RHEL7-openldap安裝配置一（服務器端安裝配置）

時間 2020-08-17

標籤 rhel7 rhel openldap 安裝配置服務器欄目 Red Hat 简体版

原文原文鏈接

LDAP的術語：
entry：一個單獨的單元，使用DN(distinguish name)區別
attribute:entry的屬性，好比，若是entry是組織機構的話，那麼它的屬性包括地址，電話，傳真號碼等，屬性分爲可選和必選，必選的屬性使用objectclass定義，這些屬性能夠在
/etc/openldap/slapd.d/cn=config/cn=schema/目錄下面找到
LDIF: LDAP interchange format 是用來表示LDAP entry的文本格式，格式以下：
[id] dn: distinguished_nameattribute_type: attribute_value…attribute_type: attribute_value…html

1、LDAP服務器端安裝
準備安裝測試環境:服務器IP:192.168.100.200
操做系統：RHEL7.4
在安裝以前，服務器上配置好 yum 源。node

要求：在服務器上安裝openldap軟件，而後把系統中已有的賬號和組信息轉存到LDAP中。以後，咱們在其它服務器上安裝配置ldap客戶端，到LDAP服務器認證登陸，並經過NFS方式掛載用戶目錄。linux

一、安裝openLDAP服務器端軟件包
# yum install -y openldap openldap-clients openldap-servers migrationtoolsapi

說明：migrationtool工具用於將本地系統賬號遷移至openldap。安全

二、設置LDAP服務器全局鏈接密碼bash

[root@server0 ~]# slappasswd -s Ynyd1234 -n > /etc/openldap/passwd
[root@server0 ~]# cat /etc/openldap/passwd 
{SSHA}SjGeEJNdQFujSss9Z72U2CNTSXOgDV64

三、創建X509認證本地LDAP服務祕鑰
由於LDAP目錄服務是以明文的方式在網絡中傳輸數據的（包括密碼），這樣真的很不安全，因此咱們採用TLS加密機制來解決這個問題，使用openssl工具生成X509格式的證書文件。服務器

# openssl req -new -x509 -nodes -out /etc/openldap/certs/cert.pem -keyout /etc/openldap/certs/priv.pem -days 365

參數說明：
req PKCS#10 X.509 Certificate Signing Request (CSR) Management.
-new new request.
-x509 output a x509 structure instead of a cert. req.
-nodes don't encrypt the output key
-out output file.
-keyout file to send the key to.
-days number of days a certificate generated by -x509 is valid for.網絡

[root@server0 ~]# openssl req -new -x509 -nodes -out /etc/openldap/certs/cert.pem -keyout /etc/openldap/certs/priv.pem -days 365
Generating a 2048 bit RSA private key
.............................+++
..............................................................................+++
writing new private key to '/etc/openldap/certs/priv.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BEIJING
Locality Name (eg, city) [Default City]:BEIJING
Organization Name (eg, company) [Default Company Ltd]:ultrapower
Organizational Unit Name (eg, section) []:ultrapower
Common Name (eg, your name or your server's hostname) []:server0.ultrapower.com
Email Address []:rusking@live.cn

[root@server0 ~]# ll /etc/openldap/certs/
total 72
-rw-r--r--. 1 root root 65536 Dec 19 16:02 cert8.db
-rw-r--r--. 1 root root  1464 Dec 19 17:03 cert.pem --公鑰，須要拷貝到每一臺客戶機上。
-rw-r--r--. 1 root root 16384 Dec 19 16:02 key3.db
-r--r-----. 1 root ldap    45 Sep 18 10:49 password
-rw-r--r--. 1 root root  1704 Dec 19 17:03 priv.pem  --私鑰
-rw-r--r--. 1 root root 16384 Sep 18 10:49 secmod.db

