LDAP目录服务安装

1、开始安装LDAP master

Openldap依赖相关软件
http://www.openldap.org/doc/admin24/install.html

2、安装前检查

[root@ldap-server ~]# cat /etc/issue
CentOS release 6.7 (Final)
Kernel \r on an \m
[root@ldap-server ~]# uname -a                  #查看系统版本
Linux ldap-server 2.6.32-573.el6.x86_64 #1 SMP Thu Jul 23 15:44:03 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
[root@ldap-server ~]# rpm -qa |grep openldap    #查看系统上是否装有openldap
openldap-2.4.40-5.el6.x86_64

3、yum安装openldap

[root@ldap-server ~]# yum  install openldap openldap-* -y                 #安装openldap及相关软件
[root@ldap-server ~]# yum install nscd nss-pam-ldap nss-* pcre pcre-* -y  #安装openldap需要的模块

[root@ldap-server ~]# rpm -qa |grep openldap                              #安装后查看一下，都安装了哪些包
openldap-devel-2.4.40-12.el6.x86_64
openldap-2.4.40-12.el6.x86_64
openldap-servers-sql-2.4.40-12.el6.x86_64
openldap-servers-2.4.40-12.el6.x86_64
openldap-clients-2.4.40-12.el6.x86_64

4、配置ldap master

[root@ldap-server ~]# cd /etc/openldap/
[root@ldap-server openldap]# ll
total 20
drwxr-xr-x. 2 root root 4096 May 11 07:32 certs
-rw-r-----. 1 root ldap  121 May 11 07:32 check_password.conf
-rw-r--r--. 1 root root  280 May 11 07:32 ldap.conf
drwxr-xr-x. 2 root root 4096 Sep 21 19:40 schema
drwx------. 3 ldap ldap 4096 Sep 21 19:40 slapd.d
[root@ldap-server openldap]# ll slapd.d/        #默认的配置文件
total 8
drwx------. 3 ldap ldap 4096 Sep 21 19:40 cn=config
-rw-------. 1 ldap ldap 1281 Sep 21 19:40 cn=config.ldif
[root@ldap-server openldap]# ll slapd.d/cn\=config
total 80
drwx------. 2 ldap ldap  4096 Sep 21 19:40 cn=schema
-rw-------. 1 ldap ldap 59366 Sep 21 19:40 cn=schema.ldif
-rw-------. 1 ldap ldap   663 Sep 21 19:40 olcDatabase={0}config.ldif
-rw-------. 1 ldap ldap   596 Sep 21 19:40 olcDatabase={-1}frontend.ldif
-rw-------. 1 ldap ldap   695 Sep 21 19:40 olcDatabase={1}monitor.ldif
-rw-------. 1 ldap ldap  1273 Sep 21 19:40 olcDatabase={2}bdb.ldif
[root@ldap-server openldap]# cp /usr/share/openldap-servers/slapd.conf.obsolete slapd.conf  #使用老版本的配置文件
[root@ldap-server openldap]# ll slapd.conf 
-rw-r--r--. 1 root root 4635 Sep 21 20:03 slapd.conf
[root@ldap-server openldap]# slappasswd --help
slappasswd: invalid option -- '-'
Usage: slappasswd [options]
  -c format crypt(3) salt format
  -g        generate random password
  -h hash   password scheme
  -n        omit trailing newline
  -o [=val] specify an option with a(n optional) value
    module-path=
    module-load=
  -s secret new password
  -u        generate RFC2307 values (default)
  -v        increase verbosity
  -T file   read file for new password
[root@ldap-server openldap]# slappasswd -s oldboy     #设置管理员用户名密码
{SSHA}huSl5ID8XwwtAxMtMS1xpSm0P7WLgc6t

[root@ldap-server openldap]# slappasswd -s oldboy|sed -e "s#{SSHA}#rootpw\t{SSHA}#g">>slapd.conf   #使用sed命令直接追加到slapd.conf配置文件中
[root@ldap-server openldap]# tail -1 slapd.conf 
rootpw  {SSHA}68ABReRFJK+5o0/4InzQtEPzX+2w+Prg

有关openldap2.3和2.4配置文件及数据格式的区别
http://www.openldap.org/doc/admin24/slapdconf2.html

5、配置ldap其他参数

修改服务器配置文件
vim slapd.conf
修改114行
#add start by oldboy 
database        bdb
suffix          "dc=etiantian,dc=org"
rootdn          "cn=admin,dc=etiantian,dc=org"
#add start by oldboy

修改完之后

修改参数的含义
database        bdb                               #指定使用的数据库bdb
suffix          "dc=etiantian,dc=org"             #指定要搜索的后缀
rootdn          "cn=admin,dc=etiantian,dc=org"    #指定管理员dn路径，使用这个dn可以登录openLDAP服务器

