寫在前面

openldap 常用名詞解釋
o– organization（組織-公司）
ou – organization unit（組織單元/部門）
c - countryName（國家）
dc - domainComponent（域名元件）
sn – suer name（真實名稱）
cn - common name（常用名稱）
dn - distinguished name（專有名稱）

注意： openldap版本2.4.44

安裝前配置

1. 防火牆設定

1. 關閉防火牆
   #systemctl stop firewalld.service
2. 禁止firewall開機啟動
   #systemctl disable firewalld.service
3. 檢視預設防火牆狀態
   #firewall-cmd --state

2. 修改selinux

• #vi /etc/selinux/config
  將SELINUX=enforcing改為:SELINUX=disabled

                                                                                                                                                                                                          
   # This file controls the state of SELinux on the system.
   
  
   # SELINUX= can take one of these three values:
   #     enforcing - SELinux security policy is enforced.
   #     permissive - SELinux prints warnings instead of enforcing.
   #     disabled - No SELinux policy is loaded.
   #SELINUX=enforcing
   SELINUX=disabled
   # SELINUXTYPE= can take one of three two values:
   
  
   #     targeted - Targeted processes are protected,
   #     minimum - Modification of targeted policy. Only selected processes are protected. 
   #     mls - Multi Level Security protection.
   SELINUXTYPE=targeted
  

• #setenforce 0 //關閉selinux防火牆

安裝配置openldap

1. 安裝openldap:

• #yum -y install openldap compat-openldap openldap-clients openldap-servers openldap-servers-sql openldap-devel migrationtools

2. 設定管理員密碼

• #slappasswd -s 123456

  結果：
  {SSHA}ueh3N2mMjtwfxztuJJeaXLxDIuH3/dql

3. 編輯配置

• #cd /etc/openldap/slapd.d/cn=config
• #vim olcDatabase={2}hdb.ldif

  #修改 olcDatabase\=\{2\}hdb.ldif
  #這個密碼就是上面生成的管理密碼，然後修改域名資訊
  olcRootPW: {SSHA}ueh3N2mMjtwfxztuJJeaXLxDIuH3/dql
  olcSuffix: dc=domain,dc=com
  olcRootDN: cn=root,dc=domain,dc=com
  

• #vim olcDatabase={1}monitor.ldif

  #修改 olcDatabase\=\{1\}monitor.ldif
  olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
    al,cn=auth" read by dn.base="cn=cn=root,dc=domain,dc=com" read by * none
  

4. 測試下配置

• #slaptest -u
  提示succeeded 說明配置正確

  5bbdc0ba ldif_read_file: checksum error on “/etc/openldap/slapd.d/cn=config/olcDatabase= {1}monitor.ldif”
  5bbdc0ba ldif_read_file: checksum error on “/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif”
  config file testing succeeded

5. 配置openldap資料庫

• #cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
• #chown ldap:ldap -R /var/lib/ldap
• #chmod 700 -R /var/lib/ldap
  注意：/var/lib/ldap/就是BerkeleyDB資料庫預設儲存的路徑。

6. 授權，若不授權啟動時或報錯，許可權不足

• #chown ldap:ldap -R /var/run/openldap
• #chown -R ldap:ldap /etc/openldap/

7. 啟動

• #systemctl start slapd
• #systemctl enable slapd

8. 執行ldapsearch -x檢查是否有如下輸出

• #ldapsearch -x -b ‘’ -s base’(objectclass=*)’

  結果：
  # extended LDIF
  #
  # LDAPv3
  # base <> with scope baseObject
  # filter: (objectclass=*)
  # requesting: ALL
  #

  #
  dn:
  objectClass: top
  objectClass: OpenLDAProotDSE

  # search result
  search: 2
  result: 0 Success

  # numResponses: 2
  # numEntries: 1

  如顯示上面資訊，表示服務已經啟動成功。

9. 配置openldap基礎的資料庫

1. 編輯ldif檔案
   #vim base.ldif

   dn: dc=domain,dc=com
   o: domain com
   dc: domain
   objectClass: top
   objectClass: dcObject
   objectclass: organization
   
   dn: cn=root,dc=domain,dc=com
   cn: root
   objectClass: organizationalRole
   description: Directory Manager
   
   dn: ou=OP,dc=domain,dc=com
   ou: OP
   objectClass: top
   objectClass: organizationalUnit
   
   dn: ou=Group,dc=domain,dc=com
   ou: Group
   objectClass: top
   objectClass: organizationalUnit
   

2. 匯入資料庫
   #ldapadd -x -D “cn=root,dc=domain,dc=com” -W -f base.ldif

   adding new entry “dc=domain,dc=com”
   
   adding new entry “cn=root,dc=domain,dc=com”
   
   adding new entry “ou=OP,dc=domain,dc=com”
   
   adding new entry “ou=Group,dc=domain,dc=com”

   注意：密碼是上面設定的密碼，這裡是123456

3. 驗證
   #ldapsearch -x -b ‘dc=domain,dc=com’ ‘(objectClass=*)’

   結果如下：
   
   # extended LDIF
   #
   # LDAPv3
   # base <dc=domain,dc=com> with scope subtree
   # filter: (objectClass=*)
   # requesting: ALL
   #
   
   # domain.com
   dn: dc=domain,dc=com
   o: domain com
   dc: domain
   objectClass: top
   objectClass: dcObject
   objectClass: organization

   # root, domain.com
   dn: cn=root,dc=domain,dc=com
   cn: root
   objectClass: organizationalRole
   description: Directory Manager

   # OP, domain.com
   dn: ou=OP,dc=domain,dc=com
   ou: OP
   objectClass: top
   objectClass: organizationalUnit

   # Group, domain.com
   dn: ou=Group,dc=domain,dc=com
   ou: Group
   objectClass: top
   objectClass: organizationalUnit

   # search result
   search: 2
   result: 0 Success

   # numResponses: 5
   # numEntries: 4

-----------------------------至此可以用root:123456登入 未完待續------------------------------------------------------------------------