@Linux搭建LDAP认证服务

#安装OPenLDAP安装包
shell> yum -y install openldap-servers openldap-clients 


#生成密钥（记住输出结果，后续会将加密后的结果设置为初始用户的密码）
shell> slappasswd -s zeny
{SSHA}jdymV5MGrZt8iI4Wdn0dAqty+LPY0Lq9



#修改ldap目录所属用户组
shell> chown ldap:ldap /var/lib/ldap/*


#启动ldap服务
shell> systemctl restart slapd


#端口确认
shell> netstat -antup | grep -i 389
tcp        0      0 0.0.0.0:389             0.0.0.0:*               LISTEN      1149/slapd          
tcp6       0      0 :::389                  :::*                    LISTEN      1149/slapd 




#导入基础模块（出现adding new entry字样表示导入成功）
shell> ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif 
shell> ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
shell> ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif



#配置域信息（创建changes.ldif文件自定义域，将要替换的部分更改为自己的数据）
vim /etc/openldap/schema/changes.ldif
# 修改域名
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
# 注意修改
olcSuffix: dc=zeny,dc=com

# 修改管理员用户
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
# 注意修改
olcRootDN: cn=admin,dc=zeny,dc=com

# 修改管理员密码
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootPW
# 替换为 slappasswd 生成后的结果
olcRootPW: {SSHA}jdymV5MGrZt8iI4Wdn0dAqty+LPY0Lq9

# 修改访问权限
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=admin,dc=zeny,dc=com" read by * none
#修改dn.base
#dn.base="cn=admin,dc=zeny,dc=com" read by * none



#导入ldap配置（输出内容如下为导入成功）
shell> ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/changes.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={2}hdb,cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

modifying entry "olcDatabase={1}monitor,cn=config"


#创建域和组织（创建文件basedomain.ldif）
shell> cat /etc/openldap/schema/basedomain.ldif
dn: dc=zeny,dc=com
dc: zeny
objectClass: top
objectClass: domain

dn: ou=People,dc=zeny,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit

dn: ou=Group,dc=zeny,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit



#导入域和组织配置（密码输入初始用户密码：zeny）
shell> ldapadd -x -D cn=admin,dc=zeny,dc=com -W -f /etc/openldap/schema/basedomain.ldif 
Enter LDAP Password: 
adding new entry "dc=zeny,dc=com"

adding new entry "ou=People,dc=zeny,dc=com"

adding new entry "ou=Group,dc=zeny,dc=com"



#查看用户列表
shell> ldapsearch -x -b "ou=People,dc=zeny,dc=com" | grep dn
dn: ou=People,dc=zeny,dc=com


#测试配置
shell> slaptest -u 
config file testing succeeded

#防火墙配置（ldapserver的默认端口为389，开通防火墙端口，否则可能登录会出错，或者直接关闭防火墙也可以
shell> firewall-cmd --zone=public --add-port=389/tcp --permanent
shell> firewall-cmd --permanent --add-service=ldap
shell> firewall-cmd --reload

#关闭SELinux
shell> setenforce 0
shell> sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config


#安装epel源
shell> wget http://mirror.centos.org/centos/7/extras/x86_64/Packages/epel-release-7-11.noarch.rpm
shell> rpm -ivh epel-release-7-11.noarch.rpm


#安装phpldapadmin和依赖包
shell> yum -y install httpd php php-ldap php-gd php-mbstring php-pear php-bcmath php-xml
shell> yum -y install phpldapadmin
-----------------------------------------------------------------------------------------------
#下载不下来，可以手动安装phpldapadmin（正常可忽略此步）
shell> wget https://nchc.dl.sourceforge.net/project/phpldapadmin/phpldapadmin-php5/1.2.3/phpldapadmin-1.2.3.tgz
shell> tar -xvzf phpldapadmin-1.2.3.tgz -C /var/www/
shell> cd /var/www/html/
shell> mv phpldapadmin-1.2.3 phpldapadmin
--------------------------------------------------------------------------------------------



#phpldapadmin文件部署到apache
shell> ln -s /usr/share/phpldapadmin /var/www


#配置修改（/etc/phpldapadmin/config.php)
vim /etc/phpldapadmin/config.php    #注意行首不要有空格：
$servers->newServer('ldap_pla');
$servers->setValue('server','name','zeny-Ldap');
$servers->setValue('server','host','192.168.1.10');
$servers->setValue('server','port',389); 
$servers->setValue('server','base',array('dc=zeny,dc=com'));
$servers->setValue('login','auth_type','session');
$servers->setValue('login','attr','dn');
// $servers->setValue('login','attr','uid');    //注释这里 因为修改的是php用"//"注释代码

#配置修改（/etc/httpd/conf.d/phpldapadmin.conf）
vim /etc/httpd/conf.d/phpldapadmin.conf
<Directory /usr/share/phpldapadmin/htdocs>
  <IfModule mod_authz_core.c>
    # Apache 2.4
     Require local
     #Require 172.18.238.34 
     Require all granted
  </IfModule>
  <IfModule !mod_authz_core.c>
    #Apache 2.2
     Order Deny,Allow
     Allow from all
    #Deny from all
    #Allow from 127.0.0.1
    #Allow from ::1
  </IfModule>
</Directory>



#服务启动
shell> systemctl restart httpd


#web访问phpldapadmin
http://192.168.1.10/phpldapadmin/index.php

#容器安装
docker run -d --privileged -p 10101:80 --name myphpldapadmin \
--env PHPLDAPADMIN_HTTPS=false --env PHPLDAPADMIN_LDAP_HOSTS=192.168.1.10  \
--detach osixia/phpldapadmin