系统环境：CentOS 7

slapd版本：2.4.44

简介

OpenLDAP是一款轻量级目录访问协议，基于X.500标准的，支持TCP/IP协议，用于实现账号集中管理的开源软件，提供一整套安全的账号统一管理机制,属于C/S架构。

OpenLDAP默认以Berkeley DB作为后端数据库，Berkeley DB数据库是一类特殊的数据库，主要以散列的数据类型进行数据存储，主要用于搜索、浏览、更新查询操作，对于一次写入数据、多次查询和搜索有很好的效果。

整体目标

后端服务器数量日益增加，账号的数量也在不断增加，账号的统一管理变得尤为重要。结合堡垒机，主要针对服务器账号体系接入LDAP管理做如下主要工作：

ldap server主从的搭建，ldap主从考虑用同步复制（syncrepl）实现，大致为slave到master以拉的模式同步目录树，master负责读写，slave只读。另外主从都需接入负载均衡提供读服务；

服务器账号接入ldap，客户端可以ssh远程连接服务器用户名和密码登录；

ldap管理客户端的公钥，使客户端可以ssh服务器免密码登录；

ldap管理服务器用户的sudo权限

OpenLDAP 目录架构

分为两种：互联网命名组织架构、企业级命名组织架构

企业级命名组织架构

ou=People,dc=xxyd,dc=com

openldap相关缩写:

LDAP相关的缩写如下：

dn - distinguished name（区别名，主键）

o - organization（组织-公司）

ou - organization unit（组织单元-部门）

c - countryName（国家）

dc - domainComponent（域名）

sn - sure name（真实名称）

cn - common name（常用名称）

openldap组件:

OpenLDAP各组件的功能简介：

slapd：主LDAP服务器

slurpd：负责与复制LDAP服务器保持同步的服务器

对网络上的目录进行操作的客户机程序。下面这两个程序是一对儿：

ldapadd：打开一个到LDAP服务器的连接，绑定、修改或增加条目

ldapsearch：打开一个到LDAP服务器的连接，绑定并使用指定的参数进行搜索

对本地系统上的数据库进行操作的几个程序：

slapadd：将以LDAP目录交换格式（LDIF）指定的条目添加到LDAP数据库中

slapcat：打开LDAP数据库，并将对应的条目输出为LDIF格式.

安装服务端

1yum -y install openldap openldap-servers openldap-clients openldap-devel compat-openldap
2
3cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
4
5chown -R ldap.ldap /etc/openldap/
6
7chown -R ldap.ldap /var/lib/ldap/
8
9systemctl start slapd
10
11vi /etc/openldap/ldap.conf
12BASE	dc=xxyd,dc=com
13URI	ldap://ldap.xxyd.com
14
15
16slappasswd
17
18cat /etc/openldap/slapd.conf 
19include		/etc/openldap/schema/corba.schema
20include		/etc/openldap/schema/core.schema
21include		/etc/openldap/schema/cosine.schema
22include		/etc/openldap/schema/duaconf.schema
23include		/etc/openldap/schema/dyngroup.schema
24include		/etc/openldap/schema/inetorgperson.schema
25include		/etc/openldap/schema/java.schema
26include		/etc/openldap/schema/misc.schema
27include		/etc/openldap/schema/nis.schema
28include		/etc/openldap/schema/openldap.schema
29include		/etc/openldap/schema/ppolicy.schema
30include		/etc/openldap/schema/collective.schema
31allow bind_v2
32pidfile		/var/run/openldap/slapd.pid
33argsfile	/var/run/openldap/slapd.args
34modulepath /usr/lib64/openldap
35moduleload ppolicy.la
36TLSCACertificatePath /etc/openldap/certs 
37TLSCertificateFile "\"OpenLDAP Server\""
38TLSCertificateKeyFile /etc/openldap/certs/password
39access to attrs=shadowLastChange,userPassword
40      by self write
41      by * auth
42access to *
43      by * read
44database config
45access to *
46	by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
47	by * none
48database monitor
49access to *
50	by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
51        by dn.exact="cn=admin,dc=xxyd,dc=com" read
52        by * none
53database	hdb
54suffix		"dc=xxyd,dc=com"
55checkpoint	1024 15
56rootdn		"cn=admin,dc=xxyd,dc=com"
57rootpw			{SSHA}M7S4/DHYIOGx7PsQJFU6kyh00YRCyjhn
58directory	/var/lib/ldap
59index objectClass                       eq,pres
60index ou,cn,mail,surname,givenname      eq,pres,sub
61index uidNumber,gidNumber,loginShell    eq,pres
62index uid,memberUid                     eq,pres,sub
63index nisMapName,nisMapEntry            eq,pres,sub
64loglevel        4095 
65
66rm -rf /etc/openldap/slapd.d/*
67
68slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/
69
70chown -R ldap.ldap /etc/openldap/slapd.d
71chown -R ldap.ldap /var/lib/ldap/
72systemctl restart slapd
73systemctl status slapd
74
75# 开机启动
76systemctl enable slapd
77
78
79
80TLSCACertificatePath /etc/openldap/certs 
81TLSCertificateFile "\"OpenLDAP Server\""
82TLSCertificateKeyFile /etc/openldap/certs/password 这三句如果出现启动不了可以干掉

安装客户端

Ubuntu client

1apt-get install libpam-ldap nscd
2
3##### The following extra packages will be installed:
4##### auth-client-config ldap-auth-client ldap-auth-config libnss-ldap
5
6安装后仍然要填写一些信息
7
8LDAP server Uniform Resource Identifier
9
10因为我用的同一台机器，所以我填的是 ldap://127.0.0.1:389，端口号选填
11特别注意把它默认的ldapi:///换成ldap://
12Distinguished name of the search base
13
14就是你目录树的根，比如我的是 dc=chenjr,dc=cc
15LDAP version to use: 3
16Make local root Database admin: Yes
17Does the LDAP database require login? No
18LDAP account for root:
19
20这个是装LDAP服务器时的创建的那个admin账号
21我这里是 cn=admin,dc=xxyd,dc=com
22LDAP root account password
23
24# If you make a mistake and need to change a value, you can go through the menu again by issuing this command:
25
26sudo dpkg-reconfigure ldap-auth-config
27
28还需要编辑一些文件，首先是/etc/nsswitch.conf，它使得我们在linux下改变用户密码等属性的时候会反映到LDAP中。在以下三行中的compat前面都加上ldap。
29
30passwd: ldap compat
31group:  ldap compat
32shadow: ldap compat
33
34以上方式，ldap server不可用时，系统将不能登录，需改成：
35passwd:		files [UNAVAIL=return] ldap
36group:      files [UNAVAIL=return] ldap
37shadow:     files [UNAVAIL=return] ldap
38
39这样，ldap client本地用户不需要ldapserver验证，即使ldap server宕机也不影响本地用户登录系统。
40
41然后需要更改PAM的配置，编辑/etc/pam.d/common-session，在末尾加上一行，这使得用户第一次登录的时候创建主目录
42
43session required    pam_mkhomedir.so skel=/etc/skel umask=0022
44然后，编辑/etc/pam.d/common-password，将以下这行中的use_authtok删掉，这是避免使用passwd命令时报错而无法更改密码
45
46password    [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass
47然后重启nscd服务
48
49sudo /etc/init.d/nscd restart
50
51

CentOS client

1yum -y install nss-pam-ldapd
2
3vim /etc/nslcd.conf
4uri ldap://ldap.xxyd.com
5base dc=xxyd,dc=com
6ssl no
7tls_cacertdir /etc/openldap/cacerts
8
9vim /etc/pam_ldap.conf
10base dc=xxyd,dc=com
11uri ldap://ldap.xxyd.com
12ssl no
13tls_cacertdir /etc/openldap/cacerts
14pam_password md5
15
16vi /etc/pam.d/system-auth
17auth        sufficient    pam_ldap.so try_first_pass
18account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
19password    sufficient    pam_ldap.so use_authtok
20session     optional      pam_ldap.so
21
22vi /etc/nsswitch.conf
23passwd:     files       ldap
24shadow:     files       ldap
25group:      files       ldap
26
27vi /etc/sysconfig/authconfig
28USELDAPAUTH=yes
29USELDAP=yes
30
31systemctl restart  nslcd
32
33切换用户:/bash-4.2$
34需：
35vi /etc/pam.d/system-auth  添加
36session     required      pam_mkhomedir.so skel=/etc/skel/ umask=0022
37

