软件安装包：
- OpenLDAP 2.4.44: ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.44.tgz
- BDB: http://download.oracle.com/berkeley-db/db-5.1.29.tar.gz
CentOS 7 准备：
-
关闭防火墙
//停止firewall
systemctl stop firewalld.service//禁止firewall开机启动 systemctl disable firewalld.service //[Optional] //设置iptables service yum -y install iptables-services vim /etc/sysconfig/iptables //增加规则 -A INPUT -m state --state NEW -m tcp -p tcp --dport 389 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 636 -j ACCEPT -
关闭selinux
//编辑selinux文件
vim /etc/sysconfig/selinux//修改SELINUX=enforcing 为disabled SELINUX=disabled //设置selinux状态 setenforce 0 //获取selinux状态 getenfroce
安装OpenLDAP
依赖包
//涉及libtool-ltdl与libtool-ltdl-devel，如不安装，在编译时报错：configure: error: could not locate libtool ltdl.h
[root@localhost ~]# yum install ltdl -y安装BDB
//必须在解压包的build_unix目录中编译安装，否则会报错
[root@localhost ~]# cd /usr/local/src/
[root@localhost src]# tar -zxvf db-5.1.29.tar.gz
[root@localhost src]# cd db-5.1.29/build_unix/
[root@localhost build_unix]# ../dist/configure --prefix=/usr/local/berkeleydb-5.1.29
[root@localhost build_unix]# make
[root@localhost build_unix]# make install更新lib库
//保证在后面编译openldap时能找到lib和include下的库。
[root@localhost build_unix]# cd /usr/local/src/
[root@localhost src]# echo "/usr/local/berkeleydb-5.1.29/lib/" > /etc/ld.so.conf
[root@localhost src]# ldconfig -v-
安装OpenLDAP
//编译选项可以通过./configure --help查看；
//其中make test一步时间较长；
[root@localhost ~]# cd /usr/local/src/
[root@localhost src]# tar -zxvf openldap-2.4.44.tgz
[root@localhost src]# cd openldap-2.4.44
[root@localhost openldap-2.4.44]# ./configure --prefix=/usr/local/openldap-2.4.44 --enable-syslog --enable-modules --enable-debug --with-tls CPPFLAGS=-I/usr/local/berkeleydb-5.1.29/include/ LDFLAGS=-L/usr/local/berkeleydb-5.1.29/lib/
[root@localhost openldap-2.4.44]# make depend
[root@localhost openldap-2.4.44]# make
[root@localhost openldap-2.4.44]# make test
[root@localhost openldap-2.4.44]# make install//OpenLDAP 包在服务器上安装了很多程序： //守护进程： slapd：主 LDAP 服务器 slurpd：负责与复制 LDAP 服务器保持同步的服务器 //对网络上的目录进行操作的客户机程序。下面这两个程序是一对儿： ldapadd：打开一个到 LDAP 服务器的连接，绑定、修改或增加条目 ldapsearch：打开一个到 LDAP 服务器的连接，绑定并使用指定的参数进行搜索 //对本地系统上的数据库进行操作的几个程序： slapadd：将以 LDAP 目录交换格式（LDIF）指定的条目添加到 LDAP 数据库中 slapcat：打开 LDAP 数据库，并将对应的条目输出为 LDIF 格式 设置可执行命令
//对openldap客户端（bin）与服务器端（sbin）相关执行档添加软链接，也可以通过增加环境变量的方式设置
[root@localhost openldap-2.4.44]# cd /usr/local/openldap-2.4.44
[root@localhost openldap-2.4.44]# ln -s /usr/local/openldap-2.4.44/bin/* /usr/local/bin/
[root@localhost openldap-2.4.44]# ln -s /usr/local/openldap-2.4.44/sbin/* /usr/local/sbin/-
配置rootdn密码
//这样rootdn密码为密文方式，复制输出密文到主配置文件rootdn对应的位置即可，如果不想麻烦，可以忽略此步，在主配置文件中使用明文即可。
[root@locahost openldap-2.4.44]# slappasswd
New password:Re-enter new password: {SSHA}Jaxya/293KIkH8+3crZqiWpYLK829+pv [root@NGACentOS7 openldap-2.4.44]# -
修改主配置文件slapd.conf :
[root@localhost openldap-2.4.44]# cd /usr/local/openldap-2.4.44/etc/openldap/
[root@localhost openldap]# vim slapd.conf
内容如下：
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.//schema默认只有core.schema，各级需要添加，这里将同配置文件一个目录的schema目录中有的schema文件都加到配置文件中。 include /usr/local/openldap-2.4.44/etc/openldap/schema/core.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/collective.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/corba.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/cosine.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/duaconf.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/dyngroup.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/inetorgperson.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/java.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/misc.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/nis.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/openldap.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/pmi.