CentOS 7 简单搭建OpenLDAP服务

<code class="bash">yum install -y openldap-servers openldap-clients</code>

<code class="bash">cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown ldap. /var/lib/ldap/DB_CONFIG</code>

<code class="bash">systemctl start slapd
systemctl enable slapd</code>

<code class="bash">slappasswd</code>

<code class="ldif">dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxx  // 将xxxxxxxxxxxxxxxxxxxxxxxx替换为你的密码哈希值</code>

<code class="bash">ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif</code>

<code class="bash">ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif</code>

<code class="bash">slappasswd</code>

<code class="ldif">dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=example,dc=com" read by * none
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=example,dc=com  // 替换为你的域名
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=example,dc=com  // 替换为你的域名和管理员DN
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxx  // 将xxxxxxxxxxxxxxxxxxxxxxxx替换为你的密码哈希值
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=Manager,dc=example,dc=com" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=example,dc=com" write by * read
</code>

<code class="bash">ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif</code>

<code class="ldif">dn: dc=example,dc=com  // 替换为你的域名
objectClass: top
objectClass: dcObject
objectclass: organization
o: Example Organization
dc: example
dn: cn=Manager,dc=example,dc=com  // 替换为你的域名
objectClass: organizationalRole
cn: Manager
description: Directory Manager
dn: ou=People,dc=example,dc=com  // 替换为你的域名
objectClass: organizationalUnit
ou: People
dn: ou=Group,dc=example,dc=com  // 替换为你的域名
objectClass: organizationalUnit
ou: Group</code>

<code class="bash">ldapadd -x -D cn=Manager,dc=example,dc=com -W -f basedomain.ldif</code>

<code class="bash">firewall-cmd --add-service=ldap --permanent
firewall-cmd --reload</code>

<code class="bash">slappasswd</code>

<code class="ldif">dn: uid=test,ou=People,dc=example,dc=com  // 替换为你的域名
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: test
sn: Linux
userPassword: {SSHA}xxxxxxxxxxxxxxxxx  // 将xxxxxxxxxxxxxxxxx替换为你的密码哈希值
loginShell: /bin/bash
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/test
dn: cn=test,ou=Group,dc=example,dc=com  // 替换为你的域名
objectClass: posixGroup
cn: test
gidNumber: 1000
memberUid: test</code>

<code class="bash">ldapadd -x -D cn=Manager,dc=example,dc=com -W -f ldapuser.ldif</code>

<code class="bash">ldapsearch -x -D "cn=Manager,dc=example,dc=com" -W -b "dc=example,dc=com"</code>