OpenLDAP用户以及用户组的添加

两种方式：

一、通过migrationtools工具导入

二、自定义LDIF文件导入

通过migrationtools工具导入

migrationtools开源工具通过查找/etc/passwd、/etc/shadow、/etc/groups生成LDIF文件，并通过ldapadd命令更新数据库数据，完成用户添加。

此方式方便导入系统目前已存在的用户以及用户组

1# 安装migrationtools工具
2yum -y install migrationtools
3
4vi /usr/share/migrationtools/migrate_common.ph
5$DEFAULT_MAIL_DOMAIN = "xxyd.com";
6$DEFAULT_BASE = "dc=xxyd,dc=com";
7$EXTENDED_SCHEMA = 1;
8
9
10# 通过migrationtools工具生成LDIF模板文件并生成系统用户及组LDIF
11cd ~
12/usr/share/migrationtools/migrate_base.pl > base.ldif
13/usr/share/migrationtools/migrate_passwd.pl  /etc/passwd > passwd.ldif
14/usr/share/migrationtools/migrate_group.pl  /etc/group > group.ldif
15
16### sed -i 's/padl/xxyd/g' *.ldif
17

删除不必要的base.ldif信息（此处我只保留ou=Group、ou=Peopl相关项）

删除不需要的用户信息（group.ldif、passwd.ldif）

导入至OpenLDAP目录树中

1ldapadd -x -D "cn=admin,dc=xxyd,dc=com" -W -f ~/base.ldif
2ldapadd -x -D "cn=admin,dc=xxyd,dc=com" -W -f ~/passwd.ldif
3ldapadd -x -D "cn=admin,dc=xxyd,dc=com" -W -f ~/group.ldif
4

自定义LDIF导入

自定义用户属性信息导入OpenLDAP。

OpenLDAP加密传输

默认情况下，OpenLDAP服务端与客户端之间使用明文进行验证、查询等一系列操作，由于在互联网上进行传输存在不安全因素，需要提供OpenLDAP服务端证书以及修改配置文件来支持加密传输

强烈建议在制作证书过程使用泛域名，这样满足多IDC机房的时候使用同一个证书进行部署。比如：证书匹配 *.domain.com，每个IDC使用各自的域名

idc1.domain.com

idc2.domain.com

idc3.domain.com

部署过程只需要一个证书即可满足所有IDC的需求，方便快捷。

客户端还可以配两个服务端地址，第一个服务端不可用自动连接第二个服务端。

自建CA

1# 安装OpenSSL软件
2yum -y install openssl-devel
3
4# CA中心生成自身私钥
5# 为保证CA机构私钥的安全，需要把私钥文件权限设置为600
6cd /etc/pki/CA
7 (umask 077;openssl genrsa -out private/cakey.pem 2048)
8 
9 # CA签发自身公钥
10 openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650
11You are about to be asked to enter information that will be incorporated
12into your certificate request.
13What you are about to enter is what is called a Distinguished Name or a DN.
14There are quite a few fields but you can leave some blank
15For some fields there will be a default value,
16If you enter '.', the field will be left blank.
17-----
18Country Name (2 letter code) [XX]:CN
19State or Province Name (full name) []:GD
20Locality Name (eg, city) [Default City]:SZ
21Organization Name (eg, company) [Default Company Ltd]:xxyd.com
22Organizational Unit Name (eg, section) []:YW
23Common Name (eg, your name or your server's hostname) []:ldap.xxyd.com
24Email Address []:976972175@qq.com
25
26touch serial index.txt
27echo "01" > serial
28
29# 查看根证书信息
30openssl x509 -noout -text -in /etc/pki/CA/cacert.pem
31

OpenLDAP与CA集成

生成OpenLDAP服务端证书以及修改配置文件来支持SSL、TLS方式会话加密

1# OpenLDAP服务端生成秘钥
2mkdir /etc/openldap/ssl
3cd /etc/openldap/ssl
4(umask 077;openssl genrsa -out ldapkey.pem 1024)
5
6# OpenLDAP服务端向CA申请证书签署请求
7openssl req -new -key ldapkey.pem -out ldap.csr -days 3650
8You are about to be asked to enter information that will be incorporated
9into your certificate request.
10What you are about to enter is what is called a Distinguished Name or a DN.
11There are quite a few fields but you can leave some blank
12For some fields there will be a default value,
13If you enter '.', the field will be left blank.
14-----
15Country Name (2 letter code) [XX]:CN
16State or Province Name (full name) []:GD
17Locality Name (eg, city) [Default City]:SZ
18Organization Name (eg, company) [Default Company Ltd]:xxyd.com
19Organizational Unit Name (eg, section) []:YW
20Common Name (eg, your name or your server's hostname) []:ldap.xxyd.com
21Email Address []:976972175@qq.com
22
23Please enter the following 'extra' attributes
24to be sent with your certificate request
25A challenge password []:
26An optional company name []:
27
28# CA核实并签发证书
29 openssl ca -in ldap.csr -out ldapcert.pem -days 3650
30Using configuration from /etc/pki/tls/openssl.cnf
31Check that the request matches the signature
32Signature ok
33Certificate Details:
34        Serial Number: 1 (0x1)
35        Validity
36            Not Before: Apr 25 08:18:45 2018 GMT
37            Not After : Apr 22 08:18:45 2028 GMT
38        Subject:
39            countryName               = CN
40            stateOrProvinceName       = GD
41            organizationName          = xxyd.com
42            organizationalUnitName    = YW
43            commonName                = ldap.xxyd.com
44            emailAddress              = 976972175@qq.com
45        X509v3 extensions:
46            X509v3 Basic Constraints: 
47                CA:FALSE
48            Netscape Comment: 
49                OpenSSL Generated Certificate
50            X509v3 Subject Key Identifier: 
51                C9:0D:16:5C:91:04:27:E9:96:F4:60:6A:B9:ED:70:16:08:0A:96:32
52            X509v3 Authority Key Identifier: 
53                keyid:CC:5A:C4:57:70:52:C0:67:D3:F3:BF:A6:3B:01:31:3C:7F:8D:07:66
54
55Certificate is to be certified until Apr 22 08:18:45 2028 GMT (3650 days)
56Sign the certificate? [y/n]:y
57
58
591 out of 1 certificate requests certified, commit? [y/n]y
60Write out database with 1 new entries
61Data Base Updated
62

