Inkonzo kavimba weenkcukacha no-OpenLDAP [7 nowokugqibela?]: Umphathi weAkhawunti yeLdap

Molweni bahlobo!. Asizange sifune ukupapasha eli nqaku kuba liqulethwe kwisihlomelo kwifomathi yePDF ecelwe ngabafundi abaninzi. Ewe, siya kubhala isishwankathelo kunye nezongezo ezinomdla. Kwaye njengemboniso yolo luhlu, sibhala i Intshayelelo:

Abantu abaninzi abaphethe iinkonzo kuthungelwano lweshishini, xa bethatha ulawulo lwenethiwekhi eneenkonzo ezisekelwe kwiimveliso zeMicrosoft, ukuba bafuna ukufudukela kwiLinux, cinga ngokufuduka kuLawulo lweNdawo phakathi kwezinye iinkonzo.

Ukuba abakhethi imveliso yomntu wesithathu efana ne-ClearOS okanye iZentyal, okanye ukuba ngenxa yezinye izizathu banqwenela ukuzimela, ke benza umsebenzi onzima wokudala owabo uMlawuli weDomain, okanye kwiSamba 4 - okanye enye - eyabo. Uvimba weefayili osebenzayo.

Kulapho ziqala khona iingxaki kunye nokuphoxeka okuthile. Iimpazamo zokusebenza. Abafumani indawo yeengxaki ukuze bakwazi ukuzisombulula. Iinzame zokufakela eziphindaphindiweyo. Ukusebenza ngokuyinxenye kweenkonzo. Kwaye i- etcetera ende yeengxaki.

Ukuba sijongisisa, uninzi lwe-Intanethi alusebenzisi uthungelwano lohlobo lweMicrosoft. Nangona kunjalo, kwindawo yethu yoshishino senza, kakhulu.

Ngale ngqungquthela sizama ukwenza kwaziwe ukuba sinokwenza inethiwekhi yezoshishino ngaphandle kwefilosofi yeMicrosoft. Iinkonzo ezisekwe ekuqinisekiseni abasebenzisi ngokuchasene ne-OpenLDAP Directory efana ne: I-imeyile, i-FTP, i-SFTP, iLifu leShishini elisekelwe kwi-Owncloud, njl.

Sinqwenela ukunika indlela eyahlukileyo esekelwe kwi-100% yeSoftware eSimahla, kwaye engasebenzisi okanye exelisa - leyo kulo mzekelo iyafana - ifilosofi yenethiwekhi yeMicrosoft, nokuba ngeMicrosoft Software, okanye nge-OpenLDAP kunye neSamba njengezona ziphambili.

Zonke izisombululo ezisebenzisa isoftware yasimahla i-Openldap + Samba ngokuyimfuneko zifuna ulwazi olusisiseko lokuba yintoni iseva ye-LDAP, ifakwe njani, iqwalaselwe kwaye ilawulwe njani, njl. Kamva badibanisa i-Samba kunye ne-Kerberos, kwaye ekugqibeleni basinika ukuba "silinganise" i-Domain Controller kwisitayile se-Microsoft NT 4, okanye i-Active Directory.

Ngokwenene ngumsebenzi onzima xa siphumeza kwaye siwuqwalaselwe ukusuka kwiipakethe zokugcina. Abo baye bafunda baza basebenzisa amaxwebhu abanzi eSamba bayazi kakuhle le nto sithetha ngayo. I-Samba 4 ide icebise ngolawulo lwe-Active Directory ngokusebenzisa i-console yolawulo yakudala esiyifumana kwi-Microsoft Active Directory, ingaba ngu-2003 okanye enye ehambele phambili ngakumbi.

Ufundo olucetyiswayo.

https://wiki.debian.org/LDAP
Isikhokelo soMlawuli se-OpenLDAP 2.4
IsiKhokelo seseva ye-Ubuntu 12.04
Ubumbeko lweseva nge-GNU/Linux.

Incwadi egqwesileyo esinika yona u-El Maestro, uJoel Barrios Dueñas kwaye enceda abasebenzisi be-Debian kakuhle kakhulu, nangona ijolise kwi-CentOS kunye ne-Red Hat.

Zeziphi iinkonzo kunye nesoftware esiceba ukuyifaka kwaye siyiqwalasele?

