一、创建cert证书
vi makecert
1、 证书创建脚本
#!/bin/bash
country=CN
state=GuangDong
locality=Shenzhen
org=test
email=test@test.com
numbits=2048
ca_days=3650
site_days=3650
client_days=3650
target=$1
ca=
site=
client=
arg_check=
if [ "$target" == "ca" ]; then
if [ "$2" == "" ]; then
echo argument error
else
ca=$2
arg_check=ok
fi
elif [ "$target" == "site" ]; then
if [ "$3" == "" ]; then
echo argument error
else
ca=$2
site=$3
arg_check=ok
fi
elif [ "$target" == "client" ]; then
if [ "$3" == "" ]; then
echo argument error
else
ca=$2
client=$3
arg_check=ok
fi
fi
if [ "$arg_check" != "ok" ]; then
echo "[make CA]"
echo " makecert ca CA-FILE-NAME"
echo "[make site cert/key]"
echo " makecert site CA-FILE-NAME SITE-DOMAIN-NAME"
echo "[make client cert/key]"
echo " makecert client CA-FILE-NAME CLIENT-NAME"
exit
fi
if [ "$target" == "ca" ]; then
echo "creating CA key..."
openssl genrsa -out "${ca}.key" ${numbits}
echo "creating CA csr..."
openssl req -new -sha256 \
-key "${ca}.key" \
-out "${ca}.csr" \
-days ${ca_days} \
-subj "/C=${country}/ST=${state}/L=${locality}/O=${org}/OU=${org}/CN=${ca}/emailAddress=${email}"
echo "creating CA cert..."
openssl x509 -req -sha256 -in "${ca}.csr" -signkey "${ca}.key" -out "${ca}.crt" -days 3650
# echo "creating CA der..."
#openssl x509 -in "${ca}.crt" -out "${ca}.der" -outform DER
rm -f "${ca}.csr" > /dev/null 2>&1
elif [ "$target" == "site" ]; then
echo "creating server key..."
openssl genrsa -out "${site}.key" ${numbits}
echo "creating server csr..."
openssl req -new -sha256 -key "${site}.key" -out "${site}.csr" -days 3650 \
-subj "/C=${country}/ST=${state}/L=${locality}/O=${org}/OU=${org}/CN=*.$site/emailAddress=${email}" \
-config <(cat /etc/pki/tls/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:*.$site"))
echo "authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = $site" > "/tmp/openssl-site-ext"
echo "sign server cert..."
openssl x509 -sha256 \
-req -in "${site}.csr" \
-extfile "/tmp/openssl-site-ext" \
-out "${site}.crt" \
-CA "${ca}.crt" \
-CAkey "${ca}.key" \
-CAcreateserial \
-days ${site_days}
rm -f "${site}.csr" > /dev/null 2>&1
rm -f /tmp/openssl-site-ext
rm -f .srl > /dev/null 2>&1
rm -f *.srl > /dev/null 2>&1
elif [ "$target" == "client" ]; then
echo "creating client key..."
openssl genrsa -out "${client}.key" ${numbits}
echo "creating client csr..."
openssl req -new -sha256 -key "${client}.key" -out "${client}.csr" -days 3650 \
-subj "/C=${country}/ST=${state}/L=${locality}/O=${org}/OU=${org}/CN=${client}/emailAddress=${email}"
echo "extendedKeyUsage=clientAuth" > "/tmp/openssl-client-ext"
echo "sign client cert.."
