CentOS7.4配置OpenLDAP Client集成AD服务及SSSD服务与SSH服务

一、前置准备

1、基础环境说明

客户端操作系统：CentOS 7.4 core

AD服务器：WinServer 2012 R2

2、AD证书导出

1).服务器管理

服务器管理→AD CS→证书颁发机构→所有任务→备份CA

 

 

2).证书备份(导出)

备份项目→设置密码(默认为空)→完成

 

 

 

二、OpenLDAP Client安装及配置

1、安装OpenLDAP Client

集群所有节点添加AD服务器hosts配置，并安装openldap-clients

 

# yum -y install openldap-clients

 

2、配置ldap.conf

1). 修改/etc/openldap/ldap.conf

# vim /etc/openldap/ldap.conf

BASE    dc=bosch,dc=com

URI     ldap://adserver.bosch.com

TLS_CACERTDIR   /etc/openldap/certs

SASL_NOCANON    on

 

2). 验证ldap配置

# ldapsearch -b "ou=Cloudera Users,dc=bosch,dc=com" -D "cn=cloudera-scm/admin,cn=Users,dc=bosch,dc=com"  -W |grep dn

3、配置证书

1).上传CA证书

将导出的证书上传至Linux服务器的/etc/openldap/certs目录并拷贝至/etc/openldap/cacerts/

2).转换CA证书

# cd /etc/openldap/certs

# openssl pkcs12 -in bosch-ADSERVER-CA.p12 -out adserver.pem

密码默认为空

3).创建软连接

# cp adserver.pem /etc/openldap/cacerts/

# cacertdir_rehash /etc/openldap/cacerts/

三、SSSD服务安装及配置

1、安装sssd服务

# yum install -y sssd authconfig nss-pam-ldapd sssd-ad

2、配置sssd服务

# authconfig --enablesssd --enablesssdauth --enablerfc2307bis --enableldap --enableldapauth --disableforcelegacy --enableldaptls --disablekrb5 --ldapserver ldap://adserver.bosch.com --ldapbasedn "dc=bosch,dc=com" --enablemkhomedir --update

# vi /etc/sssd/sssd.conf

[domain/BOSCH.COM]

 

autofs_provider = ldap

ldap_schema = ad

krb5_realm = BOSCH.COM

ldap_search_base = dc=bosch,dc=com

krb5_server = adserver.bosch.com

id_provider = ldap

auth_provider = ldap

chpass_provider = ldap

ldap_uri = ldap://adserver.bosch.com

ldap_id_use_start_tls = True

cache_credentials = True

ldap_tls_cacertdir = /etc/openldap/certs

 

# General

debug_level = 7

enumerate = false

case_sensitive = false

cache_credentials = true

min_id = 100

 

# Providers

full_name_format = %1$s

fallback_homedir = /home/%u

default_shell = /bin/bash

ldap_id_mapping = True

 

# LDAP user search settings

ldap_user_search_base = ou=Cloudera Users,dc=bosch,dc=com

# LDAP group search settings

ldap_group_search_base = ou=Cloudera groups,dc=bosch,dc=com

 

# LDAP Class settings

ldap_user_object_class = user

ldap_user_principal = userPrincipalName

ldap_user_name = sAMAccountName

ldap_user_gecos = displayName

ldap_group_object_class = group

ldap_group_name = sAMAccountName

ldap_user_home_directory = unixHomeDirectory

 

# LDAP connection settings

ldap_uri = ldap://adserver.bosch.com

ldap_default_bind_dn = cn=cloudera-scm/admin,cn=Users,dc=bosch,dc=com

ldap_default_authtok_type = password

ldap_default_authtok = UnionBigData@123.

 

[autofs]

 

[sssd]

config_file_version = 2

services = nss, pam, autofs

domains = default, BOSCH.COM

 

[nss]

#filter_groups = root

#filter_users = root

reconnection_retries = 3

 

[pam]

# systemctl restart sssd

# systemctl status sssd

四、验证SSSD和SSH集成

1、创建用户

在AD域中Cloudera Users组织创建用户

 

 

2、查看用户

在Linux服务器查看相应用户

# cat /etc/passwd|grep whtm

# id whtm

2、测试ssh登录

# ssh whtm@cdh03.domain