OpenLDAP 部署及实践（五）

OpenLDAP 自助更改密码

1. 更新OpenLDAP配置

1-1. 给数据库olcDatabase{2}hdb.ldif添加一个ACL信息

ldapmodify -Y EXTERNAL -H  ldapi:/// -f updatepass.ldif

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: to attrs=userPassword
        by dn="cn=admin,dc=boybo,dc=cn" write
        by dn.children="cn=admin,dc=boybo,dc=cn" write
        by anonymous auth
        by self write
        by * none
olcAccess: to *
        by dn="cn=admin,dc=boybo,dc=cn" write
        by dn.children="cn=admin,dc=boybo,dc=cn" write
        by * read

2.下载第三方软件（self-service-password）

用于页面更改ldap用户密码

2-1. 安装self-service-password软件

配置self-service-password的yum仓库

cat << EOF > /etc/yum.repos.d/ltb-project.repo
[ltb-project-noarch]
name=LTB project packages (noarch)
baseurl=https://ltb-project.org/rpm/\$releasever/noarch
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-LTB-project
EOF

rpm --import https://ltb-project.org/wiki/lib/RPM-GPG-KEY-LTB-project

yum update -y
yum install -y apr libzip php-common apr-util httpd-tools mailcap.noarch php-cli php-ldap php-mcrypt sendmail
yum install -y self-service-password

2-2. 配置http服务，更改self-service-password服务的监听端口

cat > /etc/httpd/conf.d/self-service-password.conf << "EOF"
Listen 88
<VirtualHost *:88>
       ServerName 192.168.3.10
       DocumentRoot /usr/share/self-service-password
       DirectoryIndex index.php
       AddDefaultCharset UTF-8
      <Directory "/usr/share/self-service-password">
            AllowOverride None
            Require all granted
      </Directory>
      LogLevel warn
      ErrorLog /var/log/httpd/ssp_error_log
      CustomLog /var/log/httpd/ssp_access_log combined
</VirtualHost>
EOF

2-3. 配置self-service-password服务连接OpenLDAP及发送邮件

cp -a /usr/share/self-service-password/conf/config.inc.php{,_backup}
cat > /usr/share/self-service-password/conf/config.inc.php << "EOF"
<?php
$debug = false;
$ldap_url = "ldap://192.168.3.10";
$ldap_starttls = false;
$ldap_binddn = "cn=admin,dc=boybo,dc=cn";
$ldap_bindpw = "boybo";
$ldap_base = "dc=boybo,dc=cn";
$ldap_login_attribute = "uid";
$ldap_fullname_attribute = "cn";
$ldap_filter = "(&(objectClass=person)($ldap_login_attribute={login}))";
$ad_mode = false;
$ad_options['force_unlock'] = false;
$ad_options['force_pwd_change'] = false;
$ad_options['change_expired_password'] = false;
$samba_mode = false;
$shadow_options['update_shadowLastChange'] = false;
$shadow_options['update_shadowExpire'] = false;
$shadow_options['shadow_expire_days'] = -1;
$hash = "clear";
$hash_options['crypt_salt_prefix'] = "$6$";
$hash_options['crypt_salt_length'] = "6";
$pwd_min_length = 0;
$pwd_max_length = 0;
$pwd_min_lower = 0;
$pwd_min_upper = 0;
$pwd_min_digit = 0;
$pwd_min_special = 0;
$pwd_special_chars = "^a-zA-Z0-9";
$pwd_no_reuse = true;
$pwd_diff_login = true;
$pwd_complexity = 0;
$use_pwnedpasswords = false;
$pwd_show_policy = "never";
$pwd_show_policy_pos = "above";
$who_change_password = "user";
$use_change = true;
$change_sshkey = false;
$change_sshkey_attribute = "sshPublicKey";
$who_change_sshkey = "user";
$notify_on_sshkey_change = false;
$use_questions = false;
$answer_objectClass = "extensibleObject";
$answer_attribute = "info";
$crypt_answers = true;
$use_tokens = true;
$crypt_tokens = true;
$token_lifetime = "3600";
$mail_attribute = "mail";
$mail_address_use_ldap = false;
$mail_from = "devops@win-stock.com.cn";
$mail_from_name = "OpenLDAP-Server";
$mail_signature = "";
$notify_on_change = true;
$mail_sendmailpath = '/usr/sbin/sendmail';
$mail_protocol = 'smtp';
$mail_smtp_debug = 0;
$mail_debug_format = 'html';
$mail_smtp_host = 'smtphz.qiye.163.com';
$mail_smtp_auth = true;
$mail_smtp_user = '123@123.163.com;
$mail_smtp_pass = '123456';
$mail_smtp_port = 587;
$mail_smtp_timeout = 30;
$mail_smtp_keepalive = false;
$mail_smtp_secure = 'tls';
$mail_smtp_autotls = true;
$mail_contenttype = 'text/plain';
$mail_wordwrap = 0;
$mail_charset = 'utf-8';
$mail_priority = 3;
$mail_newline = PHP_EOL;
$use_sms = false;
$sms_method = "mail";
$sms_api_lib = "lib/smsapi.inc.php";
$sms_attribute = "mobile";
$sms_partially_hide_number = true;
$smsmailto = "{sms_attribute}@service.provider.com";
$smsmail_subject = "Provider code";
$sms_message = "{smsresetmessage} {smstoken}";
$sms_sanitize_number = false;
$sms_truncate_number = false;
$sms_truncate_number_length = 10;
$sms_token_length = 6;
$max_attempts = 3;
$keyphrase = "ldapchangepasswd";
$show_help = true;
$lang = "en";
$allowed_lang = array();
$show_menu = true;
$logo = "images/ltb-logo.png";
$login_forbidden_chars = "*()&|";
$use_recaptcha = false;
$recaptcha_publickey = "";
$recaptcha_privatekey = "";
$recaptcha_theme = "light";
$recaptcha_type = "image";
$recaptcha_size = "normal";
$recaptcha_request_method = null;
$default_action = "change";
if (file_exists (__DIR__ . '/config.inc.local.php')) {
    require __DIR__ . '/config.inc.local.php';
}
EOF

2-4.self-service-password WEB页面调整

注释 self-service-password.css文件中第一段html内容

/*
html, body {
  background: #eee;
  padding-top: 20px;
  font-size: 12pt;
}
*/

添加一段内容到index.php并重启http服务

cd /usr/share/self-service-password
cp index.php{,_backup_$(date +%F)}
sed -i "/<\/body/i\<script type=text/javascript color=0,205,205 opacity='1' zIndex=-2 count=99  src=//cdn.bootcss.com/canvas-nest.js/1.0.1/canvas-nest.min.js></script>" index.php
systemctl restart httpd

3.自助修改密码

3-1.主动修改密码

使用浏览器输入地址: http://192.168.3.10:88
点击“自助修改密码服务”，输入用户名和旧密码
然后输入两次新密码更改用户密码

3-2. 忘记密码

使用浏览器输入地址: http://192.168.3.10:88
点击**“邮件”**
输入ldap的用户名 以及该用户对应的Email邮箱地址

若用户没有配置邮件或者用户邮件与记录不符，则更改密码失败