使用LDAP给Linux鉴权和进行用户管理
安装LDAP：
# yum install openldap-servers
安装openSSL：
# tar -zxvf openssl-1.0.0e.tar.gz
# cd openssl-1.0.0e
# ./config -fPIC shared
# make clean
# make
# make test
# make install
默认安装位置在/usr/local/ssl/，加入export PATH=/usr/local/ssl/bin:$PATH。
# echo "/usr/local/ssl/lib" >> /etc/ld.so.conf.d/openssl.conf
# ldconfig
# ldconfig -p |grep ssl
# ldconfig -v |grep ssl
创建CA根证书，这里调用的都是CA.sh，跟使用openssl加一大堆参数是一样的：
# mkdir /etc/ssl/
# cd /etc/ssl
# /usr/local/ssl/misc/CA.sh -newca
CA certificate filename (or enter to create)
Making CA certificate ...
Generating a 1024 bit RSA private key
....................................++++++
....++++++
writing new private key to './demoCA/private/./cakey.pem'
Enter PEM pass phrase: （输入ca根证书RAS密钥口令）
Verifying - Enter PEM pass phrase:（输入ca根证书RAS密钥口令）
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Guangdong
Locality Name (eg, city) []:Shenzhen
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Hanborq Ltd.
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:nd0-rack2-cloud （必须是hostname命令的输出）
Email Address []:adaishu@gmail.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:（不填，直接回车）
An optional company name []:（不填，直接回车）
Using configuration from /usr/local/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/./cakey.pem: （上面输入的ca根证书RAS密钥口令）
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number:
97:c5:5e:6c:8f:de:20:7b
Validity
Not Before: Nov 25 02:59:48 2011 GMT
Not After : Nov 24 02:59:48 2014 GMT
Subject:
countryName = CN
stateOrProvinceName = Guangdong
organizationName = Hanborq Ltd.
commonName = nd0-rack2-cloud
emailAddress = adaishu@gmail.com
X509v3 extensions:
X509v3 Subject Key Identifier:
BA:28:AA:9C:9B:2A:49:4F:1B:1D:96:DD:61:6B:AB:23:73:9D:4A:BB
X509v3 Authority Key Identifier:
keyid:BA:28:AA:9C:9B:2A:49:4F:1B:1D:96:DD:61:6B:AB:23:73:9D:4A:BB
X509v3 Basic Constraints:
CA:TRUE
Certificate is to be certified until Nov 24 02:59:48 2014 GMT (1095 days)
Write out database with 1 new entries
Data Base Updated
生成请求证书，为了LDAP能用，必须使用-newreq-nodes，正常情况应该用-newreq：
# /usr/local/ssl/misc/CA.sh -newreq-nodes
Generating a 1024 bit RSA private key
.............................++++++
.......++++++
writing new private key to 'newreq.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Guangdong
Locality Name (eg, city) []:Shenzhen
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Hanborq Ltd.
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:nd0-rack2-cloud （必须是hostname命令的输出）
Email Address []:adaishu@gmail.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:（不填，直接回车）
An optional company name []:（不填，直接回车）
Request (and private key) is in newreq.pem
签发请求证书，就是生成签名后的证书：
# /usr/local/ssl/misc/CA.sh -sign
Using configuration from /usr/local/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number:
97:c5:5e:6c:8f:de:20:7c
Validity
Not Before: Nov 25 03:13:19 2011 GMT
Not After : Nov 24 03:13:19 2012 GMT
Subject:
countryName = CN
stateOrProvinceName = Guangdong
localityName = Shenzhen
organizationName = Hanborq Ltd.
