查看系统版本，内核，定时任务同步时间，关闭防火墙selinux等
[root@ldap-master ~]# cat /etc/redhat-release CentOS release 6.5 (Final) [root@ldap-master ~]# uname -r 2.6.32-431.el6.x86_64 [root@ldap-master ~]# crontab -l #time update by root */5 * * * * /usr/sbin/ntpdate ntp1.aliyun.com >/dev/null 2>&1 [root@ldap-master ~]# getenforce Disabled [root@ldap-master ~]# /etc/init.d/iptables status iptables: Firewall is not running. [root@ldap-master ~]# echo "10.0.0.4 test.org" >>/etc/hosts [root@ldap-master ~]# tail -1 /etc/hosts 10.0.0.4 test.org
安装openLDAP
[root@ldap-master ~]# rpm -qa|grep openldap* compat-openldap-2.3.43-2.el6.x86_64 openldap-2.4.23-32.el6_4.1.x86_64 [root@ldap-master ~]# yum -y install openldap openldap-* --skip-broken #<===此步骤出错检查yum源配置，网络，DNS等是否正确 [root@ldap-master ~]# yum -y install nscd nss-pam-ldap nss* pcre pcre-* --skip-broken #<===此步骤如果出错，执行下面一条命令，然后重新再执行本条命令再继续下一步 [root@ldap-master ~]# yum -y update nss-softokn-freebl [root@ldap-master ~]# rpm -qa|grep openldap* #<===保证以下软件安装完毕 openldap-2.4.40-16.el6.x86_64 openldap-clients-2.4.40-16.el6.x86_64 openldap-servers-2.4.40-16.el6.x86_64 openldap-devel-2.4.40-16.el6.x86_64 openldap-servers-sql-2.4.40-16.el6.x86_64 compat-openldap-2.3.43-2.el6.x86_64
查看yum安装的openLDAP软件所在目录路径（没有列出所有，只列出重要的）
[root@ldap-master ~]# rpm -ql openldap-servers-2.4.40-16.el6.x86_64 /etc/openldap/slapd.conf #<===/etc/openldap为配置文件目录 /etc/openldap/slapd.conf.bak /etc/openldap/slapd.d /etc/portreserve/slapd ...... /usr/share/openldap-servers #<===服务端目录 /usr/share/openldap-servers/DB_CONFIG.example #<===数据库配置文件样本 /usr/share/openldap-servers/slapd.conf.obsolete #<===2.3版本主配置文件样本 /usr/share/openldap-servers/slapd.ldif.example #ldif 文件样本 /var/lib/ldap #<===数据库所在路径（默认为空） /var/run/openldap #进程pid目录
配置ldap2.3版本主配置文件slapd.conf
[root@ldap-master ~]# cd /etc/openldap/
[root@ldap-master openldap]# ll
total 20
drwxr-xr-x. 2 root root 4096 Feb 25 17:03 certs
-rw-r----- 1 root ldap 121 Mar 22 2017 check_password.conf
-rw-r--r-- 1 root root 280 Mar 22 2017 ldap.conf
drwxr-xr-x 2 root root 4096 Feb 25 17:03 schema
drwxr-x--- 3 ldap ldap 4096 Feb 25 17:03 slapd.d
[root@ldap-master openldap]# ll slapd.d/
total 8
drwxr-x--- 3 ldap ldap 4096 Feb 25 17:03 cn=config
-rw-r----- 1 ldap ldap 1281 Feb 25 17:03 cn=config.ldif
[root@ldap-master openldap]# cp /usr/share/openldap-servers/slapd.conf.obsolete ./slapd.conf
[root@ldap-master openldap]# ll
total 28
drwxr-xr-x. 2 root root 4096 Feb 25 17:03 certs
-rw-r----- 1 root ldap 121 Mar 22 2017 check_password.conf
-rw-r--r-- 1 root root 280 Mar 22 2017 ldap.conf
drwxr-xr-x 2 root root 4096 Feb 25 17:03 schema
-rw-r--r-- 1 root root 4635 Feb 25 17:25 slapd.conf #<===2.3版本配置文件目录
drwxr-x--- 3 ldap ldap 4096 Feb 25 17:03 slapd.d #<===2.4版本配置文件目录
[root@ldap-master openldap]# slap #<===查看所有slapd相关命令
slapacl slapauth slapd slapindex slapschema
slapadd slapcat slapdn slappasswd slaptest
[root@ldap-master openldap]# slappasswd -s 123456|sed -e 's#{SSHA}#rootpw {SSHA}#g' >>/etc/openldap/slapd.conf #<===此命令生成ldap管理员加密密码（明文密码为123456）
[root@ldap-master openldap]# tail -1 /etc/openldap/slapd.conf
rootpw {SSHA}cwkGLG6/cxNyInMajMw9kkXebbLBesTx
[root@ldap-master openldap]# vi /etc/openldap/slapd.conf #<===修改配置文件内容为如下（解释部分）
[root@ldap-master openldap]# cat /etc/openldap/slapd.conf
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /etc/openldap/schema/corba.schema
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/duaconf.schema
include /etc/openldap/schema/dyngroup.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/java.schema
