openldap的配置手册

共有 1 条评论

1. tujp123 于 2012-06-06 22:04:01发表:

   为什么我一直找不到ldap目录，
   [root@localhost openldap]# ls
   cacerts ldap.conf schema slapd.conf slapd.conf.bak slapd.d
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   #
   # LDAP Defaults
   #
   
   # See ldap.conf(5) for details
   # This file should be world readable but not world writable.
   
   #BASE dc=example, dc=com
   #URI ldap://ldap.example.com ldap://ldap-master.example.com:666
   
   #SIZELIMIT 12
   #TIMELIMIT 15
   #DEREF never
   #HOST 127.0.0.1
   HSOT 192.168.1.21
   BASE dc=buct ,dc=edu.cn BASEDN
   TLS_CACERTDIR /etc/openldap/cacerts
   ~
   ~
   ~
   ~
   ~
   "ldap.conf" 17L, 347C written
   [root@localhost openldap]# service ldap star
   ldap: unrecognized service
   [root@localhost openldap]# service ldap start
   ldap: unrecognized service
   [root@localhost openldap]# ldapsearch -x -b ‘’ -s base ‘(objectclass=*)’
   -bash: syntax error near unexpected token `('
   [root@localhost openldap]# ldapsearch -x -b ‘’ -s base ‘(objectclass=*)’
   -bash: syntax error near unexpected token `('
   [root@localhost openldap]# ldapsearch -x -b ‘-s base ‘(objectclass=*)’
   -bash: syntax error near unexpected token `('
   [root@localhost openldap]#
   [root@localhost openldap]#
   [root@localhost openldap]#
   [root@localhost openldap]#
   [root@localhost openldap]#
   [root@localhost openldap]# ls
   cacerts ldap.conf schema slapd.conf slapd.conf.bak slapd.d
   [root@localhost openldap]# vi slapd.conf
   
   #
   # See slapd.conf(5) for details on configuration options.
   # This file should NOT be world readable.
   #
   
   include /etc/openldap/schema/corba.schema
   include /etc/openldap/schema/core.schema
   include /etc/openldap/schema/cosine.schema
   include /etc/openldap/schema/duaconf.schema
   include /etc/openldap/schema/dyngroup.schema
   include /etc/openldap/schema/inetorgperson.schema
   include /etc/openldap/schema/java.schema
   include /etc/openldap/schema/misc.schema
   include /etc/openldap/schema/nis.schema
   include /etc/openldap/schema/openldap.schema
   include /etc/openldap/schema/ppolicy.schema
   include /etc/openldap/schema/collective.schema
   
   # Allow LDAPv2 client connections. This is NOT the default.
   allow bind_v2
   
   # Do not enable referrals until AFTER you have a working directory
   # service AND an understanding of referrals.
   #referral ldap://root.openldap.org
   
   pidfile /var/run/openldap/slapd.pid
   argsfile /var/run/openldap/slapd.args
   
   # Load dynamic backend modules:
   # Module syncprov.la is now statically linked with slapd and there
   # is no need to load it here
   # modulepath /usr/lib/openldap # or /usr/lib64/openldap
   # moduleload accesslog.la
   # moduleload auditlog.la
   ## To load this module, you have to install openldap-server-sql first
   # moduleload back_sql.la
   ## Following two modules can't be loaded simultaneously
   # moduleload dyngroup.la
   # moduleload dynlist.la
   # moduleload lastmod.la
   # moduleload pcache.la
   # moduleload ppolicy.la
   # moduleload refint.la
   # moduleload retcode.la
   # moduleload rwm.la
   # moduleload translucent.la
   # moduleload unique.la
   # moduleload valsort.la
   
   # The next three lines allow use of TLS for encrypting connections using a
   # dummy test certificate which you can generate by changing to
   # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on
   # slapd.pem so that the ldap user or group can read it. Your client software
   # may balk at self-signed certificates, however.
   # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
   # TLSCertificateFile /etc/pki/tls/certs/slapd.pem
   # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem
   
   # Sample security restrictions
   # Require integrity protection (prevent hijacking)
   # Require 112-bit (3DES or better) encryption for updates
   # Require 63-bit encryption for simple bind
   # security ssf=1 update_ssf=112 simple_bind=64
   
   # Sample access control policy:
   # Root DSE: allow anyone to read it
   # Subschema (sub)entry DSE: allow anyone to read it
   # Other DSEs:
   # Allow self write access
   # Allow authenticated users read access
   # Allow anonymous users to authenticate
   # Directives needed to implement policy:
   # access to dn.base="" by * read
   # access to dn.base="cn=Subschema" by * read
   # access to *
   # by self write
   # by users read
   # by anonymous auth
   #
   # if no access controls are present, the default policy
   # allows anyone and everyone to read anything but restricts
   # updates to rootdn. (e.g., "access to * by * read")
   #
   # rootdn can always read and write EVERYTHING!
   
   #######################################################################
   # ldbm and/or bdb database definitions
   #######################################################################
   
   database bdb
   suffix "dc=buct,dc=edu.cn"
   rootdn "cn=root,dc=buct,dc=edu.cn"
   cachesize 10000
   searchstack 8
   dbnosync
   dirtyread
   # Cleartext passwords, especially for the rootdn, should
   # be avoided. See slappasswd(8) and slapd.conf(5) for details.
   # Use of strong authentication encouraged.
   rootpw 123456
   rootpw {crypt}ijFYNcSNctBYg
   
   # The database directory MUST exist prior to running slapd AND
   # should only be accessible by the slapd and slap tools.
   # Mode 700 recommended.
   directory /var/lib/ldap
   
   # Indices to maintain for this database
   index objectClass eq,pres
   index ou,cn,mail,surname,givenname eq,pres,sub
   index uidNumber,gidNumber,loginShell eq,pres
   index uid,memberUid eq,pres,sub
   index nisMapName,nisMapEntry eq,pres,sub
   
   # Replicas of this database
   #replogfile /var/lib/ldap/openldap-master-replog
   #replica host=ldap-1.example.com:389 starttls=critical
   # bindmethod=sasl saslmech=GSSAPI
   # authcId=host/ldap-master.example.com@EXAMPLE.COM
   
   
   # enable monitoring
   database monitor
   
   # allow onlu rootdn to read the monitor
   access to *
   by dn.exact="cn=Manager,dc=my-domain,dc=com" read
   by * none