LDAP安装

最新推荐文章于 2023-10-21 23:54:07 发布

carlos yue

最新推荐文章于 2023-10-21 23:54:07 发布

阅读量674

点赞数

分类专栏：工具

本文链接：https://blog.csdn.net/pcjk8866/article/details/104759695

版权

工具专栏收录该内容

23 篇文章 0 订阅

订阅专栏

安装

#!/bin/bash
echo "install ldap rpm"
yum install -y openldap-servers openldap-clients
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown ldap. /var/lib/ldap/DB_CONFIG
systemctl start slapd
systemctl enable slapd

配置

slappasswd 
123456
{SSHA}DEQ07OV7txoNEUXGIOzwZX2afD6B5VuN

vi chrootpw.ldif  添加一下内容

# specify the password generated above for "olcRootPW" section
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}DEQ07OV7txoNEUXGIOzwZX2afD6B5VuN

ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif

导入基本模式

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif

ldap的DB中设置域名

slappasswd 
123456
{SSHA}YBeYeKhDGSjTvpMxj3g4CEWgNniEn8cJ
vi chdomain.ldif

# replace to your own domain name for "dc=***,dc=***" section
# specify the password generated above for "olcRootPW" section
 dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
  read by dn.base="cn=Manager,dc=yzq,dc=com" read by * none

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=yzq,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=yzq,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}YBeYeKhDGSjTvpMxj3g4CEWgNniEn8cJ

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
  dn="cn=Manager,dc=yzq,dc=com" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=yzq,dc=com" write by * read


 ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif 
 
 
 
vi basedomain.ldif

# replace to your own domain name for "dc=***,dc=***" section
dn: dc=yzq,dc=com
objectClass: top
objectClass: dcObject
objectclass: organization
o: yuezhiqian
dc: yzq

dn: cn=Manager,dc=yzq,dc=com
objectClass: organizationalRole
cn: Manager
description: Directory Manager

dn: ou=People,dc=yzq,dc=com
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=yzq,dc=com
objectClass: organizationalUnit
ou: Group


 ldapadd -x -D cn=Manager,dc=yzq,dc=com -W -f basedomain.ldif

配置

/etc/openldap/slapd.conf：OpenLDAP的主配置文件，记录根域信息，管理员名称，密码，日志，权限等
  /etc/openldap/slapd.d/*：这下面是/etc/openldap/slapd.conf配置信息生成的文件，每修改一次配置信息，这里的东西就要重新生成
  /etc/openldap/schema/*：OpenLDAP的schema存放的地方
  /var/lib/ldap/*：OpenLDAP的数据文件
  /usr/share/openldap-servers/slapd.conf.obsolete 模板配置文件
  /usr/share/openldap-servers/DB_CONFIG.example 模板数据库配置文件
  OpenLDAP监听的端口：
  默认监听端口：389（明文数据传输）
  加密监听端口：636（密文数据传输）


cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown ldap. /var/lib/ldap/DB_CONFIG
systemctl start slapd
systemctl enable slapd

slappasswd生成密文密码123456，拷贝这个到/etc/openldap/lapd.conf里
这里的rootpw必须顶格写，而且与后面的密码文件用Tab键隔开
先检测/etc/openldap/slapd.conf是否有错误：slaptest -f /etc/openldap/slapd.conf

启动

安装phpLDAPadmin来web配置LDAP

安装和配置httpd

yum -y install httpd
rm -f /etc/httpd/conf.d/welcome.conf
vi /etc/httpd/conf/httpd.conf

vi /etc/httpd/conf/httpd.conf
# line 86: change to admin's email address
ServerAdmin root@srv.world
# line 95: change to your server's name
ServerName www.srv.world:80
# line 151: change
AllowOverride All
# line 164: add file name that it can access only with directory's name
DirectoryIndex index.html index.cgi index.php
# add follows to the end
# server's response header
ServerTokens Prod
# keepalive is ON
KeepAlive On

systemctl start httpd
systemctl enable httpd
vi /var/www/html/index.html

<html>
<body>
<div style="width: 100%; font-size: 40px; font-weight: bold; text-align: center;">
Test Page
</div>
</body>
</html>

安装php

yum -y install php php-mbstring php-pear
vi /etc/php.ini

line 878: uncomment and add your timezone

date.timezone = “Asia/Shanghai”

重启hettpd 服务器

systemctl restart httpd

vi /var/www/html/index.php

  <html>
<body>
<div style="width: 100%; font-size: 40px; font-weight: bold; text-align: center;">
<?php
   print Date("Y/m/d");
?>
</div>
</body>
</html>

安装phpLDAP admin

wget http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
rpm -ivh epel-release-latest-7.noarch.rpm
yum repolist      ##检查是否已添加至源列表
yum --enablerepo=epel -y install phpldapadmin
vi /etc/phpldapadmin/config.php

# line 397: uncomment, line 398: comment out
$servers->setValue('login','attr','dn');
// $servers->setValue('login','attr','uid');

vi /etc/httpd/conf.d/phpldapadmin.conf
修改为
<Directory /usr/share/phpldapadmin/htdocs>
  Order Deny,Allow
  Allow from all
</Directory>

vi /etc/httpd/conf/httpd.conf
修改为
	102 #<Directory />
    103 #    AllowOverride none
    104 #    Require all denied
    105 #</Directory>
    106
<Directory />
    Options Indexes FollowSymLinks
    AllowOverride None
</Directory>

systemctl restart httpd

通过phpLDAPadmin访问

http://www.yzq.com/ldapadmin
账号 cn=Manager,dc=yzq,dc=com
密码 123456

参考

LDAP服务器的概念和原理简单介绍
 centos7下ldap服务搭建
 Centos7.2下针对LDAP的完整部署记录
 CentOS7 部署LDAP服务器

http://blog.51cto.com/11555417/2065747

OpenLDAP部署及管理维护
 完整版的OpenLDAP搭建全过程

carlos yue

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
复制链接

分享到 QQ

分享到新浪微博

扫一扫

专栏目录