之前总结了OpenLDAP基础知识，以往在centos6.x系统上是通过slapd.conf配置部署OpenLDAP主从环境的，centos7上默认是动态部署的，通过yum安装发现无slapd.conf文件。下面记录下Centos7.4系统下OpenLDAP主从环境配置记录：
1）服务器基本信息
192.168.10.213 openldap-master 192.168.10.214 openldap-slave
关闭两个节点机器的防火墙和selinux（两个节点机器上都要操作）
[[email protected] ~]# systemctl stop firewalld.service [[email protected] ~]# systemctl disable firewalld.service [[email protected] ~]# firewall-cmd --state not running
做下两台节点机器的hosts主机名绑定（两个节点机器上都要操作）
[[email protected] ~]# cat /etc/hosts ....... 192.168.10.213 openldap-master 192.168.10.214 openldap-slave
同步系统时间（两个节点机器上都要操作）
[[email protected] ~]# ntpdate ntp1.aliyun.com
2）OpenLDAP安装（两个节点机器上都要操作）
[[email protected] ~]# vim installOpenldap.sh #!/bin/bash echo "install ldap rpm" # compat-openldap这个包与主从有很大的关系 yum install -y openldap openldap-* compat-openldap migrationtools systemctl start slapd systemctl enable slapd [[email protected] ~]# chmod 755 installOpenldap.sh [[email protected] ~]# sh -x installOpenldap.sh
查看安装的ldpa服务
[[email protected] ~]# rpm -qa|grep ldap openldap-servers-2.4.44-13.el7.x86_64 openldap-devel-2.4.44-13.el7.x86_64 openldap-2.4.44-13.el7.x86_64 compat-openldap-2.3.43-5.el7.x86_64 openldap-clients-2.4.44-13.el7.x86_64 openldap-servers-sql-2.4.44-13.el7.x86_64
查看OpenLDAP版本
[[email protected] ~]# slapd -VV
@(#) $OpenLDAP: slapd 2.4.44 (Apr 12 2018 19:17:38) $
[email protected]:/builddir/build/BUILD/openldap-2.4.44/openldap-2.4.44/servers/slapd
查看ldap启动状态
[[email protected] ~]# systemctl status slapd
● slapd.service - OpenLDAP Server Daemon
Loaded: loaded (/usr/lib/systemd/system/slapd.service; enabled; vendor preset: disabled)
Active: active (running) since Thu 2018-05-17 18:24:39 CST; 18min ago
Docs: man:slapd
man:slapd-config
man:slapd-hdb
man:slapd-mdb
file:///usr/share/doc/openldap-servers/guide.html
Process: 26399 ExecStart=/usr/sbin/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS (code=exited, status=0/SUCCESS)
Process: 26366 ExecStartPre=/usr/libexec/openldap/check-config.sh (code=exited, status=0/SUCCESS)
Main PID: 26402 (slapd)
Memory: 10.4M
CGroup: /system.slice/slapd.service
└─26402 /usr/sbin/slapd -u ldap -h ldapi:/// ldap:///
May 17 18:35:19 openldap-master slapd[26402]: conn=1008 fd=11 ACCEPT from IP=192.168.10.214:37622 (IP=0.0.0.0:389)
May 17 18:35:19 openldap-master slapd[26402]: conn=1008 op=0 BIND dn="cn=manager,c=cn" method=128
May 17 18:35:19 openldap-master slapd[26402]: conn=1008 op=0 RESULT tag=97 err=49 text=
May 17 18:35:19 openldap-master slapd[26402]: conn=1008 op=1 UNBIND
May 17 18:35:19 openldap-master slapd[26402]: conn=1008 fd=11 closed
May 17 18:40:19 openldap-master slapd[26402]: conn=1009 fd=11 ACCEPT from IP=192.168.10.214:37624 (IP=0.0.0.0:389)
May 17 18:40:19 openldap-master slapd[26402]: conn=1009 op=0 BIND dn="cn=manager,c=cn" method=128
May 17 18:40:19 openldap-master slapd[26402]: conn=1009 op=0 RESULT tag=97 err=49 text=
May 17 18:40:19 openldap-master slapd[26402]: conn=1009 op=1 UNBIND
May 17 18:40:19 openldap-master slapd[26402]: conn=1009 fd=11 closed
查看openldap默认监听的389端口（centos7最小化安装默认没有netstat命令，需安装）
[[email protected] ~]# yum install net-tools -y [[email protected] ~]# netstat -antup| grep 389 tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 26195/slapd tcp6 0 0 :::389 :::* LISTEN 26195/slapd
============================================================================
温馨提示：
本案例测试时，已关闭了iptables防火墙。如果开启了iptables，则需要开放389端口
[[email protected] ~]# firewall-cmd --zone=public --add-port=389/tcp --permanent
[[email protected] ~]# firewall-cmd --reload
============================================================================
3）配置OpenLDAP数据库（两个节点机器上都要操作）
[[email protected] ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG [[email protected] ~]# chown ldap:ldap -R /var/lib/ldap/ [[email protected] ~]# chmod 700 -R /var/lib/ldap [[email protected] ~]# ll /var/lib/ldap/ total 19156 -rwx------. 1 ldap ldap 2048 May 17 17:42 alock -rwx------. 1 ldap ldap 2351104 May 17 17:42 __db.001 -rwx------. 1 ldap ldap 17457152 May 17 17:42 __db.002 -rwx------. 1 ldap ldap 1884160 May 17 17:42 __db.003 -rwx------. 1 ldap ldap 845 May 17 17:49 DB_CONFIG -rwx------. 1 ldap ldap 8192 Mar 13 18:38 dn2id.bdb -rwx------. 1 ldap ldap 32768 Mar 13 18:38 id2entry.bdb -rwx------. 1 ldap ldap 10485760 May 17 17:42 log.0000000001
