centos6.5安装openLDAP2.3
查看系统版本,内核,定时任务同步时间,关闭防火墙selinux等
[root@ldap-master ~]# cat /etc/redhat-release CentOS release 6.5 (Final) [root@ldap-master ~]# uname -r 2.6.32-431.el6.x86_64 [root@ldap-master ~]# crontab -l #time update by root */5 * * * * /usr/sbin/ntpdate ntp1.aliyun.com >/dev/null 2>&1 [root@ldap-master ~]# getenforce Disabled [root@ldap-master ~]# /etc/init.d/iptables status iptables: Firewall is not running. [root@ldap-master ~]# echo "10.0.0.4 test.org" >>/etc/hosts [root@ldap-master ~]# tail -1 /etc/hosts 10.0.0.4 test.org
安装openLDAP
[root@ldap-master ~]# rpm -qa|grep openldap* compat-openldap-2.3.43-2.el6.x86_64 openldap-2.4.23-32.el6_4.1.x86_64 [root@ldap-master ~]# yum -y install openldap openldap-* --skip-broken #<===此步骤出错检查yum源配置,网络,DNS等是否正确 [root@ldap-master ~]# yum -y install nscd nss-pam-ldap nss* pcre pcre-* --skip-broken #<===此步骤如果出错,执行下面一条命令,然后重新再执行本条命令再继续下一步 [root@ldap-master ~]# yum -y update nss-softokn-freebl [root@ldap-master ~]# rpm -qa|grep openldap* #<===保证以下软件安装完毕 openldap-2.4.40-16.el6.x86_64 openldap-clients-2.4.40-16.el6.x86_64 openldap-servers-2.4.40-16.el6.x86_64 openldap-devel-2.4.40-16.el6.x86_64 openldap-servers-sql-2.4.40-16.el6.x86_64 compat-openldap-2.3.43-2.el6.x86_64
查看yum安装的openLDAP软件所在目录路径(没有列出所有,只列出重要的)
[root@ldap-master ~]# rpm -ql openldap-servers-2.4.40-16.el6.x86_64 /etc/openldap/slapd.conf #<===/etc/openldap为配置文件目录 /etc/openldap/slapd.conf.bak /etc/openldap/slapd.d /etc/portreserve/slapd ...... /usr/share/openldap-servers #<===服务端目录 /usr/share/openldap-servers/DB_CONFIG.example #<===数据库配置文件样本 /usr/share/openldap-servers/slapd.conf.obsolete #<===2.3版本主配置文件样本 /usr/share/openldap-servers/slapd.ldif.example #ldif 文件样本 /var/lib/ldap #<===数据库所在路径(默认为空) /var/run/openldap #进程pid目录
配置ldap2.3版本主配置文件slapd.conf
[root@ldap-master ~]# cd /etc/openldap/ [root@ldap-master openldap]# ll total 20 drwxr-xr-x. 2 root root 4096 Feb 25 17:03 certs -rw-r----- 1 root ldap 121 Mar 22 2017 check_password.conf -rw-r--r-- 1 root root 280 Mar 22 2017 ldap.conf drwxr-xr-x 2 root root 4096 Feb 25 17:03 schema drwxr-x--- 3 ldap ldap 4096 Feb 25 17:03 slapd.d [root@ldap-master openldap]# ll slapd.d/ total 8 drwxr-x--- 3 ldap ldap 4096 Feb 25 17:03 cn=config -rw-r----- 1 ldap ldap 1281 Feb 25 17:03 cn=config.ldif [root@ldap-master openldap]# cp /usr/share/openldap-servers/slapd.conf.obsolete ./slapd.conf [root@ldap-master openldap]# ll total 28 drwxr-xr-x. 2 root root 4096 Feb 25 17:03 certs -rw-r----- 1 root ldap 121 Mar 22 2017 check_password.conf -rw-r--r-- 1 root root 280 Mar 22 2017 ldap.conf drwxr-xr-x 2 root root 4096 Feb 25 17:03 schema -rw-r--r-- 1 root root 4635 Feb 25 17:25 slapd.conf #<===2.3版本配置文件目录 drwxr-x--- 3 ldap ldap 4096 Feb 25 17:03 slapd.d #<===2.4版本配置文件目录 [root@ldap-master openldap]# slap #<===查看所有slapd相关命令 slapacl slapauth slapd slapindex slapschema slapadd slapcat slapdn slappasswd slaptest [root@ldap-master openldap]# slappasswd -s 123456|sed -e 's#{SSHA}#rootpw\t{SSHA}#g' >>/etc/openldap/slapd.conf #<===此命令生成ldap管理员加密密码(明文密码为123456) [root@ldap-master openldap]# tail -1 /etc/openldap/slapd.conf rootpw {SSHA}cwkGLG6/cxNyInMajMw9kkXebbLBesTx [root@ldap-master openldap]# vi /etc/openldap/slapd.conf #<===修改配置文件内容为如下(解释部分) [root@ldap-master openldap]# cat /etc/openldap/slapd.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules # - modulepath is architecture dependent value (32/64-bit system) # - back_sql.la overlay requires openldap-server-sql package # - dyngroup.la and dynlist.la cannot be used at the same time # modulepath /usr/lib/openldap # modulepath /usr/lib64/openldap # moduleload accesslog.la # moduleload auditlog.la # moduleload back_sql.la # moduleload chain.la # moduleload collect.la # moduleload constraint.la # moduleload dds.la # moduleload deref.