搭建一套OpenLDAP系统，实现账号的统一管理
可实现的功能：
1：OpenLDAP服务端的搭建
2：PhpLDAPAdmin的搭建(便于web页面管理)
3: OpenLDAP服务端配置分组管理用户sudo权限分配；
（1）默认没有sudo权限；
（2）运维具有sudo到任何用户执行任何命令权限；
（3）研发具有相应的配置执行命令权限
4：OpenLDAP客户端的配置
5：OpenLDAP与SSH
6：OpenLDAP结合客户端PAM，限制用户登录主机
7：OpenLDAP加入密码策略
（1）强制用户首次登录系统更改密码
（2）密码最小设置长度
（3）密码设置强度
（4）密码过期前警告天数
（5）密码过期后不能登录的天数
（6）密码尝试次数，被锁定
（7）密码失败后恢复时间
（8）是否允许用户修改密码
（9）账号锁定后，不能自动解锁，需管理员解锁
8：MirrorMode同步实现OpenLDAP双主模式
9，Keepalived+OpenLDAP实现OpenLDAP高可用
10，TCP Warppers
账号集中管理系统访问和维护流程：
实验环境：
系统：
主：CentOS6.5 64位 192.168.9.225
主：CentOS6.5 64 位 192.168.9.168
VIP： 192.168.9.253
客户端： CentoOS6.5 64位 192.168.9.176
软件包：
openldap-2.4.45
db-4.6.21
phpldapadmin-1.2.3
ltb-project-openldap-initscript-2.2
资料链接：
https://ltb-project.org/download
http://www.openldap.org/
http://www.oracle.com/technetwork/database/database-technologies/berkeleydb/downloads/index-082944.html
ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/
http://download.oracle.com/berkeley-db/db-4.6.21.tar.gz
一，安装OpenLDAP服务端
（俩台主安装方法一样）
1.1 基础环境配置
（1）系统初始化（参见http://wupengfei.blog.51cto.com/7174803/1955545）
（2）关闭防火墙与SElinux
service iptables stop chkconfig iptables off sed -i ‘[email protected][email protected][email protected]‘ /etc/selinux/config
（3）时间同步
yum -y install ntp /usr/sbin/ntpdate -u clepsydra.dec.com tick.ucla.edu ntp.nasa.gov echo "1 2 * * * /usr/sbin/ntpdate -u clepsydra.dec.com tick.ucla.edu ntp.nasa.gov" >> /var/spool/cron/root
1.2 源码安装OpenLDAP
（1）yum安装依赖包
yum -y install gcc gcc-c++ unzip gzip bzip2 openssl-devel cyrus-sasl-devel krb5-devel tcp_wrappers-devel libtool-ltdl-devel openslp-devel unixODBC-devel mysql-devel
（2）源码安装Berkeley DB
cd /usr/local/src/ wget http://download.oracle.com/berkeley-db/db-4.6.21.tar.gz tar xf db-4.6.21.tar.gz cd db-4.6.21/build_unix/ ../dist/configure --prefix=/usr/local/BDB4 make && make install echo "/usr/local/BDB4/lib" >> /etc/ld.so.conf.d/bdb.conf ldconfig ln -sv /usr/local/BDB4/include /usr/local/bdb
（3）源码安装OpenLDAP
cd /usr/local/src/ wget ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.45.tgz gunzip -c openldap-2.4.45.tgz | tar xf - cd openldap-2.4.45 ./configure --prefix=/usr/local/openldap2.4 --enable-slapd --enable-dynacl --enable-aci --enable-cleartext --enable-crypt --enable-lmpasswd --enable-spasswd --enable-modules --enable-rewrite --enable-rlookups --enable-slapi --enable-wrappers --enable-backends --enable-ndb=no --enable-perl=no --enable-overlays CPPFLAGS="-I/usr/local/BDB4/include" LDFLAGS="-L/usr/local/BDB4/lib" make depend make make test make install echo "/usr/local/openldap2.4/lib" >> /etc/ld.so.conf.d/ldap.conf ldconfig ln -sv /usr/local/openldap2.4/include /usr/include/ldap2.4 ln -sv /usr/local/openldap2.4/bin/* /usr/local/bin/ ln -sv /usr/local/openldap2.4/sbin/* /usr/local/sbin/
1.4 配置实现功能
（1）配置文件模板
# grep -v ^# slapd.conf | grep -v ^$
include /usr/local/openldap2.4/etc/openldap/schema/corba.schema
include /usr/local/openldap2.4/etc/openldap/schema/core.schema
include /usr/local/openldap2.4/etc/openldap/schema/cosine.schema
include /usr/local/openldap2.4/etc/openldap/schema/duaconf.schema
include /usr/local/openldap2.4/etc/openldap/schema/dyngroup.schema
include /usr/local/openldap2.4/etc/openldap/schema/inetorgperson.schema
include /usr/local/openldap2.4/etc/openldap/schema/java.schema
include /usr/local/openldap2.4/etc/openldap/schema/misc.schema
