128.OpenLDA安装并配置客户端-1

2022-10-10 本文已影响0人大勇任卷舒

128.1 安装及配置

安装环境及版本
- Redhat版本为7.3
- OpenLDAP版本为2.4.44
在集群中选择一台服务器(ip-xxx-xx-xx-xxx.ap-southeast-1.compute.internal)作为OpenLDAP的Server
- 安装OpenLDAP服务

[root@i-xxx-xx-xx-xxx ~]# yum -y install openldap openldap-clients openldap-servers migrationtools openldap-devel nss- pam-ldapd bind-dyndb-ldap compat-openldap perl-LDAP krb5-server-ldap php-ldap openssl

查看RPM包

[root@ip-xxx-xx-xx-xxx ~]# rpm -qa |grep openldap

openssl生成TLS加密文件

[root@ip-xxx-xx-xx-xxx certs]# openssl genrsa -out ldap.key 1024

生成签名文件

[root@ip-xxx-xx-xx-xxx certs]# openssl req -new -key ldap.key -out ldap.csr

生成公钥文件

[root@ip-xxx-xx-xx-xxx certs]# openssl x509 -req -days 3653 -in ldap.csr -signkey ldap.key -out ldap.crt

拷贝至/etc/openldap/certs目录

[root@ip-xxx-xx-xx-xxx  certs]# scp ldap.crt ldap.key /etc/openldap/certs/
[root@ip-xxx-xx-xx-xxx  certs]# ll /etc/openldap/certs/

OpenLDAP的slapd.ldif配置文件修改
slapd.ldif文件拷贝至/root目录

[root@ip-xxx-xx-xx-xxx openldap-servers]# cp slapd.ldif /root/
[root@ip-xxx-xx-xx-xxx openldap-servers]# cd /root/
[root@ip-xxx-xx-xx-xxx ~]# vim slapd.ldif

slapd.ldif文件修改

# 增加include的文件及配置管理员账号和OpenLDAP的根域信息，配置文件中需要注意的TLS Settings配置，如果不启用则可以将相关的配置注释，配置文件中多处配置dc=fayson,dc=com，由于OpenLDAP的域为fayson.com，如果LDAP的域为ldap.fayson.com则配置为dc=ldap,dc=fayson,dc=com，根据自己LDAP的域名进行相应的修改
# See slapd-config(5) for details on configuration options.
# This file should NOT be world readable.
#
dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/openldap/slapd.args
olcPidFile: /var/run/openldap/slapd.pid
#
# TLS settings
#
olcTLSCACertificatePath: /etc/openldap/certs
olcTLSCertificateFile: /etc/openldap/certs/ldap.crt
olcTLSCertificateKeyFile: /etc/openldap/certs/ldap.key
#
# Schema settings
#
dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema
include: file:///etc/openldap/schema/corba.ldif
include: file:///etc/openldap/schema/core.ldif
include: file:///etc/openldap/schema/cosine.ldif
include: file:///etc/openldap/schema/duaconf.ldif
include: file:///etc/openldap/schema/dyngroup.ldif
include: file:///etc/openldap/schema/inetorgperson.ldif
include: file:///etc/openldap/schema/java.ldif
include: file:///etc/openldap/schema/misc.ldif
include: file:///etc/openldap/schema/nis.ldif
include: file:///etc/openldap/schema/openldap.ldif
include: file:///etc/openldap/schema/ppolicy.ldif
include: file:///etc/openldap/schema/collective.ldif
#
# Frontend settings
#
dn: olcDatabase=frontend,cn=config
objectClass: olcDatabaseConfig
objectClass: olcFrontendConfig
olcDatabase: frontend
#
# Configuration database
#
dn: olcDatabase=config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: config
olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none
#
# Server status monitoring
#
dn: olcDatabase=monitor,cn=config
objectClass: olcDatabaseConfig
olcDatabase: monitor
olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=fayson,dc=com" read by * none
#
# Backend database definitions
#
dn: olcDatabase=hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: hdb
olcSuffix: dc=fayson,dc=com
olcRootDN: cn=Manager,dc=fayson,dc=com
olcRootPW: 123456
olcDbDirectory: /var/lib/ldap
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
olcDbIndex: uidNumber,gidNumber,loginShell eq,pres
olcDbIndex: uid,memberUid eq,pres,sub
olcDbIndex: nisMapName,nisMapEntry eq,pres,sub

重新生成OpenLDAP的配置

[root@ip-xxx-xx-xx-xxx ~]# rm -rf /etc/openldap/slapd.d/*
[root@ip-xxx-xx-xx-xxx ~]# slapadd -F /etc/openldap/slapd.d -n 0 -l /root/slapd.ldif

测试配置文件是否正确

[root@ip-xxx-xx-xx-xxx ~]# slaptest -u -F /etc/openldap/slapd.d

文件属主修改

[root@ip-xxx-xx-xx-xxx ~]# chown -R ldap. /etc/openldap/slapd.d/
[root@ip-xxx-xx-xx-xxx ~]# ll /etc/openldap/slapd.d/

数据库安装

[root@ip-xxx-xx-xx-xxx ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@ip-xxx-xx-xx-xxx ~]# ll /var/lib/ldap/

数据库文件属主修改

[root@ip-xxx-xx-xx-xxx ~]# chown -R ldap. /var/lib/ldap/
[root@ip-xxx-xx-xx-xxx ~]# ll /var/lib/ldap/

slapd服务添加到系统自启动服务并启动slapd服务

[root@ip-xxx-xx-xx-xxx ~]# systemctl enable slapd
[root@ip-xxx-xx-xx-xxx ~]# systemctl start slapd
[root@ip-xxx-xx-xx-xxx ~]# systemctl status slapd

128.OpenLDA安装并配置客户端-1

128.1 安装及配置

猜你喜欢

热点阅读