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload memberof.la # moduleload pbind.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload seqmod.la # moduleload smbk5pwd.la # moduleload sssvlv.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by running # /usr/libexec/openldap/generate-server-cert.sh. Your client software may balk # at self-signed certificates, however. TLSCACertificatePath /etc/openldap/certs TLSCertificateFile "\"OpenLDAP Server\"" TLSCertificateKeyFile /etc/openldap/certs/password # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! # enable on-the-fly configuration (cn=config) # enable server status monitoring (cn=monitor) #<===以下是在删除配置文件98-108增加的内容 access to * #<===将原来98-108行(2.4版本的内容)注释掉或者删除掉,然后增加这4行安全方面的优化内容 by self write by anonymous auth by * read #<===此4行意思是用户可以修改并更新自己的密码,身份验证允许检索用户的密码 ####################################################################### # database definitions ####################################################################### database bdb #<===指定数据库为dbd格式 suffix "dc=test,dc=org" #<===指定ldap要使用的后缀 checkpoint 2048 10 #<===设置每达到2048KB或者每10分钟执行一次写数据进磁盘的checkpoint操作 rootdn "cn=admin,dc=test,dc=org" #<===指定管理员的DN,使用此DN可以登录管理openLDAP服务器 # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com@EXAMPLE.COM rootpw {SSHA}cwkGLG6/cxNyInMajMw9kkXebbLBesTx #<===以下是增加的内容 loglevel 296 #<===日志级别(由256日志链接/操作/结果,32搜索过滤器,8链接管理器一起构成) cachesize 1000 #<===设置ldap可以缓存的记录数
配置rsyslog服务记录openLDAP服务日志
[root@ldap-master openldap]# echo 'local4.* /var/log/ldap.log' >>/etc/rsyslog.conf [root@ldap-master openldap]# tail -2 /etc/rsyslog.conf #ldap.log by root 2019/02/25 local4.* /var/log/ldap.log [root@ldap-master openldap]# /etc/init.d/rsyslog start Shutting down system logger: [ OK ] Starting system logger: [ OK ] [root@ldap-master openldap]# lsof -i :389 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME slapd 5499 ldap 7u IPv4 20606 0t0 TCP *:ldap (LISTEN) slapd 5499 ldap 8u IPv6 20607 0t0 TCP *:ldap (LISTEN) [root@ldap-master openldap]# cat /var/log/ldap.log #<===启动服务后,此文件中有内容证明配置rsyslog没有错误 Feb 25 18:00:14 ldap-master slapd[5498]: @(#) $OpenLDAP: slapd 2.4.40 (Mar 22 2017 06:29:21) $#012#011mockbuild@c1bm.rdu2.centos.org:/builddir/build/BUILD/openldap-2.4.40/openldap-2.4.40/build-servers/servers/slapd
配置ldap数据库并授权,slapd服务加入开机自启动,配置了数据库后重启服务提示有错误及其解决办法
[root@ldap-master openldap]# pwd /etc/openldap [root@ldap-master openldap]# ll /var/lib/ldap/ total 0 [root@ldap-master openldap]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG [root@ldap-master openldap]# ll /var/lib/ldap/ total 4 -rw-r--r-- 1 root root 845 Feb 25 17:57 DB_CONFIG [root@ldap-master openldap]# chown -R ldap.ldap /var/lib/ldap [root@ldap-master openldap]# chmod 700 /var/lib/ldap/DB_CONFIG [root@ldap-master openldap]# ll /var/lib/ldap/ total 4 -rwx------ 1 ldap ldap 845 Feb 25 17:57 DB_CONFIG [root@ldap-master openldap]# slaptest -u #<===此命令用于检查ldap配置是否出错 config file testing succeeded [root@ldap-master openldap]# /etc/init.d/slapd start Starting slapd: [ OK ] [root@ldap-master openldap]# chkconfig --level 3 slapd on [root@ldap-master openldap]# chkconfig --list|grep slapd slapd 0:off 1:off 2:off 3:on 4:off 5:off 6:off [root@ldap-master openldap]# /etc/init.d/slapd restart #<===重新启动slapd服务提示错误(原因:openLDAP2.3与2.4配置文件不一样导致) Stopping slapd: [ OK ] ls: cannot access /etc/openldap/slapd.d//cn=config/olcDatabase*.ldif: No such file or directory Starting slapd: [ OK ]
解决办法:重新生成基于2.3版本的配置文件
