2018-04-11

OpenLDAP安装与配置

初始化安装环境

sed -i '/SELINUX/s/enforcing/disabled/' /etc/selinux/config

setenforce 0

systemctl disable firewalld.service

systemctl stop firewalld.service

为了避免单点故障，通常都会采用双机环境。使用OpenLDAP复制同步功能，保持双Master数据一致性

LDAP1.CCUOL.COM IP address 192.168.150.128

LDAP2.CCUOL.COM IP address 192.168.150.130

安装OpenLDAP

yum -y install openldap compat-openldap openldap-clients openldap-servers openldap-servers-sql openldap-devel migrationtools# 查看Ldap版本slapd -VV

启动OpenLDAP

systemctl enable slapd

systemctl start slapd

systemctl status slapd

配置OpenLDAP

设置OpenLDAP的管理员密码

slappasswd -s LDAP@2018

加密后的字段保存下，等在配置文件中会使用到

导入chrootpw.ldif文件

cd /etc/openldap/

vim chrootpw.ldif # specify the password generated above for "olcRootPW" sectiondn: olcDatabase={0}config,cn=config

changetype: modify

add: olcRootPW

olcRootPW: {SSHA}HS5Bu2oNnnGe+G7OaWCtfnPBJUz7G2k2

ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif

导入基本Schema

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif

设置Domain Name

首先要生成经处理后的目录管理者明文密码

slappasswd -s LDAP@2018

导入chdomain.ldif文件，使用域名test.com，一定注意修改olcRootPW参数

cd /etc/openldap

vim chdomain.ldif # replace to your own domain name for "dc=***,dc=***" section# specify the password generated above for "olcRootPW" sectiondn: olcDatabase={1}monitor,cn=config

changetype: modify

replace: olcAccess

olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"  read by dn.base="cn=Manager,dc=ccuol,dc=com" read by * none

dn: olcDatabase={2}hdb,cn=config

changetype: modify

replace: olcSuffix

olcSuffix: dc=ccuol,dc=com

dn: olcDatabase={2}hdb,cn=config

changetype: modify

replace: olcRootDN

olcRootDN: cn=Manager,dc=ccuol,dc=com

dn: olcDatabase={2}hdb,cn=config

changetype: modify

add: olcRootPW

olcRootPW: {SSHA}eTMA99w62m1Oslr8FjNXwmFplJyZK+ei

dn: olcDatabase={2}hdb,cn=config

changetype: modify

add: olcAccess

olcAccess: {0}to attrs=userPassword,shadowLastChange by

  dn="cn=Manager,dc=ccuol,dc=com" write by anonymous auth by self write by * none

olcAccess: {1}to dn.base="" by * readolcAccess: {2}to * by dn="cn=Manager,dc=test,dc=com" write by * read

ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif

导入basedomain.ldif文件

cd /etc/openldap

vim basedomain.ldif# replace to your own domain name for "dc=***,dc=***" sectiondn: dc=ccuol,dc=com

objectClass: top

objectClass: dcObject

objectclass: organization

o: Server Com

dc: ccuoldn: cn=Manager,dc=ccuol,dc=com

objectClass: organizationalRole

cn: Manager

description: Directory Manager

dn: ou=People,dc=ccuol,dc=com

objectClass: organizationalUnit

ou: People

dn: ou=Group,dc=ccuol,dc=com

objectClass: organizationalUnit

ou: Group

ldapadd -x -D cn=Manager,dc=test,dc=com -W -f basedomain.ldif

OpenLDAP Server禁用匿名用户

cat > disable_anonymous.ldif << "EOF"

dn: cn=config

changetype: modify

add: olcDisallows

olcDisallows: bind_anon

-

dn: olcDatabase={-1}frontend,cn=config

changetype: modify

add: olcRequires

olcRequires: authc

EOF

ldapmodify -Y EXTERNAL -H ldapi:// -f disable_anonymous.ldif

OpenLDAP Server开启匿名用户

cat > disable_anonymous.ldif << "EOF"