include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/openldap.schema
include /etc/openldap/schema/ppolicy.schema
include /etc/openldap/schema/collective.schema
# Allow LDAPv2 client connections. This is NOT the default.
allow bind_v2
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
# Load dynamic backend modules
# - modulepath is architecture dependent value (32/64-bit system)
# - back_sql.la overlay requires openldap-server-sql package
# - dyngroup.la and dynlist.la cannot be used at the same time
# modulepath /usr/lib/openldap
# modulepath /usr/lib64/openldap
# moduleload accesslog.la
# moduleload auditlog.la
# moduleload back_sql.la
# moduleload chain.la
# moduleload collect.la
# moduleload constraint.la
# moduleload dds.la
# moduleload deref.la
# moduleload dyngroup.la
# moduleload dynlist.la
# moduleload memberof.la
# moduleload pbind.la
# moduleload pcache.la
# moduleload ppolicy.la
# moduleload refint.la
# moduleload retcode.la
# moduleload rwm.la
# moduleload seqmod.la
# moduleload smbk5pwd.la
# moduleload sssvlv.la
# moduleload syncprov.la
# moduleload translucent.la
# moduleload unique.la
# moduleload valsort.la
# The next three lines allow use of TLS for encrypting connections using a
# dummy test certificate which you can generate by running
# /usr/libexec/openldap/generate-server-cert.sh. Your client software may balk
# at self-signed certificates, however.
TLSCACertificatePath /etc/openldap/certs
TLSCertificateFile ""OpenLDAP Server""
TLSCertificateKeyFile /etc/openldap/certs/password
# Sample security restrictions
# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64
# Sample access control policy:
# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:
# Allow self write access
# Allow authenticated users read access
# Allow anonymous users to authenticate
# Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
# by self write
# by users read
# by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!
# enable on-the-fly configuration (cn=config)
# enable server status monitoring (cn=monitor)
#<===以下是在删除配置文件98-108增加的内容
access to * #<===将原来98-108行（2.4版本的内容）注释掉或者删除掉，然后增加这4行安全方面的优化内容
by self write
by anonymous auth
by * read #<===此4行意思是用户可以修改并更新自己的密码，身份验证允许检索用户的密码
#######################################################################
# database definitions
#######################################################################
database bdb #<===指定数据库为dbd格式
suffix "dc=test,dc=org" #<===指定ldap要使用的后缀
checkpoint 2048 10 #<===设置每达到2048KB或者每10分钟执行一次写数据进磁盘的checkpoint操作
rootdn "cn=admin,dc=test,dc=org" #<===指定管理员的DN，使用此DN可以登录管理openLDAP服务器
# Cleartext passwords, especially for the rootdn, should
# be avoided. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw secret
# rootpw {crypt}ijFYNcSNctBYg
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /var/lib/ldap
# Indices to maintain for this database
index objectClass eq,pres
index ou,cn,mail,surname,givenname eq,pres,sub
index uidNumber,gidNumber,loginShell eq,pres
index uid,memberUid eq,pres,sub
index nisMapName,nisMapEntry eq,pres,sub
