一、手工配置方式
1、软件安装:
apt-get install ldap-utils libpam-ldap libnss-ldap nslcd
安装过程中提示填写ldap相关信息:ldap server 地址,base dc等,信息保存在/etc/ldap.conf中,可通过dpkg-reconfigure ldap-auth-config重新配置,其中:
- ldap服务uri格式 ldap://ldapServerIP/
- search base:dc=my,dc=com,dc=cn
- root ldap account:cn=admin,dc=my,dc=com,dc=cn
2、认证方式中添加ldap:
root@ldapclient:~# auth-client-config -t nss -p lac_ldap
3、使认证通过后自动创建用户家目录:
vi /etc/pam.d/common-session,追加内容: session required pam_mkhomedir.so skel=/etc/skel umask=0022
4、配置开启ldap认证方式
root@ldapclient:~# pam-auth-update
5、执行
update-rc.d nslcd enable
6、配置可在本机通过passwd更改用户密码:
vi /etc/pam.d/common-password,除去其中的use_authtok参数
7、重启相关服务:
/etc/init.d/nscd restart
8、登陆或切换用户时即通过ldap进行认证,如切换为ldap中的用户manager:
user1@ldapclient:~$ su - manager Password:***** Creating directory '/home/manager'. manager@ldapclient:~$
参见http://askubuntu.com/questions/127389/how-to-configure-ubuntu-as-an-ldap-client
二、脚本配置方式
如果需配置的机器很多,采用手工配置方式不太合适,可在待配置机器上运行如下shell脚本进行自动化配置:
#!/bin/bash #-------------------------------------------------------------------------------- #Ldap server地址及base DN LDAP_SERVER_IP=192.168.1.100 BASE_DN='dc=my,dc=com,dc=cn' #-------------------------------------------------------------------------------- #创建preseed文件-软件安装自应答 touch debconf-ldap-preseed.txt echo "ldap-auth-config ldap-auth-config/ldapns/ldap-server string ldap://$LDAP_SERVER_IP" >> debconf-ldap-preseed.txt echo "ldap-auth-config ldap-auth-config/ldapns/base-dn string $BASE_DN" >> debconf-ldap-preseed.txt echo "ldap-auth-config ldap-auth-config/ldapns/ldap_version select 3" >> debconf-ldap-preseed.txt echo "ldap-auth-config ldap-auth-config/dbrootlogin boolean false" >> debconf-ldap-preseed.txt echo "ldap-auth-config ldap-auth-config/dblogin boolean false" >> debconf-ldap-preseed.txt echo "nslcd nslcd/ldap-uris string ldap://$LDAP_SERVER_IP" >> debconf-ldap-preseed.txt echo "nslcd nslcd/ldap-base string $BASE_DN" >> debconf-ldap-preseed.txt cat debconf-ldap-preseed.txt | debconf-set-selections #安装ldap client相关软件 apt-get install -y ldap-utils libpam-ldap libnss-ldap nslcd #认证方式中添加ldap auth-client-config -t nss -p lac_ldap #认证登录后自动创建用户家目录 echo "session required pam_mkhomedir.so skel=/etc/skel umask=0022" >> /etc/pam.d/common-session #自启动服务 update-rc.d nslcd enable #可以在Host上通过passwd更改用户密码 cp /etc/pam.d/common-password /etc/pam.d/common-password.bak sed -i 's/use_authtok//' /etc/pam.d/common-password #使配置生效 /etc/init.d/nscd restart