安裝LDAP- slapd.conf 方式

------------------開始安裝---------------------
查詢是否安裝

# rpm -qa openldap-servers

移除ldap

# yum remove openldap

# yum remove openldap-servers

安裝環境
centos7
Apache/2.4.6 (CentOS)
PHP 7.1.11

安裝 LDAP Server


openldap-servers-2.4.44-5.el7.x86_64

# yum install openldap-servers openldap-clients migrationtools


# rpm -qa | grep openldap

刪除 slapd.d 資料夾內全部檔案，並複製一份 slapd.conf
# rm -rvf /etc/openldap/slapd.d
# mkdir /etc/openldap/slapd.d

產生密碼

# /sbin/slappasswd
New password:
Re-enter new password:

{SSHA}XXXXXXXXXXXXXXXXX….

ldap-server 設定檔
# cp /usr/share/openldap-servers/slapd.ldif /etc/openldap/slapd.conf

修改 slapd.conf 檔案
# vi /etc/openldap/slapd.conf

把

olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=my-domain,dc=com" read by * none

olcSuffix: dc=my-domain,dc=comolcRootDN: cn=Manager,dc=my-domain,dc=com

改為

olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=ntpu,dc=edu,dc=tw" read by * noneolcSuffix: dc=ntpu,dc=edu,dc=tw
olcRootDN: cn=Manager,dc=ntpu,dc=edu,dc=tw

olcRootPW: {SSHA}XXXXXXXXXXXXXXXXXXXXX

(olcRootPW 請從剛才的 password.txt 中複製來)

開始轉換組態檔

# rm -rvf /var/lib/ldap/*

# /usr/libexec/openldap/convert-config.sh

# head -20 /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{[12]}*

測試 LDAP 設定檔是否正常

# slaptest -u

config file testing succeeded

清除資料庫範例檔，複製資料庫預設設定檔
複製資料庫預設設定檔# 
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

# rm -rvf /etc/openldap/certs
# mkdir /etc/openldap/certs

 建立 certs DB 資料

# /usr/libexec/openldap/create-certdb.sh
Creating certificate database in '/etc/openldap/certs'.
# /usr/libexec/openldap/generate-server-cert.sh
Creating new server certificate in '/etc/openldap/certs'.
# chown ldap:ldap -R /var/lib/ldap/
# systemctl start slapd
# slaptest
config file testing succeeded
# systemctl enable slapd
# firewall-cmd --permanent --zone=public --add-port=389/tcp
# firewall-cmd --reload
# ldapwhoami -WD cn=Manager,dc=ntpu,dc=edu,dc=tw
Enter LDAP Password:
dn:cn=Manager,dc=ntpu,dc=edu,dc=tw

匯入 schema
# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif

編輯根節點

# vim base.ldif

dn: dc=ntpu,dc=edu,dc=tw

objectClass: top

objectClass: dcObject

objectclass: organization

o: NTPU

dc: ntpu

dn: cn=Manager,dc=ntpu,dc=edu,dc=tw

objectClass: organizationalRole

cn: Manager

description: Directory Manager

dn: ou=STU,dc=ntpu,dc=edu,dc=tw

objectClass: organizationalUnit

ou: STU
description:student

dn: ou=TEA,dc=ntpu,dc=edu,dc=tw

objectClass: organizationalUnit

ou: TEA
description:teacher


# /bin/ldapadd -x -D "cn=Manager,dc=ntpu,dc=edu,dc=tw" -W -f base.ldif
Enter LDAP Password:
adding new entry "dc=ntpu,dc=edu,dc=tw"
adding new entry "cn=Manager,dc= ntpu,dc=edu,dc=tw"
adding new entry "ou=People,dc= ntpu,dc=edu,dc=tw"
adding new entry "ou= Group,dc= ntpu,dc=edu,dc=tw"

防火牆設定

# /bin/firewall-cmd --permanent --add-service=ldap
# /bin/firewall-cmd --reload

http://yu-li-liang.blogspot.tw/2016/02/centos7-openldap-server.html

http://wiki.weithenn.org/cgi-bin/wiki.pl?OpenLDAP-LDAP_Server_%E5%9F%BA%E7%A4%8E%E8%A8%AD%E5%AE%9A#Heading6

http://weng-weiling.blogspot.tw/2017/05/ldap-server.html

http://bojack.pixnet.net/blog/post/32056233-%E3%80%90linux%E3%80%91%E5%9C%A8-centos-%E4%B8%8A%E5%AE%89%E8%A3%9D-ldap-server-2.4