Ldap HA超详细部署方案

#两个主机都要操作，root下操作，
3、Ldap （主从）安装
#######################Ldap主从配置#####################

安装

yum -y install openldap-servers openldap-clients nss-pam-ldapd
#复制的是什么文件？
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown ldap:ldap /var/lib/ldap/DB_CONFIG

有问题可以考虑：chown -R ldap:ldap /etc/openldap/

启动（设置自启动）

systemctl start slapd
systemctl enable slapd

#设置密码

slappasswd -h {md5} -s "FCA6Pw2"
{MD5}qOykCIxA1***Nw==

vi set_rootpw.ldif
#################################################
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {MD5}qOykC***********LCSNw==
#################################################
ldapadd -Y EXTERNAL -H ldapi:/// -f set_rootpw.ldif

additional info: modify/add: olcRootPW: no equality matching rule 解决办法：
修改modify.ldif中对应选项的"add"为"replace"即可

#添加基础配置
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
#添加domain配置
vi set_domain.ldif
###################################
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base=“gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth”
read by dn.base=“cn=admin,dc=@@@,dc=com” read by * none

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=@@@,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=admin,dc=@@@,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {MD5}qOykCIx*******LCSNw==

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
dn=“cn=admin,dc=@@@,dc=com” write by anonymous auth by self write by * none
olcAccess: {1}to dn.base=“” by * read
olcAccess: {2}to * by dn=“cn=admin,dc=@@@,dc=com” write by * read
##########################################################
ldapmodify -Y EXTERNAL -H ldapi:/// -f set_domain.ldif

vi create_basedomain.ldif
##########################################################
dn: dc=@@@,dc=com
objectClass: top
objectClass: dcObject
objectclass: organization
o: Server com
dc: @@@

dn: cn=admin,dc=@@@,dc=com
objectClass: organizationalRole
cn: admin
description: Directory admin

dn: ou=People,dc=@@@,dc=com
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=@@@,dc=com
objectClass: organizationalUnit
ou: Group
##########################################################
ldapadd -x -D cn=admin,dc=@@@,dc=com -w*********FCA6Pw2 -f create_basedomain.ldif

#主从配置
------ master
vi sync_provider_addMode.ldif

###################################

create new

dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulePath: /usr/lib64/openldap
olcModuleLoad: syncprov.la
####################################
ldapadd -Y EXTERNAL -H ldapi:/// -f sync_provider_addMode.ldif

vi sync_provider.ldif
#############################

create new

dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
olcSpSessionLog: 100
###############################
ldapadd -Y EXTERNAL -H ldapi:/// -f sync_provider.ldif

———slave

vi sync_consumer.ldif

修改sync_consumer.ldif中 provider=ldap://10.@@@.50:389/

##############################
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcSyncRepl
olcSyncRepl: rid=001
provider=ldap://10.@@@.50:389/
bindmethod=simple
binddn=“cn=admin,dc=@@@,dc=com”
credentials=2D0snAY**********6Pw2
searchbase=“dc=@@@,dc=com”
scope=sub
schemachecking=on
type=refreshAndPersist
retry=“30 5 300 3”
interval=00:00:05:00
################################

ldapadd -Y EXTERNAL -H ldapi:/// -f sync_consumer.ldif

#两个节点都执行
##其它 memberof配置
vi memberof_conf.ldif
#############################3
dn: cn=module,cn=config
cn: module
objectClass: olcModuleList
objectClass: top
olcModulePath: /usr/lib64/openldap
olcModuleLoad: memberof.la
############################

vi memberOfOverlay.ldif
#########################
dn: olcOverlay=memberof,olcDatabase={2}hdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcMemberOf
olcOverlay: {0}memberof
########################

ldapadd -Y EXTERNAL -H ldapi:/// -f memberof_conf.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f memberOfOverlay.ldif

master节点执行

#创建demo用户

#创建 demo 用户
vi create_user_demo.ldif
#################################3
dn: uid=demo,ou=People,dc=@@@,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: demo
sn: demo
userPassword: {MD5}qOyk***********q/ZLCSNw==
loginShell: /bin/bash
uidNumber: 1501
gidNumber: 1501
homeDirectory: /home/demo

dn: cn=demo,ou=Group,dc=@@@,dc=com
objectClass: posixGroup
cn: demo
gidNumber: 1501
memberUid: uid=demo,ou=People,dc=@@@,dc=com
########################################

ldapadd -x -D “cn=admin,dc=@@@,dc=com” -w 2***********CA6Pw2 -f create_user_demo.ldif

