OpenLDAP配置初步
OpenLDAP是轻型目录访问协议(Lightweight Directory Access Protocol,LDAP)的自由和开源的实现,在其OpenLDAP许可证下发行,并已经被包含在众多流行的Linux发行版中。它主要包括4个部分:
1:slap 独立LDAP守护服务
2:slurpd - 独立的LDAP更新复制守护服务
3:实现LDAP协议的库
4:工具软件和示例客户端
一:openldap的编译安装
1:安装openldap需要先编译安装berkeley-db库,若未安装或配置不正确,会出现下面的错误
configure: error: BerkeleyDB version incompatible with BDB/HDB backends
[root@cfclient ~]# cd /usr/local/src/tarbag/
[root@cfclient tarbag]# wgethttp://download-east.oracle.com/berkeley-db/db-4.8.26.tar.gz
[root@cfclient tarbag]# tar -zxvf db-4.8.26.tar.gz -C ../software/
[root@cfclient tarbag]# cd ../software/db-4.8.26/
[root@cfclient db-4.8.26]# cd build_unix/
[root@cfclient build_unix]# ../dist/configure --prefix=/usr/local/BerkeleyBD.4.8
[root@cfclient build_unix]# make && make install
[root@cfclient build_unix]# echo '/usr/local/BerkeleyBD.4.8/lib/' >> /etc/ld.so.conf
[root@cfclient build_unix]# echo '/usr/local/BerkeleyBD.4.8/include/' >> /etc/ld.so.conf
[root@cfclient build_unix]# ldconfig
[root@cfclient build_unix]# cp /usr/local/BerkeleyBD.4.8/lib/* /usr/local/lib
[root@cfclient build_unix]# cp /usr/local/BerkeleyBD.4.8/include/* /usr/local/include/
2:安装libtool-ltdl和库,如果没安装,编译会出现下面的错误
[root@cfclient ~]# yum -y install libtool-ltdl libtool-ltdl-devel
configure: error: could not locate libtool ltdl.h
3:下载安装openldap
[root@cfclient ~]# cd /usr/local/src/tarbag/
[root@cfclient tarbag]# wgethttp://www.openldap.org/software/download/OpenLDAP/openldap-release/openldap-2.4.21.tgz
[root@cfclient tarbag]# tar -zxvf openldap-2.4.21.tgz -C ../software/
[root@cfclient tarbag]# cd ../software/openldap-2.4.21/
[root@cfclient openldap-2.4.21]# ./configure --prefix=/usr/local/openldap --enable-syslog --enable-modules --with-tls
[root@cfclient openldap-2.4.21]# make && make install
在64位的操作系统上,make的时候可能会报错如下,这可能是32位的libltdl.so库文件引起的
/usr/lib/libltdl.so: could not read symbols: File in wrong format
解决办法:
[root@cfclient openldap-2.4.21]# mv /usr/lib/libltdl.so /tmp/
[root@cfclient openldap-2.4.21]# ln -s /usr/lib64/libltdl.so /usr/lib/
二:配置与启动openldap
1:修改主配置文件内容如下
[root@cfclient ~]# grep -v '^#' /usr/local/openldap/etc/openldap/slapd.conf |grep -v '^$'
include /usr/local/openldap/etc/openldap/schema/core.schema
include /usr/local/openldap/etc/openldap/schema/corba.schema
include /usr/local/openldap/etc/openldap/schema/cosine.schema
include /usr/local/openldap/etc/openldap/schema/collective.schema
include /usr/local/openldap/etc/openldap/schema/dyngroup.schema
include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema
include /usr/local/openldap/etc/openldap/schema/duaconf.schema
include /usr/local/openldap/etc/openldap/schema/java.schema
include /usr/local/openldap/etc/openldap/schema/misc.schema
include /usr/local/openldap/etc/openldap/schema/nis.schema
include /usr/local/openldap/etc/openldap/schema/ppolicy.schema
include /usr/local/openldap/etc/openldap/schema/pmi.schema
include /usr/local/openldap/etc/openldap/schema/openldap.schema
pidfile /usr/local/openldap/var/run/slapd.pid
argsfile /usr/local/openldap/var/run/slapd.args
loglevel 256
allow bind_v2
database bdb
suffix "dc=yang,dc=com"
rootdn "cn=Manager,dc=yang,dc=com"
rootpw 123456
directory /openldap
index objectClass eq
[root@cfclient ~]# tail -1 /etc/syslog.conf
local4.* /var/log/openldap.log
[root@cfclient ~]# service syslog reload
Reloading syslogd... [ OK ]
Reloading klogd... [ OK ]
2:启动服务
[root@cfclient ~]# /usr/local/openldap/libexec/slapd
[root@cfclient ~]# netstat -ntpl |grep 389
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 7392/slapd
tcp 0 0 :::389 :::* LISTEN 7392/slapd
[root@cfclient ~]# tail -f /var/log/openldap.log
Dec 10 11:37:54 cfclient slapd[7391]: @(#) $OpenLDAP: slapd 2.4.21 (Dec 10 2010 11:00:38) $
Dec 10 11:37:54 cfclient slapd[7392]: bdb_db_open: warning - no DB_CONFIG file found in directory /openldap: (2). Expect poor performance for suffix "dc=yang,dc=com".
