當機器成千上百臺增加的時候，如果需要對機器內一臺一臺的使用密碼或者密鑰登錄，也是一件痛苦的事情，今天分享下使用OpenLDAP實現一個帳號任何機器及應用都可登錄。
一.OpenLDAP安裝及配置
1.安裝依賴包及軟件安裝
yum install -y openldap openldap-servers openldap-clients openldap-devel
2.配置文件配置
cp /usr/share/openldap-servers/slapd.conf.obsolete /etc/openldap/slapd.conf cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG cp /usr/share/doc/sudo-1.8.6p3/schema.OpenLDAP /etc/openldap/schema/sudo.schema #修改/etc/openldap/slapd.conf文件 找到include /etc/openldap/schema/core.schema在下面增加 include /etc/openldap/schema/sudo.schema #找到database bdb修改下面的幾行 database bdb suffix "dc=abc,dc=com" checkpoint 1024 15 rootdn "cn=admin,dc=abc,dc=com" rootpw admin loglevel 1 #說明: database bdb 說明使用Berkeley DB suffix "dc=abc,dc=com" 域名就是abc.com checkpoint 1024 15 就是每1M或者每15分鐘將緩存刷進磁盤 rootdn "cn=admin,db=abc,dc=com" 管理員是adnin rootpw admin 管理員的密碼就是admin loglevel 1 日誌級別是1 #日誌級別 Any (-1, 0xffffffff) //開啓所有的dug 信息 Trace (1, 0x1) //跟蹤trace 函數調用 Packets (2, 0x2) //與軟件包的處理相關的dug 信息 Args (4, 0x4) //全面的debug 信息 Conns (8, 0x8) //鏈接數管理的相關信息 BER (16, 0x10) //記錄包發送和接收的信息 Filter (32, 0x20) //記錄過濾處理的過程 Config (64, 0x40) //記錄配置文件的相關信息 ACL (128, 0x80) //記錄訪問控制列表的相關信息 Stats (256, 0x100) //記錄鏈接、操作以及統計信息 Stats2 (512, 0x200) //記錄向客戶端響應的統計信息 Shell (1024, 0x400) //記錄與shell 後端的通信信息 Parse (2048, 0x800) //記錄條目的分析結果信息 Sync (16384, 0x4000) //記錄數據同步資源消耗的信息 None (32768, 0x8000) //不記錄 #在文件最後增加如下，允許用戶自行修改密碼 access to attrs=shadowLastChange,userPassword by self write by * auth access to * by * read
3.配置OpenLDAP日誌
echo "local4.* /var/log/sldap.log" >>/etc/rsyslog.conf /etc/init.d/rsyslog restart
4.初始化OpenLDAP
service slapd start rm -rf /etc/openldap/slapd.d/* slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d chown -R ldap:ldap /etc/openldap/slapd.d/ service slapd restart
5.檢查服務
netstat -ntlup |grep :389
二.遷移用戶(將本地的用戶和組遷移到OpenLDAP)
1.安裝遷移工具
yum install migrationtools -y cd /usr/share/migrationtools/ [root@kvm242 migrationtools]# ls migrate_aliases.pl migrate_all_offline.sh migrate_group.pl migrate_profile.pl migrate_all_netinfo_offline.sh migrate_all_online.sh migrate_hosts.pl migrate_protocols.pl migrate_all_netinfo_online.sh migrate_automount.pl migrate_netgroup_byhost.pl migrate_rpc.pl migrate_all_nis_offline.sh migrate_base.pl migrate_netgroup_byuser.pl migrate_services.pl migrate_all_nis_online.sh migrate_common.ph migrate_netgroup.pl migrate_slapd_conf.pl migrate_all_nisplus_offline.sh migrate_common.ph.ori migrate_networks.pl migrate_all_nisplus_online.sh migrate_fstab.pl migrate_passwd.pl
2.配置遷移工具,修改migrate_common.ph 71、73行
$DEFAULT_MAIL_DOMAIN = "abc.com"; # Default base $DEFAULT_BASE = "dc=abc,dc=com";
3.導出用戶，我這裏只導出user1
cd /usr/share/migrationtools/ grep 'user1' /etc/passwd > passwd.in grep 'user1' /etc/group > group.in ./migrate_base.pl > /tmp/base.ldif ./migrate_passwd.pl passwd.in > /tmp/passwd.ldif ./migrate_group.pl group.in > /tmp/group.ldif #這裏生成了3個OpenLDAP數據 /tmp/base.ldif /tmp/passwd.ldif /tmp/group.ldif 導入數據： ldapadd -x -D "cn=admin,dc=abc,dc=com" -W -f /tmp/base.ldif ldapadd -x -D "cn=admin,dc=abc,dc=com" -W -f /tmp/passwd.ldif ldapadd -x -D "cn=admin,dc=abc,dc=com" -W -f /tmp/group.ldif
4.導入sudo基礎庫
vim /tmp/sudo.ldif
dn: ou=SUDOers,dc=abc,dc=com
objectClass: top
objectClass: organizationalUnit
description: SUDO Configuration Subtree
ou: SUDOers
dn: cn=defaults,ou=SUDOers,dc=abc,dc=com
objectClass: top
objectClass: sudoRole
cn: defaults
description: Default sudoOption's go here
sudoOption: visiblepw
sudoOption: always_set_home
sudoOption: env_reset
dn: cn=root,ou=SUDOers,dc=abc,dc=com
objectClass: top
objectClass: sudoRole
cn: root
sudoUser: root
sudoHost: ALL
sudoRunAsUser: ALL
sudoCommand: ALL
