一、搭建Openldap
1、安装openldap 服务
[root@node3 ~]# yum install -y epel-release openldap compat-openldap openldap-clients openldap-servers openldap-servers-sql openldap-devel migrationtools
2、初始化openldap服务管理权限
[root@node3 ~]# slappasswd -s 123456
{SSHA}gn0ZWIBguTeY2n/AVaTxuNc1tn/kxiiW
[root@node3 ~]# sed -i 's/cn=Manager/cn=admin/g' /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}hdb.ldif
[root@node3 ~]# sed -i 's/dc=my-domain,dc=com/dc=ldaptest,dc=com,dc=cn/g' /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}hdb.ldif
[root@node3 ~]# vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}hdb.ldif
olcSuffix: dc=ldaptest,dc=com,dc=cn
olcRootDN: cn=admin,dc=ldaptest,dc=com,dc=cn
olcRootPW: {SSHA}gn0ZWIBguTeY2n/AVaTxuNc1tn/kxiiW
[root@node3 ~]# sed -i 's/cn=Manager,dc=my-domain,dc=com/cn=admin,dc=ldaptest,dc=com,dc=cn/g' /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}monitor.ldif
[root@node3 ~]# vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}monitor.ldif
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
al,cn=auth" read by dn.base="cn=admin,dc=ldaptest,dc=com,dc=cn" read by * none
[root@node3 ~]# slaptest -u
5bea3013 ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif"
5bea3013 ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif"
config file testing succeeded
[root@node3 ~]#
[root@node3 ~]# systemctl restart slapd
3、配置Openldap数据库
[root@node3 ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@node3 ~]# chown ldap.ldap -R /var/lib/ldap/
[root@node3 ~]# chmod 700 -R /var/lib/ldap/
[root@node3 ~]# ll /var/lib/ldap/
total 324
-rwx------. 1 ldap ldap 2048 Nov 13 09:59 alock
-rwx------. 1 ldap ldap 262144 Nov 13 09:59 __db.001
-rwx------. 1 ldap ldap 32768 Nov 13 09:59 __db.002
-rwx------. 1 ldap ldap 49152 Nov 13 09:59 __db.003
-rwx------. 1 ldap ldap 845 Nov 13 10:00 DB_CONFIG
-rwx------. 1 ldap ldap 8192 Nov 13 09:59 dn2id.bdb
-rwx------. 1 ldap ldap 32768 Nov 13 09:59 id2entry.bdb
-rwx------. 1 ldap ldap 10485760 Nov 13 09:59 log.0000000001
[root@node3 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=cosine,cn=schema,cn=config"
[root@node3 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=nis,cn=schema,cn=config"
You have mail in /var/spool/mail/root
[root@node3 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=inetorgperson,cn=schema,cn=config"
4、初始化组织架构及添加初始用户和组
[root@node3 ~]# vim /usr/share/migrationtools/migrate_common.ph
$DEFAULT_MAIL_DOMAIN = "ldaptest.com.cn";
$DEFAULT_BASE = "dc=ldaptest,dc=com,dc=cn";
$EXTENDED_SCHEMA = 1;
[root@node3 ~]# groupadd OPS
[root@node3 ~]# groupadd HR
[root@node3 ~]# useradd -g OPS charles
[root@node3 ~]# useradd -g HR fiona
[root@node3 ~]# echo "123456" | passwd --stdin charles
Changing password for user charles.
passwd: all authentication tokens updated successfully.
[root@node3 ~]# echo "123456" | passwd --stdin fiona
Changing password for user fiona.
passwd: all authentication tokens updated successfully.
