centos7搭建LDAP

一、安装Openldap

[[email protected] ~]# yum install -y openldap openldap-clients openldap-servers migrationtools

二、配置项

[[email protected] ~]# vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}hdb.ldif
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 c347287f
olcRootPW: 123456         ##自定义密码
dn: olcDatabase={2}hdb
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {2}hdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=jcici,dc=com            ##需修改地方
olcRootDN: cn=admin,dc=jcici,dc=com       ##需修改地方
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
structuralObjectClass: olcHdbConfig
entryUUID: 09981338-9f85-1039-906f-315ddb938cdc
creatorsName: cn=config
createTimestamp: 20191120015848Z
entryCSN: 20191120015848.793541Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20191120015848Z

[[email protected] ~]# vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}monitor.ldif
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 b01cea22
dn: olcDatabase={1}monitor
objectClass: olcDatabaseConfig
olcDatabase: {1}monitor
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
 al,cn=auth" read by dn.base="cn=admin,dc=jcici,dc=com" read by * none    ##与上文保持一致
structuralObjectClass: olcDatabaseConfig
entryUUID: 09980852-9f85-1039-906e-315ddb938cdc
creatorsName: cn=config
createTimestamp: 20191120015848Z
entryCSN: 20191120015848.793262Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20191120015848Z

[[email protected] ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[[email protected] ~]# chown -R ldap.ldap /var/lib/ldap
[[email protected] ~]#  slaptest -u
5dd49e8b ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif"
5dd49e8b ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif"
config file testing succeeded
[[email protected] ~]# systemctl start slapd
[[email protected] ~]#  systemctl enable slapd
Created symlink from /etc/systemd/system/multi-user.target.wants/slapd.service to /usr/lib/systemd/system/slapd.service.
[[email protected] ~]# netstat -tunlp | egrep "389|636"
tcp        0      0 0.0.0.0:389             0.0.0.0:*               LISTEN      2370/slapd
tcp6       0      0 :::389                  :::*                    LISTEN      2370/slapd
[[email protected] ~]# cd /etc/openldap/schema/
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f cosine.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f nis.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f collective.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f corba.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f core.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f duaconf.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f dyngroup.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f inetorgperson.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f java.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f misc.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f openldap.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f pmi.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f ppolicy.ldif

[[email protected] schema]# cd /usr/share/migrationtools/
[[email protected] migrationtools]# vim migrate_common.ph
        $NAMINGCONTEXT{‘group‘}             = "ou=Group";    ##num61
$DEFAULT_MAIL_DOMAIN = "jcici.com";    ##num71
$DEFAULT_BASE = "dc=jcici,dc=com";    ##num74
$EXTENDED_SCHEMA = 1;    ##num90

[[email protected] migrationtools]# ./migrate_base.pl > /root/base.ldif
[[email protected] migrationtools]# ldapadd -x -W -D "cn=admin,dc=jcici,dc=com" -f /root/base.ldif

三、添加账号已经测试验证

[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f cosine.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f nis.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f collective.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f corba.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f core.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f duaconf.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f dyngroup.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f inetorgperson.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f java.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f misc.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f openldap.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f pmi.ldif
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f ppolicy.ldif

[[email protected] ~]# mkdir /home/guests
[[email protected] ~]# useradd -d /home/guests/ldapuser1 ldapuser1
[[email protected] ~]# useradd -d /home/guests/ldapuser2 ldapuser2

[[email protected] ~]# echo ‘password‘ | passwd --stdin ldapuser1
[[email protected] ~]# echo ‘password‘ | passwd --stdin ldapuser2
[[email protected] ~]# getent passwd | tail -n 5 > /root/users

[[email protected] ~]# getent shadow | tail -n 5 > /root/shadow

[[email protected] ~]# getent group | tail -n 5 > /root/groups
[[email protected] ~]# cd /usr/share/migrationtools

[[email protected] ~]# vim migrate_passwd.pl
        open(SHADOW, "/root/shadow") || return;	##num188
[[email protected] ~]# ./migrate_passwd.pl /root/users > users.ldif

[[email protected] ~]# ./migrate_group.pl /root/groups > groups.ldif
[[email protected] ~]# ldapadd -x -W -D "cn=admin,dc=jcici,dc=com" -f users.ldif

[[email protected] ~]# ldapadd -x -W -D "cn=admin,dc=jcici,dc=com" -f groups.ldif
[[email protected] ~]# ldapsearch -x -b "dc=jcici,dc=com" -H ldap://127.0.0.1

客户端验证

[[email protected] ~]# yum install -y nss-pam*

[[email protected] ~]# authconfig-tui

[[email protected] ~]# su  ldapuser1
bash-4.2$ whoami
ldapuser1
bash-4.2$

原文地址：https://www.cnblogs.com/jcici/p/11896684.html