安装 OpenLdap
yum install -y openldap openldap-clients openldap-servers
systemctl start slapd
systemctl enable slapd
OpenLdap 配置日志
- https://wiki.shileizcc.com/confluence/pages/viewpage.action?pageId=39223541#OpenLDAP%E7%AC%94%E8%AE%B0-%E9%80%9A%E8%BF%87cn=config%E9%85%8D%E7%BD%AEOpenLDAP%E6%97%A5%E5%BF%97
- https://yq.aliyun.com/articles/99841
配置 rsyslog 收集 openldap 日志
sed -i 's/^local4\./#local4\./g' /etc/rsyslog.conf
echo "local4.* /var/log/slapd/slapd.log" >> /etc/rsyslog.conf
systemctl restart rsyslog
修改 openldap loglevel
delete_loglevel.ldif (可能不需要，执行出错就不需要)
dn: cn=config
changetype: modify
delete: olcLogLevel
olcLogLevel: Stats
ldapmodify -Y EXTERNAL -H ldapi:/// -f delete_loglevel.ldif
- add_loglevel.ldif
dn: cn=config
changetype: modify
add: olcLogLevel
olcLogLevel: 256
ldapmodify -Y EXTERNAL -H ldapi:/// -f add_loglevel.ldif
添加 schema
for i in `ls /etc/openldap/schema/*.ldif`; do ldapadd -Y EXTERNAL -H ldapi:/// -f $i; done
配置支持加载模块
module_entry.ldif
dn: cn=module,cn=config
cn: module
objectClass: olcModuleList
olcModulePath: /usr/lib64/openldap
ldapadd -Y EXTERNAL -H ldapi:/// -f module_entry.ldif
配置开启 auditlog
add_auditlog_mod.ldif
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: auditlog
ldapmodify -Y EXTERNAL -H ldapi:/// -f add_auditlog_mod.ldif
conf_auditlog.ldif
dn: olcOverlay=auditlog,olcDatabase={2}hdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcAuditLogConfig
olcOverlay: auditlog
olcAuditlogFile: /var/log/slapd/auditlog.log
ldapadd -Y EXTERNAL -H ldapi:/// -f conf_auditlog.ldif
配置 memberof
add_memberof_mod.ldif
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: memberof.la
ldapadd -Y EXTERNAL -H ldapi:/// -f add_memberof_mod.ldif
conf_memberof.ldif
dn: olcOverlay=memberof,olcDatabase={2}hdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf
ldapadd -Y EXTERNAL -H ldapi:/// -f conf_memberof.ldif
配置 refint
add_refint_mod.ldif
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: refint.la
ldapadd -Y EXTERNAL -Q -H ldapi:/// -f add_refint_mod.ldif
refint_overlay.ldif
dn: olcOverlay=refint,olcDatabase={2}hdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: refint
olcRefintAttribute: memberof member manager owner
ldapadd -Y EXTERNAL -Q -H ldapi:/// -f refint_overlay.ldif
修改 rootdn
rootdn.ldif
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=admin,dc=example,dc=com
-
replace: olcSuffix
olcSuffix: dc=example,dc=com
-
replace: olcRootPW
olcRootPW: {MD5}pmq7VoTEWWLYh1ZPCDRujQ==
ldapmodify -Y EXTERNAL -H ldapi:/// -f rootdn.ldif
添加组织 (公司)
add_company.ldif
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: xxx公司
dc: example
ldapadd -H ldapi:/// -D "cn=admin,dc=example,dc=com" -w passwd -f add_company.ldif
配置密码策略
add_ppolicy_mod.ldif
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: ppolicy.la
ldapadd -Y EXTERNAL -H ldapi:/// -f add_ppolicy_mod.ldif
ppolicy_overlay.ldif
dn: olcOverlay=ppolicy,olcDatabase={2}hdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcOverlay: ppolicy
olcPPolicyDefault: cn=default,ou=policies,dc=example,dc=com
olcPPolicyHashCleartext: FALSE
ldapadd -Y EXTERNAL -H ldapi:/// -f ppolicy_overlay.ldif
add_passwd_policies.ldif
dn: ou=policies,dc=example,dc=com
objectClass: organizationalUnit
objectClass: top
ou: policies
dn: cn=default,ou=policies,dc=example,dc=com
cn: default
objectClass: top
objectClass: device
objectClass: pwdPolicy
pwdAttribute: userPassword
pwdLockout: TRUE
pwdMaxFailure: 10
pwdLockoutDuration: 600
ldapadd -H ldapi:/// -D "cn=admin,dc=example,dc=com" -w admin123456 -f add_passwd_policies.ldif
添加用户和组
add user
dn: uid=xxxxx,dc=example,dc=com
changetype: add
uid: xxxxx
userPassword: {MD5}pmq7VoTEWWLYh1ZPCDRujQ==
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: xxx
cn: xxx
displayName: 中文名
mail: [email protected]
departmentNumber: 3.1.1
mobile: xxxx
ldapadd -H ldapi:/// -D "cn=admin,dc=example,dc=com" -w admin123456 -f user_xxxxxx.ldif
group
group_employee.ldif
dn: ou=employee,dc=example,dc=com
objectClass: groupOfNames
cn: employee
member: uid=xxxx,dc=example,dc=com
ldapadd -H ldapi:/// -D "cn=admin,dc=example,dc=com" -w admin123456 -f group_employee.ldif
add_mem_group.ldif
dn: ou=employee,dc=example,dc=com
changetype: modify
add: member
member: uid=xxxxx,dc=example,dc=com
ldapmodify -H ldapi:/// -D "cn=admin,dc=example,dc=com" -w admin123456 -f group_employee_add.ldif
开启 ssl 支持
enable_ssl.ldif
dn: cn=config
changetype: modify
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/openldap/ssl/ca.crt
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/ssl/client.crt
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/ssl/client.key
-
add: olcTLSVerifyClient
olcTLSVerifyClient: never
ldapmodify -Y EXTERNAL -H ldapi:/// -D "cn=admin,dc=example,dc=com" -w admin123456 -f enable_ssl.ldif
vim /etc/sysconfig/slapd
SLAPD_URLS="ldapi:/// ldap:/// ldaps:///"
systemctl restart slapd
echo "TLS_REQCERT allow" >> /etc/openldap/ldap.conf
echo "tls_reqcert allow" >> /etc/nslcd.conf
authconfig --enableldaptls --update
参考资料：
https://www.cnblogs.com/woshimrf/p/ldap.html
https://ldapwiki.com/wiki/LDAP