如何建立 OpenLDAP server

LDAP 全名是 Lightweight Directory Access Protocol, 是一種目錄訪問協議, 在TCP/IP之上定義了一個相對簡單的升級和搜索目錄的協議。. 常見的用途有電話薄, 登入服務, 域名服務等. LDAP

今次所介紹的是 OpenLDAP 服務器的安裝方法

先安裝服務器所需軟件

sudo apt-get install slapd ldap-utils

重新設定 openldap 軟件

Dpkg-reconfigure slapd

1. omit openldap server configuration? no
2. dns domain name? example.com
3. organization name? yourCompany
4. database backend to use? bdb
5. do you want the database to be removed when slapd is purged? yes
6. may be the question: move old database? yes
7. administrator password? <your password>
8. confirm password? <your password>
9. allow LDAPv2 protocol? no

如果需要手動修改 slapd.conf, 可到 /etc/ldap/slapd.conf

# This is the main slapd configuration file. See slapd.conf(5) for more

# info on the configuration options.

#######################################################################

# Global Directives:

#

# Features to permit

allow bind_v2

# Schema and objectClass definitions

include /etc/ldap/schema/core.schema

include /etc/ldap/schema/cosine.schema

include /etc/ldap/schema/nis.schema

include /etc/ldap/schema/inetorgperson.schema

# Where the pid file is put. The init.d script

# will not stop the server if you change this.

pidfile /var/run/slapd/slapd.pid

# List of arguments that were passed to the server

argsfile /var/run/slapd/slapd.args

# Read slapd.conf(5) for possible values

“/etc/ldap/slapd.conf” 139 lines, 4760 characters

# This is the main slapd configuration file. See slapd.conf(5) for more

# info on the configuration options.

#######################################################################

# Global Directives:

# Features to permit

allow bind_v2

# Schema and objectClass definitions

include /etc/ldap/schema/core.schema

include /etc/ldap/schema/cosine.schema

include /etc/ldap/schema/nis.schema

include /etc/ldap/schema/inetorgperson.schema

# Where the pid file is put. The init.d script

# will not stop the server if you change this.

pidfile /var/run/slapd/slapd.pid

# List of arguments that were passed to the server

argsfile /var/run/slapd/slapd.args

# Read slapd.conf(5) for possible values

loglevel none

# Where the dynamically loaded modules are stored

modulepath /usr/lib/ldap

moduleload back_bdb

# The maximum number of entries that is returned for a search operation

sizelimit 500

# The tool-threads parameter sets the actual amount of cpu’s that is used

# for indexing.

tool-threads 1

#######################################################################

# Specific Backend Directives for bdb:

# Backend specific directives apply to this backend until another

# ‘backend’ directive occurs

backend bdb

#######################################################################

# Specific Backend Directives for ‘other’:

# Backend specific directives apply to this backend until another

# ‘backend’ directive occurs

#backend <other>

#######################################################################

# Specific Directives for database #1, of type bdb:

# Database specific directives apply to this databasse until another

# ‘database’ directive occurs

database bdb

# The base of your directory in database #1

suffix “dc=example,dc=com”

修改 /etc/ldap/ldap.conf (示範如下)

#

# LDAP Defaults

#

# See ldap.conf(5) for details

# This file should be world readable but not world writable.

BASE dc=example,dc=com

URI ldap://localhost:389

SIZELIMIT 12

TIMELIMIT 15

DEREF never

開始 slapd 服務器

/etc/init.d/slapd restart

測試

netstat -lvt | grep ldap

tcp 0 0 *:ldap *:* LISTEN

tcp6 0 0 [::]:ldap [::]:* LISTEN

其實 OpenLDAP 服務器的安裝方法並不複雜. 困難反而在於 client 客戶端的設定之上. 下篇文章, 將會介紹如何用 LDAP 設置 Linux 上的使用者登入系統.