Sunday, December 20, 2015

How to Increase the size of a Linux LVM by expanding the virtual machine disk


Hello Guys,
I was working on my virtual machine and suddenly i got this isssue that i dont have disk space left. and then i started increasing the disk sapce from 20G to make the disk space to 30G.

This post will cover how to increase the disk space for a Oracle VirtualBox virtual machine running Linux that is using logical volume manager (LVM). Firstly we will be increasing the size of the actual disk on the Oracle VirtualBox virtual machine, so at the hardware level – this is the VM’s .vmdk file. Once this is complete we will get into the virtual machine and make the necessary changes through the operating system in order to take advantage of the additional space that has been provided by the hard drive being extended. This will involve creating a new partition with the new space, expanding the volume group and logical group, then finally resizing the file system.

Important Note: Be very careful when working with the commands in this article as they have the potential to cause a lot of damage to your data. If you are working with virtual machines make sure you take a snapshot of your virtual machine beforehand, or otherwise have some other form of up to date backup before proceeding. Note that a snapshot must not be taken until after the virtual disk has been increased, otherwise you will not be able to increase it. It could also be worth cloning the virtual machine first and testing out this method on the clone.
Prerequisites: As this method uses the additional space to create a primary partition, you must not already have 4 partitions as you will not be able to create more than 4. If you do not have space for another partition then you will need to consider a different method, there are some others in the above list.
As this method focuses on working with LVM, we will first confirm that our partition type is actually Linux LVM by running the below command.
fdisk -l
fdisk
As you can see in the above image /dev/sda5 is listed as “Linux LVM” and it has the ID of 8e. The 8e hex code shows that it is a Linux LVM, while 83 shows a Linux native partition. Now that we have confirmed we are working with an LVM we can continue. For increasing the size of a Linux native partition
Below is the disk information showing that our initial setup only has the one 20gb disk currently, which is under the logical volume named /dev/mapper/Mega-root – this is what we will be expanding with the new disk.
disk free
Note that /dev/mapper/Mega-root is the volume made up from /dev/sda5 currently – this is what we will be expanding.
first click on windows button on you workstation and then type "cmd"  in then   it will open a command prompt go to path  "C:\Program Files\Oracle\VirtualBox"
 By using Command

C:\Users\nrathi>cd C:\Program Files\Oracle\VirtualBox

after that locate your vdi file for the vm like in my case the path is "C:\Users\nrathi\VirtualBox VMs\ubuntu\ubuntu.vdi"

Then use the below command in the command prompt to increase the dick space

c:\Users\nrathi> "C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" modifyhd   "C:\Users\nrathi\VirtualBox VMs\ubuntu\ubuntu.vdi" --resize 30G

after using this command your disk space will increase to 30G but your Guest os still can access only 20G bacause of the LVM now we need to fix that too 

so lets start doing that.

Below is an image after performing this and confirming that the new space is displaying.
fdisk

Partition the new disk space

As outlined in my previous images the disk in my example that I am working with is /dev/sda, so we use fdisk to create a new primary partition to make use of the new expanded disk space. Note that we do not have 4 primary partitions already in place, making this method possible.
fdisk /dev/sda
We are now using fdisk to create a new partition, the inputs I have entered in are shown below in bold. Note that you can press ‘m’ to get a full listing of the fdisk commands.
‘n’ was selected for adding a new partition.
WARNING: DOS-compatible mode is deprecated. It's strongly recommended to
         switch off the mode (command 'c') and change display units to
         sectors (command 'u').

