軟件安裝包：
- OpenLDAP 2.4.44: ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.44.tgz
- BDB: http://download.oracle.com/berkeley-db/db-5.1.29.tar.gz
CentOS 7 準(zhǔn)備：
-
關(guān)閉防火墻
//停止firewall
systemctl stop firewalld.service//禁止firewall開機(jī)啟動(dòng) systemctl disable firewalld.service //[Optional] //設(shè)置iptables service yum -y install iptables-services vim /etc/sysconfig/iptables //增加規(guī)則 -A INPUT -m state --state NEW -m tcp -p tcp --dport 389 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 636 -j ACCEPT -
關(guān)閉selinux
//編輯selinux文件
vim /etc/sysconfig/selinux//修改SELINUX=enforcing 為disabled SELINUX=disabled //設(shè)置selinux狀態(tài) setenforce 0 //獲取selinux狀態(tài) getenfroce
安裝OpenLDAP
依賴包
//涉及l(fā)ibtool-ltdl與libtool-ltdl-devel吭狡，如不安裝，在編譯時(shí)報(bào)錯(cuò)：configure: error: could not locate libtool ltdl.h
[root@localhost ~]# yum install ltdl -y安裝BDB
//必須在解壓包的build_unix目錄中編譯安裝丽猬，否則會(huì)報(bào)錯(cuò)
[root@localhost ~]# cd /usr/local/src/
[root@localhost src]# tar -zxvf db-5.1.29.tar.gz
[root@localhost src]# cd db-5.1.29/build_unix/
[root@localhost build_unix]# ../dist/configure --prefix=/usr/local/berkeleydb-5.1.29
[root@localhost build_unix]# make
[root@localhost build_unix]# make install更新lib庫(kù)
//保證在后面編譯openldap時(shí)能找到lib和include下的庫(kù)晌梨。
[root@localhost build_unix]# cd /usr/local/src/
[root@localhost src]# echo "/usr/local/berkeleydb-5.1.29/lib/" > /etc/ld.so.conf
[root@localhost src]# ldconfig -v-
安裝OpenLDAP
//編譯選項(xiàng)可以通過(guò)./configure --help查看迅箩；
//其中make test一步時(shí)間較長(zhǎng)缠沈；
[root@localhost ~]# cd /usr/local/src/
[root@localhost src]# tar -zxvf openldap-2.4.44.tgz
[root@localhost src]# cd openldap-2.4.44
[root@localhost openldap-2.4.44]# ./configure --prefix=/usr/local/openldap-2.4.44 --enable-syslog --enable-modules --enable-debug --with-tls CPPFLAGS=-I/usr/local/berkeleydb-5.1.29/include/ LDFLAGS=-L/usr/local/berkeleydb-5.1.29/lib/
[root@localhost openldap-2.4.44]# make depend
[root@localhost openldap-2.4.44]# make
[root@localhost openldap-2.4.44]# make test
[root@localhost openldap-2.4.44]# make install//OpenLDAP 包在服務(wù)器上安裝了很多程序： //守護(hù)進(jìn)程： slapd：主 LDAP 服務(wù)器 slurpd：負(fù)責(zé)與復(fù)制 LDAP 服務(wù)器保持同步的服務(wù)器 //對(duì)網(wǎng)絡(luò)上的目錄進(jìn)行操作的客戶機(jī)程序晋渺。下面這兩個(gè)程序是一對(duì)兒： ldapadd：打開一個(gè)到 LDAP 服務(wù)器的連接鲤看，綁定缘揪、修改或增加條目 ldapsearch：打開一個(gè)到 LDAP 服務(wù)器的連接，綁定并使用指定的參數(shù)進(jìn)行搜索 //對(duì)本地系統(tǒng)上的數(shù)據(jù)庫(kù)進(jìn)行操作的幾個(gè)程序： slapadd：將以 LDAP 目錄交換格式（LDIF）指定的條目添加到 LDAP 數(shù)據(jù)庫(kù)中 slapcat：打開 LDAP 數(shù)據(jù)庫(kù)义桂，并將對(duì)應(yīng)的條目輸出為 LDIF 格式 設(shè)置可執(zhí)行命令
//對(duì)openldap客戶端（bin）與服務(wù)器端（sbin）相關(guān)執(zhí)行檔添加軟鏈接找筝，也可以通過(guò)增加環(huán)境變量的方式設(shè)置
[root@localhost openldap-2.4.44]# cd /usr/local/openldap-2.4.44
[root@localhost openldap-2.4.44]# ln -s /usr/local/openldap-2.4.44/bin/* /usr/local/bin/
[root@localhost openldap-2.4.44]# ln -s /usr/local/openldap-2.4.44/sbin/* /usr/local/sbin/-
配置rootdn密碼
