LDAP服务部署

2023-07-31 20:36:52

1.安装基本环境

# yum -y install openldap openldap-devel openldap-servers openldap-clients

2.配置LDAP服务端

（1）拷贝LDAP配置文件至配置目录

# cp /usr/share/openldap-servers/slapd.conf.obsolete.slapd.conf /etc/openldap/slapd.conf

# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

# rm -rf /etc/openldap/slapd.d/*

（2）生成root加密字符串

# slappasswd -s liwanliang

# {SSHA}2PaTvmQgslWrvfW+1w5lZhGl53ZAciVJ

（3）编辑配置文件

# vim /etc/openldap/sladp.conf

# enable server status monitoring (cn=monitor)

database monitor

access to *

     by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read

         by dn.exact="cn=admin,dc=test,dc=com" read

         by * none

database    bdb

suffix      "dc=test,dc=com"

checkpoint  1024 15

rootdn      "cn=admin,dc=test,dc=com"

rootpw  {SSHA}2PaTvmQgslWrvfW+1w5lZhGl53ZAciVJ

（4）测试配置文件

# chown -R ldap:ldap /etc/openldap/slapd.d

service slapd start

# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d

（5）安装和配置migrationtools

# yum -y install migrationtools

# cd /usr/share/migrationtools

# vim migrate_common.h

# Default DNS domain

#$DEFAULT_MAIL_DOMAIN = "padl.com";

$DEFAULT_MAIL_DOMAIN = "test.com";

# Default base

$DEFAULT_BASE = "dc=test,dc=com";

（6）创建测试用户

创建一个用户，家目录在本地

# useradd liwanliang01

# password liwanliwang01

或创建一个块存储，用户存放用户家目录，通过NFS共享家目录

# dd if=/dev/zero of=/root/HOME bs=500M count=1

# mkfs.ext4 HOME

# mount -o loop /root/HOME /home

# useradd -d /home/liwl liwl

# yum -y install nfs-utils

# service rpcbind start && service nfs start

# vim /etc/export

/root/HOME  192.168.10.0/24(rw,no_root_squash,no_all_squash)

（7）生成ldif文件

# ./migrate_base.pl >/tmp/base.ldif

#./migrate_passwd.pl /etc/passwd > /tmp/passwd.ldif

#./migrate_group.pl /etc/group > /tmp/group.ldif

# service slapd restart

（8）导入文件

# ldapadd -x -D "cn=admin,dc=test,dc=com" -W -f /tmp/base.ldif

# ldapadd -x -D "cn=admin,dc=test,dc=com" -W -f /tmp/passwd.ldif

# ldapadd -x -D "cn=admin,dc=test,dc=com" -W -f /tmp/group.ldif

配置LDAP客户端

（1）环境部署

#yum -y install nss-pam-ldapd pam_ldap

（2）配置文件

1.配置/etc/sysconfig/authconfig

IPADOMAINJOINED=no

USEMKHOMEDIR=yes

USEPAMACCESS=no

CACHECREDENTIALS=yes

USESSSDAUTH=no

USESHADOW=yes

USEWINBIND=no

USEDB=no

PASSWDALGORITHM=yes

FORCELEGACY=yes

USEFPRINTD=yes

FORCESMARTCARD=no

USELDAPAUTH=yes

IPAV2NONTP=no

USEPASSWDQC=no

USELOCAUTHORIZE=yes

USECRACKLIB=yes

USEIPAV2=no

USEWINBINDAUTH=no

USESMARTCARD=no

USELDAP=yes

USENIS=no

USEKERBEROS=no

USESYSNETAUTH=yes

USESSSD=no

USEHESIOD=no

2.配置/etc/pam.d/system-auth

#%PAM-1.0

# This file is auto-generated.

# User changes will be destroyed the next time authconfig is run.

auth        required      pam_env.so

auth        sufficient    pam_fprintd.so

auth        sufficient    pam_unix.so nullok try_first_pass

auth        requisite     pam_succeed_if.so uid >= 500 quiet

auth        sufficient    pam_ladp.so user_first_pass

auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow

account     sufficient    pam_localuser.so

account     sufficient    pam_succeed_if.so uid < 500 quiet

account     [default=bad success=ok user_unknown=ignore] pam_ladp.so

#account        required      pam_ldap.so

account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=

password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok

password    sufficient    pam_ldap.so use_authtok

password    required      pam_deny.so

session     optional      pam_keyinit.so revoke

session     required      pam_limits.so

session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid

session     required      pam_unix.so

session     optional      pam_ldap.so

3.配置/etc/nsswitch.conf

passwd:     files ldap

shadow:     files ldap

group:      files ldap

#hosts:     db files nisplus nis dns

hosts:      files dns

# Example - obey only what nisplus tells us...

#services:   nisplus [NOTFOUND=return] files

#networks:   nisplus [NOTFOUND=return] files

#protocols:  nisplus [NOTFOUND=return] files

#rpc:        nisplus [NOTFOUND=return] files

#ethers:     nisplus [NOTFOUND=return] files

#netmasks:   nisplus [NOTFOUND=return] files

bootparams: nisplus [NOTFOUND=return] files

ethers:     files

netmasks:   files

networks:   files

protocols:  files

rpc:        files

services:   files

netgroup:   files ldap

publickey:  nisplus

automount:  files ldap

aliases:    files nisplus

4.配置/etc/pam_ldap.conf

uri ldap://192.168.80.51/

ssl no

tls_cacertdir /etc/openldap/cacerts

pam_password md5

5.配置/etc/nslsc.conf

uid nslcd

gid ldap

# This comment prevents repeated auto-migration of settings.

uri ldap://192.168.80.51/

base dc=test,dc=com

#ssl start_tls

#tls_cacertdir /etc/openldap/cacerts

6.启动服务

# service nslcd start

# service nscd start

7.验证

# su - liwl

码农公寓