码迷,mamicode.com
首页 > 其他好文 > 详细

centos7.7部署openldap2.4.44主从复制

时间:2019-12-23 15:09:24      阅读:158      评论:0      收藏:0      [点我收藏+]

标签:ref   Fix   and   ace   open   aliyun   搜索   vco   monitor   

本次部署使用Syncrepl同步模式,你是否还在为到处都是更改slapd.conf配置文件的部署方案苦恼,现在的ldap都是使用只需要写ldif配置文件更改即可。

 

节点信息

IP hostname role
172.16.0.124 ldap-master OpenLDAP Master
172.16.0.125 ldap-slave OpenLDAP Slave


os:CentOS Linux release 7.7.1908 (Core)

关闭selinux和防火墙

sed -i s/SELINUX=enforcing/SELINUX=disabled/g /etc/selinux/config
systemctl stop firewalld
systemctl disable firewalld
setenforce 0

更换yum源和epel源

mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
mv /etc/yum.repos.d/epel.repo /etc/yum.repos.d/epel.repo.backup
mv /etc/yum.repos.d/epel-testing.repo /etc/yum.repos.d/epel-testing.repo.backup
    wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo

同步时间

/bin/cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
ntpdate ntp1.ali.com

vim /etc/htp.conf#更改下面的配置
server ntp1.aliyun.com iburst
server ntp2.aliyun.com iburst
server ntp3.aliyun.com iburst
server ntp4.aliyun.com iburst


systemctl enable --now ntpd
ntpq -p

更改hostname

# 172.16.0.124
hostnamectl set-hostname ldap-master
# 172.16.0.125
hostnamectl set-hostname ldap-slave

安装OpenLDAP

yum -y install openldap compat-openldap openldap-clients openldap-servers openldap-servers-sql openldap-devel

systemctl enable --now slapd

slapd -VV
@(#) $OpenLDAP: slapd 2.4.44 (Jan 29 2019 17:42:45) $
    mockbuild@x86-01.bsys.centos.org:/builddir/build/BUILD/openldap-2.4.44/openldap-2.4.44/servers/slapd

配置OpenLDAP

生成LDAP管理员密码

slappasswd -h {SSHA} -s yLeZkAqinY0=
{SSHA}aIz8E51fHTX0ICILImDEXbGbqh9UesrS

设定数据库


cat > db.ldif <<EOF
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=datamind,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=datamind,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW:{SSHA}aIz8E51fHTX0ICILImDEXbGbqh9UesrS
EOF
#olcRootPW使用上面生成的密码

[root@ldap-master ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f db.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={2}hdb,cn=config"


modifying entry "olcDatabase={2}hdb,cn=config"


modifying entry "olcDatabase={2}hdb,cn=config"

修改/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif, 不需要手动修改文件,使用更新配置的方式更改。

cat > monitor.ldif <<EOF
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external, cn=auth" read by dn.base="cn=Manager,dc=datamind,dc=com" read by * none
EOF

[root@ldap-master ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f monitor.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={1}monitor,cn=config"

配置ldap数据库

cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

导入基础schema

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif

配置openldap基础数据库

cat > base.ldif <<EOF
dn: dc=datamind,dc=com
dc: datamind
objectClass: top
objectClass: domain

dn: cn=Manager,dc=datamind,dc=com
objectClass: organizationalRole
cn: Manager
description: LDAP Manager

dn: ou=provider,dc=datamind,dc=com
objectClass: organizationalUnit
ou: People

dn: ou=users,ou=provider,dc=datamind,dc=com
objectClass: organizationalUnit
ou: Group
EOF

ldapadd -x -w yLeZkAqinY0= -D "cn=Manager,dc=datamind,dc=com" -f base.ldif

开启日志

cat > loglevel.ldif << EOF
dn: cn=config
changetype: modify
replace: olcLogLevel
olcLogLevel: stats
EOF

[root@ldap-master ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f loglevel.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"

echo local4.* /var/log/slapd.log >> /etc/rsyslog.conf

systemctl restart rsyslog
systemctl restart slapd

 

配置master

创建一个对所有LDAP对象具有读访问权限的用户,用作slave访问master

cat > rpuser.ldif <<EOF
dn: uid=repl,dc=datamind,dc=com
objectClass: simpleSecurityObject
objectclass: account
uid: repl
description: Replication User
userPassword: root1234
EOF

ldapadd -x -w yLeZkAqinY0= -D "cn=Manager,dc=datamind,dc=com" -f rpuser.ldif

开启syncprov module

cat >syncprov_mod.ldif <<EOF
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulePath: /usr/lib64/openldap
olcModuleLoad: syncprov.la
EOF

[root@ldap-master ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f syncprov_mod.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=module,cn=config"

为每个目录开启syncprov

cat >syncprov.ldif <<EOF
dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
olcSpSessionLog: 100
EOF

[root@ldap-master ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f syncprov.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "olcOverlay=syncprov,olcDatabase={2}hdb,cn=config"

 

配置slave

配置同步

cat >syncrepl.ldif <<EOF
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcSyncRepl
olcSyncRepl: rid=001
  provider=ldap://172.16.0.124:389/
  bindmethod=simple
  binddn="uid=repl,dc=datamind,dc=com"
  credentials=root1234
  searchbase="dc=datamind,dc=com"
  scope=sub
  schemachecking=on
  type=refreshAndPersist
  retry="30 5 300 3"
  interval=00:00:05:00
EOF

ldapmodify -Y EXTERNAL  -H ldapi:/// -f syncrepl.ldif

 

测试LDAP的主从复制

在master上添加测试账号

cat > ldaptest.ldif << EOF
dn: uid=repltest,ou=users,ou=provider,dc=datamind,dc=com
uid: repltest
cn: repltest
sn: repltest
mail: repltest@datamind.com
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: 123456
shadowLastChange: 17763
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1099
gidNumber: 1099
homeDirectory: /home/repltest
EOF

ldapadd -x -w yLeZkAqinY0= -D "cn=Manager,dc=datamind,dc=com" -f ldaptest.ldif

在slave中搜索用户

[root@ldap-slave ~]# ldapsearch -x cn=repltest -b dc=datamind,dc=com
# extended LDIF
#
# LDAPv3
# base <dc=datamind,dc=com> with scope subtree
# filter: cn=repltest
# requesting: ALL
#

# repltest, users, provider, datamind.com
dn: uid=repltest,ou=users,ou=provider,dc=datamind,dc=com
uid: repltest
cn: repltest
sn: repltest
mail: repltest@datamind.com
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword:: MTIzNDU2
shadowLastChange: 17763
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1099
gidNumber: 1099
homeDirectory: /home/repltest

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

客户端绑定slave

authconfig --enableldap --enableldapauth --ldapserver=172.16.0.124,172.16.0.125 --ldapbasedn="dc=datamind,dc=com" --enablemkhomedir --update

centos7.7部署openldap2.4.44主从复制

标签:ref   Fix   and   ace   open   aliyun   搜索   vco   monitor   

原文地址:https://www.cnblogs.com/hope123/p/12083552.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!