LDAP is a protocol that helps us to access the database on different types of platforms. To implement LDAP on a Linux server, you need to download OpenLDAP Software. It is open source software. OpenLDAP Software comprises mainly two basic daemons:

• slapd (Stand-alone LDAP daemon)
• OpenLDAP server configuration file is called slapd.conf.
• It provides authentication services through SASL (Simple Authentication and Security Layer).
• It uses TLS (Transport Layer Security) for privacy concerns.
• It allows or restricts access to the server by using TCP wrappers.
• One of the most important functions of slapd is to provide a reliable access control facility.
• slurpd (stand-alone LDAP update replication daemon)
• This is used to replicate the database of LDAP directory.
• The master slapd server updates the slave server by using slurpd.
• It helps the master slapd server in distributing the load among the slave servers.

To unpack the downloaded gzipped package, you have to copy the package to a desirable directory such as /usr/local

Requirements before installation: Before installing OpenLDAP software, the LDAP server requires some additional packages:

• OpenSSL TLS libraries: Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols that provide security over the network. These are used to encrypt the segments of a network connection.
• Kerberos Authentication Services: It is a distributed authentication service.
• Database software like Berkeley DB: It stores the database using Oracle Berkeley DB package.
• TCP Wrappers: These are used in the servers having non public information.

Installation: You can install OpenLDAP in either of the two ways.

• Use apt-get/dpkg to install the binary package.



• Install OpenLDAP from sources and unpack the tar gzipped package to a desirable directory.

  

Run the following commands to build the server.

Overview of LDAP Backends:

1. BDB (Berkeley Database Backend): The BDB backend is used with a normal slapd database. It stores data with the help of Oracle Berkeley DB package.
2. LDAP: The LDAP backend is not a real database; it only forwards the incoming requests to another LDAP server.
3. LDIF (LDAP Data Interchange Format): LDIF is a text-based format for representing the LDAP contents.
4. Metadirectory: The Meta backend is similar to the LDAP backend. It acts as a proxy to forward requests to a set of remote LDAP servers called target.
5. Monitor: The running status of daemon is dynamically maintained by this backend.
6. Null: Null backend searches return success, and updates them. The slapadd and slapcat tools are also very useful.
7. Passwd: The Passwd backend lists the information stored in a system passwd file.
8. Perl/Shell: This backend can be used after installing the Perl module. Perl scripts are used for interacting with the LDAP directories.
9. SQL: The SQL backend is used with RDBMS (Relational Database Management System).

Developing LDAP Applications with Perl: perl-ldap provides an easy access to data contained in LDAP directories. You can write basic Perl scripts to interact with an LDAP directory. You need to download the following two packages:

1. Convert-BER-1.31.tar.gz
2. perl-ldap-0.15.tar.gz

You can unpack and install the Convert-BER-1.31.tar.gz package using the following commands.

Use the following commands to unpack and install perl-ldap-0.15.tar.gz.

Now you are able to write basic Perl scripts to interact with an LDAP directory. You can use the following statement to invoke perl-ldap:

After invoking, you have to open a new LDAP connection. Below is an example of how to connect to a computer with the hostname ldapserver.ucertify.com:

By default, LDAP uses port 389. If you want to use a different port, you need to mention it:

You can also set the timeout parameter:

Binding to the Server: After creating a connection to an LDAP server, you need to bind to it:

To close a connection, you must unbind from it:

Adding Entries to the Database: You can add LDAP entries to the directory:

Searching the directory: The ->search function is used to search the LDAP directory:

It searches the entire LDAP tree. You can confine your search only to the ou=People branch using the following command:

Modifying the directory: There are three types of modifications that can be performed in an LDAP directory:

• add
• delete
• replace

Summary: perl-ldap is a convenient tool for accessing LDAP servers with Perl scripts. Now a days, LDAP is emerging as a global directory providing service to a much broader context.

