ubuntu 12.04 安装openldap(不开启加密验证)

背景:公司已经有了openldap的client+server系统,我需要对系统进行备份。保证可用性。

系统环境:ubuntu 12.04 

安装准备:berkeley-db 和openldap 版本一定要匹配或者都用最新版本,否则安装openldap的时候会出现很多麻烦问题。本文采用的是老版本。berkeley-db:4.7.25(已安装系统上查看版本方法cat /usr/local/BerkeleyDB安装目录/include/db.h |grep "DB_VERSION_STRING")   openldap:2.4.40  (已安装系统上查看版本方法/usr/local/libexec/slapd  -V)

以上文件对应版本下载链接:

http://download.oracle.com/berkeley-db/db-4.7.25.tar.gz

ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.40.tgz

server安装过程:

mkdir /usr/local/openldap_install
cd /usr/local/openldap_install
wget http://download.oracle.com/berkeley-db/db-4.7.25.tar.gz
wget ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.40.tgz
tar -zxvf db-4.7.25.tar.gz
cd db-4.7.25/
cd build_unix/
../dist/configure
make  -j9
make  install

安装BerkeleyDB安装后需要将对应so文件加入系统环境,否则无法安装openldap

找到BerkeleyDB安装目录的对应lib目录,并将该路径添加到/etc/ld.so.conf
echo "/usr/local/BerkeleyDB.4.7/lib" >>/etc/ld.so.conf
ldconfig -v  #将BerkeleyDB的so文件加载到系统环境中。
然后安装openldap
cd /usr/local/openldap_install
tar -zxvf openldap-2.4.40.tgz
#以下注意命令中BerkeleyDB的安装路径
./configure  CPPFLAGS="-I/usr/local/BerkeleyDB.4.7/include -D_GNU_SOURCE" LDFLAGS="-L/usr/local/BerkeleyDB.4.7/lib"
make depend
make -j9
make install

说明,默认安装后服务端全部安装在了/usr/local/目录下。

/usr/local/BerkeleyDB.4.7   BerkeleyDB目录

/usr/local/etc/openldap  openldap 安装目录

/usr/local/libexec  openldap 的slapd 二进制执行文件目录

/usr/local/var/openldap-data  openldap的数据库目录

启动服务前,修改/usr/local/etc/openldap/slapd.conf配置

include         /usr/local/etc/openldap/schema/corba.schema
include         /usr/local/etc/openldap/schema/core.schema
include         /usr/local/etc/openldap/schema/cosine.schema
include         /usr/local/etc/openldap/schema/duaconf.schema
include         /usr/local/etc/openldap/schema/dyngroup.schema
include         /usr/local/etc/openldap/schema/inetorgperson.schema
include         /usr/local/etc/openldap/schema/misc.schema
include         /usr/local/etc/openldap/schema/openldap.schema
include         /usr/local/etc/openldap/schema/nis.schema
include         /usr/local/etc/openldap/schema/java.schema
include         /usr/local/etc/openldap/schema/ppolicy.schema
include         /usr/local/etc/openldap/schema/pmi.schema
include         /usr/local/etc/openldap/schema/collective.schema

pidfile         /usr/local/var/run/slapd.pid
argsfile        /usr/local/var/run/slapd.args

#此处内容还需进一步确认功能作用,此次用不到。
TLSCACertificateFile  /usr/local/etc/certs/cacert.pem
TLSCertificateFile    /usr/local/etc/certs/new-server.crt
TLSCertificateKeyFile /usr/local/etc/certs/new-server.key
TLSVerifyClient never

access to attrs=shadowLastChange,userPassword
      by self write
      by * auth
access to *
      by self write
      by * read

database config
access to *
        by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
        by * none

database monitor
access to *
        by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
        by dn.exact="cn=Manager,dc=my-domain,dc=com" read
        by * none
############
database        bdb
suffix          "dc=bokecc,dc=com"
checkpoint      1024 15
rootdn          "cn=root,dc=my-domain,dc=com"

rootpw          secret

directory       /usr/local/var/openldap-data

index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub

loglevel 256
logfile /usr/local/var/slapd.log

服务端启动方法:

/usr/local/libexec/slapd -h ldap://1.1.1.1 -f /usr/local/etc/openldap/slapd.conf

启动后,没有问题。后续将通过

client安装过程:

client和server安装在同一台服务器上。

二、安装配置方式:

1.apt安装
apt-get install ldap-utils libpam-ldap libnss-ldap nslcd
安装过程中提示填写ldap相关信息:ldap server 地址,base dc等.信息保存在/etc/ldap.conf中,可通过dpkg-reconfigure ldap-auth-config重新配置,其中: 
ldap服务uri格式 ldap://ldapServerIP/
search base:dc=my,dc=com,dc=com
root ldap account:cn=admin,dc=my,dc=com,dc=cn      Make local root Database admin:    no
2.修改nsswitch.conf文件
/etc/nsswitch.conf
passwd: files ldap
group: files ldap
shadow: files ldap

#hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

3.认证方式中添加ldap:
auth-client-config -t nss -p lac_ldap
直接执行以上命令即可 

4.认证通过后自动创建用户家目录: 
/etc/pam.d/common-session,追加内容:  
session required pam_mkhomedir.so skel=/etc/skel umask=0022

5.配置开启ldap认证方式
pam-auth-update

6.可在本机通过passwd更改用户密码(可选)
/etc/pam.d/common-password,除去其中的use_authtok参数

7.重启相关服务
update-rc.d nslcd enable
/etc/init.d/nslcd restart

参见http://askubuntu.com/questions/127389/how-to-configure-ubuntu-as-an-ldap-client 

二、脚本配置方式(出处:http://blog.csdn.net/qk1992919/article/details/51262424)

待修改:

如果需配置的机器很多,采用手工配置方式不太合适,可在待配置机器上运行如下shell脚本进行自动化配置: 
C代码  
#!/bin/bash  
  
#--------------------------------------------------------------------------------  
  
#Ldap server地址及base DN  
LDAP_SERVER_IP=192.168.1.100  
BASE_DN='dc=my,dc=com,dc=cn'  
  
#--------------------------------------------------------------------------------  
  
#创建preseed文件-软件安装自应答  
touch debconf-ldap-preseed.txt  
echo "ldap-auth-config    ldap-auth-config/ldapns/ldap-server    string    ldap://$LDAP_SERVER_IP" >> debconf-ldap-preseed.txt  
echo "ldap-auth-config    ldap-auth-config/ldapns/base-dn    string    $BASE_DN" >> debconf-ldap-preseed.txt  
echo "ldap-auth-config    ldap-auth-config/ldapns/ldap_version    select    3" >> debconf-ldap-preseed.txt  
echo "ldap-auth-config    ldap-auth-config/dbrootlogin    boolean    false" >> debconf-ldap-preseed.txt  
echo "ldap-auth-config    ldap-auth-config/dblogin    boolean    false" >> debconf-ldap-preseed.txt  
echo "nslcd   nslcd/ldap-uris string  ldap://$LDAP_SERVER_IP" >> debconf-ldap-preseed.txt  
echo "nslcd   nslcd/ldap-base string  $BASE_DN" >> debconf-ldap-preseed.txt  
  
cat debconf-ldap-preseed.txt | debconf-set-selections  
  
#安装ldap client相关软件  
apt-get install -y ldap-utils libpam-ldap libnss-ldap nslcd  
  
#认证方式中添加ldap  
auth-client-config -t nss -p lac_ldap  
  
#认证登录后自动创建用户家目录  
echo "session required pam_mkhomedir.so skel=/etc/skel umask=0022" >> /etc/pam.d/common-session  
  
#自启动服务  
update-rc.d nslcd enable  
  
#可以在Host上通过passwd更改用户密码  
cp /etc/pam.d/common-password /etc/pam.d/common-password.bak  
sed -i 's/use_authtok//' /etc/pam.d/common-password  
  
#使配置生效  
/etc/init.d/nslcd restart  

 

 

 

 

另一个情况:

openldap  server端  ubuntu 12.04 

创建的自签名证书。 只开启636公网端口,389监听内网。客户端通过ldaps://方式连接636端口。

TLSCACertificateFile  /etc/ldap/tls/cacert.pem 
TLSCertificateFile    /etc/ldap/tls/new-server.crt
TLSCertificateKeyFile /etc/ldap/tls/new-server.key
TLSVerifyClient never     #不校验客户端证书

 

客户端开启验证服务端证书。总是不成功。

服务端提示:

Jun  2 19:21:01 oldog slapd[1003]: conn=15447 fd=19 ACCEPT from IP=139.219.68.2:37734 (IP=serverIP:636)
Jun  2 19:21:01 oldog slapd[1003]: conn=15447 fd=19 closed (TLS negotiation failure)
Jun  2 19:21:01 oldog slapd[1003]: conn=15448 fd=19 ACCEPT from IP=139.219.68.2:37736 (IP=serverIP:636)
Jun  2 19:21:01 oldog slapd[1003]: conn=15448 fd=19 closed (TLS negotiation failure)

通过重启客户端/usr/sbin/nscd  服务能恢复正常。 

/usr/sbin/nscd      -K, --shutdown  停止nscd进程。

/usr/sbin/nscd   启动nscd进程。

客户端情况:

ubuntu 14.04

apt-get install ldap-utils libpam-ldap libnss-ldap nslcd nscd 

安装完后检查 /etc/ldap.conf  ( /etc/ldap/ldap.conf  /etc/nslcd.conf  这两个文件为互补文件)  /etc/nsswitch.conf  

