Centos7下安装OpenLDAP+Phpldapadmin及主主同步

2021-06-27 00:08:08

1、环境介绍及初始化准备

server1：172.16.138.87 openldap01
server2：172.16.138.88 openldap02

配置yum源

wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo

mv /etc/yum.repos.d/epel.repo /etc/yum.repos.d/epel.repo.backup

wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo

yum clean all

yum makecache

关闭selinux和防火墙

systemctl stop firewalld.service

systemctl disable firewalld.service

sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config

setenforce

2、安装OpenLDAP(以下操作两台主机上执行)

yum install openssl-devel gcc libtool-ltdl-devel -y

yum install openldap-servers openldap-clients -y

3、配置OpenLDAP(以下操作两台主机上执行)

OpenLDAP配置比较复杂牵涉到的内容比较多，接下来我们一步一步对其相关的配置进行介绍。

注意:从OpenLDAP2.4.23版本开始所有配置数据都保存在/etc/openldap/slapd.d/中，建议不再使用slapd.conf作为配置文件。

3.1、配置管理员密码

命令：slappasswd

slapdpasswd:

{SSHA}KLfXV8ipw55AY0bwcZGDZX7JQENgUaWs

通过slappasswd命令对管理员密码进行加密，上述加密后的字段保存下，等会我们在配置文件中会使用到。

3.2、创建密码

cat << EOF | ldapadd -Y EXTERNAL -H ldapi:///

dn: olcDatabase={}config,cn=config

changetype: modify

add: olcRootPW

olcRootPW: {SSHA}l9gQmGTK9TsC7SUQpVOpm/aimoYYdPd3

EOF

3.3、导入常用的schema文件：

ldapadd -Y EXTERNAL  -H ldapi:/// -f /etc/openldap/schema/cosine.ldif

ldapadd -Y EXTERNAL  -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif

ldapadd -Y EXTERNAL  -H ldapi:/// -f /etc/openldap/schema/ppolicy.ldif

ldapadd -Y EXTERNAL  -H ldapi:/// -f /etc/openldap/schema/nis.ldif

ldapadd -Y EXTERNAL  -H ldapi:/// -f /etc/openldap/schema/dyngroup.ldif

3.4、设置域名

cat << EOF | ldapadd -Y EXTERNAL -H ldapi://

dn: olcDatabase={}monitor,cn=config

changetype: modify

replace: olcAccess

olcAccess: {}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern

 al,cn=auth" read by dn.base="cn=Manager,dc=suixingpay,dc=com" read by * none

dn: olcDatabase={}hdb,cn=config

changetype: modify

replace: olcSuffix

olcSuffix: dc=suixingpay,dc=com

dn: olcDatabase={}hdb,cn=config

changetype: modify

replace: olcRootDN

olcRootDN: cn=Manager,dc=suixingpay,dc=com

dn: olcDatabase={}hdb,cn=config

changetype: modify

add: olcRootPW

olcRootPW: {SSHA}KLfXV8ipw55AY0bwcZGDZX7JQENgUaWs

EOF

3.5、添加用户

dn: uid=zhaikun,ou=People,dc=suixingpay,dc=com

objectClass: inetOrgPerson

objectClass: posixAccount

objectClass: shadowAccount

uid: zhaikun

cn: zhaikun

sn: user

userPassword: {SSHA}g0UwZPzG0CFez6YkzPW6XZrawSQBcGda

uidNumber:

gidNumber:

mail: zhai_kun@suixingpay.com

title: user

homeDirectory: /home/zhaikun

dn: cn=systemadmin,ou=Group,dc=suixingpay,dc=com

objectClass: posixGroup

cn: systemadmin

gidNumber:

memberUid: systemadmin

ldapadd -x -D cn=Manager,dc=suixingpay,dc=com -w123456 -f  user.ldif

3.6、配置OpenLDAP日志

修改日志配置文件

/etc/rsyslog.conf

local4.*    /var/log/ldap.log

重启rsyslog
systemctl restart rsyslog
配置日志
cat << EOF | ldapmodify -Y EXTERNAL -H ldapi:///    
dn: cn=config
changetype: modify
add: olcLoglevel
olcLogLevel: -1
EOF

修改级别
cat << EOF | ldapmodify -Y EXTERNAL -H ldapi:///
dn: cn=config
changetype: modify
replace: olcLoglevel
olcLoglevel: 256
EOF

systemctl restart slapd

4、配置双主复制(以下操作两台主机上执行)

4.1、配置LDAP主程序，增加syncprov module

[root@openldap01 ~]# vim mod_syncprov.ldif

dn: cn=module,cn=config

objectClass: olcModuleList

cn: module

olcModulePath: /usr/lib64/openldap

olcModuleLoad: syncprov.la

[root@openldap01 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f mod_syncprov.ldif
SASL/EXTERNAL authentication started

SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

SASL SSF: 0

adding new entry "cn=module,cn=config"

[root@openldap01 ~]# vim syncprov.ldif 
dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
olcSpSessionLog: 100

[root@openldap01 ~]#ldapadd -Y EXTERNAL -H ldapi:/// -f syncprov.ldif
SASL/EXTERNAL authentication started

SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "olcOverlay=syncprov,olcDatabase={2}hdb,cn=config"

4.2、配置LDAP消费者

[root@openldap01 ~]# vim master01.ldif

# create new

dn: cn=config

changetype: modify

replace: olcServerID

# specify uniq ID number on each server

olcServerID:                       #server2上替换为1

dn: olcDatabase={}hdb,cn=config

changetype: modify

add: olcSyncRepl

olcSyncRepl: rid=

  provider=ldap://172.16.138.88:389/    #主2上替换为172.16.138.87:389

  bindmethod=simple

  binddn="cn=Manager,dc=suixingpay,dc=com"

  credentials=suixingpay                           #明文密码，也可以加密

  searchbase="dc=suixingpay,dc=com"

  scope=sub

  schemachecking=on

  type=refreshAndPersist

  retry="30 5 300 3"

  interval=:::

-

add: olcMirrorMode

olcMirrorMode: TRUE

dn: olcOverlay=syncprov,olcDatabase={}hdb,cn=config

changetype: add

objectClass: olcOverlayConfig

objectClass: olcSyncProvConfig

olcOverlay: syncprov

[root@openldap01 ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f master01.ldif

SASL/EXTERNAL authentication started

SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

SASL SSF: 0

modifying entry "cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

adding new entry "olcOverlay=syncprov,olcDatabase={2}hdb,cn=config"

配置LDAP客户端也绑定LDAP消费者

 [root@test1 ~]# authconfig --ldapserver=172.16.138.87,172.16.138.88 --update

5、PhpLDAPAdmin安装

5.1、安装

yum install phpldapadmin -y

yum install httpd php php-bcmath php-gd php-mbstring php-xml php-ldap -y

systemctl restart httpd && systemctl  enable httpd

5.2、配置httpd

vim /etc/httpd/conf/httpd.conf

#添加index.php

<IfModule dir_module>

    DirectoryIndex index.html index.php

</IfModule>

#新增(支持phph)

    AddType application/x-httpd-php .php

    AddType application/x-httpd-php-source .phps

#修改ServerName

ServerName ldapserver.suixingpay.com

#新增ldapadmin 条目

<Directory /usr/share/phpldapadmin/htdocs>

  <IfModule mod_authz_core.c>

    # Apache 2.4

    Require all granted

  </IfModule>

</Directory>

#添加alias

     Alias /phpldapadmin /usr/share/phpldapadmin/htdocs

        Alias /ldapadmin /usr/share/phpldapadmin/htdocs

systemctl restart httpd

5.3配置OpenLDAPserver

vim /usr/share/phpldapadmin/config/config.php

$servers->newServer('ldap_pla');

$servers->setValue('server','name','LDAP Server');

$servers->setValue('server','host','172.16.138.87');

$servers->setValue('server','port',);

$servers->setValue('server','base',array('dc=suixingpay,dc=com'));

$servers->setValue('login','auth_type','cookie');

$servers->setValue('login','bind_id','');

$servers->setValue('login','bind_pass','');

$servers->setValue('server','tls',false);

5.4、打开PhpLADPAdmin

6、测试同步

####server01 添加jaxzhai用户

[root@openldap01 ~]# ldapadd -x -D "cn=Manager,dc=suixingpay,dc=com" -W -f ldapuser.ldif

Enter LDAP Password:

adding new entry "uid=jaxzhai,ou=People,dc=suixingpay,dc=com"

[root@openldap01 ~]#

####server02 查看是否同步

root@openldap02 ~]# ldapsearch -x -b "dc=suixingpay,dc=com" -H ldap://127.0.0.1| grep jaxzhai

# jaxzhai, People, suixingpay.com

dn: uid=jaxzhai,ou=People,dc=suixingpay,dc=com

uid: jaxzhai

cn: jaxzhai

homeDirectory: /home/jaxzhai

[root@openldap02 ~]# 

####server02 删除jaxzhai用户

[root@openldap02 ~]# ldapdelete -x -D "cn=Manager,dc=suixingpay,dc=com" -W -h172.16.138. "uid=jaxzhai,ou=People,dc=suixingpay,dc=com"

Enter LDAP Password:

[root@openldap02 ~]# 

####server01 查看是否同步

[root@openldap01 ~]# ldapsearch -x -b "dc=suixingpay,dc=com" -H ldap://127.0.0.1| grep jaxzhai

[root@openldap01 ~]#

码农公寓