File Server - Ubuntu, Openldap, sssd, Samba_not available for installation: sssd-tools sssd li-优快云博客

本文链接：https://blog.youkuaiyun.com/melancholy123/article/details/122611167

本文介绍了如何在Ubuntu 18.04上配置Openldap，包括安装、配置文件、数据库管理和认证类型。进一步讨论了SASL绑定、SSL/TLS设置以及证书握手过程。此外，还详细讲述了SSSD如何作为身份解决方案，并集成Samba，以实现与Ldap后端的Samba服务器安装和配置。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Ubuntu

Ubuntu Version: Ubuntu 18.04

Openldap

Ldap database consist of DIT, that is Directory information tree.
The file type we used to record the ldap information is .ldif, that’s LDAP data interchange format.

Installation & configuraion file

apt install slapd ldap-utils
dpkg-configure slapd
service slapd status/start/stop/restart

/etc/ldap/ldap.conf

#BASE dc=blabla,dc=com
#URI  ldap://ldap.blabla.com ldap://ldap.blabla.com:666
TLS_CACERT /etc/ssl/certs/mycacert.pem

Database

cn=config
ldap system-level database: /etc/ldap/slapd.conf/, the suffix is “cn=config” for the ldap configuration.

Only can be listed by SASL EXTERNAL.

root@bruce:/etc/ldap/slapd.d# tree
.
├── cn=config
│   ├── cn=module{0}.ldif
│   ├── cn=schema
│   │   ├── cn={0}core.ldif
│   │   ├── cn={1}cosine.ldif
│   │   ├── cn={2}nis.ldif
│   │   ├── cn={3}inetorgperson.ldif
│   │   └── cn={4}samba.ldif
│   ├── cn=schema.ldif
│   ├── olcBackend={0}mdb.ldif
│   ├── olcDatabase={0}config.ldif
│   ├── olcDatabase={-1}frontend.ldif
│   └── olcDatabase={1}mdb.ldif
└── cn=config.ldif

2 directories, 12 files

root@bruce:~# ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b "cn=config" dn
dn: cn=config   \\global setting

dn: cn=module{0},cn=config   \\module  

dn: cn=schema,cn=config   \\schema, olcAttributeTypes -> olcObjectClasses

dn: cn={0}core,cn=schema,cn=config

dn: cn={1}cosine,cn=schema,cn=config

dn: cn={2}nis,cn=schema,cn=config

dn: cn={3}inetorgperson,cn=schema,cn=config

dn: cn={4}samba,cn=schema,cn=config

dn: olcBackend={0}mdb,cn=config   \\database

dn: olcDatabase={-1}frontend,cn=config

dn: olcDatabase={0}config,cn=config

dn: olcDatabase={1}mdb,cn=config

dc=example,dc=com
ldap user-level database: /var/lib/ldap/, the suffix is “dc=blabla,dc=com”.

root@bruce:/var/lib/ldap# tree
.
├── data.mdb
└── lock.mdb

0 directories, 2 files

Authentication Type

Anonymous bind: “-x” without “-D”
Simple bind: “-X -D ‘’ -w passwd/-W”
SASL bind: "-Y EXTERNAL -H ldapi:///"

root@bruce:/var/lib/ldap# ldapwhoami -x 
anonymous
root@bruce:/var/lib/ldap# ldapwhoami -x -D "cn=admin,dc=blabla,dc=com" -w ldap
dn:cn=admin,dc=blabla,dc=com
root@bruce:/var/lib/ldap# ldapwhoami -Q -Y EXTERNAL -H ldapi:///
dn:gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

Bind User

SASL EXTERNAL wia the ldapi:/// transport

when use SASL EXTERNAL through ldapi:/// transport via /run/slapd/ldapi socket, the binddn becomes a combination of the uid & gid of the conencting local user, followed by the suffix cn=peercred,cn=external,cn=auth, like gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth for root, the ldap server could configue the local user permission