dn: cn=config

changetype: modify

delete: olcDisallows

olcDisallows: bind_anon

-

dn: olcDatabase={-1}frontend,cn=config

changetype: modify

delete: olcRequires

olcRequires: authc

EOF

ldapmodify -Y EXTERNAL -H ldapi:// -f disable_anonymous.ldif

向OpenLDAP Server中添加用户（可跳过）

首先要生成经处理后的明文密码

slappasswd -s LDAP@2018

vim ldapuser.ldif# create new user jerryhuang# replace to your own domain name for "dc=***,dc=***" sectiondn: uid=zhaoyong,ou=People,dc=ccuol,dc=com

objectClass: inetOrgPerson

objectClass: posixAccount

objectClass: shadowAccount

cn: zhaoyong

sn: Linux

userPassword: {SSHA}gfNVoxPmLgz4GPchLbnbDNUXcgK+o8sc

loginShell: /bin/bash

uidNumber: 1000

gidNumber: 1000

homeDirectory: /home//user/zhaoyong

dn: cn=zhaoyong,ou=Group,dc=ccuol,dc=com

objectClass: posixGroup

cn: zhaoyong

gidNumber: 1000

memberUid: zhaoyong

ldapadd -x -D cn=Manager,dc=test,dc=com -W -f ldapuser.ldif

添加本机的系统用户和群组到ldap目录(可跳过）

脚本SUFFIX变量替换为自己的域名

vim ldapuser.sh# extract local users and groups who have 1000-9999 digit UID# replace "SUFFIX=***" to your own domain name# this is an example #!/bin/bashSUFFIX='dc=test,dc=com'LDIF='ldapuser.ldif'echo -n > $LDIF

GROUP_IDS=()

grep "x:[1-9][0-9][0-9][0-9]:" /etc/passwd | (while read TARGET_USERdo    USER_ID="$(echo "$TARGET_USER" | cut -d':' -f1)"    USER_NAME="$(echo "$TARGET_USER" | cut -d':' -f5 | cut -d' ' -f1,2)"    [ ! "$USER_NAME" ] && USER_NAME="$USER_ID"    LDAP_SN="$(echo "$USER_NAME" | cut -d' ' -f2)"    [ ! "$LDAP_SN" ] && LDAP_SN="$USER_NAME"    LASTCHANGE_FLAG="$(grep "${USER_ID}:" /etc/shadow | cut -d':' -f3)"    [ ! "$LASTCHANGE_FLAG" ] && LASTCHANGE_FLAG="0"    SHADOW_FLAG="$(grep "${USER_ID}:" /etc/shadow | cut -d':' -f9)"    [ ! "$SHADOW_FLAG" ] && SHADOW_FLAG="0"    GROUP_ID="$(echo "$TARGET_USER" | cut -d':' -f4)"    [ ! "$(echo "${GROUP_IDS[@]}" | grep "$GROUP_ID")" ] && GROUP_IDS=("${GROUP_IDS[@]}" "$GROUP_ID")

    echo "dn: uid=$USER_ID,ou=People,$SUFFIX" >> $LDIF

    echo "objectClass: inetOrgPerson" >> $LDIF

    echo "objectClass: posixAccount" >> $LDIF

    echo "objectClass: shadowAccount" >> $LDIF

    echo "sn: $LDAP_SN" >> $LDIF

    echo "givenName: $(echo "$USER_NAME" | awk '{print $1}')" >> $LDIF

    echo "cn: $USER_NAME" >> $LDIF

    echo "displayName: $USER_NAME" >> $LDIF

    echo "uidNumber: $(echo "$TARGET_USER" | cut -d':' -f3)" >> $LDIF

    echo "gidNumber: $(echo "$TARGET_USER" | cut -d':' -f4)" >> $LDIF

    echo "userPassword: {crypt}$(grep "${USER_ID}:" /etc/shadow | cut -d':' -f2)" >> $LDIF

