# Centos安裝配置LDAP
圖形界面LDAPAdmin安裝地址：
https://nchc.dl.sourceforge.net/project/ldapadmin/ldapadmin/1.8.3/LdapAdminExe-w64-1.8.3.zip
## 環境搭建
本次安裝環境：centos6.5
配置本地域名解析：
```bash
# echo "192.168.8.43 techsure.cn" >> /etc/hosts
```
解決依賴關係:
```bash
# yum grouplist
```
輸出如下：
Base
Debugging Tools
Performance Tools
Compatibility libraries
Development tools
Dial-up Networking Support
Hardware monitoring utilities
如果缺少組包，需要安裝
```bash
# yum groupinstall -y "Compatibility libraries"
```
## 安裝openldap
```bash
# yum install -y openldap openldap-*
```
```bash
# yum install -y nscd nss-pam-ldapd nss-* pcre pcre*
```
```bash
# rpm -qa | grep openldap*
```
compat-openldap-2.3.43-2.el6.x86_64
openldap-2.4.40-12.el6.x86_64
openldap-clients-2.4.40-12.el6.x86_64
openldap-servers-sql-2.4.40-12.el6.x86_64
openldap-servers-2.4.40-12.el6.x86_64
openldap-devel-2.4.40-12.el6.x86_64
## 配置slapd.conf文件
依次執行以下命令：
```bash
# cd /etc/openldap/
```
```bash
# cp /usr/share/openldap-servers/slapd.conf.obsolete slapd.conf
```
```bash
# cp slapd.conf slapd.conf.bak
```
```bash
# slappasswd -s techsure|sed -e "s#{SSHA}#rootpw\t{SSHA}#g"
```
```bash
# slappasswd -s techsure|sed -e "s#{SSHA}#rootpw\t{SSHA}#g">>/etc/openldap/slapd.conf
```
檢查密碼是否寫入配置文件中：
```bash
# tail -1 slapd.conf
```
```bash
# vim slapd.conf
```
註釋以下四行內容：
```bash
database dbb
suffix "dc=my-domain,dc=com"
checkpoint 1024 15
rootdn "cn=Manager,dc=my-domain,dc=com"
```
添加如下內容：
```bash
database bdb
suffix "dc=techsure,dc=cn"
rootdn "cn=admin,dc=techsure,dc=cn"
```
對比修改是否成功：
```bash
# diff slapd.conf.bak slapd.conf
```
添加如下內容：
```bash
# cat >> /etc/openldap/slapd.conf<<EOF
loglevel 296
cachesize 1000
checkpoint 2018 10
EOF
```
參數說明：
> loglevel 296 # 日誌級別，記錄日誌信息方便調試，296級別是由256(日誌連接/操作/結果)、32（搜索過濾器處理）、8（連接管理）累加的結果
cachesize 1000 # 設置ldap可以換成的記錄數
checkpoint 2018 10 # 可以設置把內存中的數據協會數據文件的操作上，上面設置表示每達到2048KB或者10分鐘執行一次，checkpoint即寫入數據文件的操作
## ldap授權及安全參數配置
```bash
# vim /etc/openldap/slapd.conf
```
刪除以下內容：
```bash
database config
access to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
by * none
# enable server status monitoring (cn=monitor)
database monitor
access to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
by dn.exact="cn=Manager,dc=my-domain,dc=com" read
by * none
```
添加以下內容
```bash
access to *
by self write
by anonymous auth
by * read
```
## 加入日誌記錄
```bash
# cp /etc/rsyslog.conf /etc/rsyslog.conf.bak.$(date +%F%T)
# echo '#record ldap.log by jack 2016-07-01' >> /etc/rsyslog.conf
# echo 'local4.* /var/log/ldap.log'>> /etc/rsyslog.conf
# tail -1 /etc/rsyslog.conf
# service rsyslog restart
```
## 配置ldap數據庫路徑
```bash
# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
# chown ldap:ldap /var/lib/ldap/DB_CONFIG
# chmod 700 /var/lib/ldap/
```
驗證配置
```bash
slaptest -u
```
## 啓動服務
```bash
# /etc/init.d/slapd restart
#lsof -i :389
```
配置隨機啓動
```bash
# chkconfig --list slapd
```
## 測試查找內容
```bash
#ldapsearch -LLL -W -x -H ldap://techsure.cn -D "cn=admin,dc=techsure,dc=cn" -b "dc=techsure,dc=cn" "(uid=*)"
```
此處會要求輸入密碼，密碼是上面執行的techsure，如果出現報錯：ldap_bind: Invalid credentials (49)，執行以下命令後再次測試：
```bash
# rm -rf /etc/openldap/slapd.d/*
# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
```
## LDAPAdmin連接
