zoukankan      html  css  js  c++  java

  • OpenLDAP测试搭建

    目录

    ldap介绍

    OpenLDAP is an open-source implementation of Lightweight Directory Access Protocol developed by OpenLDAP project. LDAP is an Internet protocol that email and other programs use to look up contact information from a server. It is released under OpenLDAP public license; it is available for all major Linux distributions, AIX, Android, HP-UX, OS X, Solaris, Windows and z/OS.

    It functions like a relational database in certain ways and can be used to store any information. LDAP is not limited to store the information; it is also used as a backend database for “single sign-on” where one password for a user is shared between many services.

    In this tutorial, we will configure OpenLDAP for centralized login where the users use the single account to log in on multiple servers.

    测试环境

    主机名 IP 操作系统 角色
    elk02.lavenliu.com 192.168.6.35 CentOS 7 64位 LDAP server
    elk03.lavenliu.com 192.168.6.36 CentOS 7 64位 LDAP client

    两台机器的/etc/hosts文件要能够解析对方：

    [root@elk02 ~]# cat /etc/hosts
127.0.0.1  localhost localhost.localdomain localhost4 localhost4.localdomain4
::1        localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.6.46 ansibile.lavenliu.com ansible

192.168.6.25  elk01.lavenliu.com elk01
192.168.6.35  elk02.lavenliu.com elk02
192.168.6.36  elk03.lavenliu.com elk03
192.168.6.165 elk04.lavenliu.com elk04

[root@elk03 ~]# cat /etc/hosts
127.0.0.1  localhost localhost.localdomain localhost4 localhost4.localdomain4
::1        localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.6.46 ansibile.lavenliu.com ansible

192.168.6.25  elk01.lavenliu.com elk01
192.168.6.35  elk02.lavenliu.com elk02
192.168.6.36  elk03.lavenliu.com elk03
192.168.6.165 elk04.lavenliu.com elk04

    如果我们想使用域名而非IP地址的话，那么我们就要配置DNS服务了。本文将在配置文件中使用IP地址。

    安装LDAP服务端

    在服务端安装如下软件包：

    yum -y install openldap compat-openldap openldap-clients 
openldap-servers openldap-servers-sql openldap-devel

    安装完毕，启动LDAP服务并加入开机自启动：

    [root@elk02 ~]# systemctl start slapd.service
[root@elk02 ~]# systemctl enable slapd.service

    验证服务是否启动成功：

    [root@elk02 ~]# netstat -antup |grep 389
tcp        0      0 0.0.0.0:389            0.0.0.0:*              LISTEN      2984/slapd          
tcp6      0      0 :::389                  :::*                    LISTEN      2984/slapd

    设置LDAP的root密码

    Run below command to create an LDAP root password; we will use this root password throughout this article. So make a note of this and keep it aside.

    [root@elk02 ~]# slappasswd 
New password: 123456
Re-enter new password: 123456
{SSHA}gf3vwkGq/ykoX4qhFVuGTa3PgpzAXQsc

    配置LDAP服务端

    OpenLDAP servers configuration files are found in /etc/openldap/slapd.d/. To start with the configuration of LDAP, we would need to update the variables “olcSuffix” and “olcRootDN“.

    • olcSuffix: Database Suffix, it is the domain name for which the LDAP server provides the information. In simple words, it should be changed to your domain
      name.
    • olcRootDN: Root Distinguished Name (DN) entry for the user who has the unrestricted access to perform all administration activities on LDAP, like a root user.
    • olcRootPW: Password for the above RootDN.

    Above entries are to be updated in /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif file. Manually edit of LDAP configuration is not recommended as you will lose changes whenever you run ldapmodify command.

    [root@elk02 ~]# cd /etc/openldap/slapd.d/cn=config
[root@elk02 cn=config]# vim db.ldif
[root@elk02 cn=config]# cat  >> db.ldif <<EOF 
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=lavenliu,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=ldapadm,dc=lavenliu,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: {SSHA}gf3vwkGq/ykoX4qhFVuGTa3PgpzAXQsc
EOF

[root@elk02 cn=config]# ldapmodify -Y EXTERNAL -H ldapi:/// -f db.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={2}hdb,cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

    Make a changes to /etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif (Do not edit manually) file to restrict the monitor access only to ldap root (ldapadm) user not to others.

    # vi monitor.ldif

cat >> monitor.ldif <<EOF
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external, cn=auth" read by dn.base="cn=ldapadm,dc=itzgeek,dc=local" read by * none
EOF

    Once you have updated the file, send the configuration to the LDAP server.

    [root@elk02 cn=config]# ldapmodify -Y EXTERNAL -H ldapi:/// -f monitor.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={1}monitor,cn=config"

    创建LDAP证书

    Let’s create a self-signed certificate for our LDAP server, below command generates both certificate and private key in /etc/openldap/certs/ directory.

