![[PukiWiki]](image/owl.png "[PukiWiki]")
'Memo/Linux/OpenLDAP/' には、下位層のページがありません。
属性に "::" がついているとバイナリ値。base64でエンコードされている。
例:
# 通常の場合 sshPublicKey: ssh-rsa ... # 末尾に"\r\n"が入っている場合 sshPublicKey:: c3NoLXJ...
dn: uid=jayson,ou=people,o=example,dc=com changetype: modify delete: userPassword userPassword: OldPassword add: userPassword userPassword: NewPassword
$modifications = array( array( "attrib" => "userPassword", "modtype" => LDAP_MODIFY_BATCH_REMOVE, "values" => array($oldpassword), ), array( "attrib" => "userPassword", "modtype" => LDAP_MODIFY_BATCH_ADD, "values" => array($password), ), ); $bmod = ldap_modify_batch($ldap, $dn, $modifications);
sudo service slapd stop sudo vim /etc/openldap/slapd.conf ---- index description eq ---- sudo slapindex sudo service slapd start
loglevel stats sync
local4.* /var/log/openldap/slapd.log
/var/log/openldap/*.log {
daily
missingok
compress
notifempty
copytruncate
}sudo service rsyslog restartldapmodify -x -H 'ldap://localhost' -D 'cn=Manager,dc=my-domain,dc=com' -W <<EOS dn: uid=user01,ou=People,dc=my-domain,dc=com changetype: modify replace: sshPublicKey sshPublicKey: ssh-rsa replaced EOS
echo "dn: uid=user01,ou=People,dc=my-domain,dc=com changetype: modify replace: sshPublicKey sshPublicKey: ssh-rsa replaced " | ldapmodify -x -H 'ldap://localhost' -D 'cn=Manager,dc=my-domain,dc=com' -W
LDAPの一般ユーザが以下の事をブラウザから簡単に行いたい。
sudo vim /etc/nslcd.conf ---- nss_initgroups_ignoreusers ALLLOCAL ---- sudo service nslcd restart
cat /etc/nsswitch.conf passwd: files ldap shadow: files ldap group: files ldap # キャッシュ等を停止 sudo service nscd stop sudo service nslcd stop # debug modeで起動 sudo nslcd -d # 別ターミナルでidコマンドを使って確認 id local_user id ldap_user
sudo vim /etc/nslcd.conf ---- timelimit 60 idle_timelimit 240 ---- sudo service nslcd restart
ls -l /etc/pam.d/*auth* -rw-r--r-- 1 root root 766 2016-09-01 09:00 /etc/pam.d/fingerprint-auth lrwxrwxrwx 1 root root 27 2016-09-01 09:00 /etc/pam.d/fingerprint-auth-ac -> /etc/pam.d/fingerprint-auth -rw-r--r-- 1 root root 869 2016-09-01 09:00 /etc/pam.d/password-auth lrwxrwxrwx 1 root root 24 2016-09-01 09:00 /etc/pam.d/password-auth-ac -> /etc/pam.d/password-auth -rw-r--r-- 1 root root 879 2016-09-01 09:00 /etc/pam.d/smartcard-auth lrwxrwxrwx 1 root root 25 2016-09-01 09:00 /etc/pam.d/smartcard-auth-ac -> /etc/pam.d/smartcard-auth -rw-r--r-- 1 root root 869 2016-09-01 09:00 /etc/pam.d/system-auth lrwxrwxrwx 1 root root 22 2016-09-01 09:00 /etc/pam.d/system-auth-ac -> /etc/pam.d/system-auth
sudo yum install authconfig rpm -q authconfig authconfig-6.1.12-23.el6.x86_64 sudo authconfig --update
ls -l /etc/pam.d/*auth* lrwxrwxrwx 1 root root 19 2016-11-16 06:00 /etc/pam.d/fingerprint-auth -> fingerprint-auth-ac lrwxrwxrwx 1 root root 27 2016-09-01 09:00 /etc/pam.d/fingerprint-auth-ac -> /etc/pam.d/fingerprint-auth lrwxrwxrwx 1 root root 16 2016-11-16 06:00 /etc/pam.d/password-auth -> password-auth-ac lrwxrwxrwx 1 root root 24 2016-09-01 09:00 /etc/pam.d/password-auth-ac -> /etc/pam.d/password-auth lrwxrwxrwx 1 root root 17 2016-11-16 06:00 /etc/pam.d/smartcard-auth -> smartcard-auth-ac lrwxrwxrwx 1 root root 25 2016-09-01 09:00 /etc/pam.d/smartcard-auth-ac -> /etc/pam.d/smartcard-auth lrwxrwxrwx 1 root root 14 2016-11-16 06:00 /etc/pam.d/system-auth -> system-auth-ac lrwxrwxrwx 1 root root 22 2016-09-01 09:00 /etc/pam.d/system-auth-ac -> /etc/pam.d/system-auth
