ldap 搭建及应用
node1: 192.168.118.14
node2: 192.168.118.25
ldap server : 192.168.118.14
1. 安装LDAP服务器
[[email protected] ~]# yum install openldap-servers -y # 安装ldap服务器端软件
[[email protected] openldap]# cp -a /usr/share/openldap-servers/slapd.conf.obsolete /etc/openldap/slapd.conf # 主配置文件
[[email protected] openldap]# cp -a /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[[email protected] openldap]# slappasswd # 生成加密密码
New password:
Re-enter new password:
{SSHA}ToeOEviUjgqhRK7YYn3frPrdf6yAGETM
[[email protected] openldap]# vim slapd.conf # 修改主配置文件的dc
114 database bdb
115 suffix "dc=super,dc=com"
116 checkpoint 1024 15
117 rootdn "cn=Manager,dc=super,dc=com"
118 # Cleartext passwords, especially for the rootdn, should
119 # be avoided. See slappasswd(8) and slapd.conf(5) for details.
120 # Use of strong authentication encouraged.
121 # rootpw secret
122 # rootpw {crypt}ijFYNcSNctBYg
123 rootpw {SSHA}ToeOEviUjgqhRK7YYn3frPrdf6yAGETM # 将上面slappasswd 生成的密码写在这里
[[email protected] openldap]# rm -rf slapd.d/* # 删除原始的文件
[[email protected] openldap]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/ # 重新生成一下，这里很重要
config file testing succeeded
[[email protected] openldap]# chown -R ldap:ldap /etc/openldap/slapd.d/ # 记得权限问题，不然启动服务会报错。
[[email protected] openldap]# chown -R ldap:ldap /var/lib/ldap/
[[email protected] slapd.d]# service slapd start
Starting slapd: [ OK ]
[[email protected] slapd.d]# netstat -ntplu | grep slapd # ldap监听端口为tcp: 389
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 2633/slapd
tcp 0 0 :::389 :::* LISTEN 2633/slapd
[[email protected] slapd.d]# yum install migrationtools -y
[[email protected] slapd.d]# cd /usr/share/migrationtools/
[[email protected] migrationtools]# mkdir /ldaphome
[[email protected] migrationtools]# useradd -d /ldaphome/ldapuser1 ldapuser1 # 创建ldap测试用户，ldap用户是基于服务端本地的用户
[[email protected] migrationtools]# echo redhat | passwd ldapuser1 --stdin # 设置登录密码
Changing password for user ldapuser1.
passwd: all authentication tokens updated successfully.
[[email protected] migrationtools]# ./migrate_base.pl > /tmp/base.ldif # 生成三个文件: base.ldif、passwd.ldif、group.ldif
[[email protected] migrationtools]# grep ldapuser1 /etc/passwd > /tmp/passwd.in
[[email protected] migrationtools]# ./migrate_passwd.pl /tmp/passwd.in > /tmp/passwd.ldif
[[email protected] migrationtools]# grep ldapuser1 /etc/group > /tmp/group.in
[[email protected] migrationtools]# ./migrate_group.pl /tmp/group.in > /tmp/group.ldif
[[email protected] migrationtools]# vim /tmp/base.ldif # 编辑base.ldif修改如下
dn: dc=super,dc=com
dc: super
objectClass: top
objectClass: domain
dn: ou=People,dc=super,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit
dn: ou=Group,dc=super,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit
[[email protected] migrationtools]# cat /tmp/passwd.ldif
dn: uid=ldapuser1,ou=People,dc=super,dc=com
uid: ldapuser1
cn: ldapuser1
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}$6$3ZJY7iN1$N/RPvsQwIOH/chUV6B4K4V6ddSKWO0GcIBdB9nfWHPbkugS34L9zWBeOuQhiWtbuQ9svukuwY1qWvp8Nfr2V0/