commonName = nd0-rack2-cloud
emailAddress = adaishu@gmail.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
2F:7C:AE:2C:9D:04:CE:B6:6F:5C:91:C5:95:1C:92:9E:E4:FA:D5:66
X509v3 Authority Key Identifier:
keyid:BA:28:AA:9C:9B:2A:49:4F:1B:1D:96:DD:61:6B:AB:23:73:9D:4A:BB
Certificate is to be certified until Nov 24 03:13:19 2012 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
97:c5:5e:6c:8f:de:20:7c
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=CN, ST=Guangdong, O=Hanborq Ltd., CN=Max Shu/emailAddress=adaishu@gmail.com
Validity
Not Before: Nov 25 03:13:19 2011 GMT
Not After : Nov 24 03:13:19 2012 GMT
Subject: C=CN, ST=Guangdong, L=Shenzhen, O=Hanborq Ltd., CN=Max Shu/emailAddress=adaishu@gmail.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (1024 bit)
Modulus:
00:e3:ef:5b:50:ff:3a:14:6b:c7:72:58:90:5f:76:
2d:9c:f8:cc:34:e7:2c:07:bd:72:92:9e:47:06:44:
78:8a:bd:34:21:ed:ac:c9:1d:f3:bf:77:1a:20:a8:
75:b1:ad:4f:9f:e1:70:d1:fe:64:45:63:7b:0b:bf:
36:a7:7b:e4:4a:6e:1a:07:f3:90:78:ca:35:46:8f:
09:6e:4e:9c:c9:56:c6:f1:17:c3:53:91:f2:72:3a:
db:7d:f4:b8:38:b8:e7:d4:e2:14:03:16:f1:10:50:
cb:ab:d2:cd:18:20:97:b2:83:17:bc:47:00:d4:69:
06:3c:e4:b3:91:23:3b:d1:b7
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
2F:7C:AE:2C:9D:04:CE:B6:6F:5C:91:C5:95:1C:92:9E:E4:FA:D5:66
X509v3 Authority Key Identifier:
keyid:BA:28:AA:9C:9B:2A:49:4F:1B:1D:96:DD:61:6B:AB:23:73:9D:4A:BB
Signature Algorithm: sha1WithRSAEncryption
3a:37:db:9a:92:90:0b:c9:9e:c1:bc:bf:c2:be:e4:a5:7a:fa:
45:03:6a:cf:f0:6a:7d:0f:45:c3:a0:30:21:2f:3d:3a:c7:11:
63:f6:79:38:6e:de:9d:15:60:18:1c:d5:f1:1f:25:b1:05:e3:
56:bb:5f:d2:69:66:5c:66:50:e3:b9:06:41:3d:37:78:05:7d:
23:b8:40:d7:3b:b6:aa:59:7c:ce:dc:91:53:a5:7e:8c:dc:98:
c7:3a:ba:51:cd:f0:00:7d:1d:71:1b:22:51:ee:60:88:f8:d4:
2c:a4:d0:8b:c2:0a:55:37:a9:b2:ed:8e:9c:2e:a0:bd:31:3b:
ee:a5
-----BEGIN CERTIFICATE-----
MIIC5DCCAk2gAwIBAgIJAJfFXmyP3iB8MA0GCSqGSIb3DQEBBQUAMGwxCzAJBgNV
BAYTAkNOMRIwEAYDVQQIDAlHdWFuZ2RvbmcxFTATBgNVBAoMDEhhbmJvcnEgTHRk
LjEQMA4GA1UEAwwHTWF4IFNodTEgMB4GCSqGSIb3DQEJARYRYWRhaXNodUBnbWFp
bC5jb20wHhcNMTExMTI1MDMxMzE5WhcNMTIxMTI0MDMxMzE5WjB/MQswCQYDVQQG
EwJDTjESMBAGA1UECAwJR3Vhbmdkb25nMREwDwYDVQQHDAhTaGVuemhlbjEVMBMG
A1UECgwMSGFuYm9ycSBMdGQuMRAwDgYDVQQDDAdNYXggU2h1MSAwHgYJKoZIhvcN
AQkBFhFhZGFpc2h1QGdtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
gYEA4+9bUP86FGvHcliQX3YtnPjMNOcsB71ykp5HBkR4ir00Ie2syR3zv3caIKh1
sa1Pn+Fw0f5kRWN7C782p3vkSm4aB/OQeMo1Ro8Jbk6cyVbG8RfDU5HycjrbffS4
OLjn1OIUAxbxEFDLq9LNGCCXsoMXvEcA1GkGPOSzkSM70bcCAwEAAaN7MHkwCQYD
VR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlm
aWNhdGUwHQYDVR0OBBYEFC98riydBM62b1yRxZUckp7k+tVmMB8GA1UdIwQYMBaA
FLooqpybKklPGx2W3WFrqyNznUq7MA0GCSqGSIb3DQEBBQUAA4GBADo325qSkAvJ
nsG8v8K+5KV6+kUDas/wan0PRcOgMCEvPTrHEWP2eThu3p0VYBgc1fEfJbEF41a7
X9JpZlxmUOO5BkE9N3gFfSO4QNc7tqpZfM7ckVOlfozcmMc6ulHN8AB9HXEbIlHu
YIj41Cyk0IvCClU3qbLtjpwuoL0xO+6l
-----END CERTIFICATE-----
Signed certificate is in newcert.pem
最终生成的有用的证书就是newcert.pem，可以拷贝到别的地方使用，挪走newreq.pem和newcrt.pem之后，又可以请求和签发新证书了。
校验：
