openldap双主_使用OpenLDAP和NFS/automount的UnifiedLinux登录和主目录

openldap双主

In this post, how to unified Linux login and home directory using OpenLDAP and NFS/automount will be introduced.

在本文中&＃xff0c;将介绍如何使用OpenLDAP和NFS / automount统一Linux登录名和主目录。

0.系统环境 (0. System environment)

This solution is tested on Fedora 12 systems and CentOS 5.

该解决方案已在Fedora 12 系统和CentOS 5上进行了测试。

LDAP and NFS server:
IP: 10.0.0.2
OS: Fedora 12 x86_64
ldap base dn: “dc&＃61;lgcpu1″

LDAP和NFS服务器&＃xff1a;
IP&＃xff1a;10.0.0.2
作业系统&＃xff1a;Fedora 12 x86_64
ldap基本dn&＃xff1a;“ dc &＃61; lgcpu1”

Clients:
IP: 10.0.0.1/24
OS: Fedora 12 x86_64

客户&＃xff1a;
IP&＃xff1a;10.0.0.1/24
作业系统&＃xff1a;Fedora 12 x86_64

1. LDAP服务器 (1. LDAP server)

软件包安装&＃xff1a; (Package installation:)

# yum install openldap-servers
# /sbin/chkconfig ldap on
# /sbin/service ldap start

添加或编辑以下配置&＃xff1a; ( Add or edit these configurations:)

Edit /etc/openldap/slapd.conf. Add or edit:

编辑/etc/openldap/slapd.conf 。 添加或编辑&＃xff1a;

include /etc/openldap/schema/redhat/autofs.schema#########################################################
# ldbm and/or bdb database definitions
#########################################################database bdb
suffix "dc&＃61;lgcpu1"
checkpoint 1024 15
rootdn "cn&＃61;Manager,dc&＃61;lgcpu1"rootpw {crypt}x# Access Control
access to attrs&＃61;userPasswordby self writeby anonymous authby dn&＃61;"cn&＃61;manager,dc&＃61;lgcpu1" writeby * compare
access to *by self writeby dn&＃61;"cn&＃61;manager,dc&＃61;lgcpu1" writeby * read

How to get the rootpw:

如何获得rootpw&＃xff1a;

perl -e "print crypt(&＃39;passwd&＃39;, &＃39;salt_string&＃39;,);"

添加top.ldif (Add top.ldif)

top.ldif:

top.ldif&＃xff1a;

dn: dc&＃61;lgcpu1
objectclass: dcObject
objectclass: organization
o: lgcpu1 group
dc: lgcpu1dn: cn&＃61;manager,dc&＃61;lgcpu1
objectclass: organizationalRole
cn: managerdn: ou&＃61;people,dc&＃61;lgcpu1
ou: people
objectclass: organizationalUnit
objectclass: domainRelatedObject
associatedDomain: lgcpu1dn: ou&＃61;contacts,ou&＃61;people,dc&＃61;lgcpu1
ou: contacts
ou: people
objectclass: organizationalUnit
objectclass: domainRelatedObject
associatedDomain: lgcpu1dn: ou&＃61;group,dc&＃61;lgcpu1
ou: group
objectclass: organizationalUnit
objectclass: domainRelatedObject
associatedDomain: lgcpu1

Add top.ldif to ldap server:

将top.ldif添加到ldap服务器&＃xff1a;

$ ldapadd -x -D &＃39;cn&＃61;manager,dc&＃61;lgcpu1&＃39; -W -f top.ldif

Then search all the content in the ldap server by:

然后通过以下方式搜索ldap服务器中的所有内容&＃xff1a;

ldapsearch -x -D &＃39;cn&＃61;manager,dc&＃61;lgcpu1&＃39; -W

If the previous work is correctly processed. ldapsearch will print out all the content in ldap database.

如果先前的工作得到正确处理。 ldapsearch将打印出ldap数据库中的所有内容。

通过本地配置添加用户和组&＃xff1a; (Add users and groups from local configuration:)

Copy passwd shadow group from /etc/ to some tmp location
Edit them and only keep the normal users, that means no system users.

将passwd影子组从/ etc /复制到某个tmp位置
编辑它们&＃xff0c;只保留普通用户&＃xff0c;这意味着没有系统用户。

$ vim /usr/share/openldap/migration/migrate_common.ph

Edit these values:

编辑这些值&＃xff1a;

# Default DNS domain
$DEFAULT_MAIL_DOMAIN &＃61; "cse.ust.hk";# Default base
$DEFAULT_BASE &＃61; "dc&＃61;lgcpu1";

Then add the encryped password from shadow file to userPassword like this:

然后将加密文件中的加密密码从影子文件添加到userPassword中&＃xff0c;如下所示&＃xff1a;

$ /usr/share/openldap/migration/migrate_passwd.pl ./passwd > people.ldif

The password is in this format:

密码采用以下格式&＃xff1a;

userPassword: {crypt}$1$Zlkjsdf...