Dec 10 11:37:54 cfclient slapd[7392]: bdb_monitor_db_open: monitoring disabled; configure monitor database to enable
Dec 10 11:37:54 cfclient slapd[7392]: slapd starting
[root@cfclient ~]# cp /usr/local/openldap/etc/openldap/DB_CONFIG.example /openldap/DB_CONFIG
3:创建rootdn
[root@cfclient ~]# /usr/local/openldap/bin/ldapadd -x -D "cn=Manager,dc=yang,dc=com" -W -f base.ldif
Enter LDAP Password:
conn=1000 fd=13 ACCEPT from IP=127.0.0.1:18908 (IP=0.0.0.0:389)
conn=1000 op=0 BIND dn="cn=Manager,dc=yang,dc=com" method=128
conn=1000 op=0 BIND dn="cn=Manager,dc=yang,dc=com" mech=SIMPLE ssf=0
conn=1000 op=0 RESULT tag=97 err=0 text=
adding new entry "dc=yang,dc=com"
conn=1000 op=1 ADD dn="dc=yang,dc=com"
conn=1000 op=1 RESULT tag=105 err=0 text=
conn=1000 op=2 UNBIND
conn=1000 fd=13 closed
三:安装phpldapadmin,解压到Apache目录下即可,Apache需要支持php扩展,php编译的时候需要支持ldap,也可以用ldapadmin工具管理
[root@cfclient tarbag]# wgethttp://nchc.dl.sourceforge.net/project/phpldapadmin/phpldapadmin-php5/1.2.0.5/phpldapadmin-1.2.0.5.zip
[root@cfclient tarbag]# unzip phpldapadmin-1.2.0.5.zip
[root@cfclient tarbag]# mv phpldapadmin-1.2.0.5 /www/phpldapadmin
[root@cfclient tarbag]# cp /www/phpldapadmin/config/config.php.example /www/phpldapadmin/config/config.php
[root@cfclient ~]# mkdir /usr/local/openldap/etc/ssl
[root@cfclient ssl]# openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout server.pem -days 3650
Generating a 1024 bit RSA private key
.........++++++
...........................++++++
writing new private key to 'server.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:CHINA
Locality Name (eg, city) [Newbury]:FUZHOU
Organization Name (eg, company) [My Company Ltd]:yang.com
Organizational Unit Name (eg, section) []:JSB
Common Name (eg, your name or your server's hostname) []:ldap.yang.com
Email Address []:
[root@cfclient ~]# tail -5 /usr/local/openldap/etc/openldap/slapd.conf
TLSCipherSuite HIGH:MEDIUM:-SSLv2
TLSCACertificateFile /usr/local/openldap/etc/ssl/server.pem
TLSCertificateFile /usr/local/openldap/etc/ssl/server.pem
TLSCertificateKeyFile /usr/local/openldap/etc/ssl/server.pem
[root@cfclient ~]# /usr/local/openldap/libexec/slapd -h "ldap:// ldaps://" -d 256 &
[root@cfclient ~]# netstat -ntpl |grep slapd
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 8877/slapd
tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 8877/slapd
tcp 0 0 :::389 :::* LISTEN 8877/slapd
tcp 0 0 :::636 :::* LISTEN 8877/slapd
本文摘自http://hi.baidu.com/naruto6006/item/a69ffc0d3be6f07abee97eda
http://ylw6006.blog.51cto.com/