 /etc/ldap.conf 

添加 binddn uid=check,dc=bokecc,dc=com

bindpw   1234567

pam_groupdn  cn=pssh,dc=bokecc,dc=com 

pam_member_attribute memberUid

pam_password clear    # 由md5改成clear

最后加上

nss_initgroups_ignoreusers,backup,bin,daemon,games,gnats,irc,landscape,libuuid,list,lp,mail,man,messagebus,news,nslcd,proxy,root,sshd,sync,sys,syslog,uucp,www-data

 

修改/etc/ldap/ldap.conf

TLS_CACERT      /etc/ssl/certs/ca-certificates.crt      修改后边自签名证书路径 /usr/local/etc/certs/cacert.pem

如果在上边安装过程中,有一个问是否需要验证tls      选择demand。才能进行tls验证。 最终影响/etc/nslcd.conf中增加这个配置:tls_reqcert demand

命令:auth-client-config -t nss -p lac_ldap    修改/etc/nsswitch.conf   让本地的passwd  group shadow 添加ldap用户。

/etc/pam.d/common-session 新增: session required pam_mkhomedir.so skel=/etc/skel umask=0022  保证新增路用户自动创建用户目录    还可以通过pam-auth-update   在选项中开启。  

pam-auth-update  可以控制用户登录验证的模块。

 

在/etc/pam.d/common-account  增加 :

account sufficient      pam_ldap.so
account required        pam_unix.so

/etc/init.d/nslcd restart   出现如下错误:
/usr/sbin/nslcd: /usr/local/lib/liblber-2.4.so.2: no version information available (required by /usr/sbin/nslcd)
/usr/sbin/nslcd: /usr/local/lib/libldap_r-2.4.so.2: no version information available (required by /usr/sbin/nslcd)

 

sudo ln -fs /usr/local/lib/liblber-2.4.so.2 /usr/local/lib/

sudo ln -fs /usr/local/lib/libldap_r-2.4.so.2 /usr/local/lib/

 

 

 

 

 

ubuntu 16.04

apt-get install ldap-utils libpam-ldap libnss-ldap nslcd nscd 

安装后:检查 /etc/ldap.conf   /etc/nslcd.conf   /etc/nsswitch.conf  

 /etc/ldap/ldap.conf没有了。所有配置全部集中到了 /etc/nslcd.conf  

修改 /etc/nslcd.conf   自签名证书路径。

修改 /etc/ldap.conf

binddn uid=check,dc=bokecc,dc=com

bindpw 1234567

pam_groupdn cn=pssh,dc=bokecc,dc=com

pam_member_attribute memberUid

pam_password clear   改 md5为clear

ssl on

tls_checkpeer yes

tls_cacertfile /usr/local/etc/certs/cacert.pem

最后添加:

nss_initgroups_ignoreusers,backup,bin,daemon,games,gnats,irc,landscape,libuuid,list,lp,mail,man,messagebus,news,nslcd,proxy,root,sshd,sync,sys,syslog,uucp,www-data

 

命令:auth-client-config -t nss -p lac_ldap    修改/etc/nsswitch.conf   让本地的passwd  group shadow 添加ldap用户。

/etc/pam.d/common-session 新增: session required pam_mkhomedir.so skel=/etc/skel umask=0022  保证新增路用户自动创建用户目录    还可以通过pam-auth-update   在选项中开启。  

pam-auth-update  可以控制用户登录验证的模块。

在/etc/pam.d/common-account  增加 :

account sufficient      pam_ldap.so

account required        pam_unix.so

 

 

/etc/init.d/nslcd restart   出现如下错误:
/usr/sbin/nslcd: /usr/local/lib/liblber-2.4.so.2: no version information available (required by /usr/sbin/nslcd)
/usr/sbin/nslcd: /usr/local/lib/libldap_r-2.4.so.2: no version information available (required by /usr/sbin/nslcd)

 

sudo ln -fs /usr/local/lib/liblber-2.4.so.2 /usr/local/lib/

sudo ln -fs /usr/local/lib/libldap_r-2.4.so.2 /usr/local/lib/

 

 

 

dpkg --purge  ldap-auth-client  ldap-auth-config   ldap-utils  libnss-ldap  libpam-ldap  nslcd-utils  nslcd  nscd  

apt-get install ldap-utils libpam-ldap libnss-ldap nslcd nscd 

 

相关的进程或软件  nscd ,nss_ldap,nslcd,nsswitch,nslcd,nssldap-update-ignoreusers,pam-auth-update,

你可能感兴趣的:(openldap)