combined\n<\/VirtualHost>\nEOL<\/code><\/pre>\n\n\n\n
http:\/\/ldap-server-hostname-OR-IP<\/code><\/strong>.<\/p>\n\n\n\n
chown -R apache:apache \/usr\/share\/phpldapadmin<\/code><\/pre>\n\n\n\n
httpd -t<\/code><\/pre>\n\n\n\n
Syntax OK<\/strong><\/code>, then you good to go. Otherwise, fix any would be error before you can proceed.<\/p>\n\n\n\n
Configure FirewallD<\/h3>\n\n\n\n
firewall-cmd --add-port=80\/tcp --permanent<\/code><\/pre>\n\n\n\n
firewall-cmd --reload<\/code><\/pre>\n\n\n\n
Configure SELinux<\/h3>\n\n\n\n
setsebool -P httpd_can_network_connect 1<\/code><\/pre>\n\n\n\n
setsebool -P httpd_can_connect_ldap 1<\/code><\/pre>\n\n\n\n
setsebool -P authlogin_nsswitch_use_ldap 1<\/code><\/pre>\n\n\n\n
setsebool -P nis_enabled 1<\/code><\/pre>\n\n\n\n
Running Apache<\/h4>\n\n\n\n
systemctl enable --now httpd<\/code><\/pre>\n\n\n\n
Accessing phpLDAPadmin on Rocky Linux 8<\/h3>\n\n\n\n
http:\/\/server-hostname-or-IP\/phpldapadmin<\/code><\/strong> or
http:\/\/server-hostname-or-IP<\/code><\/strong> depending on your configuration.<\/p>\n\n\n\n
<\/figure>\n\n\n\n
cn=admin,dc=ldapmaster,dc=kifarunix-demo,dc=com<\/strong><\/code>.<\/p>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:\/\/\/ -b cn=config '(olcDatabase={-1}frontend)' olcAccess<\/code><\/pre>\n\n\n\n
dn: olcDatabase={-1}frontend,cn=config\nolcAccess: {0}to * by dn.base=\"gidNumber=0+uidNumber=0,cn=peercred,cn=externa\n l,cn=auth\" manage by * none<\/code><\/pre>\n\n\n\n
to dn.base=\"cn=Subschema\" by * read<\/code><\/pre>\n\n\n\n
vim read-access-to-subschema.ldif<\/code><\/pre>\n\n\n\n
dn: olcDatabase={-1}frontend,cn=config\nchangetype: modify\nadd: olcAccess\nolcAccess: {0}to dn.base=\"cn=Subschema\" by * read<\/code><\/pre>\n\n\n\n
ldapadd -H ldapi:\/\/\/ -Y EXTERNAL -f read-access-to-subschema.ldif<\/code><\/pre>\n\n\n\n
ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:\/\/\/ -b cn=config '(olcDatabase={-1}frontend)' olcAccess<\/code><\/pre>\n\n\n\n
dn: olcDatabase={-1}frontend,cn=config\nolcAccess: {0}to dn.base=\"cn=Subschema\" by * read\nolcAccess: {1}to * by dn.base=\"gidNumber=0+uidNumber=0,cn=peercred,cn=externa\n l,cn=auth\" manage by * none<\/code><\/pre>\n\n\n\n
systemctl restart httpd slapd<\/code><\/pre>\n\n\n\n
<\/figure>\n\n\n\n