OpenLDAP TLS/SASL部署

1cp /etc/pki/CA/cacert.pem /etc/openldap/ssl/
2chown -R ldap.ldap /etc/openldap/ssl/*
3chmod -R 0400 /etc/openldap/ssl/*
4
5vi /etc/openldap/slapd.conf 
6# TLSCACertificatePath /etc/openldap/certs
7# TLSCertificateFile "\"OpenLDAP Server\""
8# TLSCertificateKeyFile /etc/openldap/certs/password
9TLSCACertificateFile /etc/openldap/ssl/cacert.pem
10TLSCertificateFile /etc/openldap/ssl/ldapcert.pem
11TLSCertificateKeyFile /etc/openldap/ssl/ldapkey.pem
12TLSVerifyClient never
13
14vi /etc/sysconfig/slapd
15SLAPD_URLS="ldapi:/// ldap:/// ldaps:///"
16SLAPD_LDAP=yes
17SLAPD_LDAPI=yes
18SLAPD_LDAPS=yes
19
20rm -rf /etc/openldap/slapd.d/*
21slaptest -u
22slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/
23chown -R ldap.ldap /etc/openldap/slapd.d/
24service slapd restart
25ss -lnp |grep 636
26
27# 通过CA证书公钥验证OpenLDAP服务端证书的合法性
28# openssl verify -CAfile /etc/pki/CA/cacert.pem /etc/openldap/ssl/ldapcert.pem 
29/etc/openldap/ssl/ldapcert.pem: OK
30
31# 确认当前套接字是否能通过CA的验证
32# openssl s_client -connect ldap.xxyd.com:636 -showcerts -state -CAfile /etc/openldap/ssl/cacert.pem 
33CONNECTED(00000003)
34SSL_connect:before/connect initialization
35SSL_connect:SSLv2/v3 write client hello A
36SSL_connect:SSLv3 read server hello A
37depth=1 C = CN, ST = GD, L = SZ, O = xxyd.com, OU = YW, CN = ldap.xxyd.com, emailAddress = 976972175@qq.com
38verify return:1
39depth=0 C = CN, ST = GD, O = xxyd.com, OU = YW, CN = ldap.xxyd.com, emailAddress = 976972175@qq.com
40verify return:1
41SSL_connect:SSLv3 read server certificate A
42SSL_connect:SSLv3 read server key exchange A
43SSL_connect:SSLv3 read server done A
44SSL_connect:SSLv3 write client key exchange A
45SSL_connect:SSLv3 write change cipher spec A
46SSL_connect:SSLv3 write finished A
47SSL_connect:SSLv3 flush data
48SSL_connect:SSLv3 read finished A
49---
50Certificate chain
51 0 s:/C=CN/ST=GD/O=xxyd.com/OU=YW/CN=ldap.xxyd.com/emailAddress=976972175@qq.com
52   i:/C=CN/ST=GD/L=SZ/O=xxyd.com/OU=YW/CN=ldap.xxyd.com/emailAddress=976972175@qq.com
53-----BEGIN CERTIFICATE-----
54MIIDYTCCAkmgAwIBAgIBATANBgkqhkiG9w0BAQsFADB+MQswCQYDVQQGEwJDTjEL
55MAkGA1UECAwCR0QxCzAJBgNVBAcMAlNaMRAwDgYDVQQKDAdubmsuY29tMQswCQYD
56VQQLDAJZVzEVMBMGA1UEAwwMbGRhcC5ubmsuY29tMR8wHQYJKoZIhvcNAQkBFhA5
57NzY5NzIxNzVAcXEuY29tMB4XDTE4MDQyNTA4MTg0NVoXDTI4MDQyMjA4MTg0NVow
58cTELMAkGA1UEBhMCQ04xCzAJBgNVBAgMAkdEMRAwDgYDVQQKDAdubmsuY29tMQsw
59CQYDVQQLDAJZVzEVMBMGA1UEAwwMbGRhcC5ubmsuY29tMR8wHQYJKoZIhvcNAQkB
60FhA5NzY5NzIxNzVAcXEuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDW
61sexciew5xl6Yl324mBQ3EEMJvZYO+GJ7PWqoQg1qPVvfg5jUYs66ONOxmYTb+Kfw
62oMuWicyptJofwAC8CRSdm0tzZI5JBgKrHfZMmjQh9rXF4rnmKWv6LhKupDfWT0aJ
63DZZIdnrYJ8jFX5iU5SaO6C/gS+X6cuKf0yQJr6cb7QIDAQABo3sweTAJBgNVHRME
64AjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0
65ZTAdBgNVHQ4EFgQUyQ0WXJEEJ+mW9GBque1wFggKljIwHwYDVR0jBBgwFoAUzFrE
66V3BSwGfT87+mOwExPH+NB2YwDQYJKoZIhvcNAQELBQADggEBAGwpTJzHMA7Xe1EI
670aicAF7zNnep7fAFTx6t6SJgD1Yio+uwE6xpLiDq9XT8bHmqmS4RK96eB/Il1ZT9
68I0gk/7nOm9qU9tfjgvQVfL/tr1/L+gu9Q86tFUrgrR6aHI9U0VTtOug6j0/kMu5Y
69xo4H6O5/blmV9lmRI65/FDJlaQCJHsWK6fJzBiqh2OtszVgInDEum/L3GVN+oL+L
70SLLqWqvCv8QDkmvEpe7ht0/tb9C2foED1+lI+H9zQKM3lUI2Bp4SRp4nwpIyvnGc
71uq/+EzijIeW+WagPMeNtH+9h20kmvbzCog+YGWXQOkozhXCuHCgzn6+qtPYaLuZT
72WHlPkKA=
73-----END CERTIFICATE-----
74 1 s:/C=CN/ST=GD/L=SZ/O=xxyd.com/OU=YW/CN=ldap.xxyd.com/emailAddress=976972175@qq.com
75   i:/C=CN/ST=GD/L=SZ/O=xxyd.com/OU=YW/CN=ldap.xxyd.com/emailAddress=976972175@qq.com
76-----BEGIN CERTIFICATE-----
77MIIDzzCCAregAwIBAgIJAJA1elZ+21+rMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNV
78BAYTAkNOMQswCQYDVQQIDAJHRDELMAkGA1UEBwwCU1oxEDAOBgNVBAoMB25uay5j
79b20xCzAJBgNVBAsMAllXMRUwEwYDVQQDDAxsZGFwLm5uay5jb20xHzAdBgkqhkiG
809w0BCQEWEDk3Njk3MjE3NUBxcS5jb20wHhcNMTgwNDI1MDgwMTQ4WhcNMjgwNDIy
81MDgwMTQ4WjB+MQswCQYDVQQGEwJDTjELMAkGA1UECAwCR0QxCzAJBgNVBAcMAlNa
82MRAwDgYDVQQKDAdubmsuY29tMQswCQYDVQQLDAJZVzEVMBMGA1UEAwwMbGRhcC5u
83bmsuY29tMR8wHQYJKoZIhvcNAQkBFhA5NzY5NzIxNzVAcXEuY29tMIIBIjANBgkq
84hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtLLSFTcyLeQNeZMlddJ5v388TQJpUByN
85bbq0cjdeWWg9OHqF6+JIA481B8lGlmZXpUmOsWbxMpgb4M98AQ9zM48SybbNTVMf
86Is3GMz0YkXSGsqj6id3FkXs3wfPR6UpWhAQuuoHaovHEia9TVmK/ypK+OIY+F8qv
87p3qmWDCmxNOAR6tyndxcp3hG2rrIWTUkVoZWoEpPzRsesKdVYJ/CzscFQc9x2jM8
88RgQzX59Z3dM6XR2eT9byhzwPHIy7wiZBg3kesQ+3dIoRYsHWkqK5dzDA3W1Lj1pY
89xGN+udRhXSK0o9HlXd457g6SqPpEFRxClAB8fGu+7BqyiCeFOvPbJQIDAQABo1Aw
90TjAdBgNVHQ4EFgQUzFrEV3BSwGfT87+mOwExPH+NB2YwHwYDVR0jBBgwFoAUzFrE
91V3BSwGfT87+mOwExPH+NB2YwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC
92AQEAjPFE1jDbvRhTxjJ40eBssnr/E6h+baY4eDnU+dSiO7BhaA+DQY2ANdCi7scu
93pfqceQ6UPpvjNZC8bQOqc1j57kXGCK6Na1k70cP7Tpdtp1ZA0kBe43aUi7quwsYP
94b0boBwAmBFZ7C958Pgmv58r+GGTidd1RMJR111FT8hceC4WiMTrMTxCj1EFWm2c4
95wv0uZIg0awGy8TS3nfSNb9t7YiFQYjlV/xUOBzobZZRl0e8FdQ7mO7qogoOmR8r/
962P5SJk6FjH0ENKb9igwlMDnlm1E78ZUjLbfvAfyPLSUE3kYoIFa9Xa0dyVV46IuW
97u3tdbPBah5v6z3FkcbAldZHeGw==
98-----END CERTIFICATE-----
99---
100Server certificate
101subject=/C=CN/ST=GD/O=xxyd.com/OU=YW/CN=ldap.xxyd.com/emailAddress=976972175@qq.com
102issuer=/C=CN/ST=GD/L=SZ/O=xxyd.com/OU=YW/CN=ldap.xxyd.com/emailAddress=976972175@qq.com
103---
104No client certificate CA names sent
105Peer signing digest: SHA256
106Server Temp Key: ECDH, P-256, 256 bits
107---
108SSL handshake has read 2213 bytes and written 415 bytes
109---
110New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
111Server public key is 1024 bit
112Secure Renegotiation IS supported
113Compression: NONE
114Expansion: NONE
115No ALPN negotiated
116SSL-Session:
117    Protocol  : TLSv1.2
118    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
119    Session-ID: 55054DE6A2BDA0AB00F94966542DF551E357F9B3F07B5B6F1DD3567D0CBEE311
120    Session-ID-ctx: 
121    Master-Key: 1E1248619CC913A090967862C855CD9F43299DFE60A52D8BFBB515A8C6C01A74DD2E2E939C97B5414C1DA0A05FC16D2A
122    Key-Arg   : None
123    Krb5 Principal: None
124    PSK identity: None
125    PSK identity hint: None
126    Start Time: 1524647608
127    Timeout   : 300 (sec)
128    Verify return code: 0 (ok)
129---
130
131# OpenLDAP从服务器部署
132拷贝 cacert.pem ldapcert.pem ldapkey.pem至/etc/openldap/ssl/
133
134chown -R ldap.ldap /etc/openldap/ssl/*
135chmod -R 0400 /etc/openldap/ssl/*
136vi /etc/openldap/slapd.conf
137# TLSCACertificatePath /etc/openldap/certs
138# TLSCertificateFile "\"OpenLDAP Server\""
139# TLSCertificateKeyFile /etc/openldap/certs/password
140TLSCACertificateFile /etc/openldap/ssl/cacert.pem
141TLSCertificateFile /etc/openldap/ssl/ldapcert.pem
142TLSCertificateKeyFile /etc/openldap/ssl/ldapkey.pem
143TLSVerifyClient never
144
145vi /etc/sysconfig/slapd
146SLAPD_URLS="ldapi:/// ldap:/// ldaps:///"
147SLAPD_LDAP=yes
148SLAPD_LDAPI=yes
149SLAPD_LDAPS=yes
150
151rm -rf /etc/openldap/slapd.d/*
152slaptest -u
153slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/
154chown -R ldap.ldap /etc/openldap/slapd.d/
155service slapd restart
156ss -lnp |grep 636
157

