128.1 安装及配置
- 安装环境及版本
- Redhat版本为7.3
- OpenLDAP版本为2.4.44
- 在集群中选择一台服务器(ip-xxx-xx-xx-xxx.ap-southeast-1.compute.internal)作为OpenLDAP的Server
- 安装OpenLDAP服务
[root@i-xxx-xx-xx-xxx ~]# yum -y install openldap openldap-clients openldap-servers migrationtools openldap-devel nss- pam-ldapd bind-dyndb-ldap compat-openldap perl-LDAP krb5-server-ldap php-ldap openssl
- 查看RPM包
[root@ip-xxx-xx-xx-xxx ~]# rpm -qa |grep openldap
- openssl生成TLS加密文件
[root@ip-xxx-xx-xx-xxx certs]# openssl genrsa -out ldap.key 1024
- 生成签名文件
[root@ip-xxx-xx-xx-xxx certs]# openssl req -new -key ldap.key -out ldap.csr
- 生成公钥文件
[root@ip-xxx-xx-xx-xxx certs]# openssl x509 -req -days 3653 -in ldap.csr -signkey ldap.key -out ldap.crt
- 拷贝至/etc/openldap/certs目录
[root@ip-xxx-xx-xx-xxx certs]# scp ldap.crt ldap.key /etc/openldap/certs/
[root@ip-xxx-xx-xx-xxx certs]# ll /etc/openldap/certs/
-
OpenLDAP的slapd.ldif配置文件修改
- slapd.ldif文件拷贝至/root目录
[root@ip-xxx-xx-xx-xxx openldap-servers]# cp slapd.ldif /root/
[root@ip-xxx-xx-xx-xxx openldap-servers]# cd /root/
[root@ip-xxx-xx-xx-xxx ~]# vim slapd.ldif
- slapd.ldif文件修改
# 增加include的文件及配置管理员账号和OpenLDAP的根域信息，配置文件中需要注意的TLS Settings配置，如果不启用则可以将相关的配置注释，配置文件中多处配置dc=fayson,dc=com，由于OpenLDAP的域为fayson.com，如果LDAP的域为ldap.fayson.com则配置为dc=ldap,dc=fayson,dc=com，根据自己LDAP的域名进行相应的修改
# See slapd-config(5) for details on configuration options.
# This file should NOT be world readable.
#
dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/openldap/slapd.args
olcPidFile: /var/run/openldap/slapd.pid
#
# TLS settings
#
olcTLSCACertificatePath: /etc/openldap/certs
olcTLSCertificateFile: /etc/openldap/certs/ldap.crt
olcTLSCertificateKeyFile: /etc/openldap/certs/ldap.key
#
# Schema settings
#
dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema
include: file:///etc/openldap/schema/corba.ldif
include: file:///etc/openldap/schema/core.ldif
include: file:///etc/openldap/schema/cosine.ldif
include: file:///etc/openldap/schema/duaconf.ldif
include: file:///etc/openldap/schema/dyngroup.ldif
include: file:///etc/openldap/schema/inetorgperson.ldif
include: file:///etc/openldap/schema/java.ldif
include: file:///etc/openldap/schema/misc.ldif
include: file:///etc/openldap/schema/nis.ldif
include: file:///etc/openldap/schema/openldap.ldif
include: file:///etc/openldap/schema/ppolicy.ldif
include: file:///etc/openldap/schema/collective.ldif
#
# Frontend settings
#
dn: olcDatabase=frontend,cn=config
objectClass: olcDatabaseConfig
objectClass: olcFrontendConfig
olcDatabase: frontend
#
# Configuration database
#
dn: olcDatabase=config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: config
olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none
#
# Server status monitoring
#
dn: olcDatabase=monitor,cn=config
objectClass: olcDatabaseConfig
olcDatabase: monitor
olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=fayson,dc=com" read by * none
#
# Backend database definitions
#
dn: olcDatabase=hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: hdb
olcSuffix: dc=fayson,dc=com
olcRootDN: cn=Manager,dc=fayson,dc=com
olcRootPW: 123456
olcDbDirectory: /var/lib/ldap
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
olcDbIndex: uidNumber,gidNumber,loginShell eq,pres
olcDbIndex: uid,memberUid eq,pres,sub
olcDbIndex: nisMapName,nisMapEntry eq,pres,sub
- 重新生成OpenLDAP的配置
[root@ip-xxx-xx-xx-xxx ~]# rm -rf /etc/openldap/slapd.d/*
[root@ip-xxx-xx-xx-xxx ~]# slapadd -F /etc/openldap/slapd.d -n 0 -l /root/slapd.ldif
- 测试配置文件是否正确
[root@ip-xxx-xx-xx-xxx ~]# slaptest -u -F /etc/openldap/slapd.d
- 文件属主修改
[root@ip-xxx-xx-xx-xxx ~]# chown -R ldap. /etc/openldap/slapd.d/
[root@ip-xxx-xx-xx-xxx ~]# ll /etc/openldap/slapd.d/
- 数据库安装
[root@ip-xxx-xx-xx-xxx ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@ip-xxx-xx-xx-xxx ~]# ll /var/lib/ldap/
- 数据库文件属主修改
[root@ip-xxx-xx-xx-xxx ~]# chown -R ldap. /var/lib/ldap/
[root@ip-xxx-xx-xx-xxx ~]# ll /var/lib/ldap/
- slapd服务添加到系统自启动服务并启动slapd服务
[root@ip-xxx-xx-xx-xxx ~]# systemctl enable slapd
[root@ip-xxx-xx-xx-xxx ~]# systemctl start slapd
[root@ip-xxx-xx-xx-xxx ~]# systemctl status slapd
大数据视频推荐：
CSDN
人工智能算法竞赛实战
AIops智能运维机器学习算法实战
ELK7 stack开发运维实战
PySpark机器学习从入门到精通
AIOps智能运维实战
腾讯课堂
大数据语音推荐：
ELK7 stack开发运维
企业级大数据技术应用
大数据机器学习案例之推荐系统
自然语言处理
大数据基础
人工智能：深度学习入门到精通
网友评论