dpkg-reconfigure slapd 将让您更具体地重新配置 LDAP 数据库：
falcot.com”。
dpkg-reconfigure slapd 的情况下。
$ldapsearch -x -b dc=falcot,dc=com# extended LDIF # # LDAPv3 # base <dc=falcot,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # falcot.com dn: dc=falcot,dc=com objectClass: top objectClass: dcObject objectClass: organization o: Falcot Corp dc: falcot # admin, falcot.com dn: cn=admin,dc=falcot,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1
/etc/passwd、/etc/group、/etc/services、/etc/hosts 以及等等诸如此类），转换这个数据，并将其注入 LDAP 数据库中。
/etc/migrationtools/migrate_common.ph；需要启用 IGNORE_UID_BELOW 和 IGNORE_GID_BELOW 选项（将其取消注释就足够了），并且需要更新 DEFAULT_MAIL_DOMAIN/DEFAULT_BASE。
migrate_all_online.sh 命令来处理，如下：
#cd /usr/share/migrationtools#PERL5LIB="${PERL5LIB}:/etc/migrationtools" LDAPADD="/usr/bin/ldapadd -c" ETC_ALIASES=/dev/null ./migrate_all_online.sh
migrate_all_online.sh 询问一些关于数据迁移到 LDAP 数据库的问题。表 11.1 概括了 Falcot 公司的使用案例中给出回答。
表 11.1. 对 migrate_all_online.sh 脚本询问的问题的回答
| 问题 | 回答 |
|---|---|
| X.500 命名文本 | dc=falcot,dc=com |
| LDAP 服务器主机名 | localhost |
| 管理者 DN | cn=admin,dc=falcot,dc=com |
| 绑定证明 | 管理员密码 |
| 创建 DUAConfigProfile | 否 |
PERL5LIB variable. This is due to Debian bug report #982666.
/etc/aliases file, since the standard schema as provided by Debian does not include the structures that this script uses to describe email aliases. Should we want to integrate this data into the directory, the /etc/ldap/schema/misc.schema file should be added to the standard schema.
-c 选项在 ldapadd 命令中的使用；这个选项需要在错误的情况下不将处理停止下来。使用这个选项的使用是需要的，因为 /etc/services 的转换通常产生一些可以被安全地忽略的错误。
表 11.2. Configuring the libnss-ldap package:
| 问题 | 回答 |
|---|---|
| LDAP server URI (Uniform Resource Identifier) | ldapi://ldap.falcot.com |
| 搜索基础的区分名称 | dc=falcot,dc=com |
| 使用的 LDAP 版本 | 3 |
| 根的 LDAP 账户 | cn=admin,dc=falcot,dc=com |
| LDAP 根账户密码 | 管理员密码 |
| 允许 LDAP 管理账户的行为像本地根用户一样吗？ | 是 |
| LDAP 数据库需要登录吗？ | 否 |
/etc/nsswitch.conf 文件，从而配置 NSS 来使用刚刚安装的 ldap 模块。可以使用 /usr/share/doc/libnss-ldap/examples/nsswitch.ldap 中提供的示例，或者编辑现有的配置。
例 11.23. The /etc/nsswitch.conf file
#ident $Id: nsswitch.ldap,v 2.4 2003/10/02 02:36:25 lukeh Exp $ # # An example file that could be copied over to /etc/nsswitch.conf; it # uses LDAP conjunction with files. # # "hosts:" and "services:" in this file are used only if the # /etc/netconfig file has a "-" for nametoaddr_libs of "inet" transports. # the following lines obviate the "+" entry in /etc/passwd and /etc/group. passwd: files ldap shadow: files ldap group: files ldap # consult DNS first, we will need it to resolve the LDAP host. (If we # can't resolve it, we're in infinite recursion, because libldap calls # gethostbyname(). Careful!) hosts: dns ldap # LDAP is nominally authoritative for the following maps. services: ldap [NOTFOUND=return] files networks: ldap [NOTFOUND=return] files protocols: ldap [NOTFOUND=return] files rpc: ldap [NOTFOUND=return] files ethers: ldap [NOTFOUND=return] files # no support for netmasks, bootparams, publickey yet. netmasks: files bootparams: files publickey: files automount: files # I'm pretty sure nsswitch.conf is consulted directly by sendmail, # here, so we can't do much here. Instead, use bbense's LDAP # rules ofr sendmail. aliases: files sendmailvars: files # Note: there is no support for netgroups on Solaris (yet) netgroup: ldap [NOTFOUND=return] files
ldap 模块通常插在其它之前，这样会被首先询问。显著的例外是 hosts 服务，因为联系 LDAP 服务器需要首先咨询 DNS （来解析 ldap.falcot.com）。没有这个例外的话，主机名查询将试图询问 LDAP 服务器；这会触发对 LDAP 服务器的名称解析，于是进入死循环。
files 模块使用的本地文件），那么服务可以使用后面的语法来配置：
服务: ldap [NOTFOUND=return] files.
