Linux--RH134---unit 8 ldap网络帐号
ldap网络帐号
1.ldap是什么
ldap目录服务认证,和windows活动目录类似,就是记录数据的一种方式
LDAP 客户端配置的主要元素
1)服务器的完全限定主机名
2)基础 DN , 用于搜索用户定义
3)认证机构 (“ CA” )证书 ,
用于签署 LDAP 服务器的 SSL 证书
2.ldap客户端所须软件
yum sssd krb5-workstation -y
3.如何开启ldap用户认证
authconfig-tui
<当出现以下报错时>
Warning
To connect to a LDAP server with TLS
protocol enabled you need a CA certificate
which signed your server's certificate.
Copy the certificate in the PEM format to
the '/etc/openldap/cacerts' directory.
Then press OK.
是因为tls的证书缺失,需要到服务器端下载所需要的证书到/etc/openldap/cacerts,
用到的命令
wget http://172.25.254.254/pub/example-ca.crt
<检测 ldap 认证用户>
getent passwd ldapuser1
如果用户信息可以正常显示,证明客户端认成功。
id ldapuser1
[[email protected] mnt]# yum clean all
[[email protected] mnt]# vim auth-config.sh
1 #!/bin/bash
2 echo "installpackages..."
3 yum install sssd krb5-workstation -y&> /dev/null
4 echo "configauthconfig..."
5 authconfig \
6 --enableldap \
7 --enablekrb5 \
8 --disableldapauth \
9 --enableldaptls \
10--ldapserver="classroom.example.com" \
11--ldapbasedn="dc=example,dc=com" \
12--ldaploadcacert=http://172.25.254.254/pub/example-ca.crt \
13 --krb5realm="EXAMPLE.COM"\
14 --krb5kdc="classroom.example.com"\
15--krb5adminserver="classroom.example.com" \
16 --update
17 echo "ok!!"
[[email protected] mnt]# sh auth-config.sh
[[email protected] mnt]# id ldapuser1
uid=1701(ldapuser1) gid=1701(ldapuser1) groups=1701(ldapuser1)
4.自动挂载用户家目录
yum install autofs -y
vim /etc/autofs.master
/home/guests /etc/auto.ldap
vim /etc/auto.ldap
* 172.25.254.254:/home/guests/&
systemctl restart autofs
#!/bin/bash
echo "install packages..."
yum install sssd krb5-workstation autofs -y &> /dev/null
echo "config authconfig..."
authconfig \
--enableldap \
--enablekrb5 \
--disableldapauth \
--enableldaptls \
--ldapserver="classroom.example.com" \
--ldapbasedn="dc=example,dc=com" \
--ldaploadcacert=http://172.25.254.254/pub/example-ca.crt \
--krb5realm="EXAMPLE.COM" \
--krb5kdc="classroom.example.com" \
--krb5adminserver="classroom.example.com" \
--update
echo "config autofs..."
echo "/home/guests /etc/auto.ldap" >>/etc/auto.master
echo "* 172.25.254.254:/home/guests/&">>/etc/auto.ldap
systemctl restart autofs
echo "ok!!"