linux 基础运维(一)centos7 安装openldap
一 摘要
openldap 作为企业信息化底层系统,一般用于对接单点登录,等其他信息化系统。本文主要介绍centos7 上openldap 安装。
本文是从老博客迁移过来,迁移时修改了域名,所以域名这块可能会笔误。原文时边安装,边写的。
二 环境信息
(一)操作系统信息
操作系统是centos 7.6.1810
[root@prod001 ~]# lsb_release -a
LSB Version: :core-4.1-amd64:core-4.1-noarch:cxx-4.1-amd64:cxx-4.1-noarch:desktop-4.1-amd64:desktop-4.1-noarch:languages-4.1-amd64:languages-4.1-noarch:printing-4.1-amd64:printing-4.1-noarch
Distributor ID: CentOS
Description: CentOS Linux release 7.6.1810 (Core)
Release: 7.6.1810
Codename: Core
(二) 软件信息
使用openldap 2.4.44版本
[root@prod001 ~]# rpm -qa | grep ldap
openldap-2.4.44-21.el7_6.x86_64
[root@prod001 ~]#
三 安装
使用root用户通过yum 安装。
[root@prod001 ~]# yum install -y openldap openldap-clients openldap-servers migrationtools
安装成功如下
Running transaction
Installing : openldap-servers-2.4.44-21.el7_6.x86_64 1/3
Installing : migrationtools-47-15.el7.noarch 2/3
Installing : openldap-clients-2.4.44-21.el7_6.x86_64 3/3
Verifying : openldap-servers-2.4.44-21.el7_6.x86_64 1/3
Verifying : openldap-clients-2.4.44-21.el7_6.x86_64 2/3
Verifying : migrationtools-47-15.el7.noarch 3/3
Installed:
migrationtools.noarch 0:47-15.el7 openldap-clients.x86_64 0:2.4.44-21.el7_6 openldap-servers.x86_64 0:2.4.44-21.el7_6
Complete!
四 配置
openldap 配置涉及到密码、域名、管理员,我这里的域名是 chouniu.fun,请大家对应修改为自己的域名
(一)基础配置
4.1.1 生成密码
[root@prod001 ~]# slappasswd
New password:
Re-enter new password:
{SSHA}rFw4xTIEAVrlKB1yI95HlEqzTv2FMWWq
[root@prod001 ~]#
记住该密码:
rFw4xTIEAVrlKB1yI95HlEqzTv2FMWWq
此处对应的明文密码是:123456
PS(同一台机器同一个明文密码在不同的时间生成的密文是不一样的)
4.1.2 备份/etc/openldap
对配置文件修改之前,最好备份一份,因为本次改的文件较多,直接备份openldap 配置文件目录
[root@prod001 etc]# tar -zcvf openldap.20200211.tgz openldap/
[root@prod001 etc]# ls *.tgz
openldap.20200211.tgz openldap.tgz
[root@prod001 etc]#
4.1.3编辑/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 1fb9123b
dn: olcDatabase={2}hdb
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {2}hdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=chouniu,dc=fun
olcRootDN: cn=Manager,dc=chouniu,dc=fun
olcRootPW: {SSHA}rFw4xTIEAVrlKB1yI95HlEqzTv2FMWWq
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
structuralObjectClass: olcHdbConfig
entryUUID: b4232b36-e10b-1039-89ba-adc38f9f2334
creatorsName: cn=config
createTimestamp: 20200211111633Z
entryCSN: 20200211111633.060093Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20200211111633Z
olcSuffix: dc=chouniu,dc=fun #修改成自己的域名
olcRootDN: cn=Manager,dc=chouniu,dc=fun #修改成自己的域名
olcRootPW: {SSHA}rFw4xTIEAVrlKB1yI95HlEqzTv2FMWWq #增加的密码
4.1.4 修改/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif
[root@prod001 etc]# vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}monitor.ldif
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 2c600cd6
dn: olcDatabase={1}monitor
objectClass: olcDatabaseConfig
olcDatabase: {1}monitor
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
al,cn=auth" read by dn.base="cn=Manager,dc=chouniu,dc=fun" read by * none
structuralObjectClass: olcDatabaseConfig
entryUUID: b423280c-e10b-1039-89b9-adc38f9f2334
creatorsName: cn=config
createTimestamp: 20200211111633Z
entryCSN: 20200211111633.060012Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20200211111633Z
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
al,cn=auth" read by dn.base="cn=Manager,dc=chouniu,dc=fun" read by * none
此处改为您对应的域名
4.1.5 准备LDAP数据库
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
4.1.6 检验配置文件是否修订正确
[root@prod001 etc]# slaptest -u
5e429330 ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif"
5e429330 ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif"
config file testing succeeded
[root@prod001 etc]#
4.1.7 修改文件权限
[root@prod001 etc]# chown ldap:ldap -R /var/lib/ldap
[root@prod001 etc]# chmod 700 -R /var/lib/ldap
[root@prod001 etc]#
此步不做 ,会出现如下报错
Feb 11 19:46:30 prod001 runuser[26192]: pam_unix(runuser:session): session opened for user ldap by (uid=0)
Feb 11 19:46:30 prod001 runuser[26192]: pam_unix(runuser:session): session closed for user ldap
Feb 11 19:46:30 prod001 check-config.sh[26174]: Read/write permissions for DB file '/var/lib/ldap/__db.002' are required.