客户端部署

剥离基础组件故障对于平台的影响

非常幸运OpenLDAP的客户端配置文件中支持 ==nss_initgroups_ignoreusers== 的配置。也就是说可以将角色用户（ root、service、oracle、read_only等）忽略掉，不需要进行OpenLDAP请求，而直接在本地进行权限认证即可。个人账号及权限在OpenLDAP中维护，而角色账号是在服务器passwd&shadow中维护的。

Ubuntu客户端

1# rsync -azP ldap.xxyd.com:/etc/pki/CA/cacert.pem /etc/ldap/ssl/
2
3# vi /etc/ldap.conf
4base dc=xxyd,dc=com
5uri ldaps://ldap.xxyd.com
6#ssl start_tls
7#ssl no
8ssl on
9## nss_initgroups_ignoreusers set ignore local user
10nss_initgroups_ignoreusers root,daemon,bin,sys,sync,mail,nobody,syslog,sshd
11
12
13# vi /etc/ldap/ldap.conf
14BASE	dc=xxyd,dc=com
15URI	ldaps://ldap.xxyd.com
16TLS_CACERT	/etc/ldap/ssl/cacert.pem
17#TLS_CACERT     /etc/ssl/certs/ca-certificates.crt
18
19
20
21/etc/init.d/nscd restart
22

CentOS客户端

1rsync -azP ldap.xxyd.com:/etc/pki/CA/cacert.pem /etc/openldap/cacerts/
2
3vi /etc/openldap/ldap.conf
4URI ldaps://ldap.xxyd.com/
5## nss_initgroups_ignoreusers set ignore local user
6nss_initgroups_ignoreusers root,daemon,bin,operator,sync,mail,nobody,adm,sshd
7
8vi /etc/pam_ldap.conf
9# ssl start_tls
10# ssl no
11uri ldaps://ldap.xxyd.com/
12ssl on
13
14vi /etc/nslcd.conf
15# ssl no
16uri ldaps://ldap.xxyd.com/
17ssl on
18tls_cacertfile /etc/openldap/cacerts/cacert.pem
19
20
21service nslcd restart
22
23# 通过客户端测试SSL连接是否正常
24# yum -y install openldap-clients
25# ldapwhoami -v -x -Z
26ldap_initialize( <DEFAULT> )
27ldap_start_tls: Operations error (1)
28	additional info: TLS already started
29anonymous
30Result: Success (0)
31
32# LAP用户验证密码
33# ldapwhoami -D "uid=test01,ou=People,dc=xxyd,dc=com" -W -H ldaps://ldap.xxyd.com -v
34ldap_initialize( ldaps://ldap.xxyd.com:636/??base )
35Enter LDAP Password: 
36dn:uid=test01,ou=People,dc=xxyd,dc=com
37Result: Success (0)
38
39# 通过getent在客户端执行，查看能否获取账号信息
40# getent passwd test01
41test01:x:1001:1001:test01:/home/test01:/bin/bash
42
43

sudo权限控制

1cp /usr/share/doc/sudo-1.8.6p7/schema.OpenLDAP /etc/openldap/schema/sudo.schema
2
3vi /etc/openldap/slapd.conf
4include		/etc/openldap/schema/sudo.schema
5
6rm -rf /etc/openldap/slapd.d/*
7
8slaptest -u
9slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/
10chown -R ldap.ldap /etc/openldap/slapd.d/
11
12service slapd restart
13
14
15# 根据实际需求添加sudo项
16# cat ~/sudoers.ldif
17dn: ou=sudoers,dc=xxyd,dc=com
18objectClass: top
19objectClass: organizationalUnit
20ou: sudoers
21
22dn: cn=defaults,ou=sudoers,dc=xxyd,dc=com
23objectClass: top
24objectClass: sudoRole
25cn: defaults
26description: Default sudoOption's go here
27sudoOption: requiretty
28sudoOption: !visiblepw
29sudoOption: always_set_home
30sudoOption: env_reset
31sudoOption: env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
32sudoOption: env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
33sudoOption: env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
34sudoOption: env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
35sudoOption: env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
36sudoOption: secure_path = /sbin:/bin:/usr/sbin:/usr/bin
37sudoOrder: 1
38
39dn: cn=%apps,ou=sudoers,dc=xxyd,dc=com
40objectClass: top
41objectClass: sudoRole
42cn: %apps
43sudoUser: %apps
44sudoHost: ALL
45sudoRunAsUser: %apps
46sudoCommand: /bin/kill
47sudoCommand: /usr/bin/nohup
48sudoCommand: /usr/bin/vi
49sudoCommand: /bin/cp
50sudoCommand: /bin/mv
51sudoCommand: /bin/ln
52sudoCommand: /bin/mkdir
53sudoOption: !authenticate
54sudoOrder: 2
55
56dn: cn=%www-data,ou=sudoers,dc=xxyd,dc=com
57objectClass: top
58objectClass: sudoRole
59cn: %www-data
60sudoUser: %www-data
61sudoHost: ALL
62sudoRunAsUser: %www-data
63sudoCommand: /bin/kill
64sudoCommand: /usr/bin/nohup
65sudoCommand: /usr/bin/vi
66sudoCommand: /bin/cp
67sudoCommand: /bin/mv
68sudoCommand: /bin/ln
69sudoCommand: /bin/mkdir
70sudoCommand: /usr/bin/rsync
71sudoOption: !authenticate
72sudoOrder: 3
73
74
75# ldapadd -x -D "cn=admin,dc=xxyd,dc=com" -W -f ~/sudoers.ldif
76Enter LDAP Password: 
77adding new entry "ou=sudoers,dc=xxyd,dc=com"
78
79adding new entry "cn=defaults,ou=sudoers,dc=xxyd,dc=com"
80
81adding new entry "cn=%apps,ou=sudoers,dc=xxyd,dc=com"
82
83adding new entry "cn=%www-data,ou=sudoers,dc=xxyd,dc=com"
84
85## 为test01用户添加附加组
86# cat add_apps.ldif 
87dn: cn=apps,ou=Group,dc=xxyd,dc=com
88objectClass: posixGroup
89objectClass: top
90cn: apps
91userPassword: {crypt}x
92gidNumber: 1500
93memberUid: test01
94
95dn: uid=apps,ou=People,dc=xxyd,dc=com
96uid: apps
97cn: apps
98objectClass: account
99objectClass: posixAccount
100objectClass: top
101objectClass: shadowAccount
102shadowMax: 99999
103shadowWarning: 7
104loginShell: /bin/bash
105uidNumber: 1500
106gidNumber: 1500
107homeDirectory: /home/apps
108
109# ldapadd -x -D "cn=admin,dc=xxyd,dc=com" -W -f add_apps.ldif 
110Enter LDAP Password: 
111adding new entry "cn=apps,ou=Group,dc=xxyd,dc=com"
112
113adding new entry "uid=apps,ou=People,dc=xxyd,dc=com"
114