• I-NTP ezimeleyo, i-DNS kunye ne-DHCP, oko kukuthi, ezimbini zokugqibela ezingadibaniswanga kwi-Directory
• Inkonzo kavimba weefayili okanye «Inkonzo yoLawulo»ngokusekwe kwi-OpenLDAP
• I-imeyile, iSuite ye "Citadel" Umsebenzi weQela, iFTP kunye neSFTP,
• Ilifu loShishino «OwnCloud«
• Umncedisi wefayile ozimeleyo osekwe kwiSamba.

Kuzo zonke iimeko, inkqubo yokuqinisekisa iziqinisekiso zomsebenzisi iya kwenziwa ngokuchasene noMlawuli ngqo, okanye I-libnss-ldap y WFP kuxhomekeke kwiimpawu zesoftware ekuthethwa ngayo.

Kwaye ngaphandle kokuqhubeka, masingene kuyo.

Umphathi weAkhawunti yeLdap

Ngaphambi kokuba siqhubeke, kufuneka sifunde:

• Inkonzo kavimba weefayili kunye ne-LDAP. Intshayelelo
• Inkonzo yesikhombisi ne-LDAP [2]: NTP kunye nednsmasq
• Inkonzo yesikhombisi kunye ne-LDAP [3]: Isc-DHCP-Server kunye neBind9
• Inkonzo kavimba weenkcukacha ne-LDAP [4]: ​​OpenLDAP (I)
• Inkonzo kavimba weenkcukacha ne-LDAP [5]: OpenLDAP (II)
• Inkonzo yoLawulo nge-LDAP [6]: Izatifikethi kwi-Debian 7 "Wheezy"

Abo baye balandela uchungechunge lwamanqaku angaphambili baya kuba baqonda ukuba SELE sine-Directory yokulawula. Singakufezekisa oku ngeendlela ezininzi, nokuba kungezinto eziluncedo zeconsole ezibekwe ngokwamaqela kwiphakheji Imibhalo engabhalwanga, ujongano lwewebhu PhpLDAPAdmin, Umphathi weAkhawunti yeLdap, njl., ezifumaneka kwindawo yokugcina.

Kukwakho nokuba nokwenzeka kokwenza oko Isitudiyo seApache, ekufuneka sizikhuphele kwi-Intanethi. Inobunzima obumalunga ne-142 megabytes.

Ukulawula uvimba weefayili, sicebisa ngamandla ukusetyenziswa kwe Umphathi weAkhawunti yeLdap. Kwaye into yokuqala esiya kuyithetha ngayo kukuba emva kokufakwa kwayo, sinokufikelela kuyo maxwebhu ebekwe kwisilawulo /usr/share/doc/ldap-account-manager/docs.

Ngayo Umphathi weAkhawunti yeLdap, ukususela ngoku ukuya phambili UMnu, singakwazi ukulawula umsebenzisi kunye neeakhawunti zeqela ezigcinwe kwi-Directory yethu. I-LAM isebenza nakweyiphi na iseva yekhasi lewebhu exhasa i-PHP5, kwaye sinokuqhagamshela kuyo ngokusebenzisa itshaneli engafihlwanga, okanye nge QalaTLS, yindlela esiza kuyisebenzisa kumzekelo wethu.

Ufakelo lokuqala kunye noqwalaselo:

:~# ukufaneleka faka i-ldap-akhawunti-manager

Emva kokufakwa kwe Apache2 -apache2-mpm-prefork-, ukusuka kwi-PHP5 kunye nezinye izinto ezixhomekeke kuyo, kwaye ukusuka kwiphakheji ngokwayo ldap-akhawunti-umphathi, into yokuqala ekufuneka siyenzile kukwenza ikhonkco lokomfuziselo ukusuka kwifolda yoxwebhu lwe-LAM ukuya kwifolda yamaxwebhu eengcambu zomncedisi wethu wewebhu. Umzekelo:

:~# ln -s /usr/share/doc/ldap-account-manager/docs/manual/ /var/www/lam-docs

Ngale ndlela siqinisekisa ukufikelela kwincwadana ye-LAM ngokusebenzisa isiphequluli sewebhu, ukuba sikhomba idilesi http://mildap.amigos.cu/lam-docs.

Kamva, masiqale ukuqwalasela i-LAM ngokwayo. Kwisikhangeli sikhomba http://mildap.amigos.cu/lam.

• Sicofa kwikhonkco "Uqwalaselo lwe-LAM".
• Cofa kwikhonkco "Hlela iiprofayili zeseva".
• Sichwetheza igama lokugqithisa 'Um' ngaphandle kwezicatshulwa.