openssl x509 -req -sha256 \
-in "${client}.csr" \
-extfile "/tmp/openssl-client-ext" \
-out "${client}.crt" \
-CA "${ca}.crt" \
-CAkey "${ca}.key" \
-CAcreateserial \
-days ${client_days}
# echo "creating client der..."
# openssl x509 -in "${client}.crt" -out "${client}.der" -outform DER
rm -f "${client}.csr" > /dev/null 2>&1
rm -f /tmp/openssl-client-ext
rm -f .srl > /dev/null 2>&1
rm -f *.srl > /dev/null 2>&1
fi
- 生成根证书、域名证书、域名私钥
mkdir -p /data/openldap/{data,config,init,certs}
cd /data/openldap/certs
chmod +x ./makecert
./makecert ca root #创建 ca,会生成文件名root.crt文件
./makecert site root fly.cn #用 ca 颁发站点证书,生成key和crt文件
- 将此证书拷贝软连接至 /etc/ssl/certs/文件夹中
注意: 所有版本操作。
cp root.crt /etc/ssl/certs/root.crt
- 更新系统的证书
注意: 所有版本操作。
update-ca-trust
二、 部署openldap
mkdir -p /data/openldap/{data,config,init,certs}
cd /data/openldap/
- openldap docker-compose.yaml
version: "3"
services:
ldap:
container_name: "ldap"
hostname: ldap2.fly.cn
image: "osixia/openldap:latest"
restart: always
environment:
LDAP_ORGANISATION: "FLY openldap"
LDAP_DOMAIN: "fly.cn"
LDAP_ADMIN_PASSWORD: "Openldap123456"
#定义证书书
LDAP_TLS_CRT_FILENAME: "fly.cn.crt"
LDAP_TLS_KEY_FILENAME: "fly.cn.key"
LDAP_TLS_CA_CRT_FILENAME: "root.crt"
#主从复制
LDAP_REPLICATION_HOSTS: "#PYTHON2BASH:['ldap://ldap1.fly.cn','ldap://ldap2.fly.cn']"
LDAP_REPLICATION: "true"
#定义运行时的hosts配置
extra_hosts:
- "ldap1.fly.cn:192.168.11.193"
- "ldap2.fly.cn:192.168.11.194"
volumes:
- /etc/timezone:/etc/timezone
- /etc/localtime:/etc/localtime
- /data/openldap/data:/var/lib/ldap
- /data/openldap/config:/etc/ldap/slapd.d
- /data/openldap/init:/init
- /data/openldap/certs:/container/service/slapd/assets/certs
ports:
- '389:389'
- '636:636'
三、部署phpopenldap
- phpopenldap docker-compose.yaml
version: "3"
services:
php:
image: osixia/phpldapadmin:stable
restart: always
container_name: phpopenldap
environment:
TZ: "Asia/Shanghai"
PHPLDAPADMIN_HTTPS: "false"
LAM_SKIP_PRECONFIGURE: "true"
LDAP_DOMAIN: "fly.cn"
#PHPLDAPADMIN_LDAP_HOSTS: "#PYTHON2BASH:[{'ldap1.fly.cn': [{'server': [{'tls': True}]},{'login': [{'bind_id': 'cn=admin,dc=fly,dc=cn'}]}]}, {'ldap2.fly.cn': [{'server': [{'tls': True}]},{'login': [{'bind_id': 'cn=admin,dc=fly,dc=cn'}]}]}]"
PHPLDAPADMIN_LDAP_HOSTS: "#PYTHON2BASH:['ldap1.fly.cn','ldap2.fly.cn']"
#PHPLDAPADMIN_LDAP_CLIENT_TLS_CA_CRT_FILENAME: "root.crt"
#PHPLDAPADMIN_LDAP_CLIENT_TLS_CRT_FILENAME: "fly.cn.crt"
#PHPLDAPADMIN_LDAP_CLIENT_TLS_KEY_FILENAME: "fly.cn.key"
extra_hosts:
- "ldap1.fly.cn:192.168.11.193"
- "ldap2.fly.cn:192.168.11.194"
volumes:
- /etc/timezone:/etc/timezone
- /etc/localtime:/etc/localtime
- /data/openldap/certs:/container/service/ldap-client/assets/certs/
ports:
- 10005:80
访问地址:http://192.168.11.194:10005
四、部置 ldap-account-manager
version: "3"
services:
web:
image: ldapaccountmanager/lam:stable
restart: always
container_name: ldap-account-manager
environment:
TZ: "Asia/Shanghai"
#LAM_SKIP_PRECONFIGURE: "true"
LDAP_SERVER: ldap://ldap1.fly.cn:389
LDAP_GROUPS_DN: ou=groups,dc=fly,dc=cn
