实验环境:
操作系统:Centos 7.4
服务器ip:192.168.3.41
运行用户:root
网络环境:Internet
LDAP(轻量级目录访问协议)是一个能实现提供被称为目录服务的信息服务,也是一套用户认证体系系统;一般在大型企业、学校、政府单位使用的比较多,LDAP是由4部分组成,这4部分分别是slapd(独立LDAP守护进程)、slurpd(独立的LDAP更新复制守护进程)、LDAP协议库、工具软件和示例客户端(phpLDAPadmin),目录服务是一种特殊的数据库系统,用来存储用户信息的数据库,读写速度非常快,扩展性非常强,可以实现与地方系统直接对接整合起来统一管理用户信息。
![bdfd9aec022f4822636a885a3fccc879.png](https://i-blog.csdnimg.cn/blog_migrate/464cfa1d23ef3bd0cccc7f48665a2c02.jpeg)
LDAP说起来也不简单,但是ALDP在Linux应用范围是比较广泛的,如果想要深入的了解LDAP,建议去看下刘遄老师这本教程,里面解释的非常详细,也可以在百度输入此书名去官网看,想要在Linux部署还是推荐这本书去系统的学习,对初学者还是很有版本的,这篇文章搭建ldap+phpldapadmin也是在Linux环境下运行的,所以还是需要Linux基础才能看懂下面的配置步骤。
1、安装OpenLDAP
[root@centos7 ~]# yum install openldap-servers openldap-clients -y
![c1c4ca54680e323116dcc0458f01132d.png](https://i-blog.csdnimg.cn/blog_migrate/83f1f72ff11078acf3f82a8da8d9e6c8.jpeg)
[root@centos7 ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@centos7 ~]# ll /var/lib/ldap/DB_CONFIG
-rw-r--r--. 1 root root 845 Aug 1 10:04 /var/lib/ldap/DB_CONFIG
[root@centos7 ~]# chown ldap. /var/lib/ldap/DB_CONFIG //授权配置文件
[root@centos7 ~]# more /etc/passwd|grep ldap
ldap:x:55:55:OpenLDAP server:/var/lib/ldap:/sbin/nologin
![85bb7c6b1c33dacf51f72d289c20c352.png](https://i-blog.csdnimg.cn/blog_migrate/771a258314a976283c01637fc962ebda.jpeg)
[root@centos7 ~]# systemctl start slapd.service //启动slapd服务
[root@centos7 ~]# systemctl enable slapd.service //设置开机自动启动slapd服务
2、设置OpenLDAP管理员密码
[root@centos7 ~]# slappasswd
New password: //password
Re-enter new password:
{SSHA}d5pkA0TU6b+8/kEoMIxJ59QofCLV
为"olcRootPW"指定上面生成的密码
[root@centos7 ~]# vim chrootpw.ldif
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}d5pkA0TU6b+8/kEokgQeMIxJ59QofCLV
![216a919fef8a658be0fe76a1a5ff8f45.png](https://i-blog.csdnimg.cn/blog_migrate/22c5e27e7a1b6d66153fc6f17c966213.jpeg)
[root@centos7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={0}config,cn=config"
3、导入基本模式
[root@centos7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=cosine,cn=schema,cn=config"
[root@centos7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=nis,cn=schema,cn=config"
[root@centos7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=inetorgperson,cn=schema,cn=config"
![9dcf3d7fbbf0a98b5ba0594c85011965.png](https://i-blog.csdnimg.cn/blog_migrate/fd3f0d48e33009ab20d55301a8b910ff.jpeg)
4、在LDAP DB上设置域名,生成目录管理器密码
[root@centos7 ~]# slappasswd
New password:
Re-enter new password:
{SSHA}Oq61fgUFW9+ItZboTaW1+VbLuAYst7zw
注意:下面配置文件这里得注意每一个属性: 后必须有空格,但是值的后面不能有任何空格
[root@centos7 ~]# vim chdomain.ldif
# replace to your own domain name for "dc=***,dc=***" section
# specify the password generated above for "olcRootPW" section
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
read by dn.base="cn=Manager,dc=srv,dc=world" read by * none
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=srv,dc=world
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=srv,dc=world
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}Oq61fgUFW9+ItZboTaW1+VbLuAYst7zw
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
dn="cn=Manager,dc=srv,dc=world" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=srv,dc=world" write by * read
[root@centos7 ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={1}monitor,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