# /usr/local/ssl/misc/CA.sh -verify
newcert.pem: OK
移动证书到LDAP：
# cp /etc/ssl/newcert.pem /etc/openldap/cacerts/servercrt.pem
# cp /etc/ssl/newreq.pem /etc/openldap/cacerts/serverkey.pem
# cp /etc/ssl/demoCA/cacert.pem /etc/openldap/cacerts/cacert.pem
# chmod 400 /etc/openldap/cacerts/serverkey.pem
# chown ldap:ldap /etc/openldap/cacerts/serverkey.pem
# chmod 644 /etc/openldap/cacerts/servercrt.pem
# chown ldap:ldap /etc/openldap/cacerts/servercrt.pem
# chmod 644 /etc/openldap/cacerts/cacert.pem
# chown ldap:ldap /etc/openldap/cacerts/cacert.pem
# ll /etc/openldap/cacerts/
total 12
-rw-r--r-- 1 ldap ldap 3046 Nov 25 13:40 cacert.pem
-rw-r--r-- 1 ldap ldap 3217 Nov 25 13:40 servercrt.pem
-r-------- 1 ldap ldap 1600 Nov 25 13:40 serverkey.pem
得到ldap管理帐号的密码，下面会把这个密码加入slapd.conf的rootpw：
# slappasswd
New password:
Re-enter new password:
{SSHA}L19zkWmhL8zXnKfLDetVAwXt3Lm7qBOa
修改slapd.conf：
# vi /etc/openldap/slapd.conf
...
include /etc/openldap/schema/nis.schema
...
TLSCACertificateFile /etc/openldap/cacerts/cacert.pem
TLSCertificateFile /etc/openldap/cacerts/servercrt.pem
TLSCertificateKeyFile /etc/openldap/cacerts/serverkey.pem
...
suffix "dc=hanborq,dc=com"
rootdn "cn=Manager,dc=hanborq,dc=com"
...
rootpw {SSHA}L19zkWmhL8zXnKfLDetVAwXt3Lm7qBOa
...
access to attrs=shadowLastChange,userPassword
by self write
by * auth
access to *
by * read
...
修改/etc/openldap/ldap.conf，注意这个ldap.conf是用于ldapadd之类的工具的，如果是客户端，则还需要使用/etc/ldap.conf：
# vi /etc/openldap/ldap.conf
BASE dc=hanborq, dc=com
URI ldap://nd0-rack2-cloud ldaps://nd0-rack2-cloud:636
TLS_REQCERT allow
TLS_CACERTDIR /etc/openldap/cacerts
默认DB配置：
# cp /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
增加LOG：
# echo "local4.* /var/log/slapd.log" >> /etc/syslog.conf
# service syslog restart
启动：
# service ldap restart
测试tls是否可用：
# openssl s_client -connect nd0-rack2-cloud:636
会输出证书。
# ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts
dn:
namingContexts: dc=hanborq,dc=com 这里是正确的。
search: 2
result: 0 Success
# netstat -an | grep 389
# netstat -an | grep 636
编辑ldif文件：
# cd /etc/openldap/
# /usr/share/openldap/migration/migrate_base.pl > base.ldif
# sed -i "s/padl/hanborq/" base.ldif
编辑base.ldif，只需要三项：
# vi base.ldif
dn: dc=hanborq,dc=com
dc: hanborq
objectClass: top
objectClass: domain
dn: ou=People,dc=hanborq,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit
dn: ou=Group,dc=hanborq,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit
添加进数据库：
# ldapdelete -x -D "cn=Manager,dc=hanborq,dc=com" -W -r "dc=hanborq,dc=com"
# ldapadd -x -D "cn=Manager,dc=hanborq,dc=com" -W -f base.ldif
Enter LDAP Password: 这里口令为slapd.conf的rootpw的口令
注意这里的-D参数需要跟slapd.conf的rootdn一致，否则会出错。
这里的-x表示简单鉴权，-W为提醒输入口令。
迁移组信息：
# /usr/share/openldap/migration/migrate_group.pl /etc/group > group.ldif
# sed -i "s/padl/hanborq/" group.ldif
# ldapadd -x -D "cn=Manager,dc=hanborq,dc=com" -W -f group.ldif
迁移用户信息，其中shadow过的口令会自动加入：
# /usr/share/openldap/migration/migrate_passwd.pl /etc/passwd > passwd.ldif
# sed -i "s/padl/hanborq/" passwd.ldif
# ldapadd -x -D "cn=Manager,dc=hanborq,dc=com" -W -f passwd.ldif
检查一下：
