在RHEL6.5中部署LDAP服务

  1. 安装yum包
yum install openldap-servers migrationtools
  1. 建立slapd配置, 抄录密码密文
cp /usr/share/openldap-servers/slapd.conf.obsolete /etc/openldap/slapd.conf
slappasswd
vi /etc/openldap/slapd.conf

增加 loglevel 4095 记录日志
更改suffix 为 “dc=mydomain, dc=com”
更改rootdn 为 “cn=Manager, dc=mydomain, dc=com”
更改rootpw 密码为 slappasswd生成的密文

允许用户更改自己的密码
必须在.database config 前

 
# 允许自己修改userPassword属性. 用户度, 匿名用户需验证
access to attr=userPassword
        by self write
        by users read
        by anonymous auth
 
#  默认允许读
access to * by * read
 
...
 
database config

更改 /etc/rsyslog.conf 记录日志
# OpenLDAP log
local4.* /var/log/ldap.log

  1. 拷贝DB_CONFIG文件到指定目录
cp /usr/share/openldap-servers/DB_CONFIG.example  /var/lib/ldap/DB_CONFIG
  1. 清空旧配置,不清空会引起后续ldapadd时密码错误
rm -fr /etc/openldap/slapd.d/*
  1. 测试并生成配置
slaptest  -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
slaptest -u -f /etc/openldap/slapd.conf
  1. 赋予生成的配置文件权限, 防火墙开放389(ldap端口)
chown -R ldap:ldap /etc/openldap/slapd.d
 
iptables -I INPUT 行号 -m state --state NEW -m udp -p udp --dport 389 -j ACCEPT
iptables -I INPUT 行号 -m state --state NEW -m tcp -p tcp --dport 389 -j ACCEPT
service iptables save
  1. 启动服务
chkconfig slapd on
service slapd start
  1. 迁移系统用户或相关信息到到LDAP
vi /usr/share/migrationtools/migrate_common.ph
     70 # Default DNS domain
     71 $DEFAULT_MAIL_DOMAIN = "mydomain.com";
     72 
     73 # Default base
     74 $DEFAULT_BASE = "dc=mydomain, dc=com";

创建根项
其他项(user, group, host等类似操作)
迁移系统用户到ldap数据库

/usr/share/migrationtools/migrate_base.pl > ~/base.ldif
ldapadd -D "cn=Manager, dc=mydomain, dc=com" -W -x -f ~/base.ldif
 
/usr/share/migrationtools/migrate_passwd.pl /etc/passwd ~/passwd.ldif
ldapadd -D "cn=Manager, dc=mydomain, dc=com" -W -x -f ~/passwd.ldif
 
 /usr/share/migrationtools/migrate_group.pl /etc/group ~/group.ldif
ldapadd -D "cn=Manager, dc=mydomain, dc=com" -W -x -f ~/group.ldif
 
/usr/share/migrationtools/migrate_hosts.pl /etc/hosts ~/hosts.ldif
ldapadd -D "cn=Manager, dc=mydomain, dc=com" -W -x -f ~/hosts.ldif
  1. 客户端配置
vi /etc/nsswitch.conf
or
authconfig-tui
or
authconfig --enablemkhomedir --enableldap --enableldapauth --ldapserver=ldap://127.0.0.1 --ldapbasedn="dc=mydomain,dc=com" --update

qq-photo20161118142907
qq-photo20161118143231

  1. 安装 phpldapadmin
    下载 phpldapadmin-1.2.3.zip 到 /www/phpldapadmin/ 目录
    配置httpd 创建 openldap.platform站点
unzip phpldapadmin-1.2.3.zip
cp /www/phpldapadmin/config/config.php.example /www/phpldapadmin/config/config.php
 
chcon -usystem_u -robject_r -thttpd_sys_content_t -R /www/phpldapadmin/
 
vi /etc/httpd/conf/httpd.conf
<VirtualHost *:80>
    DocumentRoot /www/phpldapadmin/
    ServerName openldap.platform
    <Directory "/www/phpldapadmin/">
        Options All
        AllowOverride None
        Order Deny,Allow
        Deny From all
        Allow From 127.0.0.1
    </Directory>
</VirtualHost>

参考:

⁠Chapter 13. Configuring Authentication

Leave a Reply

Your email address will not be published.

Time limit is exhausted. Please reload the CAPTCHA.

Proudly powered by WordPress   Premium Style Theme by www.gopiplus.com