    [root@elk02 cn=config]# openssl req -new -x509 -nodes -out /etc/openldap/certs/lavenliuldapcert.pem -keyout /etc/openldap/certs/lavenliuldapkey.pem -days 365
Generating a 2048 bit RSA private key
......................................+++
..........................................................................................+++
writing new private key to '/etc/openldap/certs/lavenliuldapkey.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Shanghai
Locality Name (eg, city) [Default City]:Shanghai
Organization Name (eg, company) [Default Company Ltd]:LavenLiu
Organizational Unit Name (eg, section) []:IT Dept  
Common Name (eg, your name or your server's hostname) []:elk02.lavenliu.com
Email Address []:admin@lavenliu.com

    Set the owner and group permissions to ldap.

    [root@elk02 cn=config]# chown -R ldap:ldap /etc/openldap/certs/*.pem

    Verify the created LDAP certificate under /etc/openldap/certs/.

    [root@elk02 cn=config]# ll /etc/openldap/certs/*.pem
-rw-r--r-- 1 ldap ldap 1456 Sep 11 15:12 /etc/openldap/certs/lavenliuldapcert.pem
-rw-r--r-- 1 ldap ldap 1704 Sep 11 15:12 /etc/openldap/certs/lavenliuldapkey.pem

    Create certs.ldif file to configure LDAP to use secure communication using a self-signed certificate.

    # vi certs.ldif
cat >> certs.ldif <<EOF
dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/lavenliuldapcert.pem

dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/lavenliuldapkey.pem
EOF

    Import the configurations to LDAP server.

    [root@elk02 cn=config]# ldapmodify -Y EXTERNAL  -H ldapi:/// -f certs.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"

modifying entry "cn=config"

    Verify the configuration:

    [root@elk02 cn=config]# slaptest -u
59b638fb UNKNOWN attributeDescription "CHANGETYPE" inserted.
59b638fb UNKNOWN attributeDescription "REPLACE" inserted.
59b638fb is_entry_objectclass("cn=config,cn=config", "2.16.840.1.113730.3.2.6") no objectClass attribute
59b638fb is_entry_objectclass("olcDatabase={2}hdb,cn=config,cn=config", "2.16.840.1.113730.3.2.6") no objectClass attribute
59b638fb is_entry_objectclass("olcDatabase={1}monitor,cn=config,cn=config", "2.16.840.1.113730.3.2.6") no objectClass attribute
config file testing succeeded # 主要看这个提示

    You should get the following message confirms the verification is complete.

    config file testing succeeded

    设置LDAP数据库

    Copy the sample database configuration file to /var/lib/ldap and update the file permissions.

    [root@elk02 cn=config]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@elk02 cn=config]# chown ldap:ldap /var/lib/ldap/*

    Add the cosine and nis LDAP schemas.

    [root@elk02 cn=config]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=cosine,cn=schema,cn=config"

[root@elk02 cn=config]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=nis,cn=schema,cn=config"

[root@elk02 cn=config]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=inetorgperson,cn=schema,cn=config"

    Generate base.ldif file for your domain.

    # vi base.ldif
cat >> base.ldif <<EOF
dn: dc=lavenliu,dc=com
dc: lavenliu
objectClass: top
objectClass: domain

dn: cn=ldapadm ,dc=lavenliu,dc=com
objectClass: organizationalRole
cn: ldapadm
description: LDAP Manager

dn: ou=People,dc=lavenliu,dc=com
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=lavenliu,dc=com
objectClass: organizationalUnit
ou: Group
EOF

    Build the directory structure.

    [root@elk02 cn=config]# ldapadd -x -W -D "cn=ldapadm,dc=lavenliu,dc=com" -f base.ldif
Enter LDAP Password: 123456
adding new entry "dc=lavenliu,dc=com"

adding new entry "cn=ldapadm ,dc=lavenliu,dc=com"

adding new entry "ou=People,dc=lavenliu,dc=com"

adding new entry "ou=Group,dc=lavenliu,dc=com"

    ldapadd command will prompt you for the password of ldapadm (LDAP root user).输出：

    Enter LDAP Password:
adding new entry "dc=lavenliu,dc=com"

adding new entry "cn=ldapadm ,dc=lavenliu,dc=com"

adding new entry "ou=People,dc=lavenliu,dc=com"

adding new entry "ou=Group,dc=lavenliu,dc=com"

    创建LDAP用户

    Let’s create an LDIF file for a new user called taoqi.

    cat >> taoqi.ldif <<EOF
dn: uid=taoqi,ou=People,dc=lavenliu,dc=com
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: taoqi
uid: taoqi
uidNumber: 9999
gidNumber: 100
homeDirectory: /home/taoqi
loginShell: /bin/bash
gecos: Taoqi [Admin (at) LavenLiu]
userPassword: {SSHA}WEjZ/aebhtGztTrHsjhg4Hrtp1bk5FzL
shadowLastChange: 17058
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
EOF

    Use the ldapadd command with the above file to create a new user called “taoqi” in OpenLDAP directory.