[root@node3 ~]# grep "OPS" /etc/group > groups
[root@node3 ~]# grep "HR" /etc/group >> groups
[root@node3 ~]# grep "charles" /etc/passwd > users
[root@node3 ~]# grep "fiona" /etc/passwd >> users
[root@node3 ~]# /usr/share/migrationtools/migrate_passwd.pl users > users.ldif
[root@node3 ~]# /usr/share/migrationtools/migrate_group.pl groups > groups.ldif
[root@node3 ~]# vim base.ldif
dn: dc=ldaptest,dc=com,dc=cn
o: ldaptest.com.cn
dc: ldaptest
objectClass: top
objectClass: dcObject
objectclass: organization
dn: cn=admin,dc=ldaptest,dc=com,dc=cn
cn: admin
objectClass: organizationalRole
description: Directory Manager
dn: ou=People,dc=ldaptest,dc=com,dc=cn
ou: People
objectClass: top
objectClass: organizationalUnit
dn: ou=Group,dc=ldaptest,dc=com,dc=cn
ou: Group
objectClass: top
objectClass: organizationalUnit
[root@node3 ~]# ldapadd -x -w "123456" -D "cn=admin,dc=ldaptest,dc=com,dc=cn" -f base.ldif
[root@node3 ~]# ldapadd -x -w "123456" -D "cn=admin,dc=ldaptest,dc=com,dc=cn" -f users.ldif
[root@node3 ~]# ldapadd -x -w "123456" -D "cn=admin,dc=ldaptest,dc=com,dc=cn" -f groups.ldif
5、启用Openldap服务的日志记录功能
[root@node3 ~]# vim loglevel.ldif
dn: cn=config
changetype: modify
replace: olcLogLevel
olcLogLevel: stats
[root@node3 ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f loglevel.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
[root@node3 ~]# vim /etc/rsyslog.conf
local4.* /var/log/slapd/slapd.log
[root@node3 ~]# systemctl restart rsyslog
[root@node3 ~]# systemctl restart slapd
6、禁止用户匿名登录
[root@node3 ~]# vim disable_anon.ldif
dn: cn=config
changetype: modify
add: olcDisallows
olcDisallows: bind_anon
dn: cn=config
changetype: modify
add: olcRequires
olcRequires: authc
dn: olcDatabase={-1}frontend,cn=config
changetype: modify
add: olcRequires
olcRequires: authc
[root@node3 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /root/disable_anon.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
modifying entry "cn=config"
modifying entry "olcDatabase={-1}frontend,cn=config"
二、搭建ldap account manager 管理Openldap服务
本例中我安装的是lam 6.5 的版本，从官网的changelog上来看，此版本已经不支持使用httpd 2.2 ，且要求的php版本为7.2或以上，详情可查看：https://www.ldap-account-manager.org/lamcms/changelog
1、安装httpd服务及php 7.2
[root@node3 src]# yum install -y httpd
#移除当前系统中安装的php版本
[root@node3 src]# yum -y remove php*
[root@node3 src]# rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
[root@node3 src]# rpm -Uvh https://mirror.webtatic.com/yum/el7/webtatic-release.rpm
[root@node3 src]# yum install -y php72w php72w-ldap php72w-gd php72w-common
1、下载安装lam
[root@node3 ~]# cd /usr/local/src/
[root@node3 src]# wget https://nchc.dl.sourceforge.net/project/lam/LAM/6.5/ldap-account-manager-6.5.tar.bz2
[root@node3 src]# tar jxf ldap-account-manager-6.5.tar.bz2
[root@node3 src]# mv ldap-account-manager-6.5 /var/www/html/ldap
[root@node3 src]# cd /var/www/html/ldap/config
[root@node3 config]# cp config.cfg.sample config.cfg
[root@node3 config]# cp unix.conf.sample lam.conf
[root@node3 config]# sed -i "s/dc=my-domain,dc=com/dc=ldaptest,dc=com,dc=cn/g" lam.conf
[root@node3 config]# sed -i "s/cn=Manager/cn=admin/g" lam.conf
[root@node3 config]# sed -i "s/dc=yourdomain,dc=org/dc=ldaptest,dc=com,dc=cn/g" lam.conf
[root@node3 config]# chown -R apache.apache /var/www/html/ldap/
[root@node3 config]# systemctl start httpd
image.png
三、配置Centos 7 使用openldap服务作为认证源
1、安装openldap 客户端软件
[root@localhost ~]# yum install -y openldap-clients nss-pam-ldapd
2、修改nslcd配置文件
[root@localhost ~]# vim /etc/nslcd.conf
uri ldap://10.10.10.11/
base dc=ldaptest,dc=com,dc=cn
binddn cn=admin,dc=ldaptest,dc=com,dc=cn #若服务器开启了禁止匿名用户访问，需要在客户端配置具有读权限的账号和密码才能验证成功。
bindpw 123456 #同上
rootpwmoddn cn=admin,dc=ldaptest,dc=com,dc=cn
