openldap安装指南

Posted 2023-04-27 vmsysjack

tags:

篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了openldap安装指南相关的知识，希望对你有一定的参考价值。

#ldapserver
#安装openldap

setenforce 0 && systemctl stop firewalld && iptables -F

yum install -y epel-release

yum install -y openldap openldap-clients openldap-servers


systemctl start slapd
systemctl enable slapd
systemctl status slapd

#ldapServer root密码

adminpd=\'Huawei@123\'

DomainName="huawei"

DomainSuffix="com"

###########################################################

PassWord="$(slappasswd -s $adminpd)"

cat >/etc/openldap/schema/changepwd.ldif<<EOF
dn: olcDatabase=0config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: $PassWord
EOF

#导入自定义配置文件
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/changepwd.ldif

#导入基础schema
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/collective.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/corba.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/duaconf.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/dyngroup.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/java.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/misc.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/openldap.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/pmi.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/ppolicy.ldif


#定义修改域名和后缀
DomainName="huawei"

DomainSuffix="com"


# 修改域名，新增changedomain.ldif, 这里我自定义的域名为 huawei.com，管理员用户账号为admin。
# 如果要修改，则修改文件中相应的dc=huawei,dc=com为自己的域名

cat >/etc/openldap/schema/changedomain.ldif<<EOFA
dn: olcDatabase=1monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: 0to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=admin,dc=$DomainName,dc=$DomainSuffix" read by * none

dn: olcDatabase=2hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=$DomainName,dc=$DomainSuffix

dn: olcDatabase=2hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=admin,dc=$DomainName,dc=$DomainSuffix

dn: olcDatabase=2hdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: $PassWord

dn: olcDatabase=2hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: 0to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=$DomainName,dc=$DomainSuffix" write by anonymous auth by self write by * none
olcAccess: 1to dn.base="" by * read
olcAccess: 2to * by dn="cn=admin,dc=$DomainName,dc=$DomainSuffix" write by * read
EOFA


ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/changedomain.ldif


# 启用memberof功能
cat >/etc/openldap/schema/add-memberof.ldif<<EOFC
dn: cn=module0,cn=config
cn: modulle0
objectClass: olcModuleList
objectclass: top
olcModuleload: memberof.la
olcModulePath: /usr/lib64/openldap

dn: olcOverlay=0memberof,olcDatabase=2hdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfUniqueNames
olcMemberOfMemberAD: uniqueMember
olcMemberOfMemberOfAD: memberOf
EOFC

cat >/etc/openldap/schema/refint1.ldif<<EOFD
dn: cn=module0,cn=config
add: olcmoduleload
olcmoduleload: refint
EOFD

cat >/etc/openldap/schema/refint2.ldif<<EOFE
dn: olcOverlay=refint,olcDatabase=2hdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: refint
olcRefintAttribute: memberof uniqueMember manager owner
EOFE

ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/add-memberof.ldif

ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/refint1.ldif

ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/refint2.ldif




#定义修改域名和后缀
DomainName="huawei"

DomainSuffix="com"

cat >/etc/openldap/schema/base.ldif<<EOFF
dn: dc=$DomainName,dc=$DomainSuffix
objectClass: top
objectClass: dcObject
objectClass: organization
o: $DomainName Company
dc: $DomainName

dn: cn=admin,dc=$DomainName,dc=$DomainSuffix
objectClass: organizationalRole
cn: admin

dn: ou=People,dc=$DomainName,dc=$DomainSuffix
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=$DomainName,dc=$DomainSuffix
objectClass: organizationalRole
cn: Group
EOFF

# 执行命令，添加配置, 这里要注意修改域名为自己配置的域名，然后需要输入上面我们生成的密码
ldapadd -x -D cn=admin,dc=$DomainName,dc=$DomainSuffix -w $adminpd -f /etc/openldap/schema/base.ldif




yum install -y phpldapadmin
sed -i \'s#Require local#Require all granted#g\' /etc/httpd/conf.d/phpldapadmin.conf

# 启动apache
systemctl start httpd
systemctl enable httpd

sed -i \'/\\\'login\\\'\\,\\\'attr\\\'\\,\\\'uid\\/ s#uid#cn#g\'