Install the related packages
[root@ldap ~]# yum install -y openldap openldap-clients openldap-servers migrationtools
[root@ldap ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@ldap ~]# chown ldap. /var/lib/ldap/DB_CONFIG
[root@ldap openldap-servers]# systemctl start slapd
[root@ldap openldap-servers]# systemctl enable slapd
Created symlink from /etc/systemd/system/multi-user.target.wants/slapd.service to /usr/lib/systemd/system/slapd.service.
[root@ldap ~]# setsebool -P allow_ypbind=0 authlogin_nsswitch_use_ldap=0
setsebool: SELinux is disabled.
[root@ldap ~]# netstat -tlnp | grep slapd
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 44929/slapd
tcp6 0 0 :::389 :::* LISTEN 44929/slapd
[root@ldap ~]#
Configure LDAP Settings
[root@ldap openldap-servers]# slappasswd
New password:
Re-enter new password:
{SSHA}zOBsp9sogWCV0MDoE5KzqVXXGg3fbran
[root@ldap openldap-servers]#
Create the ldif file.
[root@ldap ~]# vi chrootpw.ldif
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}zOBsp9sogWCV0MDoE5KzqVXXGg3fbran
[root@ldap ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={0}config,cn=config"
[root@ldap ~]#
Import the base schemas.
[root@ldap ~]# cd /etc/openldap/schema/
[root@ldap schema]# for def in /etc/openldap/schema/*.ldif ; do ldapadd -Y EXTERNAL -H ldapi:/// -f $def; done
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=collective,cn=schema,cn=config"
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=corba,cn=schema,cn=config"
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=core,cn=schema,cn=config"
ldap_add: Other (e.g., implementation specific) error (80)
additional info: olcAttributeTypes: Duplicate attributeType: "2.5.4.2"
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=cosine,cn=schema,cn=config"
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=duaconf,cn=schema,cn=config"
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=dyngroup,cn=schema,cn=config"
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=inetorgperson,cn=schema,cn=config"
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=java,cn=schema,cn=config"
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=misc,cn=schema,cn=config"
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=nis,cn=schema,cn=config"
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=openldap,cn=schema,cn=config"
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=pmi,cn=schema,cn=config"
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=ppolicy,cn=schema,cn=config"
[root@ldap schema]#
Set your own domain
Generate the password for Manager.
Our domain is gemii.cc, so we replaced the "dc=,dc=" with "dc=gemii, dc=cc".
And the SSHA password is replaced by the token just created.
[root@ldap schema]# slappasswd
New password:
Re-enter new password:
{SSHA}V263ZDFqrYGHyDpxOsc4rZmb/OWuIUUd
[root@ldap schema]#
[root@ldap ~]# vi chdomain.ldif
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
read by dn.base="cn=Manager,dc=gemii,dc=cc" read by * none
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=gemii,dc=cc
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=gemii,dc=cc
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}V263ZDFqrYGHyDpxOsc4rZmb/OWuIUUd
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
dn="cn=Manager,dc=gemii,dc=cc" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=gemii,dc=cc" write by * read
~
~
~
~
~
~
~
~
"chdomain.ldif" [New] 29L, 862C written
[root@ldap ~]#
[root@ldap ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={1}monitor,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
[root@ldap ~]#
[root@ldap ~]# vi basedomain.ldif
dn: dc=gemii,dc=cc
objectClass: top
objectClass: dcObject
objectclass: organization
o: Server World
dc: gemii
dn: cn=Manager,dc=gemii,dc=cc
objectClass: organizationalRole
cn: Manager
description: Directory Manager
dn: ou=People,dc=gemii,dc=cc
objectClass: organizationalUnit
ou: People
dn: ou=Group,dc=gemii,dc=cc
objectClass: organizationalUnit
ou: Group
~
~
"basedomain.ldif" [New] 20L, 361C written
[root@ldap ~]#
[root@ldap ~]# ldapadd -x -D cn=Manager,dc=gemii,dc=cc -W -f basedomain.ldif
Enter LDAP Password:
adding new entry "dc=gemii,dc=cc"
adding new entry "cn=Manager,dc=gemii,dc=cc"
adding new entry "ou=People,dc=gemii,dc=cc"
adding new entry "ou=Group,dc=gemii,dc=cc"
[root@ldap ~]#
Add firewall rule
[root@ldap ~]# firewall-cmd --add-service=ldap --permanent
success
[root@ldap ~]# firewall-cmd --reload
success
[root@ldap ~]#
Add a user
Initialize a password firstly.