Kumaphepha oqwalaselo lwe-LAM, sinokuguqula iiparitha ezininzi ngokwezinto esizikhethayo kunye neemfuno. Njengoko bendihlala ndincoma ukusuka kwi-Simple to Complex, kwaye ingeyiyo enye indlela, siya kuchukumisa kuphela oko kuyimfuneko ngokungqongqo ukusebenzisa isixhobo esinamandla esiyi-LAM. Ukuba emva kokuba singooMasters ekusetyenzisweni kwayo, sifuna ukuguqula okanye ukongeza imisebenzi, ke bamkelekile.

• Vula i-TLS: ewe -Kuyacetyiswa-.
• Isimamva somthi: dc = abahlobo, dc = cu
• Ulwimi oluhlala lukhona: Spanish (Spain)
• Uluhlu lwabasebenzisi abasebenzayo*: cn=admin,dc=abahlobo,dc=cu
• Iphasiwedi entsha: elahlukileyo igama lokugqitha kwi lam
  
• Phinda ufake iphasiwedi: elahlukileyo igama lokugqitha kwi lam
  

Qaphela: I ' * ' kuthetha ukuba lungeno olusisinyanzelo.

Ezantsi ngasekhohlo kukho amaqhosha ^ Gcina y ^ Rhoxisa. Ukuba sigcina utshintsho ngoku, iya kusibuyisela kwiphepha lasekhaya kwaye siyabona ukuba ulwimi sele lutshintshile kwaye igama lomsebenzisi ngoku. admin. Ngaphambi kokuba umlawuli. Nangona kunjalo, masibuyele ekuhleleni i--ngoku ngeSpanish- "Ukumisela. ye LAM». Emva kokuba sibuyele kwiphepha loqwalaselo, siya kwenza oku kulandelayo:

• Sikhetha ithebhu 'Iintlobo zeakhawunti'.
• Kwicandelo 'Iintlobo zeakhawunti esebenzayo' -> 'Abasebenzisi' -> 'isimamva se-LDAP', sabhala: ou=Abantu,dc=abahlobo,dc=cu.
• Kwicandelo 'Iintlobo zeakhawunti esebenzayo' -> 'Amaqela' -> 'isimamva se-LDAP', sabhala: ou=Amaqela,dc=abahlobo,dc=cu.
• Ukusebenzisa amaqhosha anesihloko '^Susa olu hlobo lweakhawunti', sisusa ezo zihambelanayo 'Izixhobo' y 'Iindawo zeSamba', esingayi kuyisebenzisa.
• Sikhetha ithebhu 'Iimodyuli'.
• En 'Abasebenzisi', kuluhlu 'Iimodyuli ezikhethiweyo', sihambisa imodyuli 'Samba 3 (sambaSamAccount)' kuluhlu lwe 'Iimodyuli ezifumanekayo'.
• En 'Amaqela', kuluhlu 'Iimodyuli ezikhethiweyo', sihambisa imodyuli 'Samba 3 (sambaGroupMapping)' kuluhlu lwe 'Iimodyuli ezifumanekayo'.

Okwangoku, kwaye de siqhelane noqwalaselo lwe-LAM, siya kuyishiya loo nto.

Sigcina utshintsho kwaye sibuyele kwiphepha lokuqala, apho kufuneka sifake igama eliyimfihlo lomsebenzisi admin (cn=admin,dc=friends,dc=cu), ibhengezwe ngexesha lofakelo lwe qhwaba. Ukuba ubuyisela naziphi na iimpazamo, khangela ukuba i /etc/ldap/ldap.conf ibumbeke kakuhle kumncedisi ngokwakhe. Unokuba nendlela eya kwisatifikethi se-TLS engalunganga okanye enye impazamo. Khumbula ukuba kufuneka kube ngolu hlobo:

BASE dc=amigos,dc=cu URI ldap://mildap.amigos.cu # iziqinisekiso zeTLS (ezifunekayo kwi-GnuTLS) TLS_CACERT /etc/ssl/certs/cacert.pem

Nje ukuba singene kwi-LAM, kufuneka sichithe ixesha elithile siyifunda PHAMBI kokutshintsha naluphi na uqwalaselo. I-interface yayo ilula kakhulu kwaye kulula ukuyisebenzisa. Yisebenzise kwaye ukhangele.

Isimangalo: Kuluxwebhu http://mildap.amigos.cu/lam-docs/ch02s02.html#confTypicalScenarios, sinokufunda ekugqibeleni:

Uluhlu olulodwa lwe-LDAP olunabasebenzisi abaninzi (> 10)
I-LAM yavavanywa ukuba isebenze nabasebenzisi be-10. Ukuba unabasebenzisi abaninzi, ngoko unokhetho ezimbini.

