Linux下基于LDAP集中系统用户认证系统

自己跟几个朋友弄了个 http://www.net07.com以后文档都更新在上面.

Linux下基于LDAP统一用户认证系统完整版~

可能其中还有些错误.欢迎指出~

http://www.net07.com/ldap-system-user-authentication-on-linux.html

方便网友.把文章也贴到优快云上:

环境:

ldap node1:192.168.100.151
ldap node2:192.168.100.152
client ip:192.168.100.153

===========================服务端===========================
1、安装
安装DB

[root@localhost openldap]# yum install -y libtool-ltdl-devel.x86_64  libtool-ltdl.x86_64
[root@localhost tarbag]#tar -xzvf db-4.8.26.tar.gz -C ../software/
[root@localhost tarbag]# cd ../software/db-4.8.26/build_unix/
[root@localhost build_unix]# ../dist/configure
[root@localhost build_unix]#make install
[root@localhost build_unix]#echo "/usr/local/BerkeleyDB.4.8/lib/" >> /etc/ld.so.conf
[root@localhost build_unix]#ldconfig -vv

安装openldap

[root@localhost tarbag]#tar zxvf openldap-2.4.21.tgz -C ../software/
[root@localhost tarbag]# cd ../software/openldap-2.4.21/
[root@localhost openldap-2.4.21]# ./configure --prefix=/usr/local/openldap-2.4.21 --enable-syslog --enable-modules --with-tls  CPPFLAGS=-I/usr/local/BerkeleyDB.4.8/include/ LDFLAGS=-L/usr/local/BerkeleyDB.4.8/lib/
[root@localhost openldap-2.4.21]#make depend
[root@localhost openldap-2.4.21]#make
[root@localhost openldap-2.4.21]#make test  这个需要比较长的时间.如果觉得没必要执行这一步的可以跳过.直接make install
[root@localhost openldap-2.4.21]#make install
[root@localhost openldap-2.4.21]# cd /usr/local/openldap-2.4.21/
[root@localhost openldap-2.4.21]# ls
bin  etc  include  lib  libexec  sbin  share  var

2、openldap配置
下载openssh-lpk_openldap.schema

[root@localhost ~]# cd /usr/local/openldap-2.4.21/etc/openldap/schema
[root@localhost schema]#wget http://openssh-lpk.googlecode.com/files/openssh-lpk_openldap.schema
[root@localhost schema]#cp openssh-lpk_openldap.schema openssh-lpk.schema

生成密码:

[root@localhost ~]# cd /usr/local/openldap-2.4.21/sbin/
[root@localhost sbin]# ./slappasswd
New password:
Re-enter new password:
{SSHA}o/pZaQlZohhssEC7UAWnqWZ3GaHwxeUZ    //密码是123456 这个密码写到slapd.conf里面的rootpw位置

配置slapd.conf

[root@localhost openldap]# cat /usr/local/openldap-2.4.21/etc/openldap/slapd.conf
include         /usr/local/openldap-2.4.21/etc/openldap/schema/core.schema
include         /usr/local/openldap-2.4.21/etc/openldap/schema/cosine.schema
include         /usr/local/openldap-2.4.21/etc/openldap/schema/inetorgperson.schema
include         /usr/local/openldap-2.4.21/etc/openldap/schema/nis.schema
include         /usr/local/openldap-2.4.21/etc/openldap/schema/openssh-lpk.schema
loglevel        256
pidfile         /usr/local/openldap-2.4.21/var/run/slapd.pid
argsfile        /usr/local/openldap-2.4.21/var/run/slapd.args


#######################################################################
# database definition
#######################################################################


database        bdb
suffix          "dc=hsf,dc=com"


rootdn          "cn=Manager,dc=hsf,dc=com"
rootpw          {SSHA}o/pZaQlZohhssEC7UAWnqWZ3GaHwxeUZ
directory       /opt/openldap_data/


# Indices to maintain for this database
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
index sudoUser                          eq


[root@localhost openldap]#cd /usr/local/openldap-2.4.21/etc/openldap
拷贝DB_CONFIG到Ldap数据目录.
[root@localhost openldap]# cp DB_CONFIG.example  /opt/openldap_data/

修改syslog.conf 

[root@localhost www]# vi /etc/syslog.conf
#Save ldap messages to ldap.log
local4.*                                                /var/log/ldap.log

重启syslog

[root@localhost openldap]# service syslog restart
Shutting down kernel logger: [  OK  ]
Shutting down system logger: [  OK  ]
Starting system logger: [  OK  ]
Starting kernel logger: [  OK  ]

启动ldap

启动方法1：
# /usr/local/openldap-2.4.21/libexec/slapd # 直接进入后台工作
启动方法2：
# /usr/local/openldap-2.4.21/libexec/slapd -d 256 # 依旧在前端,有debug信息

[root@localhost run]# /usr/local/openldap-2.4.21/libexec/slapd
[root@localhost run]# netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp        0      0 0.0.0.0:389                 0.0.0.0:*                   LISTEN      22917/slapd
tcp        0      0 :::389                      :::*                        LISTEN      22917/slapd
tcp        0      0 :::22                       :::*                        LISTEN      1987/sshd

3、生成公私密钥对（任何一台机器都行）

# ssh-keygen -t rsa
.....不断回车
# cd /root/.ssh/
# sz id_rsa.pub 公钥（导入ldap的sshPublicKey字段）
# sz id_rsa 私钥（放在crt,putty,linux的/root/.ssh/下）

4、导入ldap数据
根：

[root@localhost ~]# cat passwd.ldif
#version: 1
dn: dc=hsf,dc=com
objectClass: top
objectCla