6、更多的ldap参数配置优化

a.日志及缓存参数

[root@ldap-server openldap]# cat >>/etc/openldap/slapd.conf< #add start by oldboy
> loglevel    296
> cachesize   1000
> checkpoint  2048 10
> #add end by oldboy
> EOF
[root@ldap-server openldap]# tail -6 slapd.conf
rootpw  {SSHA}68ABReRFJK+5o0/4InzQtEPzX+2w+Prg
#add start by oldboy
loglevel    296
cachesize   1000
checkpoint  2048 10
#add end by oldboy

参数说明
loglevel    296       #设置日志级别，记录日志信息方便调试 296级别是有256（日志连接、操作、结果）、32（搜索过滤器）、8（连接管理）累加的结果
cachesize   1000      #设置ldap可以缓存的记录数
checkpoint  2048 10   #ldap checkpoint项可以设置把内存中的数据写回到数据文件的操作，上面设置表示达到2048KB或者10分钟执行一次写入数据文件的操作

b.权限设置

案例1：
access to dn="cn=subschema" by * read

access to * 
        by self write
        by dn.subtree="ou=sysusers,dc=intra,dc=qq,dc=com" read
        by anonymous auth

有关权限管理的说明
http://www.openldap.org/doc/admin24/access-control.html

A simple example:

    olcAccess: to * by * read

This access directive grants read access to everyone.

    olcAccess: to *
        by self write
        by anonymous auth
        by * read

7、配置syslog记录ldap服务日志

配置syslog,记录ldap服务日志，默认级别为256
[root@ldap-server openldap]# cp /etc/rsyslog.conf /etc/rsyslog.conf.ori.$(date +%F%T)
[root@ldap-server openldap]# echo "record ldap.log by oldboy">>/etc/rsyslog.conf
[root@ldap-server openldap]# echo "local4.*      /var/log/ldap.log">>/etc/rsyslog.conf
[root@ldap-server openldap]# tail -1 /etc/rsyslog.conf
local4.*      /var/log/ldap.log
[root@ldap-server openldap]# /etc/init.d/rsyslog restart
Shutting down system logger:                               [  OK  ]
Starting system logger:                                    [  OK  ]

8、配置LDAP数据库路径

注意：slapd.conf 中设定了LDAP数据库格式为bdb,存储路径/var/lib/ldap
[root@ldap-server openldap]# grep bdb /etc/openldap/slapd.conf
#database   bdb
database        bdb
[root@ldap-server openldap]# grep directory /etc/openldap/slapd.conf
# Do not enable referrals until AFTER you have a working directory
# The database directory MUST exist prior to running slapd AND 
directory   /var/lib/ldap
配置ldap数据库
[root@ldap-server openldap]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@ldap-server openldap]# ll /var/lib/ldap/DB_CONFIG 
-rw-r--r--. 1 root root 845 Sep 21 21:11 /var/lib/ldap/DB_CONFIG

[root@ldap-server openldap]# chown ldap:ldap /var/lib/ldap/DB_CONFIG 
[root@ldap-server openldap]# chmod 700 /var/lib/ldap/
[root@ldap-server openldap]# ll /var/lib/ldap/DB_CONFIG 
-rw-r--r--. 1 ldap ldap 845 Sep 21 21:11 /var/lib/ldap/DB_CONFIG

测试配置是否成功
[root@ldap-server openldap]# slaptest -u
config file testing succeeded

更改后的配置文件
[root@ldap-server openldap]# egrep -v "#|^$" slapd.conf
include     /etc/openldap/schema/corba.schema
include     /etc/openldap/schema/core.schema
include     /etc/openldap/schema/cosine.schema
include     /etc/openldap/schema/duaconf.schema
include     /etc/openldap/schema/dyngroup.schema
include     /etc/openldap/schema/inetorgperson.schema
include     /etc/openldap/schema/java.schema
include     /etc/openldap/schema/misc.schema
include     /etc/openldap/schema/nis.schema
include     /etc/openldap/schema/openldap.schema
include     /etc/openldap/schema/ppolicy.schema
include     /etc/openldap/schema/collective.schema
allow bind_v2
pidfile     /var/run/openldap/slapd.pid
argsfile    /var/run/openldap/slapd.args
TLSCACertificatePath /etc/openldap/certs
TLSCertificateFile "\"OpenLDAP Server\""
TLSCertificateKeyFile /etc/openldap/certs/password
    Access  to *
        by self write
        by anonymous auth
        by * read
database        bdb
suffix      "dc=etiantian,dc=org"
rootdn      "cn=admin,dc=etiantian,dc=org"
directory   /var/lib/ldap
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
rootpw  {SSHA}68ABReRFJK+5o0/4InzQtEPzX+2w+Prg
loglevel    296
cachesize   1000
checkpoint  2048 10

