{"id":19557,"date":"2017-05-12T06:44:30","date_gmt":"2017-05-11T22:44:30","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/05\/12\/%e5%9c%a8-centos-7-x-%e4%b8%8b%e5%ae%89%e8%a3%9d-ldap-server\/"},"modified":"2021-03-18T17:25:02","modified_gmt":"2021-03-18T09:25:02","slug":"%e5%9c%a8-centos-7-x-%e4%b8%8b%e5%ae%89%e8%a3%9d-ldap-server","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/05\/12\/%e5%9c%a8-centos-7-x-%e4%b8%8b%e5%ae%89%e8%a3%9d-ldap-server\/","title":{"rendered":"\u5728 CentOS 7.x \u4e0b\u5b89\u88dd LDAP Server"},"content":{"rendered":"

\u53c3\u8003\u7db2\u9801\uff1a
Linux \uff0e \u7121\u9650: \u5728 CentOS7\/RHEL7 \u4e0a\u5b89\u88dd\u8a2d\u5b9a LDAP Server(\u4e00)<\/a>
CentOS 7 : OpenLDAP : Configure LDAP Server : Server World<\/a>
CrashedBboy: CentOS 7 \u521d\u63a2 Open LDAP<\/a>
Install And Configure LDAP Server In CentOS 7 | Unixmen<\/a>
1. \u5b89\u88dd LDAP Server
# yum install openldap-servers openldap-clients migrationtools<\/span><\/p>\n

2.\u00a0 \u8907\u88fd LDAP \u8cc7\u6599\u5eab\u7bc4\u4f8b\u6a94
# cp \/usr\/share\/openldap-servers\/DB_CONFIG.example \/var\/lib\/ldap\/DB_CONFIG<\/span><\/p>\n

3. \u66f4\u6539\u64c1\u6709\u8005\u53ca\u7fa4\u7d44
# chown ldap. \/var\/lib\/ldap\/DB_CONFIG<\/span>
# ls -l \/var\/lib\/ldap\/DB_CONFIG<\/span>
-rw-r–r– 1 ldap ldap 845 Mar\u00a0 8 17:56 \/var\/lib\/ldap\/DB_CONFIG<\/span>[@more@]
4. \u555f\u52d5 LDAP Server
#\u00a0 systemctl enable slapd.service<\/span>
Created symlink from \/etc\/systemd\/system\/multi-user.target.wants\/slapd.service to \/usr\/lib\/systemd\/system\/slapd.service.<\/span>
#\u00a0 systemctl start slapd.service<\/span><\/p>\n

\u6aa2\u67e5\u662f\u5426\u6709\u6b63\u5e38\u555f\u52d5
# systemctl status slapd.service<\/span>
# ss -nlantu | grep slapd<\/span>
tcp\u00a0\u00a0\u00a0 LISTEN\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 128\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 *:<\/span>389<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 *:*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 users:((“<\/span>slapd<\/span>“,pid=1080,fd=8))<\/span>
tcp\u00a0\u00a0\u00a0 LISTEN\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 128\u00a0\u00a0\u00a0\u00a0\u00a0 :::<\/span>389<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :::*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 users:((“<\/span>slapd<\/span>“,pid=1080,fd=9))<\/span><\/p>\n

5. \u8a2d\u5b9a\u7ba1\u7406\u8005\u5bc6\u78bc
# \/sbin\/slappasswd<\/span>
New password:<\/span>
Re-enter new password:<\/span>
{SSHA}K7FYIrbIkq2jkgJNEvhigiP3hR+CguaD<\/span><\/p>\n

# vim chrootpw.ldif<\/span>
# specify the password generated above for “olcRootPW” section<\/span><\/p>\n

dn: olcDatabase={0}config,cn=config<\/span>
changetype: modify<\/span>
add: olcRootPW<\/span>
olcRootPW: {SSHA}K7FYIrbIkq2jkgJNEvhigiP3hR+CguaD<\/span><\/p>\n

# \/bin\/ldapadd -Y EXTERNAL -H ldapi:\/\/\/ -f chrootpw.ldif<\/span>
SASL\/EXTERNAL authentication started<\/span>
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth<\/span>
SASL SSF: 0<\/span>
modifying entry “olcDatabase={0}config,cn=config”<\/span><\/p>\n

6. \u532f\u5165\u57fa\u672c\u7684 schemas
# \/bin\/ldapadd -Y EXTERNAL -H ldapi:\/\/\/ -f \/etc\/openldap\/schema\/cosine.ldif<\/span>
SASL\/EXTERNAL authentication started<\/span>
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth<\/span>
SASL SSF: 0<\/span>
adding new entry “cn=cosine,cn=schema,cn=config”<\/span><\/p>\n

