- openLDAP 安装
$ sudo yum install -y openldap-servers openldap-clients
$ sudo cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
$ sudo chown ldap. /var/lib/ldap/DB_CONFIG
$ sudo systemctl enable slapd
$ sudo systemctl start slapd
- 设置root配置密码
产生密码:
$ slappasswd -s <password>
{SSHA}qesoYLYJaww8EG5sx/ZDF+QRGrnUxS4H
编辑chrootpw.ldif文件
$ vim chrootpw.ldif
# specify the password generated above for "olcRootPW" section
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}qesoYLYJaww8EG5sx/ZDF+QRGrnUxS4H
设置
$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif
- 倒入基础schema
$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/core.ldif
$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
- 设置顶级域(top domain)信息
假设dc=mydomain,dc=com
产生密码:
$ slappasswd -s <password>
{SSHA}vV26L1/7YSWsKpLfazGLPl/f+J4INP2z
编辑chdomain.ldif文件
$ vim chdomain.ldif
# replace to your own domain name for "dc=***,dc=***" section
# specify the password generated above for "olcRootPW" section
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=admin,dc=mydomain,dc=com" read by * none
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=mydomain,dc=com
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=admin,dc=mydomain,dc=com
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}vV26L1/7YSWsKpLfazGLPl/f+J4INP2z
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=mydomain,dc=com" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=admin,dc=mydomain,dc=com" write by * read
设置:
$ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif
- 设置域的组织架构
例如
dc=mydomain,dc=com
/ | \
cn=admin ou=people ou=group
$ vim basedomain.ldif
# replace to your own domain name for "dc=***,dc=***" section
dn: dc=mydomain,dc=com
objectClass: top
objectClass: dcObject
objectclass: organization
o: mydomain
dc: mydomain
dn: cn=admin,dc=mydomain,dc=com
objectClass: organizationalRole
cn: admin
description: LDAP admin
dn: ou=people,dc=mydomain,dc=com
objectClass: organizationalUnit
ou: people
dn: ou=group,dc=mydomain,dc=com
objectClass: organizationalUnit
ou: group
或者
dc=mydomain,dc=com
/ \
cn=admin dc=dept
/ \
ou=people ou=group
$ vim basedomain.ldif
# replace to your own domain name for "dc=***,dc=***" section
dn: dc=mydomain,dc=com
objectClass: top
objectClass: domain
o: mydomain
dc: mydomain
dn: cn=admin,dc=mydomain,dc=com
objectClass: organizationalRole
cn: admin
description: LDAP admin
dn: dc=dept,dc=mydomain,dc=com
changetype: add
dc: dept
objectClass: top
objectClass: dcObject
objectClass: organization
o: dept
dn: ou=people,dc=dept,dc=mydomain,dc=com
objectClass: organizationalUnit
ou: people
dn: ou=group,dc=dept,dc=mydomain,dc=com
objectClass: organizationalUnit
ou: group
执行:
$ sudo ldapadd -x -D cn=admin,dc=mydomain,dc=com -W -f basedomain.ldif
- 添加用户
生成密码
$ slappasswd -s <password>
{SSHA}BCxXdhHMsLP25F43RSoFL3XBZ9altoqO
编辑ldapuser.ldif文件
$ vim ldapuser.ldif
# create new
# replace to your own domain name for "dc=***,dc=***" section
dn: uid=user1,ou=people,dc=mydomain,dc=com
objectClass: inetOrgPerson
cn: commonname
sn: surname
uid: user1
userPassword: {SSHA}BCxXdhHMsLP25F43RSoFL3XBZ9altoqO
执行:
$ sudo ldapadd -x -D cn=admin,dc=mydomain,dc=com -W -f ldapuser.ldif
- 查询
$ ldapsearch -x -D "cn=admin,dc=mydomain,dc=com" -W -b "dc=mydomain,dc=com" -H ldap://
- 删除
$ ldapdelete -H ldap:// -D "cn=admin,dc=mydomain,dc=com" -w <password> "uid=user1,ou=people,dc=mydomain,dc=com"
网友评论