//這樣rootdn密碼為密文方式，復(fù)制輸出密文到主配置文件rootdn對(duì)應(yīng)的位置即可慷吊，如果不想麻煩袖裕，可以忽略此步，在主配置文件中使用明文即可溉瓶。
[root@locahost openldap-2.4.44]# slappasswd
New password:Re-enter new password: {SSHA}Jaxya/293KIkH8+3crZqiWpYLK829+pv [root@NGACentOS7 openldap-2.4.44]# -
修改主配置文件slapd.conf :
[root@localhost openldap-2.4.44]# cd /usr/local/openldap-2.4.44/etc/openldap/
[root@localhost openldap]# vim slapd.conf
內(nèi)容如下：
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.//schema默認(rèn)只有core.schema急鳄，各級(jí)需要添加，這里將同配置文件一個(gè)目錄的schema目錄中有的schema文件都加到配置文件中堰酿。 include /usr/local/openldap-2.4.44/etc/openldap/schema/core.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/collective.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/corba.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/cosine.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/duaconf.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/dyngroup.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/inetorgperson.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/java.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/misc.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/nis.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/openldap.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/pmi.schema include /usr/local/openldap-2.4.44/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/openldap-2.4.44/var/run/slapd.pid argsfile /usr/local/openldap-2.4.44/var/run/slapd.args //#新增日志文件級(jí)別與路徑疾宏，需要在編譯時(shí)--enable-debug，否則日志文件輸出触创，不影響調(diào)試模式坎藐。 loglevel 256 logfile /usr/local/openldap-2.4.44/var/slapd.log # Load dynamic backend modules: # modulepath /usr/local/openldap-2.4.44/libexec/openldap # moduleload back_mdb.la # moduleload back_ldap.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # MDB database definitions ####################################################################### //這里使用mdb做后端數(shù)據(jù)庫(kù)，也可修改為”bdb”參數(shù)哼绑，在OpenLDAP 官方文檔” 11.4. LMDB”章節(jié)中有介紹mdb是推薦使用的后端數(shù)據(jù)庫(kù) database mdb maxsize 1073741824 /*使用mdb做后端數(shù)據(jù)庫(kù)時(shí)岩馍，根據(jù)官方文檔中說(shuō)明需要設(shè)置一個(gè)空間值，” In addition to the usual parameters that a minimal configuration requires, the mdb backend requires a maximum size to be set. This should be the largest that the database is ever anticipated to grow (in bytes). The filesystem must also provide enough free space to accommodate this size.”抖韩；如果使用bdb做后端數(shù)據(jù)庫(kù)蛀恩，需要將此項(xiàng)參數(shù)注釋。*/ //修改域名及管理員賬戶名茂浮。 suffix "dc=cisco,dc=com" rootdn "cn=admin,dc=cisco,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. //使用密文密碼双谆，即前面使用slappasswd生成的密文。 rootpw {SSHA}Jaxya/293KIkH8+3crZqiWpYLK829+pv # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. //openldap數(shù)據(jù)目錄席揽，采用mdb時(shí)佃乘，在相應(yīng)目錄生成” data.mdb”與” lock.mdb”文件；采用bdb時(shí)驹尼，在相應(yīng)目錄生成” dn2id.bdb”與” id2entry.bdb”趣避，及多個(gè)” __db.00*”文件。 directory /usr/local/openldap-2.4.44/var/openldap-data # Indices to maintain index objectClass eq 初始化OpenLDAP（Optional）
