openldap 2.4 centos7 常用配置

Posted 2022-04-05 37yan

新版的openldap弃用了sldap.conf配置文件，引入一种动态配置，所以尽量不要直接修改配文件

如果直接修改了配置文件可以用slaptest -u命令检查

1、安装openldap，可能需要epel源

yum install openldap openldap-clients openldap-servers

 

2、启动openldap

cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown ldap:ldap -R /var/lib/ldap
chmod 700 -R /var/lib/ldap
chown ldap:ldap -R /var/run/openldap
chown -R ldap:ldap /etc/openldap/

systemctl start slapd
systemctl enable slapd

 

3、导入基本Schema

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif

 

4、创建管理员密码，等一下要用

slappasswd -s "pass"

 

5、配置ldap数据库和管理员

创建db.ldif 文件

dn: olcDatabase=2hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=example,dc=com

dn: olcDatabase=2hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=example,dc=taovip,dc=com

dn: olcDatabase=2hdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: SSHAFqSgnCQY0evw7T3pZRfnKVHByAOhNSFS4

dn: olcDatabase=1monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: 0to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
 al,cn=auth" read by dn.base="cn=root,dc=example,dc=com" read by * none

导入配置

ldapmodify -Y EXTERNAL -H ldapi:/// -f db.ldif

 

6、创建默认DN

创建base.ldif 文件

dn: dc=example,dc=com
o: company
objectClass: top
objectclass: dcObject
objectclass: organization

dn: cn=root,dc=example,dc=com
cn: root
objectClass: organizationalRole
description: Directory Manage

导入配置

ldapadd -x -W -D "cn=root,dc=example,dc=com" -f base.ldif

 

7、开启memberOf

创建 memberof_config.ldif

dn: cn=module,cn=config
cn: module
objectClass: olcModuleList
olcModuleLoad: memberof
olcModulePath: /usr/lib64/openldap

dn: olcOverlay=0memberof,olcDatabase=2bdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf

创建 refint1.ldif

dn: cn=module0,cn=config
add: olcmoduleload
olcmoduleload: refin

创建 refint2.ldif

dn: olcOverlay=1refint,olcDatabase=2bdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: 1refint
olcRefintAttribute: memberof member manager owner

导入配置

ldapadd -Q -Y EXTERNAL -H ldapi:/// -f memberof_config.ldif
ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f refint1.ldif
ldapadd -Q -Y EXTERNAL -H ldapi:/// -f refint2.ldif

 

8、创建用户和组

创建文件add_user.ldif

dn: cn=user,dc=example,dc=com
cn: user
sn: user
uid: user
objectClass: top
objectClass: shadowAccount
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
userPassword: MD5ICy5YqxZB1uWSwcVLDFSDSNLcA==

创建add_group.ldif

dn: cn=users,dc=example,dc=com
objectClass: groupofnames
cn: users
description: default group
member: cn=user,dc=taovip,dc=com

导入配置

ldapadd -x -D cn=root,dc=example,dc=com -W -f add_user.ldif
ldapadd -x -D cn=root,dc=example,dc=com -W -f add_group.ldif

 

8、打开openldap日志

配置rsyslog

mkdir -p /var/log/slapd
chown ldap:ldap /var/log/slapd/
touch /var/log/slapd/slapd.log
chown ldap . /var/log/slapd/slapd.log
echo "local4.* /var/log/slapd/slapd.log" >> /etc/rsyslog.conf

systemctl restart rsyslog

创建log.ldif

dn: cn=config
changetype: modify
add: olcLogLevel
olcLogLevel: -1

导入配置

ldapadd -Q -Y EXTERNAL -H ldapi:/// -f log.ldif

 

9、禁止匿名访问

创建disable_anon.ldif文件

dn: cn=config
changetype: modify
add: olcDisallows
olcDisallows: bind_anon

dn: cn=config
changetype: modify
add: olcRequires
olcRequires: authc

dn: olcDatabase=-1frontend,cn=config
changetype: modify
add: olcRequires
olcRequires: authc

导入配置

ldapadd -Q -Y EXTERNAL -H ldapi:/// -f disable_anon.ldif 

 

10、设置ACL