    echo "gecos: $USER_NAME" >> $LDIF

    echo "loginShell: $(echo "$TARGET_USER" | cut -d':' -f7)" >> $LDIF

    echo "homeDirectory: $(echo "$TARGET_USER" | cut -d':' -f6)" >> $LDIF

    echo "shadowExpire: $(passwd -S "$USER_ID" | awk '{print $7}')" >> $LDIF

    echo "shadowFlag: $SHADOW_FLAG" >> $LDIF

    echo "shadowWarning: $(passwd -S "$USER_ID" | awk '{print $6}')" >> $LDIF

    echo "shadowMin: $(passwd -S "$USER_ID" | awk '{print $4}')" >> $LDIF

    echo "shadowMax: $(passwd -S "$USER_ID" | awk '{print $5}')" >> $LDIF

    echo "shadowLastChange: $LASTCHANGE_FLAG" >> $LDIF

    echo >> $LDIF

donefor TARGET_GROUP_ID in "${GROUP_IDS[@]}"do    LDAP_CN="$(grep ":${TARGET_GROUP_ID}:" /etc/group | cut -d':' -f1)"    echo "dn: cn=$LDAP_CN,ou=Group,$SUFFIX" >> $LDIF

    echo "objectClass: posixGroup" >> $LDIF

    echo "cn: $LDAP_CN" >> $LDIF

    echo "gidNumber: $TARGET_GROUP_ID" >> $LDIF

    for MEMBER_UID in $(grep ":${TARGET_GROUP_ID}:" /etc/passwd | cut -d':' -f1,3)

    do        UID_NUM=$(echo "$MEMBER_UID" | cut -d':' -f2)

        [ $UID_NUM -ge 1000 -a $UID_NUM -le 9999 ] && echo "memberUid: $(echo "$MEMBER_UID" | cut -d':' -f1)" >> $LDIF

    done

    echo >> $LDIF

done

)

执行该脚本，会生成 ldapuser.ldif 文件

导入该文件

ldapadd -x -D cn=Manager,dc=ccuol,dc=com -W -f ldapuser.ldif

删除LDAP用户或组

删除用户：

ldapdelete -x -W -D 'cn=Manager,dc=ccuol,dc=com' "uid=ldapuser,ou=People,dc=ccuol,dc=com" 

删除组：

ldapdelete -x -W -D 'cn=Manager,dc=ccuol,dc=com' "cn=ldapgroup,ou=Group,dc=ccuol,dc=com" 

查询OpenLDAP的相关信息

用户和用户组全部导入完毕后，我们就可以查询OpenLDAP的相关信息

查询OpenLDAP全部信息，使用如下命令：

ldapsearch -x -b "dc=ccuol,dc=com" -H ldap://127.0.0.1

查询添加的OpenLDAP用户信息，使用如下命令：

ldapsearch -LLL -x -D 'cn=Manager,dc=ccuol,dc=com' -w "LDAP@2018" -b 'dc=ccuol,dc=com' 'uid=jerryhuang'

把OpenLDAP用户加入到用户组

现在我们要把ldapuser用户加入到ldapgroup用户组，需要新建添加用户到用户组的ldif文件

cat > add_user_to_groups.ldif << "EOF"dn: cn=ldapgroup,ou=Group,dc=ccuol,dc=com

changetype: modify

add: memberuid

memberuid: ldapuser

EOF

执行如下命令：

ldapadd -x -w "LDAP@2018" -D "cn=Manager,dc=ccuol,dc=com" -f add_user_to_groups.ldif

开启OpenLADP日志访问功能

默认情况下OpenLDAP是没有启用日志记录功能，但是在实际使用过程中，为了定位问题需要使用OpenLDAP日志

cat > loglevel.ldif << "EOF"dn: cn=config

changetype: modify

replace: olcLogLevel

olcLogLevel: stats

EOF

导入到OpenLDAP中，并重启OpenLDAP服务

ldapmodify -Y EXTERNAL -D "cn=Manager,dc=ccuol,dc=com" -f loglevel.ldif

修改rsyslog配置文件，并重启rsyslog服务

cat >> /etc/rsyslog.conf << "EOF"local4.* /var/log/slapd.log

EOF

systemctl restart rsyslog

systemctl restart slapd

查看日志

tail -f /var/log/slapd.log

修改OpenLDAP默认监听端口

例如我们现在把OpenLDAP监听的端口修改为4567

vim /etc/sysconfig/slapd

SLAPD_URLS="ldapi://0.0.0.0:4567/ ldap://0.0.0.0:4567/"# 重启OpenLDAP服务systemctl restart slapd.service