客户端

centos 客户端

1authconfig --enableldap --enableldapauth --enablemkhomedir --enableforcelegacy --disablesssd --disablesssdauth --disableldaptls --enablelocauthorize --ldapserver=ldap.xxyd.com --ldapbasedn="dc=xxyd,dc=com" --enableshadow --update
2
3
4vi /etc/nsswitch.conf
5sudoers:  ldap files
6
7vi /etc/sudo-ldap.conf 
8uri ldaps://ldap.xxyd.com/
9base dc=xxyd,dc=com
10SUDOERS_BASE ou=sudoers,dc=xxyd,dc=com
11
12vi /etc/pam_ldap.conf
13uri ldaps://ldap.xxyd.com/
14
15service nslcd restart
16

Ubuntu客户端

1# export SUDO_FORCE_REMOVE=yes
2# apt-get install sudo-ldap
3# ls -lh /etc/sudo-ldap.conf
4lrwxrwxrwx 1 root root 14 Apr 28 01:22 /etc/sudo-ldap.conf -> ldap/ldap.conf
5
6# vi /etc/ldap/ldap.conf 
7SUDOERS_BASE ou=sudoers,dc=xxyd,dc=com
8
9# echo "sudoers:	ldap files" >> /etc/nsswitch.conf
10# service nscd restart
11
12# 测试
13# su - test01
14$ sudo -l
15匹配此主机上 test01 的默认条目：
16    requiretty, !visiblepw, always_set_home, env_reset, env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS",
17    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT
18    LC_MESSAGES", env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS
19    _XKB_CHARSET XAUTHORITY", secure_path = /sbin:/bin:/usr/sbin:/usr/bin, !visiblepw, always_set_home, env_reset, env_keep="COLORS
20    DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
21    env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER
22    LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
23
24用户 test01 可以在该主机上运行以下命令：
25    (%apps) NOPASSWD: /bin/kill, /usr/bin/nohup, /usr/bin/vi, /bin/cp, /bin/mv, /bin/ln, /bin/mkdir
26
27
28#备注：Ubuntu和CentOS命令路径部分有区别，如vi
29

密码策略

1vi /etc/openldap/slapd.conf
2include         /etc/openldap/schema/ppolicy.schema
3moduleload ppolicy.la
4overlay ppolicy
5#密码加密算法，不加这一行密码将明文显示
6password-hash {SSHA}
7#Add和Modify中传递的密码明文保存数据库中必须进行Hash加密
8ppolicy_hash_cleartext
9ppolicy_use_lockout
10#默认密码控制策略
11ppolicy_default "cn=default,ou=policies,dc=xxyd,dc=com"
12
13rm -rf /etc/openldap/slapd.d/*
14# slaptest -u
15config file testing succeeded
16# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/
17config file testing succeeded
18chown -R ldap.ldap /etc/openldap/slapd.d/
19service slapd restart
20
21#参考/root/openldap-2.4.44/servers/slapd/schema/ppolicy.ldif
22
23
24#定义默认密码策略
25# cat policy.ldif 
26dn: ou=policies, dc=xxyd,dc=com
27objectClass: top
28objectClass: organizationalUnit
29ou: Policies
30
31dn: cn=default, ou=policies, dc=xxyd,dc=com
32objectClass: top
33objectClass: person
34objectClass: pwdPolicy
35cn: default
36pwdAttribute: userPassword
37pwdLockoutDuration: 15
38pwdInHistory: 6
39pwdCheckQuality: 2
40pwdExpireWarning: 1296000
41pwdMaxAge: 15552000
42pwdMinLength: 8
43pwdGraceAuthNLimit: 3
44pwdAllowUserChange: TRUE
45pwdMustChange: TRUE
46pwdMaxFailure: 3
47pwdFailureCountInterval: 86400
48pwdSafeModify: TRUE
49pwdLockout: TRUE
50sn: dummy value
51
52
53#密码策略注解
54pwdLockout  是否开启账户锁定功能
55pwdMaxFailure 密码最大失败次数，超过后账号被锁定
56pwdLockoutDuration 帐户保持锁定的时间（秒为单位），默认为0表示无法访问账户
57pwdInHistory  历史密码维护列表中密码的数量
58pwdCheckQuality 检查密码质量，0不检查，1、2检查
59pwdExpireWarning 密码过期提醒，单位秒
60pwdMaxAge 密码有效期，单位秒
61pwdMinLength 密码最小长度
62pwdGraceAuthNLimit 密码过期后宽限期
63pwdAllowUserChange 是否允许用户更改自己的密码
64pwdLockout 超过pwdMaxFailure定义的无效密码尝试次数时是否锁定账户
65pwdMustChange 用户在帐户锁定后由管理员重置帐户后是否必须更改密码
66pwdMaxFailure 允许的最大连续失败密码尝试次数
67pwdFailureCountInterval 密码失败次数复位时间
68pwdSafeModify 用户在密码修改操作期间是否必须发送当前密码
69
70# ldapadd -x -D "cn=admin,dc=xxyd,dc=com" -W -f policy.ldif 
71Enter LDAP Password: 
72adding new entry "ou=policies, dc=xxyd, dc=com"
73
74adding new entry "cn=default, ou=policies, dc=xxyd, dc=com"
75
76# 定义用户遵守指定密码策略
77# cat test02.ldif 
78dn: cn=test02,ou=Group,dc=xxyd,dc=com
79objectClass: posixGroup
80objectClass: top
81cn: test02
82userPassword: {crypt}x
83gidNumber: 1002
84
85dn: uid=test02,ou=People,dc=xxyd,dc=com
86uid: test02
87cn: test02
88objectClass: account
89objectClass: posixAccount
90objectClass: top
91objectClass: shadowAccount
92userPassword: {crypt}$6$Yu95/zTK$g/nCoExrQwlf80a8Gc0VxMNzkJWa7icUVinFWwEjPBad/KhCNDs81hUVCYA7vV/dJdw7.zSBu2Yz.F0gVJH0a/
93shadowLastChange: 17638
94shadowMax: 99999
95shadowWarning: 7
96loginShell: /bin/bash
97uidNumber: 1002
98gidNumber: 1002
99homeDirectory: /home/test02
100pwdPolicySubentry: cn=default,ou=policies,dc=xxyd,dc=com
101
102