    [root@elk02 cn=config]# ldapadd -x -W -D "cn=ldapadm,dc=lavenliu,dc=com" -f taoqi.ldif
Enter LDAP Password: 123456
adding new entry "uid=taoqi,ou=People,dc=lavenliu,dc=com"

    Assign a password to the user.

    [root@elk02 cn=config]# ldappasswd -s password123 -W -D "cn=ldapadm,dc=lavenliu,dc=com" -x "uid=taoqi,ou=People,dc=lavenliu,dc=com"
Enter LDAP Password:123456

    选项的含义：

    • -s specify the password for the username
    • -x username for which the password is changed
    • -D Distinguished name to authenticate to the LDAP server.

    Verify LDAP entries.

    [root@elk02 cn=config]# ldapsearch -x cn=taoqi -b dc=lavenliu,dc=com
# extended LDIF
#
# LDAPv3
# base <dc=lavenliu,dc=com> with scope subtree
# filter: cn=taoqi
# requesting: ALL
#

# taoqi, People, lavenliu.com
dn: uid=taoqi,ou=People,dc=lavenliu,dc=com
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: taoqi
uid: taoqi
uidNumber: 9999
gidNumber: 100
homeDirectory: /home/taoqi
loginShell: /bin/bash
gecos: Raj [Admin (at) LavenLiu]
shadowLastChange: 17058
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
userPassword:: e1NTSEF9VWdRK25qTEtOWEk3YUNrclMyUkVZS3F4VTRpR1FDeWc=

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

    To delete an entry from LDAP (Optional).

    ldapdelete -W -D "cn=ldapadm,dc=lavenliu,dc=com" "uid=taoqi,ou=People,dc=lavenliu,dc=com"

    添加防火墙规则

    Add the LDAP service to the firewall (tcp 389).

    firewall-cmd --permanent --add-service=ldap
firewall-cmd --reload

    开启LDAP日志

    Configure Rsyslog to log a LDAP events to log file /var/log/ldap.log.

    vi /etc/rsyslog.conf
# Add below line to /etc/rsyslog.conf file.
echo "local4.* /var/log/ldap.log" >> /etc/rsyslog.conf

    Restart the rsyslog service.

    systemctl restart rsyslog

    配置LDAP客户端

    Install the necessary LDAP client packages on the client machine.

    [root@elk03 ~]# yum install -y openldap-clients nss-pam-ldapd

    Execute the below command to add the client machine to LDAP server for single sign on. Replace “192.168.6.35” with your LDAP server’s IP address or hostname.

    [root@elk03 ~]# authconfig --enableldap --enableldapauth --ldapserver=192.168.6.35 --ldapbasedn="dc=lavenliu,dc=com" --enablemkhomedir --update
getsebool:  SELinux is disabled
[root@elk03 ~]# echo $?
0

    Restart the LDAP client service.

    [root@elk03 ~]# systemctl restart  nslcd

    验证LDAP登录

    Use getent command to get the LDAP entries from the LDAP server.

    [root@elk03 ~]# getent passwd taoqi
taoqi:x:9999:100:Taoqi [Admin (at) LavenLiu]:/home/taoqi:/bin/bash
[root@elk03 ~]# id taoqi
uid=9999(taoqi) gid=100(users) groups=100(users)
[root@elk03 ~]# su - taoqi
Creating directory '/home/taoqi'.
[taoqi@elk03 ~]$ pwd
/home/taoqi

    本文来自博客园，作者：武兴旺，转载请注明原文链接：https://www.cnblogs.com/wuxingwang/p/12125360.html
  • 相关阅读:
    TRIGGERS_监测系统_多表视图触发器—向原始数据报表中插入数据
    PROCEDURE_监测系统_原始数据报表数据生成存储过程—求每天平均值插入多表视图
    PROCEDURE_监测系统_数据备份存储过程—备份原始数据，每十分钟一条，取平均值
    TRIGGERS_监测系统_原始数据表触发器—调用告警信息存储过程
    PROCEDURE_监测系统_告警信息存储过程—产生告警信息插入告警表
    秒(s) 毫秒(ms) 微秒(μs) 纳秒(ns) 皮秒(ps)及Java获得 .
    new String(byte[])和byte[]toString() 的区别
    Java 线程池 .
    加载配置文件的方式
    Spring的PropertyPlaceholderConfigurer应用
  • 原文地址：https://www.cnblogs.com/wuxingwang/p/12125360.html
Copyright © 2011-2022 走看看