[root@centos7 ~]# vim basedomain.ldif
# replace to your own domain name for "dc=***,dc=***" section
dn: dc=srv,dc=world
objectClass: top
objectClass: dcObject
objectclass: organization
o: Server World
dc: Srv
dn: cn=Manager,dc=srv,dc=world
objectClass: organizationalRole
cn: Manager
description: Directory Manager
dn: ou=People,dc=srv,dc=world
objectClass: organizationalUnit
ou: People
dn: ou=Group,dc=srv,dc=world
objectClass: organizationalUnit
ou: Group
[root@centos7 ~]# ldapadd -x -D "cn=Manager,dc=srv,dc=world" -W -f basedomain.ldif
Enter LDAP Password: //输入上面设置的目录管理器密码 password
adding new entry "dc=srv,dc=world"
adding new entry "cn=Manager,dc=srv,dc=world"
adding new entry "ou=People,dc=srv,dc=world"
adding new entry "ou=Group,dc=srv,dc=world"
![039d893ca1e64e939c8d6105bf0c925c.png](https://i-blog.csdnimg.cn/blog_migrate/1ce8930b92695301f280721535de7373.jpeg)
[root@centos7 ~]# ldapsearch -x -b "cn=Manager,dc=srv,dc=world"
# extended LDIF
#
# LDAPv3
# base with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# Manager, srv.world
dn: cn=Manager,dc=srv,dc=world
objectClass: organizationalRole
cn: Manager
description: Directory Manager
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
5、设置Firewalld,如果未启用防火墙关闭,忽略
[root@centos7 ~]# firewall-cmd --add-service=ldap --permanent
[root@centos7 ~]# firewall-cmd --reload
6、安装并配置Apache
[root@centos7 ~]# yum install httpd-devel.x86_64 httpd.x86_64 -y
[root@centos7 ~]# mv /etc/httpd/conf.d/welcome.conf /etc/httpd/conf.d/welcome.conf.bak
[root@centos7 ~]# vim /etc/httpd/conf/httpd.conf
# line 86: change to admin's email address
ServerAdmin root@srv.world
![6b6165e3759da18dca7ebf89cb00742f.png](https://i-blog.csdnimg.cn/blog_migrate/3bef99510e53468619e3836b3d043818.jpeg)
# line 95: change to your server's name
ServerName www.srv.world:80
![18fd63f1ebd6229c258b755780cdea78.png](https://i-blog.csdnimg.cn/blog_migrate/775590b363a6e3ad7a94e54062946543.jpeg)
# line 151: change
AllowOverride All
![ae82155aa2032f190ab5dd8a4fd92b02.png](https://i-blog.csdnimg.cn/blog_migrate/1803dd86c2808e60c7d6c86f81a8d3f9.jpeg)
# line 164: add file name that it can access only with directory's name
DirectoryIndex index.html index.cgi index.php
![abab90efaf6d487a94eaeb60a3d0417f.png](https://i-blog.csdnimg.cn/blog_migrate/2c94982a6b97c9957111297c0845c25a.jpeg)
# add follows to the end //在尾部新增
# server's response header
ServerTokens Prod
# keepalive is ON
KeepAlive On
![cf0d2b68e1d206407ae8af43e53e7e5d.png](https://i-blog.csdnimg.cn/blog_migrate/05d22903114ad65ba48858d85b39f68c.jpeg)
[root@centos7 ~]# systemctl start httpd.service
[root@centos7 ~]# systemctl enable httpd.service
[root@centos7 ~]# firewall-cmd --add-service=http --permanent //防火墙排除httpd服务,如果没有启用防火墙,此步骤可以忽略。
success
[root@centos7 ~]# firewall-cmd --reload //重新加载firewall
success
[root@centos7 ~]# vim /var/www/html/index.html //测试apache服务
Test Page
测试:http://192.168.3.41/index.html
![007e56feb47bdbbf8421f1a71da62d59.png](https://i-blog.csdnimg.cn/blog_migrate/2444fcb5f35893d6ecbd4bba5095904b.jpeg)
7、安装PHP
[root@centos7 ~]# yum -y install php php-mbstring php-pear
[root@centos7 ~]# vim /etc/php.ini
#修改时区 878行
date.timezone = Asia/Shanghai
![a5caea42a0291673b63380d49b0ef38c.png](https://i-blog.csdnimg.cn/blog_migrate/d415925d2d1a9f7271d5248e7de1727c.jpeg)