# Replicas of this database
#replogfile /var/lib/ldap/openldap-master-replog
#replica host=ldap-1.example.com:389 starttls=critical
# bindmethod=sasl saslmech=GSSAPI
# authcId=host/ldap-master.example.com@EXAMPLE.COM
rootpw {SSHA}cwkGLG6/cxNyInMajMw9kkXebbLBesTx
#<===以下是增加的内容
loglevel 296 #<===日志级别（由256日志链接/操作/结果，32搜索过滤器，8链接管理器一起构成）
cachesize 1000 #<===设置ldap可以缓存的记录数
配置rsyslog服务记录openLDAP服务日志
[root@ldap-master openldap]# echo 'local4.* /var/log/ldap.log' >>/etc/rsyslog.conf [root@ldap-master openldap]# tail -2 /etc/rsyslog.conf #ldap.log by root 2019/02/25 local4.* /var/log/ldap.log [root@ldap-master openldap]# /etc/init.d/rsyslog start Shutting down system logger: [ OK ] Starting system logger: [ OK ] [root@ldap-master openldap]# lsof -i :389 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME slapd 5499 ldap 7u IPv4 20606 0t0 TCP *:ldap (LISTEN) slapd 5499 ldap 8u IPv6 20607 0t0 TCP *:ldap (LISTEN) [root@ldap-master openldap]# cat /var/log/ldap.log #<===启动服务后，此文件中有内容证明配置rsyslog没有错误 Feb 25 18:00:14 ldap-master slapd[5498]: @(#) $OpenLDAP: slapd 2.4.40 (Mar 22 2017 06:29:21) $#012#011mockbuild@c1bm.rdu2.centos.org:/builddir/build/BUILD/openldap-2.4.40/openldap-2.4.40/build-servers/servers/slapd
配置ldap数据库并授权，slapd服务加入开机自启动，配置了数据库后重启服务提示有错误及其解决办法
[root@ldap-master openldap]# pwd /etc/openldap [root@ldap-master openldap]# ll /var/lib/ldap/ total 0 [root@ldap-master openldap]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG [root@ldap-master openldap]# ll /var/lib/ldap/ total 4 -rw-r--r-- 1 root root 845 Feb 25 17:57 DB_CONFIG [root@ldap-master openldap]# chown -R ldap.ldap /var/lib/ldap [root@ldap-master openldap]# chmod 700 /var/lib/ldap/DB_CONFIG [root@ldap-master openldap]# ll /var/lib/ldap/ total 4 -rwx------ 1 ldap ldap 845 Feb 25 17:57 DB_CONFIG [root@ldap-master openldap]# slaptest -u #<===此命令用于检查ldap配置是否出错 config file testing succeeded [root@ldap-master openldap]# /etc/init.d/slapd start Starting slapd: [ OK ] [root@ldap-master openldap]# chkconfig --level 3 slapd on [root@ldap-master openldap]# chkconfig --list|grep slapd slapd 0:off 1:off 2:off 3:on 4:off 5:off 6:off [root@ldap-master openldap]# /etc/init.d/slapd restart #<===重新启动slapd服务提示错误（原因：openLDAP2.3与2.4配置文件不一样导致） Stopping slapd: [ OK ] ls: cannot access /etc/openldap/slapd.d//cn=config/olcDatabase*.ldif: No such file or directory Starting slapd: [ OK ]
解决办法：重新生成基于2.3版本的配置文件
[root@ldap-master openldap]# ll
total 32
drwxr-xr-x. 2 root root 4096 Feb 25 17:03 certs
-rw-r----- 1 root ldap 121 Mar 22 2017 check_password.conf
-rw-r--r-- 1 root root 280 Mar 22 2017 ldap.conf
drwxr-xr-x 2 root root 4096 Feb 25 17:03 schema
-rw-r--r-- 1 root root 4478 Feb 25 17:49 slapd.conf
drwxr-x--- 3 ldap ldap 4096 Feb 25 17:03 slapd.d
drwxr-x--- 3 ldap ldap 4096 Feb 25 17:03 slapd.d.2019-02-25.bak
[root@ldap-master openldap]# rm -fr slapd.d/*
[root@ldap-master openldap]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
[root@ldap-master openldap]# ll /etc/openldap/slapd.d/*
-rw------- 1 root root 1301 Feb 25 18:08 /etc/openldap/slapd.d/cn=config.ldif
/etc/openldap/slapd.d/cn=config:
total 76
drwxr-x--- 2 root root 4096 Feb 25 18:08 cn=schema