9、启动ldap master

操作命令：/etc/init.d/slapd start
[root@ldap-server openldap]# /etc/init.d/slapd start
Starting slapd:                                            [  OK  ]
[root@ldap-server openldap]# lsof -i :389   #查看是否启动成功
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
slapd   8217 ldap    7u  IPv4  30558      0t0  TCP *:ldap (LISTEN)
slapd   8217 ldap    8u  IPv6  30559      0t0  TCP *:ldap (LISTEN)
[root@ldap-server openldap]# ps -ef f|grep ldap|grep -v grep
ldap       8217      1  0 21:20 ?        Ssl    0:00 /usr/sbin/slapd -h  ldap:/// ldapi:/// -u ldap

[root@ldap-server openldap]# chkconfig slapd on   #设置开机启动
[root@ldap-server openldap]# chkconfig --list slapd
slapd           0:off   1:off   2:on    3:on    4:on    5:on    6:off

[root@ldap-server openldap]# tail /var/log/ldap.log 
Sep 21 21:20:09 ldap-server slapd[8214]: @(#) $OpenLDAP: slapd 2.4.40 (May 10 2016 23:30:49) $#012#[email protected]:/builddir/build/BUILD/openldap-2.4.40/openldap-2.4.40/build-servers/servers/slapd

10、有关官方openldap2.4说明

http://www.openldap.org/doc/admin24/runningslapd.html

[root@ldap-server openldap]# ldapsearch -LLL -W -x -H ldap://etiantian.org -D "cn=admin,dc=etiantian,dc=org" -b "dc=etiantian,dc=org" "(uid=*)"
Enter LDAP Password: 
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
[root@ldap-server openldap]# rm -rf /etc/openldap/slapd.
slapd.conf      slapd.conf.ori  slapd.d/        
[root@ldap-server openldap]# rm -rf /etc/openldap/slapd.d/*

[root@ldap-server openldap]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
57e28d7a /etc/openldap/slapd.conf: line 113: unknown directive  outside backend info and database definitions.
slaptest: bad configuration directory!
[root@ldap-server openldap]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
57e28e17 bdb_monitor_db_open: monitoring disabled; configure monitor database to enable
config file testing succeeded

[root@ldap-server openldap]# ll /etc/openldap/slapd.d/*
-rw-------. 1 root root 1301 Sep 21 21:41 /etc/openldap/slapd.d/cn=config.ldif

/etc/openldap/slapd.d/cn=config:
total 76
drwxr-x---. 2 root root  4096 Sep 21 21:41 cn=schema
-rw-------. 1 root root 59366 Sep 21 21:41 cn=schema.ldif
-rw-------. 1 root root   584 Sep 21 21:41 olcDatabase={0}config.ldif
-rw-------. 1 root root  2699 Sep 21 21:41 olcDatabase={1}bdb.ldif
-rw-------. 1 root root   660 Sep 21 21:41 olcDatabase={-1}frontend.ldif
[root@ldap-server openldap]# /etc/init.d/slapd restart
Stopping slapd:                                            [  OK  ]
Checking configuration files for slapd:                    [FAILED]
57e28e64 ldif_read_file: Permission denied for "/etc/openldap/slapd.d/cn=config.ldif"
slaptest: bad configuration file!
[root@ldap-server openldap]# chown -R ldap:ldap /etc/openldap/slapd.d/
[root@ldap-server openldap]# /etc/init.d/slapd restart
Stopping slapd:                                            [FAILED]
Starting slapd:                                            [  OK  ]
[root@ldap-server openldap]# lsof -i :389
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
slapd   8362 ldap    7u  IPv4  31921      0t0  TCP *:ldap (LISTEN)
slapd   8362 ldap    8u  IPv6  31922      0t0  TCP *:ldap (LISTEN)

11、解决2.3和2.4冲突的问题

 rm -rf /etc/openldap/slapd.d/*
 slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
 chown -R ldap:ldap /etc/openldap/slapd.d/
 /etc/init.d/slapd restart
 lsof -i :389

仍然有问题

[root@ldap-server openldap]# ldapsearch -LLL -W -x -H ldap://etiantian.org -D "cn=admin,dc=etiantian,dc=org" -b "dc=etiantian,dc=org" "(uid=*)"
Enter LDAP Password: 
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

解决办法：
配置/etc/hosts
127.0.0.1   etiantian.org

转载于:https://www.cnblogs.com/migongci0412/p/6032994.html