Then add people.ldif to ldap server

然后将people.ldif添加到ldap服务器

$ /usr/share/openldap/migration/migrate_group.ph ./group > group.ldif

Then add group.ldif to ldap server

然后将group.ldif添加到ldap服务器

添加auto.master.ldif (Add auto.master.ldif)

dn: ou&＃61;auto.master,dc&＃61;lgcpu1
objectClass: top
objectClass: automountMap
ou: auto.masterdn: cn&＃61;/home,ou&＃61;auto.master,dc&＃61;lgcpu1
objectClass: automount
automountInformation: ldap:ou&＃61;auto.home,dc&＃61;lgcpu1
cn: /homedn: cn&＃61;/share,ou&＃61;auto.master,dc&＃61;lgcpu1
objectClass: automount
automountInformation: ldap:ou&＃61;auto.misc, dc&＃61;lgcpu1
cn: /share

add auto.master.ldif

添加auto.master.ldif

添加auto.home.ldif (Add auto.home.ldif)

Add for every users

为每个用户添加

add auto.home.ldif

添加auto.home.ldif

auto.misc.ldif (auto.misc.ldif)

Add for some common share directories

添加一些常见的共享目录

dn: ou&＃61;auto.misc,dc&＃61;lgcpu1
objectClass: top
objectClass: automountMap
ou: auto.misc

add auto.misc.ldif

添加auto.misc.ldif

2. NFS服务器 (2. NFS server)

Please refer to How to Set Up and Configure NFS Server and Clients for how to set up a NFS server.

请参阅如何设置和配置NFS服务器和客户端以了解如何设置NFS服务器。

编辑/ etc / exports (Edit /etc/exports)

Allow the servers inside subnet 10.0.0.1/24 to mount the /home directory with read/write permission. Add this line to /etc/exports:

允许子网10.0.0.1/24内的服务器安装具有读/写权限的/ home目录。 将此行添加到/ etc / exports&＃xff1a;

/home 10.0.0.1/24(rw)

启动服务 (Start up service)

Enable nfs service on the NFS server so that the service automatically starts each time the server starts:

在NFS服务器上启用nfs服务&＃xff0c;以便该服务在每次服务器启动时自动启动&＃xff1a;

# /sbin/chkconfig nfs on

You may also manually start it

您也可以手动启动它

# service nfs start

3.客户端配置 (3. Client configuration)

3.1软件包安装 (3.1 Packages installation)

# yum install nss_ldap autofs nfs-utils
# chkconfig autofs on
# service rpcbind restart
# service autofs restart

3.2配置 (3.2 Configuration)

# authconfig-tui

Select like this:

像这样选择&＃xff1a;

| User Information Authentication │
│ [ ] Cache Information [*] Use MD5 Passwords │
│ [ ] Use Hesiod [*] Use Shadow Passwords │
│ [*] Use LDAP [*] Use LDAP Authentication │
│ [ ] Use NIS [ ] Use Kerberos │
│ [ ] Use Winbind [ ] Use Fingerprint reader │
│ [ ] Use Winbind Authentication │
│ [*] Local authorization is sufficient │

In next step:

下一步&＃xff1a;

│ [ ] Use TLS │
│ Server: ldap://10.0.0.2/________________________ │
│ Base DN: dc&＃61;lgcpu1_______________________________ │

3.3在以下位置删除旧的用户条目&＃xff1a; (3.3 Delete old user entries in:)

/etc/passwd
/etc/shadow
/etc/group
/etc/gshadow

/ etc / passwd
/ etc / shadow
/ etc / group
/ etc / gshadow

4.添加个人 (4. add individual person)

将people.sample.ldif添加到ldap (Add people.sample.ldif to ldap)

dn: uid&＃61;sample,ou&＃61;People,dc&＃61;lgcpu1
uid: sample
cn: sample
sn: sample
mail: sample&＃64;cse.ust.hk
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
userPassword: {crypt}$6$encryped password here
loginShell: /bin/bash
uidNumber: 507
gidNumber: 507
homeDirectory: /home/sample

将group.sample.ldif添加到ldap (Add group.sample.ldif to ldap)

dn: cn&＃61;sample,ou&＃61;Group,dc&＃61;lgcpu1
objectClass: posixGroup
objectClass: top
cn: sample
userPassword: {crypt}x
gidNumber: 507

将auto.home.sample.ldif添加到ldap (Addauto.home.sample.ldif to ldap)

dn: cn&＃61;sample,ou&＃61;auto.home,dc&＃61;lgcpu1
objectClass: automount
automountInformation: 10.0.0.2:/home/sample
cn: sample

删除以下位置的旧条目&＃xff1a; (Delete old entries in:)

/etc/passwd
/etc/shadow
/etc/group
/etc/gshadow

/ etc / passwd
/ etc / shadow
/ etc / group
/ etc / gshadow

在NFS服务器上创建主目录&＃xff1a; (Create home directory on NFS server:)

# mkdir /home/sample
# cp /etc/skel/.[a-z]* /home/sample/
# chown -R 507:507 /home/sample/

翻译自: https://www.systutorials.com/unified-linux-login-and-home-directory-using-openldap-and-nfsautomount/

openldap双主