参考：
http://54im.com/openldap/centos-6-yum-install-openldap-phpldapadmin-tls-%E5%8F%8C%E4%B8%BB%E9%85%8D%E7%BD%AE.html
1.规划：
用户：gongshaocheng,littlesuccess,cuckoo
组:administrator,analsyst,engineer
2.安装openldap
yum -y install openldap-servers openldap-clients cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG chown -R ldap:ldap /var/lib/ldap cd /etc/openldap mv slapd.d slapd.d.original cp ldap.conf ldap.conf.original
设置openldap服务器密码
slappasswd New password: (123456) Re-enter new password: (123456) {SSHA}5PD6lnr0JDKUg6n4/6irm/h5XRM3VYOa
配置slapd.con
cp /usr/share/openldap-servers/slapd.conf.obsolete slapd.conf vi /usr/share/openldap-servers/slapd.conf
修改内容如下:
database bdb suffix "dc=clouderachina,dc=com" checkpoint 1024 15 rootdn "cn=Manager,dc=clouderachina,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg rootpw {SSHA}5PD6lnr0JDKUg6n4/6irm/h5XRM3VYOa
启动ldap服务
chkconfig slapd on
/etc/init.d/slapd start
检查:
ldapsearch -x -b "dc=clouderachina,dc=com"
3. 建立用户和组:
groupadd -g 500 -p 123456 administrator groupadd -g 501 -p 123456 analsyst groupadd -g 502 -p 123456 engineer useradd -u 5000 -d /home/gongshaocheng -g administrator -p 123456 gongshaocheng useradd -u 5010 -d /home/littlesuccess -g analsyst -p 123456 littlesuccess useradd -u 5020 -d /home/cuckoo -g engineer -p 123456 cuckoo
安装及配置迁移工具
yum install migrationtools -y cd /usr/share/migrationtools/
修改migrate_common.ph
# Default DNS domain $DEFAULT_MAIL_DOMAIN = "clouderachina.com"; # Default base $DEFAULT_BASE = "dc=clouderachina,dc=com";
./migrate_base.pl >base.ldif
base.ldiff文件里面很多内容是多余的，我们只要如下内容:
dn: clouderachina,dc=com clouderachina: objectClass: top objectClass: dn: ou=People,clouderachina,dc=com ou: People objectClass: top objectClass: organizationalUnit dn: ou=Group,clouderachina,dc=com ou: Group objectClass: top objectClass: organizationalUnit
创建用户和组的数据库文件
grep gongshaocheng /etc/passwd >>user.txt grep littlesuccess /etc/passwd >>user.txt grep cuckoo /etc/passwd >>users.txt ./migrate_passwd.pl user.txt ./user.ldif grep administrator /etc/group >>group.txt grep analsyst /etc/group >>group.txt grep engineer /etc/group >>group.txt ./migrate_group.pl group.txt ./group.ldif
迁移系统用户到ldap数据库
ldapadd -D "cn=Manager,dc=clouderachina,dc=com" -W -x -f /usr/share/migrationtools/base.ldif ldapadd -D "cn=Manager,dc=clouderachina,dc=com" -W -x -f /usr/share/migrationtools/user.ldif ldapadd -D "cn=Manager,dc=clouderachina,dc=com" -W -x -f /usr/share/migrationtools/group.ldif
ldap客户端配置
yum install authconfig-tui
进入authconfig-tui
选择使用LDAP，和LDAP验证
ldap地址：ldap://192.168.0.85/
基点DN: dc=clouderachina,dc=com
退出后会自动启sssd服务
验证：
输入 id gongshaocheng
[root@demo2 ~]# id gongshaocheng uid=5000(gongshaocheng) gid=500(administrator) groups=500(administrator)
输入 su gongshaocheng
[root@demo3 ~]# su gongshaocheng bash-4.1$ exit
5.在NFS服务器上建立用户主目录
在NFS服务器上执行：
/etc/init.d/rpcbind start
/etc/init.d/nfslock start
/etc/init.d/nfs start
chkconfig rpcbind on
chkconfig nfslock on
chkconfig nfs on
修改/etc/exports
增加如下内容：
vi /etc/exports
/home *(rw,sync)
设置完后，重启nfs 服务器：
service nfs restart
检查:
showmount -e localhost
6.在客户端挂载NFS主目录
确保客户端已经安装了 autofs 服务
配置 autofs 服务
#vi /etc/auto.master
最后加入如下行并保存：
/home /etc/auto.nfs //表示挂载到本地的位置和配置文件
#vi /etc/auto.nfs
输入如下内容并保存：
* -fstype=nfs,rw,sync 192.168.0.85:/home/&
说明，上面的*表示要挂载的某用户的目录，后面的&表示用户名。192.168.0.85为NFS服务器
测试:
su - gongshaocheng
mkdir test
这时在NFS服务器上/home/gongshaocheng/下就可以找到test