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/openldap-2.4.44/var/run/slapd.pid argsfile /usr/local/openldap-2.4.44/var/run/slapd.args //#新增日志文件级别与路径，需要在编译时--enable-debug，否则日志文件输出，不影响调试模式。 loglevel 256 logfile /usr/local/openldap-2.4.44/var/slapd.log # Load dynamic backend modules: # modulepath /usr/local/openldap-2.4.44/libexec/openldap # moduleload back_mdb.la # moduleload back_ldap.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # MDB database definitions ####################################################################### //这里使用mdb做后端数据库，也可修改为”bdb”参数，在OpenLDAP 官方文档” 11.4. LMDB”章节中有介绍mdb是推荐使用的后端数据库 database mdb maxsize 1073741824 /*使用mdb做后端数据库时，根据官方文档中说明需要设置一个空间值，” In addition to the usual parameters that a minimal configuration requires, the mdb backend requires a maximum size to be set. This should be the largest that the database is ever anticipated to grow (in bytes). The filesystem must also provide enough free space to accommodate this size.”；如果使用bdb做后端数据库，需要将此项参数注释。*/ //修改域名及管理员账户名。 suffix "dc=cisco,dc=com" rootdn "cn=admin,dc=cisco,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. //使用密文密码，即前面使用slappasswd生成的密文。 rootpw {SSHA}Jaxya/293KIkH8+3crZqiWpYLK829+pv # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. //openldap数据目录，采用mdb时，在相应目录生成” data.mdb”与” lock.mdb”文件；采用bdb时，在相应目录生成” dn2id.bdb”与” id2entry.bdb”，及多个” __db.00*”文件。 directory /usr/local/openldap-2.4.44/var/openldap-data # Indices to maintain index objectClass eq 初始化OpenLDAP（Optional）
#如果采用mdb做后端数据库，此步可忽略，DB_CONFIG是 bdb/hdb数据库使用的。
#与主配置文件中的配置有关，主配置文件确定使用bdb与数据存放路径。
[root@localhost openldap]# cd /usr/local/openldap-2.4.44/var/openldap-data/
[root@localhost openldap-data]# cp DB_CONFIG.example DB_CONFIG-
启动OpenLDAP
//直接在后台工作;
[root@localhost ~]# /usr/local/openldap-2.4.44/libexec/slapd//非root用户不能监听端口1~1024，如果是非root用户，有可能需要重新定义服务端口。 [root@localhost ~]# /usr/local/openldap-2.4.44/libexec/slapd -d 256 //验证(任选一个) [root@localhost ~]# ldapsearch -x -b '' -s base'(objectclass=*)' [root@localhost ~]# ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts [root@localhost ~]# netstat -tunlp | grep 389，ps -ef | grep slapd，ps aux | grep slapd -
LDIF文件配置组织，用户，条目等
//创建一个管理员账号：
[root@NGACentOS7 ~]# cat admin.ldifdn: dc=cisco,dc=com objectclass: dcObject objectclass: organization o: CISCO.Inc dc: cisco dn: cn=admin,dc=cisco,dc=com objectclass: organizationalRole cn: admin [root@NGACentOS7 ~]# //注意：you need an empty line before each line starting with "dn:" LDIF separates entries by blank lines. //添加至ldap数据库 //简单身份验证必须要使用 -x 选项指定。在 slapd.conf 中定义的 rootdn 身份验证识别名是 “cn=admin,dc=cisco,dc=com”。对于简单身份验证来说，必须使用密码。选项 -W 强制提示输入密码。这个密码就是在 slapd.conf 文件中指定的 rootpw 参数的值。包含这些条目的 LDIF 文件是使用 -f 选项指定的： [root@NGACentOS7 ~]# ldapadd -x -D "cn=admin,dc=cisco,dc=com" -W -f admin.ldif Enter LDAP Password: adding new entry "dc=cisco,dc=com" adding new entry "cn=admin,dc=cisco,dc=com" /*验证 [root@NGACentOS7 ~]# ldapsearch -x -b 'dc=cisco,dc=com' '(objectClass=*)' # extended LDIF # # LDAPv3 # base
[Private]
NAM Lab 配置实例：
[root@NGACentOS7 ~]# cat namPeople.ldif
dn:uid=Lily,ou=namPeople,dc=cisco,dc=com
uid:Lily
cn:Lily
sn:Lily
userPassword:Crdc%123
objectClass:inetOrgPerson
objectClass:posixAccount
uidNumber:1315
gidNumber:100
homeDirectory:/home/Lily
dn:uid=Lucy,ou=namPeople,dc=cisco,dc=com
uid:Lucy
cn:Lucy
objectClass:account
objectClass:posixAccount
objectClass:top
objectClass:shadowAccount
userPassword:Crdc%123
shadowLastChange:15064
loginShell:/bin/sh
uidNumber:1315
gidNumber:100
homeDirectory:/home/Lucy
dn:uid=Leo,ou=namPeople,dc=cisco,dc=com
uid:Leo
cn:Leo
objectClass:account
objectClass:posixAccount
objectClass:top
objectClass:shadowAccount
userPassword:Crdc%123
shadowLastChange:15064
loginShell:/bin/sh
uidNumber:1316
gidNumber:100
homeDirectory:/home/Leo
[root@NGACentOS7 ~]#
ISE 关联配置：
参考补充自：
- http://blog.chinaunix.net/xmlrpc.php?r=blog/article&uid=26168435&id=5746284
- http://seanlook.com/2015/01/22/openldap_ldif_example/
- https://www.ibm.com/developerworks/cn/linux/l-openldap/