Command (m for help): n
‘p’ is then selected as we are making a primary partition.
Command action
   l   logical (5 or over)
   p   primary partition (1-4)
p
As I already have /dev/sda1 and /dev/sda2 as shown in previous images, I have gone with using ‘3’ for this new partition which will be created as /dev/sda3
Partition number (1-4): 3
We just press enter twice above as by default the first and last cylinders of the unallocated space should be correct. After this the partition is then ready.
First cylinder (2611-3916, default 2611): "enter"
Using default value 2611
Last cylinder, +cylinders or +size{K,M,G} (2611-3916, default 3916): "enter"
Using default value 3916
‘t’ is selected to change to a partition’s system ID, in this case we change to ‘3’ which is the one we just created.
Command (m for help): t
Partition number (1-5): 3
The hex code ‘8e’ was entered as this is the code for a Linux LVM which is what we want this partition to be, as we will be joining it with the original /dev/sda5 Linux LVM.
Hex code (type L to list codes): 8e
Changed system type of partition 3 to 8e (Linux LVM)
‘w’ is used to write the table to disk and exit, basically all the changes that have been done will be saved and then you will be exited from fdisk.
Command (m for help): w
The partition table has been altered!

Calling ioctl() to re-read partition table.

WARNING: Re-reading the partition table failed with error 16: Device or resource busy.
The kernel still uses the old table. The new table will be used at
the next reboot or after you run partprobe(8) or kpartx(8)
Syncing disks.
You will see a warning which basically means in order to use the new table with the changes a system reboot is required. If you can not see the new partition using “fdisk -l” you may be able to run “partprobe -s” to rescan the partitions. In my test I did not require either of those things at this stage (I do a reboot later on), straight after pressing ‘w’ in fdisk I was able to see the new /dev/sda3 partition of my 10gb of space as displayed in the below image.
For CentOS/RHEL run a “partx -a /dev/sda3” to avoid rebooting later on.
fdisk
That’s all for partitioning, we now have a new partition which is making use of the previously unallocated disk space from the increase in VMware.

Increasing the logical volume

We use the pvcreate command which creates a physical volume for later use by the logical volume manager (LVM). In this case the physical volume will be our new /dev/sda3 partition.
root@Mega:~# pvcreate /dev/sda3
  Device /dev/sda3 not found (or ignored by filtering).
In order to get around this you can either reboot, or use partprobe/partx as previously mentioned to avoid a reboot, as in this instance the disk does not appear to be there correctly despite showing in “fdisk -l”. After a reboot or partprobe/partx use the same command which will succeed.
root@Mega:~# pvcreate /dev/sda3
  Physical volume "/dev/sda3" successfully created
Next we need to confirm the name of the current volume group using the vgdisplay command. The name will vary depending on your setup, for me it is the name of my test server. vgdisplay provides lots of information on the volume group, I have only shown the name and the current size of it for this example.
root@Mega:~# vgdisplay
  --- Volume group ---
  VG Name               Mega
...
VG Size               19.76 GiB
Now we extend the ‘Mega’ volume group by adding in the physical volume of /dev/sda3 which we created using the pvcreate command earlier.
root@Mega:~# vgextend Mega /dev/sda3
  Volume group "Mega" successfully extended
Using the pvscan command we scan all disks for physical volumes, this should confirm the original /dev/sda5 partition and the newly created physical volume /dev/sda3
root@Mega:~# pvscan
  PV /dev/sda5   VG Mega   lvm2 [19.76 GiB / 0    free]
  PV /dev/sda3   VG Mega   lvm2 [10.00 GiB / 10.00 GiB free]
  Total: 2 [29.75 GiB] / in use: 2 [29.75 GiB] / in no VG: 0 [0   ]
Next we need to increase the logical volume (rather than the physical volume) which basically means we will be taking our original logical volume and extending it over our new partition/physical volume of /dev/sda3.
Firstly confirm the name of the logical volume using lvdisplay. This name will vary depending on your setup.
root@Mega:~# lvdisplay
  --- Logical volume ---
  LV Name                /dev/Mega/root
The logical volume is then extended using the lvextend command.
root@Mega:~# lvextend /dev/Mega/root /dev/sda3
  Extending logical volume root to 28.90 GiB
  Logical volume root successfully resized
There is then one final step which is to resize the file system so that it can take advantage of this additional space, this is done using the resize2fs command for ext based file systems. Note that this may take some time to complete, it took about 30 seconds for my additional space.
root@Mega:~# resize2fs /dev/Mega/root
resize2fs 1.41.12 (17-May-2010)
Filesystem at /dev/Mega/root is mounted on /; on-line resizing required
old desc_blocks = 2, new_desc_blocks = 2
Performing an on-line resize of /dev/Mega/root to 7576576 (4k) blocks.
The filesystem on /dev/Mega/root is now 7576576 blocks long.
Alternatively if you’re running the XFS file system (default as of RedHat/CentOS 7) you can grow the file system with “xfs_growfs /dev/Mega/root”.
That’s it, now with the ‘df’ command we can see that the total available disk space has been increased.
disk free after expansion

