Centos Openldap伺服器資料庫主備（二）

標籤：

二、 Openldap伺服器明文主備配置
2.1伺服器架設
Configure OpenLDAP Replication to continue Directory service if OpenLDAP master server would be down. OpenLDAP master server is called "Provider" and OpenLDAP Slave server is called "Consumer" on OpenLDAP.
Configure Basic LDAP Server settings on both Provider and Consumer.
2.2主伺服器設定
Configure LDAP Provider. Add syncprov module
[[email protected] ~]# vim mod_syncprov.ldif
# create new

dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulePath: /usr/lib64/openldap
olcModuleLoad: syncprov.la
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f mod_syncprov.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=module,cn=config"
[[email protected] ~]# vim syncprov.ldif
# create new

dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
olcSpSessionLog: 100
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f syncprov.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "olcOverlay=syncprov,olcDatabase={2}hdb,cn=config"
2.3備份伺服器設定
Configure LDAP Consumer.
[[email protected] ~]# vim syncrepl.ldif
# create new

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcSyncRepl
olcSyncRepl: rid=001 provider=ldap://10.8.8.46:389/ bindmethod=simple binddn="cn=Manager,dc=server,dc=world" credentials=dc168 searchbase="dc=server,dc=world" scope=sub schemachecking=on type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00
[[email protected] ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f syncrepl.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={2}hdb,cn=config"
confirm settings to search datas
[[email protected] ~]# ldapsearch -x -b ‘ou=People,dc=server,dc=world‘
# People, server.world
dn: ou=People,dc=server,dc=world
objectClass: organizationalUnit
ou: People
...
...
三、基於Tls的Openldap伺服器主備配置
3.1Provider配置
需啟用Tls，且已完成非Tls相關配置。
3.2支援基於tls的Consumer備份機配置
3.2.1Provider的認證同步
將Provider的CACertificateFile、CertificateFile、CertificateKeyFile拷貝到Consumer機器的cacerts路徑

[[email protected] syncacerts]# vim tls.ldif
dn: cn=config
changetype: modify
replace: olcTLSCACertificatePath
olcTLSCACertificatePath: /etc/openldap/cacerts
-
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/openldap/cacerts/ca-bundle.crt
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/cacerts/LDAP.crt
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/cacerts/LDAP.key

Add this to the LDAP tree:
#ldapadd -Y EXTERNAL -H ldapi:/// -f tls.ldif

3.2.2啟用ldaps支援
[[email protected] certs]# vim /etc/sysconfig/ldap
set line 20, if not yet set this way, so SLAPD_LDAPS=yes

restart LDAP afterwards
[[email protected] certs]# service slapd restart
3.2.3基於tls傳輸的備份機配置
[[email protected] syncacerts]# vim syncrepl.ldif
# create new
dn: olcDatabase={2}bdb,cn=config
changetype: modify
replace: olcSyncRepl
olcSyncRepl: rid=001 provider=ldaps://66.191.103.166/ bindmethod=simple binddn="
cn=Manager,dc=dcnet,dc=com" credentials="d…1…h…s…" searchb
ase="dc=dcnet,dc=com" tls_reqcert=never starttls=yes scope=sub schemacheck
ing=on type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00

# ldapadd -Y EXTERNAL -H ldapi:/// -f syncrepl.ldif
3.2.4基於tls傳輸的備份機ldap.conf配置
如發現錯誤tls啟動錯誤，則需要查看/etc/openldap/ldap.conf配置如下：
STARTTLS yes
TLS_REQCERT never
TLS_CACERTDIR /etc/openldap/cacerts

四、Consumer伺服器samba使用者資訊備份配置
此時應可正常同步，但如果備份機不識別samba庫，則同步中含samba的部分可能無法正常，此時需要手動添加samba庫：
找到provider機器中，samba.schema檔案複製到/etc/openldap/schema檔案夾
[[email protected] syncacerts]# vim schema_convert.conf
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/collective.schema
include /etc/openldap/schema/corba.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/duaconf.schema
include /etc/openldap/schema/dyngroup.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/java.schema
include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/openldap.schema
include /etc/openldap/schema/ppolicy.schema
include /etc/openldap/schema/pmi.schema
include /etc/openldap/schema/samba.schema

mkdir ldif_output (will hold temporary schema files)
slaptest -f schema_convert.conf -F ldif_output
（或者：slapcat -f schema_convert.conf -F ldif_output -n 0 | grep samba,cn=schema）
slapcat -f schema_convert.conf -F ldif_output -n0 -H ldap:///cn={13}samba,cn=schema,cn=config -l cn=samba.ldif

Edit the generated cn=samba.ldif file by removing index information to arrive at:

dn: cn=samba,cn=schema,cn=config
...
cn: samba

Remove the bottom lines:

structuralObjectClass: olcSchemaConfig
entryUUID: b53b75ca-083f-102d-9fff-2f64fd123c95
creatorsName: cn=config
createTimestamp: 20080827045234Z
entryCSN: 20080827045234.341425Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20080827045234Z

Your attribute values will vary.

Samba indices

Now that slapd knows about the Samba attributes, we can set up some indices based on them. Indexing entries is a way to improve performance when a client performs a filtered search on the DIT.

Create the file samba_indices.ldif with the following contents:

dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcDbIndex
olcDbIndex: uidNumber eq
olcDbIndex: gidNumber eq
olcDbIndex: loginShell eq
olcDbIndex: uid eq,pres,sub
olcDbIndex: memberUid eq,pres,sub
olcDbIndex: uniqueMember eq,pres
olcDbIndex: sambaSID eq
olcDbIndex: sambaPrimaryGroupSID eq
olcDbIndex: sambaGroupType eq
olcDbIndex: sambaSIDList eq
olcDbIndex: sambaDomainName eq
olcDbIndex: default sub

dn: olcDatabase={2}bdb,cn=config
changetype: modify
add: olcDbIndex
olcDbIndex: uniqueMember eq,pres
olcDbIndex: sambaSID eq
olcDbIndex: sambaPrimaryGroupSID eq
olcDbIndex: sambaGroupType eq
olcDbIndex: sambaSIDList eq
olcDbIndex: sambaDomainName eq
olcDbIndex: default sub

Using the ldapmodify utility load the new indices:

sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f samba_indices.ldif

Centos Openldap伺服器資料庫主備（二）