starlingx/docs
Code Issues Proposed changes
df365480a3
docs/doc/source/security/kubernetes/create-ldap-linux-accounts.rst
Ron Stone d777022a6e fix reference (pick) 
Correct markup on :ref: that was exposed to HTML

Signed-off-by: Ron Stone <ronald.stone@windriver.com>
Change-Id: Ie1ea420b41e4f56c9658fb2eb06649a5409d37eb
2021-11-05 12:46:38 +00:00

3.0 KiB
Raw Blame History

Create LDAP Linux Accounts

includes a script for creating Linux accounts.

Note

For security reasons, it is recommended that ONLY admin level users be allowed to to the nodes of the . Non-admin level users should strictly use remote or remote web GUIs.

The ldapusersetup command provides an interactive method for setting up Linux user accounts.

Centralized management is implemented using two servers, one running on each controller node. server synchronization is automatic using the native content synchronization protocol.

A set of commands is available to operate on user accounts. The commands are installed in the directory /usr/local/sbin, and are available to any user account in the sudoers list. Included commands are lsldap, ldapadduser, ldapdeleteuser, and several others starting with the prefix ldap.

Use the command option --help on any command to display a brief help message, as illustrated below.

$ ldapadduser --help
Usage : /usr/local/sbin/ldapadduser <username> <groupname | gid> [uid]
$ ldapdeleteuser --help
Usage : /usr/local/sbin/ldapdeleteuser <username | uid>

For convenience, identify the user's Keystone account user name in .

  1. Log in as sysadmin, and start the ldapusersetup script.

    controller-0: ~$ sudo ldapusersetup

  2. Follow the interactive steps in the script.

    1. Provide a user name.

      Enter username to add to |LDAP|:
      Successfully added user user1 to |LDAP|
Successfully set password for user user1

    2. Specify a secondary user group for this user.

      Add user1 to secondary user group (yes/No):

    3. Change the password duration.

      Enter days after which user password must be changed [90]:
      Successfully modified user entry uid=ldapuser1, ou=People, dc=cgcs, dc=local in |LDAP|
Updating password expiry to 90 days

    4. Change the warning period before the password expires.

      Enter days before password is to expire that user is warned [2]:
      Updating password expiry to 2 days

On completion of the script, the command prompt is displayed.

controller-0: ~$

The account is created. For information about the user login process, see For StarlingX and Platform OpenStack CLIs from a Local LDAP Linux Account Login <establish-keystone-credentials-from-a-linux-account>.