SO We have successfully increase the disk space from 20G to 30G.

Thanks guys.and let me know if you want any help with linux...

Once Again...
Happy To Help You.....

Thursday, October 22, 2015

Setting Secure LDAP and Authenticating client with Secure LDAP Server

Hello boys,

follow All the post of my previous 2 blogs it will help you to setup LDAP server and authenticating client using LDAP now lets move 1 step ahead and start making our ldap server secure.

Enable SSL in OpenLDAP Server

Using encrypted sessions we can secure LDAP communication.  Transport Layer Security (TLS) is used for this purpose. Recent releases of  slapd  in Ubuntu is compiled with support for GnuTLS instead of OpenSSL, there for we need to install following packages now.
$sudo apt-get install gnutls-bin
After that we need to create certificate authority(CA) for this purpose.
#certtool --generate-privkey > /etc/ssl/private/cakey.pem
After that create a template file(/etc/ssl/ca.info) to assist the creation of self-sign CA.
cn = Example Company
ca
cert_signing_key
Now sign the generated CA.
#certtool --generate-self-signed \
--load-privkey /etc/ssl/private/cakey.pem \ 
--template /etc/ssl/ca.info \
--outfile /etc/ssl/certs/cacert.pem


Now create the key for slapd and sign it using generated CA.

#certtool --generate-privkey \
--outfile /etc/ssl/private/slapd01_key.pem
Create a template file.(/etc/ssl/slapd01.info)
organization = Example
cn = ldap01.example.com
tls_www_server
encryption_key
signing_key
expiration_days = 3650
Create a certificate and sign it with previously created CA.
#certtool --generate-certificate \
--load-privkey /etc/ssl/private/slapd01_key.pem \
--load-ca-certificate /etc/ssl/certs/cacert.pem \
--load-ca-privkey /etc/ssl/private/cakey.pem \
--template /etc/ssl/slapd01.info \
--outfile /etc/ssl/certs/slapd01.pem

Once the certificate is generated , now we need to tell LDAP about the created SSL certificate, for that we  need to create a LDIF file as below. (/etc/ssl/certinfo.ldif)
dn: cn=config
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/slapd01.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/slapd01_key.pem
Now add it to the LDAP.
$sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ssl/certinfo.ldif
Also make sure to grant read access to openldap user to each of below files and locations.
$chown openldap:openldap /etc/ssl/private/cakey.pem \
/etc/ssl/private/slapd01_key.pem  /etc/ssl/certs/cacert.pem   /etc/ssl/certs/slapd01.pem 
$chown -R openldap:openldap /etc/ssl/private 
Now enable SSL in /etc/default/slapd as below and restart the slapd daemon.(add ldaps:/// entry additionally.)
SLAPD_SERVICES="ldap:/// ldapi:/// ldaps:///"
/etc/init.d/slapd  restart

Now lets see how to access the secured LDAP server.

Configure DHCP server to access secured LDAP 

In http://mageconfig.blogspot.com/2014/10/configure-isc-dhcp-server-with-openldap.html  post I have already configured ISC DHCP to communicate with OpenLDAP server, therefor in here I will only show the extra steps required to communicate with secured OpenLDAP server.

