您好,登錄后才能下訂單哦!
本篇內(nèi)容介紹了“CentOS7如何部署OpenLDAP服務(wù)”的有關(guān)知識(shí),在實(shí)際案例的操作過程中,不少人都會(huì)遇到這樣的困境,接下來就讓小編帶領(lǐng)大家學(xué)習(xí)一下如何處理這些情況吧!希望大家仔細(xì)閱讀,能夠?qū)W有所成!
OpenLDAP 是一款輕量級(jí)目錄訪問協(xié)議(Lightweight Directory Access Protocol,LDAP),屬于開源集中賬號(hào)管理架構(gòu)的實(shí)現(xiàn),且支持眾多系統(tǒng)版本,被廣大互聯(lián)網(wǎng)公司所采用。
[root@ldap ~]# yum install -y openldap-servers openldap-clients[root@ldap ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG[root@ldap ~]# chown ldap. /var/lib/ldap/DB_CONFIG[root@ldap ~]# systemctl start slapd[root@ldap ~]# systemctl enable slapd
# 生成管理員密碼
[root@ldap ~]# slappasswdNew password: Re-enter new password: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxx [root@ldap ~]# vim chrootpw.ldif# specify the password generated above for "olcRootPW" sectiondn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxx [root@ldap ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldifSASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={0}config,cn=config"
[root@ldap ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldifSASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=cosine,cn=schema,cn=config"[root@ldap ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldifSASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=nis,cn=schema,cn=config"[root@ldap ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldifSASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=inetorgperson,cn=schema,cn=config"
# 生成目錄管理員密碼
[root@ldap ~]# slappasswdNew password: Re-enter new password: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxx [root@ldap ~]# vim chdomain.ldif# replace to your own domain name for "dc=***,dc=***" section# specify the password generated above for "olcRootPW" sectiondn: olcDatabase={1}monitor,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"read by dn.base="cn=Manager,dc=jumpserver,dc=tk" read by * none dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcSuffix olcSuffix: dc=jumpserver,dc=tk dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=Manager,dc=jumpserver,dc=tk dn: olcDatabase={2}hdb,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxx dn: olcDatabase={2}hdb,cn=config changetype: modify add: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=Manager,dc=jumpserver,dc=tk" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * readolcAccess: {2}to * by dn="cn=Manager,dc=jumpserver,dc=tk" write by * read[root@ldap ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldifSASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={1}monitor,cn=config"modifying entry "olcDatabase={2}hdb,cn=config"modifying entry "olcDatabase={2}hdb,cn=config"modifying entry "olcDatabase={2}hdb,cn=config"[root@ldap ~]# vim basedomain.ldif# replace to your own domain name for "dc=***,dc=***" sectiondn: dc=jumpserver,dc=tk objectClass: top objectClass: dcObject objectclass: organization o: Server tk dc: jumpserver dn: cn=Manager,dc=jumpserver,dc=tk objectClass: organizationalRole cn: Manager description: Directory Manager dn: ou=People,dc=jumpserver,dc=tk objectClass: organizationalUnit ou: People dn: ou=Group,dc=jumpserver,dc=tk objectClass: organizationalUnit ou: Group [root@ldap ~]# ldapadd -x -D cn=Manager,dc=jumpserver,dc=tk -W -f basedomain.ldifEnter LDAP Password: # 輸入目錄管理員密碼adding new entry "dc=jumpserver,dc=tk"adding new entry "cn=Manager,dc=jumpserver,dc=tk"adding new entry "ou=People,dc=jumpserver,dc=tk"adding new entry "ou=Group,dc=jumpserver,dc=tk"
# firewall-cmd --add-service=ldap --permanentsuccess# firewall-cmd --reloadsuccess
# 生成用戶密碼
[root@ldap ~]# slappasswdNew password: Re-enter new password: {SSHA}xxxxxxxxxxxxxxxxx [root@ldap ~]# vi ldapuser.ldif# create new# replace to your own domain name for "dc=***,dc=***" sectiondn: uid=test,ou=People,dc=jumpserver,dc=tk objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount cn: testsn: Linux userPassword: {SSHA}xxxxxxxxxxxxxxxxx loginShell: /bin/bash uidNumber: 1000 gidNumber: 1000 homeDirectory: /home/testdn: cn=test,ou=Group,dc=jumpserver,dc=tk objectClass: posixGroup cn: testgidNumber: 1000 memberUid: test[root@ldap ~]# ldapadd -x -D cn=Manager,dc=jumpserver,dc=tk -W -f ldapuser.ldifEnter LDAP Password: adding new entry "uid=test,ou=People,dc=jumpserver,dc=tk"adding new entry "cn=test,ou=Group,dc=jumpserver,dc=tk"[root@ldap ~]# ldapsearch -x -D "cn=Manager,dc=jumpserver,dc=tk" -W -b ""dc=jumpserver,dc=tk"
“CentOS7如何部署OpenLDAP服務(wù)”的內(nèi)容就介紹到這里了,感謝大家的閱讀。如果想了解更多行業(yè)相關(guān)的知識(shí)可以關(guān)注億速云網(wǎng)站,小編將為大家輸出更多高質(zhì)量的實(shí)用文章!
免責(zé)聲明:本站發(fā)布的內(nèi)容(圖片、視頻和文字)以原創(chuàng)、轉(zhuǎn)載和分享為主,文章觀點(diǎn)不代表本網(wǎng)站立場(chǎng),如果涉及侵權(quán)請(qǐng)聯(lián)系站長(zhǎng)郵箱:is@yisu.com進(jìn)行舉報(bào),并提供相關(guān)證據(jù),一經(jīng)查實(shí),將立刻刪除涉嫌侵權(quán)內(nèi)容。