OpenLDAP 部署及实践（四）

OpenLDAP-WEB管理页面

角色	主机名	操作系统	IP地址	备注
ldap-1	ldap1	CentOS7	192.168.3.11	VIP 192.168.3.10
ldap-2	ldap2	CentOS7	192.168.3.12	VIP 192.168.3.10

1. 安装phpldapadmin

1-1.yum安装依赖及修改php.ini

yum -y install httpd perl-Sys-Syslog php php-mbstring php-pear php-ldap php-gd epel-release
cp -a /etc/php.ini{,_$(date +%F)}
sed -i 's#^;\(date\.timezone.*\)#\1 "Asia\/Shanghai"#' /etc/php.ini

1-2.安装phpldapadmin并修改phpldapadmin相关配置并重启httpd服务

yum -y install phpldapadmin
cp -a /etc/phpldapadmin/config.php{,_$(date +%F)}
sed -i 's#\/\/ \(\$servers->setValue.*attr.*dn.*\;\)#\1#' /etc/phpldapadmin/config.php
sed -i 's#\(^\$servers->setValue.*attr.*uid..\;\)#\/\/\1#' /etc/phpldapadmin/config.php
sed -i 's/\(Require \).*/\1all granted/' /etc/httpd/conf.d/phpldapadmin.conf
systemctl start httpd
systemctl enable httpd

1-3.登录

登录WEB页面 http://192.168.3.10/phpldapadmin/

输入登录DN: cn=admin,dc=boybo,dc=cn
密码: boybo
登录后，如截图所示

2. 安装LAM

LAM既 ldap-account-manager

2-1.安装相关软件并配置lam.conf

yum install -y bzip2
wget https://svwh.dl.sourceforge.net/project/lam/LAM/4.7.1/ldap-account-manager-4.7.1.tar.bz2
tar jxf ldap-account-manager-4.7.1.tar.bz2 -C /var/www/html
cd /var/www/html
mv ldap-account-manager-4.7.1 ldap-account
cd /var/www/html/ldap-account/config
cp -a lam.conf.sample lam.conf
cp -a config.cfg.sample  config.cfg
chown -R apache.apache /var/www/html

编辑lam.conf文件，具体内容参考下面配置文件

sed -i 's#\(admins: \)cn=Manager\(,dc=\)my-domain\(,dc=\)com#\1cn=admin\2boybo\3cn#' /var/www/html/ldap-account/config/lam.conf
PASSWORD='{SSHA}RjBruJcTxZEdcBjPQdRBkDaSQeY= iueleA=='
sed -i "s/\(^passwd: \).*/\1${PASSWORD}/" /var/www/html/ldap-account/config/lam.conf
sed -i 's/\(^treesuffix: \).*/\1dc=boybo,dc=cn /' /var/www/html/ldap-account/config/lam.conf
sed -i 's/\(^defaultLanguage: \).*/\1zh_CN.utf8 /' /var/www/html/ldap-account/config/lam.conf
DOMAIN_OU='ou=People,dc=boybo,dc=cn'
sed -i "s/\(^types: suffix_user: \).*/\1${DOMAIN_OU}/" /var/www/html/ldap-account/config/lam.conf
DOMAIN_GROUP='ou=Group,dc=boybo,dc=cn'
sed -i "s/\(^types: suffix_group: \).*/\1${DOMAIN_GROUP}/" /var/www/html/ldap-account/config/lam.conf
sed -i 's/dc=my-domain/dc=boybo/' /var/www/html/ldap-account/config/lam.conf

** lam.conf配置文件内容 **

ServerURL: ldap://localhost:389
Admins: cn=admin,dc=boybo,dc=cn
Passwd: {SSHA}RjBruJcTxZEdcBjPQdRBkDaSQeY= iueleA==
###密码为LinL0ng1DaP99
treesuffix: dc=boybo,dc=cn
###根域为boybo.cn
defaultLanguage: zh_CN.utf8
###使用中文简体
scriptPath:
scriptServer:
scriptRights: 750
cachetimeout: 5
searchLimit: 0
modules: posixAccount_minUID: 10000
modules: posixAccount_maxUID: 30000
modules: posixAccount_minMachine: 50000
modules: posixAccount_maxMachine: 60000
modules: posixGroup_minGID: 10000
modules: posixGroup_maxGID: 20000
modules: posixGroup_pwdHash: SSHA
modules: posixAccount_pwdHash: SSHA
activeTypes: user,group,host,smbDomain
types: suffix_user: ou=People,dc=boybo,dc=cn
###组织单元ou=People
types: attr_user: #uid;#givenName;#sn;#uidNumber;#gidNumber
types: modules_user: inetOrgPerson,posixAccount,shadowAccount,sambaSamAccount
types: suffix_group: ou=Group,dc=boybo,dc=cn
###组织单元ou=Group
types: attr_group: #cn;#gidNumber;#memberUID;#description
types: modules_group: posixGroup,sambaGroupMapping
types: suffix_host: ou=machines,dc=boybo,dc=cn
types: attr_host: #cn;#description;#uidNumber;#gidNumber
types: modules_host: account,posixAccount,sambaSamAccount
types: attr_smbDomain: sambaDomainName:Domain name;sambaSID:Domain SID
types: modules_smbDomain: sambaDomain
lamProMailSubject: Your password was reset
lamProMailText: Dear @@givenName@@ @@sn@@,+::++::+your password was reset to: @@newPassword@@+::++::++::+Best regards+::++::+deskside support+::+
useTLS: no
followReferrals: false
accessLevel: 100
loginMethod: list
loginSearchSuffix: dc=boybo,dc=cn
loginSearchFilter: uid=%USER%
loginSearchDN:
loginSearchPassword:
httpAuthentication: false
lamProMailFrom:
lamProMailReplyTo:
lamProMailIsHTML: false
lamProMailAllowAlternateAddress: true
tools: tool_hide_toolServerInformation: false
tools: tool_hide_toolFileUpload: false
tools: tool_hide_toolMultiEdit: false
tools: tool_hide_toolPDFEditor: false
tools: tool_hide_toolOUEditor: false
tools: tool_hide_toolProfileEditor: false
tools: tool_hide_toolTests: false
tools: tool_hide_toolSchemaBrowser: false

注意:配置的时候需要把本段配置文件中 注释讲解的地方全部删除，否则会有报错

2-2.重启httpd服务

systemctl restart httpd

2-3. 登录

浏览器输入地址: http://192.168.3.10/ldap-account
输入admin的密码: boybo

3. 使用 LDAP Admin

LDAP Admin是一款运行在Windows系统上连接OpenLDAP的工具
官网地址:
下载地址:
下载后解压即可使用