OpenLdap configuration and management
Server-side configuration
Yum install openldap-servers
Slapd configuration
[root@public-puppet01-P-Z ~] # slappasswd-h {MD5}
New password:
Re-enter new password:
{MD5} sBICuL/nbqxH63QBPkxqrw==
1 、 / etc/openldap/slapd.conf
Include / etc/openldap/schema/corba.schema
Include / etc/openldap/schema/core.schema
Include / etc/openldap/schema/cosine.schema
Include / etc/openldap/schema/duaconf.schema
Include / etc/openldap/schema/dyngroup.schema
Include / etc/openldap/schema/inetorgperson.schema
Include / etc/openldap/schema/java.schema
Include / etc/openldap/schema/misc.schema
Include / etc/openldap/schema/nis.schema
Include / etc/openldap/schema/openldap.schema
Include / etc/openldap/schema/ppolicy.schema
Include / etc/openldap/schema/collective.schema
Allow bind_v2
Pidfile / var/run/openldap/slapd.pid
Argsfile / var/run/openldap/slapd.args
Database bdb
Suffix "dc=chanjetoms,dc=com"
Rootdn "cn=Manager,dc=chanjetoms,dc=com"
Rootpw {MD5} sBICuL/nbqxH63QBPkxqrw==
Directory / var/lib/ldap
Index objectClass eq,pres
Index ou,cn,mail,surname,givenname eq,pres,sub
Index uidNumber,gidNumber,loginShell eq,pres
Index uid,memberUid eq,pres,sub
Index nisMapName,nisMapEntry eq,pres,sub
Database monitor
Access to attrs=shadowLastChange,userPassword
By self write
By * auth
Access to *
By * read
2 、 / etc/openldap/ldap.conf
BASE dc=chanjetoms,dc=com
URI ldap://10.10.10.10
TLS_CACERTDIR / etc/openldap/cacerts
[root@dns1 openldap] # cp / usr/share/doc/openldap-servers-2.4.19/DB_CONFIG.example / var/lib/ldap/DB_CONFIG
[root@dns1 openldap] # chown ldap.ldap / var/lib/ldap/DB_CONFIG
[root@dns1 openldap] #
# enable monitoring
Database monitor
Start:
[root@common0 ~] # service slapd start
Starting slapd: [OK]
Error report:
Ldapadd ldap_bind: Invalid credentials (49)
Solution:
Rm-rf / etc/openldap/slapd.d/*
Slaptest-f / etc/openldap/slapd.conf-F / etc/openldap/slapd.d
Chown-R ldap.ldap / etc/openldap/slapd.d/
Chmod-R000 / etc/openldap/slapd.d/
Chmod-R u+rwX / etc/openldap/slapd.d/
Synchronize replication configuration
Master:
# Replicas of this database
Replogfile / var/lib/ldap/replog
Replica host=ldap.ops.com:389
Binddn= "cn=Manager,dc=oms,dc=com"
Credentials=secret
Bindmethod=simple
Slave:
Updatedn "cn=Manager,dc=oms,dc=com"
Updateref ldap://ldap.ops.com:389/
Log on master (/ usr/sbin/slapd-d 256)
2012-10-08 18:50:24 common0.ops.com slapd [13583]: conn=1000 fd=13 ACCEPT from IP=192.168.52.145:58109 (IP=0.0.0.0:389)
2012-10-08 18:50:24 common0.ops.com slapd [13583]: conn=1000 op=0 BIND dn= "" method=128
2012-10-08 18:50:24 common0.ops.com slapd [13583]: conn=1000 op=0 RESULT tag=97 err=0 text=
2012-10-08 18:50:24 common0.ops.com slapd [13583]: conn=1000 op=1 SRCH base= "dc=oms,dc=com" scope=2 deref=0 filter= "(objectClass=*)"
2012-10-08 18:50:24 common0.ops.com slapd [13583]: conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=4 text=
2012-10-08 18:50:24 common0.ops.com slapd [13583]: conn=1000 op=2 UNBIND
2012-10-08 18:50:24 common0.ops.com slapd [13583]: conn=1000 fd=13 closed
* *
Client configuration
Setup
The / lib64/libnss_ldap.so.2 file was not found.
This file is required for LDAP support to work properly.
Install the nss-pam-ldapd package that provides this file.
# yum install nss-pam-ldapd
# vim / etc/nsswitch.conf
#
# / etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry'[NOTFOUND=return] 'means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Valid entries include:
#
# nisplus Use NIS+ (NIS version 3)
# nis Use NIS (NIS version 2), also called YP
# dns Use DNS (Domain Name Service)
# files Use the local files
# db Use the local database (.db) files
# compat Use NIS on compat mode
# hesiod Use Hesiod for user lookups
# [NOTFOUND=return] Stop searching if not found so far
#
# To use db, put the "db" in front of "files" for entries you want to be
# looked up first in the databases
#
# Example:
# passwd: db files nisplus nis
# shadow: db files nisplus nis
# group: db files nisplus nis
Passwd: files ldap
Shadow: files ldap
Group: files ldap
# hosts: db files nisplus nis dns
Hosts: files dns
# Example-obey only what nisplus tells us...
# services: nisplus [NOTFOUND=return] files
# networks: nisplus [NOTFOUND=return] files
# protocols: nisplus [NOTFOUND=return] files
# rpc: nisplus [NOTFOUND=return] files
# ethers: nisplus [NOTFOUND=return] files
# netmasks: nisplus [NOTFOUND=return] files
Bootparams: nisplus [NOTFOUND=return] files
Ethers: files
Netmasks: files
Networks: files
Protocols: files
Rpc: files
Services: files
Netgroup: nisplus
Publickey: nisplus
Automount: files nisplus
Aliases: files nisplus
# vim / etc/sysconfig/authconfig
USEMKHOMEDIR=yes
USEPAMACCESS=no
CACHECREDENTIALS=yes
USESSSDAUTH=no
USESHADOW=yes
USEWINBIND=no
USESSSD=no
PASSWDALGORITHM=md5
FORCELEGACY=no
USEFPRINTD=no
USEHESIOD=no
FORCESMARTCARD=no
USELDAPAUTH=yes
USELDAP=yes
USECRACKLIB=yes
USEWINBINDAUTH=no
USESMARTCARD=no
USELOCAUTHORIZE=yes
USENIS=no
USEKERBEROS=no
USESYSNETAUTH=no
USESMBAUTH=no
USEDB=no
USEPASSWDQC=no
# vim / etc/openldap/ldap.conf
BASE dc=oms,dc=com
URI ldap://ldap-master.ops.com, ldap://ldap-slave.ops.com
# vim / etc/pam_ldap.conf
BASE dc=oms,dc=com
URI ldap://ldap-master.ops.com, ldap://ldap-slave.ops.com
Pam_check_host_attr yes
# vim / etc/pam.d/system-auth
#% PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
Auth required pam_env.so
Auth sufficient pam_unix.so nullok try_first_pass
Auth requisite pam_succeed_if.so uid > = 500quiet
Auth sufficient pam_ldap.so use_first_pass
Auth required pam_deny.so
Account required pam_unix.so broken_shadow
Account sufficient pam_localuser.so
Account sufficient pam_succeed_if.so uid < 500 quiet
Account [default=bad success=ok user_unknown=ignore] pam_ldap.so
Account required pam_permit.so
Password requisite pam_cracklib.so try_first_pass retry=3 type=
Password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
Password sufficient pam_ldap.so use_authtok
Password required pam_deny.so
Session optional pam_keyinit.so revoke
Session required pam_limits.so
Session optional pam_mkhomedir.so skel=/etc/skel/ umask=0022
Session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
Session required pam_unix.so
Session optional pam_ldap.so
# nslcd.conf does not need to be configured. Caching services are provided by nscd, not nslcd.
# vim / etc/nslcd.conf
Uid nslcd
Gid ldap
Uri ldap://ldap-master.ops.com ldap://ldap-slave.ops.com
Base dc=oms,dc=com
Ssl no
Tls_cacertdir / etc/openldap/cacerts
/ etc/pam.d/system-auth-ac # set "use MD5 password" in setup
/ etc/pam.d/password-auth # is configured before you can log in using LDAP
-
Error message:
[root@wade28 openldap] # service slapd restart
Stopping slapd: [OK]
Checking configuration files for slapd: [WARNING]
Bdb_db_open: warning-no DB_CONFIG file found in directory / var/lib/ldap: (2)
Expect poor performance for suffix "dc=my-domain,dc=com".
Config file testing succeeded
Starting slapd: [OK]
Solution:
This error does not affect the ldap authentication service; if you must fix it, execute the following command
[root@wade28 openldap] # cp / usr/share/doc/openldap-servers-2.4.19/DB_CONFIG.example / var/lib/ldap/DB_CONFIG
Chown-R ldap / var/lib/ldap
OR:
/ usr/share/openldap-servers/DB_CONFIG.example
*********************
Installation package dependencies:
[root@h2] # rpm-ivh openldap-servers-2.3.43-12.el5.i386.rpm
Error: Failed dependencies:
Libltdl.so.3 is needed by openldap-servers-2.3.43-12.el5.i386
Openldap = 2.3.43-12.el5 is needed by openldap-servers-2.3.43-12.el5.i386
Solution:
[root@h2] # rpm-ivh libtool-ltdl-devel-1.5.22-7.el5_4.i386.rpm libtool-ltdl-1.5.22-7.el5_4.i386.rpm
Preparing... # [100%]
1:libtool-ltdl # # [50%]
2:libtool-ltdl-devel # # [100%]
* *
[root@xiangjingdev40_v_o openldap] # slaptest-f slapd.conf-F slapd.d/
Bdb_db_open: warning-no DB_CONFIG file found in directory / var/lib/ldap: (2)
Expect poor performance for suffix "dc=chanjetoms,dc=com".
Bdb_db_open: database "dc=chanjetoms,dc=com": db_open (/ var/lib/ldap/id2entry.bdb) failed: No such file or directory (2).
Backend_startup_one (type=bdb, suffix= "dc=chanjetoms,dc=com"): bi_db_open failed! (2)
Slap_startup failed (test would succeed using the-u switch)
Solution:
Chown ldap.ldap / var/lib/ldap
/ etc/init.d/sldapd start
Ls-lh / var/lib/ldap/ check whether the db file is generated
[root@www ldap] # slaptest-f / etc/openldap/slapd.conf
Config file testing succeeded
