在Ubuntu Intrepid Ibex上安装和配置OpenLDAP
1初步说明
使用Ubuntu 8.10 Intrepid Ibex, OpenLDAP的使用和配置方式已更改。 在Intrepid中,OpenLDAP不再通过slapd.conf
文件配置,而是通过包含ldif文件的slapd.d目录来配置OpenLDAP。
请注意,如果您需要添加应用程序特定的shema或其他,请遵循应用程序或其他人提供的安装指南。 这样只能提供如何使用旧样式slapd.conf
方式配置OpenLDAP的方法。
2安装OpenLDAP
安装OpenLDAP很简单:
apt-get install slapd ldap-utils
出现提示时,输入您要用于OpenLDAP管理员帐户的密码。
如果你不想配置其他任何东西,你就开始运行了。 然而,大多数应用程序和脚本需要加载特定的模式或者要进行其他配置。
3配置OpenLDAP
那么现在我们怎么做呢? 没有什么比较容易。
您可以使用下面的默认slapd.conf
作为起点,因为该包不再提供slapd.conf
。
示例slapd.conf
文件:
# This is the main slapd configuration file. See slapd.conf for more # info on the configuration options. ####################################################################### # Global Directives: # Features to permit # allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel none # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 ####################################################################### # Specific Backend Directives for hdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend hdb ####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other> database config ####################################################################### # Specific Directives for database #1, of type hdb: # Database specific directives apply to this databasse until another # 'database' directive occurs database hdb # The base of your directory in database #1 suffix "dc=yourdomain,dc=tld" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. rootdn "cn=admin,cn=config" # Where the database file are physically stored for database #1 directory "/var/lib/ldap" # The dbconfig settings are used to generate a DB_CONFIG file the first # time slapd starts. They do NOT override existing an existing DB_CONFIG # file. You should therefore change these settings in DB_CONFIG directly # or remove DB_CONFIG and restart slapd for changes to take effect. # For the Debian package we use 2MB as default but be sure to update this # value if you have plenty of RAM dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 for more # information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 index objectClass eq # Save the time that the entry gets modified, for database #1 lastmod on # Checkpoint the BerkeleyDB database periodically in case of system # failure and to speed slapd shutdown. checkpoint 512 30 # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only # acl specific for phamm access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=webhabitat,dc=be" write by anonymous auth by self write by * none access to * by dn="cn=admin,dc=yourdomain,dc=tld" write by * read access to dn.base="" by * read # For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=yourdomain,dc=tld" write # by dnattr=owner write ####################################################################### # Specific Directives for database #2, of type 'other' (can be hdb too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other> # The base of your directory for database #2 #suffix "dc=debian,dc=org"
将dc = yourdomain.dc = tld
更改为OpenLDAP安装时使用的域名。
根据您的需要修改slapd.conf
文件。
接下来我们将更新OpenLDAP的配置。
/etc/init.d/slapd stop
备份当前的slapd.d
目录。
更改为ldap
目录:
cd /etc/ldap
将旧slapd.d
移动到备份位置:
mv slapd.d slapd.d.bck
现在我们将创建slapd.d
目录并从slapd.conf
文件加载配置。
mkdir slapd.d
slaptest -f slapd.conf -F slapd.d
您应该看到: 配置文件测试成功
。
接下来我们将slapd.d目录的所有权
设置为openldap
。
chown -R openldap:openldap slapd.d
现在我们可以重新启动OpenLDAP。
/etc/init.d/slapd start
如果您没有看到任何错误,OpenLDAP将启动并运行新的配置。
每次更改slapd.conf
文件时,您可以重复这些步骤,以加载新的OpenLDAP配置。
在任何情况下,都有一个好主意,具有slapd.conf
文件,因为某些脚本和应用程序会查看该文件以检查OpenLDAP配置,而不管现在如何使用slapd.d
目录配置OpenLDAP。
4.如果从Ubuntu 8.04升级
如果您在升级到Ubuntu 8.10之前运行OpenLDAP,请在尝试升级之前对slapd.conf进行以下更改:
将根dn设置为:
rootdn "cn=admin,cn=config"
广告添加: 数据库配置
之前:
####################################################################### # Specific Directives for database #1, of type hdb:
所以看起来像:
database config ####################################################################### # Specific Directives for database #1, of type hdb:
在我知道之前,我有幸升级到8.10。