配置ldap服务
设置OpenLDAP的管理员密码（这里密码为：kevin123456）
[[email protected] ~]# slappasswd #或者使用命令"slappasswd -s kevin123456"
New password:
Re-enter new password:
{SSHA}p2PfTOW/rViNOvc2WkB5BHD05/m+LTux
编辑chrootpw.ldif文件
[[email protected] ~]# cd /opt/
[[email protected] opt]# vim chrootpw.ldif
# specify the password generated above for "olcRootPW" section
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}p2PfTOW/rViNOvc2WkB5BHD05/m+LTux
导入chrootpw.ldif
[[email protected] opt]# ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={0}config,cn=config"
============================================================================
温馨提示：
如果上面的命令出现下面报错：
[[email protected] opt]# ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={0}config,cn=config"
ldap_modify: Inappropriate matching (18)
additional info: modify/add: olcRootPW: no equality matching rule
解决办法：
修改modify.ldif中对应选项的"add"为"replace"即可
即：
[[email protected] opt]# cat chrootpw.ldif
# specify the password generated above for "olcRootPW" section
dn: olcDatabase={0}config,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: {SSHA}p2PfTOW/rViNOvc2WkB5BHD05/m+LTux
然后再次执行
[[email protected] opt]# ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={0}config,cn=config"
============================================================================
导入基本模式
[[email protected] opt]# vim ldapaddBaseSchema.sh #!/bin/bash ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
执行上面脚本
[[email protected] opt]# chmod 755 ldapaddBaseSchema.sh [[email protected] opt]# sh -x ldapaddBaseSchema.sh + ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=cosine,cn=schema,cn=config" + ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=nis,cn=schema,cn=config" + ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=inetorgperson,cn=schema,cn=config"
===========================================================================
温馨提示：
如果上面的命令出现下面报错：
......
ldap_add: Other (e.g., implementation specific) error (80)
additional info: olcAttributeTypes: Duplicate attributeType: "2.16.840.1.113730.3.1.1"
原因是：
LDIF已经加载，所以尝试再次加载它们就报错这些信息，忽略这个步骤即可。
===========================================================================
接着在ldap服务的DB中设置域名，即编辑chdomain.ldif文件
[[email protected] opt]# vim chdomain.ldif
# replace to your own domain name for "dc=***,dc=***" section
# specify the password generated above for "olcRootPW" section
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
read by dn.base="cn=Manager,c=cn" read by * none
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: c=cn
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,c=cn
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}p2PfTOW/rViNOvc2WkB5BHD05/m+LTux
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
dn="cn=Manager,c=cn" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,c=cn" write by * read
导入chdomain.ldif文件
[[email protected] opt]# ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={1}monitor,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
===================================================================================
温馨提示：
如果上面的命令出现下面报错：
.......
ldap_modify: Inappropriate matching (18)
additional info: modify/add: olcRootPW: no equality matching rule
解决办法：将chdomain.ldif文件中的"add"全部替换成"replace"，然后重新执行上面命令即可！
===================================================================================
导入管理员基础数据
[[email protected] opt]# vim rootdn.ldif dn: c=cn objectclass: country c: cn dn: cn=Manager,c=cn objectclass: organizationalRole cn: Manager
执行下面命令，输入上面设置的密码:kevin123456
[[email protected] opt]# ldapadd -x -D cn=Manager,c=cn -W -f rootdn.ldif Enter LDAP Password: adding new entry "c=cn" adding new entry "cn=Manager,c=cn"
开启日志配置
查看OpenLDAP的日志级别，日志主要用于对OpenLDAP排查
[[email protected] opt]# slapd -d ?
