参考文档:
LDAP and Transport Layer Security (TLS) | Ubuntu
https://www.cnblogs.com/yun-xx/p/17961221
踩坑:
最早用的是docker版本openLDAP,没有tls的,结果各种验证不过,看日志隐约感觉是要用tls才行。
于是开始安装openLDAP,中间看了几个编译的版本没成功,最后还是官网的安装一试成功了。
Ubuntu22安装openLDAP:
sudo apt install slapd ldap-utils
配置openLDAP:
sudo dpkg-reconfigure slapd
后续步骤按官网的来,dc=example,dc=com这些名字可以改成自己的,比如xxx。
安装好后开始继续配置TLS,安装按官网文档依葫芦画瓢一路下来
Create the /etc/ssl/ldap01.info
info file containing:
organization = Example Company
cn = ldap01.example.com
tls_www_server
encryption_key
signing_key
expiration_days = 365
这里的cn=ldap01.example.com,记得改成你的(比如xxx.com),到时在改/etc/hosts的时候对应配上解析(我是走hosts,没用dns解析)
openLDAP的都配置好后,开始安装配置sssd:
apt install sssd ldap-utils
修改/etc/sssd/sssd.conf(记得权限要600)
[sssd]
config_file_version = 2
services = nss, pam
domains = alpha
[nss]
debug_level = 4
filter_groups = root
filter_users = root
[domain/alpha]
debug_level = 9
auth_provider = ldap
id_provider = ldap
chpass_provider = ldap
ldap_uri = ldaps://xxx.com
ldap_search_base = dc=xxx,dc=com
#ldap_default_bind_dn = cn=admin,dc=xxx,dc=com
ldap_default_authtok_type = password
ldap_default_authtok = 123456
override_homedir = /home/%u
override_shell = /bin/bash
access_provider = permit
sudo_provider = ldap
autofs_provider = ldap
resolver_provider = ldap
ldap_tls_reqcert = never
ldap_id_use_start_tls = true
配置好后测试成功: