OpenLdap配置與管理

服務器端配置

yum install openldap-servers

slapd配置

[root@public-puppet01-P-Z ~]# slappasswd -h {MD5}

New password: 

Re-enter new password: 

{MD5}sBICuL/nbqxH63QBPkxqrw==

1、/etc/openldap/slapd.conf

include         /etc/openldap/schema/corba.schema

include         /etc/openldap/schema/core.schema

include         /etc/openldap/schema/cosine.schema

include         /etc/openldap/schema/duaconf.schema

include         /etc/openldap/schema/dyngroup.schema

include         /etc/openldap/schema/inetorgperson.schema

include         /etc/openldap/schema/java.schema

include         /etc/openldap/schema/misc.schema

include         /etc/openldap/schema/nis.schema

include         /etc/openldap/schema/openldap.schema

include         /etc/openldap/schema/ppolicy.schema

include         /etc/openldap/schema/collective.schema

allow bind_v2

pidfile         /var/run/openldap/slapd.pid

argsfile        /var/run/openldap/slapd.args

database        bdb

suffix          "dc=chanjetoms,dc=com"

rootdn          "cn=Manager,dc=chanjetoms,dc=com"

rootpw          {MD5}sBICuL/nbqxH63QBPkxqrw==

directory       /var/lib/ldap

index objectClass                       eq,pres

index ou,cn,mail,surname,givenname      eq,pres,sub

index uidNumber,gidNumber,loginShell    eq,pres

index uid,memberUid                     eq,pres,sub

index nisMapName,nisMapEntry            eq,pres,sub

database monitor

access to attrs=shadowLastChange,userPassword

        by self write

        by * auth

access to *

        by * read

2、/etc/openldap/ldap.conf

BASE dc=chanjetoms,dc=com

URI ldap://10.10.10.10

TLS_CACERTDIR /etc/openldap/cacerts

[root@dns1 openldap]# cp /usr/share/doc/openldap-servers-2.4.19/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

[root@dns1 openldap]# chown ldap.ldap /var/lib/ldap/DB_CONFIG

[root@dns1 openldap]# 

# enable monitoring

database monitor

啟動：

[root@common0 ~]# service slapd start

正在啟動 slapd：                                           [確定]

報錯：

ldapadd ldap_bind: Invalid credentials (49)

解決方法：

rm -rf /etc/openldap/slapd.d/*

slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d

chown -R ldap.ldap /etc/openldap/slapd.d/

chmod -R 000 /etc/openldap/slapd.d/

chmod -R u+rwX /etc/openldap/slapd.d/

同步復制配置

Master：

#Replicas of this database

replogfile /var/lib/ldap/replog

replica host=ldap.ops.com:389

        binddn="cn=Manager,dc=oms,dc=com"

        credentials=secret

        bindmethod=simple

Slave：

updatedn "cn=Manager,dc=oms,dc=com"

updateref ldap://ldap.ops.com:389/

master上日志（/usr/sbin/slapd -d 256）

2012-10-08 18:50:24 common0.ops.com slapd[13583]:  conn=1000 fd=13 ACCEPT from IP=192.168.52.145:58109 (IP=0.0.0.0:389)

2012-10-08 18:50:24 common0.ops.com slapd[13583]:  conn=1000 op=0 BIND dn="" method=128

2012-10-08 18:50:24 common0.ops.com slapd[13583]:  conn=1000 op=0 RESULT tag=97 err=0 text=

2012-10-08 18:50:24 common0.ops.com slapd[13583]:  conn=1000 op=1 SRCH base="dc=oms,dc=com" scope=2 deref=0 filter="(objectClass=*)"

2012-10-08 18:50:24 common0.ops.com slapd[13583]:  conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=4 text=

2012-10-08 18:50:24 common0.ops.com slapd[13583]:  conn=1000 op=2 UNBIND

2012-10-08 18:50:24 common0.ops.com slapd[13583]:  conn=1000 fd=13 closed

******************************

客戶端配置

setup

沒有找到 /lib64/libnss_ldap.so.2 文件。

LDAP支持需要這個文件方可正常工作。

安裝提供該文件的 nss-pam-ldapd 軟件包。

# yum install nss-pam-ldapd

# vim /etc/nsswitch.conf

#

# /etc/nsswitch.conf

#

# An example Name Service Switch config file. This file should be

# sorted with the most-used services at the beginning.

#

# The entry '[NOTFOUND=return]' means that the search for an

# entry should stop if the search in the previous entry turned

# up nothing. Note that if the search failed due to some other reason

# (like no NIS server responding) then the search continues with the

# next entry.

#

# Valid entries include:

#

#       nisplus                 Use NIS+ (NIS version 3)

#       nis                     Use NIS (NIS version 2), also called YP

#       dns                     Use DNS (Domain Name Service)

#       files                   Use the local files

#       db                      Use the local database (.db) files

#       compat                  Use NIS on compat mode

#       hesiod                  Use Hesiod for user lookups

#       [NOTFOUND=return]       Stop searching if not found so far

#

# To use db, put the "db" in front of "files" for entries you want to be

# looked up first in the databases

#

# Example:

#passwd:    db files nisplus nis

#shadow:    db files nisplus nis

#group:     db files nisplus nis

passwd:     files ldap

shadow:     files ldap

group:      files ldap

#hosts:     db files nisplus nis dns

hosts:      files dns

# Example - obey only what nisplus tells us...

#services:   nisplus [NOTFOUND=return] files

#networks:   nisplus [NOTFOUND=return] files

#protocols:  nisplus [NOTFOUND=return] files

#rpc:        nisplus [NOTFOUND=return] files

#ethers:     nisplus [NOTFOUND=return] files

#netmasks:   nisplus [NOTFOUND=return] files     

bootparams: nisplus [NOTFOUND=return] files

ethers:     files

netmasks:   files

networks:   files

protocols:  files

rpc:        files

services:   files

netgroup:   nisplus

publickey:  nisplus

automount:  files nisplus

aliases:    files nisplus

# vim /etc/sysconfig/authconfig

USEMKHOMEDIR=yes

USEPAMACCESS=no

CACHECREDENTIALS=yes

USESSSDAUTH=no

USESHADOW=yes

USEWINBIND=no

USESSSD=no

PASSWDALGORITHM=md5

FORCELEGACY=no

USEFPRINTD=no

USEHESIOD=no

FORCESMARTCARD=no

USELDAPAUTH=yes

USELDAP=yes

USECRACKLIB=yes

USEWINBINDAUTH=no

USESMARTCARD=no

USELOCAUTHORIZE=yes

USENIS=no

USEKERBEROS=no

USESYSNETAUTH=no

USESMBAUTH=no

USEDB=no

USEPASSWDQC=no

# vim /etc/openldap/ldap.conf

BASE dc=oms,dc=com

URI ldap://ldap-master.ops.com, ldap://ldap-slave.ops.com

# vim /etc/pam_ldap.conf

BASE dc=oms,dc=com

URI ldap://ldap-master.ops.com, ldap://ldap-slave.ops.com

pam_check_host_attr yes

# vim /etc/pam.d/system-auth

#%PAM-1.0

# This file is auto-generated.

# User changes will be destroyed the next time authconfig is run.

auth        required      pam_env.so

auth        sufficient    pam_unix.so nullok try_first_pass

auth        requisite     pam_succeed_if.so uid >= 500 quiet

auth        sufficient    pam_ldap.so use_first_pass

auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow

account     sufficient    pam_localuser.so

account     sufficient    pam_succeed_if.so uid < 500 quiet

account     [default=bad success=ok user_unknown=ignore] pam_ldap.so

account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=

password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok

password    sufficient    pam_ldap.so use_authtok

password    required      pam_deny.so

session     optional      pam_keyinit.so revoke

session     required      pam_limits.so

session     optional      pam_mkhomedir.so skel=/etc/skel/ umask=0022

session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid

session     required      pam_unix.so

session     optional      pam_ldap.so

#nslcd.conf不用配置，緩存服務由nscd提供，而不是nslcd。

# vim /etc/nslcd.conf

uid nslcd

gid ldap

uri ldap://ldap-master.ops.com ldap://ldap-slave.ops.com

base dc=oms,dc=com

ssl no

tls_cacertdir /etc/openldap/cacerts

/etc/pam.d/system-auth-ac #設置setup中的“使用MD5密碼”

/etc/pam.d/password-auth #配置后才能使用LDAP登錄

--------------------

錯誤信息：

[root@wade28 openldap]# service slapd restart

Stopping slapd:                                            [  OK  ]

Checking configuration files for slapd:                    [WARNING]

bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (2).

Expect poor performance for suffix "dc=my-domain,dc=com".

config file testing succeeded

Starting slapd:                                            [  OK  ]

解決方法：

該錯誤不影響ldap驗證服務；若一定要解決，執行以下命令即可

[root@wade28 openldap]# cp /usr/share/doc/openldap-servers-2.4.19/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

chown -R ldap /var/lib/ldap

OR：

/usr/share/openldap-servers/DB_CONFIG.example

*********************

安裝包依賴：

[root@h2 ~]# rpm -ivh openldap-servers-2.3.43-12.el5.i386.rpm 

error: Failed dependencies:

        libltdl.so.3 is needed by openldap-servers-2.3.43-12.el5.i386

        openldap = 2.3.43-12.el5 is needed by openldap-servers-2.3.43-12.el5.i386

解決方法：

[root@h2 ~]# rpm -ivh libtool-ltdl-devel-1.5.22-7.el5_4.i386.rpm libtool-ltdl-1.5.22-7.el5_4.i386.rpm 

Preparing...                ########################################### [100%]

   1:libtool-ltdl           ########################################### [ 50%]

   2:libtool-ltdl-devel     ########################################### [100%]

***********************************

[root@xiangjingdev40_v_o openldap]# slaptest -f slapd.conf -F slapd.d/

bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (2).

Expect poor performance for suffix "dc=chanjetoms,dc=com".

bdb_db_open: database "dc=chanjetoms,dc=com": db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2).

backend_startup_one (type=bdb, suffix="dc=chanjetoms,dc=com"): bi_db_open failed! (2)

slap_startup failed (test would succeed using the -u switch)

解決方法：

chown ldap.ldap /var/lib/ldap

/etc/init.d/sldapd start

ls -lh /var/lib/ldap/        // 查看db文件是否生成

[root@www ldap]# slaptest -f /etc/openldap/slapd.conf 

config file testing succeeded