include /usr/local/openldap2.4/etc/openldap/schema/nis.schema
include /usr/local/openldap2.4/etc/openldap/schema/openldap.schema
include /usr/local/openldap2.4/etc/openldap/schema/ppolicy.schema
include /usr/local/openldap2.4/etc/openldap/schema/collective.schema
include /usr/local/openldap2.4/etc/openldap/schema/sudo.schema
pidfile /usr/local/openldap2.4/var/run/slapd.pid
argsfile /usr/local/openldap2.4/var/run/slapd.args
modulepath /usr/local/openldap2.4/libexec/openldap
moduleload accesslog.la
moduleload auditlog.la
moduleload ppolicy.la
moduleload syncprov.la
moduleload back_mdb.la
moduleload back_ldap.la
access to attrs=shadowLastChange,userPassword
by self write
by anonymous auth
by dn.base="cn=admin,dc=dabayouxi,dc=com" write
by * none
access to *
by self write
by * read
database config
access to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
by dn.base="cn=admin,dc=dabayouxi,dc=com" write
by * none
database mdb
suffix "dc=dabayouxi,dc=com"
rootdn "cn=admin,dc=dabayouxi,dc=com"
rootpw {SSHA}jnN16Laklfzlm4hCrob1nhUgUloLpvnm
directory /data0/openldap-data
index objectClass eq,pres
index ou,cn,mail,surname,givenname eq,pres,sub
index uidNumber,gidNumber,loginShell eq,pres
index uid,memberUid eq,pres,sub
index nisMapName,nisMapEntry eq,pres,sub
loglevel 256
logfile /data0/logs/slapd/slapd.log
checkpoint 2048 10
overlay ppolicy
ppolicy_default cn=default,ou=pwpolicies,dc=dabayouxi,dc=com
（2）添加sudo.schema
cp -f /usr/share/doc/sudo-1.8.6p3/schema.OpenLDAP /usr/local/openldap2.4/etc/openldap/schema/sudo.schema restorecon /usr/local/openldap2.4/etc/openldap/schema/sudo.schema
（3）创建ldap用户和组
groupadd -r ldap useradd -r -g ldap -s /sbin/nologin ldap
（4）配置日志
mkdir -p /data0/logs/slapd
touch /data0/logs/slapd/slapd.log
echo "local4.* /data0/logs/slapd/slapd.log" >> /etc/rsyslog.d/openldap.conf
service rsyslog restart
echo "/data0/logs/slapd/*log {
missingok
compress
notifempty
daily
rotate 5
create 0600 root root
}" >> /etc/logrotate.d/slapd
（5）配置数据存放路径
mkdir -p /data0/openldap-data chmod 700 /data0/openldap-data/ cp /usr/local/openldap2.4/etc/openldap/DB_CONFIG.example /data0/openldap-data/DB_CONFIG chown -R ldap.ldap /data0/openldap-data/ mkdir -p /usr/local/openldap2.4/etc/openldap/slapd.d cd /usr/local/openldap2.4/etc/openldap/ slaptest -f slapd.conf -F slapd.d/ echo "BASE dc=dabayouxi,dc=com URI ldap://192.168.9.168" >> /usr/local/openldap2.4/etc/openldap/ldap.conf
（6）启动脚本下载，修改配置
cd /usr/local/src/ wget https://ltb-project.org/archives/ltb-project-openldap-initscript-2.2.tar.gz tar -xvf ltb-project-openldap-initscript-2.2.tar.gz mv ltb-project-openldap-initscript-2.2/slapd /etc/init.d vim /etc/init.d/slapd SLAPD_PATH="/usr/local/openldap2.4" DATA_PATH="/data0/openldap-data" BDB_PATH="/usr/local/BDB4" chmod +x /etc/init.d/slapd chkconfig slapd on service slapd restart
1.5 OpenLDAP目录树规划
# 将规划的dn导入，将以下内容写入ldif文件中使用ldapadd 命令添加到数据库
mkdir -p /data0/ldapldif/{users,groups,sudoers,policy}
（1）base.ldif
