Overstimulus Alexus -

May. 16th, 2009

12:57 PM

In case you were wondering, here's how you use the command line to manually bind a Mac client to a 3rd party LDAP server and Kerberos realm...

$ sudo dscl /Search create / SearchPolicy CSPSearchpath
$ sudo defaults write /Library/Preferences/DirectoryService/DirectoryService LDAPv3 Active
$ sudo killall DirectoryService
$ sudo dsconfigldap -v -a servername.domain.com -n servername -u directoryadmin -p adminpassword -l clientadmin -q clientpassword
$ sudo dscl /Search append / CSPSearchPath /LDAPv3/servername.domain.com
$ sudo /usr/sbin/sso_util configure -r servername.domain.com -a diradmin -p adminpassword -f /LDAPv3/servername.domain.com -v 1 all

Comments

( 6 comments — Leave a comment )

latemodel wrote:

May. 16th, 2009 06:24 pm (UTC)

Isn't entering your password on the cmd line bad practice?

Link | Reply | Thread

overstim wrote:

May. 16th, 2009 07:15 pm (UTC)

well I certainly wouldn't want to save my passwords in a script, but it's fine to enter them manually- they're not logged- only the dirt command logs your password AFAIK. And as long as youre using SSL youre good. You won't get far without entering passwords- most of the ldap* and slap* commands require it.

Link | Reply | Parent | Thread

latemodel wrote:

May. 19th, 2009 01:34 am (UTC)

My recollection from Linux world — it may well be different on Macs — is that the problem is that your password is then visible in /etc/proc because the process info includes the exact command used to invoke it. The info is usually only there briefly, of course, but it's there and can easily be trapped by any user who has shell access to the machine.

Link | Reply | Parent | Thread

overstim wrote:

May. 19th, 2009 02:25 am (UTC)

well, there is no /etc/proc on OS X; if this is equivalent to ps or top, they don't list the path.

it DOES show up in the bash history, though.

Link | Reply | Parent | Thread