隶属于文章系列：大数据安全实战 https://www.jianshu.com/p/76627fd8399c
- 安装
- 配置
- 配置服务端
- 配置客户端
- 生成数据库
- 启动
安装
ansible all --become -m shell -a "yum install db4 db4-utils db4-devel cyrus-sasl* krb5-server-ldap -y"
ansible all --become -m shell -a "yum install openldap openldap-servers openldap-clients openldap-devel compat-openldap -y"
验证安装包
rpm -qa openldap
openldap-2.4.39-8.el6.x86_64
rpm -qa krb5-server-ldap
krb5-server-ldap-1.10.3-33.el6.x86_64
配置
- 数据库配置文件
rm -rf /var/lib/ldap/*
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown -R ldap:ldap /var/lib/ldap
- 为Kerberos准备schema
cp /usr/share/doc/krb5-server-ldap-1.15.1/kerberos.schema /etc/openldap/schema/
- 修改 /etc/openldap/slapd.conf
vi slapd.conf
include /etc/openldap/schema/corba.schema
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/duaconf.schema
include /etc/openldap/schema/dyngroup.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/java.schema
include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/openldap.schema
include /etc/openldap/schema/ppolicy.schema
include /etc/openldap/schema/collective.schema
include /etc/openldap/schema/kerberos.schema
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
loglevel -1
access to dn.base=""
by * read
access to dn.base="cn=Subschema"
by * read
access to attrs=userPassword,userPKCS12
by self write
by * auth
access to attrs=shadowLastChange
by self write
by * read
access to *
by * read
# Providing access to realm container
#access to dn.subtree="cn=TT.COM,cn=krbcontainer,dc=javachen,dc=com"
access to dn.subtree="cn=krbcontainer,dc=javachen,dc=com"
by dn.exact="uid=krb5kdc,ou=people,dc=javachen,dc=com" manage
by dn.exact="uid=kadmind,ou=people,dc=javachen,dc=com" manage
by dn.exact="uid=ldapadmin,ou=people,dc=javachen,dc=com" manage
by * manage
"slapd.conf" [New] 41L, 1283C written
chown -R ldap:ldap /etc/openldap/slapd.d && chmod -R 700 /etc/openldap/slapd.d
验证：
[root@vm10-247-24-53 openldap]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
- 修改 /etc/sysconfig/slapd
# OpenLDAP server configuration
# see 'man slapd' for additional information
# Where the server will run (-h option)
# - ldapi:/// is required for on-the-fly configuration using client tools
# (use SASL with EXTERNAL mechanism for authentication)
# - default: ldapi:/// ldap:///
# - example: ldapi:/// ldap://127.0.0.1/ ldap://10.0.0.1:1389/ ldaps:///
SLAPD_URLS="ldapi:/// ldap:///"
# Any custom options
#SLAPD_OPTIONS=""
# Keytab location for GSSAPI Kerberos authentication
KRB5_KTNAME="FILE:/etc/openldap/ldap.keytab"
export KRB5_KTNAME=/etc/openldap/ldap.keytab
客户端
修改/etc/openldap/.conf
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
#BASE dc=example,dc=com
BASE dc=javachen,dc=com
URI ldap://v-worker3-kdps.sz.kingdee.net
#URI ldap://ldap.example.com ldap://ldap-master.example.com:666
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
TLS_CACERTDIR /etc/openldap/certs
# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON on
创建数据库
在centos7上安装往往出现hdb数据：olcDatabase={2}hdb.ldif，本着偷懒原则把原来在centos6上的复制过来，可以直接修改数据
在一个centos6节点上安装就有，复制过来。
[root@v-worker3-kdps cn=config]# ll
total 68
drwx------ 2 ldap ldap 4096 Jan 30 15:39 cn=schema
-rwx------ 1 ldap ldap 45804 Jan 30 15:39 cn=schema.ldif
-rwx------ 1 ldap ldap 584 Jan 30 15:39 olcDatabase={0}config.ldif
-rwx------ 1 ldap ldap 596 Jan 30 15:39 olcDatabase={-1}frontend.ldif
-rwxrwxr-x 1 ldap ldap 695 Jan 30 15:53 olcDatabase={1}monitor.ldif
-rwxrwxr-x 1 ldap ldap 1498 Jan 30 15:53 olcDatabase={2}bdb.ldif
解决config error processing cn={1}core,cn=schema,cn=config: olcAttributeTypes: Duplicate attributeType: "2.5.