定义用户登录修改密码

为了增强用户密码安全性，一般需要用户更改初始密码

方式有两种：用户登录后通过passwd命令更改、用户登录系统是提示更改初始密码否则无法登录

推进第二种

为了定义密码控制策略，将pwdReset属性和值添加至用户的属性中，否则不生效

1# cat << EOF |ldapadd -x -D "cn=admin,dc=xxyd,dc=com" -W
2dn: uid=test02,ou=People,dc=xxyd,dc=com
3changetype: modify
4replace: pwdReset
5pwdReset: TRUE
6EOF
7
8#查看定义用户的策略信息
9# pwdReset属于隐藏属性，默认ldapsearch无法获取隐藏属性，通过“+”号可获取查询包含的隐藏属性
10# ldapsearch -x -LLL uid=test02 +
11dn: uid=test02,ou=People,dc=xxyd,dc=com
12pwdPolicySubentry: cn=default,ou=policies,dc=xxyd,dc=com
13structuralObjectClass: account
14entryUUID: 0fc49c74-dd83-1037-8006-65040a056c63
15creatorsName: cn=admin,dc=xxyd,dc=com
16createTimestamp: 20180426095056Z
17pwdChangedTime: 20180426095747Z
18pwdHistory: 20180426095747Z#1.3.6.1.4.1.1466.115.121.1.40#105#{crypt}$6$Yu95/z
19 TK$g/nCoExrQwlf80a8Gc0VxMNzkJWa7icUVinFWwEjPBad/KhCNDs81hUVCYA7vV/dJdw7.zSBu2
20 Yz.F0gVJH0a/
21pwdReset: TRUE
22entryCSN: 20180426095747.741644Z#000000#000#000000
23modifiersName: uid=test02,ou=People,dc=xxyd,dc=com
24modifyTimestamp: 20180426095747Z
25entryDN: uid=test02,ou=People,dc=xxyd,dc=com
26subschemaSubentry: cn=Subschema
27hasSubordinates: FALSE
28

客户端配置

CentOS 客户端

1vi /etc/pam_ldap.conf
2bind_policy soft
3pam_password md5
4pam_lookup_policy yes
5pam_password clear_remove_old
6
7service nslcd restart
8
9# ssh test02@10.1.101.116
10test02@10.1.101.116's password: 
11You are required to change your LDAP password immediately.
12Creating directory '/home/test02'.
13WARNING: Your password has expired.
14You must change your password now and login again!
15Changing password for user test02.
16Enter login(LDAP) password: 
17New password: 
18Retype new password: 
19LDAP password information changed for test02
20passwd: all authentication tokens updated successfully.
21

Ubuntu 客户端

1vi /etc/pam_ldap.conf
2bind_policy soft
3pam_password md5
4pam_lookup_policy yes
5pam_password clear_remove_old
6
7service nscd restart
8

密码审计控制

1# cat << EOF | ldapadd -Y EXTERNAL -H ldapi:///
2dn: cn=module{0},cn=config
3changetype: modify
4add: olcModuleLoad
5olcModuleLoad: {1}auditlog
6
7dn: olcOverlay=auditlog,olcDatabase={2}hdb,cn=config
8changetype: add
9objectClass: olcOverlayConfig
10objectClass: olcAuditLogConfig
11olcOverlay: auditlog
12olcAuditlogFile: /var/log/slapd/auditlog.log
13EOF
14
15mkdir /var/log/slapd
16chown -R ldap.ldap /var/log/slapd
17service slapd restart
18
19

日志

1vi /etc/openldap/slapd.conf
2loglevel 0x80 0x1
3logfile         /var/log/slapd/slapd.log
4
5rm -rf /etc/openldap/slapd.d/*
6slaptest -u
7slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/
8chown -R ldap.ldap /etc/openldap/slapd.d/
9service slapd restart
10
11mkdir /var/log/slapd/
12chown -R ldap.ldap /var/log/slapd/
13
14# vi /etc/logrotate.d/ldap 
15/var/log/slapd/slapd.log {
16	prerotate
17		/usr/bin/chattr -a /var/log/slapd/slapd.log
18	endscript
19	compress
20	delaycompress
21	notifempty
22	rotate 100
23	size 10M
24	postrotate
25		/usr/bin/chattr +a /var/log/slapd/slapd.log
26	endscript
27}
28
29vi /etc/rsyslog.conf
30local4.*			/var/log/slapd/slapd.log
31
32service rsyslog restart
33

ssh public key

服务端

1yum -y install openssh-ldap
2
3cp /usr/share/doc/openssh-ldap-7.4p1/openssh-lpk-openldap.schema /etc/openldap/schema/
4
5rm -rf /etc/openldap/slapd.d/*
6slaptest -u
7slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/
8chown -R ldap.ldap /etc/openldap/slapd.d/
9service slapd restart
10
11# 添加测试账户
12# cat test03.ldif 
13dn: cn=test03,ou=Group,dc=xxyd,dc=com
14objectClass: posixGroup
15objectClass: top
16cn: test03
17userPassword: {crypt}x
18gidNumber: 1003
19
20dn: uid=test03,ou=People,dc=xxyd,dc=com
21uid: test03
22cn: test03
23objectClass: account
24objectClass: posixAccount
25objectClass: top
26objectClass: shadowAccount
27objectClass: ldapPublicKey
28userPassword: {crypt}$6$Yu95/zTK$g/nCoExrQwlf80a8Gc0VxMNzkJWa7icUVinFWwEjPBad/KhCNDs81hUVCYA7vV/dJdw7.zSBu2Yz.F0gVJH0a/
29shadowLastChange: 17638
30shadowMax: 99999
31shadowWarning: 7
32loginShell: /bin/bash
33uidNumber: 1003
34gidNumber: 1003
35homeDirectory: /home/test03
36pwdPolicySubentry: cn=default,ou=policies,dc=xxyd,dc=com
37sshPublicKey: ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIBZpJc0dfiPsHlfPNEJBUqhCGZX2wGabxklz09ptnriLoCh9AeYj39suHPptTZDAGiOn8JxrdYK4SubEby9WdQ/t2kVE60Bytw+Jyc2YjEhVb1iJinMd1sdck7O3YBDJoCt0WTf7USAQE7e1oH54kDCPQcPozid7AjbrF2mzxnFpQ== rsa-key-20101209
38
39# ldapadd -x -D "cn=admin,dc=xxyd,dc=com" -W -f test03.ldif
40Enter LDAP Password: 
41adding new entry "cn=test03,ou=Group,dc=xxyd,dc=com"
42
43adding new entry "uid=test03,ou=People,dc=xxyd,dc=com"
44
45

客户端

CentOS client

1yum -y install openssh-ldap
2
3# vi /etc/ssh/ldap.conf 
4URI ldaps://ldap.xxyd.com/
5BASE dc=xxyd,dc=com
6ssl on
7
8# vi /etc/ssh/sshd_config
9AuthorizedKeysCommand /usr/libexec/openssh/ssh-ldap-wrapper
10AuthorizedKeysCommandRunAs nobody
11
12# vi /usr/libexec/openssh/ssh-ldap-wrapper
13#!/bin/bash
14# get configuration from /etc/ldap.conf
15for x in $(sed -n 's/^\([a-zA-Z_]*\) \(.*\)$/\1="\2"/p' /etc/ldap.conf); do 
16    eval $x; 
17done
18
19# local user do not search ldap
20USER=$1
21for user in `echo $nss_initgroups_ignoreusers|sed 's/,/ /g'`; do
22    exit ;
23done
24
25exec /usr/libexec/openssh/ssh-ldap-helper -s "$1"
26
27
28# service sshd restart
29
30# grep test03 /var/log/secure
31Apr 27 15:15:37 new sshd[31926]: Accepted publickey for test03 from xx.xx.xx.xx port 6658 ssh2
32Apr 27 15:15:37 new sshd[31926]: pam_unix(sshd:session): session opened for user test03 by (uid=0)
33
34