Feb 11 19:46:30 prod001 runuser[26194]: pam_unix(runuser:session): session opened for user ldap by (uid=0)
Feb 11 19:46:30 prod001 runuser[26194]: pam_unix(runuser:session): session closed for user ldap
Feb 11 19:46:30 prod001 check-config.sh[26174]: Read/write permissions for DB file '/var/lib/ldap/__db.003' are required.
Feb 11 19:46:30 prod001 systemd[1]: slapd.service: control process exited, code=exited status=1
Feb 11 19:46:30 prod001 systemd[1]: Failed to start OpenLDAP Server Daemon.
Feb 11 19:46:30 prod001 systemd[1]: Unit slapd.service entered failed state.
Feb 11 19:46:30 prod001 systemd[1]: slapd.service failed.
4.1.8 设置开机启动及启动验证
[root@prod001 etc]# systemctl enable slapd
Created symlink from /etc/systemd/system/multi-user.target.wants/slapd.service to /usr/lib/systemd/system/slapd.service.
[root@prod001 etc]#
[root@prod001 etc]# systemctl start slapd
[root@prod001 etc]# systemctl status slapd
● slapd.service - OpenLDAP Server Daemon
Loaded: loaded (/usr/lib/systemd/system/slapd.service; disabled; vendor preset: disabled)
Active: active (running) since Tue 2020-02-11 19:49:50 CST; 7s ago
Docs: man:slapd
man:slapd-config
man:slapd-hdb
man:slapd-mdb
4.1.9 测试
[root@prod001 etc]# ldapsearch -x -b '' -s base'(objectclass=*)'
# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectclass=*)
# requesting: ALL
#
#
dn:
objectClass: top
objectClass: OpenLDAProotDSE
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
[root@prod001 etc]#
4.1.10 添加到LDAP schemas中
cd /etc/openldap/schema/
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f core.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f inetorgperson.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f collective.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f corba.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f duaconf.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f dyngroup.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f java.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f misc.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f openldap.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f pmi.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f ppolicy.ldif
4.1.11 使用 Migration Tools to 创建LDAP DIT
4.1.11.1 修改配置文件
[root@prod001 schema]# cd /usr/share/migrationtools/
[root@prod001 migrationtools]# cp migrate_common.ph migrate_common.ph.bak.orig
[root@prod001 migrationtools]#
主要修改下面几行,请修改成您对应的域名
71 $DEFAULT_MAIL_DOMAIN = "chouniu.fun";
74 $DEFAULT_BASE = "dc=chouniu,dc=fun";
90 $EXTENDED_SCHEMA = 1;
4.1.11.2 生成base.ldif
[root@prod001 migrationtools]# cd /usr/share/migrationtools/
[root@prod001 migrationtools]# ./migrate_base.pl> /root/base.ldif
[root@prod001 migrationtools]# ll /root/base.ldif
-rw-r--r-- 1 root root 2007 Feb 11 20:04 /root/base.ldif
[root@prod001 migrationtools]#
这句命令 我注意
cn=Manager,dc=chouniu,dc=fun 要与4.1.2 里一致,否则会报密码不对。
[root@prod001 migrationtools]# ldapadd -x -W -D "cn=Manager,dc=chouniu,dc=fun" -f /root/base.ldif
Enter LDAP Password:
adding new entry "dc=chouniu,dc=fun"
adding new entry "ou=Hosts,dc=chouniu,dc=fun"
adding new entry "ou=Rpc,dc=chouniu,dc=fun"
adding new entry "ou=Services,dc=chouniu,dc=fun"
adding new entry "nisMapName=netgroup.byuser,dc=chouniu,dc=fun"
adding new entry "ou=Mounts,dc=chouniu,dc=fun"
adding new entry "ou=Networks,dc=chouniu,dc=fun"
adding new entry "ou=People,dc=chouniu,dc=fun"
adding new entry "ou=Group,dc=chouniu,dc=fun"
adding new entry "ou=Netgroup,dc=chouniu,dc=fun"
adding new entry "ou=Protocols,dc=chouniu,dc=fun"
adding new entry "ou=Aliases,dc=chouniu,dc=fun"
adding new entry "nisMapName=netgroup.byhost,dc=chouniu,dc=fun"
[root@prod001 migrationtools]#
posted on 2020-12-15 09:38 weiwei2021 阅读(360) 评论(0) 编辑 收藏 举报