搭建OPENLDAP代理服務無縫訪問AD伺服器
阿新 • • 發佈:2019-01-07
tar -xvzf db-4.6.21.tar.gz
cd db-4.6.21
cd build_unix
../dist/configure --prefix=/usr/local/berkeleydb
make
make install
2、安裝openldap
下載openldap安裝包:此處我用的版本號為2.4.43,下面配置也僅依據該版本 ,其他版本未做研究,而且差別很大。
安裝包:openldap-2.4.43.tgz
第一步,解開安裝包
第二步,設定編譯環境變數
CPPFLAGS="-I/usr/local/berkeleydb/include"
export CPPFLAGS
LDFLAGS="-L/usr/local/lib -L/usr/local/berkeleydb/lib"
export LDFLAGS
LD_LIBRARY_PATH="/usr/local/berkeleydb/lib"
export LD_LIBRARY_PATH
第三步,配置openldap:
cd openldap-2.4.43
./configure --prefix=/usr/local/ldapproxy --enable-bdb=mod --enable-ldap=mod --enable-meta=mod --enable-rewrite=yes --with-proxycache =yes --enable-rwm=yes
沒有報錯即可下一步。若有報錯優先解決滿足配置要求。
如下警告:configure: WARNING: unrecognized options: –with-proxycache
可以不理會,繼續
make depend
第四步,編譯安裝:
make
make install
第五步,配置openldap:
vi /usr/local/ldapproxy/etc/openldap/slapd.conf
1、包入所有的schema
include /usr/local/ldapproxy/etc/openldap/schema/core.schema
include /usr/local/ldapproxy/etc/openldap/schema/ppolicy.schema
include /usr/local/ldapproxy/etc/openldap/schema/misc.schema
include /usr/local/ldapproxy/etc/openldap/schema/corba.schema
include /usr/local/ldapproxy/etc/openldap/schema/collective.schema
include /usr/local/ldapproxy/etc/openldap/schema/cosine.schema
include /usr/local/ldapproxy/etc/openldap/schema/dyngroup.schema
include /usr/local/ldapproxy/etc/openldap/schema/nis.schema
2、load模組:
moduleload meta
overlay rwm
rewriteEngine on
3、增加ldap代理配置:
database ldap
suffix "dc=server,dc=org"
rebind-as-user yes
uri "ldap://server.org"
chase-referrals yes
4、增加本地伺服器的配置:
lastmod off
database bdb
suffix "dc=testadvdbg,dc=org"
rootdn "cn=user,dc=testserver,dc=org"
rootpw user
5、公共配置:
directory /usr/local/ldapproxy/var/openldap-data
index objectClass eq,pres
index ou,cn,mail,surname,givenname eq,pres,sub
index uid eq,pres,sub
配置完成,slapd.conf配置檔案中內容均以tab鍵分割,否則報錯。
第六步,測試openldap配置
[root@mailmeta1 libexec]# /usr/local/ldapproxy/libexec/slapd -T test -u
config file testing succeeded
說明測試通過
第七步,啟動openldap代理服務
[root@mailmeta1 libexec]# /usr/local/ldapproxy/libexec/slapd -d 256&
[1] 20493
[root@mailmeta1 libexec]# 568c8098 @(#) $OpenLDAP: slapd 2.4.43 (Jan 6 2016 10:31:01) $
root@mailmeta1.synihefei.com:/home/ldap/openldap-2.4.43/servers/slapd
568c8098 bdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/ldapproxy/var/openldap-data: (2).
Expect poor performance for suffix "dc=testadvdbg,dc=org".
568c8098 bdb_monitor_db_open: monitoring disabled; configure monitor database to enable
568c8098 slapd starting
沒有報錯說明啟動成功。
第八步,配置域名解析
vi /etc/hosts
192.168.28.183 server.org
第八步,測試代理是否可用
1、登入本地openldap伺服器是否成功
/usr/local/ldapproxy/bin/ldapsearch -H "ldap://127.0.0.1:389" -D "cn=user,dc=testserver,dc=org" -w '111111' -b "ou=People,DC=testserver,DC=org"
2、通過代理登入AD查詢是否成功
/usr/local/ldapproxy/bin/ldapsearch -H "ldap://127.0.0.1:389" -D "cn=Administrator,cn=users,dc=server,dc=org" -w '111111' -b "cn=users,DC=server,DC=org" -x
提示如下表示成功查詢:
# search result
search: 2
result: 0 Success
# numResponses: 42
# numEntries: 41