#Word文档导入#LDAP的部署及用户同步

[root@node168 ~]# yum -y install openldap compat-openldap openldap-clients openldap-servers openldap-servers-sql openldap-devel migrationtools​

​

[root@incubator-t3-infra01 ]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG​

[root@incubator-t3-infra01 ]# chown ldap:ldap -R /var/lib/ldap​

[root@incubator-t3-infra01 ]# chmod 700 -R /var/lib/ldap​

​

​

[root@node168 ~]# systemctl enable slapd​

[root@node168 ~]# systemctl start slapd​

[root@node168 ~]# systemctl status slapd​

​

[root@node168 ~]# slappasswd -s xxxxxx​

{SSHA}z56dz1Ew6rF5mkMIVqp0UkAa+73RhXhx​

[root@node168 ldap]# vi /root/ldap/chrootpw.ldif ​

​

#specify the password generated above for "olcRootPW" section​

dn: olcDatabase={0}config,cn=config​

changetype: modify​

add: olcRootPW​

olcRootPW: {SSHA}z56dz1Ew6rF5mkMIVqp0UkAa+73RhXhx​​

​

​

[root@node168 ldap]# ldapadd -Y EXTERNAL -H ldapi:/// -f /root/ldap/chrootpw.ldif ​

​

[root@node168 ldap]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif​

[root@node168 ldap]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif​

[root@node168 ldap]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif​

​

[root@node168 ldap]# vi /root/ldap/chdomain.ldif ​

​

#replace to your own domain name for "dc=***,dc=***" section​

#specify the password generated above for "olcRootPW" section​

dn: olcDatabase={1}monitor,cn=config​

changetype: modify​

replace: olcAccess​

olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"​

read by dn.base="cn=ldapadm,dc=xxx,dc=com" read by * none​

​

dn: olcDatabase={2}hdb,cn=config​

changetype: modify​

replace: olcSuffix​

olcSuffix: dc=xxx,dc=com​

​

dn: olcDatabase={2}hdb,cn=config​

changetype: modify​

replace: olcRootDN​

olcRootDN: cn=ldapadm,dc=xxx,dc=com​

​

dn: olcDatabase={2}hdb,cn=config​

changetype: modify​

add: olcRootPW​

olcRootPW: {SSHA}z56dz1Ew6rF5mkMIVqp0UkAa+73RhXhx​

​

dn: olcDatabase={2}hdb,cn=config​

changetype: modify​

add: olcAccess​

olcAccess: {0}to attrs=userPassword,shadowLastChange by​

dn="cn=ldapadm,dc=t3cx,dc=com" write by anonymous auth by self write by * none​

olcAccess: {1}to dn.base="" by * read​

olcAccess: {2}to * by dn="cn=ldapadm,dc=xxx,dc=com" write by * read​

[root@node168 ldap]# ldapmodify -Y EXTERNAL -H ldapi:/// -f /root/ldap/chdomain.ldif​

​

[root@node168 ~]# vi /root/ldap/basedomain.ldif​

​

#replace to your own domain name for "dc=***,dc=***" section​

dn:dc=t3cx,dc=com​

objectClass: top​

objectClass: dcObject​

objectclass: organization​

o: Server cn​

dc: xxx​

​

dn: cn=ldapadm,dc=xxx,dc=com​

objectClass: organizationalRole​

cn: ldapadm​

description: Directory ldapadm​

​

dn: ou=People,dc=xxx,dc=com​

objectClass: organizationalUnit​

ou: People​

​

dn: ou=Group,dc=xxx,dc=com​

objectClass: organizationalUnit​

ou: Group​

​​

[root@node168 ~]# ldapadd -x -D cn=ldapadm,dc=xxx,dc=com -w "xxx@123" -f /root/ldap/basedomain.ldif​​

[root@node168 ~]# vi /root/ldap/users.ldif​

​

dn: uid=ldapuser1,ou=People,dc=xxx,dc=com​

uid: ldapuser1​

cn: 测试用户1​

objectClass: account​

objectClass: posixAccount​

objectClass: top​

objectClass: shadowAccount​

userPassword: 123456​

shadowLastChange: 17642​

shadowMin: 0​

shadowMax: 99999​

shadowWarning: 7​

loginShell: /bin/bash​

uidNumber: 1000​

gidNumber: 1000​

homeDirectory: /home/ldapuser1​

​

dn: uid=ldapuser2,ou=People,dc=xxx,dc=com​

uid: ldapuser2​

cn: 测试用户2​

objectClass: account​

objectClass: posixAccount​

objectClass: top​

objectClass: shadowAccount​

userPassword: 123456​

shadowLastChange: 17642​

shadowMin: 0​

shadowMax: 99999​

shadowWarning: 7​

loginShell: /bin/bash​

uidNumber: 1001​

gidNumber: 1001​

homeDirectory: /home/ldapuser2​

[root@incubator-t3-infra01 ~]# ldapadd -x -w "xxx@123" -D "cn=ldapadm,dc=xxx,dc=com" -f /root/ldap/users.ldif​​

