Linux统一登录认证之 --- OpenLDAP服务部署

前言

OpenLDAP 是 LDAP 协议的一个开源实现。LDAP 服务器本质上是一个为只读访问而优化的非关系型数据库。它主要用做地址簿查询（如 email 客户端）或对各种服务访问做后台认证以及用户数据权限管控。（例如，访问 Samba 时，LDAP 可以起到域控制器的作用；或者 Linux 系统认证 时代替 /etc/passwd 的作用。）
本文采用联网方式安装, 未来会尝试内网安装包方式.

搭建环境

  • Centos 7.5
  • OpenLdap 2.4.44

安装步骤

安装OpenLdap服务端

  1. yum安装OpenLdap
yum install openldap-clients openldap-servers    # 安装OPENLdap 包
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG # 配置文件
chown ldap. /var/lib/ldap/DB_CONFIG     # 分配配置文件权限
systemctl enable slapd     # OPENLdap 开机自启
systemctl start slapd      # OPENLdap 启动
  1. 检擦服务是否安装成功
[root@testnode01 ~]# rpm -qa | grep openldap
openldap-clients-2.4.44-21.el7_6.x86_64
openldap-2.4.44-21.el7_6.x86_64
openldap-servers-2.4.44-21.el7_6.x86_64

[root@testnode01 openldap]# systemctl status slapd
● slapd.service - OpenLDAP Server Daemon
   Loaded: loaded (/usr/lib/systemd/system/slapd.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2020-03-04 21:56:06 EST; 21s ago
     Docs: man:slapd
           man:slapd-config
           man:slapd-hdb
           man:slapd-mdb
           file:///usr/share/doc/openldap-servers/guide.html

如果启动出现权限问题,给相应文件赋予LDAP用户权限

配置LDAP

  1. 我们使用 slappasswd 命令来生成一个密码，并使用 LDIF（LDAP 数据交换格式）文件将其导入到 LDAP 中来配置管理员密码：
[root@testnode01 openldap]# slappasswd -s 2NsxAHruCQy7ZD
{SSHA}UkZvtF0xj7uHKFBgvEmRgIiADjYRtZB4

[root@testnode01 ldapInstallScript]vim chrootpw.ldif
# specify the password generated above for "olcRootPW" section
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}UkZvtF0xj7uHKFBgvEmRgIiADjYRtZB4

[root@testnode01 ldapInstallScript]# ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={0}config,cn=config"
  1. 我们需要向 LDAP 中导入一些基本的 Schema。这些 Schema 文件位于 /etc/openldap/schema/ 目录中，定义了我们以后创建的条目可以使用哪些属性：
[root@testnode01 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=cosine,cn=schema,cn=config"
 
[root@testnode01 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=nis,cn=schema,cn=config"
 
[root@testnode01 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=inetorgperson,cn=schema,cn=config"
  1. 我们需要配置 LDAP 的顶级域（以 dc=awuwuwu,dc=com 为例）及其管理域：
[root@testnode01 openldap]# slappasswd -s Le52buqVSw4nCv
{SSHA}U7bb1izJGbLjollWG1t2EV6ZLB7NDKtF

[root@testnode01 openldap]vim chdomain.ldif
# replace to your own domain name for “dc=***,dc=***” section
# specify the password generated above for “olcRootPW” section
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
  read by dn.base="cn=Manager,dc=awuwuwu,dc=com" read by * none

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=awuwuwu,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=awuwuwu,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}U7bb1izJGbLjollWG1t2EV6ZLB7NDKtF

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
  dn="cn=Manager,dc=awuwuwu,dc=com" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=awuwuwu,dc=com" write by * read

[root@testnode01 ldapInstallScript]# ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={1}monitor,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
  1. 在上述基础上，我们来创建一个叫做 Awuwuwu News Agency 的组织，并在其下创建一个 Manager 的组织角色（该角色内的用户具有管理整个 LDAP 的权限）和 People 和 Group 两个组织单元：
[root@qsmaster ldapInstallScript]vim basedomain.ldif
# replace to your own domain name for "dc=***,dc=***" section
dn: dc=awuwuwu,dc=com
objectClass: top
objectClass: dcObject
objectclass: organization
o: Awuwuwu News Agency
dc: awuwuwu

dn: cn=Manager,dc=awuwuwu,dc=com
objectClass: organizationalRole
cn: Manager

dn: ou=People,dc=awuwuwu,dc=com
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=awuwuwu,dc=com
objectClass: organizationalUnit
ou: Group


[root@qsmaster ldapInstallScript]# ldapadd -x -D cn=Manager,dc=awuwuwu,dc=com -W -f basedomain.ldif
Enter LDAP Password: 
adding new entry "dc=awuwuwu,dc=com"
adding new entry "cn=Manager,dc=awuwuwu,dc=com"
adding new entry "ou=People,dc=awuwuwu,dc=com"
adding new entry "ou=Group,dc=awuwuwu,dc=com"

5.通过以上的所有步骤，我们就设置好了一个 LDAP 目录树：其中基准 dn dc=awuwuwu,dc=com 是该树的根节点，其下有一个管理域 cn=Manager,dc=awuwuwu,dc=com 和两个组织单元 ou=People,dc=awuwuwu,dc=com 及 ou=Group,dc=awuwuwu,dc=com.我们来创建一个叫作 Ada Catherine 的员工并将其分配到 Secretary 组来验证上述配置是否生效

[root@qsmaster ldapInstallScript]# slappasswd -s 1234
{SSHA}9yAYb5PwB97TVDrapYCAkW31WYV9SfUQ