四、設置LDAP祕鑰權限app

root@server0 certs]# chown ldap:ldap /etc/openldap/certs/*
[root@server0 certs]# chmod 600 priv.pem 
[root@server0 certs]# ll
total 72
-rw-r--r--. 1 ldap ldap 65536 Dec 19 16:02 cert8.db
-rw-r--r--. 1 ldap ldap  1464 Dec 19 17:03 cert.pem
-rw-r--r--. 1 ldap ldap 16384 Dec 19 16:02 key3.db
-r--r-----. 1 ldap ldap    45 Sep 18 10:49 password
-rw-------. 1 ldap ldap  1704 Dec 19 17:03 priv.pem
-rw-r--r--. 1 ldap ldap 16384 Sep 18 10:49 secmod.db

五、生成LDAP基礎數據並設置其權限dom

複製一份LDAP的配置模板（基礎數據）

# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG 
# chown ldap:ldap /var/lib/ldap/*
# slaptest 測試

六、啓動LDAP服務，並設置開機自啓動
# systemctl start/restart slapd
# systemctl enable slapd
# systemctl status slapd

七、設置防火牆規則容許LDAP服務被鏈接
# firewall-cmd --permanet --add-service=ldap

# firewall-cmd --reload

八、設置LDAP日誌文件，保存日誌信息
# vi /etc/rsyslog.conf 添加以下一行
local4.* /var/log/ldap.log
# systemctl restart rsyslog --重啓rsyslog服務

2、配置LDAP本地服務器域
一、配置基礎用戶認證結構

[root@server0 ~]# cd /etc/openldap/schema/
[root@server0 schema]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f cosine.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=cosine,cn=schema,cn=config"

[root@server0 schema]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f nis.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=nis,cn=schema,cn=config"

二、配置自定義的結構文件並導入到LDAP服務器

2.1 建立/etc/openldap/changes.ldif文件，並將下面的信息複製進去

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=ultrapower,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=ultrapower,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: 此處輸入以前生成的密碼（如{SSHA}v/GJvGG8SbIuCxhfTDVhkmWEuz2afNIR）

dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/cert.pem

dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/priv.pem

dn: cn=config
changetype: modify
replace: olcLogLevel
olcLogLevel: -1

dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=ultrapower,dc=com" read by * none

2.2 將新的配置文件更新到slapd服務程序

[root@server0 openldap]# ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/openldap/changes.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={2}hdb,cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

modifying entry "cn=config"

modifying entry "cn=config"

modifying entry "cn=config"

modifying entry "olcDatabase={1}monitor,cn=config"

2.3 建立/etc/openldap/base.ldif文件，並將下面的信息複製進去

[root@server0 schema]# vi /etc/openldap/base.ldif
dn: dc=ultrapower,dc=com
dc: ultrapower
objectClass: top
objectClass: domain

dn: ou=People,dc=ultrapower,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit

dn: ou=Group,dc=ultrapower,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit

2.3 建立目錄的結構服務

[root@server0 ~]# ldapadd -x -w Ynyd1234 -D cn=Manager,dc=ultrapower,dc=com -f /etc/openldap/base.ldif 
adding new entry "dc=ultrapower,dc=com"

adding new entry "ou=People,dc=ultrapower,dc=com"

adding new entry "ou=Group,dc=ultrapower,dc=com"

三、建立測試用戶，並將本地用戶認證信息導入到LDAP服務
3.1 建立測試用戶

3.1 用腳本的方式批量建立10個測試用戶

[root@server0 home]# mkdir /home/guests 建立guests目錄

[root@server0 ~]# for i in $(seq 1 10) ; do useradd -d /home/guests/testldapuser$i -m testldapuser$i ; done [root@server0 ~]# for i in $(seq 1 10) ; do echo testldapuser$i | passwd --stdin testldapuser$i ; done

3.2 設置賬戶的遷移（修改第71與74行）

使用咱們一開始

[root@server0 ~]# vi /usr/share/migrationtools/migrate_common.ph 
 # Default DNS domain
$DEFAULT_MAIL_DOMAIN = "ultrapower.com";
# Default base
$DEFAULT_BASE = "dc=ultrapower,dc=com";

