ldap网络账号

ldap网络账号

######ldap网络帐号#####1.什么是ldap？ldap目录服务认证，和windows活动目录类似，就是记录数据的一种方式

2.ldap客户端所须软件yum sssd krb5-workstation -y

3.如何开启ldap用户认证authconfig-tui

┌────────────────┤ Authentication Configuration ├─────────────────┐                       │                                                                 │                        │  User Information        Authentication                         │                        │  [ ] Cache Information   [ ] Use MD5 Passwords                  │                        │  [*] Use LDAP            [*] Use Shadow Passwords               │                        │  [ ] Use NIS             [ ] Use LDAP Authentication            │                        │  [ ] Use IPAv2           [*] Use Kerberos                       │                        │  [ ] Use Winbind         [ ] Use Fingerprint reader             │                        │                          [ ] Use Winbind Authentication         │                        │                          [*] Local authorization is sufficient  │                        │                                                                 │                        │            ┌────────┐                      ┌──────┐             │                        │            │ Cancel │                      │ Next │             │                        │            └────────┘                      └──────┘             │                        │                                                                 │                        │                                                                 │                        └─────────────────────────────────────────────────────────────────┘

┌─────────────────┤ LDAP Settings ├─────────────────┐                              │                                                   │                               │          [*] Use TLS                              │                               │  Server: ldap://classroom.example.com/___________ │                               │ Base DN: dc=example,dc=com_______________________ │                               │                                                   │                               │         ┌──────┐                ┌──────┐          │                               │         │ Back │                │ Next │          │                               │         └──────┘                └──────┘          │                               │                                                   │                               │                                                   │                               └───────────────────────────────────────────────────┘

┌─────────────────┤ Kerberos Settings ├──────────────────┐                           │                                                        │                            │        Realm: EXAMPLE.COM_____________________________ │                            │          KDC: classroom.example.com___________________ │                            │ Admin Server: classroom.example.com___________________ │                            │               [ ] Use DNS to resolve hosts to realms   │                            │               [ ] Use DNS to locate KDCs for realms    │                            │                                                        │                            │          ┌──────┐                    ┌────┐            │                            │          │ Back │                    │ Ok │            │                            │          └──────┘                    └────┘            │                            │                                                        │                            │                                                        │                            └────────────────────────────────────────────────────────┘                                                                                      <当出现以下报错时>

┌────────────────┤ Warning ├─────────────────┐                                 │                                            │                                  │ To connect to a LDAP server with TLS       │                                  │ protocol enabled you need a CA certificate │                                  │ which signed your server's certificate.    │                                  │ Copy the certificate in the PEM format to  │                                  │ the '/etc/openldap/cacerts' directory.     │                                  │ Then press OK.                             │                                  │                                            │                                  │                  ┌────┐                    │                                  │                  │ Ok │                    │                                  │                  └────┘                    │                                  │                                            │                                  │                                            │                                  └────────────────────────────────────────────┘                                                                                 时因为tls的证书缺失，需要到服务器端下载所需要的证书到/etc/openldap/cacerts，用到的命令wget getent passwd ldapuser1如果用户信息可以正常显示，证明客户端认成功。

4.自动挂载用户家目录yum install autofs -yvim /etc/autofs.master/home/guests /etc/auto.ldap

vim /etc/auto.ldapldapuser1 172.25.254.254:/home/guests/ldapuser1+++++++++++++++++++++++++++++++++++++++++++++++++++++++*  172.25.254.254:/home/guests/&

systemctl restart autofs ####建立脚本执行ldap####vim set-ldap.sh#!/bin/bashecho "install software ing ..."yum install sssd krb5-workstation autofs -y

echo "config ldap auth client ing ..."authconfig \--enableldap \--enablekrb5 \--disableldapauth \--enableldaptls \--ldaploadcacert=\--ldapserver="classroom.example.com" \--ldapbasedn="dc=example,dc=com" \--krb5realm="EXAMPLE.COM" \--krb5kdc="classroom.example.com" \--krb5adminserver="classroom.example.com" \--enablesssd \--enablesssdauth \--update \

echo "config ldap user\'s home directory"

echo /home/guests /etc/auto.ldap >> /etc/auto.master

echo "* 172.25.254.254:/home/guests/&" >> /etc/auto.ldap

systemctl restart autofssystemctl enable autofs

echo "all is successful!":wqsh set-ldap.sh   ##执行脚本

版权声明：本文内容由网络用户投稿，版权归原作者所有，本站不拥有其著作权，亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容，请联系我们jiasou666@gmail.com 处理，核实后本网站将在24小时内删除侵权内容。