OpenLDAP+freeradius+samba+802.1x实现无线和有线网络认证+动态vlan下发——openLDAP篇
全部都是开源工具,顺便学习一下openldap的用户管理。
也欢迎大家来我的个人博客网站www.lichunpeng.cn查看本文章及后续章节。
文章目录
一、环境准备
1.服务器环境信息
名称 | 系统版本 | 配置 | ip地址 |
---|---|---|---|
ldap-master | CentOS 7.6(core) | 2c 2g 50g | 192.168.2.147 |
ldap-slave | CentOS 7.6(core) | 2c 2g 50g | 192.168.2.150 |
redius-master | CentOS 7.6(core) | 2c 2g 50g | 192.168.3.140 |
redius-slave | CentOS 7.6(core) | 2c 2g 50g | 192.168.3.141 |
CA服务器 | CentOS 7.6(core) | 1c 1g 16g | 192.168.2.148 |
客户机 | Windows7 | 2c 2g 50g | 192.168.3.150 |
2.初始化服务器配置
(脚本里的网卡名称要注意)
#/bin/bash
echo "Enter your system information"
###关闭防火墙、NetworkManager、SELinux###
systemctl stop firewalld
systemctl disable firewalld
systemctl stop NetworkManager
systemctl disable NetworkManager
setenforce 0
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
###关闭防火墙、NetworkManager、SELinux###
##安装一些常用的软件##
yum -y install vim tree wget net-tools ntpdate
###同步时间
ntpdate ntp1.aliyun.com
echo "* */1 * * * /usr/sbin/ntpdate ntp1.aliyun.com > /dev/null 2>&1" > /var/spool/cron/root
##更改yum源为阿里云源
mkdir /etc/yum.repos.d.bak ; mv /etc/yum.repos.d/* /etc/yum.repos.d.bak
wget -O /etc/yum.repos.d/aliyun-centos7-base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
wget -O /etc/yum.repos.d/aliyun-centos7-epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
yum clean all
yum makecache
####网卡配置
m1=`ifconfig ens192 | grep "ether"| tr -s " " %|cut -d% -f3`
cd /etc/sysconfig/network-scripts/
echo "HWADDR=$m1" >> ifcfg-ens192
mv ifcfg-ens192 ifcfg-eth0
sed -i 's/ens192/eth0/g' ifcfg-eth0
cat > /etc/udev/rules.d/70-persistent-net.rules <<EOF
SUBSYSTEM=="net",ACTION=="add",DRIVERS=="?*",ATTR{address}=="$m1",ATTR{type}=="1",KERNEL=="eth*",NAME="eth0"
EOF
##创建几个需要的文件夹
mkdir /data
###PS1
echo 'export PS1="\[\e[37;40m\][\[\e[31;40m\]\u\[\e[37;40m\]@\h \[\e[36;40m\](\t)\w\[\e[0m\]]\\$ "' >> /root/.bashrc
3.保存快照防止误操作导致系统崩溃
重启后开始部署ldap环境
二、LDAP环境搭建
1.确保已联网
[root@lcp (13:49:35)~]# ping www.baidu.com
PING www.a.shifen.com (61.135.169.125) 56(84) bytes of data.
64 bytes from 61.135.169.125 (61.135.169.125): icmp_seq=1 ttl=128 time=3.11 ms
^C
--- www.a.shifen.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 3.111/3.111/3.111/0.000 ms
2.安装所需软件包
[root@ldap-master (11:21:26)~]# yum -y install openldap openldap-servers openldap-clients compat-openldap openldap-devel migrationtools samba* freeradius*
3.LDAP配置文件存放目录
[root@ldap-master (11:21:26)~]# cd /etc/openldap/
[root@ldap-master (11:25:33)/etc/openldap]# tree slapd.d
slapd.d
├── cn=config
│ ├── cn=schema
│ │ └── cn={
0}core.ldif #核心配置文件
│ ├── cn=schema.ldif #schema配置文件
│ ├── olcDatabase={
0}config.ldif #关于全局的配置文件
│ ├── olcDatabase={
-1}frontend.ldif #关于前端的配置文件
│ ├── olcDatabase={
1}monitor.ldif #关于监控的配置文件
│ └── olcDatabase={
2}hdb.ldif #关于数据库的配置文件
└── cn=config.ldif #关于全局配置的文件
2 directories, 7 files
4.配置LDAP
1.备份配置文件目录
[root@ldap-master (11:25:35)/etc/openldap]# mv slapd.d{,.bak}
[root@ldap-master (11:26:16)/etc/openldap]# ls
certs check_password.conf ldap.conf schema slapd.d.bak
[root@ldap-master (11:26:23)/etc/openldap]# mkdir slapd.d
[root@ldap-master (11:26:30)/etc/openldap]# slappasswd
New password: 123456
Re-enter new password: 123456
{
SSHA}hnxiKpbSXyzF1sazYma5FBlkdD39dpU6 #复制保存好,一会要用到
[root@ldap-master (11:26:43)/etc/openldap]# cp /usr/share/openldap-servers/slapd.ldif ./ #复制slapd.ldif配置文件到此目录下
2.复制需要的schema到/etc/openldap/schema目录下
这里把samba和radius的schema都复制过来。
cp /usr/share/doc/freeradius-3.0.13/schemas/ldap/openldap/freeradius.ldif /etc/openldap/schema/
cp /usr/share/doc/freeradius-3.0.13/schemas/ldap/openldap/freeradius.schema /etc/openldap/schema/