Linux operating systems are predominantly known for their use in different types of servers. These are installed on a wide variety of computer hardware, ranging from embedded devices and mobile phones to supercomputers. A Senior Level Linux Professional should be able to measure hardware resources and network bandwidth usage of a Linux system. There are so many tools (command-line as well as graphical tools) supported by different Linux distributions described in this article:

• vmstat: vmstat (virtual memory statistics) is a computer system monitor tool that collects and displays summary information about operating system memory, processes, interrupts, paging, and block I/O information. By specifying the interval, it can be used to observe system activity interactively. The vmstat tool is available on most UNIX and Unix-like operating systems, such as Linux. The syntax and output of vmstat often differs slightly between different operating systems.
• iostat: iostat (input/output statistics) is a computer system monitor tool used to collect and show operating system storage input and output statistics. It is often used to identify performance issues with local disks or networked file systems such as NFS. The iostat tool is available on most UNIX and Unix-like operating systems, such as Linux or Solaris. The syntax and output of iostat often differs slightly between different operating systems. Some of the options used with this tool are given below:
  

  Option	Description
  -k	Display statistics in kilobytes per second instead of blocks per second.
  -V	Print version number and usage, then exit.
  -c	Display only the CPU usage statistics.
  -p	Display statistics for block devices and all their partitions that are used by the system.
  -d	Display only the device utilization report.

• mpstat: mpstat is a computer command-line tool used in the Linux operating system to report (on the screen) processor-related statistics. It is used in computer monitoring in order to diagnose problems or for build statistics about a computer’s CPU usage. The mpstat command writes to standard output activities for each available processor and can be used both on SMP and UP machines. The general format of the mpstat command is given below:

  $ mpstat

  The mpstat command can also be used to find out the details of a multi-processor computer as shown below:

  $ mpstat -P

• free: The free command displays the total amount of free and used physical and swap memory in the computer. This command also displays the buffers used by the kernel. The free command uses the file /proc/meminfo. Some of the options used with the free command are given below:
  

  Option	Description
  -b	Display the amount of memory in bytes.
  -k	Display the amount of memory in kilobytes.
  -m	Display the amount of memory in megabytes.
  -o	Disable the display of a buffer adjusted line.
  -t	Display a line comprising the total memory.
  -V	Display version information.

• sar: The sar command writes to the information of selected cumulative activity counters in the operating system. This command operates on the values in the count and interval parameters. The sar command writes information the specified number of times spaced at the specified intervals in seconds. It evaluates the key metrics and provides a technique to retrieve the measurements. Some of the options used with the sar command are given below:
  

  Option	Description
  -A	Display everything.
  -b	Show transactions and blocks sent to block devices and read from block devices.
  -B	Show swap statistics.
  -d	Display disk usage including wait, service time, and queue length.
  -r	Display information about memory, swap, cache, and buffer usage.
  -e	Specify time-out for display.
  -q	Display information about the run queue and total process list sizes, and load averages.

• Htop: Htop is an advanced, interactive system monitor process viewer written for Linux. It is designed to replace the Unix program top. It shows a frequently updated list of the processes running on a computer, normally ordered by the amount of CPU usage. Htop provides a full list of processes running. Htop also uses color and gives visual information about processor, swap, and memory status. Htop provides a more convenient, cursor-controlled interface for killing processes. The output of Htop is shown below:

  

• tload: The tload command prints a graph of the current system load average to the specified tty. It provides a graphic representation of the system load average. The general syntax of using tload is given below:

  tload [-V] [-s scale] [-d delay] [tty]

  where,

  • The -s scale option allows a vertical scale to be specified for the display.
  • The -d delay option sets the delay between graph updates in seconds.
• bwm-ng: bwm-ng (Bandwidth Monitor-Next Generation) is a live bandwidth monitor that is used to analyze the current bandwidth of all or some specific interfaces. It automates the monitoring and display of the total bandwidth. It supports different output methods such as curses, plain, csv, and html. The behavior of bwm-ng can be controlled by a configuration file. By default, bwm-ng first checks the /etc/bwm-ng.conf file for information and then the ~/.bwm-ng.conf file. It can use other locations as well if required.
• iftop: iftop is a command-line tool that is used to display bandwidth usage on an interface by host. It listens to network traffic on a specified interface and displays a table of current bandwidth usage by pairs of hosts. The iftop command requires sufficient permissions to monitor all network traffic on the interface. Some of the commands used with iftop are given below:
  

  Option	Description
  -h	Print a summary of usage.
  -P	Turn on port display.
  -b	Don’t display bar graphs of traffic.
  -N	Do not resolve port number to service names.

