Configure LDAP Server in order to share users' accounts among local networks.
|
|
| [1] | Install openldap |
|
root@master:~#
vi /etc/hosts
127.0.0.1 localhost
# add own hostname
127.0.1.1 master.server.world master
root@master:~#
aptitude -y install slapd ldap-utils
# Input LDAP admin password during installation
# check working
root@master:~#
slapcat
dn: dc=server,dc=world objectClass: top objectClass: dcObject objectClass: organization o: server.world dc: server structuralObjectClass: organization entryUUID: dca957c0-2e16-1031-8dca-fb8c238ea817 creatorsName: cn=admin,dc=server,dc=world createTimestamp: 20120509113546Z entryCSN: 20120509113546.006578Z#000000#000#000000 modifiersName: cn=admin,dc=server,dc=world modifyTimestamp: 20120509113546Z dn: cn=admin,dc=server,dc=world objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: e1NTSEF9VDFtMjFLZVpqTkZjWFRmckE5Y01QM0pkUXFwSXdNOWg= structuralObjectClass: organizationalRole entryUUID: dcb4b048-2e16-1031-8dcb-fb8c238ea817 creatorsName: cn=admin,dc=server,dc=world createTimestamp: 20120509113546Z entryCSN: 20120509113546.080941Z#000000#000#000000 modifiersName: cn=admin,dc=server,dc=world modifyTimestamp: 20120509113546Z |
| [2] | Add new directory |
|
root@master:~#
vi base.ldif
# create new
# change to your own suffix for the field 'dc=server,dc=world'
dn: ou=people,dc=server,dc=world objectClass: organizationalUnit ou: people dn: ou=groups,dc=server,dc=world objectClass: organizationalUnit ou: groups
ldapadd -x -D cn=admin,dc=server,dc=world -W -f base.ldif
Enter LDAP Password:
# LDAP admin password (set in installation of openldap)
adding new entry "ou=people,dc=server,dc=world" adding new entry "ou=groups,dc=server,dc=world" |
| [3] | Add existing local users to LDAP directory |
|
root@master:~#
vi ldapuser.sh
# extract local users who have 4-digit UID
# this is an example
#!/bin/bash
SUFFIX='dc=server,dc=world'
LDIF='ldapuser.ldif'
echo -n > $LDIF
for line in `grep "x:[1-9][0-9][0-9][0-9]:" /etc/passwd | sed -e "s/ /%/g"`
do
UID1=`echo $line | cut -d: -f1`
NAME=`echo $line | cut -d: -f5 | cut -d, -f1`
if [ ! "$NAME" ]
then
NAME=$UID1
else
NAME=`echo $NAME | sed -e "s/%/ /g"`
fi
SN=`echo $NAME | awk '{print $2}'`
if [ ! "$SN" ]
then
SN=$NAME
fi
GIVEN=`echo $NAME | awk '{print $1}'`
UID2=`echo $line | cut -d: -f3`
GID=`echo $line | cut -d: -f4`
PASS=`grep $UID1: /etc/shadow | cut -d: -f2`
SHELL=`echo $line | cut -d: -f7`
HOME=`echo $line | cut -d: -f6`
EXPIRE=`passwd -S $UID1 | awk '{print $7}'`
FLAG=`grep $UID1: /etc/shadow | cut -d: -f9`
if [ ! "$FLAG" ]
then
FLAG="0"
fi
WARN=`passwd -S $UID1 | awk '{print $6}'`
MIN=`passwd -S $UID1 | awk '{print $4}'`
MAX=`passwd -S $UID1 | awk '{print $5}'`
LAST=`grep $UID1: /etc/shadow | cut -d: -f3`
echo "dn: uid=$UID1,ou=people,$SUFFIX" >> $LDIF
echo "objectClass: inetOrgPerson" >> $LDIF
echo "objectClass: posixAccount" >> $LDIF
echo "objectClass: shadowAccount" >> $LDIF
echo "uid: $UID1" >> $LDIF
echo "sn: $SN" >> $LDIF
echo "givenName: $GIVEN" >> $LDIF
echo "cn: $NAME" >> $LDIF
echo "displayName: $NAME" >> $LDIF
echo "uidNumber: $UID2" >> $LDIF
echo "gidNumber: $GID" >> $LDIF
echo "userPassword: {crypt}$PASS" >> $LDIF
echo "gecos: $NAME" >> $LDIF
echo "loginShell: $SHELL" >> $LDIF
echo "homeDirectory: $HOME" >> $LDIF
echo "shadowExpire: $EXPIRE" >> $LDIF
echo "shadowFlag: $FLAG" >> $LDIF
echo "shadowWarning: $WARN" >> $LDIF
echo "shadowMin: $MIN" >> $LDIF
echo "shadowMax: $MAX" >> $LDIF
echo "shadowLastChange: $LAST" >> $LDIF
echo >> $LDIF
done
sh ldapuser.sh
root@master:~#
ldapadd -x -D cn=admin,dc=server,dc=world -W -f ldapuser.ldif
Enter LDAP Password:
# admin password
adding new entry "uid=pangolin,ou=people,dc=server,dc=world" adding new entry "uid=ubuntu,ou=people,dc=server,dc=world" adding new entry "uid=fedora,ou=people,dc=server,dc=world" adding new entry "uid=cent,ou=people,dc=server,dc=world" |
| [4] | Add existing local groups to LDAP directory |
|
root@master:~#
vi ldapgroup.sh
# extract local groups who have 4-digit UID
# this is an example
#!/bin/bash
SUFFIX='dc=server,dc=world'
LDIF='ldapgroup.ldif'
echo -n > $LDIF
for line in `grep "x:[1-9][0-9][0-9][0-9]:" /etc/group`
do
CN=`echo $line | cut -d: -f1`
GID=`echo $line | cut -d: -f3`
echo "dn: cn=$CN,ou=groups,$SUFFIX" >> $LDIF
echo "objectClass: posixGroup" >> $LDIF
echo "cn: $CN" >> $LDIF
echo "gidNumber: $GID" >> $LDIF
users=`echo $line | cut -d: -f4 | sed "s/,/ /g"`
for user in ${users} ; do
echo "memberUid: ${user}" >> $LDIF
done
echo >> $LDIF
done
sh ldapgroup.sh
root@master:~#
ldapadd -x -D cn=admin,dc=server,dc=world -W -f ldapgroup.ldif
Enter LDAP Password:
# admin password
adding new entry "cn=pangolin,ou=groups,dc=server,dc=world" adding new entry "cn=ubuntu,ou=groups,dc=server,dc=world" adding new entry "cn=fedora,ou=groups,dc=server,dc=world" adding new entry "cn=cent,ou=groups,dc=server,dc=world" |
| [5] | If you'd like to delete User or Group in LDAP, Do as below. |
ldapdelete -x -W -D 'cn=admin,dc=server,dc=world' "uid=ubuntu,ou=people,dc=server,dc=world"
Enter LDAP Password:
root@master:~#
ldapdelete -x -W -D 'cn=admin,dc=server,dc=world' "cn=ubuntu,ou=groups,dc=server,dc=world"
Enter LDAP Password:
Post a Comment