open LDAP for Linux 安装过程

需要下载：Berkeley DB from Sleepycat Software
地址为：http://www.sleepycat.com/update/snapshot/db-4.2.52.tar.gz
openldap from openldap.org
地址为： openldap依赖于Berkeley DB作为LDBM(LDAP database management),Berkeley DB是一个关系型数据库。
将db-4.2.52.tar.gz和openldap-2.2.4.tgz上传到linux服务器
tar -zxvf db-4.2.52.tar.gz
tar -zxvf openldap-2.2.4.tgz
-z开关符表示使用ungzip来解压
解压后得到db-4.2.52和openldap-2.2.4两个目录
需要先安装Berkeley DB 注意不能在db-4.2.52目录下编译
db-4.2.52/dist/configure --prefix=/usr/local/BerkeleyDB.4.2
make
make install
Berkeley DB将被安装在/usr/local/BerkeleyDB.4.2目录下，由--prefix来指定
make realcelan 来清除生成的文件 现在来安装openldap
env CPPFLAGS=-I/usr/local/BerkeleyDB.4.2/include LDFLAGS=-L/usr/local/BerkeleyDB.4.2/lib ./configure --prefix=/usr/local
make depend
make test //测试openldap是否可以正常工作
make install 执行文件将被安装在/usr/local/libexec
工具将被安装在/usr/local/sbin
配置文件在/usr/local/etc/openldap 下面进行配置工作
修改/usr/local/etc/openldap/slapd.conf
我的配置文件如下：
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include   /usr/local/etc/openldap/schema/core.schema
include   /usr/local/etc/openldap/schema/cosine.schema
include   /usr/local/etc/openldap/schema/inetorgperson.schema
# Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral pidfile   /usr/local/var/run/slapd.pid
argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules:
# modulepath /usr/local/libexec/openldap
# moduleload back_bdb.la
# moduleload back_ldap.la
# moduleload back_ldbm.la
# moduleload back_passwd.la
# moduleload back_shell.la # Sample security restrictions
# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy:
# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:
#   Allow self write access
#   Allow authenticated users read access
#   Allow anonymous users to authenticate
# Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
# by self write
# by users read
# by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING! #######################################################################
# ldbm database definitions
####################################################################### database bdb
suffix      "dc=shjava,dc=mdcl.com.cn"
rootdn   "cn=Manager,dc=shjava,dc=mdcl.com.cn"
# Cleartext passwords, especially for the rootdn, should
# be avoid. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw   secret
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /usr/local/var/openldap-data
# Indices to maintain
index objectClass eq 可以根据自己的需要include /usr/local/etc/openldap/schema/目录下的的schema
修改suffix和rootdn
修改rootpw可以使用ldappasswd工具生成加密后的rootdn口令 执行/usr/local/libexec/slapd 启动openldap服务 使用ps -ef|grep slapd来查看是否有slapd的进程
使用netstat -na|grep 389来查看389端口是否监听
可以使用tcpdump port 389来监听389端口的输入输出 由于red linux的版本中防火墙设置389端口对外关闭
可以调整防火墙的设置打开，或者改成无防火墙
否则只能通过本地访问ldap 补充： 修改/etc/ld.so.conf 加上 /usr/local/BerkeleyDB.4.2/lib
/usr/local/lib