• Yahlula umthi wakho we-LDAP ube ziiyunithi zombutho: Le yeyona ndlela ilungileyo yokwenza. Beka iiakhawunti zakho kwiiyunithi ezininzi zombutho kwaye usete i-LAM njengakwimeko ephambili engentla.
• Yandisa umda wememori: Yandisa i-memory_limit parameter kwiphp.ini yakho. Oku kuya kuvumela i-LAM ukuba ifunde amangenelo amaninzi. Kodwa oku kuya kunciphisa amaxesha okuphendula kwe-LAM.

Masibe nobuchule kunye nocwangco kuLawulo lweBhodi yethu yaBalawuli.

Iipolisi zokhuseleko lwephasiwedi, kunye neminye imiba nge-LAM

• Sicofa kwikhonkco "Uqwalaselo lwe-LAM".
• Cofa kwikhonkco "Hlela iisetingi eziqhelekileyo".
• Sichwetheza igama lokugqithisa 'Um' ngaphandle kwezicatshulwa.

Kwaye kwelo phepha sifumana iMigaqo-nkqubo yegama lokugqithisa, iziKhenketho zoKhuseleko, iinginginya eziVunyiweyo, kunye nezinye.

Qaphela: Ubumbeko lwe-LAM lugcinwe ngaphakathi /usr/share/ldap-account-manager/config/lam.conf.

Senza ukuba i-https iqhagamshelane ne-LAM ngokukhuselekileyo:

:~# a2ensite default-ssl
:~# a2enmod ssl
:~# /etc/init.d/apache2 restart

Xa senza i-https ngendlela yangaphambili, sisebenza kunye nezatifikethi eziveliswa yi-Apache ngokungagqibekanga, kwaye izibonise kwinkcazo yomkhosi wayo wenyani. emiselweyo-ssl. Ukuba sifuna ukusebenzisa ezinye izatifikethi ezenziwe sithi, nceda uqhagamshelane nathi /usr/share/doc/apache2.2-common/README.Debian.gz. Izatifikethi ekuthethwa ngazo zezi kuthiwa "Ioyile yeNyoka" okanye i-Oli yeNyoka, kwaye ifumaneka kwi:

/etc/ssl/certs/ssl-cert-snakeoil.pem
/etc/ssl/private/ssl-cert-snakeoil.key

Masikhomba ibhrawuza https://mildap.amigos.cu, kwaye siyasamkela isatifikethi. Emva koko sikhomba https://mildap.amigos.cu/lam kwaye ngoku sinokusebenza nge-https kwi-LAM.

Kubalulekile: Ukuba ngexesha lenkqubo yokuqalisa umncedisi, i khululiwe kuthatha ixesha elide ukuqalisa, faka i-lightweight replacement ssmtp.

:~# ukufaneleka faka i-ssmtp
 Ezi phakheji EZINTSHA zilandelayo ziya kufakwa: ssmtp{b} 0 iipakethe ezihlaziyiweyo, ezi-1 ezifakiweyo ezitsha, 0 mazikhutshwe kwaye 0 azihlaziywa. Ndifuna ukukhuphela i-52,7 kB yeefayile. Emva kokukhupha i-8192 B. Ukuxhomekeka kwezi phakheji zilandelayo akonelisekanga: i-exim4-config: Iingxabano: i-ssmtp kodwa i-2.64-4 iyafakelwa. I-exim4-daemon-light: Ungquzulwano: imeyile-yezothutho-arhente eyimpahla yenyani. ssmtp: Ungquzulwano: imeyile-yezothutho-arhente eyipakethi enenyani. Ezi zenzo zilandelayo ziza kusombulula ezi zixhomekeko Susa ezi phakheji zilandelayo: 1) i-exim4 2) i-exim4-base 3) i-exim4-config 4) i-exim4-daemon-light Uyasamkela esi sisombululo? [Y/n/q/?]y

Emva koko senza:

:~# aptitude purge ~c :~# aptitude clean :~# aptitude autoclean :~# reboot

Ukuba usebenza kunye neeseva zenyani, eli iyakuba lixesha elihle lokwenza ugcino olululo lomncedisi oyintloko... 🙂

Ukuphindaphinda. Ugcina kwaye ubuyisela kwi-database ye-Directory.

