• ldap + kerberos 整合


    第一部分:ldap

    1. 安装ldap

    yum install -y openldap openldap-clients openldap-servers openldap-devel



    2. 配置ldap

    复制代码
    # cat /etc/openldap/slapd.conf 
    include /etc/openldap/schema/core.schema
    include /etc/openldap/schema/cosine.schema
    include /etc/openldap/schema/inetorgperson.schema
    include /etc/openldap/schema/misc.schema
    include /etc/openldap/schema/nis.schema
    include /etc/openldap/schema/kerberos.schema

    pidfile     /var/run/openldap/slapd.pid
    argsfile    /var/run/openldap/slapd.args

    loglevel 135
    idletimeout 5
    writetimeout 5

    access to attrs=userPassword
        by self read
        by dn.exact="cn=ops,ou=Control,dc=lishen,dc=com" write
        by anonymous auth

    access to dn.subtree="cn=Kerberos,dc=lishen,dc=com"
        by dn.exact="cn=kdc-adm,ou=Control,dc=lishen,dc=com" write
        by dn.exact="cn=kdc-srv,ou=Control,dc=lishen,dc=com" read
        by * none

    access to dn.base=""
        by * read

    access to *
        by self write
        by dn.base="cn=ops,ou=Control,dc=lishen,dc=com" write
        by users read
        by anonymous read

    #TLSCipherSuite        HIGH:MEDIUM:-SSLv2
    #TLSVerifyClient       never
    TLSCertificateFile    /etc/openldap/certs/server.pem
    TLSCertificateKeyFile /etc/openldap/certs/server.pem
    TLSCACertificateFile  /etc/openldap/certs/server.pem

    #######################################################################
    # BDB database definitions
    #######################################################################
    database    hdb
    suffix      "dc=lishen,dc=com"
    checkpoint  32    30
    rootdn      "cn=root,ou=Control,dc=lishen,dc=com"
    rootpw      {SSHA}ifM5X6pQS2eO8hODguTPmjRLFyCnVWvP
    directory   /var/lib/ldap/
    dbconfig    set_cachesize  0 268435456 1
    dbconfig    set_lg_regionmax 262144
    dbconfig    set_lg_bsize 2097152
    index       objectClass,entryCSN,entryUUID eq
    index       uid,uidNumber,gidNumber eq,pres
    index       ou,krbPrincipalName eq,pres,sub
    复制代码


    说明:
    1. rootpw 后面的密码是由命令 slappasswd -s 123456 生成
    2. 证书使用命令生成:openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout server.pem -days 36500 


    3. 启动openldap服务:slapd

    service slapd restart


    4. 测试:现在数据库是空的

    slapcat
    ldapsearch -x -D 'cn=root,ou=Control,dc=lishen,dc=com' -w 123456 -h 127.0.0.1 -b 'dc=lishen,dc=com'


    5. 初始化数据库
    准备ldif文件:

    复制代码

    cat init.ldif 
    dn: dc=lishen,dc=com
    dc: lishen
    objectClass: domain
    objectClass: dcObject

    dn: ou=Group,dc=lishen,dc=com
    ou: Group
    objectClass: organizationalUnit

    dn: ou=Aliases,dc=lishen,dc=com
    ou: Aliases
    objectClass: organizationalUnit

    dn: ou=People,dc=lishen,dc=com
    ou: People
    objectClass: organizationalUnit

    dn: cn=Kerberos,dc=lishen,dc=com
    cn: Kerberos
    objectClass: organizationalRole

    dn: ou=Control,dc=lishen,dc=com
    ou: Control
    objectClass: organizationalUnit

    dn: cn=kdc-srv,ou=Control,dc=lishen,dc=com
    cn: kdc-srv
    userPassword:: e1NTSEF9cUNhclpCYXN1SWhGRExkQ1o4bUxTbkMyZXg3bXQ2UTMK
    objectClass: simpleSecurityObject
    objectClass: organizationalRole