In the DHCP server configuration file, change as below and restart the DHCP server.
/etc/dhcp/dhcpd.conf
ldap-server                 "localhost";
ldap-port 636;
ldap-ssl ldaps;
ldap-tls-reqcert never; #Telling Not to verify certificates as we have used self sign certs
ldap-base-dn                "ou=dhcp,dc=example,dc=com";
ldap-method                 static;
ldap-debug-file             "/var/log/dhcp-ldap-startup.log";
ldap-dhcp-server-cn         "server"

Configure Ubuntu Server to Authenticate with Secured LDAP

As I have explained the procedure above I will only show you the extra configurations needed. As I have used self sign certificates in here also I will disable certificate checks.

/etc/ldap.conf

.
.
uri ldaps://IpAddressOfLDAPServer:636/
.
.
ssl on
.
.
TLS_REQCERT never 
tls_checkpeer no . .
  
Now  on client machine I hope you have followed the previous blogs for setup ldap auth .now copy the cacaert.pem from server to client machine as it will required to validate the server certificate.

# scp /etc/ssl/certs/cacert.pem  root@<ip-address-of-client-mahine>:/etc/ssl/certs/

After that on client machine  add the below line

TLS_REQCERT allow #Which tells not to validate self sign certs

now Its a time for testing guys.

$ldapsearch -x  -H ldaps://ldap.example.com -b dc=example,dc=com

if its promts for password that means every thing is ok and now we can reconfigure the ldap-auth-config
$sudo dpkg-reconfigure ldap-auth-config


  • LDAP server Uniform Resource Identifier: ldaps://LDAP-server-IP-Address
    • Change the initial string from "ldapi:///" to "ldap://" before inputing your server's information
  • Distinguished name of the search base:
    • This should match the value you put in your LDAP server's /etc/phpldapadmin/config.phpfile.
    • Search for: " 'server','base',array " within the file.
    • Our example was "dc=test,dc=com"
  • LDAP version to use: 3
  • Make local root Database admin: Yes
  • Does the LDAP database require login? No
  • LDAP account for root:
    • This should also match the value in your /etc/phpldapadmin/config.php.
    • Search for: " 'login','bind_id' " within the file
    • Our example was "cn=admin,dc=test,dc=com"
  • LDAP root account password: Your-LDAP-root-password
and we are done. if you are still not getting authenticated then restart the nscd service as it may happen that connection timeout has happen if its still not working then check into the 

/var/log/authlog

Thanks guys let me know if you still have any questions... 

Wednesday, October 14, 2015

Authenticate Client Computers Using LDAP on an Ubuntu 12/14.04

Hello Guys 

welcome back again now the final touch to our ldap server and its auth.but before that let me refer to my previous blog explaining the setup of ldap server.

I will assume that you have gone through my previous blog and setup your own LDAp server with basic config so lets move ahead

Install Client Packages

On the client machine, you will needs to install a few packages to make authentication function correctly with an LDAP server.
You can install them from the default Ubuntu repositories with the following commands:
sudo apt-get update
sudo apt-get install libpam-ldap nscd
You will be asked a variety of questions similar to the those asked when you were installing the server components.
  • LDAP server Uniform Resource Identifier: ldap://LDAP-server-IP-Address
    • Change the initial string from "ldapi:///" to "ldap://" before inputing your server's information
  • Distinguished name of the search base:
    • This should match the value you put in your LDAP server's /etc/phpldapadmin/config.phpfile.
    • Search for: " 'server','base',array " within the file.
    • Our example was "dc=test,dc=com"
  • LDAP version to use: 3
  • Make local root Database admin: Yes
  • Does the LDAP database require login? No
  • LDAP account for root:
    • This should also match the value in your /etc/phpldapadmin/config.php.
    • Search for: " 'login','bind_id' " within the file
    • Our example was "cn=admin,dc=test,dc=com"
  • LDAP root account password: Your-LDAP-root-password
If you make a mistake and need to change a value, you can go through the menu again by issuing this command:
sudo dpkg-reconfigure ldap-auth-config