Installed log subsystems:
Any (-1, 0xffffffff)
Trace (1, 0x1)
Packets (2, 0x2)
Args (4, 0x4)
Conns (8, 0x8)
BER (16, 0x10)
Filter (32, 0x20)
Config (64, 0x40)
ACL (128, 0x80)
Stats (256, 0x100)
Stats2 (512, 0x200)
Shell (1024, 0x400)
Parse (2048, 0x800)
Sync (16384, 0x4000)
None (32768, 0x8000)
NOTE: custom log subsystems may be later installed by specific code
编辑logLevel.ldif文件
[[email protected] opt]# vim logLevel.ldif [[email protected] opt]# cat logLevel.ldif dn: cn=config changetype: modify replace: olcLogLevel olcLogLevel: stats
导入logLevel.ldif
[[email protected] opt]# ldapmodify -Y EXTERNAL -H ldapi:/// -f logLevel.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config"
创建slapd.log文件
[[email protected] opt]# touch /var/log/slapd.log [[email protected] opt]# vim /etc/rsyslog.conf +73 #"+73"表示指定位到文件73行 ....... local4.* /var/log/slapd.log
重启系统日志服务与ldap服务
[[email protected] opt]# systemctl restart rsyslog [[email protected] opt]# systemctl restart slapd [[email protected] opt]# systemctl status slapd [[email protected] opt]# tail -f /var/log/slapd.log May 17 18:24:38 openldap-master slapd[26195]: daemon: shutdown requested and initiated. May 17 18:24:38 openldap-master slapd[26195]: slapd shutdown: waiting for 0 operations/tasks to finish May 17 18:24:38 openldap-master slapd[26195]: slapd stopped. May 17 18:24:38 openldap-master slapd[26399]: @(#) $OpenLDAP: slapd 2.4.44 (Apr 12 2018 19:17:38) $#012#[email protected]:/builddir/build/BUILD/openldap-2.4.44/openldap-2.4.44/servers/slapd May 17 18:24:39 openldap-master slapd[26402]: slapd starting
======================================================================================
温馨提示：
还可以通过cn=config配置OpenLDAP日志
[[email protected] opt]# cat /etc/openldap/slapd.d/cn\=config.ldif | grep olcLogLevel
olcLogLevel: stats
[[email protected] opt]# cat << EOF | ldapmodify -Y EXTERNAL -H ldapi:///
> dn: cn=config
> changetype: modify
> add: olcLogLevel
> olcLogLevel: 32
> EOF
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
======================================================================================
4）OpenLDAP主从模式配置
a）openldap-master主节点配置
在master上启用添加syncprov模块来实现主从复制功能点，通过ldif文件来增加syncprov模块，无需重启ldap server。
[[email protected] opt]# vim mod_syncprov.ldif dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/lib64/openldap olcModuleLoad: syncprov.la
Ldap由于scheam的控制，文件里的属性有严格的控制，错误的或者不存在的属性将无法执行ldif文件，所以ldif文件的字体颜色会帮助我们配置ldif文件（属性：绿色，属性值：红色）
[[email protected] opt]# ldapadd -Y EXTERNAL -H ldapi:/// -f mod_syncprov.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=module,cn=config"
[[email protected] opt]# vim syncprov.ldif
dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
olcSpCheckpoint: 100 10
olcSpSessionLog: 100
[[email protected] opt]# ldapadd -Y EXTERNAL -H ldapi:/// -f syncprov.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "olcOverlay=syncprov,olcDatabase={2}hdb,cn=config"
b）openldap-slave从节点配置
同样，在slave上也需要配置syncrepl，因为syncrepl实现的主从复制是单向的，即master的所有操作都会同步到slave上，slave无法同步到master上，为了避免master与slave上的数据不一致，slave上禁止对ldap信息的增删改操作，只允许查询操作。因为是单向的，故slave需要一些master的认证信息，以便从master同步数据。
[[email protected] opt]# vim syncrepl.ldif
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcSyncRepl
olcSyncRepl: rid=001
provider=ldap://192.168.10.213:389/
bindmethod=simple
binddn="cn=Manager,c=cn"
credentials=AHdms520
searchbase="c=cn"
scope=sub
schemachecking=on
type=refreshAndPersist
retry="5 5 300 +"
attrs="*,+"
interval=00:00:00:10
注意：一定要注意字体的颜色和上面一致，provider，bindmethod …… interval都是olcSyncRepl的属性值，不是与olcSyncRepl同级别，故其为红色。
[[email protected] opt]# ldapadd -Y EXTERNAL -H ldapi:/// -f syncrepl.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={2}hdb,cn=config"
原文地址：https://www.cnblogs.com/kevingrace/p/9052669.html