特殊:Badtitle/NS100:OpenLDAPServer:修订间差异
小无编辑摘要 |
小无编辑摘要 |
||
第171行: | 第171行: | ||
Before implementing LDAP replication consider the following steps: | Before implementing LDAP replication consider the following steps: | ||
# Stop the master server's slapd daemon. | |||
2. Reconfigure the master server's slapd.conf to enable replication to the new slave server. | 2. Reconfigure the master server's slapd.conf to enable replication to the new slave server. | ||
3. Export the database of the master server. | 3. Export the database of the master server. |
2007年5月13日 (日) 16:14的版本
文章出处: |
{{#if: | {{{2}}} | https://help.ubuntu.com/community/OpenLDAPServer }} |
点击翻译: |
English {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/af | • {{#if: php5|Afrikaans| [[::OpenLDAPServer/af|Afrikaans]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/ar | • {{#if: php5|العربية| [[::OpenLDAPServer/ar|العربية]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/az | • {{#if: php5|azərbaycanca| [[::OpenLDAPServer/az|azərbaycanca]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/bcc | • {{#if: php5|جهلسری بلوچی| [[::OpenLDAPServer/bcc|جهلسری بلوچی]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/bg | • {{#if: php5|български| [[::OpenLDAPServer/bg|български]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/br | • {{#if: php5|brezhoneg| [[::OpenLDAPServer/br|brezhoneg]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/ca | • {{#if: php5|català| [[::OpenLDAPServer/ca|català]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/cs | • {{#if: php5|čeština| [[::OpenLDAPServer/cs|čeština]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/de | • {{#if: php5|Deutsch| [[::OpenLDAPServer/de|Deutsch]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/el | • {{#if: php5|Ελληνικά| [[::OpenLDAPServer/el|Ελληνικά]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/es | • {{#if: php5|español| [[::OpenLDAPServer/es|español]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/fa | • {{#if: php5|فارسی| [[::OpenLDAPServer/fa|فارسی]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/fi | • {{#if: php5|suomi| [[::OpenLDAPServer/fi|suomi]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/fr | • {{#if: php5|français| [[::OpenLDAPServer/fr|français]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/gu | • {{#if: php5|ગુજરાતી| [[::OpenLDAPServer/gu|ગુજરાતી]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/he | • {{#if: php5|עברית| [[::OpenLDAPServer/he|עברית]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/hu | • {{#if: php5|magyar| [[::OpenLDAPServer/hu|magyar]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/id | • {{#if: php5|Bahasa Indonesia| [[::OpenLDAPServer/id|Bahasa Indonesia]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/it | • {{#if: php5|italiano| [[::OpenLDAPServer/it|italiano]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/ja | • {{#if: php5|日本語| [[::OpenLDAPServer/ja|日本語]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/ko | • {{#if: php5|한국어| [[::OpenLDAPServer/ko|한국어]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/ksh | • {{#if: php5|Ripoarisch| [[::OpenLDAPServer/ksh|Ripoarisch]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/mr | • {{#if: php5|मराठी| [[::OpenLDAPServer/mr|मराठी]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/ms | • {{#if: php5|Bahasa Melayu| [[::OpenLDAPServer/ms|Bahasa Melayu]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/nl | • {{#if: php5|Nederlands| [[::OpenLDAPServer/nl|Nederlands]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/no | • {{#if: php5|norsk| [[::OpenLDAPServer/no|norsk]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/oc | • {{#if: php5|occitan| [[::OpenLDAPServer/oc|occitan]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/pl | • {{#if: php5|polski| [[::OpenLDAPServer/pl|polski]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/pt | • {{#if: php5|português| [[::OpenLDAPServer/pt|português]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/ro | • {{#if: php5|română| [[::OpenLDAPServer/ro|română]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/ru | • {{#if: php5|русский| [[::OpenLDAPServer/ru|русский]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/si | • {{#if: php5|සිංහල| [[::OpenLDAPServer/si|සිංහල]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/sq | • {{#if: php5|shqip| [[::OpenLDAPServer/sq|shqip]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/sr | • {{#if: php5|српски / srpski| [[::OpenLDAPServer/sr|српски / srpski]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/sv | • {{#if: php5|svenska| [[::OpenLDAPServer/sv|svenska]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/th | • {{#if: php5|ไทย| [[::OpenLDAPServer/th|ไทย]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/tr | • {{#if: php5|Türkçe| [[::OpenLDAPServer/tr|Türkçe]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/vi | • {{#if: php5|Tiếng Việt| [[::OpenLDAPServer/vi|Tiếng Việt]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/yue | • {{#if: php5|粵語| [[::OpenLDAPServer/yue|粵語]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/zh | • {{#if: php5|中文| [[::OpenLDAPServer/zh|中文]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/zh-hans | • {{#if: php5|中文(简体)| [[::OpenLDAPServer/zh-hans|中文(简体)]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}OpenLDAPServer}}/zh-hant | • {{#if: php5|中文(繁體)| [[::OpenLDAPServer/zh-hant|中文(繁體)]]}}|}} |
{{#ifeq:php5|:OpenLDAPServer|请不要直接编辑翻译本页,本页将定期与来源同步。}} |
{{#ifexist: :OpenLDAPServer/zh | | {{#ifexist: OpenLDAPServer/zh | | {{#ifeq: {{#titleparts:OpenLDAPServer|1|-1|}} | zh | | }} }} }} {{#ifeq: {{#titleparts:OpenLDAPServer|1|-1|}} | zh | | }}
Introduction
LDAP means Lightweight Directory Access Protocol, it is a simplified version of X500 protocol. You will find a more detailed presentation on Wikipedia.
To describe quickly, all informations are stored in a tree. You have to determine by yourself the directory arborescence (the Directory Information Tree: the DIT). We will begin with a basic tree with two nodes above the root :
- "People" node where your users will be stored
- "Groups" node where your groups will be stored
You have to first determine what the root of your LDAP will be. By default, your tree will be determined by your internet domain. If your domain is example.com (we will use it in the above example), your root will be dc=example,dc=com
.
Installation
First of all, install the ldap server daemon (slapd) on the server ; install the following packages: slapd
and ldap-utils
(see InstallingSoftware).
Enter your domain as asked and the password that you want for the directory administrator.
Only few changes will be operated on the default configuration. First set the root password in the configuration file (instead of in the directory) by editing the file /etc/ldap/slapd.conf
.
Don't use a cleartext password however. To generate an encrypted password first use slappasswd
:
$ slappasswd New password: Re-enter password: {SSHA}d2BamRTgBuhC6SxC0vFGWol31ki8iq5m
This example shows what happens when using the string "secret" as the password. (By nature of the SSHA encryption scheme, your result will vary.)
Now edit /etc/ldap/slapd.conf
and copy paste the generated string.
# Make sure you edit or add these directives after the first 'database' directive. suffix "dc=example,dc=com" directory "/var/lib/ldap" rootdn "cn=admin,dc=example,dc=com" rootpw {SSHA}d2BamRTgBuhC6SxC0vFGWol31ki8iq5m
Populating LDAP
The directory has been created at the installation, now it is time to populate. It will be populated with a "classical" entry that will be compatible with directory (for example for a shared directory), with classical accounts (for a web application) and with Unix accounts (posix).
LDAP directory can be fed with a ldif file (ldif means ldap directory interchange format). Generate this example text file init.ldif
somewhere on your system:
dn: dc=example,dc=com objectClass: dcObject objectClass: organizationalUnit dc: example ou: Example Dot Com dn: cn=admin,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator dn: ou=people,dc=example,dc=com objectClass: organizationalUnit ou: people dn: ou=groups,dc=example,dc=com objectClass: organizationalUnit ou: groups dn: uid=lionel,ou=people,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: lionel sn: Porcheron givenName: Lionel cn: Lionel Porcheron displayName: Lionel Porcheron uidNumber: 1000 gidNumber: 10000 userPassword: <password> gecos: Lionel Porcheron loginShell: /bin/bash homeDirectory: /home/lionel shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 8 shadowMax: 999999 shadowLastChange: 10877 mail: [email protected] postalCode: 31000 l: Toulouse o: Example mobile: +33 (0)6 xx xx xx xx homePhone: +33 (0)5 xx xx xx xx title: System Administrator postalAddress: initials: LP dn: cn=example,ou=groups,dc=example,dc=com objectClass: posixGroup cn: example gidNumber: 10000
In the example above, the directory structure, a user and group have been setup. In other example you might see the objectClass: top added in every entry, but that is default behavior so you don't have to add it explicitly.