diff -uwr schema/inetorgperson.schema schema.2.4.40-12/inetorgperson.schema --- schema/inetorgperson.schema 2012-11-30 22:38:35.000000000 +0900 +++ schema.2.4.40-12/inetorgperson.schema 2016-05-11 08:32:09.000000000 +0900 @@ -151,5 +151,5 @@ labeledURI $ mail $ manager $ mobile $ o $ pager $ photo $ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIdentifier $ preferredLanguage $ - userSMIMECertificate $ userPKCS12 $ c ) + userSMIMECertificate $ userPKCS12 ) )
slapadd等でLDAPスキーマが不足している場合は、「str2ad(sudoUser): attribute type undefined」の様なエラーが出る。
# sudo.schemaを追加 find /usr/share/doc/ -name schema.OpenLDAP /usr/share/doc/sudo-1.8.6p3/schema.OpenLDAP sudo cp /usr/share/doc/sudo-1.8.6p3/schema.OpenLDAP /etc/openldap/schema/sudo.schema # openssh.schema, ldapns.schemaを追加 sudo yum install openssh-ldap pam_ldap -y find /usr/share/doc/ -name openssh-lpk-openldap.schema /usr/share/doc/openssh-ldap-5.3p1/openssh-lpk-openldap.schema sudo cp /usr/share/doc/openssh-ldap-5.3p1/openssh-lpk-openldap.schema /etc/openldap/schema/openssh.schema find /usr/share/doc/ -name ldapns.schema /usr/share/doc/pam_ldap-185/ldapns.schema sudo cp /usr/share/doc/pam_ldap-185/ldapns.schema /etc/openldap/schema/ sudo vim /etc/openldap/slapd.conf ---- include /etc/openldap/schema/sudo.schema include /etc/openldap/schema/openssh.schema include /etc/openldap/schema/ldapns.schema ----
sudo service nslcd stop sudo nslcd -d # デバッグ終了時に CTRL+C
LANG=C; authconfig-tuisudo -V | grep 'ldap.conf path:' ldap.conf path: /etc/ldap.conf.sudo
ln -s /etc/ldap.conf /etc/ldap.conf.sudo
現状2つ方法があるようだ。
AuthorizedKeysCommand /usr/libexec/openssh/ssh-ldap-wrapper AuthorizedKeysCommandRunAs root
AuthorizedKeysCommand /usr/libexec/openssh/ssh-ldap-wrapper AuthorizedKeysCommandUser root
sudo authconfig --update
# 設定変更 LANG=C sudo authconfig-tui # 設定確認 sudo authconfig --test # 変更されるファイル /etc/nscl.conf /etc/nsswitch.conf /etc/pam_ldap.conf /etc/openldap/ldap.conf /etc/sysconfig/authconfig /etc/pam.d/*
ldapdelete -x -H ldap://localhost:389 \ -D "cn=Manager,dc=my-domain,dc=com" \ -W \ 'uid=user03,ou=People,dc=my-domain,dc=com'
rpm -ivh http://dl.iuscommunity.org/pub/ius/stable/Redhat/6/x86_64/ius-release-1.0-11.ius.el6.noarch.rpm rpm -ivh http://dl.iuscommunity.org/pub/ius/stable/Redhat/6/x86_64/epel-release-6-5.noarch.rpm yum install yum-plugin-replace yum replace openldap-servers --replace-with openldap24-servers --enablerepo=ius-dev
sudo vim /etc/openldap/slapd.conf ---- # database config より上に記述 password-hash {SHA} ---- sudo service slapd stop sudo rm -rf /etc/openldap/slapd.d/{cn=config,cn=config.ldif} sudo -u ldap slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d sudo service slapd restart