LDAP_BASE_DN: dc=fly,dc=cn
LDAP_USERS_DN: ou=users,dc=fly,dc=cn
LDAP_DOMAIN: "fly.cn"
LDAP_BASE_DN: "dc=fly,dc=cn"
LDAP_ADMIN_USER: "admin"
LAM_PASSWORD: "Openldap123456"
LAM_LANG: "zh_CN"
volumes:
- /etc/timezone:/etc/timezone
- /etc/localtime:/etc/localtime
#- /data/openldap/lam:/var/lib/ldap-account-manager
#- /data/openldap/lam-conf:/etc/ldap-account-manager
# - /data/openldap/ldap-account-manager/lam.conf:/var/lib/ldap-account-manager/config/lam.conf
ports:
- 10004:80
extra_hosts:
- "ldap1.fly.cn:192.168.11.193"
- "ldap2.fly.cn:192.168.11.194"
访问地址:http://192.168.11.194:10004
五、 openldap数据初始化
1、 创建组
cat > "/data/openldap/init/base.ldif" << EOF
dn: ou=users,dc=fly,dc=cn
objectClass: organizationalUnit
ou: users
dn: ou=groups,dc=fly,dc=cn
objectClass: organizationalUnit
ou: groups
# 管理员组
dn: ou=g-admin,ou=groups,dc=fly,dc=cn
changetype: add
cn: g-admin
objectClass: groupOfNames
objectClass: top
member: cn=radmin,ou=users,dc=fly,dc=cn
#创建unix组
dn: cn=unix,ou=groups,dc=fly,dc=cn
cn: unix
gidnumber: 10000
objectclass: posixGroup
EOF
docker exec -i ldap ldapadd -x -D cn=admin,dc=fly,dc=cn -w Openldap123456 -f /init/base.ldif
2、创建用户
cat > "/data/openldap/init/adduser.ldif" << EOF
# 密码readonly2020
dn: cn=readonly,dc=fly,dc=cn
changetype: add
cn: readonly
objectClass: inetOrgPerson
objectClass: top
sn: readonly
telephoneNumber: 13000000001
mail: readonly@fly.cn
userPassword: readonly2020
#userPassword: {MD5}DJGL63b7oYOncsZSsb/e7A==
# 密码test2020
dn: cn=test,ou=users,dc=fly,dc=cn
changetype: add
cn: test
objectClass: inetOrgPerson
objectClass: top
sn: test
telephoneNumber: 13000000002
mail: test@fly.cn
userPassword: {MD5}mLAb4tluXq/vZtslgQfK9A==
# 密码radmin2020
dn: cn=radmin,ou=users,dc=fly,dc=cn
changetype: add
cn: radmin
objectClass: inetOrgPerson
objectClass: top
sn: radmin
telephoneNumber: 13000000003
mail: radmin@fly.cn
userPassword: {MD5}Wkr/lT7eoTyB27LjGG5BTw==
# 密码admin2020
dn: cn=admin,ou=users,dc=fly,dc=cn
changetype: add
cn: admin
objectclass: inetOrgPerson
objectclass: top
objectclass: posixAccount
sn: admin
userpassword: {MD5}REHl1ws2V5APpX5m20B+Cw==
#unix用户配置
gidnumber: 10000
homedirectory: /home/
loginshell: /bin/bash
uid: admin
uidnumber: 10000
EOF
docker exec -i ldap ldapadd -x -D cn=admin,dc=fly,dc=cn -w Openldap123456 -f /init/adduser.ldif
3、禁止匿名访问
cat > "/data/openldap/init/disable_anon.ldif" << EOF
dn: cn=config
changetype: modify
add: olcDisallows
olcDisallows: bind_anon
dn: cn=config
changetype: modify
add: olcRequires
olcRequires: authc
dn: olcDatabase={-1}frontend,cn=config
changetype: modify
add: olcRequires
olcRequires: authc
EOF
docker exec -i ldap ldapadd -Y EXTERNAL -H ldapi:/// -f /init/disable_anon.ldif
4、密码修改策略
cat > "/data/openldap/init/acl.ldif" << EOF
dn: olcDatabase={1}mdb,cn=config
changetype: modify
# 只有自己可以修改密码,不允许匿名访问,允许超级管理员admin修改,允许g-admin组修改
replace: olcAccess
olcAccess: {0}to attrs=userPassword
by self write
by anonymous auth
by dn="cn=admin,dc=fly,dc=cn" write
