一、环境准备
关闭 selinux firewalld
setenforce 0
systemctl stop firewalld.service
systemctl disable firewalld.service
二、OPENLDAP服务搭建
1、安装LDAP服务器和客户端,migrationtools工具包
yum install -y openldap-servers openldap-clients migrationtools
2、设置openldap管理员密码
slappasswd
然后根据提示输入密码:
New password: 123456
Re-enter new password: 123456
会返回加密的密码字符串,保存好这个字符串
{SSHA}f13zZnx/b4LQ/ErM+Rf9VSVEJqIE7yHM
3、更改openldap配置
查看安装了哪些文件(如果熟悉目录结构可以略过)
rpm -ql openldap
rpm -ql openldap-servers
修改配置
vim /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif
找到olcSuffix,修改为你的dc,如:
dc=mypaas,dc=com
下一行olcRootDN, 修改为你的用户名,如:
cn=Manager,dc=mypaas,dc=com
在文件末尾添加一行,设置刚才的密码:
olcRootPW: {SSHA}f13zZnx/b4LQ/ErM+Rf9VSVEJqIE7yHM
4、更改监控认证配置
vim /etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif
修改 olcAccess 中的dn.base=”cn=xxxxxxx”这行为刚才设置的用户名,如:
dn.base=”cn=Manager,dc=mypaas,dc=com”
5、设置DB Cache
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown -R ldap:ldap /var/lib/ldap/
6、测试配置文件
slaptest -u
末尾出现configfile testing successed 说明成功了
7、启动OpenLDAP和开机启动
systemctl start slapd.service
systemctl enable slapd.service
8、导入模板
ls /etc/openldap/schema/*.ldif | xargs -I {} sudo ldapadd -Y EXTERNAL -H ldapi:/// -f {}
三、安装Web管理服务
1、 安装httpd服务器
yum install httpd -y
2、修改配置文件httpd.conf
vim /etc/httpd/conf/httpd.conf
找到AllowOverride一行,修改none为all
如果想修改端口号,修改Listen 80一行
3、启动服务,测试页面
systemctl start httpd.service
systemctl enable httpd.service
curl http://127.0.0.1/
4、安装phpldapadmin
yum install phpldapadmin
(如果找不到软件包,重新设置一下yum源)
yum localinstall http://rpms.famillecollet.com/enterprise/remi-release-7.rpm
5、修改配置文件
vim /etc/phpldapadmin/config.php
找到并取消下面几行的注释:
$servers->setValue(‘server’,’host’,’127.0.0.1’);
$servers->setValue(‘server’,’port’,389);
$servers->setValue(‘server’,’base’,array(‘dc=mypaas,dc=com’));
(array里加上openldap配置文件中设置的olcSuffix)
$servers->setValue(‘login’,’auth_type’,’session’);
$servers->setValue(‘login’,’attr’,’dn’);
把它的下一行注释掉
#$servers->setValue(‘login’,’attr’,’uid’);
6、修改访问配置文件,允许任意ip访问
vim /etc/httpd/conf.d/phpldapadmin.conf
取消Order Deny,Allow的注释
7、创建基础目录
在/etc/openldap目录下添加base.ldif文件
cd /etc/openldap/
vim base.ldif
在文件中添加以下内容
dn: dc=mypaas,dc=com
o: ldap
objectclass: dcObject
objectclass: organization
dc: mypaas
(dc 修改为你自己的内容)
8、重启httpd服务
systemctl restart httpd.service
9、访问web管理端
访问 http://ip/phpldapadmin
登陆用户名:cn=Manager,dc=mypaas,dc=com
四、常见问题
1.yum install phpldapadmin
(如果找不到软件包,重新设置一下yum源)
yum localinstall http://rpms.famillecollet.com/enterprise/remi-release-7.rpm
报一下错误
One of the configured repositories failed (Unknown),
and yum doesn't have enough cached data to continue. At this point the only
safe thing yum can do is fail. There are a few ways to work "fix" this:
1. Contact the upstream for the repository and get them to fix the problem.
2. Reconfigure the baseurl/etc. for the repository, to point to a working
upstream. This is most often useful if you are using a newer
distribution release than is supported by the repository (and the
packages for the previous distribution release still work).
3. Disable the repository, so yum won't use it by default. Yum will then
just ignore the repository until you permanently enable it again or use
--enablerepo for temporary usage:
yum-config-manager --disable <repoid>
4. Configure the failing repository to be skipped, if it is unavailable.
Note that yum will try to contact the repo. when it runs most commands,
so will have to try and fail each time (and thus. yum will be be much
slower). If it is a very temporary problem though, this is often a nice
compromise:
yum-config-manager --save --setopt=<repoid>.skip_if_unavailable=true
Cannot retrieve metalink for repository: epel/x86_64. Please verify its path and try again
解决方法:
1.cd /etc/sysconfig/network-scripts
2、修改ifcfg-ens33的网卡配置文件(不同版本有可能名称不一样)
3、将 “ONBOOT” 的值修改为 “yes” ,之后按esc退出编辑模式,输入 “:wq” 保存退出
4、输入命令 “vi /etc/resolv.conf”
5、添加 “nameserver 114.114.114.114”
6.保存后,重启系统或者重启网卡,输入命令 “reboot” 或 “service network restart”。
7、进入 “/etc/yum.repos.d” 。
8、编辑 “vi CentOS-Base.repo” 。
9、将所有的 “mirrorlist” 注释掉,将所有的 “baseurl” 取消注释。
10.保存后,重启系统,输入命令 “reboot” 。
或者
1、cd /etc/yum.repos.d/epel.repo;
2、注释掉mirrorlist,取消注释baseurl;
3、再次使用yum命令即正常!
yum clean all
yum makecache
yum update
yum install -y lsof
2.Forbidden You don’t have permission to access / on this server.
解决方法:vim /etc/httpd/conf.d/phpldapadmin.conf