Ubuntu client

1# 升级OpenSSH (6.2以上版本)
2
3## 搭建telnet server
4# apt-get install openbsd-inetd telnetd
5# vi /etc/inetd.conf
6telnet stream tcp nowait root /usr/sbin/tcpd /usr/sbin/in.telnetd 
7
8# vi /etc/securetty 
9# Telnet
10pts/0
11pts/1
12pts/2
13
14# 限制telnet登录ip，只允许指定ip段(信任ip段)登录
15# vi /etc/hosts.deny
16in.telnetd:ALL EXCEPT 192.168.0.0/24
17
18service openbsd-inetd restart
19
20# telnet 登录服务器升级OpenSSh版本
21telnet x.x.x.x
22
23cp /etc/init.d/ssh /root/ssh.old
24cp -r /etc/ssh /root/
25cp /etc/pam.d/sshd /root/
26grep sshd /etc/passwd | head -1 | awk -F: '{print $1,$3,$4,$6,$7}' > /root/ssh_user
27
28# 卸载openssh 旧版本，卸载之前必须确认可用telnet登录，以下步骤telnet登录服务器操作
29apt-get -y purge openssh-client openssh-server
30
31apt-get -y install zlib1g-dev libssl-dev libpam0g-dev make
32
33## 安装openssh 7.2
34wget https://openbsd.hk/pub/OpenBSD/OpenSSH/portable/openssh-7.2p2.tar.gz
35
36useradd -u `awk '{print $2}' /root/ssh_user` -g `awk '{print $3}' /root/ssh_user` -d `awk '{print $4}' /root/ssh_user` -s `awk '{print $5}' /root/ssh_user` sshd
37
38tar zxvf openssh-7.2p2.tar.gz
39cd openssh-7.2p2/
40
41./configure --prefix=/usr --sysconfdir=/etc/ssh --with-zlib --with-md5-passwords --with-pam --with-tcp-wrappers
42
43make &&make install
44
45# ssh -V
46OpenSSH_7.2p2, OpenSSL 1.0.1 14 Mar 2012
47
48
49
50
51# cat > /etc/ssh/sshd_config << EOF
52Port 22
53Protocol 2
54HostKey /etc/ssh/ssh_host_rsa_key
55HostKey /etc/ssh/ssh_host_dsa_key
56HostKey /etc/ssh/ssh_host_ecdsa_key
57HostKey /etc/ssh/ssh_host_ed25519_key
58UsePrivilegeSeparation yes
59KeyRegenerationInterval 3600
60ServerKeyBits 1024
61SyslogFacility AUTH
62LogLevel INFO
63LoginGraceTime 120
64PermitRootLogin yes
65StrictModes yes
66RSAAuthentication yes
67PubkeyAuthentication yes
68IgnoreRhosts yes
69RhostsRSAAuthentication no
70HostbasedAuthentication no
71PermitEmptyPasswords no
72ChallengeResponseAuthentication no
73PasswordAuthentication yes
74X11Forwarding yes
75X11DisplayOffset 10
76PrintMotd no
77PrintLastLog yes
78TCPKeepAlive yes
79AcceptEnv LANG LC_*
80Subsystem sftp /usr/lib/openssh/sftp-server
81UsePAM yes
82AuthorizedKeysCommand /etc/ssh/ldap-keys.sh
83AuthorizedKeysCommandUser nobody
84EOF
85
86# cat > /etc/ssh/ssh_config <<EOF
87Host *
88    SendEnv LANG LC_*
89    HashKnownHosts yes
90    #GSSAPIAuthentication yes
91    #GSSAPIDelegateCredentials no
92EOF
93
94### 7.2 不支持GSSAPI参数
95/etc/ssh/ssh_config line 4: Unsupported option "gssapiauthentication"
96/etc/ssh/ssh_config line 5: Unsupported option "gssapidelegatecredentials"
97###
98
99cat > /etc/pam.d/sshd << EOF
100@include common-auth
101account    required     pam_nologin.so
102@include common-account
103@include common-session
104session    optional     pam_motd.so # [1]
105session    optional     pam_mail.so standard noenv # [1]
106session    required     pam_limits.so
107session    required     pam_env.so # [1]
108session    required     pam_env.so user_readenv=1 envfile=/etc/default/locale
109@include common-password
110EOF
111
112
113apt-get -y install ldap-utils
114
115vi /etc/ssh/ldap-keys.sh
116#!/bin/bash
117# get configuration from /etc/ldap.conf
118for x in $(sed -n 's/^\([a-zA-Z_]*\) \(.*\)$/\1="\2"/p' /etc/ldap.conf); do 
119    eval $x;
120done
121
122# local user do not search ldap
123for USER in `echo $nss_initgroups_ignoreusers|sed 's/,/ /g'`; do
124    if [ $USER == $1 ];then
125    exit
126    fi
127done
128 
129OPTIONS=
130case "$ssl" in
131    start_tls) 
132        case "$tls_checkpeer" in
133            no) OPTIONS+="-Z";;
134            *) OPTIONS+="-ZZ";;
135        esac;;
136esac
137 
138# ldap user search ldap sshPublicKey
139ldapsearch $OPTIONS -H ${uri} -w "${bindpw}" -D "${binddn}" -b "${base}" '(&(objectClass=posixAccount)(uid='"$1"'))' 'sshPublicKey' \
140    | sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'
141
142chmod +x /etc/ssh/ldap-keys.sh
143
144# 拷贝旧的ssh启动脚本
145cp /root/ssh.old /etc/init.d/ssh 
146
147# service ssh start
148
149#开机启动
150update-rc.d ssh defaults
151
152# ssh 升级完成之后卸载telnet服务，还原配置
153apt-get purge openbsd-inetd telnetd
154sed -i '/Telnet/d' /etc/securetty
155sed -i '/pts\//d' /etc/securetty
156sed -i '/in.telnetd/d' /etc/hosts.deny
157
158参考链接：
159https://www.linuxidc.com/Linux/2011-10/45739.htm
160https://marc.waeckerlin.org/computer/blog/ssh_and_ldap
161

主机控制策略

http://ju.outofmemory.cn/entry/146609

服务端

1# vi /etc/openldap/schema/ldapns.schema
2# $
3# : ldapns.schema,v 1.3 2009-10-01 19:17:20 tedcheng Exp $
4# LDAP Name Service Additional Schema
5# http://www.iana.org/assignments/gssapi-service-names
6#
7# Not part of the distribution: this is a workaround!
8#
9attributetype ( 1.3.6.1.4.1.5322.17.2.1 NAME 'authorizedService'
10          DESC 'IANA GSS-API authorized service name'
11          EQUALITY caseIgnoreMatch
12          SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
13attributetype ( 1.3.6.1.4.1.5322.17.2.2 NAME 'loginStatus'
14          DESC 'Currently logged in sessions for a user'
15          EQUALITY caseIgnoreMatch
16          SUBSTR caseIgnoreSubstringsMatch
17          ORDERING caseIgnoreOrderingMatch
18          SYNTAX OMsDirectoryString )
19objectclass ( 1.3.6.1.4.1.5322.17.1.1 NAME 'authorizedServiceObject'
20          DESC 'Auxiliary object class for adding authorizedService attribute'
21          SUP top
22          AUXILIARY
23          MAY authorizedService )
24objectclass ( 1.3.6.1.4.1.5322.17.1.2 NAME 'hostObject'
25          DESC 'Auxiliary object class for adding host attribute'
26          SUP top
27          AUXILIARY
28          MAY host )
29objectclass ( 1.3.6.1.4.1.5322.17.1.3 NAME 'loginStatusObject'
30          DESC 'Auxiliary object class for login status attribute'
31          SUP top
32          AUXILIARY
33          MAY loginStatus )
34
35# vi /etc/openldap/slapd.conf
36include         /etc/openldap/schema/ldapns.schema
37
38rm -rf /etc/openldap/slapd.d/*
39slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/
40chown -R ldap.ldap /etc/openldap/slapd.d/
41service slapd restart
42
43cat <<EOF | ldapadd -x -D cn=admin,dc=xxyd,dc=com -W -H ldap://ldap.xxyd.com/
44dn: ou=APP,ou=People,dc=xxyd,dc=com
45ou: APP
46objectClass: top
47objectClass: organizationalUnit
48EOF
49
50cat <<EOF | ldapadd -x -D cn=admin,dc=xxyd,dc=com -W -H ldap://ldap.xxyd.com/
51dn: ou=DB,ou=People,dc=xxyd,dc=com
52ou: DB
53objectClass: top
54objectClass: organizationalUnit
55EOF
56

