This tutorial explains how you can set up LDAP user authentication on a CentOS 5.x system.
Domain name: shadow.com
LDAP Server IP: 192.168.56.1
Server Configuration
Packages needed: openldap-servers
[root@icewalker ~]# vi /etc/openldap/slapd.conf
Set these values to:
suffix "dc=shadow,dc=com"
rootdn "cn=root,dc=shadow,dc=com"
Set root’s password:
rootpw your_desired_password
We can encrypt our admin password; for that run the slappasswd command. It will ask you for a password, and after you enter it twice, it'll spit out a line like this:
{SSHA}04b5U6YTzQ651v9EB+l7e0FEXoEmB/Up
and use it as
rootpw {SSHA}04b5U6YTzQ651v9EB+l7e0FEXoEmB/Up
Test your configuration by running the
slaptest -u
command.
[root@icewalker ~]# cp /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@icewalker ~]# service ldap start
[root@icewalker ~]# chkconfig ldap on
Now we need to set up our base, authentication and group files. That is, we'll establish our basic parameters for the LDAP server, then migrate over (most of) the user accounts, and (most of) the group accounts.
[root@icewalker ~]# cd /usr/share/openldap/migration
[root@icewalker ~]# ./migrate_base.pl > base.ldif
In base.ldif we require only the following sections:
dn: dc=padl,dc=com
dc: padl
objectClass: top
objectClass: domain
dn: ou=People,dc=padl,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit
dn: ou=Group,dc=padl,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit
Replace all padl with shadow so that it becomes:
dn: dc=shadow,dc=com
dc: shadow
objectClass: top
objectClass: domain
dn: ou=People,dc=shadow,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit
dn: ou=Group,dc=shadow,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit
Now, we can import that information into our LDAP database using this command:
[root@icewalker ~]# ldapadd -x -W -D “cn=root,dc=shadow,dc=com” -f ./base.ldif
We need to tell the script where to find password information. We do that by setting the shell variable ETC_SHADOW to be /etc/shadow. This command will do just that:
[root@icewalker ~]# export ETC_SHADOW=/etc/shadow
Then, we can run
[root@icewalker ~]# ./migrate_passwd.pl /etc/passwd people.ldif
In the people.ldif file delete all sections except the required user's section and replace all padl with shadow.
[root@icewalker migration]# cat people.ldif
dn: uid=basil,ou=People,dc=shadow,dc=com
uid: basil
cn: Basil Kurian
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}$1$Dr0hxwtg$.zGk8MIf57AHmj6vpD07n.
shadowLastChange: 14791
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 500
gidNumber: 500
homeDirectory: /home/basil
gecos: Basil Kurian
[root@icewalker migration]# ./migrate_group.pl /etc/group group.ldif
Again, replace instances of padl with linuxclass, and remove extraneous groups.
[root@icewalker migration]# cat group.ldif
dn: cn=basil,ou=Group,dc=shadow,dc=com
objectClass: posixGroup
objectClass: top
cn: basil
userPassword: {crypt}x
gidNumber: 500
After you've done that, it's time to import the two files to ldap:
[root@icewalker migration]# ldapadd -x -W -D “cn=root,dc=shadow,dc=com” -f people.ldif
[root@icewalker migration]# ldapadd -x -W -D “cn=root,dc=shadow,dc=com” -f group.ldif
Now, we have our database populated with info. It's time to test our work. First, you can use the ldapsearch command to look for your username:
[root@icewalker migration]# ldapsearch -x ‘cn=basil’
Client Configuration
Use authconfig-gtk or authconfig-tui:
[root@icewalker migration]# authconfig-gtk
Choose Enable LDAP Support.
LDAP Search Base DN should be dc=shadow,dc=com
LDAP server, we'll enter ldap://192.168.56.1, that is the server's IP.
How To Clear LDAP Database
First stop LDAP:
[root@icewalker ~]# service ldap stop
Go to the /var/lib/ldap directory (this is the directory containing your database; this directory is specified in the slapd.conf file).
[root@icewalker ~]# cd /var/lib/ldap
Remove all databases by using:
[root@icewalker ~]# rm *
Again start the LDAP service and populate it with data.
分享到:
相关推荐
官方离线安装包,测试可用。使用rpm -ivh [rpm完整包名] 进行安装
LDAP-based Authentication for Samba. This document demonstrates how to install and configure Samba as a primary Domain Controller with a secure LDAP-based authentication mechanism.
Softerra LDAP Administrator 2019.1 最新版本,功能齐全,稳定
资源分类:Python库 所属语言:Python 资源全名:trytond_ldap_authentication-3.2.0.tar.gz 资源来源:官方 安装方法:https://lanzao.blog.csdn.net/article/details/101784059
官方离线安装包,测试可用。使用rpm -ivh [rpm完整包名] 进行安装
在windows系统上搭建并配置一个LDAP服务器的LDAP admin连接工具。
1. LDAP客户端工具 2. 可以用于LDAP的管理 3. 功能包括添加条目、查询等等 4. 经典的LDAP Browser的升级版本
官方离线安装包,测试可用。使用rpm -ivh [rpm完整包名] 进行安装
含 org.apache.jmeter.protocol.ldap.config.* org.apache.jmeter.protocol.ldap.control.* org.apache.jmeter.protocol.ldap.sampler.*
对基于LDAP统一身份认证架构下的802.1x的无线接入认证整合进行研究。提出并建立了一套保障信息安全的全局身份认证管理系统,在采用RC4安全加密技术的基础上,实现了基于RADIUS的无线802.1x/EAP接入认证和基于LDAP的...
CentOS和Linueox、组装Linux (White box Linux)、Tao Linux 、X/OS Linux,及科学Linux (Scientific Linux)等都以红帽所发布的源代码原件重建Red Hat Enterprise Linux的翻版,并修正了已经发现了的redhat的...
详细的配置过程: 一.配置 authentication sources .... 添加用户认证有两种方法 方法一:为Authentication Source导入LDAP中的用户 ....
官方离线安装包,测试可用。使用rpm -ivh [rpm完整包名] 进行安装
ldapbrowser-4.5.10625.0-x86-eng 挺好用的工具 大家可以试下哦
官方离线安装包,亲测可用。使用rpm -ivh [rpm完整包名] 进行安装
C# 访问Directory或eDirectory的引用DLL文件,使用Novell.Directory.Ldap.dll Samples.zip 例程库所必须的动态链接库
openldap 在 centOS 6.x 版本上配置全教程
python库。 资源全名:ldap0-1.4.1.tar.gz
资源分类:Python库 所属语言:Python 资源全名:python-ldap-2.4.43.tar.gz 资源来源:官方 安装方法:https://lanzao.blog.csdn.net/article/details/101784059
HackTheBox机器:分析,LDAP盲注入以获取凭据.zip