centos7 部署ldap

原創

2022-03-05 13:52

centos7 部署 ldap

需求

jenkins、svn、rancher 等要使用统一账号密码认证，方便人员管理,因此使用ldap 用来集中认证

安装ldap

#关闭selinux
getenforce 
Disabled

#关闭防火墙
systemctl stop firewalld
systemctl disable firewalld

#时间同步
ntpdate  -u cn.ntp.org.cn

#安装LDAP
yum -y install openldap compat-openldap openldap-clients openldap-servers openldap-servers-sql openldap-devel migrationtools

#生成密码
slappasswd -s m2i3sc
{SSHA}opZoeJ0qVqOgpv+hEc46uDGeIwMnO4K5

#修改域、管理员信息
vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}hdb.ldif 
需要修改内容如下：
olcSuffix: dc=moviebook,dc=cn #修改dc名称
olcRootDN: cn=admin,dc=moviebook,dc=cn #修改cn名称、dc名称
olcRootPW: {SSHA}opZoeJ0qVqOgpv+hEc46uDGeIwMnO4K5 #该行为新增行，指定管理员密码，该行为新增行(新增加一行)

#修改监控文件信息
vim /etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif

olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
 al,cn=auth" read by dn.base="cn=admin,dc=moviebook,dc=cn" read by * none  #修改dn.base 部分，即dn.base="cn=admin,dc=moviebook,dc=cn"

#查看ldap版本号及检测
slapd -VV
slaptest -u

#设置DB
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

#修改ldap数据库配置目录归属用户
chown ldap:ldap -R /var/lib/ldap

#修改ldap数据库配置目录权限
chmod 700 -R /var/lib/ldap

#启动ldap
systemctl start  slapd
systemctl enable slapd
systemctl status slapd

#导入基本的数据库schema
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/collective.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/corba.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/duaconf.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/dyngroup.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/java.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/misc.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/openldap.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/pmi.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/ppolicy.ldif


#修改migrate_common.ph
vim /usr/share/migrationtools/migrate_common.ph

# Default DNS domain
$DEFAULT_MAIL_DOMAIN = "moviebook.cn";

# Default base 
$DEFAULT_BASE = "dc=moviebook,dc=cn";
$EXTENDED_SCHEMA = 1;

安装httpd

#安装httpd
yum install httpd -y

#启动httpd
systemctl start httpd
systemctl enable httpd
systemctl status httpd

ldap 创建账号

#创建基础目录
cd /etc/openldap/
# cat 2.ldif 

dn: dc=moviebook,dc=cn
o: ldap
objectclass: dcObject
objectclass: organization
dc: moviebook

#创建目录结构
ldapadd -x -D "cn=admin,dc=moviebook,dc=cn" -W -f 2.ldif
输入admin 密码： m2i3sc

Enter LDAP Password: 
adding new entry "dc=moviebook,dc=cn"

#创建部门员工
# cat 5.ldif 
dn: ou=People,dc=moviebook,dc=cn
ou: People
objectClass: organizationalUnit

dn: cn=zhang.san,ou=People,dc=moviebook,dc=cn
ou: People
cn: zhang.san
sn: People
objectClass: inetOrgPerson
objectClass: organizationalPerson

#创建员工
# ldapadd -x -D "cn=admin,dc=moviebook,dc=cn" -W -f 5.ldif
Enter LDAP Password: 
adding new entry "ou=People,dc=moviebook,dc=cn"

adding new entry "cn=zhang.san,ou=People,dc=moviebook,dc=cn"

使用lam做web管理，搭建ldap account manager 管理Openldap服务

#安装php
yum install epel-release -y
rpm -Uvh https://mirror.webtatic.com/yum/el7/webtatic-release.rpm
yum -y install php72w php72w-cli php72w-fpm php72w-common php72w-devel 
systemctl enable php-fpm.service
systemctl start php-fpm.service

yum -y install php*   --skip-broken 

#报错解决
报错：rror: php72w-common conflicts with php-common-5.4.16-48.el7.x86_64
yum -y install php*   --skip-broken 

#下载安装lam
wget https://nchc.dl.sourceforge.net/project/lam/LAM/7.1/ldap-account-manager-7.1.tar.bz2  --no-check-certificate

#解压
tar jxf ldap-account-manager-7.1.tar.bz2 

#移动到httpd 目录下
mv ldap-account-manager-7.1 /var/www/html/ldap

#修改参数
cd /var/www/html/ldap/config
cp config.cfg.sample config.cfg
cp unix.conf.sample lam.conf

sed -i "s/dc=my-domain,dc=com/dc=moviebook,dc=cn/g" lam.conf
sed -i "s/cn=Manager/cn=admin/g" lam.conf
sed -i "s/dc=yourdomain,dc=org/dc=moviebook,dc=cn/g" lam.conf

#授权
chown -R apache.apache /var/www/html/ldap/

#重启httpd
systemctl restart httpd  
systemctl restart php-fpm

访问 lam

http://10.65.91.52/ldap

输入密码 m2i3sc

配置 LAM

#1.在登录界面选择右上角 LAM 配置
#2.选择编辑服务器配置文件
#3.密码默认为  lam
#4.General settings
  Server address: ldap://localhost:389
  Activate TLS: no
  Tree suffix:dc=moviebook,dc=cn
  LDAP search limit:-

Security settings
  Fixed list
  List of valid users: cn=admin,dc=moviebook,dc=cn
  
#5.Account types
  Users:
    LDAP suffix:ou=People,dc=moviebook,dc=cn
    List attributes:#uid;#givenName;#sn;#uidNumber;#gidNumber
  Groups:
    LDAP suffix:ou=group,dc=moviebook,dc=cn
    List attributes:#cn;#gidNumber;#memberUID;#description