openldap 单节点编译安装
1、获取源码包
#下载Berkeley DB
www.oracle.com/technetwork/database/database-technologies/berkeleydb/
#下载OpenLDAP
www.openldap.org/software/download
#安装依赖
yum install openssl-devel gcc libtool-ltdl-devel
2、编译安装Berkeley DB
#解压
tar zxvf db-5.3..tar.gz
cd db-5.3.
#编译
cd build_unix/
../dist/configure --prefix=/usr/local/bd-5.3.
make && make install
3、编译安装openldap
#解压
tar zxvf openldap-2.4..tgz
cd openldap-2.4.
#编译
./configure --prefix=/usr/local/openldap --enable-wrappers --enable-syslog --enable-modules --with-tls=openssl CPPFLAGS="-I/usr/local/bd-5.3.28/include" LDFLAGS="-L/usr/local/bd-5.3.28/lib -Wl,-rpath,/usr/local/bd-5.3.28/lib" make && make install
4、修改配置
cd /usr/local/openldap/etc/openldap && mv DB_CONFIG.example DB_CONFIG
cd /usr/local/openldap/var/openldap-data && mv DB_CONFIG.example DB_CONFIG
ln -s /usr/local/openldap/bin/* /usr/bin/
ln -s /usr/local/openldap/sbin/* /usr/sbin/
#启动
/usr/local/openldap/libexec/slapd
Yum安装方式
yum install openldap-servers openldap-clients
服务端初始化
cn=config语法 (语法严格“：”后必须有空格，每行必须没有空格)
dn:
changetype: modify
add/delete/replace:
olcRootPW: ********
objectClass:
1、设置Openldap-server的管理密码：
命令：slappasswd
slapdpasswd:
{SSHA}KLfXV8ipw55AY0bwcZGDZX7JQENgUaWs
2、创建密码：
cat << EOF | ldapadd -Y EXTERNAL -H ldapi:///
dn: olcDatabase={}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}l9gQmGTK9TsC7SUQpVOpm/aimoYYdPd3
EOF
3、导入常用的schema文件：
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/ppolicy.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/dyngroup.ldif
4、设置域名：
cat << EOF | ldapadd -Y EXTERNAL -H ldapi://
dn: olcDatabase={}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
al,cn=auth" read by dn.base="cn=Manager,dc=suixingpay,dc=com" read by * none dn: olcDatabase={}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=suixingpay,dc=com dn: olcDatabase={}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=suixingpay,dc=com dn: olcDatabase={}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}KLfXV8ipw55AY0bwcZGDZX7JQENgUaWs
EOF
5、设置组织架构
cat << EOF | ldapadd -x -D cn=Manager,dc=suixingpay,dc=com -W
dn: dc=suixingpay,dc=com
objectClass: dcObject
objectClass: organization
dc: suixingpay
o: suixingpay.com dn: ou=研发中心,dc=suixingpay,dc=com
objectClass: organizationalUnit
objectClass: top
ou: 研发中心 dn: ou=运维部,ou=研发中心,dc=suixingpay,dc=com
objectClass: organizationalUnit
objectClass: top
ou: 运维部 dn: cn=Manager,dc=suixingpay,dc=com
objectClass: organizationalRole
cn: Manager dn: cn=应用运维组,ou=运维部,ou=研发中心,dc=suixingpay,dc=com
objectClass: posixGroup
cn: 应用运维组
gidNumber:
EOF
6、添加用户
cat << EOF | ldapadd -x -D cn=Manager,dc=suixingpay,dc=com -W
dn: uid=zhai_kun,ou=运维部,ou=研发中心,dc=suixingpay,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
homeDirectory: /home/zhai_kun
userPassword: {SSHA}l9gQmGTK9TsC7SUQpVOpm/aimoYYdPd3
loginShell: /bin/bash
cn: 应用运维组
uidNumber:
gidNumber:
sn: System Administrator
mail: zhai_kun@suixingpay.com
postalAddress: beijing
mobile:
EOF
centons 7 客户端部署
1、安装
yum install nss-pam-ldapd -y
2、authconfig备份还原
authconfig --savebackup=openldap.bak (备份)
authconfig --restorebackup=openldap.bak (还原)
3、配置
authconfig --enableldap --enableldapauth --ldapserver=ldap://172.16.138.87 --disableldaptls --enablemkhomedir --ldapbasedn="dc=suixingpay,dc=com" --update
4、验证
id zhai_kun
getent passwd zhai_kun
getent shadow zhai_kun
5、登录
[root@openldap02 ~]# ssh zhai_kun@172.16.138.88
The authenticity of host '172.16.138.88 (172.16.138.88)' can't be established.
ECDSA key fingerprint is dc:b1:7f:2e::::6d:5d::d6:c7:8b:5c:a6:.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.16.138.88' (ECDSA) to the list of known hosts.
zhai_kun@172.16.138.88's password:
Last login: Wed Jun :: from 172.16.40.86
/usr/bin/id: cannot find name for group ID
[zhai_kun@openldap02 ~]$