一个企业经常会碰上部署多台机器的问题，但是账号管理就成了问题，怎么在N台机器上统一部署账号管理，完成账号统一认证和管理是让我们后续非常方便的地方。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
//安装三大应用，服务端，客户端，导出导入工具
yum install -y openldap-servers openldap-clients migrationtools

//配置文件
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown ldap. /var/lib/ldap/DB_CONFIG

//启动服务
systemctl start slapd
systemctl enable slapd

//生成root密码
╭─root@ykdev ~
╰─# slappasswd
New password:
Re-enter new password:
{SSHA}/UFZ8EehpMMtKiiAy+vxdxH6fObhaF3l

//修改rootdn密码
cat chrootpw.ldif
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}/UFZ8EehpMMtKiiAy+vxdxH6fObhaF3l

ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif



//导出基础的Schema，这些 Schema 文件位于 /etc/openldap/schema/ 目录中，定义了我们以后创建的条目可以使用哪些属性
[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=cosine,cn=schema,cn=config"

[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=nis,cn=schema,cn=config"

[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=inetorgperson,cn=schema,cn=config"

//配置 LDAP 的顶级域
[root@proxy ldap]# cat chdomain.ldif
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
  read by dn.base="cn=Manager,dc=my-domain,dc=com" read by * none

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=my-domain,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=my-domain,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: {SSHA}/UFZ8EehpMMtKiiAy+vxdxH6fObhaF3l

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
  dn="cn=Manager,dc=my-domain,dc=com" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=my-domain,dc=com" write by * read

[root@localhost ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif 

//导入基础组信息什么的
[root@proxy ldap]# cat base.ldif
dn: dc=my-domain,dc=com
dc: my-domain
objectClass: top
objectClass: domain

dn: ou=People,dc=my-domain,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit

dn: ou=Group,dc=my-domain,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit

ldapadd -x -D "cn=Manager,dc=my-domain,dc=com" -W -f base.ldif

//导入用户信息
//修改域名基础信息
vi /usr/share/migrationtools/migrate_common.ph
$DEFAULT_BASE = "dc=my-domain,dc=com";
[root@proxy ldap]# /usr/share/migrationtools/migrate_passwd.pl /etc/passwd passwd.ldif
[root@proxy ldap]# /usr/share/migrationtools/migrate_group.pl /etc/group group.ldif
[root@proxy ldap]# ldapadd -x -D cn=Manager,dc=my-domain,dc=com -W -f passwd.ldif
[root@proxy ldap]# ldapadd -x -D cn=Manager,dc=my-domain,dc=com -W -f group.ldif

//查看所有记录
[root@proxy ldap]# ldapsearch -x -b "dc=my-domain,dc=com" -H ldap://192.168.1.1

至此全部搭建完毕