#ldapserver #安装openldap setenforce 0 && systemctl stop firewalld && iptables -F yum install -y epel-release yum install -y openldap openldap-clients openldap-servers systemctl start slapd systemctl enable slapd systemctl status slapd #ldapServer root密码 adminpd='Huawei@123' DomainName="huawei" DomainSuffix="com" ########################################################### PassWord="$(slappasswd -s $adminpd)" cat >/etc/openldap/schema/changepwd.ldif<<EOF dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: $PassWord EOF #导入自定义配置文件 ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/changepwd.ldif #导入基础schema ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/collective.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/corba.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/duaconf.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/dyngroup.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/java.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/misc.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/openldap.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/pmi.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/ppolicy.ldif #定义修改域名和后缀 DomainName="huawei" DomainSuffix="com" # 修改域名，新增changedomain.ldif, 这里我自定义的域名为 huawei.com，管理员用户账号为admin。 # 如果要修改，则修改文件中相应的dc=huawei,dc=com为自己的域名 cat >/etc/openldap/schema/changedomain.ldif<<EOFA dn: olcDatabase={1}monitor,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=admin,dc=${DomainName},dc=${DomainSuffix}" read by * none dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcSuffix olcSuffix: dc=${DomainName},dc=${DomainSuffix} dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=admin,dc=${DomainName},dc=${DomainSuffix} dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootPW olcRootPW: ${PassWord} dn: olcDatabase={2}hdb,cn=config changetype: modify add: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=${DomainName},dc=${DomainSuffix}" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=${DomainName},dc=${DomainSuffix}" write by * read EOFA ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/changedomain.ldif # 启用memberof功能 cat >/etc/openldap/schema/add-memberof.ldif<<EOFC dn: cn=module{0},cn=config cn: modulle{0} objectClass: olcModuleList objectclass: top olcModuleload: memberof.la olcModulePath: /usr/lib64/openldap dn: olcOverlay={0}memberof,olcDatabase={2}hdb,cn=config objectClass: olcConfig objectClass: olcMemberOf objectClass: olcOverlayConfig objectClass: top olcOverlay: memberof olcMemberOfDangling: ignore olcMemberOfRefInt: TRUE olcMemberOfGroupOC: groupOfUniqueNames olcMemberOfMemberAD: uniqueMember olcMemberOfMemberOfAD: memberOf EOFC cat >/etc/openldap/schema/refint1.ldif<<EOFD dn: cn=module{0},cn=config add: olcmoduleload olcmoduleload: refint EOFD cat >/etc/openldap/schema/refint2.ldif<<EOFE dn: olcOverlay=refint,olcDatabase={2}hdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcRefintConfig objectClass: top olcOverlay: refint olcRefintAttribute: memberof uniqueMember manager owner EOFE ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/add-memberof.ldif ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/refint1.ldif ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/refint2.ldif #定义修改域名和后缀 DomainName="huawei" DomainSuffix="com" cat >/etc/openldap/schema/base.ldif<<EOFF dn: dc=${DomainName},dc=${DomainSuffix} objectClass: top objectClass: dcObject objectClass: organization o: ${DomainName} Company dc: ${DomainName} dn: cn=admin,dc=${DomainName},dc=${DomainSuffix} objectClass: organizationalRole cn: admin dn: ou=People,dc=${DomainName},dc=${DomainSuffix} objectClass: organizationalUnit ou: People dn: ou=Group,dc=${DomainName},dc=${DomainSuffix} objectClass: organizationalRole cn: Group EOFF # 执行命令，添加配置, 这里要注意修改域名为自己配置的域名，然后需要输入上面我们生成的密码 ldapadd -x -D cn=admin,dc=${DomainName},dc=${DomainSuffix} -w ${adminpd} -f /etc/openldap/schema/base.ldif yum install -y phpldapadmin sed -i 's#Require local#Require all granted#g' /etc/httpd/conf.d/phpldapadmin.conf # 启动apache systemctl start httpd systemctl enable httpd sed -i '/\'login\'\,\'attr\'\,\'uid\/ s#uid#cn#g'