OPENLDAP RHEL7
SERVIDOR:
Instalação dos pacotes necessários:
[root@ldap ~]#yum install openldap openldap-clients openlda-servers migrationtools
Gerando a senha e o certificado:
[root@ldap ~]# slappasswd -n > /etc/openldap/passwd
New password:
Re-enter new password:
[root@ldap ~]# cat /etc/openldap/passwd
{SSHA}RzdNb3SLWI3kaTwWawePv15IWierde7k
[root@ldap ~]#openssl req -new -x509 -nodes -out /etc/openldap/certs/cert.pem -keyout /etc/openldap/certs/priv.pem -days 365
O common name deve ser o nome FQDN do servidor.
Alterando permissões de segurança:
[root@ldap ~]#chown ldap:ldap /etc/openldap/certs/*
[root@ldap ~]#chmod 600 /etc/openldap/certs/priv.pem
Preparar a base de dados LDAP:
[root@ldap ~]#cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
Gerar a base de dados:
[root@ldap ~]#slaptest
Desconsiderar erros apresentados nesse comando.
Alterar o dono da base LDAP:
[root@ldap ~]#chown ldap:ldap /var/lib/ldap/*
Ativar e iniciar o serviço:
[root@ldap ~]#systemctl enable slapd.service
[root@ldap ~]#systemctl start slapd.service
[root@ldap ~]# netstat -lt | grep ldap
tcp 0 0 0.0.0.0:ldap 0.0.0.0:* OUÇA
tcp6 0 0 [::]:ldap [::]:* OUÇA
Adicionar schemas:
[root@ldap ~]# cd /etc/openldap/schema/
[root@ldap schema]# ldapadd -Y EXTERNAL -H ldapi:/// -D “cn=config” -f cosine.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry “cn=cosine,cn=schema,cn=config”
[root@ldap schema]# ldapadd -Y EXTERNAL -H ldapi:/// -D “cn=config” -f nis.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry “cn=nis,cn=schema,cn=config”
Criar LDIF:
[root@ldap ~]#vi /etc/openldap/changes.ldif
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=example,dc=com
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=example,dc=com
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: nesse ponto, copiar a senha do arquivo /etc/openldap/passwd (gerada com o comando slappasswd) e colar aqui.
dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/cert.pem
dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/priv.pem
dn: cn=config
changetype: modify
replace: olcLogLevel
olcLogLevel: -1
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=example,dc=com" read by * none
Enviar a configuração para o slapd:
[root@ldap ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/openldap/changes.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry “olcDatabase={2}hdb,cn=config”
modifying entry “olcDatabase={2}hdb,cn=config”
modifying entry “olcDatabase={2}hdb,cn=config”
modifying entry “cn=config”
modifying entry “cn=config”
modifying entry “cn=config”
modifying entry “olcDatabase={1}monitor,cn=config”
Criar o base.ldif:
[root@ldap ~]#vi /etc/openldap/base.ldif
dn: dc=example,dc=com
dc: example
objectClass: top
objectClass: domain
dn: ou=People,dc=example,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit
dn: ou=Group,dc=example,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit
Construir a estrutura de serviço de diretórios:
[root@ldap ~]# ldapadd -x -W -D cn=Manager,dc=example,dc=com -f /etc/openldap/base.ldif
Enter LDAP Password:
adding new entry “dc=example,dc=com”
adding new entry “ou=People,dc=example,dc=com”
adding new entry “ou=Group,dc=example,dc=com”
Criar usuários para teste:
[root@ldap ~]#mkdir /home/guests
[root@ldap ~]#useradd -d /home/guests/ldapuser01 ldapuser01 | passwd ldapuser01
[root@ldap ~]#useradd -d /home/guests/ldapuser02 ldapuser02 | passwd ldapuser02
[root@ldap ~]#useradd -d /home/guests/ldapuser03 ldapuser03 | passwd ldapuser03
Alterar o nome do domínio:
[root@ldap ~]#cd /usr/share/migrationtools/
[root@ldap ~]#sed -i ‘s/padl/example/g’ migrate_common.ph
Adicionar os usuários ao serviço de diretório:
[root@ldap ~]#tail -n 3 /etc/passwd > users
[root@ldap ~]#./migrate_passwd.pl users users.ldif
[root@ldap migrationtools]# ldapadd -x -W -D cn=Manager,dc=example,dc=com -f users.ldif
Enter LDAP Password:
adding new entry “uid=ldapuser01,ou=People,dc=example,dc=com”
adding new entry “uid=ldapuser02,ou=People,dc=example,dc=com”
adding new entry “uid=ldapuser03,ou=People,dc=example,dc=com”