To generate a password you can use slappasswd
using the MD5 or CRYPT hashing scheme (see Installation above and man slappasswd
).
Now, add your entries to the LDAP:
- stop LDAP daemon:
sudo /etc/init.d/slapd stop
- delete the content that was automatically added at installation:
sudo rm -rf /var/lib/ldap/*
- add the content
sudo slapadd -l init.ldif
- start LDAP daemon:
sudo /etc/init.d/slapd start
- stop LDAP daemon:
An alternative method to add the entries when you just installed the packages:
- reconfigure your LDAP installation when needed:
sudo dpkg-reconfigure slapd
- start LDAP daemon when not running:
sudo /etc/init.d/slapd start
- load the initial data:
sudo ldapadd -x -W -c -D "cn=admin,dc=kemuri,dc=net" -f init.ldif
- reconfigure your LDAP installation when needed:
We can check that the content has been correctly added with the tools from the ldap-utils package. In order to execute a search in the LDAP directory :
$ ldapsearch -xLLL -b "dc=example,dc=com" uid=lionel sn givenName cn dn: uid=lionel,ou=people,dc=example,dc=com cn: Lionel Porcheron sn: Porcheron givenName: Lionel
Just a quick explanation :
-x
is because we do not use SASL authentication method (by default)-LLL
disable printing LDIF informations
Put your LDAP server to use
Now that it is up and running you can:
- authenticate your users on the directory as explained in UbuntuHelp:LDAPClientAuthentication
- authenticate your users in a web application.
- use it as a shared address directory for your mail agent.
Use of LDAP are infinite !
ACL setup
Authentication requires access to password field, that should be not accessible by default. Another issue is that during password change using passwd shadowLastChange needs to be accessible as well. Following code shows example ACL setting that permits access to shadowLastChange:
access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=example,dc=com" write by anonymous auth by self write by * none
Usually the installation of the OpenLDAP packages will create correct ACL settings in the slapd.conf configuration file.
LDAP replication
LDAP service often quickly becomes a highly critical service in an information system: all is depending of LDAP: authentication, authorization, mail system, etc. It can be a good idea to setup a redundant system. It is easy to setup, here is a quick HOWTO.
Introduction
With OpenLDAP 2.2 (on Breezy and Dapper), replication is based on a master-slave relation.
Before implementing LDAP replication consider the following steps:
- Stop the master server's slapd daemon.
2. Reconfigure the master server's slapd.conf to enable replication to the new slave server. 3. Export the database of the master server. 4. Configure the replica server's slapd.conf. 5. Import the database of the master server to the slaver server. 6. Re/Start the replica server's slapd process 7. Re/Start the master server's slapd process.
attachment:IconsPage/IconWarning3.png You will have to remember that modifications should ALWAYS be done on the master ! If you modifies the slave, modifications will get lost.
LDAP master
On the master, you have to modify the database section of the /etc/ldap/slapd.conf
to add a replica
instruction. The following example shows a replica on ldap-2.example.com
with the Manager user with secret
as password. The replication logfile is the place modifications are stored before they are send to the LDAP slave.
replica uri=ldap://ldap-2.example.com:389 binddn="cn=Manager,dc=example,dc=com" bindmethod=simple credentials=secret replogfile /var/lib/ldap/replog
Export the database of the master using slapcat. Then copy master.ldif to the slave using scp or other tools.
user@master:~$ sudo slapcat -l master.ldif
LDAP slave
On the slave, you have to authorize your master to update LDAP database. Add the following lines to your /etc/ldap/slapd.conf
file in the database section:
updatedn cn=Manager,dc=example,dc=com updateref ldap://ldap-1.example.com
Import the master.ldif using slapadd.
user@slave:~$ sudo slapadd -c -l master.ldif
Restart the master server.
user@master:~$ sudo /etc/init.d/slapd start
Restart the slave server.
user@slave:~$ sudo /etc/init.d/slapd start
Links
- OpenLDAP website give you lot of informations
- LDAP HOWTO
- [1] Simple GUI to LDAP administration, available in repositories.
CategoryDocumentation