目的：实现ldap server的高可用，当主ldapserver宕机后，备的ldapserver可以正常提供服务。
主机规划：
host-10-1-236-51 master ldapserver
host-10-1-236-52 slave ldapserver
Master ldap部署
1.1 master ldap安装
yum install -y openldap openldap-servers openldap-clients openldap-devel
1.2 master ldap配置
cd /etc/openldap/
cp /usr/share/openldap-servers/slapd.conf.obsolete ./slapd.conf
创建密文密码：
slappasswd
New password:123456
Re-enter new password:123456
输入两次明文密码，然后会生成一个密文密码。
{SSHA}/nes94wRPNK2PND6DWDXzsSPfFXjQ3RH
配置master ldapserver：
vi slap.conf:(加粗部分需要修改)
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /etc/openldap/schema/corba.schema
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/duaconf.schema
include /etc/openldap/schema/dyngroup.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/java.schema
include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/openldap.schema
include /etc/openldap/schema/ppolicy.schema
include /etc/openldap/schema/collective.schema
# Allow LDAPv2 client connections. This is NOT the default.
allow bind_v2
loglevel 4095
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
# Load dynamic backend modules
# - modulepath is architecture dependent value (32/64-bit system)
# - back_sql.la overlay requires openldap-server-sql package
# - dyngroup.la and dynlist.la cannot be used at the same time
# modulepath /usr/lib/openldap
modulepath /usr/lib64/openldap
# moduleload accesslog.la
# moduleload auditlog.la
# moduleload back_sql.la
# moduleload chain.la
# moduleload collect.la
# moduleload constraint.la
# moduleload dds.la
# moduleload deref.la
# moduleload dyngroup.la
# moduleload dynlist.la
# moduleload memberof.la
# moduleload pbind.la
# moduleload pcache.la
# moduleload ppolicy.la
# moduleload refint.la
# moduleload retcode.la
# moduleload rwm.la
# moduleload seqmod.la
# moduleload smbk5pwd.la
# moduleload sssvlv.la
moduleload syncprov.la
# moduleload translucent.la
# moduleload unique.la
# moduleload valsort.la
# The next three lines allow use of TLS for encrypting connections using a
# dummy test certificate which you can generate by running
# /usr/libexec/openldap/generate-server-cert.sh. Your client software may balk
# at self-signed certificates, however.
TLSCACertificatePath /etc/openldap/certs
TLSCertificateFile "\"OpenLDAP Server\""
TLSCertificateKeyFile /etc/openldap/certs/password
# Sample security restrictions
# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64
# Sample access control policy:
# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:
# Allow self write access
# Allow authenticated users read access
# Allow anonymous users to authenticate
# Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
# by self write
# by users read
# by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!
# enable on-the-fly configuration (cn=config)
database config
access to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
by * none
# enable server status monitoring (cn=monitor)
database monitor
access to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
by dn.exact="cn=root,dc=yinkp,dc=com" read
by * none
#######################################################################
# database definitions
#######################################################################
database bdb
suffix "dc=yinkp,dc=com"
checkpoint 1024 15
rootdn "cn=root,dc=yinkp,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoided. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw secret
# rootpw {crypt}ijFYNcSNctBYg
rootpw {SSHA}/nes94wRPNK2PND6DWDXzsSPfFXjQ3RH
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /var/lib/ldap
# Indices to maintain for this database
index objectClass eq,pres
index ou,cn,mail,surname,givenname eq,pres,sub
index uidNumber,gidNumber,loginShell eq,pres
index uid,memberUid eq,pres,sub
index nisMapName,nisMapEntry eq,pres,sub
index entryCSN,entryUUID eq
# master replia server start
overlay syncprov
syncprov-checkpoint 100 10
syncprov-sessionlog 100
1.3 master ldap操作&启动
cd /var/lib/ldap
cp /usr/share/openldap-servers/DB_CONFIG.example ./DB_CONFIG
rm -rf /etc/openldap/slapd.d/*
chown -R ldap:ldap /etc/openldap/slapd.d
slaptest -u -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
chown -R ldap:ldap /etc/openldap/slapd.d
service slapd restart
Slave ldap部署&同步数据
2.1 slave ldap安装
yum install -y openldap openldap-servers openldap-clients openldap-devel
2.2 slave ldap配置
vi slapd.conf
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /etc/openldap/schema/corba.schema
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/duaconf.schema
include /etc/openldap/schema/dyngroup.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/java.schema
