本文共 4315 字，大约阅读时间需要 14 分钟。

CentOS 7 下 LDAP 与 phpLDAPadmin 搭建及常用操作

一、实验环境

• 操作系统：CentOS 7.4
• 服务器 IP：192.168.3.41
• 运行用户：root
• 网络环境：Internet

二、LDAP 安装与配置

1. 安装 OpenLDAP

# 安装 OpenLDAP 和客户端工具[root@centos7 ~]# yum install openldap-servers openldap-clients -y

[root@centos7 ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG[root@centos7 ~]# ll /var/lib/ldap/DB_CONFIG-rw-r--r--. 1 root root 845 Aug  1 10:04 /var/lib/ldap/DB_CONFIG[root@centos7 ~]# chown ldap. /var/lib/ldap/DB_CONFIG

2. 设置 OpenLDAP 管理员密码

[root@centos7 ~]# slappasswdNew password: Re-enter new password:{SSHA}d5pkA0TU6b+8/kEoMIxJ59QofCLV

[root@centos7 ~]# vim chrootpw.ldifdn: olcDatabase={0}config,cn=configchangetype: modifyadd: olcRootPWolcRootPW: {SSHA}d5pkA0TU6b+8/kEokgQeMIxJ59QofCLV[root@centos7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif

3. 导入基本模式

[root@centos7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif[root@centos7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif[root@centos7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif

4. 设置 LDAP 域名及目录管理器密码

[root@centos7 ~]# slappasswdNew password:Re-enter new password:{SSHA}Oq61fgUFW9+ItZboTaW1+VbLuAYst7zw

[root@centos7 ~]# vim chdomain.ldifdn: olcDatabase={1}monitor,cn=configchangetype: modifyreplace: olcAccessolcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"read by dn.base="cn=Manager,dc=srv,dc=world" read by * nonedn: olcDatabase={2}hdb,cn=configchangetype: modifyreplace: olcSuffixolcSuffix: dc=srv,dc=worlddn: olcDatabase={2}hdb,cn=configchangetype: modifyreplace: olcRootDNolcRootDN: cn=Manager,dc=srv,dc=worlddn: olcDatabase={2}hdb,cn=configchangetype: modifyadd: olcRootPWolcRootPW: {SSHA}Oq61fgUFW9+ItZboTaW1+VbLuAYst7zwdn: olcDatabase={2}hdb,cn=configchangetype: modifyadd: olcAccessolcAccess: {0}to attrs=userPassword,shadowLastChange byread by anonymous auth by self write by * noneolcAccess: {1}to dn.base="" by * readolcAccess: {2}to * by dn="cn=Manager,dc=srv,dc=world" write by * read

[root@centos7 ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif

5. 设置 Firewalld 防火墙

[root@centos7 ~]# firewall-cmd --add-service=ldap --permanent[root@centos7 ~]# firewall-cmd --reload

三、Apache 安装与配置

1. 安装 Apache

[root@centos7 ~]# yum install httpd-devel.x86_64 httpd.x86_64 -y

2. 配置 Apache

[root@centos7 ~]# mv /etc/httpd/conf.d/welcome.conf /etc/httpd/conf.d/welcome.conf.bak[root@centos7 ~]# vim /etc/httpd/conf/httpd.conf

3. 启动 Apache

[root@centos7 ~]# systemctl start httpd.service[root@centos7 ~]# systemctl enable httpd.service[root@centos7 ~]# firewall-cmd --add-service=http --permanent[root@centos7 ~]# firewall-cmd --reload

4. 测试 Apache 服务

[root@centos7 ~]# vim /var/www/html/index.html        
   
            Test Page    
   

四、PHP 安装与配置

1. 安装 PHP

[root@centos7 ~]# yum -y install php php-mbstring php-pear

2. 配置 PHP 时间区

[root@centos7 ~]# vim /etc/php.inidate.timezone = Asia/Shanghai

3. 启动 PHP 服务

[root@centos7 ~]# systemctl restart httpd.service

4. 测试 PHP 服务

[root@centos7 ~]# vim /var/www/html/index.php
   

五、phpLDAPadmin 安装与配置

1. 安装 phpLDAPadmin

[root@centos7 ~]# yum install phpldapadmin.noarch -y

2. 配置 phpLDAPadmin

[root@centos7 ~]# vim /etc/phpldapadmin/config.php397 $servers->setValue('login','attr','dn'); //取消注释398 //$servers->setValue('login','attr','uid'); //注释

3. 配置 Apache 配置文件

[root@centos7 ~]# vim /etc/httpd/conf.d/phpldapadmin.confAlias /phpldapadmin /usr/share/phpldapadmin/htdocsAlias /ldapadmin /usr/share/phpldapadmin/htdocs
       
    
             Require all granted        # 允许特定 IP段访问        Require ip 192.168.3.0/24    
        
    
             Order Deny,Allow        Deny from all        Allow from 127.0.0.1        Allow from ::1    
    
   

4. 启动服务并测试

[root@centos7 ~]# systemctl restart httpd.service[root@centos7 ~]# systemctl status httpd.service

# 测试访问 phpLDAPadmin 后台http://192.168.3.41/ldapadmin/

六、禁止匿名用户登录

[root@centos7 ~]# vim /root/ldap_disable_bind_anon.ldifangetype: modifyadd: olcDisallowsolcDisallows: bind_anondn: cn=configchangetype: modifyadd: olcRequiresolcRequires: authcdn: olcDatabase={-1}frontend,cn=configchangetype: modifyadd: olcRequiresolcRequires: authc

[root@centos7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f ldap_disable_bind_anon.ldif[root@centos7 ~]# systemctl restart slapd.service