rootpwmodpw 123456
ssl no
tls_cacertdir /etc/openldap/cacerts
3、修改system-auth配置文件
[root@localhost ~]# vim /etc/pam.d/system-auth
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_ldap.so use_first_pass #新增
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam.ldap.so #新增
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_ldap.so use_authtok #新增
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session optional pam_ldap.so #新增
session required pam_unix.so
4、修改nsswitch.conf 配置文件
[root@localhost ~]# vim /etc/nsswitch.conf
passwd: files ldap
shadow: files ldap
group: files ldap
5、修改authconfig配置文件
[root@localhost ~]# vim /etc/sysconfig/authconfig
USELOCAUTHORIZE=yes
USELDAPAUTH=yes
USELDAP=yes
USESHADOW=yes
6、启动nslcd服务
[root@localhost ~]# systemctl restart nslcd
#可通过下述命令，获取openldap认证用户的相关信息的话，说明配置成功。
[root@localhost ~]# getent passwd charles
charles:x:1000:1000:charles:/home/charles:/bin/bash
7、配置客户端登录自动创建家目录
[root@localhost ~]# vim /etc/pam.d/system-auth
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_ldap.so
#添加创建家目录的模块
session optional pam__mkhomedir.so skel=/etc/skel umask=077
[root@localhost ~]# vim /etc/pam.d/sshd
#%PAM-1.0
auth required pam_sepermit.so
auth include password-auth
account required pam_nologin.so
account include password-auth
password include password-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open env_params
session required pam_namespace.so
session optional pam_keyinit.so force revoke
session include password-auth
#添加模块
session required pam_mkhomedir.so
#重启相应的服务
[root@localhost ~]# service sshd restart
Stopping sshd: [ OK ]
Starting sshd: [ OK ]
[root@localhost ~]# service nslcd restart
Stopping nslcd: [ OK ]
Starting nslcd: [ OK ]
配置完成后，初次使用openldap认证用户登录系统时，系统会自动创建改用户的家目录。
image.png
四、配置Openldap服务的sudo权限管理
1、在openldap服务器上导入相应的sudo schema
[root@node3 ~]# cp -f /usr/share/doc/sudo-1.8.19p2/schema.OpenLDAP /etc/openldap/schema/sudo.schema
[root@node3 ~]# restorecon /etc/openldap/schema/sudo.schema
[root@node3 ~]# mkdir ~/sudo
[root@node3 ~]# echo "include /etc/openldap/schema/sudo.schema" > ~/sudo/sudoSchema.conf
[root@node3 ~]# slapcat -f ~/sudo/sudoSchema.conf -F /tmp/ -n0 -s "cn={0}sudo,cn=schema,cn=config" > ~/sudo/sudo.ldif
[root@node3 ~]# sed -i "s/{0}sudo/{12}sudo/g" ~/sudo/sudo.ldif
[root@node3 ~]# head -n-8 ~/sudo/sudo.ldif > ~/sudo/sudo-config.ldif
[root@node3 ~]# vim ~/sudo/sudo-config.ldif
[root@node3 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f ~/sudo/sudo-config.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn={12}sudo,cn=schema,cn=config"
[root@node3 ~]# ls /etc/openldap/slapd.d/cn\=config/cn\=schema
cn={0}core.ldif cn={1}cosine.ldif cn={2}nis.ldif cn={3}inetorgperson.ldif cn={4}sudo.ldif
2、定义sudo组及规则
[root@node3 ~]# vim sudoenv.ldif
dn: ou=sudoers,dc=ldaptest,dc=com,dc=cn
objectClass: organizationalUnit
ou: sudoers
dn: cn=defaults,ou=sudoers,dc=ldaptest,dc=com,dc=cn
objectClass: sudoRole
cn: defaults
description: Default suduOption's go here
sudoOption: requiretty
sudoOption: always_set_home
sudoOption: env_reset
sudoOption: env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
sudoOption: env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
sudoOption: env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
sudoOption: env_keep+="LC_MONETARY LC_NAME LC_NUMBERIC LC_PAPER LC_TELEPHONE"
sudoOption: env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
sudoOption: secure_path=/sbin:/bin:/usr/sbin/:/usr/bin
[root@node3 ~]# vim sudorules.ldif
dn: cn=%admin,ou=sudoers,dc=ldaptest,dc=com,dc=cn
objectClass: sudoRole
cn: %admin
sudoUser: %admin
sudoHost: ALL
sudoOption: authenticate
sudoCommand: /bin/rm
sudoCommand: /bin/rmdir