Configure Client Software

We have to adjust a few files to tell our authentication files that they can look to our LDAP server for authentication information.
First, edit the /etc/nsswitch.conf file. This will allow us to specify that the LDAP credentials should be modified when users issue authentication change commands.
sudo nano /etc/nsswitch.conf
The three lines we are interested in are the "passwd", "group", and "shadow" definitions. Modify them to look like this:
passwd:         ldap compat
group:          ldap compat
shadow:         ldap compat
Next, we will add a value to our PAM configuration.
PAM, or Pluggable Authentication Modules, is a system that connects applications that can provide authentication to applications that require authentication.
PAM is already implemented on most computers, and works behind the scenes without needing user interaction. When we installed and configured our LDAP PAM module, most of the needed information was added to the configuration files.
Edit the /etc/pam.d/common-session file:
sudo nano /etc/pam.d/common-session
Add a line to the bottom of the configuration that reads:
session required    pam_mkhomedir.so skel=/etc/skel umask=0022
This will create a home directory on the client machine when an LDAP user logs in who does not have a home directory.
We have to restart a service for these changes to be implemented:
sudo /etc/init.d/nscd restart

Permissions

During the LDAP server configuration, we created a group called "admin". This was not chosen at random. It coincides with the "admin" group that is created by default on Ubuntu machines.
The LDAP users that you added to the "admin" group will have access to the sudo command.
This is because we have a line that gives members of the "admin" group sudo access within the/etc/sudoers file. Edit the file by issuing this command:
sudo visudo
There is a line that reads:
%admin ALL=(ALL) ALL
Entries that begin with a percentage sign (%) specify a group instead of a user. If you wish to disable this functionality, or only grant specific users this functionality, comment out this line:
#%admin ALL=(ALL) ALL

Log In as an LDAP User

We have now configured our client machine enough to be able to log in as one of our LDAP users. This user does not have to exist on the client machine.
In a new terminal window (it is best to keep your original terminal window logged in, in case of a configuration mistake), ssh into the client machine using an LDAP user's credentials:
ssh LDAP_user@LDAP_client_IP_Address
You should be able to log in as if your user had been created locally. Issue the print working directory command:
pwd
You should see that the home directory you selected for your user on the LDAP server is being used on this machine. It has been created on-demand to serve the LDAP user.
If you log out and log in with a different LDAP user, you can see that there will be two home directory entries:
ls /home
user1  user2
If your user is part of the "admin" group and you didn't disable the ability in the previous section, you will have normal sudo access, otherwise, you will not.
If you issue the passwd command to change your password, you can see that it will be modifying your LDAP credentials:
passwd
Enter login(LDAP) password:

Restricting Access by Group

If you only want members of certain groups to be able to log into this specific machine, you can configure that restriction within the PAM files.
Edit the following file with root privileges:
sudo nano /etc/pam.d/common-auth
At the bottom, we will specify that PAM should look at the security access file to see how to restrict user logins. Add this to the bottom:
auth    required    pam_access.so
Save and close the file.
The file that PAM references for security information when that setting is configured is at/etc/security/access.conf. Open this file now, with root privileges:
sudo nano /etc/security/access.conf
We need to add a rule to the end of the file.
The dash (-) at the beginning of the line means this is a restriction. From the first colon (:) to the next colon, we specify who this rule applies to.
We specify that this applies to all users except root and the group "admin". Groups are given within parentheses.
From the second colon to the end of the line, we will specify under which circumstances the rule should apply. In our case, the restriction will apply in all circumstances but local logins.
-:ALL EXCEPT root (admin):ALL EXCEPT LOCAL
This will allow us to restrict logins to the "admin" group. We can add other groups or change the group.
This will also allow us to log in through the "console access" button on the DigitalOcean console if we somehow lock ourselves out of SSH.
Keep in mind that this will apply to all users, not just LDAP users. So any users you create on the client machine will need to be a member of one of the specified groups

Install and configure LDAP server on UBUNTU 14.04

Hello Guys,

I have trying to install and configure LDAP as its like Active Directory from windows   and the reason I have to configure ldap as We have more than 100+users and 100+ servers so creating a new users or adding a new server and granting access to users on that is really a hectic job.so As i googled I found LDAP  in first few like.So I will not waste your time and lets start with implementation of the same.

