Centos7 安装配置OpenLdap服务及OpenLdap管理工具

admin · 发表于 2017-5-24 17:50:59

配置好yum源，不细说；使用yum源安装：
            # yum install -y openldap openldap-servers openldap-clients migrationtools

   首先要设置openldap的管理员密码：
需要注意的是:一定要记住及拷贝出执行的后的加密的密码信息。
配置密码吧：
      # slappasswd
New password: 123456
Re-enter new password:
{SSHA}rvkUUrhb+8sbC1TtFPSBZ9AjrHijM3DD

切换目录
# cd /etc/openldap/slapd.d/cn\=config/
# vim olcDatabase\=\{2\}hdb.ldif
增加一行
olcRootPW: {SSHA}rvkUUrhb+8sbC1TtFPSBZ9AjrHijM3DD
修改域信息
olcSuffix: dc=my-domain,dc=com
olcRootDN: cn=Manager,dc=my-domain,dc=com

# vim olcDatabase\=\{1\}monitor.ldif
修改域信息

admin · 发表于 2017-5-24 18:12:53

# slaptest -u
59255c20 ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif"
config file testing succeeded
报这个错误，很郁闷。

admin · 发表于 2017-5-24 18:25:56

Step 2: Configure OpenLDAP Server:
[root@HBC-CtrlCenter ~]# vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}hdb.ldif
change two lines: #change  dc=yooma
olcSuffix: dc=yooma,dc=com
olcRootDN: cn=root,dc=yooma,dc=com
add one line:
olcRootPW: 123456 #密码根据自己需要修改
:wq!
Step 3: Configure Monitoring Database Configuration file:
[root@HBC-CtrlCenter ~]# vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}monitor.ldif
#修改dn.base=""中的cn、dc项与step2中的相同
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
al,cn=auth" read by dn.base="cn=root,dc=yooma,dc=com" read by * none
:wq!
Step 4: Prepare the LDAP database:
[root@HBC-CtrlCenter ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@HBC-CtrlCenter ~]# chown -R ldap.ldap /var/lib/ldap
Step 5: Test the configuration:

[root@HBC-CtrlCenter ~]# slaptest -u
56e7c83d ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif"
56e7c83d ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif"
config file testing succeeded  #验证成功
Step 6: Start and enable the slapd service at boot:
[root@HBC-CtrlCenter ~]# systemctl start slapd
[root@HBC-CtrlCenter ~]# systemctl enable slapd
Step 7: Check the LDAP activity:

[root@HBC-CtrlCenter ~]# netstat -lt | grep ldap
tcp 0 0 0.0.0.0:ldap 0.0.0.0:* LISTEN
tcp6 0 0 [::]:ldap [::]:* LISTEN
[root@HBC-CtrlCenter ~]# netstat -tunlp | egrep "389|636"
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 18814/slapd
tcp6 0 0 :::389 :::* LISTEN 18814/slapd
Step 8: To start the configuration of the LDAP server, add the follwing LDAP schemas:
[root@HBC-CtrlCenter ~]# cd /etc/openldap/schema/
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f cosine.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f nis.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f collective.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f corba.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f core.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f duaconf.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f dyngroup.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f inetorgperson.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f java.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f misc.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f openldap.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f pmi.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f ppolicy.ldif
##################################################
# NOTE-: You can add schema files according to your need: #
##################################################
Step 9: Now use Migration Tools to create LDAP DIT:
[root@HBC-CtrlCenter ~]# cd /usr/share/migrationtools/
[root@HBC-CtrlCenter migrationtools]# vim migrate_common.ph
on the Line Number 61, change "ou=Groups"
$NAMINGCONTEXT{'group'} = "ou=Groups";
on the Line Number 71, change your domain name
$DEFAULT_MAIL_DOMAIN = "yooma.com";
on the line number 74, change your base name
$DEFAULT_BASE = "dc=yooma,dc=com";
on the line number 90, change schema value
$EXTENDED_SCHEMA = 1;
:wq!
Step 10: Generate a base.ldif file for your Domain DIT:
[root@HBC-CtrlCenter migrationtools]# ./migrate_base.pl /root/base.ldif
Step 11: Load "base.ldif" into LDAP Database:
[root@HBC-CtrlCenter migrationtools]# ldapadd -x -W -D "cn=root,dc=yooma,dc=com" -f /root/base.ldif
Step 12: Now Create some users and Groups and migrate it from local database to LDAP database:
#mkdir /home/guests
#useradd -d /home/guests/ldapuser1 ldapuser1
#useradd -d /home/guests/ldapuser2 ldapuser2
#echo 'password' | passwd --stdin ldapuser1
#echo 'password' | passwd --stdin ldapuser2
Step 13: Now filter out these Users and Groups and it password from /etc/shadow to different file:
#getent passwd | tail -n 5 > /root/users
#getent shadow | tail -n 5 > /root/shadow
# getent group | tail -n 5 > /root/groups
Step 14: Now you need to create ldif file for these users using migrationtools:
[root@HBC-CtrlCenter ~]# cd /usr/share/migrationtools
[root@HBC-CtrlCenter migrationtools]# vim migrate_passwd.pl
#search /etc/shadow and replace it into /root/shadow on Line Number 188.
:wq!
[root@HBC-CtrlCenter migrationtools]# ./migrate_passwd.pl /root/users > users.ldif
[root@HBC-CtrlCenter migrationtools]# ./migrate_group.pl /root/groups > groups.ldif
Step 15: Upload these users and groups ldif file into LDAP Database:
[root@HBC-CtrlCenter migrationtools]# ldapadd -x -W -D "cn=root,dc=yooma,dc=com" -f users.ldif
[root@HBC-CtrlCenter migrationtools]# ldapadd -x -W -D "cn=root,dc=yooma,dc=com" -f groups.ldif
Step 16: Now search LDAP DIT for all records:
[root@HBC-CtrlCenter migrationtools]# ldapsearch -x -b "dc=yooma,dc=com" -H ldap://127.0.0.1
三、客户端安装配置调试
[root@HBC-C1-WB-5 ~]# yum install -y nss-pam*
[root@HBC-C1-WB-5 ~]# authconfig-tui #chose the secend [ Use LDAP] and next

click OK.
[root@HBC-C1-WB-5 ~]# su ldapuser1
bash-4.2$    #测试成功

		自动登录	找回密码
密码			注册