include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/openldap.schema
include /etc/openldap/schema/ppolicy.schema
include /etc/openldap/schema/collective.schema
# Allow LDAPv2 client connections. This is NOT the default.
allow bind_v2
loglevel 4095
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
# Load dynamic backend modules
# - modulepath is architecture dependent value (32/64-bit system)
# - back_sql.la overlay requires openldap-server-sql package
# - dyngroup.la and dynlist.la cannot be used at the same time
# modulepath /usr/lib/openldap
modulepath /usr/lib64/openldap
# moduleload accesslog.la
# moduleload auditlog.la
# moduleload back_sql.la
# moduleload chain.la
# moduleload collect.la
# moduleload constraint.la
# moduleload dds.la
# moduleload deref.la
# moduleload dyngroup.la
# moduleload dynlist.la
# moduleload memberof.la
# moduleload pbind.la
# moduleload pcache.la
# moduleload ppolicy.la
# moduleload refint.la
# moduleload retcode.la
# moduleload rwm.la
# moduleload seqmod.la
# moduleload smbk5pwd.la
# moduleload sssvlv.la
moduleload syncprov.la
# moduleload translucent.la
# moduleload unique.la
# moduleload valsort.la
# The next three lines allow use of TLS for encrypting connections using a
# dummy test certificate which you can generate by running
# /usr/libexec/openldap/generate-server-cert.sh. Your client software may balk
# at self-signed certificates, however.
TLSCACertificatePath /etc/openldap/certs
TLSCertificateFile "\"OpenLDAP Server\""
TLSCertificateKeyFile /etc/openldap/certs/password
# Sample security restrictions
# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64
# Sample access control policy:
# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:
# Allow self write access
# Allow authenticated users read access
# Allow anonymous users to authenticate
# Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
# by self write
# by users read
# by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!
# enable on-the-fly configuration (cn=config)
database config
access to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
by * none
# enable server status monitoring (cn=monitor)
database monitor
access to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
by dn.exact="cn=root,dc=yinkp,dc=com" read
by * none
#######################################################################
# database definitions
#######################################################################
database bdb
suffix "dc=yinkp,dc=com"
checkpoint 1024 15
rootdn "cn=root,dc=yinkp,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoided. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw secret
# rootpw {crypt}ijFYNcSNctBYg
rootpw {SSHA}/nes94wRPNK2PND6DWDXzsSPfFXjQ3RH
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /var/lib/ldap
# Indices to maintain for this database
index objectClass eq,pres
index ou,cn,mail,surname,givenname eq,pres,sub
index uidNumber,gidNumber,loginShell eq,pres
index uid,memberUid eq,pres,sub
index nisMapName,nisMapEntry eq,pres,sub
index entryCSN,entryUUID eq
syncrepl rid=123
provider=ldap://10.1.236.51:389
type=refreshOnly
interval=00:00:01:00
searchbase="dc=yinkp,dc=com"
scope=sub
attrs="*"
schemachecking=off
bindmethod=simple
binddn="cn=root,dc=yinkp,dc=com"
credentials=123456
2.3 slave ldap操作&启动
cd /var/lib/ldap
cp /usr/share/openldap-servers/DB_CONFIG.example ./DB_CONFIG
rm -rf /etc/openldap/slapd.d/*
chown -R ldap:ldap /etc/openldap/slapd.d
slaptest -u -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
chown -R ldap:ldap /etc/openldap/slapd.d
service slapd restart
2.4 同步系统用户到ldap
在master ldap主机上进行操作：
安装migrationtools 工具：
yum install migrationtools -y
配置migrationtools 工具：
vi /usr/share/migrationtools/migrate_common.ph
# Default DNS domain
$DEFAULT_MAIL_DOMAIN = "yinkp.com";
# Default base
$DEFAULT_BASE = "dc=yinkp,dc=com";
导出主机用户配置：
cd /usr/share/migrationtools/
./migrate_base.pl > /tmp/base.ldif
./migrate_passwd.pl /etc/passwd > /tmp/passwd.ldif
./migrate_group.pl /etc/group > /tmp/group.ldif
添加主机用户配置到ldap
ldapadd -x -D "cn=root,dc=yinkp,dc=com" -W -f /tmp/base.ldif
ldapadd -x -D "cn=root,dc=yinkp,dc=com" -W -f /tmp/passwd.ldif
ldapadd -x -D "cn=root,dc=yinkp,dc=com" -W -f /tmp/group.ldif
同步系统用户到ldap：
cat /etc/passwd > testpwd.in
/usr/share/migrationtools/migrate_passwd.pl testpwd.in > testpwd.ldif
ldapadd -x -D "cn=root,dc=asiainfo,dc=com" -w 123456 -f testpwd.ldif
注：因为ldap已经配置好了主备，所以只需要在master上进行加载，slave会主动从master上去拉对应变更内容，所以数据也就同步到了slave上。
查看两个server是否都同步到了数据：
ldapsearch -x -H ldap://host-10-1-236-51 -b "dc=yinkp,dc=com"
ldapsearch -x -H ldap://host-10-1-236-52 -b "dc=yinkp,dc=com"
如果有问题可以通过日志查看问题原因：
ldap开启日志
vi slapd.conf
添加：
loglevel 4095
vi /etc/rsyslog.conf
添加：
local4.* /var/log/openldap.log
service rsyslog restart
service slapd restart
网友评论