cp /usr/share/doc/samba-4.9.1/LDAP/samba.schema /etc/openldap/schema/
cp /usr/share/doc/samba-4.9.1/LDAP/samba.ldif /etc/openldap/schema/
3.编辑配置文件
[root@ldap-master (11:31:23)/etc/openldap]# cat slapd.ldif
#
# See slapd-config(5) for details on configuration options.
# This file should NOT be world readable.
#
dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/openldap/slapd.args
olcPidFile: /var/run/openldap/slapd.pid
#
# TLS settings
#
olcTLSCACertificatePath: /etc/openldap/certs
olcTLSCertificateFile: "OpenLDAP Server"
olcTLSCertificateKeyFile: /etc/openldap/certs/password
#
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#
#olcReferral: ldap://root.openldap.org
#
# Sample security restrictions
# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 64-bit encryption for simple bind
#
#olcSecurity: ssf=1 update_ssf=112 simple_bind=64
#
# Load dynamic backend modules:
# - modulepath is architecture dependent value (32/64-bit system)
# - back_sql.la backend requires openldap-servers-sql package
# - dyngroup.la and dynlist.la cannot be used at the same time
#
#dn: cn=module,cn=config
#objectClass: olcModuleList
#cn: module
#olcModulepath: /usr/lib/openldap
#olcModulepath: /usr/lib64/openldap
#olcModuleload: accesslog.la
#olcModuleload: auditlog.la
#olcModuleload: back_dnssrv.la
#olcModuleload: back_ldap.la
#olcModuleload: back_mdb.la
#olcModuleload: back_meta.la
#olcModuleload: back_null.la
#olcModuleload: back_passwd.la
#olcModuleload: back_relay.la
#olcModuleload: back_shell.la
#olcModuleload: back_sock.la
#olcModuleload: collect.la
#olcModuleload: constraint.la
#olcModuleload: dds.la
#olcModuleload: deref.la
#olcModuleload: dyngroup.la
#olcModuleload: dynlist.la
#olcModuleload: memberof.la
#olcModuleload: pcache.la
#olcModuleload: ppolicy.la
#olcModuleload: refint.la
#olcModuleload: retcode.la
#olcModuleload: rwm.la
#olcModuleload: seqmod.la
#olcModuleload: smbk5pwd.la
#olcModuleload: sssvlv.la
#olcModuleload: syncprov.la
#olcModuleload: translucent.la
#olcModuleload: unique.la
#olcModuleload: valsort.la
#
# Schema settings
#
dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema
include: file:///etc/openldap/schema/core.ldif #将/etc/openldap/schema/目录下以ldif为结尾的模块都添加进来
include: file:///etc/openldap/schema/collective.ldif
include: file:///etc/openldap/schema/corba.ldif
include: file:///etc/openldap/schema/cosine.ldif
include: file:///etc/openldap/schema/duaconf.ldif
include: file:///etc/openldap/schema/dyngroup.ldif
include: file:///etc/openldap/schema/inetorgperson.ldif
include: file:///etc/openldap/schema/java.ldif
include: file:///etc/openldap/schema/misc.ldif
include: file:///etc/openldap/schema/nis.ldif
include: file:///etc/openldap/schema/openldap.ldif
include: file:///etc/openldap/schema/ppolicy.ldif
include: file:///etc/openldap/schema/pmi.ldif
include: file:///etc/openldap/schema/samba.ldif
include: file:///etc/openldap/schema/freeradius.ldif
#
# Frontend settings
#
dn: olcDatabase=frontend,cn=config
objectClass: olcDatabaseConfig
objectClass: olcFrontendConfig
olcDatabase: frontend
#
# Sample global access control policy:
# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:
# Allow self write access
# Allow authenticated users read access
# Allow anonymous users to authenticate
#
#olcAccess: to dn.base="" by * read
#olcAccess: to dn.base="cn=Subschema" by * read
#olcAccess: to *
# by self write
# by users read
# by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!
#
#
# Configuration database
#
dn: olcDatabase=config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: config
olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c
n=auth" manage by * none
#
# Server status monitoring
#
dn: olcDatabase=monitor,cn=config
objectClass: olcDatabaseConfig
olcDatabase: monitor
olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c
n=auth" read by dn.base="cn=acadmin,dc=test,dc=net,dc=cn" read by * none #这里把cn为管理员名称,dc为域名
#
# Backend database definitions
#
dn: olcDatabase=hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: hdb
olcSuffix: dc=test,dc=net,dc=cn #这里要和上面的cn和dc一样
olcRootDN: cn=acadmin,dc=test,dc=net,dc=cn #还有这里同上
olcRootPW: {
SSHA}hnxiKpbSXyzF1sazYma5FBlkdD39dpU6 #加上刚才设置的密码
olcDbDirectory: /var/lib/ldap
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
简单说一下这里的cn和dc, cn相当于名字,dc相当与域名,有几级域名就写几个dc。
这里slapd.ldif的初始文件就配置完成了。
4.设置数据库
[root@ldap-master (11:31:54)/etc/openldap]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@ldap-master (11:36:40)/etc/openldap]# chown -R ldap:ldap /var/lib/ldap
数据库这里就简单了,直接拷贝过来加上权限即可。
5.使用slapd.ldif初始化配置文件
这里如果导入错误,请检查slapd.ldif文件内容,注意每行后面不能有空格。
检查完后,删除slapd.d文件夹内的文件重新执行导入命令。
[root@ldap-master (11:43:16)/etc/openldap]# slapadd -n 0 -F slapd.d -l slapd.ldif
_#################### 100.00% eta none elapsed none fast!
Closing DB...
[root@ldap-master (11:43:18)/etc/openldap]# chown -R ldap:ldap slapd.d
6.启动服务
如果这里启动失败,请检查上面关于文件夹权限的设置。
[root@ldap-master (11:45:35)/etc/openldap]# systemctl start slapd
[root@ldap-master (11:45:41)/etc/openldap]# systemctl enable slapd
Created symlink from /etc/systemd/system/multi-user.target.wants/slapd.service to /usr/lib/systemd/system/slapd.service.
使用LDAP Admin
软件来测试ldap服务
7.开启日志功能
创建日志存放目录,并授权给ldap用户。
[root@ldap-master (14:54:54)/etc/openldap]# mkdir /var/log/slapd
[root@ldap-master (14:55:04)/etc/openldap]# touch /var/log/slapd/slapd.log
[root@ldap-master (14:55:15)/etc/openldap]# chown -R ldap:ldap /var/log/slapd
在/etc/rsyslog.conf的74行添加如下内容:
74 local4.* /var/log/slapd/slapd.log
设置日志切割(因为日志存放越久,日志文件占用的空间就越大,开启日志切割,只保留最近的日志)
root@ldap-master (15:02:55)/etc/openldap]# vim /etc/logrotate.d/slapd
/var/log/slapd/slapd.log{
daily #每天轮询一次
rotate 5 #保存5个历史日志文件,超过的删除
copytruncate #复制源日志内容后,清空文件,而不是创建新文件
dateext #切割文件时,文件名带有日期
missingok #如果指定的目录不存在,会报错,此选项用来抑制报错
}
测试日志切割功能
[root@ldap-master (15:06:59)/etc/openldap]# ll /var/log/slapd/
total 0
-rw-r--r-- 1 ldap ldap 0 Nov 26 14:55 slapd.log
[root@ldap-master (15:07:11)/etc/openldap]# logrotate -f /etc/logrotate.d/slapd
[root@ldap-master (15:07:49)/etc/openldap]# ll /var/log/slapd/
total 0
-rw-r--r-- 1 ldap ldap 0 Nov 26 15:07 slapd.log
-rw-r--r-- 1 ldap ldap 0 Nov 26 15:07 slapd.log-20191126
重新编辑slapd.ldif,添加支持日志功能的模块。
在配置文件的第10行下面,紧跟一行添加如下内容,注意不要有空格。
[root@ldap-master (11:45:47)/etc/openldap]# vim slapd.ldif
11 olcLogLevel: stats
这里有人会说,为什么不用ldif文件热添加呢,因为我们是新建的ldap服务,直接使用初始化文件去配置,以后出现问题就可以把配置文件copy走,在另一个服务器上继续开启服务而不丢配置。
然后重新生成配置文件,来测试是否生成日志。
这里我们创建一个初始化用的脚本,为后面一步步添加功能做下简化,
[root@ldap-master (15:12:48)/etc/openldap]# vim config_init.sh
[root@ldap-master (15:17:23)/etc/openldap]# chmod +x config_init.sh
#!/bin/bash
rm -rf slapd.d/*
slapadd -n 0 -F slapd.d -l slapd.ldif
chown -R ldap:ldap slapd.d
systemctl restart slapd
[root@ldap-master (15:17:35)/etc/openldap]#
测试日志功能
[root@ldap-master (15:18:04)/etc/openldap]# sh config_init.sh
_#################### 100.00% eta none elapsed none fast!