• tcpdump: tcpdump is a tool that dumps traffic on a network. It prints out the headers of packets regarding the boolean expression. Only those packets that match the Boolean expression are processed by tcpdump. Some of the options used with tcpdump are given below:
  

  Option	Description
  -A	Print each packet in ASCII.
  -c	Exit after receiving count packets.
  -e	Print the link-level header on each dump line.
  -t	Don’t print a timestamp on each dump line.

• Driftnet: Driftnet is a graphical tool that captures images from network traffic. It analyses the network traffic and displays JPEG and GIF images in an X window. Driftnet is also known as graphical tcpdump. The images may be saved by clicking on them. Some of the options used with this tool are given below:
  

  Option	Description
  -h	Print a summary of usage.
  -v	Print additional information about the packets captured to the terminal.
  -p	Do not put the interface into promiscuous mode.
  -S	Capture audio only.

• Ttcp: Ttcp is a utility program for measuring network throughput, popular on UNIX systems. For normal use, Ttcp is installed on two machines – one will be the sender, the other the receiver. The receiver is started first and waits for a connection. Once the two connect, the sending machine sends data to the receiver and displays the overall throughput of the network they traverse. The amount of data sent and other options are configurable through a simple command-line interface. The output is generally in kB/s (kilobytes per second) instead of kbit/s (kilobits per second). Ttcp determines the transmission and reception of data between two systems using the UDP or TCP protocols.

ypbind is a UNIX/Linux daemon that finds the server for an NIS domain and stores the information in a file. The binding files reside in the directory /var/yp/binding and are conventionally named [domainname].[version]. After establishing the binding, the ypbind daemon sends YPPROC_DOMAIN requests to the NIS server at 20-second intervals. It searches a new server if no response is found. If more than one response is found, ypbind sends a ping request to all of the servers and binds with the one that responds first.

tdbdump is a tool for printing the contents of a TDB file. This tool is a part of the samba suite and is used to store the contents of a TDB (Trivial DataBase) file to the standard output when debugging problems with TDB files. The samba database (such as secrets.tdb) can be checked by the tdbdump tool.

ypldapd is a tool that is used to start the NIS/LDAP Gateway daemon. NIS/LDAP Gateway is a Network Information Service (NIS) server that uses LDAP as its information source. It allows existing NIS clients to transparently use LDAP to access user, group, and host information. It also supports the Microsoft services for UNIX Active Directory schema. ypldapd caches NIS maps for maximum performance.

Shared libraries are libraries that are used by programs when the corresponding program runs on the system. A shared library is automatically recognized by the programs after they are installed, and the programs automatically start using the new shared library. Shared libraries must be placed somewhere in the filesystem. The ldd command is used to see the list of shared libraries used by a program.

The accesslog overlay is used to record accesses to the databases, mainly the backend databases. This overlay enables users to review all the activities of the given database using LDAP queries. Users can use various logging types and automatically reduce log records from the logging database. These log records are saved in the audit schema. The accesslog overlay is also used with delta-syncrepl replication.

slapo-auditlog is an auditlog overlay that is used to record all the changes on a particular backend database to a specific log file. This overlay can be used to record changes as standard LDIF with an additional comment header giving the timestamp of the change and the identity of the user that has changed the database. The configuration file of the auditlog overlay is /etc/openldap/slapd.conf (the default slapd configuration file).

The TLSVerifyClient directive belongs to the global directives section of slapd.conf. This specifies the checks that are to be operated on client certificates in an incoming TLS session. Below is the list of options used with this directive:

• never: Never ask the client for a certificate.
• allow: Ask the client for a certificate.
• try: If none is provided, the session proceeds normally.
• demand: A valid certificate must be provided, otherwise the session is immediately terminated.

The structural object-class usually defines the identity of an object, whereas the auxiliary object-class is used to add attributes. Some common examples of the structural object-classes are organizationalUnit, inetOrgPerson, etc. The auxiliary object-classes are usually used in extensions such as authentication. An entry must contain one and only one structural object-class, whereas it may contain any number of auxiliary object-classes.