shadowLastChange: 16990
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 500
gidNumber: 500
homeDirectory: /ldaphome/ldapuser1
[[email protected] migrationtools]# cat /tmp/group.ldif
dn: cn=ldapuser1,ou=Group,dc=super,dc=com
objectClass: posixGroup
objectClass: top
cn: ldapuser1
userPassword: {crypt}x
gidNumber: 500
[[email protected] migrationtools]# ldapadd -x -D ‘cn=Manager,dc=super,dc=com‘ -W -f /tmp/base.ldif
Enter LDAP Password: # 注意这里如果很久都没有跳出来，请检查selinxu是否为Permissive状态，输入的密码为上面设置的redhat
adding new entry "dc=super,dc=com"
adding new entry "ou=People,dc=super,dc=com"
adding new entry "ou=Group,dc=super,dc=com"
# 把三个文件导入ldap，这样ldap数据库里就有我们想要是用户
[[email protected] migrationtools]# ldapadd -x -D ‘cn=Manager,dc=super,dc=com‘ -W -f /tmp/passwd.ldif
Enter LDAP Password:
adding new entry "uid=ldapuser1,ou=People,dc=super,dc=com"
[[email protected] migrationtools]# ldapadd -x -D ‘cn=Manager,dc=super,dc=com‘ -W -f /tmp/group.ldif
Enter LDAP Password:
adding new entry "cn=ldapuser1,ou=Group,dc=super,dc=com"
这样就已经配置一个ldapuser1用户为ldap用户。
[[email protected] ~]# yum install nfs-utils -y # 配置nfs服务器，将ldapuser1家目录共享出去。
[[email protected] ~]# vim /etc/exports
/ldaphome 192.168.118.0/24(rw,async,root_squash)
[[email protected] ~]# service rpcbind start
Starting rpcbind: [ OK ]
[[email protected] ~]# service nfs start
Starting NFS services: [ OK ]
Starting NFS mountd: [ OK ]
Starting NFS daemon: [ OK ]
Starting RPC idmapd: [ OK ]
2. 配置ldap client端
配置setup内容，建议使用setup命令直接配置。
配置setup内容，建议使用setup命令直接配置。 [[email protected] ~]# yum install setuptool -y # 安装setup包 [[email protected] ~]# setup # 直接运行setup进行配置 Authentication configuration
安装这样的选项
这里缺少什么组件就安装什么 yum install /lib64/security/pam_fprintd.so -y
这里不使用 TLS Server为服务器地址，DN为主配置文件中的配置
setup配置完成就可以尝试登录ldapuser1
[[email protected] ~]# su - ldapuser1
su: warning: cannot change directory to /ldaphome/ldapuser1: No such file or directory
-bash-4.1$
这里已经登录成功，表示ldap服务工作正常了，只是在客户端登录没有找到家目录。这里通过autofs方式，登录时自动挂载家目录
[[email protected] ~]# yum install nfs-utils -y # 安装nfs-utils 使用showmount 查看服务器共享目录
[[email protected] ~]# showmount -e 192.168.118.14 # 查看到node1共享了/ldaphome
Export list for 192.168.118.14:
/ldaphome 192.168.118.0/24
[[email protected] ~]# yum install autofs -y # 安装autofs包
[[email protected] ~]# vim /etc/auto.master
/ldaphome /etc/auto.nfs # 添加一条新的规则
[[email protected] ~]# vim /etc/auto.nfs # 添加自动挂载的规则
* -fstype=nfs,rw,async 192.168.118.14:/ldaphome/& # 挂载192.168.118.14:/ldaphome/到本地的/ldaphome
[[email protected] ~]# service autofs start # 启动autofs服务
Loading autofs4: [ OK ]
Starting automount: [ OK ]
[[email protected] ~]# su - ldapuser1 # 直接测试
[[email protected] ~]$ pwd
/ldaphome/ldapuser1
[[email protected] ~]$ df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/mapper/VolGroup-lv_root
18003272 838212 16243872 5% /
tmpfs 502384 0 502384 0% /dev/shm
/dev/sda1 487652 33246 428806 8% /boot
/dev/sr0 3803432 3803432 0 100% /mnt/iso
192.168.118.14:/ldaphome/ldapuser1
18003328 802432 16279680 5% /ldaphome/ldapuser1
查看上面已经挂载成功。
时间： 2024-11-03 21:23:38