openldap 双主模式部署
规划两台机器
系统版本centos7.5
master1上部署ldap:
一、安装启动openldap软件
yum -y install openldap compat-openldap openldap-clients openldap-servers openldap-servers-sql openldap-devel migrationtools
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG chown ldap:ldap -R /var/lib/ldap chmod 700 -R /var/lib/ldap
systemctl enable slapd
systemctl start slapd
systemctl status slapd
二、配置openldap管理员密码
先自行生成秘钥 >>>>> 命令: slappassword -s "密码" 本文用root@123
编写ldif文件 添加进去密码字段
cat >/root/chrootpw.ldif << EOF #specify the password generated above for “olcRootPW” section dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}FC/YWM2DGSuhn5vuKaK92pF1EwGVdznj #根据自行生成的秘钥修改 EOF ldapadd -Y EXTERNAL -H ldapi:/// -f /root/chrootpw.ldif
三、导入相关openldap属性
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
四、修改openldap的基本配置
cat > /root/chdomain.ldif << EOF # replace to your own domain name for "dc=***,dc=***" section # specify the password generated above for "olcRootPW" section dn: olcDatabase={1}monitor,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=root,dc=ztjy,dc=com" read by * none dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcSuffix olcSuffix: dc=ztjy,dc=com dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=root,dc=ztjy,dc=com dn: olcDatabase={2}hdb,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}cm/LXtPjAlGzPWta+Yn3mKiDH53rVfMD #管理员密码 自行生成修改 dn: olcDatabase={2}hdb,cn=config changetype: modify add: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=root,dc=ztjy,dc=com" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=root,dc=ztjy,dc=com" write by * read EOF
ldapmodify -Y EXTERNAL -H ldapi:/// -f /root/chdomain.ldif
五、导入基础数据库
cat >/root/basedomain.ldif << EOF # replace to your own domain name for "dc=***,dc=***" section dn: dc=root,dc=com objectClass: top objectClass: dcObject objectclass: organization o: Server Com dc: root dn: cn=root,dc=root,dc=com objectClass: organizationalRole cn: root description: Directory root dn: ou=People,dc=root,dc=com objectClass: organizationalUnit ou: People dn: ou=Group,dc=root,dc=com objectClass: organizationalUnit ou: Group EOF
如下导入basedomain.ldif文件时需要输入的密码是root@123
ldapadd -x -D cn=Manager,dc=huanqiu,dc=com -W -f basedomain.ldif
六、导入用户及用户组
cat > /root/user.ldif << EOF # create new # replace to your own domain name for "dc=***,dc=***" section dn: uid=kevin,ou=People,dc=huanqiu,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount cn: Kevin sn: Linux userPassword: {SSHA}NKGiugr+3ceSiv3tkgKYU5w5ywpDy/bP #自行修改 loginShell: /bin/bash uidNumber: 1000 gidNumber: 1000 homeDirectory: /home/kevin dn: cn=kevin,ou=Group,dc=huanqiu,dc=com objectClass: posixGroup cn: Kevin gidNumber: 1000 memberUid: kevin EOF
ldapadd -x -D cn=Manager,dc=huanqiu,dc=com -W -f ldapuser.ldif 导入用户 输入管理员密码
至此,master上配置已完成,可以用ldap管理工具去链接 管理员账号 cn=root,dc=ztjy,dc=com 密码:root@123
master2上配置:
一、安装启动openldap软件
yum -y install openldap compat-openldap openldap-clients openldap-servers openldap-servers-sql openldap-devel migrationtools
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG chown ldap:ldap -R /var/lib/ldap chmod 700 -R /var/lib/ldap
systemctl enable slapd
systemctl start slapd
systemctl status slapd
二、配置openldap管理员密码
先自行生成秘钥 >>>>> 命令: slappassword -s "密码" 本文用root@123
编写ldif文件 添加进去密码字段
cat >/root/chrootpw.ldif << EOF
#specify the password generated above for “olcRootPW” section
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}FC/YWM2DGSuhn5vuKaK92pF1EwGVdznj #根据自行生成的秘钥修改
EOF
ldapadd -Y EXTERNAL -H ldapi:/// -f /root/chrootpw.ldif
三、导入相关openldap属性
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
四、修改openldap的基本配置
cat > /root/chdomain.ldif << EOF
# replace to your own domain name for "dc=***,dc=***" section
# specify the password generated above for "olcRootPW" section
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=root,dc=ztjy,dc=com" read by * none
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=ztjy,dc=com
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=root,dc=ztjy,dc=com
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}cm/LXtPjAlGzPWta+Yn3mKiDH53rVfMD #管理员密码 自行生成修改
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=root,dc=ztjy,dc=com" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=root,dc=ztjy,dc=com" write by * read
EOF
ldapmodify -Y EXTERNAL -H ldapi:/// -f /root/chdomain.ldif
配置双主复制，在主1和主2上执行下面的步骤
添加syncprov模块
添加syncprov模块 [root@test1] ~/ldif$ vim mod_syncprov.ldif # create new dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/lib64/openldap olcModuleLoad: syncprov.la [root@test1 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f mod_syncprov.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=module,cn=config
[root@test1] ~/ldif$ vim syncprov.ldif # create new dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpSessionLog: 100 [root@test1 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f syncprov.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "olcOverlay=syncprov,olcDatabase={2}hdb,cn=config"
在主1和主2上执行下面的步骤，但是注意需要替换olcServerID和provider的值
[root@test1] ~/ldif$ vim master01.ldif # create new dn: cn=config changetype: modify replace: olcServerID # specify uniq ID number on each server olcServerID: 0 #主2上替换为1 dn: olcDatabase={2}hdb,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://192.168.255.125:389/ #主2上替换为192.168.255.124:389 bindmethod=simple binddn="cn=root,dc=ztjy,dc=com" credentials=123456 #明文密码 可以选择加密的 searchbase="dc=ztjy,dc=com" scope=sub schemachecking=on type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00 - add: olcMirrorMode olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov ####[root@test1 ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f master01.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config" modifying entry "olcDatabase={2}hdb,cn=config" adding new entry "olcOverlay=syncprov,olcDatabase={2}hdb,cn=config"
至此双主已搭建完成.
取消匿名用户登录ldif文件:
cat > /root/disable_anon.ldif << EOF dn: cn=config changetype: modify add: olcDisallows olcDisallows: bind_anon dn: cn=config changetype: modify add: olcRequires olcRequires: authc dn: olcDatabase={-1}frontend,cn=config changetype: modify add: olcRequires olcRequires: authc EOF ldapadd -Y EXTERNAL -H ldapi:/// -f /root/disable_anon.ldif
修改超级管理员密码ldif文件:
slappasswd -s 新密码 cat > /root/newpasswd.ldif << EOF dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootPW olcRootPW: {SSHA}jPCXoLxOgasTDuWx9eNdZS0nrqd242oc #根据生成更改 EOF ldapmodify -H ldapi:// -Y EXTERNAL -f /root/newpasswd.ldif
开启openldap日志功能
cat > /root/loglevel.ldif << “EOF” dn: cn=config changetype: modify replace: olcLogLevel olcLogLevel: stats EOF ldapmodify -Y EXTERNAL -H ldapi:/// -f /root/loglevel.ldif systemctl restart slapd
cat >> /etc/rsyslog.conf << EOF local4.* /var/log/slapd.log EOF systemctl restart rsyslog