sudoCommand: /bin/chmod
sudoCommand: /bin/chown
sudoCommand: /bin/dd
sudoCommand: /bin/mv
sudoCommand: /bin/cp
sudoCommand: /sbin/fsck*
sudoCommand: /sbin/*remove
sudoCommand: /usr/bin/chattr
sudoCommand: /sbin/mkfs*
sudoCommand: !/usr/bin/passwd
sudoOrder: 0
dn: cn=%app,ou=sudoers,dc=ldaptest,dc=com,dc=cn
objectClass: sudoRole
cn: %app
sudoUser: %app
sudoHost: ALL
sudoRunAsUser: appman
sudoOption: !authenticate
sudoCommand: /bin/bash
[root@node3 ~]# ldapadd -D "cn=admin,dc=ldaptest,dc=com,dc=cn" -h 10.10.10.35 -x -W -f sudoenv.ldif
Enter LDAP Password:
adding new entry "ou=sudoers,dc=ldaptest,dc=com,dc=cn"
adding new entry "cn=defaults,ou=sudoers,dc=ldaptest,dc=com,dc=cn"
[root@node3 ~]# ldapadd -D "cn=admin,dc=ldaptest,dc=com,dc=cn" -h 10.10.10.35 -x -W -f sudorules.ldif
Enter LDAP Password:
adding new entry "cn=%admin,ou=sudoers,dc=ldaptest,dc=com,dc=cn"
adding new entry "cn=%app,ou=sudoers,dc=ldaptest,dc=com,dc=cn"
配置完成后，新增一个用户组为admin，并把相应的管理员用户添加为该组成员，在配置了读取openldap上的sudo配置的系统中登录时，该用户就能获取相应的sudo权限。
3、在Centos 7 客户端上配置相关的sudo配置
[root@localhost ~]# vim /etc/nsswitch.conf
#在文件末尾添加
sudoers: ldap files
[root@localhost ~]# vim /etc/sudo-ldap.conf
binddn cn=admin,dc=ldaptest,dc=com,dc=cn
bindpw 123456
uri ldap://10.10.10.35
#在文件末尾添加
sudoers_base ou=sudoers,dc=ldaptest,dc=com,dc=cn
配置完成后，可以使用指定用户登录客户端系统验证其对应的sudo权限，类似如下：
[charles@localhost ~]$ sudo -l
[sudo] password for charles:
Matching Defaults entries for charles on localhost:
requiretty, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS",
env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION
LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMBERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME
LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin:/bin:/usr/sbin/:/usr/bin, !visiblepw,
always_set_home, match_group_by_gid, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS",
env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION
LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME
LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
User charles may run the following commands on localhost:
(root) PASSWD: /bin/rm, /bin/rmdir, /bin/chmod, /bin/chown, /bin/dd, /bin/mv, /bin/cp, /sbin/fsck*, /sbin/*remove,
/usr/bin/chattr, /sbin/mkfs*, !/usr/bin/passwd
五、Openldap的用户密码管理
1、Openldap服务端加载ppolicy schema
[root@node3 ~]# ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/ppolicy.ldif
adding new entry "cn=ppolicy,cn=schema,cn=config"
2、Openldap服务端加载平policy模块及相应的obejectClass
[root@node3 ~]# vim add_module.ldif
dn: cn=module,cn=config
cn: module
objectClass: olcModuleList
olcModulePath: /usr/lib64/openldap
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: ppolicy.la
[root@node3 ~]# vim add_objectClass.ldif
dn: olcOverlay=ppolicy,olcDatabase={2}hdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcOverlay: ppolicy
olcPPolicyDefault: cn=default,ou=policy,dc=ldaptest,dc=com,dc=cn
olcPPolicyHashCleartext: TRUE
olcPPolicyUseLockout: TRUE
[root@node3 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f add_module.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=module,cn=config"
modifying entry "cn=module{0},cn=config"
[root@node3 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f add_objectClass.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "olcOverlay=ppolicy,olcDatabase={2}hdb,cn=config"
3、在服务端定义密码策略组
[root@node3 ~]# vim ppolicy.ldif
dn: ou=policy,dc=ldaptest,dc=com,dc=cn
objectClass: organizationalUnit
ou: policy
[root@node3 ~]# ldapadd -x -D "cn=admin,dc=ldaptest,dc=com,dc=cn" -h 10.10.10.35 -W -f ppolicy.ldif
Enter LDAP Password:
adding new entry "ou=policy,dc=ldaptest,dc=com,dc=cn"
4、在服务端定义默认的密码规则
[root@node3 ~]# vim ppolicy_rules.ldif