[root@centos7 ~]# systemctl restart httpd.service
[root@centos7 ~]# vim /var/www/html/index.php
print Date("Y/m/d");
?>
php打印日期
测试:http://192.168.3.41/index.php
![83ac0884b7add98fa6e05e32d3f98d62.png](https://i-blog.csdnimg.cn/blog_migrate/b3247e1bca6e34e5a2a81e0cd8ebf01b.jpeg)
可以不安装phpLDAPadmin工具,直接下载Windows系统下的LdapAdmin应用程序
8、安装phpLDAPadmin
[root@centos7 ~]# yum install phpldapadmin.noarch -y
[root@centos7 ~]# vim /etc/phpldapadmin/config.php
397 $servers->setValue('login','attr','dn'); #取消397行注释
398 //$servers->setValue('login','attr','uid'); #注释398
![9505bbcc847025d22b098365661514cb.png](https://i-blog.csdnimg.cn/blog_migrate/04d4999a0f4f9ac0e645c0821b667748.jpeg)
[root@centos7 ~]# vim /etc/httpd/conf.d/phpldapadmin.conf
#
# Web-based tool for managing LDAP servers
#
Alias /phpldapadmin /usr/share/phpldapadmin/htdocs
Alias /ldapadmin /usr/share/phpldapadmin/htdocs
# Apache 2.4
#只允许本地请求访问
# Require local
#允许所有的请求访问
Require all granted
#允许IP段访问
#Require ip 10.0.0.0/24
# Apache 2.2
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
Allow from ::1
[root@centos7 ~]# systemctl restart httpd.service
[root@centos7 ~]# systemctl status httpd.service
![7c1967eb1bef6652416737d122d815d9.png](https://i-blog.csdnimg.cn/blog_migrate/10a3b287249b7926c41722651760aecf.jpeg)
测试:http://192.168.3.41/ldapadmin/
![cbc1306cf5c594badd1fe15a3b48b328.png](https://i-blog.csdnimg.cn/blog_migrate/a282870bea6cabd35b348c4d8d762c8d.jpeg)
如果是按照上面配置执行的操作,登录一直提示失败,需要执行
[root@centos7 ~]# setsebool -P httpd_can_connect_ldap on
cn=Manager,dc=srv,dc=world
![784f494b44b435082f9f5262b3173025.png](https://i-blog.csdnimg.cn/blog_migrate/b3af6a6969c6f0801e0f770155c0ac98.jpeg)
![d3d162cc4ac27275f9289fb9b278ef0b.png](https://i-blog.csdnimg.cn/blog_migrate/9fd4123cf193244ea8a2b2fa2d997ae9.jpeg)
9、基本操作和使用
9.1、添加组
![d989ff829a4ec18e88c4b1993f92d5ee.png](https://i-blog.csdnimg.cn/blog_migrate/c8b1f7b8adad8a76f7ee6ff501a199d7.jpeg)
![99ca7568224e2a913f4595cd6601e557.png](https://i-blog.csdnimg.cn/blog_migrate/4954f56913eb977870d481a40a3443b8.jpeg)
9.2、添加用户
![beb425e366c0b73de9bcf13136086084.png](https://i-blog.csdnimg.cn/blog_migrate/12b49ec30e1e8c02f10f6462bd4a36de.jpeg)
9.3、phpldapadmin的网站的apache配置文件
# vim /etc/httpd/conf.d/phpldapadmin.conf
#
# Web-based tool for managing LDAP servers
#
Alias /phpldapadmin /usr/share/phpldapadmin/htdocs
Alias /ldapadmin /usr/share/phpldapadmin/htdocs
#注意:/usr/share/phpldapadmin/htdocs 是phpldapadmin根目录
# Apache 2.4
#只允许本地请求访问
# Require local
#允许所有的请求访问
Require all granted
#允许IP段访问
#Require ip 192.168.3.0/24
# Apache 2.2
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
Allow from ::1
这里可以直接访问phpldapadmin后台,最好是通过apache做密码验证才能登录,这样比较安全。
参考文献:
10、禁止匿名用户登录
# vim /root/ldap_disable_bind_anon.ldif
angetype: modify
add: olcDisallows
olcDisallows: bind_anon
dn: cn=config
changetype: modify
add: olcRequires
olcRequires: authc
dn: olcDatabase={-1}frontend,cn=config
changetype: modify
add: olcRequires
olcRequires: authc
[root@centos7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f ldap_disable_bind_anon.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
modifying entry "olcDatabase={-1}frontend,cn=config"
[root@centos7 ~]# systemctl restart slapd.service