Ldap network account
# ldap network account #
1. What is ldap?
Ldap directory service authentication, similar to windows active Directory, is a way to record data
Software required for 2.ldap client
Yum sssd krb5-workstation-y
3. How to turn on ldap user authentication
Authconfig-tui
┌─┤ Authentication Configuration ├─┐
│ │
│ User Information Authentication │
│ [] Cache Information [] Use MD5 Passwords │
│ [*] Use LDAP [*] Use Shadow Passwords │
│ [] Use NIS [] Use LDAP Authentication │
│ [] Use IPAv2 [*] Use Kerberos │
│ [] Use Winbind [] Use Fingerprint reader │
│ [] Use Winbind Authentication │
│ [*] Local authorization is sufficient │
│ │
│ ┌─┐ ┌─┐ │
│ │ Cancel │ │ Next │ │
│ └─┘ └─┘ │
│ │
│ │
└─┘
┌─┤ LDAP Settings ├─┐
│ │
│ [*] Use TLS │
│ Server: ldap://cla***oom.example.com/_ │
│ Base DN: dc=example,dc=com___ │
│ │
│ ┌─┐ ┌─┐ │
│ │ Back │ │ Next │ │
│ └─┘ └─┘ │
│ │
│ │
└───┘
┌─┤ Kerberos Settings ├─┐
│ │
│ Realm: EXAMPLE.COM__ │
│ KDC: cla***oom.example.com_ │
│ Admin Server: cla***oom.example.com_ │
│ [] Use DNS to resolve hosts to realms │
│ [] Use DNS to locate KDCs for realms │
│ │
│ ┌─┐ ┌────┐ │
│ │ Back │ │ Ok │ │
│ └─┘ └────┘ │
│ │
│ │
└───┘
┌─┤ Warning ├─┐
│ │
│ To connect to a LDAP server with TLS │
│ protocol enabled you need a CA certificate │
│ which signed your server's certificate. │
│ Copy the certificate in the PEM format to │
│ the'/ etc/openldap/cacerts' directory. │
│ Then press OK. │
│ │
│ ┌────┐ │
│ │ Ok │ │
│ └────┘ │
│ │
│ │
└────┘
Because the certificate of tls is missing, you need to download the required certificate to / etc/openldap/cacerts from the server.
Commands used
Wget http://172.25.254.254/pub/example-ca.crt
Getent passwd ldapuser1
If the user information can be displayed normally, it proves that the client has recognized it successfully.
4. Automatically mount the user's home directory
Yum install autofs-y
Vim / etc/autofs.master
/ home/guests / etc/auto.ldap
Vim / etc/auto.ldap
Ldapuser1 172.25.254.254:/home/guests/ldapuser1
+ + +
* 172.25.254.254Homeostermogram guestsUniverse &
Systemctl restart autofs
# create script execution ldap####
Vim set-ldap.sh
#! / bin/bash
Echo "install software ing..."
Yum install sssd krb5-workstation autofs-y
Echo "config ldap auth client ing..."
Authconfig\
-- enableldap\
-- enablekrb5\
-- disableldapauth\
-- enableldaptls\
-- ldaploadcacert= http://172.25.254.254/pub/example-ca.crt\
-ldapserver= "cla***oom.example.com"\
-ldapbasedn= "dc=example,dc=com"\
-krb5realm= "EXAMPLE.COM"\
-krb5kdc= "cla***oom.example.com"\
-krb5adminserver= "cla***oom.example.com"\
-- enablesssd\
-- enablesssdauth\
-- update\
Echo "config ldap user\'s home directory"
Echo / home/guests / etc/auto.ldap > > / etc/auto.master
Echo "* 172.25.254.254VERVERGULAR homeguestsUnix &" > > / etc/auto.ldap
Systemctl restart autofs
Systemctl enable autofs
Echo "all is successful!"
: wq
Sh set-ldap.sh # # execute script
