CentOS7 上安裝 OpenLDAP Server

 CentOS7 上安裝 OpenLDAP Server
臺中市政府教育局資網中心 沈俊達
一、安裝 openldap Server 及 Client 工具程式
# yum -y install openldap-servers openldap-clients
二、刪除 slapd.d 資料夾內全部檔案，並複製一份 slapd.conf
# rm -rvf /etc/openldap/slapd.d
# mkdir /etc/openldap/slapd.d
# cp /usr/share/openldap-servers/slapd.ldif /etc/openldap/slapd.conf
三、產生 LDAP Server 管理權限密碼 ssh 編碼
1. 建產生 LDAP Server 管理權限密碼 ssh 編碼
# cd /etc/openldap
# slappasswd > password.txt
輸入密碼兩次，密碼請立刻抄寫下來，
2. 修改 slapd.conf 檔案
# vi /etc/openldap/slapd.conf
把
olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c
n=auth" read by dn.base="cn=Manager,dc=my-domain,dc=com" read by * none
olcSuffix: dc=my-domain,dc=com
olcRootDN: cn=Manager,dc=my-domain,dc=com
改為
olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c
n=auth" read by dn.base="cn=Manager, dc=clpes,dc=tc,dc=edu,dc=tw" read by * none
olcSuffix: dc=clpes,dc=tc,dc=edu,dc=tw
olcRootDN: cn=Manager, dc=clpes,dc=tc,dc=edu,dc=tw
olcRootPW: {SSHA}uL156gSB8j6Hg83CwTV5n/sfiNKoQwx9
(olcRootPW 請從剛才的 password.txt 中複製來)
3. 開始轉換組態檔
# /usr/libexec/openldap/convert-config.sh
# head -20 /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{[12]*
# slaptest -u
config file testing succeeded
# rm -rvf /var/lib/ldap/*
第 175 頁
# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
# rm -rvf certs
# mkdir certs
# /usr/libexec/openldap/create-certdb.sh
Creating certificate database in '/etc/openldap/certs'.
# /usr/libexec/openldap/generate-server-cert.sh
Creating new server certificate in '/etc/openldap/certs'.
# chown ldap:ldap -R /var/lib/ldap/
# systemctl start slapd
# slaptest
config file testing succeeded
# systemctl enable slapd
# firewall-cmd --permanent --zone=public --add-port=389/tcp
# firewall-cmd --reload
# ldapwhoami -WD cn=Manager,dc=clpes,dc=tc,dc=edu,dc=tw
Enter LDAP Password:
dn:cn=Manager,dc=tc,dc=edu,dc=tw
4. 匯入 schema
# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
5. 編輯 LDAP 樹系架構，並建立
# vi domain.ldif
dn: dc=clpes,dc=tc,dc=edu,dc=tw
objectClass: dcObject
objectclass: organization
dc: clpes
o: clpes
dn: ou=teacher,dc=clpes,dc=tc,dc=edu,dc=tw
objectClass: organizationalUnit
ou: teacher
description: teachers account
dn: ou=student,dc=clpes,dc=tc,dc=edu,dc=tw
objectClass: organizationalUnit
ou: student
description: students account
第 176 頁
# ldapadd -D cn=Manager,dc=clpes,dc=tc,dc=edu,dc=tw -W -f domain.ldif
Enter LDAP Password:
adding new entry "dc=clpes,dc=tc,dc=edu,dc=tw"
adding new entry "ou=teacher,dc=clpes,dc=tc,dc=edu,dc=tw"
adding new entry "ou=student,dc=clpes,dc=tc,dc=edu,dc=tw"