OpenLDAP 部署及实践（二）

OpenLDAP部署

角色	主机名	操作系统	IP地址	备注
ldap-1	ldap1	CentOS7	192.168.3.11	VIP 192.168.3.10
ldap-2	ldap2	CentOS7	192.168.3.12	VIP 192.168.3.10
在两台OpenLDAP上都部署

1.安装OpenLDAP

1-1. 使用yum方式安装OpenLdap

yum install -y openldap openldap-servers openldap-clients compat-openldap
chown -R ldap.ldap /etc/openldap/
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown ldap.ldap /var/lib/ldap/DB_CONFIG

1-2. 启动slapd并开机自启动，查看端口386是否开启

systemctl restart slapd
yum install -y net-tools
netstat -atnulp | grep :389

2.配置OpenLDAP开启TLS

2-1. 采用ldif方式配置Openldap以TLS加密传输并打开636（默认的SSL连接端口）

mkdir /ldif_file
cd /ldif_file
ldapmodify -Y EXTERNAL -H ldapi:/// -f mod_ssl.ldif

sed -i "s#ldap:\/\/\/#& ldaps:\/\/\/#" /etc/sysconfig/slapd
systemctl restart slapd
yum install -y net-tools
netstat -atnulp | grep :636

mod_ssl.ldif 内容

dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/openldap/certs/CA.crt

replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/ldap.crt

replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/ldap.key

3.验证TLS是否配置成功

3-1. 通过CA证书公钥，验证ldap服务端证书的合法性

openssl verify -CAfile /etc/pki/CA/CA.crt /etc/openldap/certs/ldap.crt

/etc/openldap/certs/ldapsrv.crt: OK

3-2. 通过当前套接字是否能通过CA的验证

openssl s_client -connect $(hostname):636 -showcerts -state -CAfile /etc/openldap/certs/CA.crt

4.配置OpenLDAP的根域和管理员

4-1. 创建Openldap的管理员密码（记住加密后的密码，后续很多地方会使用）

slappasswd -s redhat

{SSHA}DbijN+dbVNqZ0XwFMTecd+PHwT249ILG

4-2. 查看OpenLDAP数据库相关ldif文件及名称

ls -l /etc/openldap/slapd.d/cn\=config

total 36
-rw------- 1 ldap ldap 537 Feb 3 13:38 cn=module{0}.ldif
-rw------- 1 ldap ldap 537 Feb 3 16:32 cn=module{1}.ldif
drwxr-x— 2 ldap ldap 4096 Feb 3 13:28 cn=schema
-rw------- 1 ldap ldap 378 Feb 2 10:58 cn=schema.ldif
-rw------- 1 ldap ldap 624 Feb 3 13:28 olcDatabase={0}config.ldif
-rw------- 1 ldap ldap 508 Feb 3 13:36 olcDatabase={-1}frontend.ldif
-rw------- 1 ldap ldap 603 Feb 3 13:29 olcDatabase={1}monitor.ldif
drwxr-x— 2 ldap ldap 4096 Feb 3 16:32 olcDatabase={2}hdb
-rw------- 1 ldap ldap 1251 Feb 3 13:53 olcDatabase={2}hdb.ldif
*—/

4-3.使用ldif文件，设置OpenLDAP的管理员密码

ldapadd -Y EXTERNAL -H ldapi:/// -f rootpw.ldif

dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}XSUcpSOL+nE1vTp2r9en29U3zBfSbi0M   ###刚刚生成的加密后密码

4-4.导入基本的schema配置

Schema控制着条目拥有哪些对象类和属性
使用ldapadd命令，执行下面的ldif文件，设置管理员密码

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif

4-5. 配置OpenLDAP的根域及其管理域

使用ldapmodify命令，创建根域及管理域

ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif

dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=admin,dc=boybo,dc=cn" read by * none

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=boybo,dc=cn

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=admin,dc=boybo,dc=cn

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}XSUcpSOL+nE1vTp2r9en29U3zBfSbi0M

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=boybo,dc=cn" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=admin,dc=boybo,dc=cn" write by * read

4-6. 创建admin的组织角色，用以管理整个OpenLDAP

导入admin组织的配置

ldapadd -x -D cn=admin,dc=boybo,dc=cn -W -f admin.ldif

# replace to your own domain name for "dc=***,dc=***" section
dn: dc=boybo,dc=cn
objectClass: top
objectClass: dcObject
objectclass: organization
o: LinLong company
dc: boybo

dn: cn=admin,dc=boybo,dc=cn
objectClass: organizationalRole
cn: admin
description: administrator

5.创建三个OU，分别是Group和People以及People下的Shenyang

在上述基础上，创建一个 boybo company的组织，People 和 Group 两个组织单元

ldapadd -x -D cn=admin,dc=boybo,dc=cn -W -f add_ou_Group_People.ldif

dn: ou=People,dc=boybo,dc=cn
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=boybo,dc=cn
objectClass: organizationalUnit
ou: Groupass: organizationalUnit
ou: Group

dn: ou=Shenyang,ou=People,dc=boybo,dc=cn
objectClass: organizationalUnit
ou: Shenyang

6.设定日志级别、日志轮滚

6-1. 设定日志级别

ldapmodify -Y EXTERNAL -H ldapi:/// -W -f change_log_level.ldif
grep "olcLogLevel" /etc/openldap/slapd.d/cn\=config.ldif

dn: cn=config
changetype: modify
add: olcLogLevel
olcLogLevel: -1

6-2. 设定日志轮滚

echo "local4.*                                                /var/log/slapd.log" >> /etc/rsyslog.conf
systemctl restart rsyslog
systemctl status rsyslog

6-3. 清除当前日志

ldapmodify -Y EXTERNAL -H ldapi:/// -W -f clean_log_level.ldif

dn: cn=config
changetype: modify
delete: olcLogLevel
olcLogLevel: -1   ###根据查询后的level清除日志级别

7.取消匿名登录

ldapmodify -Y EXTERNAL -H ldapi:/// -W -f no_anonymoun.ldif

dn: cn=config
changetype: modify
add: olcDisallows
olcDisallows: bind_anon

dn: cn=config
changetype: modify
add: olcRequires
olcRequires: authc

dn: olcDatabase={-1}frontend,cn=config
changetype: modify
add: olcRequires
olcRequires: authc

8.测试 创建一个用户并查询是否添加成功

8-1. 创建用户

ldapadd -x -D cn=admin,dc=boybo,dc=cn -W -f superman.ldif

### 查询用户
ldapsearch -LLL -W -x -H ldapi:/// -D "cn=admin,dc=boybo,dc=cn" -b "dc=boybo,dc=cn" "(uid=superman)"

dn: uid=superman,ou=Shenyang,ou=People,dc=boybo,dc=cn
uid: superman
cn: superman
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}$6$EJd1EaFj$7s3DPnTNxAuBumdWhl8vFyOg5pY5FcqgWoY3rbZRH4g0j34RcOfWIoQkJlkoSSh8ytRdqwK8.JhAp1aeSX03T.
shadowLastChange: 19019
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1011
gidNumber: 1006
homeDirectory: /home/superman
mail: 123@163.com
departmentNumber: openvpn
telephonenumber: 11012345678
displayName: 超人
sn: 超人