验证创建用户，两个主机验证同步

ldapsearch -x -b ‘ou=People,dc=@@@,dc=com’

ldapsearch -x

#LDAP HA操作#
#keepalive安装 两台主机都执行
#安装
yum install -y keepalived
#配置
mv /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.bak

master
vi /etc/keepalived/keepalived.conf

##########################################
vrrp_script check_ldap {
script “nc localhost 389 -w 1 </dev/null &>/dev/null || systemctl stop keepalived”
interval 2
weight 2
}
vrrp_instance LDAP_HA {
state MASTER
#state BACKUP
interface bond0
virtual_router_id 75
priority 100
nopreempt
advert_int 1
authentication {
auth_type PASS
auth_pass password123
}

    track_script {
      check_ldap
    }

    virtual_ipaddress {
        172.@@@.232
    }

}
#####################################

slave

vi /etc/keepalived/keepalived.conf

#############################33
vrrp_script check_ldap {
script “nc localhost 389 -w 1 </dev/null &>/dev/null || systemctl stop keepalived”
interval 2
weight 2
}
vrrp_instance LDAP_HA {
#state MASTER
state BACKUP
interface bond0
virtual_router_id 75
priority 90
nopreempt
advert_int 1
authentication {
auth_type PASS
auth_pass password123
}

    track_script {
      check_ldap
    }

    virtual_ipaddress {
        172.@@@.232
    }

}
###############################

启动命令：systemctl start keepalived
检查状态：systemctl status keepalived
验证：ping 172.@@@.232

#ldap 客户端配置 所有的主机执行
yum install -y openldap-clients nss-pam-ldapd
同步命令，所有主机
authconfig --enableldap --enableldapauth --ldapserver=172.@@@.232:389 --ldapbasedn=“dc=@@@,dc=com” --enablemkhomedir --update

非server主机，验证：ldapsearch -x -b ‘ou=People,dc=@@@,dc=com’

ldapwhoami -x -D “uid=ocdp,ou=People,dc=@@@,dc=com” -w ‘密码’

ldapsearch -x -b ‘ou=People,dc=@@@,dc=com’

ldapsearch -x

#Ranger HA操作
ranger keepalive安装
#安装
yum install -y keepalived
#配置
mv /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.bak

master
vi /etc/keepalived/keepalived.conf
#######################
vrrp_script check_ranger {
script “nc localhost 6080 -w 1 </dev/null &>/dev/null || systemctl stop keepalived”
interval 2
weight 2
}
vrrp_instance LDAP_HA {
state MASTER
#state BACKUP
interface bond0
virtual_router_id 70
priority 100
nopreempt
advert_int 1
authentication {
auth_type PASS
auth_pass password123
}

    track_script {
      check_ranger
    }

    virtual_ipaddress {
        172.@@@.231
    }

}
##############################

vi /etc/keepalived/keepalived.conf
#######################################
vrrp_script check_ranger {
script “nc localhost 6080 -w 1 </dev/null &>/dev/null || systemctl stop keepalived”
interval 2
weight 2
}
vrrp_instance LDAP_HA {
#state MASTER
state BACKUP
interface bond0
virtual_router_id 70
priority 90
nopreempt
advert_int 1
authentication {
auth_type PASS
auth_pass password123
}

    track_script {
      check_ranger
    }

    virtual_ipaddress {
        172.@@@.231
    }

}
########################################
启动命令：systemctl start keepalived
检查状态：systemctl status keepalived
验证：ping 172.@@@.231