    dn: cn=kdc-adm,ou=Control,dc=lishen,dc=com
    cn: kdc-adm
    userPassword:: e1NTSEF9cUNhclpCYXN1SWhGRExkQ1o4bUxTbkMyZXg3bXQ2UTMK
    objectClass: simpleSecurityObject
    objectClass: organizationalRole

    dn: cn=root,ou=Control,dc=lishen,dc=com
    cn: root
    userPassword:: e1NTSEF9cUNhclpCYXN1SWhGRExkQ1o4bUxTbkMyZXg3bXQ2UTMK
    objectClass: simpleSecurityObject
    objectClass: organizationalRole

    dn: cn=demo_users,ou=Group,dc=lishen,dc=com
    cn: demo_users
    gidNumber: 20000
    objectClass: posixGroup

    dn: uid=test,ou=People,dc=lishen,dc=com
    uid: test
    uidNumber: 10000
    gidNumber: 20000
    sn: Test
    cn: Test User
    loginShell: /bin/bash
    homeDirectory: /home/users/test
    objectClass: person
    objectClass: posixAccount
    objectClass: inetOrgPerson
    objectClass: organizationalPerson

    复制代码


    说明:文件中的userPassword由命令slappasswd  -s 123456 | base64生成

    执行命令导入数据:ldapadd -x -D 'cn=root,ou=Control,dc=lishen,dc=com' -w 123456 -h 127.0.0.1 -f init.ldif

    执行命令验证数据导入是否成功: ldapsearch -x -D 'cn=root,ou=Control,dc=lishen,dc=com' -w 123456 -h 127.0.0.1 -b 'dc=lishen,dc=com'

    6. 去掉配置文件中配置的rootdn密码,因为ldif文件中已经配置了密码
    注释掉slapd.conf文件中的rootpw      {SSHA}J/6iFFDlPhucaupBEI9V//gkIFTZBNrr
    重启slapd:service slapd restart
    测试是否密码正确:ldapsearch -x -D 'cn=root,ou=Control,dc=lishen,dc=com' -w 123456 -h 127.0.0.1 -b 'dc=lishen,dc=com'

    7. 现在如果要使用LDAP作为用户认证,只需要给用户(uid=test)添加userPassword属性即可
    准备ldif文件:

    cat add.ldif
    dn: uid=test,ou=People,dc=lishen,dc=com
    changetype: modify
    add: userPassword
    userPassword:: e1NTSEF9Ym0rZXloV1ExalB1aWNEVU1BaHlNM0hZVHh3REIrWU4K

    执行命令:ldapmodify -x -D  'cn=root,ou=Control,dc=lishen,dc=com' -w 123456 -h 127.0.0.1 -f add.ldif 

    如果需要更改密码,ldif例子如下:

    复制代码

    # cat /tmp/change.ldif 
    dn: cn=kdc-adm,ou=Control,dc=demo,dc=local
    changetype: modify
    replace: userPassword
    userPassword: e1NTSEF9aGc5OGh0OGVlbiszaGk3OFhkRVlWc0MzNWJ2SWRCcG8K


    dn: cn=kdc-srv,ou=Control,dc=demo,dc=local
    changetype: modify
    replace: userPassword
    userPassword: e1NTSEF9aGc5OGh0OGVlbiszaGk3OFhkRVlWc0MzNWJ2SWRCcG8K
    复制代码


    执行命令:ldapmodify -x -D  'cn=root,ou=Control,dc=lishen,dc=com' -w 123456 -h 127.0.0.1 -f change.ldif 


    第二部分:kerberos

    1. 安装kerberos

    yum install krb5-server krb5-libs


    2. 配置Kerberos

    复制代码
    cat /etc/krb5.conf 
    [libdefaults]
        debug = false
        default_realm = LISHEN.COM

    [realms]
        LISHEN.COM = {
            kdc = 127.0.0.1
            admin_server = 127.0.0.1
            default_domain = lishen.com
            database_module = openldap_ldapconf
            key_stash_file = /etc/krb5.LISHEN.COM
            max_life = 1d 0h 0m 0s
            max_renewable_life = 90d 0h 0m 0s
            dict_file = /usr/share/dict/words
        }