配置 LDAP 客户端 (服务器端ip:192.168.150.128)

yum install -y openldap-clients nss-pam-ldapd authconfig authconfig-gtk

执行命令

authconfig --enableldap \--enableldapauth \--ldapserver=192.168.150.128 \--ldapbasedn="dc=ccuol,dc=com" \--enablemkhomedir \--update

安装部署phpldapadmin:

rpm -ivhhttp://mirrors.ukfast.co.uk/sites/dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

yum install httpd phpldapadmin

systemctl  restart httpd

vim /etc/phpldapadmin/config.php

// $servers->setValue('login','attr','uid')；把这一行的注释去掉

$servers->setValue('login','attr','dn');    //新增加这行

http://192.168.150.128/phpldapadmin

登录名：cn=Manager,dc=ccuol,dc=com

密码：123abcABC

OpenLDAP Multi-Master Replication:

双机执行

cat >  mod_syncprov.ldif << "EOF"

dn: cn=module,cn=config

objectClass: olcModuleList

cn: module

olcModulePath: /usr/lib64/openldap

olcModuleLoad: syncprov.la

EOF

# ldapadd -Y EXTERNAL -H ldapi:/// -f mod_syncprov.ldif

cat >  syncprov.ldif << "EOF"

dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config

objectClass: olcOverlayConfig

objectClass: olcSyncProvConfig

olcOverlay: syncprov

olcSpSessionLog: 100

EOF

# ldapadd -Y EXTERNAL -H ldapi:/// -f syncprov.ldif

LDAP01执行：

cat > ldap02.ldif  << "EOF"

# create new

dn: cn=config

changetype: modify

replace: olcServerID

# specify unique ID number on each server

olcServerID: 0

dn: olcDatabase={2}hdb,cn=config

changetype: modify

add: olcSyncRepl

olcSyncRepl: rid=001 provider=ldap://192.168.150.130:389/ bindmethod=simple binddn="cn=Manager,dc=ccuol,dc=com" credentials=123abcABC searchbase="dc=ccuol,dc=com" scope=sub schemachecking=on type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00

-

add: olcMirrorMode

olcMirrorMode: TRUE

dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config

changetype: add

objectClass: olcOverlayConfig

objectClass: olcSyncProvConfig

olcOverlay: syncprov

EOF

# ldapmodify -Y EXTERNAL -H ldapi:/// -f ldap02.ldif

LDAP02执行：

cat > ldap01.ldif  << "EOF"

# create new

dn: cn=config

changetype: modify

replace: olcServerID

# specify unique ID number on each server

olcServerID: 0

dn: olcDatabase={2}hdb,cn=config

changetype: modify

add: olcSyncRepl

olcSyncRepl: rid=001 provider=ldap://192.168.150.128:389/ bindmethod=simple binddn="cn=Manager,dc=ccuol,dc=com" credentials=123abcABC searchbase="dc=ccuol,dc=com" scope=sub schemachecking=on type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00

-

add: olcMirrorMode

olcMirrorMode: TRUE

dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config

changetype: add

objectClass: olcOverlayConfig

objectClass: olcSyncProvConfig

olcOverlay: syncprov

EOF

# ldapmodify -Y EXTERNAL -H ldapi:/// -f ldap01.ldif

常见问题：

1.phpldapadmin Can't contact LDAP server (-1) for user set

# getsebool httpd_can_connect_ldap

httpd_can_connect_ldap --> off

# setsebool -P httpd_can_connect_ldap on

# getsebool httpd_can_connect_ldapll

httpd_can_connect_ldap --> on