OpenLdap+phpldapadmin安装

一、openldap安装

需要准备软件：berkeleydb4.8( db-4.8.24.tar.gz )和 openlpdap2.4.19(openldap-2.4.19.tgz)

  berkeleydb: https://download.oracle.com/berkeley-db/db-4.8.24.tar.gz
  openlpdap: ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/

1.openldap需要通过berkeleyDB存储数据，先安装BerkeleyDB:

# tar -xvf db-4.8.24.tar.gz
解压之后会生成一个目录 db-4.8.24
# cd db-4.8.24/build_unix
# ../dist/configure
# make
# make install

完成之后，默认安装/usr/local/BerkeleyDB.4.8,把/usr/local/BerkeleyDB.4.8/bin和/usr/local/BerkeleyDB.4.8/lib 添加到/etc/ld.so.conf中，然后只想命令ldconfig,使配置生效。

# vim /etc/ld.so.conf
  include ld.so.conf.d/*.conf
  /usr/local/BerkeleyDB.4.8/bin
  /usr/local/BerkeleyDB.4.8/lib
# ldconfig

2.安装openldap,将下载好的 openldap-2.4.19.tgz解压。

# tar -xvf openldap-2.4.19.tgz
解压后目录openldap-2.4.19
# cd openldap-2.4.19
# export CPPFLAGS="-I/usr/local/BerkeleyDB.4.8/include"
# export LDFLAGS="-L/usr/local/BerkeleyDB.4.8/lib"
# vi .bash_profile
 export LD_LIBRARY_PATH=/usr/local/ssl/lib:/usr/local/BerkeleyDB.4.8/lib
# source .bash_profile
# env CPPFLAGS="-I/usr/local/BerkeleyDB.4.8/include" LDFLAGS="-L/usr/local/BerkeleyDB.4.8/lib" ./configure --prefix=/usr/local/openldap --enable-ldbm  （最后提示make depend）
# make depend
# make
# make test
# make install

Openldap 安装结束默认目录。/usr/local/openladp.
3.修改本地slaps.conf文件修改内容，保存并替换（/usr/local/openldap/etc/openldap）

# vim /usr/local/openldap/etc/openldap/slapd.conf
  suffix          "dc=nightmare,dc=cn"
  rootdn          "cn=Manager,dc=nightmare,dc=cn"

4.设置管理员密码.

# ./ldappasswd -s wu123456
  {SSHA}+YY+OPCOifWc2F65D6QjUU78z8dyp3aB
# vim /usr/local/openldap/etc/openldap/slapd.conf
  rootpw  {SSHA}+YY+OPCOifWc2F65D6QjUU78z8dyp3aB

5.生成数据配置文件：

# ./slaptest -f /usr/local/openldap/etc/openldap/slapd.conf -F /etc/openldap/slapd.d/

6.导入schema,编辑slapd.conf文件，导入schema.

include /usr/local/openldap/etc/openldap/schema/corba.schema
include /usr/local/openldap/etc/openldap/schema/core.schema
include /usr/local/openldap/etc/openldap/schema/cosine.schema
include /usr/local/openldap/etc/openldap/schema/duaconf.schema
include /usr/local/openldap/etc/openldap/schema/dyngroup.schema
include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema
include /usr/local/openldap/etc/openldap/schema/java.schema
include /usr/local/openldap/etc/openldap/schema/misc.schema
include /usr/local/openldap/etc/openldap/schema/nis.schema
include /usr/local/openldap/etc/openldap/schema/openldap.schema
include /usr/local/openldap/etc/openldap/schema/ppolicy.schema
include /usr/local/openldap/etc/openldap/schema/collective.schema

7.启动openldap,使用命令启动

# /usr/local/openldap/libexec/slapd

8.测试openldap

# ps -ef | grep slapd

二、安装phpldapamin。

1、获取phpldapadmin

# wget https://nchc.dl.sourceforge.net/project/phpldapadmin/phpldapadmin-php5/1.2.3/phpldapadmin-1.2.3.tgz --no-check-certificate
# tar -xvf phpldapadmin-1.2.3.tgz
# mv phpldapadmin-1.2.3 /kerwin/install/phpldapadmin

2、修改phpldapadmin连接ldap信息.

# vim /kerwin/install/phpldapadmin/config/config.php
  $servers->newServer('ldap_pla');
  $servers->setValue('server','name','LDAP Server');
  $servers->setValue('server','host','81.71.15.231');
  $servers->setValue('server','port',389);
  $servers->setValue('server','base',array('dc=nightmare,dc=cn'));
  $servers->setValue('login','auth_type','cookie');
  $servers->setValue('login','bind_id','cn=Manager,dc=nightmare,dc=cn');
  $servers->setValue('login','bind_pass','wu123456');
  $servers->setValue('server','tls',false);

3、安装httpd

# yum -y install httpd php php-ldap php-gd php-mbstring php-pear php-bcmath php-xml phpldapadmin

4、修改httpd配置文件

# vim  /etc/httpd/conf.d/phpldapadmin.conf
Alias /phpldapadmin /kerwin/install/phpldapadmin/htdocs
Alias /ldapadmin /kerwin/install/phpldapadmin/htdocs
  <Directory /kerwin/install/phpldapadmin/htdocs>
    <IfModule mod_authz_core.c>
      # Apache 2.4
      Require all granted
    </IfModule>
    <IfModule !mod_authz_core.c>
      # Apache 2.2
      Order Deny,Allow
      Deny from all
      Allow from 81.71.15.231
      Allow from ::1
    </IfModule>
  </Directory>

5、修改httpd配置文件

systemctl start httpd
systemctl enable httpd
systemctl status httpd

三、OpenLDAP与migrationtools实现导入系统账号的相关信息

1、安装migrationtools

yum -y install migrationtools

2、修改migrationtools的配置文件，在/usr/share/migrationtools/这个目录下有很多migrationtools的文件,修改以下的两个地方:DEFAULT_MAIL_DOMAIN 和 DEFAULT_BASE。

# vim /usr/share/migrationtools/migrate_common.ph
    # Default DNS domain
    $DEFAULT_MAIL_DOMAIN = "nightmare.cn";
    # Default base
    $DEFAULT_BASE = "dc=nightmare,dc=cn";

3、生成基础的数据文件，可以自己修改这个生成的base.ldif文件，把不需要的去掉

  /usr/share/migrationtools/migrate_base.pl > base.ldif

4、把base.ldif导入OpenLDAP

  ldapadd -x -D "cn=Manager,dc=nightmare,dc=cn" -W -f /usr/share/migrationtools/base.ldif

导入后查看效果：

image.png