http://www.jslink.org/linux/openldap-ssl-sssd.html
http://www.unix-power.net/centos7/openldap.html
http://www.learnitguide.net/2016/01/configure-openldap-server-on-rhel7.html
https://www.server-world.info/en/note?os=CentOS_7&p=openldap&f=1
http://news.gtmtech.co.uk/blog/2013/04/03/puppet-ldap-ssh-keys-the-whole-mess/
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Directory_Servers.html
http://chuansong.me/n/1786706
http://www.yolinux.com/TUTORIALS/LinuxTutorialLDAP-BindPW.html
https://www.pigo.idv.tw/archives/2914
安装
yum -y install openldap openldap-clients openldap-servers migrationtools
配置数据库启动
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown -R ldap:ldap /var/lib/ldap
systemctl start slapd
systemctl enable slapd
生成密码
slappasswd
New password:
Re-enter new password:
{SSHA}rXEozcP/ZzlkNfEXUyX8rtvlCgXJUvUi
生成配置文件
cat > /etc/openldap/slapd.conf << _EOF_
#include /etc/openldap/schema/corba.schema
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
#include /etc/openldap/schema/duaconf.schema
#include /etc/openldap/schema/dyngroup.schema
include /etc/openldap/schema/inetorgperson.schema
#include /etc/openldap/schema/java.schema
#include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/nis.schema
#include /etc/openldap/schema/openldap.schema
#include /etc/openldap/schema/ppolicy.schema
#include /etc/openldap/schema/collective.schema
allow bind_v2
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
database config
access to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
by * none
database monitor
access to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
by dn.exact="cn=Manager,dc=suntv,dc=tv" read
by * none
database hdb
#下面2条是允许用户自己修改密码
access to attrs=userPassword,shadowLastChange
by self write
by dn.base="cn=Manager,dc=suntv,dc=tv" write
by anonymous auth
by * none
access to *
by dn.base="cn=Manager,dc=suntv,dc=tv" write
by self write
by * read
suffix "dc=suntv,dc=tv"
checkpoint 1024 15
rootdn "cn=Manager,dc=suntv,dc=tv"
rootpw {SSHA}rXEozcP/ZzlkNfEXUyX8rtvlCgXJUvUi
directory /var/lib/ldap
index objectClass eq,pres
index ou,cn,mail,surname,givenname eq,pres,sub
index uidNumber,gidNumber,loginShell eq,pres
index uid,memberUid eq,pres,sub
index nisMapName,nisMapEntry eq,pres,sub
loglevel 256
_EOF_
配置openldap
cd /etc/openldap/
rm -rf slapd.d/*
slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
chown -R ldap:ldap /etc/openldap/slapd.d
systemctl restart slapd
配置日志
touch /var/log/slapd.log
chown ldap:ldap /var/log/slapd.log
echo 'local4.* /var/log/slapd.log' >> /etc/rsyslog.conf
systemctl restart rsyslog
建立组织结构
vim /usr/share/migrationtools/migrate_common.ph
$DEFAULT_MAIL_DOMAIN = "suntv.tv";
$DEFAULT_BASE = "dc=suntv,dc=tv";
/usr/share/migrationtools/migrate_base.pl > /tmp/base.ldif
# base.ldif 只保留以下内容
dn: dc=suntv,dc=tv
dc: suntv
objectClass: top
objectClass: domain
dn: ou=people,dc=suntv,dc=tv
ou: people
objectClass: organizationalUnit
dn: ou=group,dc=suntv,dc=tv
ou: group
objectClass: organizationalUnit
ldapadd -x -W -H ldap:/// -D cn=Manager,dc=suntv,dc=tv -f /tmp/base.ldif
or
cat << _EOF_ | ldapadd -x -W -H ldap:/// -D cn=Manager,dc=suntv,dc=tv
dn: dc=suntv,dc=tv
dc: suntv
objectClass: domain
objectClass: top
dn: ou=people,dc=suntv,dc=tv
ou: people
objectClass: organizationalUnit
dn: ou=group,dc=suntv,dc=tv
ou: group
objectClass: organizationalUnit
_EOF_
建立用户及组
groupadd -g 2001 op
useradd -u 1001 -g 2001 op01; echo '123456' | passwd op01 --stdin
cat /etc/group |egrep '^[a-z]*[0-9]*:x:2[0-9]{3}:' > /tmp/group.txt
/usr/share/migrationtools/migrate_group.pl /tmp/group.txt > /tmp/group.ldif
ldapadd -H ldap:/// -D cn=Manager,dc=suntv,dc=tv -W -x -f /tmp/group.ldif
or
cat << _EOF_ | ldapadd -x -W -H ldap:/// -D cn=Manager,dc=suntv,dc=tv
dn: cn=op,ou=group,dc=suntv,dc=tv
objectClass: posixGroup
cn: op
gidNumber: 2001
_EOF_
cat /etc/passwd |egrep '^[a-z]*[0-9]*:x:1[0-9]{3}:' > /tmp/user.txt
/usr/share/migrationtools/migrate_passwd.pl /tmp/user.txt > /tmp/user.ldif
ldapadd -H ldap:/// -D cn=Manager,dc=suntv,dc=tv -W -x -f /tmp/user.ldif
or
cat << _EOF_ | ldapadd -x -W -H ldap:/// -D cn=Manager,dc=suntv,dc=tv
dn: uid=op01,ou=people,dc=suntv,dc=tv
uid: op01
cn: op01
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
userPassword: 123456
shadowLastChange: 17085
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1001
gidNumber: 2001
homeDirectory: /home/op01
_EOF_
# 查询用户
ldapsearch -H ldap:/// -D cn=manager,dc=suntv,dc=tv -b ou=people,dc=suntv,dc=tv -W -x
客户端
yum -y install openldap-clients nss-pam-ldapd
authconfig --enableldap --enableldapauth --ldapserver=ldap://master.local,ldap://slave.local --ldapbasedn='dc=suntv,dc=tv' --enablemkhomedir --update
登录后变更密码
passwd