LDAP, or Lightweight Directory Access Protocol, is a protocol for managing related information from a centralized location through the use of a file and directory hierarchy.It functions in a similar way to a relational database in certain ways, and can be used to organize and store any kind of information. LDAP is commonly used for centralized authentication

Install LDAP

The OpenLDAP server is in Ubuntu's default repositories under the package "slapd", so we can install it easily with apt-get. We will also install some additional utilities:

sudo apt-get update
sudo apt-get install slapd ldap-utils
You will be asked to enter and confirm an administrator password for the administrator LDAP account.

Reconfigure slapd

When the installation is complete, we actually need to reconfigure the LDAP package. Type the following to bring up the package configuration tool:

sudo dpkg-reconfigure slapd
You will be asked a series of questions about how you'd like to configure the software.
  • Omit OpenLDAP server configuration? No
  • DNS domain name?
    • This will create the base structure of your directory path. Read the message to understand how it works.
    • There are no set rules for how to configure this. If you have an actual domain name on this server, you can use that. Otherwise, use whatever you'd like.
    • In this article, we will call it test.com 
  • Organization name?
    • Again, this is up to you
    • We will use example in this guide. 
  • Administrator password?
    • Use the password you configured during installation, or choose another one 
  • Database backend to use? HDB
  • Remove the database when slapd is purged? No
  • Move old database? Yes
  • Allow LDAPv2 protocol? No

Install PHPldapadmin

We will be administering LDAP through a web interface called PHPldapadmin. This is also available in Ubuntu's default repositories.
Install it with this command:
sudo apt-get install phpldapadmin
That will install all of the required web server and PHP dependencies.

Configure PHPldapadmin

We need to configure some values within the web interface configuration files before trying it out.
Open the configuration file with root privileges:
sudo nano /etc/phpldapadmin/config.php
Search for the following sections and modify them accordingly.
Change the red value to the way you will be referencing your server, either through domain name or IP address.
$servers->setValue('server','host','domain_nam_or_IP_address');
For the next part, you will need to reflect the same value you gave when asked for the DNS domain name when we reconfigured "slapd".
You will have to convert it into a format that LDAP understands by separating each domain component. Domain components are anything that is separated by a dot.
These components are then given as values to the "dc" attribute.
For instance, if your DNS domain name entry was "imaginary.lalala.com", LDAP would need to see "dc=imaginary,dc=lalala,dc=com". Edit the following entry to reflect the name you selected (ours is "test.com" as you recall):
$servers->setValue('server','base',array('dc=test,dc=com'));
The next value to modify will use the same domain components that you just set up in the last entry. Add these after the "cn=admin" in the entry below:
$servers->setValue('login','bind_id','cn=admin,dc=test,dc=com');
Search for the following section about the "hidetemplatewarning" attribute. We want to uncomment this line and set the value to "true" to avoid some annoying warnings that are unimportant.
$config->custom->appearance['hide_template_warning'] = true;
Save and close the file.

Log Into the Web Interface

You can access by going to your domain name or IP address followed by "/phpldapadmin" in your web browser:
domain_name_or_IP_address/phpldapadmin
PHPldapadmin inital screen
Click on the "login" link on the left-hand side.
You will receive a login prompt. The correct Login DN (distinguished name) should be pre-populated if you configured PHPldapadmin correctly. In our case, this would be "cn=admin,dc=test,dc=com".
PHPldapadmin login
Enter the password you selected during our slapd configuration.
You will be presented with a rather sparse interface initially.
PHPldapadmin logged in
If you click on the "plus" next to the domain components (dc=test,dc=com), you will see the admin login we are using.
PHPldapadmin admin entry

Add Organizational Units, Groups, and Users

LDAP is very flexible. You can create hierarchies and relationships in many different ways, depending on what kind of information you need accessible and what kind of use case you have.
We will create some basic structure to our information and then populate it with information.

