本文共 4101 字，大约阅读时间需要 13 分钟。

This tutorial explains how you can set up LDAP user authentication on a CentOS 5.x system.

Domain name: shadow.com

LDAP Server IP: 192.168.56.1

Server Configuration

Packages needed: openldap-servers

[root@icewalker ~]# vi /etc/openldap/slapd.conf

Set these values to:

suffix        "dc=shadow,dc=com"rootdn        "cn=root,dc=shadow,dc=com"

Set root’s password:

rootpw        your_desired_password

We can  encrypt our admin password; for that run the slappasswd command. It will ask you for a password, and after you enter it twice, it'll spit out a line like this:

{SSHA}04b5U6YTzQ651v9EB+l7e0FEXoEmB/Up

and use it as

rootpw {SSHA}04b5U6YTzQ651v9EB+l7e0FEXoEmB/Up

Test your configuration by running the

slaptest -u

command.

[root@icewalker ~]# cp /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

[root@icewalker ~]# service ldap start

[root@icewalker ~]# chkconfig ldap on

Now we need to set up our base, authentication and group files. That is, we'll establish our basic parameters for the LDAP server, then migrate over (most of) the user accounts, and (most of) the group accounts.

[root@icewalker ~]# cd /usr/share/openldap/migration

[root@icewalker ~]# ./migrate_base.pl > base.ldif

In base.ldif we require only the following sections:

dn: dc=padl,dc=comdc: padlobjectClass: topobjectClass: domaindn: ou=People,dc=padl,dc=comou: PeopleobjectClass: topobjectClass: organizationalUnitdn: ou=Group,dc=padl,dc=comou: GroupobjectClass: topobjectClass: organizationalUnit

Replace all padl with shadow so that it becomes:

dn: dc=shadow,dc=comdc: shadowobjectClass: topobjectClass: domaindn: ou=People,dc=shadow,dc=comou: PeopleobjectClass: topobjectClass: organizationalUnitdn: ou=Group,dc=shadow,dc=comou: GroupobjectClass: topobjectClass: organizationalUnit

Now, we can import that information into our LDAP database using this command:

[root@icewalker ~]# ldapadd -x -W -D “cn=root,dc=shadow,dc=com” -f ./base.ldif

We need to tell the script where to find password information. We do that by setting the shell variable ETC_SHADOW to be /etc/shadow. This command will do just that:

[root@icewalker ~]# export ETC_SHADOW=/etc/shadow

Then, we can run

[root@icewalker ~]# ./migrate_passwd.pl /etc/passwd people.ldif

In the people.ldif file delete all sections except the required user's section and replace all padl with shadow.

[root@icewalker migration]# cat people.ldif

dn: uid=basil,ou=People,dc=shadow,dc=comuid: basilcn: Basil KurianobjectClass: accountobjectClass: posixAccountobjectClass: topobjectClass: shadowAccountuserPassword: {crypt}$1$Dr0hxwtg$.zGk8MIf57AHmj6vpD07n.shadowLastChange: 14791shadowMax: 99999shadowWarning: 7loginShell: /bin/bashuidNumber: 500gidNumber: 500homeDirectory: /home/basilgecos: Basil Kurian

[root@icewalker migration]# ./migrate_group.pl /etc/group group.ldif

Again, replace instances of padl with linuxclass, and remove extraneous groups.

[root@icewalker migration]# cat group.ldif

dn: cn=basil,ou=Group,dc=shadow,dc=comobjectClass: posixGroupobjectClass: topcn: basiluserPassword: {crypt}xgidNumber: 500

After you've done that, it's time to import the two files to ldap:

[root@icewalker migration]# ldapadd -x -W -D “cn=root,dc=shadow,dc=com” -f people.ldif

[root@icewalker migration]# ldapadd -x -W -D “cn=root,dc=shadow,dc=com” -f group.ldif

Now, we have our database populated with info. It's time to test our work. First, you can use the ldapsearch command to look for your username:

[root@icewalker migration]# ldapsearch -x ‘cn=basil’

Client Configuration

Use authconfig-gtk or authconfig-tui:

[root@icewalker migration]# authconfig-gtk

Choose Enable LDAP Support.

LDAP Search Base DN should be dc=shadow,dc=com

LDAP server, we'll enter ldap://192.168.56.1, that is the server's IP.

How To Clear LDAP Database

First stop LDAP:

[root@icewalker ~]# service ldap stop

Go to the /var/lib/ldap directory (this is the directory containing your database; this directory is specified in the slapd.conf file).

[root@icewalker ~]# cd /var/lib/ldap

Remove all databases by using:

[root@icewalker ~]#  rm *

Again start the LDAP service and populate it with data.

转载地址：http://nqqmb.baihongyu.com/