***************************

***********ldap************

***************************

1.ldap是什么

ldap目录服务认证，和windows活动目录类似，就是记录数据的一种方式

2.ldap客户端所需软件

yum install sssd krb5-workstation -y

3.如何开启ldap用户认证

authconfig-tui

┌────────────────┤ Authentication Configuration ├─────────────────┐

│                                                                 │

│  User Information        Authentication                         │

│  [ ] Cache Information   [ ] Use MD5 Passwords                  │

│  [*] Use LDAP            [*] Use Shadow Passwords               │

│  [ ] Use NIS             [ ] Use LDAP Authentication            │

│  [ ] Use IPAv2           [*] Use Kerberos                       │

│  [ ] Use Winbind         [ ] Use Fingerprint reader             │

│                          [ ] Use Winbind Authentication         │

│                          [*] Local authorization is sufficient  │

│                                                                 │

│            ┌────────┐                      ┌──────┐             │

│            │ Cancel │                      │ Next │             │

│            └────────┘                      └──────┘             │

│                                                                 │

│                                                                 │

└─────────────────────────────────────────────────────────────────┘

┌─────────────────┤ LDAP Settings ├─────────────────┐

│                                                   │

│          [*] Use TLS                              │

│  Server: ldap://cla***oom.example.com/___________ │

│ Base DN: dc=example,dc=com_______________________ │

│                                                   │

│         ┌──────┐                ┌──────┐          │

│         │ Back │                │ Next │          │

│         └──────┘                └──────┘          │

│                                                   │

│                                                   │

└───────────────────────────────────────────────────┘

┌─────────────────┤ Kerberos Settings ├──────────────────┐

│                                                        │

│        Realm: EXAMPLE.COM_____________________________ │

│          KDC: cla***oom.example.com___________________ │

│ Admin Server: cla***oom.example.com___________________ │

│               [ ] Use DNS to resolve hosts to realms   │

│               [ ] Use DNS to locate KDCs for realms    │

│                                                        │

│          ┌──────┐                    ┌────┐            │

│          │ Back │                    │ Ok │            │

│          └──────┘                    └────┘            │

│                                                        │

│                                                        │

└────────────────────────────────────────────────────────┘

【补图】

如果有提示证书文件缺失的话，是因为tls的证书缺失，需要到服务器端下载所需要的证书到/etc/openldap/cacerts,

用到的命令

wget http://172.25.254.254/pub/example-ca.crt

<测试>

getent passwd ldapuser1

如果用户信息可以正常显示，证明客户端认证成功。

列出所有用户

vim /etc/sssd/sssd.conf

enumerate = True

4.自动挂载用户家目录

yum install autofs -y

vim /etc/auto.master

/home/guests/etc/auto.ldap

vim /etc/auto.ldap

ldapuser1172.25.254.254:/home/guests/ldapuser1

————————————————————————————————————————————————————————

*172.25.254.254:/home/guests/&

systemctl restart autofs

systemctl enable autofs

5.【在新的机子上执行脚本获得上述所有功能,脚本如下】

#!/bin/bash

echo "install software ing ..."

yum install sssd krb5-workstation autofs -y &>/dev/null

echo "config ldap auth client ing ..."

authconfig \

--enableldap \

--enablekrb5 \

--disableldapauth \

--enableldaptls \

--ldaploadcacert=http://172.25.254.254/pub/example-ca.crt \

--ldapserver="cla***oom.example.com" \

--ldapbasedn="dc=example,dc=com" \

--krb5realm="EXAMPLE.COM" \

--krb5kdc="cla***oom.example.com" \

--krb5adminserver="cla***oom.example.com" \

--enablesssd \

--enablesssdauth \

--update

echo "config ldap user\'s home dirctory ing ..."

echo /home/guests       /etc/auto.ldap >> /etc/auto.master

echo "*         172.25.254.254:/home/guests/&" >> /etc/auto.ldap

systemctl restart autofs

systemctl enable autofs &> /dev/null

echo " All is Successfully !!!"

*******查询authconfig命令内容*****

authconfig --help | less