vim /data0/ldapldif/base.ldif dn: dc=dabayouxi,dc=com dc: dabayouxi objectClass: top objectClass: domain dn: ou=users,dc=dabayouxi,dc=com ou: users objectClass: top objectClass: organizationalUnit dn: ou=groups,dc=dabayouxi,dc=com ou: groups objectClass: top objectClass: organizationalUnit dn: ou=sudoers,dc=dabayouxi,dc=com ou: sudoers objectClass: top objectClass: organizationalUnit dn: ou=pwpolicies,dc=dabayouxi,dc=com ou: pwpolicies objectClass: top objectClass: organizationalUnit ldapadd -x -D cn=admin,dc=dabayouxi,dc=com -W -f /data0/ldapldif/base.ldif Enter LDAP Password: adding new entry "dc=dabayouxi,dc=com" adding new entry "ou=users,dc=dabayouxi,dc=com" adding new entry "ou=groups,dc=dabayouxi,dc=com" adding new entry "ou=sudoers,dc=dabayouxi,dc=com" adding new entry "ou=pwpolicies,dc=dabayouxi,dc=com" -x 使用简单认证，不使用加密协议 -D 指定查找的dn，类似操作系统中的根目录 -W 输入密码，不想输入密码使用-w passwd，不推荐容易暴露密码 -f 指定ldif文件 # 通过 ldapsearch查看当前目录树结构 ldapsearch -x -LLL # -LLL 禁止输出不匹配的消息
（2）groups.ldif
echo "dn: cn=web,ou=groups,dc=dabayouxi,dc=com objectClass: posixGroup objectClass: top cn: web gidNumber: 1501" >> /data0/ldapldif/groups/web.ldif echo "dn: cn=core,ou=groups,dc=dabayouxi,dc=com objectClass: posixGroup objectClass: top cn: core gidNumber: 1502" >> /data0/ldapldif/groups/core.ldif ldapadd -x -D cn=admin,dc=dabayouxi,dc=com -W -f /data0/ldapldif/groups/web.ldif Enter LDAP Password: adding new entry "cn=web,ou=groups,dc=dabayouxi,dc=com" ldapadd -x -D cn=admin,dc=dabayouxi,dc=com -W -f /data0/ldapldif/groups/core.ldif Enter LDAP Password: adding new entry "cn=core,ou=groups,dc=dabayouxi,dc=com"
（3）users.ldif
echo "dn: uid=webuser,ou=users,dc=dabayouxi,dc=com
uid: webuser
cn: webuser
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {SSHA}1F4G8mlpJ4asfQud0kJOsj6tIWdoiHEc
shadowLastChange: 17412
shadowMin: 0
shadowMax: 999999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 2501
gidNumber: 1501
homeDirectory: /home/webuser
pwdReset: TRUE" >> /data0/ldapldif/users/webuser.ldif
echo "dn: uid=coreuser,ou=users,dc=dabayouxi,dc=com
uid: coreuser
cn: coreuser
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {SSHA}1F4G8mlpJ4asfQud0kJOsj6tIWdoiHEc
shadowLastChange: 17412
shadowMin: 0
shadowMax: 999999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 2502
gidNumber: 1502
homeDirectory: /home/coreuser
pwdReset: TRUE" >> /data0/ldapldif/users/coreuser.ldif
ldapadd -x -D cn=admin,dc=dabayouxi,dc=com -W -f /data0/ldapldif/users/webuser.ldif
Enter LDAP Password:
adding new entry "uid=webuser,ou=users,dc=dabayouxi,dc=com"
ldapadd -x -D cn=admin,dc=dabayouxi,dc=com -W -f /data0/ldapldif/users/coreuser.ldif
Enter LDAP Password:
adding new entry "uid=coreuser,ou=users,dc=dabayouxi,dc=com"
（4）sudoers.ldif
vim /data0/ldapldif/sudoers/defaults.ldif dn: cn=defaults,ou=sudoers,dc=dabayouxi,dc=com objectClass: top objectClass: sudoRole cn: defaults sudoOption: requiretty sudoOption: !visiblepw sudoOption: always_set_home sudoOption: env_reset vim /data0/ldapldif/sudoers/web.ldif dn: cn=%web,ou=sudoers,dc=dabayouxi,dc=com objectClass: top objectClass: sudoRole cn: %web sudoHost: ALL sudoRunAsUser: www sudoOption: !authenticate sudoOption: !visiblepw sudoOption: always_set_home sudoOption: env_reset sudoCommand: ALL sudoUser: %web vim /data0/ldapldif/sudoers/core.ldif dn: cn=%core,ou=sudoers,dc=dabayouxi,dc=com objectClass: top objectClass: sudoRole cn: %core sudoHost: ALL sudoRunAsUser: ALL sudoOption: !authenticate sudoOption: !visiblepw sudoOption: always_set_home sudoOption: env_reset sudoCommand: ALL sudoUser: %core ldapadd -x -D cn=admin,dc=dabayouxi,dc=com -W -f /data0/ldapldif/sudoers/defaults.ldif Enter LDAP Password: adding new entry "cn=defaults,ou=sudoers,dc=dabayouxi,dc=com" ldapadd -x -D cn=admin,dc=dabayouxi,dc=com -W -f /data0/ldapldif/sudoers/web.ldif Enter LDAP Password: adding new entry "cn=%web,ou=sudoers,dc=dabayouxi,dc=com" ldapadd -x -D cn=admin,dc=dabayouxi,dc=com -W -f /data0/ldapldif/sudoers/core.ldif Enter LDAP Password: adding new entry "cn=%core,ou=sudoers,dc=dabayouxi,dc=com"