by group.exact="cn=g-admin,ou=groups,dc=fly,dc=cn" write
by * none
# 自己可以修改自己的信息,g-admin组可以修改任何信息,readonly账号可以查看信息
olcAccess: {1}to *
by self write
by dn.exact="cn=readonly,dc=fly,dc=cn" read
by group.exact="cn=g-admin,ou=groups,dc=fly,dc=cn" write
by * none
EOF
docker exec -i ldap ldapadd -Y EXTERNAL -H ldapi:/// -f /init/acl.ldif
5、 ppolicy模块
#配置module模块
cat > "/data/openldap/init/module.ldif" << EOF
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulepath: /usr/lib/ldap
olcModuleload: accesslog.la
olcModuleload: auditlog.la
olcModuleLoad: ppolicy.la
#olcModuleload: memberof.la
EOF
docker exec -i ldap ldapadd -Y EXTERNAL -H ldapi:/// -f /init/module.ldif
#配置默认配置
cat > "/data/openldap/init/ppolicy_db.ldif" << EOF
dn: olcOverlay=ppolicy,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcOverlay: ppolicy
olcPPolicyDefault: cn=default,ou=Policies,dc=fly,dc=cn
olcPPolicyHashCleartext: TRUE
olcPPolicyUseLockout: TRUE
EOF
docker exec -i ldap ldapadd -Y EXTERNAL -H ldapi:/// -f /init/ppolicy_db.ldif
#创建组
cat > "/data/openldap/init/ppolicy_group.ldif" << EOF
dn: ou=Policies,dc=fly,dc=cn
objectClass: top
objectClass: organizationalUnit
ou: Policies
EOF
docker exec -i ldap ldapadd -x -D cn=admin,dc=fly,dc=cn -w Openldap123456 -f /init/ppolicy_group.ldif
#创建默认密码策略
cat > "/data/openldap/init/ppolicy_rulues.ldif" << EOF
dn: cn=default,ou=Policies,dc=fly,dc=cn
cn: default
objectClass: top
objectClass: device
objectClass: pwdPolicy
objectClass: pwdPolicyChecker
pwdAttribute: 2.5.4.35
pwdInHistory: 8
pwdMinLength: 8
pwdMaxFailure: 3
pwdFailureCountInterval: 1800
pwdCheckQuality: 2
pwdMustChange: TRUE
pwdGraceAuthNLimit: 0
pwdMaxAge: 3600
pwdExpireWarning: 1209600
pwdLockoutDuration: 900
pwdLockout: TRUE
EOF
docker exec -i ldap ldapadd -x -D cn=admin,dc=fly,dc=cn -w Openldap123456 -f /init/ppolicy_rulues.ldif
6、 pqchecker模块
cat > "/data/openldap/init/pqchecker.ldif" << EOF
dn: cn=default,ou=Policies,dc=fly,dc=cn
changetype: modify
add: pwdcheckmodule
pwdCheckModule: pqchecker.so
#-
#add: objectClass
#objectclass: pwdPolicyChecker
EOF
docker exec -i ldap ldapadd -x -D cn=admin,dc=fly,dc=cn -w Openldap123456 -f /init/pqchecker.ldif
7、 审核模块audit
cat > "/data/openldap/init/audit.ldif" << EOF
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: auditlog
dn: olcOverlay=auditlog,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcAuditLogConfig
olcAuditlogFile: /var/log/slapd/auditlog.log
dn: olcDatabase={1}mdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange
by self write
by dn="cn=admin,dc=fly,dc=cn" write
by anonymous auth by * read
olcAccess: {1}to *
by self write
by dn="cn=admin,dc=fly,dc=cn" write
by * read
EOF
docker exec -i ldap ldapadd -Y EXTERNAL -H ldapi:/// -f /init/audit.ldif
8、sudo模块
cat > "/data/openldap/init/sudo-overlay.ldif" << EOF
dn: cn=sudo,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: sudo