规划：

ou=APP 应用运维人员账户根路径；

ou=DB 数据库管理员账户根路径

Ubuntu客户端

1# echo "pam_check_host_attr yes" >> /etc/pam_ldap.conf
2# vi /etc/ldap.conf
3nss_base_passwd ou=APP,ou=People,dc=xxyd,dc=com
4nss_base_shadow ou=APP,ou=People,dc=xxyd,dc=com
5nss_base_group ou=APP,ou=People,dc=xxyd,dc=com
6
7## 注明：应用服务器设置ou=APP,ou=People,dc=xxyd,dc=com
8##       数据库服务器设置ou=DB,ou=People,dc=xxyd,dc=com
9##       同时登陆应用和数据库服务器设置ou=People,dc=xxyd,dc=com
10## /etc/ldap.conf配置文件注意不要有多余的空格分隔符，否则ldap-keys.sh脚本会报语法错误
11
12# service nscd restart
13

CentOS 客户端

测试，应用运维人员只能登录应用服务器，数据库管理员只能登录数据库服务器

数据同步

主从同步

主服务器同步策略配置

编辑OpenLDAP主配置文件

vi /etc/ldap/slapd.conf

1moduleload syncprov.la
2index entryCSN,entryUUID eq
3overlay syncprov
4syncprov-checkpoint 100 10
5syncprov-sessionlog 100
6

重新生成数据库文件，使其配置生效

1service slapd stop
2rm -rf /etc/openldap/slapd.d/*
3slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/
4chown -R ldap.ldap /etc/openldap/slapd.d/
5service slapd restart
6ss -lnp |grep slapd
7

从服务器配置

编辑OpenLDAP主配置文件

vi /etc/openldap/slapd.conf

1moduleload syncprov.la
2index entryCSN,entryUUID eq
3syncrepl rid=002
4	provider=ldap://10.1.31.128:389/
5	type=refreshOnly
6	retry="60 10 600 +"
7	interval=00:00:00:10
8	searchbase="dc=xxyd,dc=com"
9	scope=sub
10	schemachecking=off
11	bindmethod=simple
12	binddn="cn=admin,dc=xxyd,dc=com"
13	attrs="*,+"
14	credentials=PASSWD
15
16# Refer updates to the master
17updatedn "cn=admin,xxyd,dc=com"
18updateref  ldap://10.1.31.243
19

重新生成数据库文件，使其配置生效

1service slapd stop
2rm -rf /etc/openldap/slapd.d/*
3slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/
4chown -R ldap.ldap /etc/openldap/slapd.d/
5service slapd restart
6ss -lnp |grep slapd
7

导入数据条目

主服务器上导出数据条目：

1ldapsearch -x -b 'dc=com,dc=cn' > ldapbackup.ldif
2

传输备份数据到备服务器上并导入

1ldapadd -x -D "cn=admin,dc=xxyd,dc=com" -W -f ldapbackup.ldif
2

比对主备服务器数据条目是否一致

1ldapsearch -x -LLL  |wc -l
2

重新生成数据库文件，使其配置生效

1service slapd stop
2rm -rf /etc/ldap/slapd.d/
3slaptest -f /etc/ldap/slapd.conf -F /etc/ldap/slapd.d/
4chown -R openldap.openldap /etc/ldap/slapd.d/
5service slapd restart
6ss -lnp |grep slapd
7

主从同步验证

主服务器上添加条目

1ldapadd -x -D "cn=admin,dc=xxyd,dc=com" -W -f group.test02.ldif
2
3ldapadd -x -D "cn=admin,dc=xxyd,dc=com" -W -f passwd.test02.ldif 
4

查看从服务器上是否存在新添加的条目

1ldapsearch -x -LLL uid=test02
2

查看同步日志

1/var/log/syslog
2

多主同步（N-Way Multimaster）

服务器同步策略配置

多主模式，多台服务器配置一致，只需更改ip/域名即可

编辑OpenLDAP配置文件

1# vi /etc/openldap/slapd.conf
2moduleload syncprov.la
3index entryUUID,entryCSN eq
4overlay syncprov
5syncprov-checkpoint 100 10
6syncprov-sessionlog 100
7serverID 1 ldaps://ldap01.xxyd.com
8serverID 2 ldaps://ldap02.xxyd.com
9
10syncrepl rid=001
11    provider=ldaps://ldap01.xxyd.com
12    binddn="cn=admin,dc=xxyd,dc=com"
13    bindmethod=simple
14    credentials=PASSWD
15    searchbase="dc=xxyd,dc=com"
16    type=refreshAndPersist
17    retry="5 5 300 5"
18    timeout=1
19syncrepl rid=002
20    provider=ldaps://ldap02.xxyd.com
21    binddn="cn=admin,dc=xxyd,dc=com"
22    bindmethod=simple
23    credentials=PASSWD
24    searchbase="dc=xxyd,dc=com"
25    type=refreshAndPersist
26    retry="5 5 300 5"
27    timeout=1
28mirrormode TRUE
29
30## 填写本机监听地址
31# vi /etc/sysconfig/slapd
32SLAPD_URLS="ldapi:/// ldaps://ldap01.xxyd.com"
33
34
35rm -rf /etc/openldap/slapd.d/*
36slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/
37chown -R ldap.ldap /etc/openldap/slapd.d
38systemctl restart slapd
39

同步数据测试

在一台主服务器上添加或删除数据，会立即同步到另一台主服务器上即测试成功。

高可用

方案一、

客户端连接两台openldap服务器（主从或主主模式或多主模式）

第一台不可用时会自动连接到第二台

vi /etc/ldap.conf

1uri ldaps://ldap01.xxyd.com ldaps://ldap02.xxyd.com
2

重启服务

1service nscd restart
2

方案二

两台openldap服务器使用主从或主主模式

结合keepalived配置VIP实现故障切换

客户端连接域名：uri ldaps://ldap.xxyd.com，ldap.xxyd.com域名指向VIP

自助修改密码

https://www.ilanni.com/?p=13822

数据备份

1ldapsearch -x -b 'dc=xxyd,dc=com' > backupldap_$(date +%Y%m%d-%H%M).ldif
2

参考链接：

http://chuansong.me/n/317694151860 https://blog.csdn.net/m1213642578/article/details/52578360 http://www.zytrax.com/books/ldap/ch6/ppolicy.html http://blog.163.com/excellent_2008/blog/static/30760156201392362414238/ https://serverfault.com/questions/653792/ssh-key-authentication-using-ldap http://briteming.blogspot.com/2017/11/setting-up-openldap-server-with-openssh.html https://www.cnblogs.com/moonson/archive/2008/11/20/1337775.html

OpenLDAP 搭建入门

系统环境：CentOS 7

简介

整体目标

OpenLDAP 目录架构

企业级命名组织架构

openldap组件:

安装服务端

安装客户端

Ubuntu client

CentOS client

OpenLDAP用户以及用户组的添加

通过migrationtools工具导入

自定义LDIF导入

OpenLDAP加密传输

自建CA

OpenLDAP与CA集成

OpenLDAP TLS/SASL部署

客户端部署

Ubuntu客户端

CentOS客户端

sudo权限控制

客户端

centos 客户端

Ubuntu客户端

密码策略

定义用户登录修改密码

客户端配置

CentOS 客户端

Ubuntu 客户端

密码审计控制

日志

ssh public key

服务端

客户端

CentOS client

Ubuntu client

主机控制策略

服务端

Ubuntu客户端

CentOS 客户端

数据同步

主从同步

主服务器同步策略配置

编辑OpenLDAP主配置文件

重新生成数据库文件，使其配置生效

从服务器配置

编辑OpenLDAP主配置文件

重新生成数据库文件，使其配置生效

导入数据条目

重新生成数据库文件，使其配置生效

主从同步验证

多主同步（N-Way Multimaster）

服务器同步策略配置

编辑OpenLDAP配置文件

同步数据测试

高可用

方案一、

方案二

自助修改密码

数据备份

参考链接：

评论区

相关推荐