olcAttributeTy>>> dnPrettyNormal: <cn={1}core>
5ab8bc38 <<< dnPrettyNormal: <cn={1}core>, <cn={1}core>
5ab8bc38 >>> dnNormalize: <cn=config>
5ab8bc38 <<< dnNormalize: <cn=config>
5ab8bc38 >>> dnNormalize: <cn=config>
5ab8bc38 <<< dnNormalize: <cn=config>
5ab8bc38 <= str2entry(cn={1}core) -> 0x7fd10737f798
5ab8bc38 => test_filter
5ab8bc38 PRESENT
5ab8bc38 => access_allowed: search access to "cn={1}core,cn=schema,cn=config" "objectClass" requested
5ab8bc38 <= root access granted
5ab8bc38 => access_allowed: search access granted by manage(=mwrscxd)
5ab8bc38 <= test_filter 6
5ab8bc38 olcAttributeTypes: value #0 olcAttributeTypes: Duplicate attributeType: "2.5.4.2"
5ab8bc38 config error processing cn={1}core,cn=schema,cn=config: olcAttributeTypes: Duplicate attributeType: "2.5.
发现：两个0
-rwx------ 1 ldap ldap 1283 Mar 26 15:25 cn={0}corba.ldif
-rwx------ 1 ldap ldap 15578 Mar 26 10:21 cn={0}core.ldif
-rwx------ 1 ldap ldap 3837 Mar 26 15:25 cn={10}ppolicy.ldif
-rwx------ 1 ldap ldap 1523 Mar 26 15:25 cn={11}collective.ldif
-rwx------ 1 ldap ldap 10462 Mar 26 15:25 cn={12}kerberos.ldif
-rwx------ 1 ldap ldap 15546 Mar 26 15:25 cn={1}core.ldif
-rwx------ 1 ldap ldap 11363 Mar 26 15:25 cn={2}cosine.ldif
-rwx------ 1 ldap ldap 4489 Mar 26 15:25 cn={3}duaconf.ldif
-rwx------ 1 ldap ldap 1693 Mar 26 15:25 cn={4}dyngroup.ldif
-rwx------ 1 ldap ldap 2857 Mar 26 15:25 cn={5}inetorgperson.ldif
-rwx------ 1 ldap ldap 2589 Mar 26 15:25 cn={6}java.ldif
-rwx------ 1 ldap ldap 1519 Mar 26 15:25 cn={7}misc.ldif
-rwx------ 1 ldap ldap 6495 Mar 26 15:25 cn={8}nis.ldif
-rwx------ 1 ldap ldap 1323 Mar 26 15:25 cn={9}openldap.ldif
解决：
mv cn={0}core.ldif cn={1}core.ldif
验证
- 启动
slapd -h "ldapi:/// ldap:///"
[root@vm10-247-24-53 cn=schema]# netstat -nao |grep 389
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN off (0.00/0/0)
tcp6 0 0 :::389 :::* LISTEN off (0.00/0/0)
[root@vm10-247-24-53 cn=schema]# netstat -nap |grep 389
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 17986/slapd
tcp6 0 0 :::389 :::* LISTEN 17986/slapd
- 关闭
kill -INT `cat /var/run/openldap/slapd.pid`
- 日志
[root@v-worker3-kdps slapd]# tail -f /var/log/slapd/slapd.log
Jan 12 16:50:48 v-worker3-kdps slapd[5792]: daemon: activity on 1 descriptor
Jan 12 16:50:48 v-worker3-kdps slapd[5792]: daemon: activity on:
Jan 12 16:50:48 v-worker3-kdps slapd[5792]:
Jan 12 16:50:48 v-worker3-kdps slapd[5792]: daemon: epoll: listen=7 active_threads=0 tvp=NULL
Jan 12 16:50:48 v-worker3-kdps slapd[5792]: daemon: epoll: listen=8 active_threads=0 tvp=NULL
Jan 12 16:52:00 v-worker3-kdps slapd[6037]: @(#) $OpenLDAP: slapd 2.4.44 (Aug 4 2017 14:23:27) $#012#011mockbuild@c1bm.rdu2.centos.org:/builddir/build/BUILD/openldap-2.4.44/openldap-2.4.44/servers/slapd
Jan 12 16:52:00 v-worker3-kdps slapd[6037]: daemon: bind(7) failed errno=98 (Address already in use)
Jan 12 16:52:00 v-worker3-kdps slapd[6037]: daemon: bind(7) failed errno=98 (Address already in use)
Jan 12 16:52:00 v-worker3-kdps slapd[6037]: slapd stopped.
Jan 12 16:52:00 v-worker3-kdps slapd[6037]: connections_destroy: nothing to destroy.
image.png
image.png
image.png
