参考链接:
https://blog.51cto.com/10788142/2167923#h26
LDAP 和Kerberos假设已经安装完成,可以看我前面的博客
LDAP:host1
Kerberos:host2
一、LDAP服务端
1.yum安装krb5-server-ldap
yum install krb5-server-ldap -y
2.配置kerberos的schema
cp /usr/share/doc/krb5-server-ldap-1.15.1/kerberos.schema /etc/openldap/schema/
cd /opt
touch schema_convert.conf
vim schema_convert.conf
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/collective.schema
include /etc/openldap/schema/corba.schema
include /etc/openldap/schema/duaconf.schema
include /etc/openldap/schema/dyngroup.schema
include /etc/openldap/schema/java.schema
include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/openldap.schema
include /etc/openldap/schema/pmi.schema
include /etc/openldap/schema/ppolicy.schema
include /etc/openldap/schema/kerberos.schema
注意:上面schema中的顺序要和/etc/openldap/slapd.d/cn=config/cn=schema中ldif文件一致,不然kerberos schema会报错
3.生成kerberos schema,下面命令中的13是上面schema中的索引位置,根据情况而定
slapcat -f schema_convert.conf -F /tmp/ -n 0 -s "cn={13}kerberos,cn=schema,cn=config" > /tmp/cn=kerberos.ldif
4.修改tmp下的kerberos.ldif
vim /tmp/cn\=kerberos.ldif
并注释掉如下属性
#structuralObjectClass: olcSchemaConfig
#entryUUID: 02b11972-d310-1037-80c6-774a6a5fe133
#creatorsName: cn=config
#createTimestamp: 20180413024211Z
#entryCSN: 20180413024211.191038Z#000000#000#000000
#modifiersName: cn=config
#modifyTimestamp: 20180413024211Z
5.将kerberos schema导入到ldap
ldapadd -x -D "cn=config" -w 123456 -f /tmp/cn\=kerberos.ldif
6.重启ldap
systemctl restart slapd
二、kerberos服务端
1.yum安装krb5-server-ldap
yum install krb5-server-ldap -y
2. 生成LDAP数据库的密码文件
kdb5_ldap_util -D cn=admin,dc=yaobili,dc=com -w 123456 stashsrvpw -f /etc/krb5.ldap cn=admin,dc=yaobili,dc=com
输入密码
3.ldap页面为kerberos创建一个krb 分支
4.修改kerberos
vi /var/kerberos/krb5kdc/kdc.conf
HENGHE.COM = {
……
database_module = openldap_ldapconf
}
增加[dbdefaults]和[dbmodules]字段
[dbdefaults]
ldap_kerberos_container_dn = cn=krb,dc=yaobili,dc=com
[dbmodules]
openldap_ldapconf = {
db_library = kldap
ldap_servers = ldap://host1IP
ldap_kerberos_container_dn = cn=krb,dc=yaobili,dc=com
ldap_kdc_dn = cn=admin,dc=yaobili,dc=com
ldap_kadmind_dn = cn=admin,dc=yaobili,dc=com
ldap_service_password_file = /etc/krb5.ldap
ldap_conns_per_server = 5
}
5. 创建kerberos的LDAP数据库
kdb5_ldap_util -D cn=admin,dc=yaobili,dc=com -w 123456 -H ldap://host1IP:389 create -r HENGHE.COM -s
输入密码
6. 启动kerberos服务
systemctl restart krb5kdc
systemctl restart kadmin
7.登录LDAP页面,可以看到kerberos用户和ldap相互同步