-rw------- 1 root root 59398 Feb 25 18:08 cn=schema.ldif
-rw------- 1 root root 584 Feb 25 18:08 olcDatabase={0}config.ldif
-rw------- 1 root root 2710 Feb 25 18:08 olcDatabase={1}bdb.ldif
-rw------- 1 root root 660 Feb 25 18:08 olcDatabase={-1}frontend.ldif
[root@ldap-master openldap]# chown -R ldap.ldap /etc/openldap/slapd.d
[root@ldap-master openldap]# /etc/init.d/slapd restart
Stopping slapd: [ OK ]
Starting slapd: [ OK ]
[root@ldap-master openldap]# lsof -i :389
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
slapd 5618 ldap 7u IPv4 21201 0t0 TCP *:ldap (LISTEN)
slapd 5618 ldap 8u IPv6 21202 0t0 TCP *:ldap (LISTEN)
验证openLDAP2.3安装成功
[root@ldap-master openldap]# ldapsearch -LLL -W -x -H ldap://test.org -D "cn=admin,dc=test,dc=org" -b "dc=test,dc=org" "(uid=*)" Enter LDAP Password: #<===这里输入前面设置的ldap管理员admin的密码123456 No such object (32) #<===正常情况下，输入正确密码登录，内容为空证明以上所有配置正确（如果输入正确的密码登录提示错误证明配置有错误）
配置web管理openLDAP
[root@ldap-master openldap]# yum -y install httpd php php-ldap php-gd
[root@ldap-master openldap]# rpm -qa httpd php php-ldap php-gd
httpd-2.2.15-69.el6.centos.x86_64
php-5.3.3-49.el6.x86_64
php-ldap-5.3.3-49.el6.x86_64
php-gd-5.3.3-49.el6.x86_64
[root@ldap-master openldap]# cd /var/www/html/
[root@ldap-master html]# ll
total 0
[root@ldap-master html]# rz -y
rz waiting to receive.
???a? zmodem ′???￡ °′ Ctrl+C ???￡
?[root@ldap-master html]# rz -y
rz waiting to receive.
???a? zmodem ′???￡ °′ Ctrl+C ???￡
??′?? ldap-account-manager-3.7.tar.gz...
100% 8942 KB 8942 KB/s 00:00:01 0 ′?
?[root@ldap-master html]# ll
total 8944
-rw-r--r-- 1 root root 9157357 Feb 21 15:00 ldap-account-manager-3.7.tar.gz
[root@ldap-master html]# tar xf ldap-account-manager-3.7.tar.gz
[root@ldap-master html]# mv ldap-account-manager-3.7 ldap
[root@ldap-master html]# cd ldap/config
[root@ldap-master config]# cp config.cfg_sample config.cfg
[root@ldap-master config]# cp lam.conf_sample lam.conf
[root@ldap-master config]# sed -i 's#cn=Manager#cn=admin#g' lam.conf
[root@ldap-master config]# sed -i 's#dc=my-domain#dc=test#g' lam.conf
[root@ldap-master config]# sed -i 's#dc=com#dc=org#g' lam.conf
[root@ldap-master config]# chown -R apache.apache /var/www/html/ldap
[root@ldap-master config]# /etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: httpd: apr_sockaddr_info_get() failed for ldap-master
httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
[ OK ]
[root@ldap-master config]# lsof -i :80
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 5841 root 4u IPv6 24972 0t0 TCP *:http (LISTEN)
httpd 5843 apache 4u IPv6 24972 0t0 TCP *:http (LISTEN)
httpd 5844 apache 4u IPv6 24972 0t0 TCP *:http (LISTEN)
httpd 5845 apache 4u IPv6 24972 0t0 TCP *:http (LISTEN)
httpd 5846 apache 4u IPv6 24972 0t0 TCP *:http (LISTEN)
httpd 5847 apache 4u IPv6 24972 0t0 TCP *:http (LISTEN)
httpd 5848 apache 4u IPv6 24972 0t0 TCP *:http (LISTEN)
httpd 5849 apache 4u IPv6 24972 0t0 TCP *:http (LISTEN)
浏览器输入 http://10.0.0.4/ldap/templates/login.php 访问，输入ldap管理员admin的密码123456
安装Windows客户端管理软件LdapAdminExe-w64-1.8.3管理openLDAP（链接http://www.ldapadmin.org/download/ldapadmin.html）