/etc/environment 和 /etc/default/locale），它允许应用针对 LDAP 数据库来执行所需要的授权。
/etc/pam.d/common-auth、/etc/pam.d/common-password 和 /etc/pam.d/common-account 文件中的默认 PAM 配置。这个机制使用专用的 pam-auth-update 工具（由 libpam-runtime 软件包提供）。这个工具还可以由管理员运行，如果他们想要启用或禁止 PAM 模块的话。
./easyrsa build-server-full ldap.falcot.com nopass 会询问有关“通用名称”。对问题的回答必须是 LDAP 服务器完全合格的主机名；在我们的例子中是 ldap.falcot.com。
pki/issued/ldap.falcot.com.crt 文件中创建了证书；相应的私钥存储在 pki/private/ldap.falcot.com.key 中。
openldap身份下运行的 LDAP 服务器读取：
#adduser openldap ssl-certAdding user `openldap' to group `ssl-cert' ... Adding user openldap to group ssl-cert Done. #mv pki/private/ldap.falcot.com.key /etc/ssl/private/ldap.falcot.com.key#chown root.ssl-cert /etc/ssl/private/ldap.falcot.com.key#chmod 0640 /etc/ssl/private/ldap.falcot.com.key#mv pki/issued/ldap.falcot.com.crt /etc/ssl/certs/ldap.falcot.com.pem#chown root.root /etc/ssl/certs/ldap.falcot.com.pem#chmod 0644 /etc/ssl/certs/ldap.falcot.com.pem
slapd 守护进程使用这些密钥来加密。LDAP 服务器的配置被动态地管理：可以在 cn=config 对象层次结构上通过正常的 LDAP 操做来更新配置；并且服务器实时更新 /etc/ldap/slapd.d 而使配置持续。这样 ldapmodify 就是更新配置的合适工具了：
例 11.24. 配置 slapd 来加密
#cat >ssl.ldif <<END dn: cn=config changetype: modify add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/private/ldap.falcot.com.key - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/certs/ldap.falcot.com.pem END#ldapmodify -Y EXTERNAL -H ldapi:/// -f ssl.ldifSASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config" #systemctl restart slapd.service#ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config -s base | grep TLSSASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 olcTLSCertificateFile: /etc/ssl/certs/ldap.falcot.com.pem olcTLSCertificateKeyFile: /etc/ssl/certs/ldap.falcot.com.key
/etc/default/slapd 文件中的 SLAPD_SERVICES 变量。我们将同时安全地运行并禁止不安全 LDAP。
例 11.25. /etc/default/slapd 文件
# Default location of the slapd.conf file or slapd.d cn=config directory. If # empty, use the compiled-in default (/etc/ldap/slapd.d with a fallback to # /etc/ldap/slapd.conf). SLAPD_CONF= # System account to run the slapd server under. If empty the server # will run as root. SLAPD_USER="openldap" # System group to run the slapd server under. If empty the server will # run in the primary group of its user. SLAPD_GROUP="openldap" # Path to the pid file of the slapd server. If not set the init.d script # will try to figure it out from $SLAPD_CONF (/etc/ldap/slapd.d by # default) SLAPD_PIDFILE= # slapd normally serves ldap only on all TCP-ports 389. slapd can also # service requests on TCP-port 636 (ldaps) and requests via unix # sockets. # Example usage: # SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///" SLAPD_SERVICES="ldaps:/// ldapi:///" # If SLAPD_NO_START is set, the init script will not start or restart # slapd (but stop will still work). Uncomment this if you are # starting slapd via some other means or if you don't want slapd normally # started at boot. #SLAPD_NO_START=1 # If SLAPD_SENTINEL_FILE is set to path to a file and that file exists, # the init script will not start or restart slapd (but stop will still # work). Use this for temporarily disabling startup of slapd (when doing # maintenance, for example, or through a configuration management system) # when you don't want to edit a configuration file. SLAPD_SENTINEL_FILE=/etc/ldap/noslapd # For Kerberos authentication (via SASL), slapd by default uses the system # keytab file (/etc/krb5.keytab). To use a different keytab file, # uncomment this line and change the path. #export KRB5_KTNAME=/etc/krb5.keytab # Additional options to pass to slapd SLAPD_OPTIONS=""
ldaps:// URI。
/usr/local/share/ca-certificates and running update-ca-certificates.
#cp pki/ca.crt /usr/local/share/ca-certificates/falcot.crt#update-ca-certificatesUpdating certificates in /etc/ssl/certs... 1 added, 0 removed; done. Running hooks in /etc/ca-certificates/update.d... Adding debian:falcot.pem done. done.
/etc/ldap/ldap.conf 中修改。这会节省一些输入工作。
例 11.26. /etc/ldap/ldap.conf 文件
# # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example,dc=com #URI ldap://ldap.example.com ldap://ldap-provider.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never # TLS certificates (needed for GnuTLS) TLS_CACERT /etc/ssl/certs/ca-certificates.crt