ハッシュ化パスワードを生成する。
# 入力待ち slappasswd New password: Re-enter new password: {SSHA}CfGz6P2+x1YoIAjBnIsezTJvROGXQFMw # パスワード指定 slappasswd -s secret {SSHA}H8R+xa45GRrDhntW8NzXO0pP5btUnAz3 # Hash methodの指定: {SHA}, {SSHA}, {MD5}, {SMD5}, {CRYPT}, {CLEARTEXT} slappasswd -s secret -h {SHA} {SHA}5en6G6MezRroT3XKqkdPOmY/BfQ=
ldappasswd -x -H 'ldap://localhost' \ -D 'uid=user01,l=apac,ou=users,dc=my-domain,dc=com' \ -W -S -A 'uid=user01,l=apac,ou=users,dc=my-domain,dc=com' Old password: *** Re-enter old password: *** New password: *** Re-enter new password: *** Enter LDAP Password: ***
ldappasswd -x -H 'ldap://localhost' -D 'cn=Manager,dc=my-domain,dc=com' -w 'Manager password' -s 'new password' 'uid=user01,l=apac,ou=users,dc=my-domain,dc=com'
ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax
sudo vim /etc/openldap/slapd.conf ---- include /etc/openldap/schema/inetorgperson.schema ---- # slapd.conf 更新 sudo service slapd stop sudo rm -rf /etc/openldap/slapd.d/{cn=config,cn=config.ldif} sudo -u ldap slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d sudo service slapd restart
# 1つめのエントリ dn: uid=user01,ou=People,dc=my-domain,dc=com uid: user01 cn: Test User 01 objectClass: account objectClass: posixAccount objectClass: top loginShell: /bin/bash uidNumber: 5001 gidNumber: 3001 homeDirectory: /home/user01 # 2つめのエントリ dn: uid=user02,ou=People,dc=my-domain,dc=com uid: user02 cn: Test User 02 objectClass: account objectClass: posixAccount objectClass: top loginShell: /bin/bash uidNumber: 5002 gidNumber: 3002 homeDirectory: /home/user02
ldapsearch -x -H 'ldap://localhost' -b 'dc=my-domain,dc=com' -D 'cn=Manager,dc=my-domain,dc=com' -w 'YOUR PASSWORD' '(objectClass=posixAccount)' -LLL | \ grep uidNumber: | \ cut -f 2 -d ' ' | \ sort -nr | \ head -n 1
ldapsearch -x -b 'dc=my-domain,dc=com' '(uid=hoge)' \ -H ldaps://localhost:636 \ -D "cn=Manager,dc=my-domain,dc=com" \ -W
ldaps://での通信時に発生。SSL自己証明書等を利用していると出る。
openldap-clientsのみの場合でも有効。
vim /etc/openldap/ldap.conf ---- tls_reqcert never ----
# インストール yum install pam_ldap nscd nss-pam-ldapd # デフォルトでTLS認証が嫌な場合は以下をyesに変更 vim /etc/sysconfig/authconfig ---- FORCELEGACY=yes ---- # 認証情報設定(/etc/nsswitch.conf, /etc/pam.d/system-auth-ac, /etc/openldap/ldap.conf が変更される) authconfig --enableldap --enableldapauth --ldapserver="ldap://[LDAP SERVER]/" --ldapbasedn="dc=my-domain,dc=com" --update authconfig --test | grep -i ldap chkconfig nslcd on # ホームディレクトリが無い場合は自動作成 echo "session optional pam_mkhomedir.so skel=/etc/skel umask=022" >> /etc/pam.d/system-auth-ac
authconfig --disableldap --disableldapauth --update authconfig --test | grep -i ldap
デフォルトでは以下のディレクトリはadminユーザでも見えない。