dn: cn=default,ou=policy,dc=ldaptest,dc=com,dc=cn
cn: default
objectClass: pwdPolicy
objectClass: person
objectClass: pwdPolicyChecker
pwdCheckModule: check_password.so #调用密码复杂性检查模块
pwdAllowUserChange: TRUE
pwdAttribute: userPassword
pwdExpireWarning: 259200
pwdFailureCountInterval: 0
pwdGraceAuthNLimit: 5
pwdCheckQuality: 1 #默认为0不检测密码强度，1为检查密码强度，并调用相应的模块检查密码复杂性，如果模块不存在，则仅检测ppolicy设置的属性；2为强制检测，如果检测模块不存在，则认为检测失败。
pwdInHistory: 5
pwdLockout: TRUE
pwdLockoutDuration: 300
pwdMaxAge: 259200
pwdMinAge: 0
pwdMaxFailure: 5
pwdMinLength: 8
pwdMustChange: TRUE
pwdSafeModify: TRUE
pwdReset: TRUE
sn: dummy value
[root@node3 ~]# ldapadd -x -D "cn=admin,dc=ldaptest,dc=com,dc=cn" -h 10.10.10.35 -W -f ppolicy_rules.ldif
Enter LDAP Password:
adding new entry "cn=default,ou=policy,dc=ldaptest,dc=com,dc=cn"
[root@node3 ~]# vim /etc/openldap/check_password.conf #配置密码复杂性检查规则
# OpenLDAP pwdChecker library configuration
#useCracklib 1
minPoints 3 #至少满足三个规则，此5个规则之间的关系为与关系，会按顺序匹配检查，如果全启用，则密码必须全部匹配所有规则才算合法。
minUpper 1 #至少1个大写字母
minLower 1 #至少1个小写字母
minDigit 1 #至少一个数字
minPunct 1 #至少一个标点符号
5、定义用户登录修改密码
#定义用户自助修改密码的acl权限
[root@node3 ~]# vim pw_access.ldif
dn: olcDatabase={-1}frontend,cn=config
changetype: modify
add: olcAccess
olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=admin,dc=ldaptest,dc=com,dc=cn" write by * none
olcAccess: to * by self write by dn.base="cn=admin,dc=ldaptest,dc=com,dc=cn" write by * read
dn: olcDatabase={-1}frontend,cn=config #定义修改默认的密码hash算法
changetype: modify
replace: olcPasswordHash
olcPasswordHash: {MD5}
[root@node3 ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f pw_access.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={-1}frontend,cn=config"
[root@node3 ~]# vim pwreset.ldif
dn: uid=charles,ou=People,dc=ldaptest,dc=com,dc=cn
changetype: modify
replace: pwdReset
pwdReset: TRUE
[root@node3 ~]# ldapadd -x -D "cn=admin,dc=ldaptest,dc=com,dc=cn" -h 10.10.10.35 -W -f pwreset.ldif
Enter LDAP Password:
modifying entry "uid=charles,ou=People,dc=ldaptest,dc=com,dc=cn"
[root@node3 ~]# ldapwhoami -x -D "uid=charles,ou=People,dc=ldaptest,dc=com,dc=cn" -W -e ppolicy -v
ldap_initialize( )
Enter LDAP Password:
ldap_bind: Success (0); Password must be changed (Password expires in 258868 seconds)
dn:uid=charles,ou=People,dc=ldaptest,dc=com,dc=cn
Result: Success (0)
在某些情况下，使用pwReset 来让用户登录修改密码的话，有时候用户会无法成功登录。在这种情况下，我们可以通过修改用户的密码属性shadowLastChange 的时间为0，来主动使得用户的密码过期，以达到用户下一次登录后触发密码更改的机制。如：
[root@node3 ~]# vim pwExpire.ldif
dn: uid=charles,ou=People,dc=ldaptest,dc=com,dc=cn
changetype: modify
replace: shadowLastChange
shadowLastChange: 0
[root@node3 ~]# ldapadd -x -D "cn=admin,dc=ldaptest,dc=com,dc=cn" -h 10.10.10.35 -W -f pwExpire.ldif
Enter LDAP Password:
modifying entry "uid=charles,ou=People,dc=ldaptest,dc=com,dc=cn"
6、在服务端配置密码审计
[root@node3 ~]# vim add_audit.ldif
dn: cn=module,cn=config
cn: module
objectClass: olcModuleList
olcModulePath: /usr/lib64/openldap
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: auditlog.la
[root@node3 ~]# vim add_auditlog_objectClass.ldif
dn: olcOverlay=auditlog,olcDatabase={2}hdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcAuditLogConfig
olcOverlay: auditlog
olcAuditlogFile: /var/log/slapd/auditlog.log #配置密码审计记录的日志保存路径
[root@node3 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f add_audit.ldif
[root@node3 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f add_auditlog_objectClass.ldif
[root@node3 ~]# mkdir /var/log/slapd
[root@node3 ~]# touch /var/log/slapd/auditlog.log
[root@node3 ~]# chown -R ldap.ldap /var/log/slapd/auditlog.log
[root@node3 ~]# systemctl restart slapd
[root@node3 ~]# systemctl restart rsyslog
配置完成后，在用户修改密码的记录均会记录到指定的路径下。