[root@ldap-master openldap]# ll total 32 drwxr-xr-x. 2 root root 4096 Feb 25 17:03 certs -rw-r----- 1 root ldap 121 Mar 22 2017 check_password.conf -rw-r--r-- 1 root root 280 Mar 22 2017 ldap.conf drwxr-xr-x 2 root root 4096 Feb 25 17:03 schema -rw-r--r-- 1 root root 4478 Feb 25 17:49 slapd.conf drwxr-x--- 3 ldap ldap 4096 Feb 25 17:03 slapd.d drwxr-x--- 3 ldap ldap 4096 Feb 25 17:03 slapd.d.2019-02-25.bak [root@ldap-master openldap]# rm -fr slapd.d/* [root@ldap-master openldap]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d [root@ldap-master openldap]# ll /etc/openldap/slapd.d/* -rw------- 1 root root 1301 Feb 25 18:08 /etc/openldap/slapd.d/cn=config.ldif /etc/openldap/slapd.d/cn=config: total 76 drwxr-x--- 2 root root 4096 Feb 25 18:08 cn=schema -rw------- 1 root root 59398 Feb 25 18:08 cn=schema.ldif -rw------- 1 root root 584 Feb 25 18:08 olcDatabase={0}config.ldif -rw------- 1 root root 2710 Feb 25 18:08 olcDatabase={1}bdb.ldif -rw------- 1 root root 660 Feb 25 18:08 olcDatabase={-1}frontend.ldif [root@ldap-master openldap]# chown -R ldap.ldap /etc/openldap/slapd.d [root@ldap-master openldap]# /etc/init.d/slapd restart Stopping slapd: [ OK ] Starting slapd: [ OK ] [root@ldap-master openldap]# lsof -i :389 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME slapd 5618 ldap 7u IPv4 21201 0t0 TCP *:ldap (LISTEN) slapd 5618 ldap 8u IPv6 21202 0t0 TCP *:ldap (LISTEN)
验证openLDAP2.3安装成功
[root@ldap-master openldap]# ldapsearch -LLL -W -x -H ldap://test.org -D "cn=admin,dc=test,dc=org" -b "dc=test,dc=org" "(uid=*)" Enter LDAP Password: #<===这里输入前面设置的ldap管理员admin的密码123456 No such object (32) #<===正常情况下,输入正确密码登录,内容为空证明以上所有配置正确(如果输入正确的密码登录提示错误证明配置有错误)
配置web管理openLDAP
[root@ldap-master openldap]# yum -y install httpd php php-ldap php-gd
[root@ldap-master openldap]# rpm -qa httpd php php-ldap php-gd
httpd-2.2.15-69.el6.centos.x86_64
php-5.3.3-49.el6.x86_64
php-ldap-5.3.3-49.el6.x86_64
php-gd-5.3.3-49.el6.x86_64
[root@ldap-master openldap]# cd /var/www/html/
[root@ldap-master html]# ll
total 0
[root@ldap-master html]# rz -y
rz waiting to receive.
???a? zmodem ′???£ °′ Ctrl+C ???£
?[root@ldap-master html]# rz -y
rz waiting to receive.
???a? zmodem ′???£ °′ Ctrl+C ???£
??′?? ldap-account-manager-3.7.tar.gz...
100% 8942 KB 8942 KB/s 00:00:01 0 ′?
?[root@ldap-master html]# ll
total 8944
-rw-r--r-- 1 root root 9157357 Feb 21 15:00 ldap-account-manager-3.7.tar.gz
[root@ldap-master html]# tar xf ldap-account-manager-3.7.tar.gz
[root@ldap-master html]# mv ldap-account-manager-3.7 ldap
[root@ldap-master html]# cd ldap/config
[root@ldap-master config]# cp config.cfg_sample config.cfg
[root@ldap-master config]# cp lam.conf_sample lam.conf
[root@ldap-master config]# sed -i 's#cn=Manager#cn=admin#g' lam.conf
[root@ldap-master config]# sed -i 's#dc=my-domain#dc=test#g' lam.conf
[root@ldap-master config]# sed -i 's#dc=com#dc=org#g' lam.conf
[root@ldap-master config]# chown -R apache.apache /var/www/html/ldap
[root@ldap-master config]# /etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: httpd: apr_sockaddr_info_get() failed for ldap-master
httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
[ OK ]
[root@ldap-master config]# lsof -i :80
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 5841 root 4u IPv6 24972 0t0 TCP *:http (LISTEN)
httpd 5843 apache 4u IPv6 24972 0t0 TCP *:http (LISTEN)
httpd 5844 apache 4u IPv6 24972 0t0 TCP *:http (LISTEN)
httpd 5845 apache 4u IPv6 24972 0t0 TCP *:http (LISTEN)
httpd 5846 apache 4u IPv6 24972 0t0 TCP *:http (LISTEN)
httpd 5847 apache 4u IPv6 24972 0t0 TCP *:http (LISTEN)
httpd 5848 apache 4u IPv6 24972 0t0 TCP *:http (LISTEN)
httpd 5849 apache 4u IPv6 24972 0t0 TCP *:http (LISTEN)
浏览器输入 http://10.0.0.4/ldap/templates/login.php 访问,输入ldap管理员admin的密码123456
安装Windows客户端管理软件LdapAdminExe-w64-1.8.3管理openLDAP(链接http://www.ldapadmin.org/download/ldapadmin.html)