[root@node168 ~]# vi /root/ldap/groups.ldif ​

​

dn: cn=ldapgroup1,ou=Group,dc= xxx,dc=com​

objectClass: posixGroup​

objectClass: top​

cn: ldapgroup1​

userPassword: 123456​

gidNumber: 1000​

​

dn: cn=ldapgroup2,ou=Group,dc=xxx,dc=com​

objectClass: posixGroup​

objectClass: top​

cn: ldapgroup2​

userPassword: 123456​

gidNumber: 1001​

​

[root@incubator-t3-infra01 ~]# ldapadd -x -w "xxx@123" -D "cn=ldapadm,dc=t3cx,dc=com" -f /root/ldap/groups.ldif ​

​

[root@node168 ~]# vi /root/ldap/add_user_to_groups.ldif​

​

dn: cn=ldapgroup1,ou=Group,dc=xxx,dc=com​

changetype: modify​

add: memberuid​

memberuid: ldapuser1​

​

dn: cn=ldapgroup2,ou=Group,dc= t3cx,dc=com​

changetype: modify​

add: memberuid​

memberuid: ldapuser2​

[root@incubator-t3-infra01 ~]# ldapadd -x -w "t3cx@123" -D "cn=ldapadm,dc=xxx,dc=com" -f /root/ldap/add_user_to_groups.ldif ​

[root@node168 ldap]# vi /root/ldap/loglevel.ldif​

​

dn: cn=config​

changetype: modify​

replace: olcLogLevel​

olcLogLevel: stats​

​

[root@node168~]#​tail -f /var/log/ldap.log​

​

authconfig \​

--enablesssd \​

--enablesssdauth \​

--enablelocauthorize \​

--enableldap \​

--enableldapauth \​

--ldapserver=ldap://incubator-xx-infra01:389 \​

--ldapbasedn=dc=xxx,dc=com \​

--enablemkhomedir \​

--enablecachecreds \​

--update​

[root@node168 pam.d]# vim /etc/pam.d/system-auth​

​

#%PAM-1.0​

# This file is auto-generated.​

# User changes will be destroyed the next time authconfig is run.​

auth required pam_env.so​

auth required pam_faildelay.so delay=2000000​

auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet​

auth [default=1 ignore=ignore success=ok] pam_localuser.so​

auth sufficient pam_unix.so nullok try_first_pass​

auth requisite pam_succeed_if.so uid >= 1000 quiet_success​

auth sufficient pam_ldap.so forward_pass​

auth required pam_deny.so​

​

account required pam_unix.so broken_shadow​

account sufficient pam_localuser.so​

account sufficient pam_succeed_if.so uid < 1000 quiet​

account [default=bad success=ok user_unknown=ignore] pam_ldap.so​

account required pam_permit.so​

​

password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=​

password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok​

password sufficient pam_ldap.so use_authtok​

password required pam_deny.so​

​

session optional pam_keyinit.so revoke​

session required pam_limits.so​

-session optional pam_systemd.so​

session optional pam_oddjob_mkhomedir.so umask=0077​

session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid​

session required pam_unix.so​

session optional pam_ldap.so​​

​​

​

​

启动命令​

​

[root@incubator-xx-infra01 ~]# systemctl restart messagebus​

[root@incubator-xx-infra01 ~]# systemctl restart oddjobd​

[root@incubator-xx-infra01 ~]# systemctl restart nslcd​

[root@incubator-xx-infra01 ~]# systemctl restart sssd​

[root@incubator-xx-infra01 ~]# systemctl restart systemd-logind​

[root@incubator-xx-infra01 ~]# systemctl enable messagebus​

[root@incubator-xx-infra01 ~]# systemctl enable oddjobd​

[root@incubator-xx-infra01 ~]# systemctl enable nslcd​

[root@incubator-xx-infra01 ~]# systemctl enable sssd​

[root@incubator-xx-infra01 ~]# systemctl enable systemd-logind​

​