# \/bin\/ldapadd -Y EXTERNAL -H ldapi:\/\/\/ -D “cn=config” -f \/etc\/openldap\/schema\/nis.ldif<\/span>
SASL\/EXTERNAL authentication started<\/span>
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth<\/span>
SASL SSF: 0<\/span>
adding new entry “cn=nis,cn=schema,cn=config”<\/span><\/p>\n

# \/bin\/ldapadd -Y EXTERNAL -H ldapi:\/\/\/ -f \/etc\/openldap\/schema\/inetorgperson.ldif<\/span>
SASL\/EXTERNAL authentication started<\/span>
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth<\/span>
SASL SSF: 0<\/span>
adding new entry “cn=inetorgperson,cn=schema,cn=config”<\/span><\/p>\n

7. \u8a2d\u5b9a LDAP \u8cc7\u6599\u5eab
# cat chdomain.ldif<\/span>
dn: olcDatabase={2}hdb,cn=config<\/span>
changetype: modify<\/span>
replace: olcSuffix<\/span>
olcSuffix: dc=ilc,dc=edu,dc=tw<\/span><\/p>\n

dn: olcDatabase={2}hdb,cn=config<\/span>
changetype: modify<\/span>
replace: olcRootDN<\/span>
olcRootDN: cn=Manager,dc=ilc,dc=edu,dc=tw<\/span><\/p>\n

dn: olcDatabase={2}hdb,cn=config<\/span>
changetype: modify<\/span>
replace: olcRootPW<\/span>
olcRootPW: {SSHA}K7FYIrbIkq2jkgJNEvhigiP3hR+CguaD<\/span><\/p>\n

dn: cn=config<\/span>
changetype: modify<\/span>
replace: olcLogLevel<\/span>
olcLogLevel: -1<\/span><\/p>\n

dn: olcDatabase={1}monitor,cn=config<\/span>
changetype: modify<\/span>
replace: olcAccess<\/span>
olcAccess: {0}to * by dn.base=”gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth” read by dn.base=”cn=Manager,dc=ilc,dc=edu,dc=tw” read by * none<\/span><\/p>\n

dn: olcDatabase={2}hdb,cn=config<\/span>
changetype: modify<\/span>
add: olcAccess<\/span>
olcAccess: {0}to attrs=userPassword,shadowLastChange by<\/span>
\u00a0 dn=”cn=Manager,dc=srv,dc=world” write by anonymous auth by self write by * none<\/span>
olcAccess: {1}to dn.base=”” by * read<\/span>
olcAccess: {2}to * by dn=”cn=Manager,dc=ilc,dc=edu,dc=tw” write by * read<\/span><\/p>\n

# \/bin\/ldapmodify -Y EXTERNAL -H ldapi:\/\/\/ -f chdomain.ldif<\/span>
SASL\/EXTERNAL authentication started<\/span>
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth<\/span>
SASL SSF: 0<\/span>
modifying entry “olcDatabase={2}hdb,cn=config”<\/span><\/p>\n

modifying entry “olcDatabase={2}hdb,cn=config”<\/span><\/p>\n

modifying entry “olcDatabase={2}hdb,cn=config”<\/span><\/p>\n

modifying entry “cn=config”<\/span><\/p>\n

modifying entry “olcDatabase={1}monitor,cn=config”<\/span><\/p>\n

modifying entry “olcDatabase={2}hdb,cn=config”<\/span><\/p>\n

8. \u5efa\u7acb\u6240\u9808\u7db2\u57df\u7684 LDIF \u6a94\u6848
# vim base.ldif<\/span>
dn: dc=ilc,dc=edu,dc=tw<\/span>
objectClass: top<\/span>
objectclass: domain<\/span>
dc: ilc<\/span><\/p>\n

dn: cn=Manager,dc=ilc,dc=edu,dc=tw<\/span>
objectClass: organizationalRole<\/span>
cn: Manager<\/span>
description: Directory Manager<\/span><\/p>\n

dn: ou=tces,dc=ilc,dc=edu,dc=tw<\/span>
objectClass: top<\/span>
objectClass: organizationalUnit<\/span>
ou: tces<\/span><\/p>\n

dn: ou=teacher,ou=tces,dc=ilc,dc=edu,dc=tw<\/span>
objectClass: top<\/span>
objectClass: organizationalUnit<\/span>
ou: teacher<\/span><\/p>\n

dn: ou=student,ou=tces,dc=ilc,dc=edu,dc=tw<\/span>
objectClass: top<\/span>
objectClass: organizationalUnit<\/span>
ou: student<\/span><\/p>\n

dn: ou=s0101,ou=student,ou=tces,dc=ilc,dc=edu,dc=tw<\/span>
objectClass: top<\/span>
objectClass: organizationalUnit<\/span>
ou: s0101<\/span><\/p>\n