olcAttributeTypes: {0}( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: {1}( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: {2}( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Command(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: {3}( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s) impersonated by sudo (deprecated)' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: {4}( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Options(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: {5}( 1.3.6.1.4.1.15953.9.1.6 NAME 'sudoRunAsUser' DESC 'User(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: {6}( 1.3.6.1.4.1.15953.9.1.7 NAME 'sudoRunAsGroup' DESC 'Group(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: {7}( 1.3.6.1.4.1.15953.9.1.8 NAME 'sudoNotBefore' DESC 'Start of time interval for which the entry is valid' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
olcAttributeTypes: {8}( 1.3.6.1.4.1.15953.9.1.9 NAME 'sudoNotAfter' DESC 'End of time interval for which the entry is valid' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
olcAttributeTypes: {9}( 1.3.6.1.4.1.15953.9.1.10 NAME 'sudoOrder' DESC 'an integer to order the sudoRole entries' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
olcObjectClasses: {0}( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' DESC 'SudoerEntries' SUP top STRUCTURAL MUST cn MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoRunAsUser $ sudoRunAsGroup $ sudoOption $ sudoOrder $ sudoNotBefore $ sudoNotAfter $ description ) )
EOF
cat > "/data/openldap/init/sudo.ldif" << EOF
dn: ou=SUDOers,dc=fly,dc=cn
ou: SUDOers
objectClass: top
objectClass: organizationalUnit
dn: cn=defaults,ou=SUDOers,dc=fly,dc=cn
objectClass: sudoRole
cn: defaults
sudoOption: requiretty
sudoOption: !visiblepw
sudoOption: always_set_home
sudoOption: env_reset
sudoOption: env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
sudoOption: env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
sudoOption: env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
sudoOption: env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
sudoOption: env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
sudoOption: secure_path = /sbin:/bin:/usr/sbin:/usr/bin
#sudoOption: logfile = /var/log/sudo
EOF
cat > "/data/openldap/init/sudouser.ldif" << EOF
dn: cn=sudo_ops_role,ou=SUDOers,dc=fly,dc=cn
objectClass: sudoRole
cn: sudo_ops_role
sudoOption: !authenticate
sudoRunAsUser: root
sudoCommand: ALL
sudoHost: ALL
sudoUser: 800001
EOF
docker exec -i ldap ldapadd -Y EXTERNAL -H ldapi:/// -f /init/sudo-overlay.ldif
docker exec -i ldap ldapadd -x -D cn=admin,dc=fly,dc=cn -w Openldap123456 -f /init/sudo.ldif
docker exec -i ldap ldapadd -x -D cn=admin,dc=fly,dc=cn -w Openldap123456 -f /init/sudouser.ldif
9、memberof模块(不用安装)
cat > "/data/openldap/init/memberof_conf.ldif" << EOF
#开启memberof支持
dn: cn=module{2},cn=config
cn: modulle{2}
objectClass: olcModuleList
objectclass: top
olcModuleload: memberof.la
olcModulePath: /usr/lib/ldap
#新增用户支持memberof配置
dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfUniqueNames
olcMemberOfMemberAD: uniqueMember
olcMemberOfMemberOfAD: memberOf
EOF
cat > "/data/openldap/init/refint1.ldif" << EOF
dn: cn=module{2},cn=config
changetype: modify
add: olcmoduleload
olcmoduleload: refint.la
EOF
cat > "/data/openldap/init/refint2.ldif" << EOF
dn: olcOverlay=refint,olcDatabase={1}mdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: refint
olcRefintAttribute: memberof uniqueMember manager owner
EOF
docker exec -i ldap ldapadd -Y EXTERNAL -H ldapi:/// -f /init/memberof_conf.ldif
docker exec -i ldap ldapadd -Y EXTERNAL -H ldapi:/// -f /init/refint1.ldif
docker exec -i ldap ldapadd -Y EXTERNAL -H ldapi:/// -f /init/refint2.ldif
参考https://blog.csdn.net/qq_38120778/article/details/106889176
参考https://blog.csdn.net/qiushun_fang/article/details/111302221
https://blog.csdn.net/u011607971/article/details/86378361
此配置主作参考 certs.ldif
dn: cn=config
changetype: modify
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: "/container/service/slapd/assets/certs/rootCA.pem"
dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: "/container/service/slapd/assets/certs/ldap.crt"
dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: "/container/service/slapd/assets/certs/ldap.key"
#增加用户首次登陆更改密码
cat > "/data/openldap/init/ppolicy_changepasswd_at_first_time.ldif" << EOF
dn: uid=linux_user1,ou=People,dc=fly,dc=cn
changetype: modify
replace: pwdReset
pwdReset: TRUE
EOF
#删除该用户登陆更改密码属性
cat > "/data/openldap/init/ppolicy_delete_changepassword.ldif" << EOF
changetype: modify
delete: pwdReset
EOF
# 对于服务帐户,不使帐户过期更安全。
cat > "/data/openldap/init/ppolicy_1.ldif" << EOF
dn: cn=servicesaccounts, ou=Policies,dc=fly,dc=cn
cn: servicesaccounts
objectClass: top
objectClass: device
objectClass: pwdPolicy
pwdAllowUserChange: TRUE
pwdAttribute: userPassword
pwdExpireWarning: 0
pwdFailureCountInterval: 0
pwdGraceAuthNLimit: 5
pwdLockout: FALSE
pwdLockoutDuration: 0
pwdInHistory: 0
pwdMaxAge: 0
pwdMaxFailure: 0
pwdMinAge: 0
pwdMinLength: 15
pwdMustChange: FALSE
pwdSafeModify: FALSE
EOF
docker exec -i ldap ldapadd -Y EXTERNAL -H ldapi:/// -f /init/ppolicy_1.ldif
#配置日志输出界别
cat > "/data/openldap/init/log_out_console.ldif" << EOF
dn: cn=config
changetype: modify
add: olcLogLevel
olcLogLevel: -1
EOF
备份的三种方法
1、slapcat备份
cat >/data/openldap/init/backup/backup.sh <<EOF
#!/bin/bash
echo '准备开始备份ldap'
DATEFORMATTYPE=\$(date +%Y-%m-%d)
echo \$DATEFORMATTYPE
LDAPSCAT=/usr/sbin/slapcat
#备份目录
BACKDIR=/init/backup
docker exec -it ldap slapcat -l \${BACKDIR}/backup_\${DATEFORMATTYPE}.ldif
EOF
chmod +x /data/openldap/init/backup/backup.sh
bash /data/openldap/init/backup/backup.sh
slapcat恢复
#删除所有数据的操作
docker exec -it ldap ldapdelete -x -D "cn=admin,dc=fly,dc=cn" -w Openldap123456 -r "dc=fly,dc=cn"
docker exec -it ldap bash
2、整目录备份
cd /data/openldap
tar zcvf backup.tar.gz data config init certs
3、phpopenldap进行备份
#删除所有数据的操作
docker exec -it ldap ldapdelete -x -D "cn=admin,dc=fly,dc=cn" -w Openldap123456 -r "dc=fly,dc=cn"