3.3 將當前系統中的用戶和組遷移至LDAP服務

[root@server0 ~]# cd /usr/share/migrationtools/

3.3.1 把用戶信息轉換成ldif文件，並導入到LDAP中

[root@server0 migrationtools]# grep ":10[0-9][0-9]" /etc/passwd > passwdtest
[root@server0 migrationtools]# cat passwdtest
rusky:x:1000:1000:rusky:/home/rusky:/bin/bash
testldapuser1:x:1001:1001::/home/guests/testldapuser1:/bin/bash
testldapuser2:x:1002:1002::/home/guests/testldapuser2:/bin/bash
testldapuser3:x:1003:1003::/home/guests/testldapuser3:/bin/bash
testldapuser4:x:1004:1004::/home/guests/testldapuser4:/bin/bash
testldapuser5:x:1005:1005::/home/guests/testldapuser5:/bin/bash
testldapuser6:x:1006:1006::/home/guests/testldapuser6:/bin/bash
testldapuser7:x:1007:1007::/home/guests/testldapuser7:/bin/bash
testldapuser8:x:1008:1008::/home/guests/testldapuser8:/bin/bash
testldapuser9:x:1009:1009::/home/guests/testldapuser9:/bin/bash
testldapuser10:x:1010:1010::/home/guests/testldapuser10:/bin/bash

[root@server0 migrationtools]# ./migrate_passwd.pl passwdtest users.ldif --執行該命令把上一步建立的passwd文件轉換成LDAP能識別的ldif格式的文件。
[root@server0 migrationtools]# cat users.ldif

[root@server0 migrationtools]# cat user.ldif 
dn: uid=rusky,ou=People,dc=ultrapower,dc=com
uid: rusky
cn: rusky
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}$6$1pUcE65tSly517VY$sd5ht.PGvqQnLO8Rb3AyEswE1ZWX6QAYxo3q6PPkJ5mq0i0NZuy352GFwnUgLxiySdszCr7v5qebg50gVVOYQ.
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/rusky
gecos: rusky

dn: uid=testldapuser1,ou=People,dc=ultrapower,dc=com
uid: testldapuser1
cn: testldapuser1
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}$6$TkAJZ5Dk$zhLV04HMvOsZghPFWZwonBNYB87Wd2KFDSPKfnDgqkcxRCsx06BTYKSvd3SgtGeIjeWDFBLj2L2.g0dtRPLGh1
shadowLastChange: 17524
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1001
gidNumber: 1001
homeDirectory: /home/guests/testldapuser1

dn: uid=testldapuser2,ou=People,dc=ultrapower,dc=com
uid: testldapuser2
cn: testldapuser2
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}$6$FAV0kLqI$zrbZZXu5.k/KJ0rWvX/yemdwcBE55FQ1PbnGmAZW7o.Ck7ru3oZZHTmWZaLLOjrD/BftPRBByYSnzoxUPKANL/
shadowLastChange: 17524
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1002
gidNumber: 1002
homeDirectory: /home/guests/testldapuser2
…省略…

導入user.ldif文件到LDAP中：

[root@server0 migrationtools]# ldapadd -x -w Ynyd1234 -D cn=Manager,dc=ultrapower,dc=com -f user.ldif 
adding new entry "uid=rusky,ou=People,dc=ultrapower,dc=com"

adding new entry "uid=testldapuser1,ou=People,dc=ultrapower,dc=com"

adding new entry "uid=testldapuser2,ou=People,dc=ultrapower,dc=com"

adding new entry "uid=testldapuser3,ou=People,dc=ultrapower,dc=com"

adding new entry "uid=testldapuser4,ou=People,dc=ultrapower,dc=com"

adding new entry "uid=testldapuser5,ou=People,dc=ultrapower,dc=com"

adding new entry "uid=testldapuser6,ou=People,dc=ultrapower,dc=com"

adding new entry "uid=testldapuser7,ou=People,dc=ultrapower,dc=com"

adding new entry "uid=testldapuser8,ou=People,dc=ultrapower,dc=com"

adding new entry "uid=testldapuser9,ou=People,dc=ultrapower,dc=com"

adding new entry "uid=testldapuser10,ou=People,dc=ultrapower,dc=com"

