OpenLDAP部署实践

1.说明

该方案是使用源码方案部署，适用于OpenLDAP-2.4.48、2.4.49版本
架构：X86_64
操作系统：统信服务器操作系统V20-1020a

2.下载

OpenLDAP2.4.48和OpenLDAP2.4.49下载链接

https://www.openldap.com/software/download/OpenLDAP/openldap-release/openldap-2.4.48.tgz
https://www.openldap.com/software/download/OpenLDAP/openldap-release/openldap-2.4.49.tgz

BerkeleyDB下载链接

http://download.oracle.com/berkeley-db/db-5.0.32.tar.gz

3.初始环境

编译源码需make、gcc

安装

dnf -y install make gcc gcc-c++

4.编译安装BerkeleyDB

1、解压db-5.0.32.tar.gz

tar -zxvf db-5.0.32.tar.gz -C /opt/

2、进入目录编译

cd /opt/db-5.0.32/build_unix
../dist/configure
make
make install

3、设置环境变量

vim /etc/ld.so.conf
添加：/usr/local/BerkeleyDB.5.0/lib/

执行生效

ldconfig -v

5.编译安装OpenLDAP

解压OpenLDAP

tar -zxvf openldap-2.4.49.tgz -C /opt/

编译OpenLDAP

./configure CPPFLAGS="-I/usr/local/BerkeleyDB.5.0/include -D_GNU_SOURCE" LDFLAGS="-L/usr/local/BerkeleyDB.5.0/lib"
make depend
make
make test
make install

5.1.OpenLDAP目录结构介绍

1、配置文件目录

2、服务端可执行指令目录

3、服务端启动工具slapd

4、客户端可执行指令目录

5、bdb数据、log存放目录

5.2.版本信息

版本管理

/usr/local/libexec/slapd -VV

5.3.配置

设置密码

slappasswd

配置主文件

vim /usr/local/etc/openldap/slapd.conf

添加修改

include         /usr/local/etc/openldap/schema/collective.schema
include         /usr/local/etc/openldap/schema/corba.schema
include         /usr/local/etc/openldap/schema/cosine.schema
include         /usr/local/etc/openldap/schema/duaconf.schema
include         /usr/local/etc/openldap/schema/dyngroup.schema
include         /usr/local/etc/openldap/schema/inetorgperson.schema
include         /usr/local/etc/openldap/schema/java.schema
include         /usr/local/etc/openldap/schema/misc.schema
include         /usr/local/etc/openldap/schema/nis.schema
include         /usr/local/etc/openldap/schema/openldap.schema
include         /usr/local/etc/openldap/schema/pmi.schema
include         /usr/local/etc/openldap/schema/ppolicy.schema
loglevel    256
logfile    /usr/local/var/slapd.log
database    mdb
maxsize        1073741824
suffix         "dc=nmcm,dc=com"
rootdn        "cn=admin,dc=nmcm,dc=com"
rootpw        {
    
    上述设置密码生成的密文}
directory    /usr/local/var/openldap-data
index   objectClass     eq

5.4.初始化OpenLDAP

cd /usr/local/var/openldap-data/
cp DB_CONFIG.example DB_CONFIG

5.5.启动OpenLDAP

两种方式启动：
后台启动

/usr/local/libexec/slapd

前端启动输出debug信息

/usr/local/libexec/slapd -d 256

该信息是已经在运行，无法开启。

查看监听端口

lsof -i:389

5.6.验证OpenLDAP

ldapsearch -x -b '' -s base'(objectclass=*)'

ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts

6.创建账号

vim admin.ldif

添加：

dn: dc=nmcm,dc=com
objectclass: dcObject
objectclass: organization
o: NMCM.Inc
dc: nmcm

dn: cn=admin,dc=nmcm,dc=com
objectclass: organizationalRole
cn: admin

插入数据库

ldapadd -x -D "cn=admin,dc=nmcm,dc=com" -W -f admin.ldif

验证

ldapsearch -x -b 'dc=nmcm,dc=com' '(objectClass=*)'