centos7搭建LDAP
一、安装Openldap
[root@cc ~]# yum install -y openldap openldap-clients openldap-servers migrationtools
二、配置项
[root@cc ~]# vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}hdb.ldif
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 c347287f
olcRootPW: 123456 ##自定义密码
dn: olcDatabase={2}hdb
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {2}hdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=jcici,dc=com ##需修改地方
olcRootDN: cn=admin,dc=jcici,dc=com ##需修改地方
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
structuralObjectClass: olcHdbConfig
entryUUID: 09981338-9f85-1039-906f-315ddb938cdc
creatorsName: cn=config
createTimestamp: 20191120015848Z
entryCSN: 20191120015848.793541Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20191120015848Z
[root@cc ~]# vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}monitor.ldif
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 b01cea22
dn: olcDatabase={1}monitor
objectClass: olcDatabaseConfig
olcDatabase: {1}monitor
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
al,cn=auth" read by dn.base="cn=admin,dc=jcici,dc=com" read by * none ##与上文保持一致
structuralObjectClass: olcDatabaseConfig
entryUUID: 09980852-9f85-1039-906e-315ddb938cdc
creatorsName: cn=config
createTimestamp: 20191120015848Z
entryCSN: 20191120015848.793262Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20191120015848Z
[root@cc ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@cc ~]# chown -R ldap.ldap /var/lib/ldap
[root@cc ~]# slaptest -u
5dd49e8b ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif"
5dd49e8b ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif"
config file testing succeeded
[root@cc ~]# systemctl start slapd
[root@cc ~]# systemctl enable slapd
Created symlink from /etc/systemd/system/multi-user.target.wants/slapd.service to /usr/lib/systemd/system/slapd.service.
[root@cc ~]# netstat -tunlp | egrep "389|636"
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 2370/slapd
tcp6 0 0 :::389 :::* LISTEN 2370/slapd
[root@cc ~]# cd /etc/openldap/schema/
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f cosine.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f nis.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f collective.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f corba.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f core.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f duaconf.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f dyngroup.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f inetorgperson.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f java.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f misc.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f openldap.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f pmi.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f ppolicy.ldif
[root@cc schema]# cd /usr/share/migrationtools/
[root@cc migrationtools]# vim migrate_common.ph
$NAMINGCONTEXT{'group'} = "ou=Group"; ##num61
$DEFAULT_MAIL_DOMAIN = "jcici.com"; ##num71
$DEFAULT_BASE = "dc=jcici,dc=com"; ##num74
$EXTENDED_SCHEMA = 1; ##num90
[root@cc migrationtools]# ./migrate_base.pl > /root/base.ldif
[root@cc migrationtools]# ldapadd -x -W -D "cn=admin,dc=jcici,dc=com" -f /root/base.ldif
三、添加账号已经测试验证
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f cosine.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f nis.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f collective.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f corba.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f core.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f duaconf.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f dyngroup.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f inetorgperson.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f java.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f misc.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f openldap.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f pmi.ldif
[root@cc ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f ppolicy.ldif
[root@cc ~]# mkdir /home/guests
[root@cc ~]# useradd -d /home/guests/ldapuser1 ldapuser1
[root@cc ~]# useradd -d /home/guests/ldapuser2 ldapuser2
[root@cc ~]# echo 'password' | passwd --stdin ldapuser1
[root@cc ~]# echo 'password' | passwd --stdin ldapuser2
[root@cc ~]# getent passwd | tail -n 5 > /root/users
[root@cc ~]# getent shadow | tail -n 5 > /root/shadow
[root@cc ~]# getent group | tail -n 5 > /root/groups
[root@cc ~]# cd /usr/share/migrationtools
[root@cc ~]# vim migrate_passwd.pl
open(SHADOW, "/root/shadow") || return; ##num188
[root@cc ~]# ./migrate_passwd.pl /root/users > users.ldif
[root@cc ~]# ./migrate_group.pl /root/groups > groups.ldif
[root@cc ~]# ldapadd -x -W -D "cn=admin,dc=jcici,dc=com" -f users.ldif
[root@cc ~]# ldapadd -x -W -D "cn=admin,dc=jcici,dc=com" -f groups.ldif
[root@cc ~]# ldapsearch -x -b "dc=jcici,dc=com" -H ldap://127.0.0.1
客户端验证
[root@k8s-es7-27 ~]# yum install -y nss-pam*
[root@k8s-es7-27 ~]# authconfig-tui
[root@k8s-es7-27 ~]# su ldapuser1
bash-4.2$ whoami
ldapuser1
bash-4.2$