#两个主机都要操作,root下操作,
3、Ldap (主从)安装
#######################Ldap主从配置#####################
安装
yum -y install openldap-servers openldap-clients nss-pam-ldapd
#复制的是什么文件?
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown ldap:ldap /var/lib/ldap/DB_CONFIG
有问题可以考虑:chown -R ldap:ldap /etc/openldap/
启动(设置自启动)
systemctl start slapd
systemctl enable slapd
#设置密码
slappasswd -h {md5} -s "FCA6Pw2"
{MD5}qOykCIxA1***Nw==
vi set_rootpw.ldif
#################################################
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {MD5}qOykC***********LCSNw==
#################################################
ldapadd -Y EXTERNAL -H ldapi:/// -f set_rootpw.ldif
additional info: modify/add: olcRootPW: no equality matching rule 解决办法:
修改modify.ldif中对应选项的"add"为"replace"即可
#添加基础配置
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
#添加domain配置
vi set_domain.ldif
###################################
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base=“gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth”
read by dn.base=“cn=admin,dc=@@@,dc=com” read by * none
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=@@@,dc=com
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=admin,dc=@@@,dc=com
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {MD5}qOykCIx*******LCSNw==
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
dn=“cn=admin,dc=@@@,dc=com” write by anonymous auth by self write by * none
olcAccess: {1}to dn.base=“” by * read
olcAccess: {2}to * by dn=“cn=admin,dc=@@@,dc=com” write by * read
##########################################################
ldapmodify -Y EXTERNAL -H ldapi:/// -f set_domain.ldif
vi create_basedomain.ldif
##########################################################
dn: dc=@@@,dc=com
objectClass: top
objectClass: dcObject
objectclass: organization
o: Server com
dc: @@@
dn: cn=admin,dc=@@@,dc=com
objectClass: organizationalRole
cn: admin
description: Directory admin
dn: ou=People,dc=@@@,dc=com
objectClass: organizationalUnit
ou: People
dn: ou=Group,dc=@@@,dc=com
objectClass: organizationalUnit
ou: Group
##########################################################
ldapadd -x -D cn=admin,dc=@@@,dc=com -w*********FCA6Pw2 -f create_basedomain.ldif
#主从配置
------ master
vi sync_provider_addMode.ldif
###################################
create new
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulePath: /usr/lib64/openldap
olcModuleLoad: syncprov.la
####################################
ldapadd -Y EXTERNAL -H ldapi:/// -f sync_provider_addMode.ldif
vi sync_provider.ldif
#############################
create new
dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
olcSpSessionLog: 100
###############################
ldapadd -Y EXTERNAL -H ldapi:/// -f sync_provider.ldif
———slave
vi sync_consumer.ldif
修改sync_consumer.ldif中 provider=ldap://10.@@@.50:389/
##############################
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcSyncRepl
olcSyncRepl: rid=001
provider=ldap://10.@@@.50:389/
bindmethod=simple
binddn=“cn=admin,dc=@@@,dc=com”
credentials=2D0snAY**********6Pw2
searchbase=“dc=@@@,dc=com”
scope=sub
schemachecking=on
type=refreshAndPersist
retry=“30 5 300 3”
interval=00:00:05:00
################################
ldapadd -Y EXTERNAL -H ldapi:/// -f sync_consumer.ldif
#两个节点都执行
##其它 memberof配置
vi memberof_conf.ldif
#############################3
dn: cn=module,cn=config
cn: module
objectClass: olcModuleList
objectClass: top
olcModulePath: /usr/lib64/openldap
olcModuleLoad: memberof.la
############################
vi memberOfOverlay.ldif
#########################
dn: olcOverlay=memberof,olcDatabase={2}hdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcMemberOf
olcOverlay: {0}memberof
########################
ldapadd -Y EXTERNAL -H ldapi:/// -f memberof_conf.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f memberOfOverlay.ldif
master节点执行
#创建demo用户
#创建 demo 用户
vi create_user_demo.ldif
#################################3
dn: uid=demo,ou=People,dc=@@@,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: demo
sn: demo
userPassword: {MD5}qOyk***********q/ZLCSNw==
loginShell: /bin/bash
uidNumber: 1501
gidNumber: 1501
homeDirectory: /home/demo
dn: cn=demo,ou=Group,dc=@@@,dc=com
objectClass: posixGroup
cn: demo
gidNumber: 1501
memberUid: uid=demo,ou=People,dc=@@@,dc=com
########################################
ldapadd -x -D “cn=admin,dc=@@@,dc=com” -w 2***********CA6Pw2 -f create_user_demo.ldif
验证创建用户,两个主机验证同步
ldapsearch -x -b ‘ou=People,dc=@@@,dc=com’
ldapsearch -x
#LDAP HA操作#
#keepalive安装 两台主机都执行
#安装
yum install -y keepalived
#配置
mv /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.bak
master
vi /etc/keepalived/keepalived.conf
##########################################
vrrp_script check_ldap {
script “nc localhost 389 -w 1 </dev/null &>/dev/null || systemctl stop keepalived”
interval 2
weight 2
}
vrrp_instance LDAP_HA {
state MASTER
#state BACKUP
interface bond0
virtual_router_id 75
priority 100
nopreempt
advert_int 1
authentication {
auth_type PASS
auth_pass password123
}
track_script {
check_ldap
}
virtual_ipaddress {
172.@@@.232
}
}
#####################################
slave
vi /etc/keepalived/keepalived.conf
#############################33
vrrp_script check_ldap {
script “nc localhost 389 -w 1 </dev/null &>/dev/null || systemctl stop keepalived”
interval 2
weight 2
}
vrrp_instance LDAP_HA {
#state MASTER
state BACKUP
interface bond0
virtual_router_id 75
priority 90
nopreempt
advert_int 1
authentication {
auth_type PASS
auth_pass password123
}
track_script {
check_ldap
}
virtual_ipaddress {
172.@@@.232
}
}
###############################
启动命令:systemctl start keepalived
检查状态:systemctl status keepalived
验证:ping 172.@@@.232
#ldap 客户端配置 所有的主机执行
yum install -y openldap-clients nss-pam-ldapd
同步命令,所有主机
authconfig --enableldap --enableldapauth --ldapserver=172.@@@.232:389 --ldapbasedn=“dc=@@@,dc=com” --enablemkhomedir --update
非server主机,验证:ldapsearch -x -b ‘ou=People,dc=@@@,dc=com’
ldapwhoami -x -D “uid=ocdp,ou=People,dc=@@@,dc=com” -w ‘密码’
ldapsearch -x -b ‘ou=People,dc=@@@,dc=com’
ldapsearch -x
#Ranger HA操作
ranger keepalive安装
#安装
yum install -y keepalived
#配置
mv /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.bak
master
vi /etc/keepalived/keepalived.conf
#######################
vrrp_script check_ranger {
script “nc localhost 6080 -w 1 </dev/null &>/dev/null || systemctl stop keepalived”
interval 2
weight 2
}
vrrp_instance LDAP_HA {
state MASTER
#state BACKUP
interface bond0
virtual_router_id 70
priority 100
nopreempt
advert_int 1
authentication {
auth_type PASS
auth_pass password123
}
track_script {
check_ranger
}
virtual_ipaddress {
172.@@@.231
}
}
##############################
vi /etc/keepalived/keepalived.conf
#######################################
vrrp_script check_ranger {
script “nc localhost 6080 -w 1 </dev/null &>/dev/null || systemctl stop keepalived”
interval 2
weight 2
}
vrrp_instance LDAP_HA {
#state MASTER
state BACKUP
interface bond0
virtual_router_id 70
priority 90
nopreempt
advert_int 1
authentication {
auth_type PASS
auth_pass password123
}
track_script {
check_ranger
}
virtual_ipaddress {
172.@@@.231
}
}
########################################
启动命令:systemctl start keepalived
检查状态:systemctl status keepalived
验证:ping 172.@@@.231