[root@ldap ~]#tail -n 3 /etc/group > groups
[root@ldap ~]#./migrate_group.pl groups groups.ldif
[root@ldap migrationtools]# ldapadd -x -W -D cn=Manager,dc=example,dc=com -f groups.ldif
Enter LDAP Password:
adding new entry “cn=ldapuser01,ou=Group,dc=example,dc=com”
adding new entry “cn=ldapuser02,ou=Group,dc=example,dc=com”
adding new entry “cn=ldapuser03,ou=Group,dc=example,dc=com”
Testar a configuração:
[root@ldap ~]#ldapsearch -x cn=ldapuser01 -b dc=example,dc=com
Configurar o firewall e o serviço de log:
[root@ldap ~]#firewall-cmd –permanent –add-service=ldap
[root@ldap ~]#firewall-cmd –reload
[root@ldap ~]#vi /etc/rsyslog.conf
local4.* /var/log/ldap.log
Disponibilizar o certificado via web (Opcional):
[root@ldap ~]#yum install httpd
[root@ldap ~]#systemctl enable httpd
[root@ldap ~]#systemctl start httpd
[root@ldap ~]#firewall-cmd –permanent –add-service=http
[root@ldap ~]#firewall-cmd –reload
[root@ldap ~]#cp /etc/openldap/certs/cert.pem /var/www/html
CLIENTES:
Instalar os pacotes:
[root@client1 ~]#yum install openldap-clients nss-pam-ldapd
Configurar resolução do nome do servidor:
[root@client1 ~]#echo ‘192.168.122.60 ldap.example.com ldap’ >> /etc/hosts
[root@client1 ~]#ping ldap.example.com
Configurar autenticação LDAP:
[root@client1 ~]#authconfig-tui
– Cache Information
– Use LDAP
– Use MD5 Passwords
– Use Shadow Passwords
– Use LDAP Authentication
– Local authorization is sufficient
Use TLS
ldap://ldap.example.com
dc=example,dc=com
[root@client1 ~]#scp ldap.example.com:/etc/openldap/certs/cert.pem /etc/openldap/cacerts/
ou
[root@client1 ~]#wget -O /etc/openldap/cacerts/cert.pem http://ldap.example.com/cert.pem (caso o httpd tenha sido configurado)
[root@client1 ~]#getent passwd ldapuser01
Caso não retorne nenhum resultado, repetir o processo de autenticação (authconfig-tui).
MONTAGEM AUTOMÁTICA DO DIRETÓRIO HOME (SERVIDOR)
Instalar pacotes:
[root@ldap ~]#yum groupinstall file-server
Configurar o firewall:
[root@ldap ~]#firewall-cmd –permanent –add-service=nfs
[root@ldap ~]#firewall-cmd –reload
Ativar e iniciar os serviços:
[root@ldap ~]#systemctl enable nfs-server.service
[root@ldap ~]#systemctl enable nfs-idmap.service
[root@ldap ~]#systemctl start nfs-server.service
[root@ldap ~]#systemctl start nfs-idmap.service
Configurar permissões;
[root@ldap ~]#chmod 777 /home/guests/
Configurar o contexto SELinux:
[root@ldap ~]#yum install -y setroubleshoot-server
[root@ldap ~]#semanage fcontext -a -t public_content_rw_t “/home/guests(/.*)?”
[root@ldap ~]#restorecon -R /home/guests/
[root@ldap ~]# setsebool -P nfs_export_all_rw on
[root@ldap ~]# setsebool -P nfs_export_all_ro on
[root@ldap ~]# setsebool -P use_nfs_home_dirs on
ou
Desabilitar o SELinux:
[root@ldap ~]#getenforce
Enforcing
[root@ldap ~]#sed -i ‘s/SELINUX=enforcing/SELINUX=disabled/g’ /etc/selinux/config
[root@ldap ~]#reboot
Exportar o diretório:
[root@ldap ~]# vi /etc/exports
/home/guests *(rw,no_root_squash)
[root@ldap ~]#exportfs -avr
[root@ldap ~]#systemctl restart nfs-server
[root@ldap ~]#showmount -e localhost
MONTAGEM AUTOMÁTICA DO DIRETÓRIO HOME (CLIENTE)
Instalar pacotes:
[root@client1 ~]#yum install -y autofs nfs-utils
Configurar o automount:
[root@client1 ~]#vi /etc/auto.master.d/guests.autofs
/home/guests /etc/auto.guests
[root@client1 ~]#vi /etc/auto.guests
* -rw,sync ldap.example.com:/home/guests/&
Ativar e iniciar o serviço:
[root@client1 ~]#systemctl enable autofs
[root@client1 ~]#systemctl start autofs
Testar o login:
[root@client1 ~]# su – ldapuser01
[ldapuser01@client1 ~]$ pwd
/home/guests/ldapuser01
Verificar a montagem do diretório:
[ldapuser02@client1 ~]$ df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/rhel-root 7.9G 847M 7.0G 11% /
devtmpfs 491M 0 491M 0% /dev
tmpfs 498M 0 498M 0% /dev/shm
tmpfs 498M 6.6M 491M 2% /run
tmpfs 498M 0 498M 0% /sys/fs/cgroup
/dev/mapper/rhel-home 997M 33M 965M 4% /home
/dev/vda1 497M 97M 401M 20% /boot
ldap.example.com:/home/guests/ldapuser01 997M 33M 965M 4% /home/guests/ldapuser01
linux4sysadmin 