Kwisikhokelo esigqwesileyo-esicebisa ukuba wonke umntu asifunde kwaye asifunde - «IsiKhokelo seseva ye-Ubuntu» ukusuka kwi-Ubuntu Server 12.04 «Chane», kukho inkcazo eneenkcukacha yamacandelo ekhowudi esiyibhalileyo malunga ne-OpenLDAP kunye nokuveliswa kwezatifikethi ze-TLS, kunye nokuReplication kweDirectory kuxoxwe ngeenkcukacha ezinkulu, kunye nendlela yokugcina noBuyiselo lwedatha. .

Nangona kunjalo, sinika ngezantsi inkqubo yokubuyisela yonke i-database kwimeko yentlekele.

Ibaluleke kakhulu:

KUFUNEKA SIHLALE sinefayile ethunyelwe ngaphandle esandleni sisebenzisa uMphathi weAkhawunti ye-LDap njengekopi yogcino lwedatha yethu. Kunjalo ifayile cn=amigos.ldif kufuneka ihambelane nofakelo lwethu. Sinokuyifumana ngokusebenzisa umyalelo we-slapcat njengoko siza kubona kamva.

1.- Siphelisa ukufakwa kwe-slapd kuphela.

:~# aptitude purge slpad

2.- Sicoca inkqubo yephakheji

:~# ukufaneleka kokufaka -f :~# ukucoca ukufaneleka ~c :~# ukufaneleka ukucoca

3.- Sicima ngokupheleleyo i-database ye-Directory

:~# rm -r /var/lib/ldap/*

4.- Sifaka kwakhona i-daemon ye-slapd kunye nokuxhomekeka kwayo

:~# ubuchule bokufaka i-slapd

5.- Sijonga

:~# ldapsearch -Q -LLL -Y NGAPHANDLE -H ldapi:/// -b cn=config dn :~# ldapsearch -x -LLL -H ldap:/// -b dc=friends,dc=cu dn

6.- Songeza ifayile yesalathisi efanayo olcDbIndex.ldif

:~# ldapmodify -Y NGAPHANDLE -H ldapi:/// -f ./olcDbIndex.ldif

7.- Sijonga ii-indices ezongeziweyo

:~# ldapsearch -Q -LLL -Y NGAPHANDLE -H ldapi:/// \ -b cn=config '(olcDatabase={1}hdb)' olcDbIndex

8.- Songeza iMithetho yoLawulo lokuFikelela efanayo

:~# ldapmodify -Y NGAPHANDLE -H ldapi:/// -f ./olcAccess.ldif

9.- Sijonga iMithetho yoLawulo lokuFikelela

:~# ldapsearch -Q -LLL -Y NGAPHANDLE -H ldapi:/// \ -b cn=config '(olcAccess=*)' olcFikelela olcSuffix

I-10.- Songeze iZatifikethi ze-TLS. Akukho sidingo sokuzihlaziya okanye ukulungisa iimvume. Sele zikhona kwindlela yefayile, kodwa azichazwanga kwisiseko sedatha.

:~# ldapmodify -Y NGAPHANDLE -H ldapi:/// -f /etc/ssl/certinfo.ldif

11.- Songeza umxholo ngokwekopi yethu yokugcina

:~# ldapadd -x -D cn=admin,dc=abahlobo,dc=cu -W -f dc=friends.ldif

MUSA ukuqalisa kwakhona i-slapd kuba isalathisa isiseko sedatha kwaye inokonakala !!!. HLALA uhlela ifayile yakho egciniweyo PHAMBI kokuba uyifake, ukunqanda ukufaka amangeniso esele ekhona.

Sikhomba kwisikhangeli kwi https://mildap.amigos.cu/lam kwaye sijonga.

Umyalelo we-slapcat

Umyalelo slapcat Isetyenziselwa ikakhulu ukuvelisa, kwifomathi ye-LDIF, umxholo wesiseko sedatha elawulwa yi qhwaba. Umyalelo uvula i-database egqitywe yinombolo yayo okanye isimamva, kwaye ibhala ifayile ehambelanayo kwifomathi ye-LDIF kwisikrini. Oovimba beenkcukacha ezibunjwe njengabangaphantsi nazo zibonisiwe, ngaphandle kokuba sikhankanya ukhetho -g.

Owona mda ubalulekileyo wokusebenzisa lo myalelo kukuba ungaphunyezwa xa i qhwaba, ubuncinane kwimodi yokubhala, ukuqinisekisa ukuhambelana kwedatha.

Umzekelo, ukuba sifuna ukwenza ikopi yogcino lwe-database ye-Directory, kwifayile ebizwa i-backup-slapd.ldif, senza:

:~# inkonzo slapd stop :~# slapcat -l backup-slapd.ldif :~# inkonzo ngempama

Imifanekiso ye-LAM