（5）pwpolicies.ldif
echo "dn: cn=default,ou=pwpolicies,dc=dabayouxi,dc=com cn: default objectClass: pwdPolicy objectClass: person pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdExpireWarning: 259200 pwdFailureCountInterval: 0 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 300 pwdMaxAge: 2592000 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 8 pwdMustChange: TRUE pwdSafeModify: TRUE sn: dummy value" >> /data0/ldapldif/policy/default.ldif ldapadd -x -D cn=admin,dc=dabayouxi,dc=com -W -f /data0/ldapldif/policy/default.ldif Enter LDAP Password: adding new entry "cn=default,ou=pwpolicies,dc=dabayouxi,dc=com"
1.6 安装PhpLDAPAdmin
yum install -y httpd php php-mbstring php-pear php-ldap cd /usr/local/src/ wget https://jaist.dl.sourceforge.net/project/phpldapadmin/phpldapadmin-php5/1.2.3/phpldapadmin-1.2.3.zip unzip phpldapadmin-1.2.3.zip mkdir -p /data0/web_root/ mv phpldapadmin-1.2.3 /data0/web_root/phpldapadmin echo "<VirtualHost *:80> ServerAdmin [email protected] DocumentRoot /data0/web_root/phpldapadmin ServerName openldap.dabayouxi.com ErrorLog /data0/logs/apache/openldap.dabayouxi.com-error_log CustomLog /data0/logs/apache/openldap.dabayouxi.com-access_log common <Directory "/data/web_root/phpldapadmin"> Options FollowSymLinks AllowOverride all Require all granted </Directory> </VirtualHost>" >> /etc/httpd/conf/httpd.conf mkdir -p /data0/logs/apache/ service httpd restart cp /data0/web_root/phpldapadmin/config/config.php.example /data0/web_root/phpldapadmin/config/config.php vim /data0/web_root/phpldapadmin/config/config.php $servers->setValue(‘server‘,‘host‘,‘192.168.9.168‘); $servers->setValue(‘server‘,‘port‘,389);
浏览器访问输入：http://192.168.9.168
1.7 MirrorMode同步实现OpenLDAP双主模式
（1）192.168.9.168上slapd.conf最后添加
vim /usr/local/openldap2.4/etc/openldap/slapd.conf #添加以下内容 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 serverID 1 syncrepl rid=123 provider=ldap://192.168.9.225/ bindmethod=simple binddn="cn=admin,dc=dabayouxi,dc=com" credentials=dabayouxi searchbase="dc=dabayouxi,dc=com" schemachecking=off type=refreshAndPersist retry="60 +" mirrormode on cd /usr/local/openldap2.4/etc/openldap/ slaptest -u rm -rf slapd.d/* slaptest -f slapd.conf -F slapd.d/ service slapd restart
（2）192.168.9.225上slapd.conf最后添加
vim /usr/local/openldap2.4/etc/openldap/slapd.conf #添加以下内容 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 serverID 2 syncrepl rid=123 provider=ldap://192.168.9.168/ bindmethod=simple binddn="cn=admin,dc=dabayouxi,dc=com" credentials=dabayouxi searchbase="dc=dabayouxi,dc=com" schemachecking=off type=refreshAndPersist retry="60 +" mirrormode on cd /usr/local/openldap2.4/etc/openldap/ slaptest -u rm -rf slapd.d/* slaptest -f slapd.conf -F slapd.d/ service slapd restart
（2）测试同步
1.8 Keepalived+OpenLDAP实现OpenLDAP高可用
（1）下载安装keepalive
cd /usr/local/src/ wget http://www.keepalived.org/software/keepalived-1.2.13.tar.gz yum install -y pcre-devel openssl-devel popt-devel tar xf keepalived-1.2.13.tar.gz cd keepalived-1.2.13 ./configure --prefix=/usr/local/keepalived make make install
