CentOS 7 OpenLDAP LDAP 서버 설정

OpenLDAP LDAP 서버 설정

 

각 서버에서 사용자의 계정 정보를 공유 할 수 있도록 LDAP 서버를 구축합니다.

1. OpenLDAP을 설치합니다.

[root@cent7 ~]# yum -y install openldap-servers openldap-clients

[root@cent7 ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG 

[root@cent7 ~]# chown ldap. /var/lib/ldap/DB_CONFIG 

[root@cent7 ~]# systemctl start slapd 

[root@cent7 ~]# systemctl enable slapd 

2. OpenLDAP 관리자 암호를 설정합니다.

# 관리자 암호 생성

[root@cent7 ~]# slappasswd 

New password:

Re-enter new password:

{SSHA}xxxxxxxxxxxxxxxxxxxxxxxx

[root@cent7 ~]# vi chrootpw.ldif

# olcRootPW 생성 한 관리자 암호를 지정

dn: olcDatabase={0}config,cn=config

changetype: modify

add: olcRootPW

olcRootPW: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxx

[root@cent7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif 

SASL/EXTERNAL authentication started

SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

SASL SSF: 0

modifying entry "olcDatabase={0}config,cn=config"

3. 기본 스키마를로드해야합니다.

[root@cent7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif 

SASL/EXTERNAL authentication started

SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

SASL SSF: 0

adding new entry "cn=cosine,cn=schema,cn=config"

[root@cent7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif 

SASL/EXTERNAL authentication started

SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

SASL SSF: 0

adding new entry "cn=nis,cn=schema,cn=config"

[root@cent7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif 

SASL/EXTERNAL authentication started

SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

SASL SSF: 0

adding new entry "cn=inetorgperson,cn=schema,cn=config"

4. 자신의 도메인 이름을 설정합니다.

# 디렉토리 관리자 비밀번호 생성

[root@cent7 ~]# slappasswd 

New password:

Re-enter new password:

{SSHA}xxxxxxxxxxxxxxxxxxxxxxxx

[root@cent7 ~]# vi chdomain.ldif

# dc = *** dc = ***는 자신의 도메인 이름으로 대체

# (다음은 도메인 이름 "srv.world"의 경우의 예)

# olcRootPW 생성 한 디렉토리 관리자 암호를 지정

dn: olcDatabase={1}monitor,cn=config

changetype: modify

replace: olcAccess

olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"

  read by dn.base="cn=Manager,dc=srv,dc=world" read by * none

dn: olcDatabase={2}hdb,cn=config

changetype: modify

replace: olcSuffix

olcSuffix: dc=srv,dc=world

dn: olcDatabase={2}hdb,cn=config

changetype: modify

replace: olcRootDN

olcRootDN: cn=Manager,dc=srv,dc=world

dn: olcDatabase={2}hdb,cn=config

changetype: modify

add: olcRootPW

olcRootPW: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxx

dn: olcDatabase={2}hdb,cn=config

changetype: modify

add: olcAccess

olcAccess: {0}to attrs=userPassword,shadowLastChange by

dn="cn=Manager,dc=srv,dc=world" write by anonymous auth by self write by * none

olcAccess: {1}to dn.base="" by * read

olcAccess: {2}to * by dn="cn=Manager,dc=srv,dc=world" write by * read

[root@cent7 ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif 

SASL/EXTERNAL authentication started

SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

SASL SSF: 0

modifying entry "olcDatabase={1}monitor,cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

[root@cent7 ~]# vi basedomain.ldif

# dc = *** dc = ***는 자신의 도메인 이름으로 대체

# (다음은 도메인 이름 "srv.world"의 경우의 예)

# "dc : Srv"부분은 자신의 도메인 이름의 시작 부분에 대체

dn: dc=srv,dc=world

objectClass: top

objectClass: dcObject

objectclass: organization

o: Server World

dc: Srv

dn: cn=Manager,dc=srv,dc=world

objectClass: organizationalRole

cn: Manager

description: Directory Manager

dn: ou=People,dc=srv,dc=world

objectClass: organizationalUnit

ou: People

dn: ou=Group,dc=srv,dc=world

objectClass: organizationalUnit

ou: Group

[root@cent7 ~]# ldapadd -x -D cn=Manager,dc=srv,dc=world -W -f basedomain.ldif 

Enter LDAP Password: # directory manager's password

adding new entry "dc=srv,dc=world"

adding new entry "cn=Manager,dc=srv,dc=world"

adding new entry "ou=People,dc=srv,dc=world"

adding new entry "ou=Group,dc=srv,dc=world"

5. Firewalld을 사용하고있는 경우 , LDAP 서비스의 허가가 필요합니다. 또한 LDAP는 389 / TCP를 사용합니다.

[root@cent7 ~]# firewall-cmd --add-service=ldap --permanent 

success

[root@cent7 ~]# firewall-cmd --reload 

success