ldap网络帐号 1.ldap是什么 ldap目录服务认证，和windows活动目录类似，就是记录数据的一种方式 LDAP 客户端配置的主要元素 1)服务器的完全限定主机名 2)基础 DN , 用于搜索用户定义 3)认证机构 (“ CA” )证书 , 用于签署 LDAP 服务器的 SSL 证书 2.ldap客户端所须软件 yum sssd krb5-workstation -y 3.如何开启ldap用户认证 authconfig-tui
<当出现以下报错时> Warning
To connect to a LDAP server with TLS
protocol enabled you need a CA certificate which signed your server's certificate. Copy the certificate in the PEM format to
the '/etc/openldap/cacerts' directory. Then press OK. 是因为tls的证书缺失，需要到服务器端下载所需要的证书到/etc/openldap/cacerts， 用到的命令 wget http://172.25.254.254/pub/example-ca.crt <检测 ldap 认证用户> getent passwd ldapuser1 如果用户信息可以正常显示，证明客户端认成功。
id ldapuser1 [root@server31 mnt]# yum clean all [root@server31 mnt]# vim auth-config.sh 1 #!/bin/bash 2 echo "installpackages..." 3 yum install sssd krb5-workstation -y&> /dev/null 4 echo "configauthconfig..." 5 authconfig \ 6 --enableldap \ 7 --enablekrb5 \ 8 --disableldapauth \ 9 --enableldaptls \ 10--ldapserver="classroom.example.com" \ 11--ldapbasedn="dc=example,dc=com" \ 12--ldaploadcacert=http://172.25.254.254/pub/example-ca.crt \ 13 --krb5realm="EXAMPLE.COM"\ 14 --krb5kdc="classroom.example.com"\ 15--krb5adminserver="classroom.example.com" \ 16 --update 17 echo "ok！！"
[root@server31 mnt]# sh auth-config.sh [root@server31 mnt]# id ldapuser1 uid=1701(ldapuser1) gid=1701(ldapuser1) groups=1701(ldapuser1) 4.自动挂载用户家目录 yum install autofs -y vim /etc/autofs.master /home/guests /etc/auto.ldap vim /etc/auto.ldap * 172.25.254.254:/home/guests/& systemctl restart autofs #!/bin/bash echo "install packages..." yum install sssd krb5-workstation autofs -y &> /dev/null echo "config authconfig..." authconfig \ --enableldap \ --enablekrb5 \ --disableldapauth \ --enableldaptls \ --ldapserver="classroom.example.com" \ --ldapbasedn="dc=example,dc=com" \ --ldaploadcacert=http://172.25.254.254/pub/example-ca.crt \ --krb5realm="EXAMPLE.COM" \ --krb5kdc="classroom.example.com" \ --krb5adminserver="classroom.example.com" \ --update echo "config autofs..." echo "/home/guests /etc/auto.ldap" >>/etc/auto.master echo "* 172.25.254.254:/home/guests/&">>/etc/auto.ldap systemctl restart autofs echo "ok！！"