# \/bin\/ldapadd -x -D cn=Manager,dc=ilc,dc=edu,dc=tw -W -f base.ldif<\/span>
Enter LDAP Password:<\/span>
adding new entry “dc=ilc,dc=edu,dc=tw”<\/span><\/p>\n

adding new entry “cn=Manager,dc=ilc,dc=edu,dc=tw”<\/span><\/p>\n

adding new entry “ou=tces,dc=ilc,dc=edu,dc=tw”<\/span><\/p>\n

adding new entry “ou=teacher,ou=tces,dc=ilc,dc=edu,dc=tw”<\/span><\/p>\n

adding new entry “ou=student,ou=tces,dc=ilc,dc=edu,dc=tw”<\/span><\/p>\n

adding new entry “ou=s0101,ou=student,ou=tces,dc=ilc,dc=edu,dc=tw”<\/span><\/p>\n

9. \u4fee\u6539 migrationtools \u8a2d\u5b9a\u6a94
# cp \/usr\/share\/migrationtools\/migrate_common.ph \/usr\/share\/migrationtools\/migrate_common.ph.$(date +%F)<\/span>
# sed -i ‘\/DEFAULT_MAIL_DOMAIN\/s\/padl.com\/ilc.edu.tw\/’ \/usr\/share\/migrationtools\/migrate_common.ph<\/span>
# sed -i ‘\/DEFAULT_BASE\/s\/dc=padl,dc=com\/dc=ilc,dc=edu,dc=tw\/’ \/usr\/share\/migrationtools\/migrate_common.ph<\/span>
# sed -i ‘s\/$EXTENDED_SCHEMA = 0;\/$EXTENDED_SCHEMA = 1;\/’ \/usr\/share\/migrationtools\/migrate_common.ph<\/span><\/p>\n

10. \u7531 Server \u53d6\u51fa\u6240\u8981\u7684\u8cc7\u6599
# grep ^s0101 \/etc\/passwd > \/root\/ldap_users_utf8<\/span>
# grep ^s0101 \/etc\/group > \/root\/ldap_groups<\/span>
# \/bin\/piconv -f utf8 -t big5 \/root\/ldap_users_utf8 > \/root\/ldap_users_big5<\/span><\/p>\n

# \/usr\/share\/migrationtools\/migrate_passwd.pl \/root\/ldap_users_big5 > \/root\/users_big5.ldif<\/span>
# \/usr\/share\/migrationtools\/migrate_group.pl \/root\/ldap_groups > \/root\/groups.ldif<\/span>
# piconv -f big5 -t utf8 \/root\/users_big5.ldif > \/root\/users_utf8.ldif<\/span><\/p>\n

11. \u9032\u884c\u532f\u5165
# \/bin\/ldapadd -x -D cn=Manager,dc=ilc,dc=edu,dc=tw -W -f groups.ldif<\/span>
# \/bin\/ldapadd -x -D cn=Manager,dc=ilc,dc=edu,dc=tw -W -f users_utf8.ldif<\/span><\/p>\n

12. \u6e2c\u8a66\u662f\u5426\u53ef\u4ee5\u67e5\u8a62\u7684\u5230
# \/usr\/bin\/ldapsearch -x -b “ou=s0101,ou=student,ou=tces,dc=ilc,dc=edu,dc=tw” uid=s0101129<\/span><\/p>\n

13. \u9632\u706b\u7246\u8a2d\u5b9a
# \/bin\/firewall-cmd –permanent –add-service=ldap<\/span>
# \/bin\/firewall-cmd –reload<\/span>
\u6216
# iptables -A INPUT -p tcp -s 192.168.1.0\/24 –syn -m state –state NEW –dport 389 -j ACCEPT<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u53c3\u8003\u7db2\u9801\uff1aLinux \uff0e \u7121\u9650: \u5728 CentOS7\/RHEL7 \u4e0a\u5b89\u88dd\u8a2d\u5b9a LDAP Server(\u4e00)Ce … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u5728 CentOS 7.x \u4e0b\u5b89\u88dd LDAP Server\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117,115],"tags":[],"class_list":["post-19557","post","type-post","status-publish","format-standard","hentry","category-c-78462","category-c-78460"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["688049"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19557"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19557"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19557\/revisions"}],"predecessor-version":[{"id":21069,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19557\/revisions\/21069"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19557"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19557"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19557"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}