centos7搭建LDAP

Posted 2020-11-22 jcici

centos7搭建LDAP

一、安装Openldap

[root@cc ~]# yum install -y openldap openldap-clients openldap-servers migrationtools

 二、配置项

[root@cc ~]# vim /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif 
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 c347287f
olcRootPW: 123456         ##自定义密码
dn: olcDatabase={2}hdb
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {2}hdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=jcici,dc=com            ##需修改地方
olcRootDN: cn=admin,dc=jcici,dc=com       ##需修改地方
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
structuralObjectClass: olcHdbConfig
entryUUID: 09981338-9f85-1039-906f-315ddb938cdc
creatorsName: cn=config
createTimestamp: 20191120015848Z
entryCSN: 20191120015848.793541Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20191120015848Z    

 

[root@cc ~]# vim /etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 b01cea22
dn: olcDatabase={1}monitor
objectClass: olcDatabaseConfig
olcDatabase: {1}monitor
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
 al,cn=auth" read by dn.base="cn=admin,dc=jcici,dc=com" read by * none    ##与上文保持一致
structuralObjectClass: olcDatabaseConfig
entryUUID: 09980852-9f85-1039-906e-315ddb938cdc
creatorsName: cn=config
createTimestamp: 20191120015848Z
entryCSN: 20191120015848.793262Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20191120015848Z

 

[root@cc ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@cc ~]# chown -R ldap.ldap /var/lib/ldap
[root@cc ~]#  slaptest -u
5dd49e8b ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif"
5dd49e8b ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif"
config file testing succeeded
[root@cc ~]# systemctl start slapd
[root@cc ~]#  systemctl enable slapd
Created symlink from /etc/systemd/system/multi-user.target.wants/slapd.service to /usr/lib/systemd/system/slapd.service.
[root@cc ~]# netstat -tunlp | egrep "389|636"
tcp        0      0 0.0.0.0:389             0.0.0.0:*               LISTEN      2370/slapd          
tcp6       0      0 :::389                  :::*                    LISTEN      2370/slapd          
[root@cc ~]# cd /etc/openldap/schema/
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f cosine.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f nis.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f collective.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f corba.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f core.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f duaconf.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f dyngroup.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f inetorgperson.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f java.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f misc.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f openldap.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f pmi.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f ppolicy.ldif

 

[root@cc schema]# cd /usr/share/migrationtools/
[root@cc migrationtools]# vim migrate_common.ph
        $NAMINGCONTEXT{‘group‘}             = "ou=Group";    ##num61
$DEFAULT_MAIL_DOMAIN = "jcici.com";    ##num71
$DEFAULT_BASE = "dc=jcici,dc=com";    ##num74
$EXTENDED_SCHEMA = 1;    ##num90

[root@cc migrationtools]# ./migrate_base.pl > /root/base.ldif
[root@cc migrationtools]# ldapadd -x -W -D "cn=admin,dc=jcici,dc=com" -f /root/base.ldif

 

三、添加账号已经测试验证

[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f cosine.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f nis.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f collective.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f corba.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f core.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f duaconf.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f dyngroup.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f inetorgperson.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f java.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f misc.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f openldap.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f pmi.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f ppolicy.ldif


[root@cc ~]# mkdir /home/guests
[root@cc ~]# useradd -d /home/guests/ldapuser1 ldapuser1
[root@cc ~]# useradd -d /home/guests/ldapuser2 ldapuser2
             
[root@cc ~]# echo ‘password‘ | passwd --stdin ldapuser1
[root@cc ~]# echo ‘password‘ | passwd --stdin ldapuser2
[root@cc ~]# getent passwd | tail -n 5 > /root/users

[root@cc ~]# getent shadow | tail -n 5 > /root/shadow

[root@cc ~]# getent group | tail -n 5 > /root/groups
[root@cc ~]# cd /usr/share/migrationtools

[root@cc ~]# vim migrate_passwd.pl
        open(SHADOW, "/root/shadow") || return;	##num188
[root@cc ~]# ./migrate_passwd.pl /root/users > users.ldif

[root@cc ~]# ./migrate_group.pl /root/groups > groups.ldif
[root@cc ~]# ldapadd -x -W -D "cn=admin,dc=jcici,dc=com" -f users.ldif

[root@cc ~]# ldapadd -x -W -D "cn=admin,dc=jcici,dc=com" -f groups.ldif
[root@cc ~]# ldapsearch -x -b "dc=jcici,dc=com" -H ldap://127.0.0.1

 客户端验证

[root@k8s-es7-27 ~]# yum install -y nss-pam*

[root@k8s-es7-27 ~]# authconfig-tui

 

 

 

 [root@k8s-es7-27 ~]# su  ldapuser1
bash-4.2$ whoami
ldapuser1
bash-4.2$