OpenLdap 部署

安装 OpenLdap

yum install -y openldap openldap-clients openldap-servers   
systemctl start slapd
systemctl enable slapd

OpenLdap 配置日志

配置 rsyslog 收集 openldap 日志

sed -i 's/^local4\./#local4\./g' /etc/rsyslog.conf
echo "local4.*                        /var/log/slapd/slapd.log" >> /etc/rsyslog.conf
systemctl restart rsyslog

修改 openldap loglevel

delete_loglevel.ldif (可能不需要，执行出错就不需要)

dn: cn=config
changetype: modify
delete: olcLogLevel
olcLogLevel: Stats

ldapmodify -Y EXTERNAL -H ldapi:/// -f delete_loglevel.ldif

add_loglevel.ldif

dn: cn=config
changetype: modify
add: olcLogLevel
olcLogLevel: 256

ldapmodify -Y EXTERNAL -H ldapi:/// -f add_loglevel.ldif

添加 schema

for i in `ls /etc/openldap/schema/*.ldif`; do ldapadd -Y EXTERNAL -H ldapi:/// -f $i; done

配置支持加载模块

module_entry.ldif

dn: cn=module,cn=config
cn: module
objectClass: olcModuleList
olcModulePath: /usr/lib64/openldap

ldapadd -Y EXTERNAL -H ldapi:/// -f module_entry.ldif

配置开启 auditlog

add_auditlog_mod.ldif

dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: auditlog

ldapmodify -Y EXTERNAL -H ldapi:/// -f add_auditlog_mod.ldif
conf_auditlog.ldif

dn: olcOverlay=auditlog,olcDatabase={2}hdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcAuditLogConfig
olcOverlay: auditlog
olcAuditlogFile: /var/log/slapd/auditlog.log

ldapadd -Y EXTERNAL -H ldapi:/// -f conf_auditlog.ldif

配置 memberof

add_memberof_mod.ldif

dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: memberof.la

ldapadd -Y EXTERNAL -H ldapi:/// -f add_memberof_mod.ldif

conf_memberof.ldif

dn: olcOverlay=memberof,olcDatabase={2}hdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf

ldapadd -Y EXTERNAL -H ldapi:/// -f conf_memberof.ldif

配置 refint

add_refint_mod.ldif

dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: refint.la

ldapadd -Y EXTERNAL -Q -H ldapi:/// -f add_refint_mod.ldif

refint_overlay.ldif

dn: olcOverlay=refint,olcDatabase={2}hdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: refint
olcRefintAttribute: memberof member manager owner

ldapadd -Y EXTERNAL -Q -H ldapi:/// -f refint_overlay.ldif

修改 rootdn

rootdn.ldif

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=admin,dc=example,dc=com
-
replace: olcSuffix
olcSuffix: dc=example,dc=com
-
replace: olcRootPW
olcRootPW: {MD5}pmq7VoTEWWLYh1ZPCDRujQ==

ldapmodify -Y EXTERNAL -H ldapi:/// -f rootdn.ldif

添加组织 (公司)

add_company.ldif

dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: xxx公司
dc: example

ldapadd -H ldapi:/// -D "cn=admin,dc=example,dc=com" -w passwd -f add_company.ldif

配置密码策略

add_ppolicy_mod.ldif

dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: ppolicy.la

ldapadd -Y EXTERNAL -H ldapi:/// -f add_ppolicy_mod.ldif

ppolicy_overlay.ldif

dn: olcOverlay=ppolicy,olcDatabase={2}hdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcOverlay: ppolicy
olcPPolicyDefault: cn=default,ou=policies,dc=example,dc=com
olcPPolicyHashCleartext: FALSE

ldapadd -Y EXTERNAL -H ldapi:/// -f ppolicy_overlay.ldif

add_passwd_policies.ldif

dn: ou=policies,dc=example,dc=com
objectClass: organizationalUnit
objectClass: top
ou: policies

dn: cn=default,ou=policies,dc=example,dc=com
cn: default
objectClass: top
objectClass: device
objectClass: pwdPolicy
pwdAttribute: userPassword
pwdLockout: TRUE
pwdMaxFailure: 10
pwdLockoutDuration: 600

ldapadd -H ldapi:/// -D "cn=admin,dc=example,dc=com" -w admin123456 -f add_passwd_policies.ldif

添加用户和组

add user

dn: uid=xxxxx,dc=example,dc=com
changetype: add
uid: xxxxx
userPassword: {MD5}pmq7VoTEWWLYh1ZPCDRujQ==
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: xxx
cn: xxx
displayName: 中文名
mail: xxx@example.com 
departmentNumber: 3.1.1
mobile: xxxx

ldapadd -H ldapi:/// -D "cn=admin,dc=example,dc=com" -w admin123456 -f user_xxxxxx.ldif

group

group_employee.ldif

dn: ou=employee,dc=example,dc=com
objectClass: groupOfNames
cn: employee
member: uid=xxxx,dc=example,dc=com

ldapadd -H ldapi:/// -D "cn=admin,dc=example,dc=com" -w admin123456 -f group_employee.ldif

add_mem_group.ldif

dn: ou=employee,dc=example,dc=com
changetype: modify
add: member
member: uid=xxxxx,dc=example,dc=com

ldapmodify -H ldapi:/// -D "cn=admin,dc=example,dc=com" -w admin123456 -f group_employee_add.ldif

开启 ssl 支持

enable_ssl.ldif

dn: cn=config
changetype: modify
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/openldap/ssl/ca.crt
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/ssl/client.crt
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/ssl/client.key
-
add: olcTLSVerifyClient
olcTLSVerifyClient: never

ldapmodify -Y EXTERNAL -H ldapi:/// -D "cn=admin,dc=example,dc=com" -w admin123456 -f enable_ssl.ldif

vim /etc/sysconfig/slapd
SLAPD_URLS="ldapi:/// ldap:/// ldaps:///"

systemctl restart slapd

echo "TLS_REQCERT allow" >> /etc/openldap/ldap.conf
echo "tls_reqcert allow" >> /etc/nslcd.conf
authconfig --enableldaptls --update

参考资料：
https://www.cnblogs.com/woshimrf/p/ldap.html
https://ldapwiki.com/wiki/LDAP