# "database bdb" の前に追加 sudo vim /etc/openldap/slapd.conf ---- # enable on-the-fly configuration (cn=config) database config access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by dn.exact="cn=Manager,dc=my-domain,dc=com" manage by * none # enable server status monitoring (cn=monitor) database monitor access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.exact="cn=Manager,dc=my-domain,dc=com" read by * none ---- sudo service slapd stop sudo rm -rf /etc/openldap/slapd.d/{cn=config,cn=config.ldif} sudo -u ldap slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d sudo service slapd restart
ldapsearch -x \ -b "cn=Uptime,cn=Time,cn=Monitor" \ -D "cn=Manager,dc=my-domain,dc=com" \ -W \ monitoredInfo -LLL # 結果 dn: cn=Uptime,cn=Time,cn=Monitor monitoredInfo: 111
mirrormode off
ldapsearch -x -H ldap://localhost \ -s base -b "dc=my-domain,dc=com" \ -D "cn=Manager,dc=my-domain,dc=com" \ -W contextCSN contextCSN: 20130906022414.910401Z#000000#001#000000 contextCSN: 20130906013314.290742Z#000000#002#000000
ldap-status.sh
yum install openldap-clients chmod 755 ldap-status.sh ./ldap-status.sh --servers ldap://server01/,ldap://server02/ \ --base-dn dc=my-domain,dc=com \ --bind-dn cn=Manager,dc=my-domain,dc=com \ --bind-password YOUR-PASSWORD \ replication-status
ldap-backup.sh
yum install s3cmd --enablerepo=epel s3cmd --configure chmod 755 ldap-backup.sh ./ldap-backup.sh \ --base-dn "dc=yourDC,dc=local" \ --backup-dir /path/to/backup \ --log-dir /tmp \ --s3cmd-config /path/to/.s3cfg \ --s3-bucket s3://BUCKET/path/to
sudo service slapd stop sudo find /var/lib/ldap/ -type f ! -name DB_CONFIG -delete sudo find /etc/openldap/slapd.d/ ! -name slapd.d -delete sudo -u ldap slapadd -l /tmp/ldap.backup.ldif sudo -u ldap slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d sudo service slapd start
記事:
yum install openldap-servers openldap-clients # rootパスワードの設定。"{SSHA}〜"をメモ slappasswd -s secret # Berkeley DB設定 cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG vim /var/lib/ldap/DB_CONFIG ---- # one 0.25 GB cache set_cachesize 0 268435456 1 # Transaction Log settings set_lg_regionmax 262144 set_lg_bsize 2097152 # automatically delete transaction logs set_flags DB_LOG_AUTOREMOVE ---- # slapd.conf 設定変更 cp /usr/share/openldap-servers/slapd.conf.obsolete /etc/openldap/slapd.conf vim /etc/openldap/slapd.conf ---- # suffixの変更 suffix "dc=my-domain,dc=com" # rootdnの変更 rootdn "cn=Manager,dc=my-domain,dc=com" # rootpwの変更 rootpw {SSHA}XACqUDuUFVNjgfn+JPFilYB1X852Xepi ---- # slapd.conf テスト slaptest -u -f /etc/openldap/slapd.conf -v # slapd.conf 更新 sudo service slapd stop sudo rm -rf /etc/openldap/slapd.d/{cn=config,cn=config.ldif} sudo -u ldap slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d sudo service slapd restart
ldif-example.zip
ldapadd -x -D "cn=Manager,dc=my-domain,dc=com" -W -f ./base.ldif ldapadd -x -D "cn=Manager,dc=my-domain,dc=com" -W -f ./group.ldif ldapadd -x -D "cn=Manager,dc=my-domain,dc=com" -W -f ./user.ldif
# rootユーザで検索 ldapsearch -x -b 'dc=my-domain,dc=com' '(objectClass=*)' \ -H ldap://localhost \ -D "cn=Manager,dc=my-domain,dc=com" \ -W # 外部サービス接続用のユーザで検索 ldapsearch -x -b 'dc=my-domain,dc=com' '(objectClass=*)' \ -H ldap://localhost \ -D "cn=connector,ou=People,dc=my-domain,dc=com" \ -W