[root@ldap ~]# slappasswd
New password:
Re-enter new password:
{SSHA}dyYqthUCBL7Jfll9BzAcOgI3UkF7PyJk
[root@ldap ~]#
Prepare user conf file.
[root@ldap ~]# vi ldapuser.ldif
dn: uid=cent,ou=People,dc=gemii,dc=cc
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: Cent
sn: Linux
userPassword: {SSHA}dyYqthUCBL7Jfll9BzAcOgI3UkF7PyJk
loginShell: /bin/bash
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/cent
dn: cn=cent,ou=Group,dc=gemii,dc=cc
objectClass: posixGroup
cn: Cent
gidNumber: 1000
memberUid: cent
~
"ldapuser.ldif" [New] 18L, 373C written
[root@ldap ~]#
Load the user with Manager's password.
[root@ldap ~]# ldapadd -x -D cn=Manager,dc=gemii,dc=cc -W -f ldapuser.ldif
Enter LDAP Password:
adding new entry "uid=cent,ou=People,dc=gemii,dc=cc"
adding new entry "cn=cent,ou=Group,dc=gemii,dc=cc"
[root@ldap ~]#
Install phpLDAPadmin to Manage LDAP
[root@ldap ~]# yum -y install httpd
[root@ldap ~]# vi /etc/httpd/conf/httpd.conf
# line 86: change to admin's email address
ServerAdmin root@srv.world
# line 95: change to your server's name
ServerName www.srv.world:80
# line 151: change
AllowOverride All
# line 164: add file name that it can access only with directory's name
DirectoryIndex index.html index.cgi index.php
# add follows to the end
# server's response header
ServerTokens Prod
# keepalive is ON
KeepAlive On
[root@ldap ~]# systemctl start httpd
[root@ldap ~]# systemctl enable httpd
[root@ldap ~]# firewall-cmd --add-service=http --permanent
success
[root@ldap ~]# firewall-cmd --reload
success
[root@ldap ~]# vi /var/www/html/index.html
<html>
<body>
<div style="width: 100%; font-size: 40px; font-weight: bold; text-align: center;">
Test Page
</div>
</body>
</html>
Install PHP
[root@ ldap ~]# yum -y install php php-mbstring php-pear
[root@ ldap ~]# vi /etc/php.ini
# line 878: uncomment and add your timezone
date.timezone = "Asia/Shanghai"
[root@ ldap ~]# systemctl restart httpd
[root@ ldap ~]# vi /var/www/html/index.php
<html>
<body>
<div style="width: 100%; font-size: 40px; font-weight: bold; text-align: center;">
<?php
print Date("Y/m/d");
?>
</div>
</body>
</html>
Install PHPLDAPAdmin
[root@ldap ~]# wget http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
[root@ldap ~]# rpm -ivh epel-release-latest-7.noarch.rpm
[root@ldap ~]# yum repolist ##检查是否已添加至源列表
# install from EPEL
[root@ldap ~]# yum --enablerepo=epel -y install phpldapadmin
[root@ldap ~]# vi /etc/phpldapadmin/config.php
# line 397: uncomment, line 398: comment out
$servers->setValue('login','attr','dn');
// $servers->setValue('login','attr','uid');
[root@dlp ~]# vi /etc/httpd/conf.d/phpldapadmin.conf
Alias /phpldapadmin /usr/share/phpldapadmin/htdocs
Alias /ldapadmin /usr/share/phpldapadmin/htdocs
<Directory /usr/share/phpldapadmin/htdocs>
<IfModule mod_authz_core.c>
# Apache 2.4
# line 12: add access permission
Require local
Require ip 192.168.0.0/16
[root@ldap ~]# systemctl restart httpd
Open the Admin page
http://192.168.0.137:8888/phpldapadmin/