[root@qsmaster ldapInstallScript]vim ldapuser.ldif
# create new
# replace to your own domain name for "dc=***,dc=***" section
dn: uid=ada,ou=People,dc=awuwuwu,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: ada
cn: Ada Catherine
sn: Catherine
userPassword: {SSHA}9yAYb5PwB97TVDrapYCAkW31WYV9SfUQ
loginShell: /bin/bash
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/ada

dn: cn=Secretary,ou=Group,dc=awuwuwu,dc=com
objectClass: posixGroup
cn: Secretary
gidNumber: 1000
memberUid: ada

[root@qsmaster ldapInstallScript]# ldapadd -x -D cn=Manager,dc=awuwuwu,dc=com -W -f ldapuser.ldif
Enter LDAP Password: 
adding new entry "uid=ada,ou=People,dc=awuwuwu,dc=com"
adding new entry "cn=Secretary,ou=Group,dc=awuwuwu,dc=com"
  1. 至此我们已经成功创建了Ada Catherine 和 Secretary 组，

验证是否成功

检查ldap库, 验证是否创建成功

[root@qsmaster ldapInstallScript]# ldapsearch -x -b "dc=awuwuwu,dc=com" -H ldap://127.0.0.1   
# extended LDIF
#
# LDAPv3
# base <dc=awuwuwu,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# awuwuwu.com
dn: dc=awuwuwu,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: Awuwuwu News Agency
dc: awuwuwu

# Manager, awuwuwu.com
dn: cn=Manager,dc=awuwuwu,dc=com
objectClass: organizationalRole
cn: Manager

# People, awuwuwu.com
dn: ou=People,dc=awuwuwu,dc=com
objectClass: organizationalUnit
ou: People

# Group, awuwuwu.com
dn: ou=Group,dc=awuwuwu,dc=com
objectClass: organizationalUnit
ou: Group

# ada, People, awuwuwu.com
dn: uid=ada,ou=People,dc=awuwuwu,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: ada
cn: Ada Catherine
sn: Catherine
loginShell: /bin/bash
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/ada

# Secretary, Group, awuwuwu.com
dn: cn=Secretary,ou=Group,dc=awuwuwu,dc=com
objectClass: posixGroup
cn: Secretary
gidNumber: 1000
memberUid: ada

# search result
search: 2
result: 0 Success

# numResponses: 7
# numEntries: 6

LDAP常用增删改查命令

查询LDAP用户

命令 ldapsearch -x -b “xxxx,dc=xxxx,dc=xxxx” -H ldap://127.0.0.1 其中xxx为相应条件, 举例如下

  • 查看组织
[root@qsmaster ldapInstallScript]# ldapsearch -x -b "dc=awuwuwu,dc=com" -H ldap://127.0.0.1
# extended LDIF
#
# LDAPv3
# base <dc=awuwuwu,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# awuwuwu.com
dn: dc=awuwuwu,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: Awuwuwu News Agency
dc: awuwuwu

# Manager, awuwuwu.com
dn: cn=Manager,dc=awuwuwu,dc=com
objectClass: organizationalRole
cn: Manager

# People, awuwuwu.com
dn: ou=People,dc=awuwuwu,dc=com
objectClass: organizationalUnit
ou: People

# Group, awuwuwu.com
dn: ou=Group,dc=awuwuwu,dc=com
objectClass: organizationalUnit
ou: Group

# ada, People, awuwuwu.com
dn: uid=ada,ou=People,dc=awuwuwu,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: ada
cn: Ada Catherine
sn: Catherine
loginShell: /bin/bash
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/ada

# Secretary, Group, awuwuwu.com
dn: cn=Secretary,ou=Group,dc=awuwuwu,dc=com
objectClass: posixGroup
cn: Secretary
gidNumber: 1000
memberUid: ada

# search result
search: 2
result: 0 Success

# numResponses: 7
# numEntries: 6
  • 查看组织People
[root@qsmaster ldapInstallScript]# ldapsearch -x -b "ou=People,dc=awuwuwu,dc=com" -H ldap://127.0.0.1     
# extended LDIF
#
# LDAPv3
# base <ou=People,dc=awuwuwu,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# People, awuwuwu.com
dn: ou=People,dc=awuwuwu,dc=com
objectClass: organizationalUnit
ou: People

# ada, People, awuwuwu.com
dn: uid=ada,ou=People,dc=awuwuwu,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: ada
cn: Ada Catherine
sn: Catherine
loginShell: /bin/bash
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/ada

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntries: 2

删除用户

命令 ldapdelete -x -W -D ‘cn=Manager,dc=hpc,dc=com’ “uid=ada,ou=People,dc=hpc,dc=com”

修改用户

命令 ldapmodify -a -H ldap://127.0.0.1 -D ‘cn=Manager,dc=awuwuwu,dc=com’ -W -f modifyhomDirectory.ldif

[root@qsmaster ldapInstallScript]vim modifyhomDirectory.ldif
dn: uid=ada,ou=People,dc=awuwuwu,dc=com # 条件
changetype: modify
replace: homeDirectory  # 需要修改的数据
homeDirectory: /data/home/jchen_seu # 修改的值

客户端工具

下载地址: http://directory.apache.org/studio/download/download-windows.html
----_20200308190916

参看文献

  • OpenLDAP安装包编译安装https://www.cnblogs.com/hanxiaohui/p/9463938.html
版权声明：本文为sanzhuge原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接和本声明。