Create Organizational Units

First, we will create some categories of information where we will place the later information. Because this is a basic setup, we will only need two categories: groups and users.
Click on the "Create new entry here" link on the left-hand side.
Here, we can see the different kinds of entries we can create.
LDAP object selection
Because we are only using this as an organizational structure, rather than an information-heavy entry, we will use the "Generic: Organizational Unit" template.
We will be asked to create a name for our organizational unit. Type "groups":
LDAP groups name
We will then need to commit the changes.
LDAP commit ou
When this is complete, we can see a new entry on the left-hand side.
LDAP ou groups
We will create one more organizational structure to get ourselves going. Repeat the procedure, but this time, use the name "users".
When you are done, you should have something that looks like this:
LDAP ou complete

Create Groups

We will be creating three different groups that could be used to organize users into different "access" groups based on the privileges they require.
We will create an "admin" group, an "irc" group, and a "user" group. We could then allow members of different groups to authenticate if we set up client LDAP authentication.
We want to create the groups within the "groups" organizational unit. Click on the "groups" category we created. In the main pane, click on the "Create a child entry" within the groups category.
LDAP child of groups
This time, we will choose the "Generic: Posix Group" category.
LDAP posix group
Fill in "admin" as the group name. Click "Create Object" and then confirm on the next page.
LDAP admin group
Repeat the process, but simply replace the "admin" name with "irc" and "user". Be sure to re-click the "ou=groups" entry before creating child entries, or else you may create entries under the wrong category.
You should now have three groups in the left-hand panel:
LDAP three groups
You can see an overview of the entries in the "ou=groups" category by clicking on that entry, and then clicking on "View 3 children":
LDAP view three children

Create Users

Next, we will create users to put in these groups. Start by clicking the "ou=users" category. Click on "Create a child entry".
We will choose "Generic: User Account" for these entries.
LDAP user account
While adding a user you can face a tipical problem like there is no textbox for password and instate of textbox there is some error message some thing like this:
"Error trying to get a non-existant value (appearance,password_hash)"
 solution to this problem is as below:
replace password_hash with password_hash_custom which is in  /usr/share/phpldapadmin/lib/TemplateRender.php file on line no 2469  and reload the page
We will be given a lot of fields to fill out:
LDAP user fields
Fill in all of the entries with information that makes sense for your user.
Something to keep in mind is that the "Common Name" needs to be unique for each entry in a category. So you may want to use a username format instead of the default "FirstName LastName" that is auto-populated.
Click "Create Object" at the bottom and confirm on the following page.
To create additional users, we will take advantage of the ability to copy entries.
Click on the user you just created in the left-hand panel. In the main pane, click "Copy or move this entry":
LDAP copy user entry
Adjust the "cn=user" portion of the entry to point it to the common name you'd like to use for the new entry. Click "Copy" at the bottom:
LDAP copy common name
You will be given the next page populated with your first users data. You will need to adjust it to match the new users information.
Be sure to adjust the uidNumber. Click the "Create Object" button at the bottom.

Add Users to Groups

We can add users to various groups by clicking on the group in question. In the main pane, select "Add new attribute":
LDAP add new attribute
Select "memberUid" from the drop down menu:
LDAP memberuid entry menu
In the text field that populates, enter the first user you'd like to add. Click "Update Object" at the bottom:
LDAP add user2
You can then add more members by clicking "modify group members" and selecting them from the available choices:
LDAP user choices


I will explane how to use it in next blog which also quite easy.

Thank you guys I will appriciate your feed back if you find any error please let me know .
Enjoy.......!