Closing DB...
[root@ldap-master (15:19:02)/etc/openldap]# systemctl restart rsyslog
[root@ldap-master (15:19:27)/etc/openldap]# systemctl restart slapd
[root@ldap-master (15:19:38)/etc/openldap]# cat /var/log/slapd/slapd.log
Nov 26 15:19:38 ldap-master slapd[19478]: daemon: shutdown requested and initiated.
Nov 26 15:19:38 ldap-master slapd[19478]: slapd shutdown: waiting for 0 operations/tasks to finish
Nov 26 15:19:38 ldap-master slapd[19478]: slapd stopped.
Nov 26 15:19:38 ldap-master slapd[19533]: @(#) $OpenLDAP: slapd 2.4.44 (Jan 29 2019 17:42:45) $#012#011mockbuild@x86-01.bsys.centos.org:/builddir/build/BUILD/openldap-2.4.44/openldap-2.4.44/servers/slapd
Nov 26 15:19:38 ldap-master slapd[19535]: slapd starting
[root@ldap-master (15:19:39)/etc/openldap]#
5.安装phpldapadmin管理软件
该软件可以在web上对ldap进行管理,有中文的,方便一些。
1.安装所需依赖包
yum -y install epel-release
yum -y install phpldapadmin
2.编辑/etc/httpd/conf.d/phpldapadmin.conf用来允许所有网段访问:
vim /etc/httpd/conf.d/phpldapadmin.conf
<VirtualHost *:80>
ServerName openldap.test.net.cn
Alias /phpldapadmin /usr/share/phpldapadmin/htdocs
Alias /ldapadmin /usr/share/phpldapadmin/htdocs
<Directory /usr/share/phpldapadmin/htdocs>
<IfModule mod_authz_core.c>
# Apache 2.4
Require all granted
Require local
</IfModule>
<IfModule !mod_authz_core.c>
# Apache 2.2
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
Allow from ::1
</IfModule>
</Directory>
</VirtualHost>
3.修改 /etc/phpldapadmin/config.php文件,将397行取消注释,并注释398行,用来开启使用dn登录。
[root@ldap-master (15:23:49)/etc/openldap]# vim /etc/phpldapadmin/config.php
397 $servers->setValue('login','attr','dn');
398 // $servers->setValue('login','attr','uid');
编辑httpd的配置文件,在96行添加ServerName localhost:80
[root@ldap-master (15:26:10)/etc/openldap]# vim /etc/httpd/conf/httpd.conf
96 ServerName localhost:80
开启http服务,查看phpldapadmin是否可登录
[root@ldap-master (15:29:07)/etc/openldap]# systemctl start httpd
[root@ldap-master (15:29:16)/etc/openldap]# systemctl enable httpd
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
4.在主机的hosts文件中添加一条解析记录
192.168.2.147 openldap.test.net.cn
5.测试登录
访问http://IP/ldapadmin/
这里我们看见没有任何信息,这是因为我们还没有初始化域。
6.取消phpldapadmin警告信息
在初始化域之前,我们修改一下phpldapadmin的警告信息,取消掉警告。
修改 /etc/phpldapadmin/config.php
的第166行为如下内容
[root@ldap-master (15:29:21)/etc/openldap]# vim /etc/phpldapadmin/config.php
166 $config->custom->appearance['hide_template_warning'] = true;
三、加固LDAP(ssl和https)
我们先不初始化域,先把ldap变得更安全一下–添加tls(这里是内网使用,所以用的是自签的证书,这个证书不要设置密码!否则ldap会不识别证书)
1.ldap配置ssl
这里我们使用自己的CA服务器
CA服务器:
[root@CA (15:41:08)~]# yum -y install openssl #1.安装CA服务器
[root@CA (15:42:04)~]# cd /etc/pki/CA/
[root@CA (15:42:06)/etc/pki/CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048) #2.生成CA服务器自己的私钥
Generating RSA private key, 2048 bit long modulus
....................+++
..................+++
e is 65537 (0x10001)
[root@CA (15:42:15)/etc/pki/CA]#
[root@CA (15:42:15)/etc/pki/CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650 #3.生成自签名证书
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN #国家
State or Province Name (full name) []:BeiJing #省份
Locality Name (eg, city) [Default City]:BeiJing #城市
Organization Name (eg, company) [Default Company Ltd]:test.net.cn #域名
Organizational Unit Name (eg, section) [