zoukankan      html  css  js  c++  java
  • ldap部署

    主要参考https://www.server-world.info/en/note?os=CentOS_7&p=openldap&f=1

    1、安装ldap  server

    [root@dlp ~]# yum -y install openldap-servers openldap-clients
    [root@dlp ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
    [root@dlp ~]# chown ldap. /var/lib/ldap/DB_CONFIG
    [root@dlp ~]# systemctl start slapd
    [root@dlp ~]# systemctl enable slapd

    2、设置ldap admin 的密码

    [root@dlp ~]# slappasswd
    New password:
    Re-enter new password:
    {SSHA}xxxxxxxxxxxxxxxxxxxxxxxx
    [root@dlp ~]# vi chrootpw.ldif
    dn: olcDatabase={0}config,cn=config
    changetype: modify
    add: olcRootPW
    olcRootPW: {SSHA}{SSHA}xxxxxxxxxxxxxxxxxxxxxxxx

    [root@dlp ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif

      SASL/EXTERNAL authentication started
      SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
      SASL SSF: 0
      modifying entry "olcDatabase={0}config,cn=config"

    3、导入基本的 Schemas

    [root@dlp ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
    SASL/EXTERNAL authentication started
    SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
    SASL SSF: 0
    adding new entry "cn=cosine,cn=schema,cn=config"
    
    [root@dlp ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
    SASL/EXTERNAL authentication started
    SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
    SASL SSF: 0
    adding new entry "cn=nis,cn=schema,cn=config"
    
    [root@dlp ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
    SASL/EXTERNAL authentication started
    SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
    SASL SSF: 0
    adding new entry "cn=inetorgperson,cn=schema,cn=config"

    4、设置domain name及密码

    # generate directory manager's password
    [root@dlp ~]# slappasswd
    New password:
    Re-enter new password:
    {SSHA}xxxxxxxxxxxxxxxxxxxxxxxx
    [root@dlp ~]# vi chdomain.ldif
    # replace to your own domain name for "dc=***,dc=***" section
    # specify the password generated above for "olcRootPW" section
    dn: olcDatabase={1}monitor,cn=config
    changetype: modify
    replace: olcAccess
    olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
      read by dn.base="cn=Manager,dc=srv,dc=world" read by * none
    
    dn: olcDatabase={2}hdb,cn=config
    changetype: modify
    replace: olcSuffix
    olcSuffix: dc=srv,dc=world
    
    dn: olcDatabase={2}hdb,cn=config
    changetype: modify
    replace: olcRootDN
    olcRootDN: cn=Manager,dc=srv,dc=world
    
    dn: olcDatabase={2}hdb,cn=config
    changetype: modify
    add: olcRootPW
    olcRootPW: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxx
    
    dn: olcDatabase={2}hdb,cn=config
    changetype: modify
    add: olcAccess
    olcAccess: {0}to attrs=userPassword,shadowLastChange by
      dn="cn=Manager,dc=srv,dc=world" write by anonymous auth by self write by * none
    olcAccess: {1}to dn.base="" by * read
    olcAccess: {2}to * by dn="cn=Manager,dc=srv,dc=world" write by * read
    
    [root@dlp ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif
    SASL/EXTERNAL authentication started
    SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
    SASL SSF: 0
    modifying entry "olcDatabase={1}monitor,cn=config"
    
    modifying entry "olcDatabase={2}hdb,cn=config"
    
    modifying entry "olcDatabase={2}hdb,cn=config"
    
    modifying entry "olcDatabase={2}hdb,cn=config"
    
    [root@dlp ~]# vi basedomain.ldif
    # replace to your own domain name for "dc=***,dc=***" section
    dn: dc=srv,dc=world
    objectClass: top
    objectClass: dcObject
    objectclass: organization
    o: Server World
    dc: Srv
    
    dn: cn=Manager,dc=srv,dc=world
    objectClass: organizationalRole
    cn: Manager
    description: Directory Manager
    
    dn: ou=People,dc=srv,dc=world
    objectClass: organizationalUnit
    ou: People
    
    dn: ou=Group,dc=srv,dc=world
    objectClass: organizationalUnit
    ou: Group
    
    [root@dlp ~]# ldapadd -x -D cn=Manager,dc=srv,dc=world -W -f basedomain.ldif
    Enter LDAP Password:     # directory manager's password
    adding new entry "dc=srv,dc=world"
    
    adding new entry "cn=Manager,dc=srv,dc=world"
    
    adding new entry "ou=People,dc=srv,dc=world"
    
    adding new entry "ou=Group,dc=srv,dc=world"

    5、关闭防火墙

    如何查看呢?见phpldap部署

  • 相关阅读:
    ExtJs005继承
    ExtJs004define定义类
    ExtJS笔记
    解决vscode-pandoc插件生成pdf中文显示问题
    UDP学习笔记(.NET)
    WPF类库不能添加资源词典(xaml)的解决办法
    解决win10下获取操作系统版本为6.2.900(win8)的问题
    [转] Unit Test 访问Internal类型和方法
    VS2017使用小技巧(持续更新。。。)
    [转]Github遇到Permanently added the RSA host key for IP address '192.30.252.128' to the list of known host
  • 原文地址:https://www.cnblogs.com/students/p/13269208.html
Copyright © 2011-2022 走看看