sudoOption: !visiblepw
sudoOption: always_set_home
sudoOption: env_reset
dn: cn=%wheel,ou=SUDOers,dc=abc,dc=com
objectClass: top
objectClass: sudoRole
cn: %wheel
sudoUser: %wheel
sudoHost: ALL
sudoRunAsUser: ALL
sudoCommand: ALL
sudoOption: !authenticate
sudoOption: !visiblepw
sudoOption: always_set_home
sudoOption: env_reset
sudoOption: requiretty
dn: cn=%confops,ou=SUDOers,dc=abc,dc=com
objectClass: top
objectClass: sudoRole
cn: %confops
sudoUser: %confops
sudoHost: ALL
sudoRunAsUser: ALL
sudoOption: !authenticate
sudoOption: !visiblepw
sudoOption: always_set_home
sudoOption: env_reset
sudoCommand: ALL
sudoCommand: !/bin/passwd
dn: cn=%confdev,ou=SUDOers,dc=abc,dc=com
objectClass: top
objectClass: sudoRole
cn: %confdev
sudoUser: %confdev
sudoHost: ALL
sudoRunAsUser: ALL
sudoOption: !authenticate
sudoOption: !visiblepw
sudoOption: always_set_home
sudoOption: env_reset
sudoCommand: /sbin/service
sudoCommand: !/bin/passwd
sudoCommand: /etc/init.d/tomcat
sudoCommand: /bin/kill
sudoCommand: /usr/bin/pkill
sudoCommand: /usr/bin/killall
sudoCommand: /etc/init.d/confservice
sudoCommand: /bin/su - app -s /bin/bash
sudoCommand: /bin/su - tomcat -s /bin/bash
dn: cn=%confqa,ou=SUDOers,dc=abc,dc=com
objectClass: top
objectClass: sudoRole
cn: %confqa
sudoUser: %confqa
sudoHost: ALL
sudoRunAsUser: ALL
sudoOption: !authenticate
sudoOption: !visiblepw
sudoOption: always_set_home
sudoOption: env_reset
sudoCommand: /sbin/service
sudoCommand: !/bin/passwd
sudoCommand: /etc/init.d/confservice
sudoCommand: /bin/kill
sudoCommand: /usr/bin/pkill
sudoCommand: /usr/bin/killall
sudoCommand: /bin/su - app -s /bin/bash
sudoCommand: /bin/su - tomcat -s /bin/bash
sudoCommand: /etc/init.d/tomcat
dn: cn=zabbix,ou=SUDOers,dc=abc,dc=com
objectClass: top
objectClass: sudoRole
cn: zabbix
sudoHost: ALL
sudoUser: zabbix
sudoOption: !authenticate
sudoOption: !visiblepw
sudoOption: always_set_home
sudoOption: env_reset
sudoRunAsUser: root
sudoCommand: !/bin/passwd
sudoCommand: /etc/init.d/tomcat
sudoCommand: /etc/init.d/confservice
sudoCommand: /usr/bin/nmap
sudoCommand: /usr/local/zabbix-ztc/bin/sudo-*
dn: cn=admin,ou=SUDOers,dc=abc,dc=com
objectClass: top
objectClass: sudoRole
cn: admin
sudoHost: ALL
sudoRunAsUser: ALL
sudoOption: !authenticate
sudoOption: !visiblepw
sudoOption: always_set_home
sudoOption: env_reset
sudoCommand: ALL
sudoCommand: !/bin/passwd
sudoUser: admin
導入sudo.ldif
ldapadd -x -D "cn=admin,dc=abc,dc=com" -W -f /tmp/sudo.ldif
從上面可以看到會生成
SUDOers (OU)
%confdev (cn)
%confops (cn)
%confqa (cn)
%wheel (cn)
admin (cn)
defaults (cn)
root (cn)
zabbix (cn)
因此只需要建立組confdev，然後將用戶拉入confdev組即可有相應的權限，同理zabbix用戶也有zabbix相應的權限
二.客戶端部署
CentOS 6
yum -y install openldap openldap-clients nss-pam-ldapd pam_ldap python-simplejson sudo libselinux-python echo "session required pam_mkhomedir.so skel=/etc/skel umask=0077" >> /etc/pam.d/system-auth authconfig --savebackup=auth.bak authconfig --enablemkhomedir --disableldaptls --enableldap --enableldapauth --ldapserver=ldap://192.168.10.242 --ldapbasedn="dc=abc,dc=com" --update echo -e "uri ldap://192.168.10.242\nSudoers_base ou=SUDOers,dc=abc,dc=com" > /etc/sudo-ldap.conf echo "Sudoers: files ldap" >> /etc/nsswitch.conf
CentOS 5
yum -y install openldap openldap-clients nss_ldap python-simplejson sudo libselinux-python echo "session required pam_mkhomedir.so skel=/etc/skel umask=0077" >> /etc/pam.d/system-auth authconfig --savebackup=auth.bak authconfig --enableldap --enableldapauth --enablemkhomedir --ldapserver=192.168.10.242 --ldapbasedn="dc=abc,dc=com" --update echo "Sudoers_base ou=SUDOers,dc=abc,dc=com" >> /etc/ldap.conf echo "Sudoers: files ldap" >> /etc/nsswitch.conf