{"id":18130,"date":"2013-12-26T07:12:57","date_gmt":"2013-12-25T23:12:57","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2013\/12\/26\/%e5%95%9f%e7%94%a8-open-ldap-server-%e5%8a%a0%e5%af%86%e5%82%b3%e8%bc%b8\/"},"modified":"2021-03-18T17:23:47","modified_gmt":"2021-03-18T09:23:47","slug":"%e5%95%9f%e7%94%a8-open-ldap-server-%e5%8a%a0%e5%af%86%e5%82%b3%e8%bc%b8","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2013\/12\/26\/%e5%95%9f%e7%94%a8-open-ldap-server-%e5%8a%a0%e5%af%86%e5%82%b3%e8%bc%b8\/","title":{"rendered":"\u555f\u7528 Open LDAP Server \u52a0\u5bc6\u50b3\u8f38"},"content":{"rendered":"

\u70ba\u4e86\u5b89\u5168\u7684\u56e0\u7d20\uff0c\u6240\u4ee5\u555f\u7528 Open LDAP Server \u52a0\u5bc6\u50b3\u8f38\uff0c\u8b93\u8cc7\u6599\u5728\u50b3\u8f38\u6642\u80fd\u66f4\u52a0\u7684\u5b89\u5168\u3002
\u6587\u7ae0\u5167\u5bb9\u53c3\u8003 \u516b\u514b\u91cc: CENTOS 6 LDAP server\u8a2d\u5b9a – \u8f49\u79fb\u4f7f\u7528\u8005\u5e33\u865f\u8cc7\u8a0a\u5230 LDAP<\/a>
\u5207\u63db\u76ee\u9304
# <\/span> cd \/etc\/pki\/tls\/certs
<\/span> \u522a\u9664\u539f\u6709\u7684\u6191\u8b49
# <\/span> <\/span> rm -rf slapd.pem <\/span>
\u7522\u751f\u65b0\u7684\u6191\u8b49
# <\/span> <\/span> make slapd.pem <\/span>
\u66f4\u6539\u6a94\u6848\u6b0a\u9650
# <\/span> <\/span> chmod 640 slapd.pem
<\/span> \u66f4\u6539\u6a94\u6848\u64c1\u6709\u7684\u4f7f\u7528\u8005\u53ca\u7fa4\u7d44
# <\/span> <\/span> chown ldap:ldap slapd.pem
<\/span> \u5c07 slapd.pem \u9023\u7d50\u5230 \/etc\/openldap\/cacerts \u76ee\u9304\u4e0b\u63d0\u4f9b\u6191\u8b49\u8a8d\u8b49\u4f7f\u7528
# <\/span> <\/span> ln -s \/etc\/pki\/tls\/certs\/slapd.pem \/etc\/openldap\/certs\/slapd.pem <\/span>
[@more@]\u4fee\u6539\u7cfb\u7d71\u7684\u555f\u52d5\u8a2d\u5b9a\u6a94\uff0c\u958b\u555f LDAPS \u7684\u529f\u80fd
# <\/span> <\/span> vim \/etc\/sysconfig\/ldap <\/span> <\/p>\n

SLAPD_LDAPS=yes <\/span> <\/p>\n

\u4fee\u6539 \/etc\/openldap\/slapd.conf \u8a2d\u5b9a\u6a94\uff0c\u52a0\u5165\u6191\u8b49\u8def\u5f91
# <\/span> <\/span> vim \/etc\/openldap\/slapd.conf <\/span> <\/p>\n

\u53d6\u6d88\u8a3b\u89e3\u4ee5\u4e0b\u5167\u5bb9: <\/span>
TLSCACertificateFile \/etc\/pki\/tls\/certs\/ca-bundle.crt <\/span>
TLSCertificateFile \/etc\/pki\/tls\/certs\/slapd.pem <\/span>
TLSCertificateKeyFile \/etc\/pki\/tls\/certs\/slapd.pem <\/span> <\/p>\n

\u4fee\u6539 \/etc\/openldap.ldap.conf \u8a2d\u5b9a\u6a94
# <\/span> <\/span> vim \/etc\/openldap\/ldap.conf <\/span> <\/p>\n

#\u52a0\u5165\u4ee5\u4e0b\u5167\u5bb9: <\/span>
TLS_CACERTDIR \/etc\/openldap\/cacerts <\/span>
TLS_REQCERT never <\/span> <\/p>\n

\u91cd\u65b0\u521d\u59cb\u5316 Open LDAP Server
# <\/span> <\/span> rm -rf \/etc\/openldap\/slapd.d\/* <\/span>
# <\/span> <\/span> slaptest -f \/etc\/openldap\/slapd.conf -F \/etc\/openldap\/slapd.d <\/span>
# <\/span> <\/span> chown -R ldap:ldap \/etc\/openldap\/slapd.d <\/span>
# <\/span> <\/span> service slapd restart <\/span> <\/p>\n

\u6aa2\u67e5\u662f\u5426\u6709\u555f\u52d5 636 Port
# netstat -ntulp | egrep ‘389|636’ <\/span>
tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 38883\/slapd <\/span>
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 38883\/slapd <\/span>
tcp 0 0 :::636 :::* LISTEN 38883\/slapd <\/span>
tcp 0 0 :::389 :::* LISTEN 38883\/slapd <\/span> <\/p>\n

\u8a2d\u5b9a\u9632\u706b\u7246
# iptables -A INPUT -p tcp -s 192.168.1.0\/24 -m state –state NEW –dport 389 -j ACCEPT<\/span>
# iptables -A INPUT -p tcp -s 192.168.1.0\/24 -m state –state NEW –dport 636 -j ACCEPT<\/span>
\u6216
# iptables -A INPUT -p tcp -s 192.168.1.0\/24 -m state –state NEW -m multiport –dports 389,636 -j ACCEPT<\/span><\/p>\n

<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u70ba\u4e86\u5b89\u5168\u7684\u56e0\u7d20\uff0c\u6240\u4ee5\u555f\u7528 Open LDAP Server \u52a0\u5bc6\u50b3\u8f38\uff0c\u8b93\u8cc7\u6599\u5728\u50b3\u8f38\u6642\u80fd\u66f4\u52a0\u7684\u5b89\u5168\u3002 \u6587\u7ae0\u5167\u5bb9\u53c3 … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u555f\u7528 Open LDAP Server \u52a0\u5bc6\u50b3\u8f38\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[115],"tags":[],"class_list":["post-18130","post","type-post","status-publish","format-standard","hentry","category-c-78460"],"meta_key":{"_encloseme":["1"],"lt_post_id":["467649"],"_pingme":["1"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18130"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=18130"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18130\/revisions"}],"predecessor-version":[{"id":19812,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18130\/revisions\/19812"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=18130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=18130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=18130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}