ldap管理linux用户,Linux环境下通过OpenLDAP实现用户的统一认证和管理
测试环境：OpenLDAP Server OpenLDAP Clientip:192.168.4.178 ip:192.168.4.177Centos 6.4...
测试环境：
OpenLDAP Server OpenLDAP Client
ip:192.168.4.178 ip:192.168.4.177
Centos 6.4 Centos 6.4
hostname:open*** hostname:open***-client
一、OpenLDAP Server的安装和配置
[root@open*** ~]# yum install -y openldap openldap-servers openldap-clients
[root@open*** ~]# cd /etc/openldap/
[root@open*** openldap]# mv slapd.d slapd.d-bak
[root@open*** openldap]# cp /usr/share/openldap-servers/slapd.conf.obsolete /etc/openldap/slapd.conf
创建slappasswd密码：
[root@open*** ~]# slappasswd
New password:
Re-enter new password:
{SSHA}CoOOJ5NZCzKuWktw6t4lD76FsDgX9ItX
[root@open*** openldap]# vi /etc/openldap/slapd.conf
suffix "dc=test,dc=com"
rootpw {SSHA}CoOOJ5NZCzKuWktw6t4lD76FsDgX9ItX /将md5值粘贴到此
directory /var/lib/ldap
[root@open*** openldap]# slaptest -u -f /etc/openldap/slapd.conf
config file testing succeeded
[root@open*** openldap]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@open*** openldap]#cd /var/lib/ldap
[root@open*** ldap]#chown ldap.ldap DB_CONFIG*
[root@open*** ldap]#cd
[root@open*** ~]# service slapd start
[root@open*** ~]#chkconfig slapd on
[root@open*** ldap]# ldapsearch -x -b "dc=test,dc=com"
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
解决方法：
[root@open*** ldap]# vi /etc/sysconfig/ldap
SLAPD_LDAPI=no
[root@open*** ldap]# vi /etc/openldap/ldap.conf
base dc=test,dc=com
uri ldap://192.168.4.178
[root@open*** ldap]# service slapd restart
Stopping slapd: [ OK ]
Starting slapd: [ OK ]
[root@open*** ldap]# ldapsearch -x -b "dc=test.com"
# extended LDIF
#
# LDAPv3
# base with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# search result
search: 2
result: 32 No such object
# numResponses: 1
创建用户ldapuser1,ldapuser2其密码分别为123456
[root@open*** ldap]# useradd ldapuser1
[root@open*** ldap]# echo "123456" | passwd --stdin ldapuser1
Changing password for user ldapuser1.
passwd: all authentication tokens updated successfully.
[root@open*** ldap]# useradd ldapuser2
[root@open*** ldap]# echo "123456" | passwd --stdin ldapuser2
Changing password for user ldapuser2.
passwd: all authentication tokens updated successfully.
安装migrationtools迁移本地用户到LDAP的工具包
[root@open*** ldap]# yum install -y migrationtools
[root@open*** ldap]# cd /usr/share/migrationtools/
[root@open*** migrationtools]# vi migrate_common.ph
# Default DNS domain
$DEFAULT_MAIL_DOMAIN = "test.com";
# Default base
$DEFAULT_BASE = "dc=test,dc=com";
[root@open*** migrationtools]# ./migrate_base.pl > base.ldif
[root@open*** migrationtools]# vi base.ldif
dn: dc=test,dc=com
dc: test
objectClass: top
objectClass: domain
dn: ou=People,dc=test,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit
dn: ou=Group,dc=test,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit
[root@open*** migrationtools]# ./migrate_passwd.pl /etc/passwd ./user.ldif /迁移用户[root@open*** migrationtools]# vi user.ldif
dn: uid=ldapuser1,ou=People,dc=test,dc=com
uid: ldapuser1
cn: ldapuser1
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}$6$fiweB1Cv$UrLDDL9yWi8W7djPJQosXGEb3v5VbSmyhzRdunpWHJso0hysXeus9i0c87vY2CVQSb0ySU.Uv6moqzZBB1nF//
shadowLastChange: 15674
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 501
gidNumber: 502
homeDirectory: /home/ldapuser1
dn: uid=ldapuser2,ou=People,dc=test,dc=com
uid: ldapuser2
cn: ldapuser2
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}$6$RK3zu0Np$2FssBfu3XJIeKOmJzyOmZgWoXk9npkpZquGvac0HoWbeB6A1aNjX.a2mxQhPIi6mhScV.PNTdE2AIs1l758GC1
shadowLastChange: 15674
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 502
gidNumber: 503
homeDirectory: /home/ldapuser2
[root@open*** migrationtools]#./migrate_group.pl /etc/group ./group.ldif /迁移组[root@open*** migrationtools]# vi group.ldif
n: cn=ldapuser1,ou=Group,dc=test,dc=com
objectClass: posixGroup
objectClass: top
cn: ldapuser1
userPassword: {crypt}x
gidNumber: 502
dn: cn=ldapuser2,ou=Group,dc=test,dc=com
objectClass: posixGroup
objectClass: top
cn: ldapuser2
userPassword: {crypt}x
gidNumber: 503
[root@open*** ~]#ldapadd -D "cn=open***,dc=test.com" -W -x -f /usr/share/migrationtools/base.ldifEnter LDAP Password:
ldap_bind: Invalid credentials (49)
解决方法：
[root@open*** ~]# ldapadd -D "cn=open***,dc=test,dc=com" -W -x -f /usr/share/migrationtools/base.ldifEnter LDAP Password:
adding new entry "dc=test,dc=com"
adding new entry "ou=People,dc=test,dc=com"
adding new entry "ou=Group,dc=test,dc=com"
[root@open*** ~]# ldapadd -D "cn=open***,dc=test,dc=com" -W -x -f /usr/share/migrationtools/user.ldifEnter LDAP Password:
adding new entry "uid=ldapuser1,ou=People,dc=test,dc=com"
adding new entry "uid=ldapuser2,ou=People,dc=test,dc=com"
[root@open*** ~]# ldapadd -D "cn=open***,dc=test,dc=com" -W -x -f /usr/share/migrationtools/group.ldifEnter LDAP Password:
adding new entry "cn=ldapuser1,ou=Group,dc=test,dc=com"
adding new entry "cn=ldapuser2,ou=Group,dc=test,dc=com"
[root@open*** ~]# ldapsearch -x -b "dc=test.com" /报错
# extended LDIF
#
# LDAPv3
# base with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# search result
search: 2
result: 32 No such object
# numResponses: 1
解决方法：
[root@open*** ~]# ldapsearch -x -b "dc=test,dc=com"
# extended LDIF
#
# LDAPv3
# base with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# test.com
dn: dc=test,dc=com
dc: test
objectClass: top
objectClass: domain
# People, test.com
dn: ou=People,dc=test,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit
# Group, test.com
dn: ou=Group,dc=test,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit
# ldapuser1, People, test.com
dn: uid=ldapuser1,ou=People,dc=test,dc=com
uid: ldapuser1
cn: ldapuser1
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword:: e2NyeXB0fSQ2JGZpd2VCMUN2JFVyTERETDl5V2k4VzdkalBKUW9zWEdFYjN2NVZ
iU215aHpSZHVucFdISnNvMGh5c1hldXM5aTBjODd2WTJDVlFTYjB5U1UuVXY2bW9xelpCQjFuRi8v
shadowLastChange: 15674
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 501
gidNumber: 502
homeDirectory: /home/ldapuser1
# ldapuser2, People, test.com
dn: uid=ldapuser2,ou=People,dc=test,dc=com
uid: ldapuser2
cn: ldapuser2
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword:: e2NyeXB0fSQ2JFJLM3p1ME5wJDJGc3NCZnUzWEpJZUtPbUp6eU9tWmdXb1hrOW5
wa3BacXVHdmFjMEhvV2JlQjZBMWFOalguYTJteFFoUElpNm1oU2NWLlBOVGRFMkFJczFsNzU4R0Mx
shadowLastChange: 15674
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 502
gidNumber: 503
homeDirectory: /home/ldapuser2
# ldapuser1, Group, test.com
dn: cn=ldapuser1,ou=Group,dc=test,dc=com
objectClass: posixGroup
objectClass: top
cn: ldapuser1
userPassword:: e2NyeXB0fXg=
gidNumber: 502
# ldapuser2, Group, test.com
dn: cn=ldapuser2,ou=Group,dc=test,dc=com
objectClass: posixGroup
objectClass: top
cn: ldapuser2
userPassword:: e2NyeXB0fXg=
gidNumber: 503
# search result
search: 2
result: 0 Success
# numResponses: 8
# numEntries: 7
二、OpenLDAP Client安装和配置
[root@open***-client ~]# yum install openldap openldap-clients -y
[root@open***-client ~]# yum install -y nss-pam-ldapd pam_ldap
[root@open***-client ~]# vi /etc/openldap/ldap.conf
BASE dc=test,dc=com
URI ldap://192.168.4.178
[root@open***-client ~]# vi /etc/nsswitch.conf
passwd: files ldapshadow: filesldapgroup: filesldap
[root@open***-client ~]# vi /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_fprintd.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_ldap.soauth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_ldap.soaccount required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_ldap.so use_authtokpassword required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_ldap.so
[root@open***-client ~]# vi /etc/pam.d/password-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_fprintd.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_ldap.soauth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_ldap.soaccount required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_ldap.so use_authtokpassword required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_ldap.so
[root@open***-client ~]# service nslcd restart
[root@open***-client ~]#chkconfig nslcd on
三、通过NFS实现LDAP用户/home的自动挂载
四、通过Phpldapadmin实现LDAP用户的WEB创建和管理
魔乐社区（Modelers.cn) 是一个中立、公益的人工智能社区，提供人工智能工具、模型、数据的托管、展示与应用协同服务，为人工智能开发及爱好者搭建开放的学习交流平台。社区通过理事会方式运作，由全产业链共同建设、共同运营、共同享有，推动国产AI生态繁荣发展。
更多推荐
0
0- 0
已为社区贡献3条内容
所有评论(0)