    [domain_realm]
        .lishen.com = LISHEN.COM
         lishen.com = LISHEN.COM

    [logging]
        default = SYSLOG
        admin_server = FILE:/var/log/kadmind.log
        kdc = FILE:/var/log/kdc.log

    [dbdefaults]
        ldap_kerberos_container_dn = cn=Kerberos,dc=lishen,dc=com

    [dbmodules]
        openldap_ldapconf = {
            db_library = kldap
            ldap_servers = ldapi://
            ldap_kerberos_container_dn = cn=Kerberos,dc=lishen,dc=com
            ldap_kdc_dn = cn=kdc-srv,ou=Control,dc=lishen,dc=com
            ldap_kadmind_dn = cn=kdc-adm,ou=Control,dc=lishen,dc=com
            ldap_service_password_file = /etc/krb5.ldap
            ldap_conns_per_server = 5

        }

    复制代码

        
    说明: ldap_kerberos_container_dn must start with a 'cn'.    

    4. 生成访问ldap的服务密码文件

    kdb5_ldap_util -D cn=root,ou=Control,dc=lishen,dc=com  -w 123456 stashsrvpw -f /etc/krb5.ldap  cn=kdc-srv,ou=Control,dc=lishen,dc=com
    kdb5_ldap_util -D cn=root,ou=Control,dc=lishen,dc=com  -w 123456 stashsrvpw -f /etc/krb5.ldap  cn=kdc-adm,ou=Control,dc=lishen,dc=com


    5. 创建kerberos数据库

    kdb5_ldap_util -D cn=root,ou=Control,dc=lishen,dc=com -H ldap://  create  -r LISHEN.COM


    6. 启动kerberos
    #

    service krb5kdc restart


    7. 测试:添加用户

    复制代码
    # kadmin.local 
    Authenticating as principal root/admin@LISHEN.COM with password.
    kadmin.local:  addprinc test
    WARNING: no policy specified for test@LISHEN.COM; defaulting to no policy
    Enter password for principal "test@LISHEN.COM": 
    Re-enter password for principal "test@LISHEN.COM": 
    Principal "test@LISHEN.COM" created.

    #slapcat |grep "test"
    dn: uid=test,ou=People,dc=lishen,dc=com
    uid: test
    homeDirectory: /home/users/test
    dn: krbPrincipalName=test@LISHEN.COM,cn=LISHEN.COM,cn=Kerberos,dc=lishen,dc=co
    krbPrincipalName: test@LISHEN.COM

    复制代码

    添加用户成功

    测试获取凭证:

    复制代码
    # kinit test
    Password for test@LISHEN.COM: 
    # klist 
    Ticket cache: FILE:/tmp/krb5cc_0
    Default principal: test@LISHEN.COM

    Valid starting       Expires              Service principal
    10/16/2016 02:11:55  10/17/2016 02:11:55  krbtgt/LISHEN.COM@LISHEN.COM


    复制代码


    帮助:
    1. http://blog.clanzx.net/2013/09/27/ldap-kerberos.html
    2. http://web.mit.edu/KERBEROS/krb5-1.12/doc/admin/conf_ldap.html
    3. http://docs.adaptivecomputing.com/viewpoint/hpc/Content/topics/1-setup/installSetup/settingUpOpenLDAPOnCentos6.htm
    4. http://secfree.github.io/blog/2015/06/29/kerberos-ldap-deploy.html#kdc--kadmin--dn--acl
    5. http://ian.wang/69.htm
    6. https://help.ubuntu.com/lts/serverguide/kerberos-ldap.html#kerberos-ldap-openldap

    ldap使用工具:http://directory.apache.org/studio/

  • 相关阅读:
    Silverlight学习(五)图形标绘
    Silverlight学习(四) domainservice动态多条件查询
    MySQL之单表查询
    mysql外键的三种关系
    mysql之完整性约束
    接口类和抽象类的区别
    mysql中的sql_mode
    html5本地存储技术 localstorage
    mysql数值类型
    mysql
  • 原文地址:https://www.cnblogs.com/felixzh/p/9525749.html
Copyright © 2020-2023  润新知