#如果采用mdb做后端數(shù)據(jù)庫(kù)新翎，此步可忽略程帕，DB_CONFIG是 bdb/hdb數(shù)據(jù)庫(kù)使用的住练。
#與主配置文件中的配置有關(guān)，主配置文件確定使用bdb與數(shù)據(jù)存放路徑愁拭。
[root@localhost openldap]# cd /usr/local/openldap-2.4.44/var/openldap-data/
[root@localhost openldap-data]# cp DB_CONFIG.example DB_CONFIG-
啟動(dòng)OpenLDAP
//直接在后臺(tái)工作;
[root@localhost ~]# /usr/local/openldap-2.4.44/libexec/slapd//非root用戶不能監(jiān)聽端口1~1024讲逛，如果是非root用戶，有可能需要重新定義服務(wù)端口岭埠。 [root@localhost ~]# /usr/local/openldap-2.4.44/libexec/slapd -d 256 //驗(yàn)證(任選一個(gè)) [root@localhost ~]# ldapsearch -x -b '' -s base'(objectclass=*)' [root@localhost ~]# ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts [root@localhost ~]# netstat -tunlp | grep 389盏混，ps -ef | grep slapd，ps aux | grep slapd -
LDIF文件配置組織惜论，用戶许赃，條目等
//創(chuàng)建一個(gè)管理員賬號(hào)：
[root@NGACentOS7 ~]# cat admin.ldifdn: dc=cisco,dc=com objectclass: dcObject objectclass: organization o: CISCO.Inc dc: cisco dn: cn=admin,dc=cisco,dc=com objectclass: organizationalRole cn: admin [root@NGACentOS7 ~]# //注意：you need an empty line before each line starting with "dn:" LDIF separates entries by blank lines. //添加至ldap數(shù)據(jù)庫(kù) //簡(jiǎn)單身份驗(yàn)證必須要使用 -x 選項(xiàng)指定。在 slapd.conf 中定義的 rootdn 身份驗(yàn)證識(shí)別名是 “cn=admin,dc=cisco,dc=com”馆类。對(duì)于簡(jiǎn)單身份驗(yàn)證來(lái)說(shuō)混聊，必須使用密碼。選項(xiàng) -W 強(qiáng)制提示輸入密碼乾巧。這個(gè)密碼就是在 slapd.conf 文件中指定的 rootpw 參數(shù)的值句喜。包含這些條目的 LDIF 文件是使用 -f 選項(xiàng)指定的： [root@NGACentOS7 ~]# ldapadd -x -D "cn=admin,dc=cisco,dc=com" -W -f admin.ldif Enter LDAP Password: adding new entry "dc=cisco,dc=com" adding new entry "cn=admin,dc=cisco,dc=com" /*驗(yàn)證 [root@NGACentOS7 ~]# ldapsearch -x -b 'dc=cisco,dc=com' '(objectClass=*)' # extended LDIF # # LDAPv3 # base <dc=cisco,dc=com> with scope subtree # filter: (objectClass=*) # requesting: ALL # # cisco.com dn: dc=cisco,dc=com objectClass: dcObject objectClass: organization o: CISCO.Inc dc: cisco # admin, cisco.com dn: cn=admin,dc=cisco,dc=com objectClass: organizationalRole cn: admin # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 */
[Private]
NAM Lab 配置實(shí)例：
[root@NGACentOS7 ~]# cat namPeople.ldif
dn:uid=Lily,ou=namPeople,dc=cisco,dc=com
uid:Lily
cn:Lily
sn:Lily
userPassword:Crdc%123
objectClass:inetOrgPerson
objectClass:posixAccount
uidNumber:1315
gidNumber:100
homeDirectory:/home/Lily
dn:uid=Lucy,ou=namPeople,dc=cisco,dc=com
uid:Lucy
cn:Lucy
objectClass:account
objectClass:posixAccount
objectClass:top
objectClass:shadowAccount
userPassword:Crdc%123
shadowLastChange:15064
loginShell:/bin/sh
uidNumber:1315
gidNumber:100
homeDirectory:/home/Lucy
dn:uid=Leo,ou=namPeople,dc=cisco,dc=com
uid:Leo
cn:Leo
objectClass:account
objectClass:posixAccount
objectClass:top
objectClass:shadowAccount
userPassword:Crdc%123
shadowLastChange:15064
loginShell:/bin/sh
uidNumber:1316
gidNumber:100
homeDirectory:/home/Leo
[root@NGACentOS7 ~]#
ISE 關(guān)聯(lián)配置：
參考補(bǔ)充自：
