Centos7安装配置OpenLDAP与LDAPadmin

目录

安装配置OpenLDAP服务

配置OpenLDAP

添加一个用户

参考链接

---

安装配置OpenLDAP服务

1. yum方式安装OpenLDAP服务

yum -y install openldap compat-openldap openldap-clients openldap-servers openldap-servers-sql openldap-devel migrationtools

2. 查看版本

3. 拷贝数据库配置配置文件，并启动服务

cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG 

修改数据目录权限给ldap用户，此用户在安装时已自动创建

chown ldap:ldap -R /var/lib/ldap/  
chmod 700 -R /var/lib/ldap

我不知道别人为什么安装很顺利，我这里出了一些报错，多加几个命令

chmod 777 /var/run/openldap/slapd.args

设置开机启动

systemctl enable slapd
systemctl start slapd
systemctl status slapd

配置OpenLDAP

1. 准备加密后的密码（加了盐）

[root@localhost zhaoyun]# slappasswd -s "passwd"
{SSHA}vqlSc07S0e/0ko+NP0CHz/jfo80Y7zpP

cat changepwd.ldif
#this is OpenLDAP admin password 
dn: olcDatabase={0}config,cn=config 
changetype: modify 
add: olcRootPW 
olcRootPW: {SSHA}rgA7eR9GYjUYFcWS/W519wzC35rWE0sn

执行命令，有5个modifying 表示修改全部修改成功

ldapadd -Y EXTERNAL -H ldapi:/// -f changepwd.ldif

温馨提示：如果上面的命令出现下面报错：

[root@openldap-master opt]# ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif

SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={0}config,cn=config" ldap_modify: Inappropriate matching (18) additional info: modify/add: olcRootPW: no equality matching rule

解决办法：修改modify.ldif中对应选项的"add"为"replace"即可

2. 导入基本模式

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif 

3. 在OpenLDAP DB上配置域信息

[root@localhost zhaoyun]# cat changedomain.ldif 
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
  read by dn.base="cn=Manager,dc=cloud,dc=cn" read by * none

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=cloud,dc=cn

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=cloud,dc=cn

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: {SSHA}vqlSc07S0e/0ko+NP0CHz/jfo80Y7zpP

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
  dn="cn=Manager,dc=cloud,dc=cn" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=cloud,dc=cn" write by * read

ldapmodify -Y EXTERNAL -H ldapi:/// -f changedomain.ldif 

温馨提示：如果上面的命令出现下面报错：

....... ldap_modify: Inappropriate matching (18) additional info: modify/add: olcRootPW: no equality matching rule

解决办法：将chdomain.ldif文件中的"add"全部替换成"replace"，然后重新执行上面命令即可！

4. 关闭匿名用户访问

cat >disable_anamouse.dif << EOF
dn: cn=config
changetype: modify
add: olcDisallows
olcDisallows: bind_anon
dn: cn=config
changetype: modify
add: olcRequires
olcRequires: authc
dn: olcDatabase={-1}frontend,cn=config
changetype: modify
add: olcRequires
olcRequires: authc
EOF

ldapadd -Y EXTERNAL -H ldapi:/// -f disable_anamouse.dif

5. 基础

[root@localhost zhaoyun]# cat basedomain.ldif 
dn: dc=cloud,dc=cn
objectClass: top
objectClass: dcObject
objectclass: organization
o: cloud
dc: cloud

dn: cn=Manager,dc=cloud,dc=cn
objectClass: organizationalRole
cn: Manager
description: Directory Manager

dn: ou=People,dc=cloud,dc=cn
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=cloud,dc=cn
objectClass: organizationalUnit
ou: Group

ldapadd -x -D cn=Manager,dc=cloud,dc=cn -W -f basedomain.ldif

ladpadmin链接测试

工具下载地址：

https://download.csdn.net/download/u012206617/89584400

添加一个用户

[root@localhost zhaoyun]# slappasswd -s "123456"
{SSHA}Qq/NAkTxLmqXdhCyHKzJZIdo6Y/xyF1w

cat vim ldapuser.ldif
dn: uid=xuanll,ou=People,dc=cloud,dc=cn
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: xuanll
sn: Linux
userPassword: {SSHA}Qq/NAkTxLmqXdhCyHKzJZIdo6Y/xyF1w
loginShell: /bin/bash
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/test

dn: cn=test,ou=Group,dc=cloud,dc=cn
objectClass: posixGroup
cn: test
gidNumber: 1000
memberUid: test

ldapadd -x -D cn=Manager,dc=cloud,dc=cn -W -f ldapuser.ldif 

参考链接

在Centos7上部署LDAP服务_centos系统怎么搭建ldap服务-CSDN博客

CentOS7安装配置OpenLDAP与phpLDAPadmin