安装
#!/bin/bash
echo "install ldap rpm"
yum install -y openldap-servers openldap-clients
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown ldap. /var/lib/ldap/DB_CONFIG
systemctl start slapd
systemctl enable slapd
配置
slappasswd
123456
{SSHA}DEQ07OV7txoNEUXGIOzwZX2afD6B5VuN
vi chrootpw.ldif 添加一下内容
# specify the password generated above for "olcRootPW" section
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}DEQ07OV7txoNEUXGIOzwZX2afD6B5VuN
ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif
导入基本模式
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
ldap的DB中设置域名
slappasswd
123456
{SSHA}YBeYeKhDGSjTvpMxj3g4CEWgNniEn8cJ
vi chdomain.ldif
# replace to your own domain name for "dc=***,dc=***" section
# specify the password generated above for "olcRootPW" section
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
read by dn.base="cn=Manager,dc=yzq,dc=com" read by * none
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=yzq,dc=com
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=yzq,dc=com
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}YBeYeKhDGSjTvpMxj3g4CEWgNniEn8cJ
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
dn="cn=Manager,dc=yzq,dc=com" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=yzq,dc=com" write by * read
ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif
vi basedomain.ldif
# replace to your own domain name for "dc=***,dc=***" section
dn: dc=yzq,dc=com
objectClass: top
objectClass: dcObject
objectclass: organization
o: yuezhiqian
dc: yzq
dn: cn=Manager,dc=yzq,dc=com
objectClass: organizationalRole
cn: Manager
description: Directory Manager
dn: ou=People,dc=yzq,dc=com
objectClass: organizationalUnit
ou: People
dn: ou=Group,dc=yzq,dc=com
objectClass: organizationalUnit
ou: Group
ldapadd -x -D cn=Manager,dc=yzq,dc=com -W -f basedomain.ldif
配置
/etc/openldap/slapd.conf:OpenLDAP的主配置文件,记录根域信息,管理员名称,密码,日志,权限等
/etc/openldap/slapd.d/*:这下面是/etc/openldap/slapd.conf配置信息生成的文件,每修改一次配置信息,这里的东西就要重新生成
/etc/openldap/schema/*:OpenLDAP的schema存放的地方
/var/lib/ldap/*:OpenLDAP的数据文件
/usr/share/openldap-servers/slapd.conf.obsolete 模板配置文件
/usr/share/openldap-servers/DB_CONFIG.example 模板数据库配置文件
OpenLDAP监听的端口:
默认监听端口:389(明文数据传输)
加密监听端口:636(密文数据传输)
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown ldap. /var/lib/ldap/DB_CONFIG
systemctl start slapd
systemctl enable slapd
slappasswd生成密文密码123456,拷贝这个到/etc/openldap/lapd.conf里
这里的rootpw必须顶格写,而且与后面的密码文件用Tab键隔开
先检测/etc/openldap/slapd.conf是否有错误:slaptest -f /etc/openldap/slapd.conf
启动
安装phpLDAPadmin来web配置LDAP
安装和配置httpd
yum -y install httpd
rm -f /etc/httpd/conf.d/welcome.conf
vi /etc/httpd/conf/httpd.conf
vi /etc/httpd/conf/httpd.conf
# line 86: change to admin's email address
ServerAdmin root@srv.world
# line 95: change to your server's name
ServerName www.srv.world:80
# line 151: change
AllowOverride All
# line 164: add file name that it can access only with directory's name
DirectoryIndex index.html index.cgi index.php
# add follows to the end
# server's response header
ServerTokens Prod
# keepalive is ON
KeepAlive On
systemctl start httpd
systemctl enable httpd
vi /var/www/html/index.html
<html>
<body>
<div style="width: 100%; font-size: 40px; font-weight: bold; text-align: center;">
Test Page
</div>
</body>
</html>
安装php
yum -y install php php-mbstring php-pear
vi /etc/php.ini
line 878: uncomment and add your timezone
date.timezone = “Asia/Shanghai”
重启hettpd 服务器
systemctl restart httpd
vi /var/www/html/index.php
<html>
<body>
<div style="width: 100%; font-size: 40px; font-weight: bold; text-align: center;">
<?php
print Date("Y/m/d");
?>
</div>
</body>
</html>
安装phpLDAP admin
wget http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
rpm -ivh epel-release-latest-7.noarch.rpm
yum repolist ##检查是否已添加至源列表
yum --enablerepo=epel -y install phpldapadmin
vi /etc/phpldapadmin/config.php
# line 397: uncomment, line 398: comment out
$servers->setValue('login','attr','dn');
// $servers->setValue('login','attr','uid');
vi /etc/httpd/conf.d/phpldapadmin.conf
修改为
<Directory /usr/share/phpldapadmin/htdocs>
Order Deny,Allow
Allow from all
</Directory>
vi /etc/httpd/conf/httpd.conf
修改为
102 #<Directory />
103 # AllowOverride none
104 # Require all denied
105 #</Directory>
106
<Directory />
Options Indexes FollowSymLinks
AllowOverride None
</Directory>
systemctl restart httpd
通过phpLDAPadmin访问
http://www.yzq.com/ldapadmin
账号 cn=Manager,dc=yzq,dc=com
密码 123456
参考
LDAP服务器的概念和原理简单介绍
centos7下ldap服务搭建
Centos7.2下针对LDAP的完整部署记录
CentOS7 部署LDAP服务器
http://blog.51cto.com/11555417/2065747