（2）配置keepalived配置成系统服务
cd /usr/local/keepalived/ cp etc/rc.d/init.d/keepalived /etc/init.d/ cp etc/sysconfig/keepalived /etc/sysconfig/ mkdir /etc/keepalived cp etc/keepalived/keepalived.conf /etc/keepalived/ cp sbin/keepalived /usr/sbin/ chkconfig keepalived on chkconfig --list keepalived
（3）配置OpenLDAP热备
Master 192.168.9.168
vim /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
router_id OpenLDAP_HA
}
vrrp_instance OpenLDAP {
state Backup
interface eth0
virtual_router_id 53
priority 100
advert_int 1
nopreempt
authentication {
auth_type PASS
auth_pass dabayouxi
}
virtual_ipaddress {
192.168.9.253
}
}
virtual_server 192.168.9.253 389 {
delay_loop 6
nat_mask 255.255.255.0
persistence_timeout 50
protocol TCP
real_server 192.168.9.168 389 {
weight 3
notify_down "/etc/keepalived/openldap.sh"
TCP_CHECK {
connect_timeout 5
nb_get_retry 2
delay_before_retry 3
}
}
}
vim /etc/keepalived/openldap.sh
#!/bin/bash
/etc/init.d/keepalived stop
chmod +x /etc/keepalived/openldap.sh
service keepalived start
Starting keepalived: [ OK ]
ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether fa:9b:55:ac:33:00 brd ff:ff:ff:ff:ff:ff
inet 192.168.9.168/24 brd 192.168.9.255 scope global eth0
inet 192.168.9.253/32 scope global eth0
inet6 fe80::f89b:55ff:feac:3300/64 scope link
valid_lft forever preferred_lft forever
Master 192.168.9.225
vim /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
router_id OpenLDAP_HA
}
vrrp_instance OpenLDAP {
state Backup
interface eth0
virtual_router_id 53
priority 90
advert_int 1
authentication {
auth_type PASS
auth_pass dabayouxi
}
virtual_ipaddress {
192.168.9.253
}
}
virtual_server 192.168.9.253 389 {
delay_loop 6
nat_mask 255.255.255.0
persistence_timeout 50
protocol TCP
real_server 192.168.9.225 389 {
weight 3
notify_down "/etc/keepalived/openldap.sh"
TCP_CHECK {
connect_timeout 5
nb_get_retry 2
delay_before_retry 3
}
}
}
vim /etc/keepalived/openldap.sh
#!/bin/bash
/etc/init.d/keepalived stop
chmod +x /etc/keepalived/openldap.sh
service keepalived start
（4）验证
二，安装OpenLDAP客户端
2.1 基础环境配置
（1）系统初始化（参见http://wupengfei.blog.51cto.com/7174803/1955545）
（2）关闭防火墙与SElinux
service iptables stop chkconfig iptables off sed -i ‘[email protected][email protected][email protected]‘ /etc/selinux/config
（3）时间同步
yum -y install ntp /usr/sbin/ntpdate -u clepsydra.dec.com tick.ucla.edu ntp.nasa.gov echo "1 2 * * * /usr/sbin/ntpdate -u clepsydra.dec.com tick.ucla.edu ntp.nasa.gov" >> /var/spool/cron/root
1.2 源码安装OpenLDAP
（1）yum安装依赖包
yum -y install openldap openldap-devel compat-openldap nss-pam-ldapd
（2）备份源文件
cp /etc/nslcd.conf /etc/nslcd.conf_default cp /etc/nsswitch.conf /etc/nsswitch.conf_dafault cp /etc/pam.d/system-auth-ac /etc/pam.d/system-auth-ac_default cp /etc/pam.d/password-auth-ac /etc/pam.d/password-auth-ac_default cp /etc/pam.d/fingerprint-auth-ac /etc/pam.d/fingerprint-auth-ac_default cp /etc/pam.d/smartcard-auth-ac /etc/pam.d/smartcard-auth-ac_default cp /etc/pam.d/sshd /etc/pam.d/sshd_default cp /etc/pam.d/login /etc/pam.d/login_default cp /etc/openldap/ldap.conf /etc/openldap/ldap.conf_defalut cp /etc/sudo-ldap.conf /etc/sudo-ldap.conf_default
（3）停用sssd服务
service sssd stop && chkconfig sssd off
（4）客户端文件配置修改
#/etc/nslcd.conf
vim /etc/nslcd.conf uri ldap://192.168.9.253 base dc=dabayouxi,dc=com ssl no tls_cacertdir /etc/openldap/cacerts