3.3.2 把用戶組group信息轉換成ldif文件，並導入到LDAP中

操做步驟同上：

[root@server0 migrationtools]# grep ":10[0-9][0-9]" /etc/group > grouptest
[root@server0 migrationtools]# cat grouptest 
ruskyGroup:x:1000:rusky
rusky:x:1000:rusky
testldapuser1:x:1001:
testldapuser2:x:1002:
testldapuser3:x:1003:
testldapuser4:x:1004:
testldapuser5:x:1005:
testldapuser6:x:1006:
testldapuser7:x:1007:
testldapuser8:x:1008:
testldapuser9:x:1009:
testldapuser10:x:1010:

[root@server0 migrationtools]# ./migrate_group.pl grouptest group.ldif
[root@server0 migrationtools]# cat group.ldif 
dn: cn=ruskyGroup,ou=Group,dc=ultrapower,dc=com
objectClass: posixGroup
objectClass: top
cn: ruskyGroup
userPassword: {crypt}x
gidNumber: 1000
memberUid: rusky

dn: cn=rusky,ou=Group,dc=ultrapower,dc=com
objectClass: posixGroup
objectClass: top
cn: rusky
userPassword: {crypt}x
gidNumber: 1000

dn: cn=testldapuser1,ou=Group,dc=ultrapower,dc=com
objectClass: posixGroup
objectClass: top
cn: testldapuser1
userPassword: {crypt}x
gidNumber: 1001
...略...

[root@server0 migrationtools]# ldapadd -x -w Ynyd1234 -D cn=Manager,dc=ultrapower,dc=com -f group.ldif

四、測試LDAP服務器上的用戶認證信息

[root@server0 migrationtools]# ldapsearch -x cn=testldapuser3 -b dc=ultrapower,dc=com   隨便查一個用戶信息，看是否能查到。
# extended LDIF
#
# LDAPv3
# base <dc=ultrapower,dc=com> with scope subtree
# filter: cn=testldapuser3
# requesting: ALL
#

# testldapuser3, People, ultrapower.com
dn: uid=testldapuser3,ou=People,dc=ultrapower,dc=com
uid: testldapuser3
cn: testldapuser3
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword:: e2NyeXB0fSQ2JEFNcHZTanhWJEdvMzVHVGU3Lm0xWG8xMTlWejJBaklTVnlDTjl
 2a00uQVRoNWcuV0k1QnNzSmVjbGd4cjRqV3ZWbXBHWlF6RFNGWDVYMVQ3VE9yNjFyTVhjU0JUQkUx
shadowLastChange: 17524
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1003
gidNumber: 1003
homeDirectory: /home/guests/testldapuser3

# testldapuser3, Group, ultrapower.com
dn: cn=testldapuser3,ou=Group,dc=ultrapower,dc=com
objectClass: posixGroup
objectClass: top
cn: testldapuser3
userPassword:: e2NyeXB0fXg=
gidNumber: 1003

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntries: 2

或者經過LDAP-browser工具鏈接到LDAP服務器上查看：

五、安裝httpd服務程序，並上傳密鑰文件到網站目錄

這是爲了方便客戶機經過http方式下載公鑰文件cert.pem。你也可使用ftp方式；或者手動scp拷貝也行。

[root@server0 ~]# yum install httpd -y
[root@server0 ~]# cp /etc/openldap/certs/cert.pem /var/www/html/
[root@server0 ~]# systemctl enable httpd
[root@server0 ~]# firewall-cmd --permanent --add-service=http
[root@server0 ~]# firewall-cmd --reload
[root@server0 ~]# systemctl restart httpd

至此，openldap軟件在服務器端的安裝與配置已完成，下一篇文章咱們將使用另一臺服務器作爲客戶機，安裝 openldap-client軟件，到服務器端完成認證，並登陸和經過NFS方式掛載用戶目錄。

參考文檔：

http://www.linuxfuckprobe.com/chapter-12.html

https://www.certdepot.net/ldap-configure-ldap-server-for-user-connection/

https://www.cnblogs.com/lemon-le/p/6266921.html