# ldapsearch -x -b "dc=hanborq,dc=com"
可以看到所有用户和组都加入了。
URL方式检查：
非加密方式：
# ldapsearch -v -x -H ldap://nd0-rack2-cloud
SSL方式：
# ldapsearch -v -x -H ldaps://nd0-rack2-cloud:636
TLS方式，最好就用TLS方式：
# ldapsearch -v -x -h nd0-rack2-cloud -ZZ
客户端配置：
传输CA到客户端：
# scp LDAP_SERVER_IP:/etc/openldap/cacerts/cacert.pem /etc/openldap/cacerts/
下面的配置最好使用setup命令来配置。
修改/etc/sysconfig/authconfig：
# sed -i "/USELDAP=/d" /etc/sysconfig/authconfig && echo "USELDAP=yes" >> /etc/sysconfig/authconfig
# sed -i "/USELDAPAUTH=/d" /etc/sysconfig/authconfig && echo "USELDAPAUTH=yes" >> /etc/sysconfig/authconfig
# sed -i "/USEMD5=/d" /etc/sysconfig/authconfig && echo "USEMD5=yes" >> /etc/sysconfig/authconfig
# sed -i "/USESHADOW=/d" /etc/sysconfig/authconfig && echo "USESHADOW=yes" >> /etc/sysconfig/authconfig
# sed -i "/USELOCAUTHORIZE=/d" /etc/sysconfig/authconfig && echo "USELOCAUTHORIZE=yes" >> /etc/sysconfig/authconfig
修改/etc/openldap/ldap.conf：
# vi /etc/openldap/ldap.conf
BASE dc=hanborq, dc=com
URI ldap://nd0-rack2-cloud ldaps://nd0-rack2-cloud:636
TLS_REQCERT allow
TLS_CACERTDIR /etc/openldap/cacerts
修改/etc/ldap.conf和/etc/nslcd.conf，注意这个ldap.conf是用于客户端的，不是用于ldapadd之类的工具，CentOS6.x是/etc/pam_ldap.conf：
# vi /etc/ldap.conf
host nd0-rack2-cloud
base dc=hanborq,dc=com
ssl start_tls
tls_checkpeer yes
tls_cacertfile /etc/openldap/cacerts/cacert.pem
CentOS6.x需要配置/etc/nslcd.conf：
# vi /etc/nslcd.conf
uri ldap://nd0-rack2-cloud
base dc=hanborq,dc=com
ssl start_tls
tls_reqcert allow
tls_cacertdir /etc/openldap/cacerts
CentOS6.x如果不使用sssd，就不需要配置/etc/sssd/sssd.conf：
# vi /etc/sssd/sssd.conf
...
domains = default
...
[domain/default]
ldap_id_use_start_tls = True
cache_credentials = True
ldap_search_base = dc=hanborq,dc=com
chpass_provider = ldap
id_provider = ldap
auth_provider = ldap
debug_level = 0
ldap_uri = ldap://nd0-rack2-cloud
ldap_tls_cacertdir = /etc/openldap/cacerts
CentOS6.x需要重启nslcd进程，如果用非加密方式，则必须修改/etc/sysconfig/authconfig里面的FORCELEGACY=no为yes，使用TLS，则不需要修改：
# sed -i "/FORCELEGACY=/d" /etc/sysconfig/authconfig && echo "FORCELEGACY=yes" >> /etc/sysconfig/authconfig
# service nslcd restart
# service sssd restart
修改NSS:
# vi /etc/nsswitch.conf
...
passwd: files ldap
shadow: files ldap
group: files ldap
...
netgroup: files ldap
...
automount: files ldap
...
修改系统鉴权：
# vi /etc/pam.d/system-auth
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_ldap.so use_first_pass
...
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_ldap.so
...
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password sufficient pam_ldap.so use_authtok
...
session required pam_unix.so
session optional pam_ldap.so
测试：
刚才已经导入了linux的所有用户到LDAP，现在我们删除掉一个linux用户，用修改密码方式可以看到该用户已经在LDAP上面了：
# userdel nimbus
# passwd nimbus
Changing password for user nimbus.
Enter login(LDAP) password:
New UNIX password:
BAD PASSWORD: it is too simplistic/systematic
Retype new UNIX password:
LDAP password information changed for nimbus
passwd: all authentication tokens updated successfully.
登录测试：
# ssh nimbus@10.24.170
可以登录。
评论