#/etc/pam_ldap.conf
vim /etc/pam_ldap.conf uri ldap://192.168.9.253 base dc=dabayouxi,dc=com ssl no tls_cacertdir /etc/openldap/cacerts pam_password md5 bind_policy soft pam_lookup_policy yes pam_password clear_remove_old
#/etc/pam.d/system-auth
vim /etc/pam.d/system-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_fprintd.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so minlen=10 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 try_first_pass retry=3 type= password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so
#/etc/pam.d/password-auth
vim /etc/pam.d/password-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so minlen=10 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 try_first_pass retry=3 type= password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so
#/etc/pam.d/fingerprint-auth
vim /etc/pam.d/fingerprint-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_fprintd.so auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so
#/etc/pam.d/smartcard-auth
vim /etc/pam.d/smartcard-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth [success=done ignore=ignore default=die] pam_pkcs11.so wait_for_card card_only auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password required pam_pkcs11.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so
#/etc/pam.d/sshd
vim /etc/pam.d/sshd #%PAM-1.0 auth required pam_sepermit.so auth include password-auth account required pam_access.so account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session required pam_namespace.so session optional pam_keyinit.so force revoke session include password-auth
#/etc/pam.d/login
vim /etc/pam.d/login #%PAM-1.0 auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so auth include system-auth account required pam_nologin.so account include system-auth password include system-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so session required pam_limits.so session optional pam_console.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open session required pam_namespace.so session optional pam_keyinit.so force revoke session include system-auth -session optional pam_ck_connector.so
#/etc/nsswitch.conf
vim /etc/nsswitch.conf passwd: files ldap shadow: files ldap group: files ldap hosts: files dns bootparams: nisplus [NOTFOUND=return] files ethers: files netmasks: files networks: files protocols: files rpc: files services: files netgroup: ldap publickey: nisplus automount: files ldap sudoers: files ldap
#/etc/sysconfig/authconfig
vim /etc/sysconfig/authconfig IPADOMAINJOINED=no USEMKHOMEDIR=yes USEPAMACCESS=no CACHECREDENTIALS=yes USESSSDAUTH=no USESHADOW=yes USEWINBIND=no USESSSD=no PASSWDALGORITHM=sha512 FORCELEGACY=no USEFPRINTD=no USEHESIOD=no FORCESMARTCARD=no USELDAPAUTH=yes IPAV2NONTP=no USELDAP=yes USECRACKLIB=yes USEIPAV2=no USEWINBINDAUTH=no USESMARTCARD=no USELOCAUTHORIZE=yes USENIS=no USEKERBEROS=no USESYSNETAUTH=no USEDB=no USEPASSWDQC=no
# /etc/sudo-ldap.conf
echo "uri ldap://192.168.9.253 sudoers_base ou=sudoers,dc=dabayouxi,dc=com" >> /etc/sudo-ldap.conf
#/etc/openldap/ldap.conf
vim /etc/openldap/ldap.conf TLS_CACERTDIR /etc/openldap/cacerts URI ldap://192.168.9.253 BASE dc=dabayouxi,dc=com
#/etc/security/access.conf
vim /etc/security/access.conf 添加内容 -:ALL EXCEPT root web : ALL
（5）启动服务
service nslcd restart
（6）测试
时间： 2024-10-09 23:44:01