suffix "dc=my-domain, dc=com"
rootdn "cn=Manager, dc=my-domain, dc=com"
rootpw HESLO
directory /var/lib/openldap-data
index uid,uidNumber,gidNumber eq
access to dn=".*ou=group,dc=my-domain,dc=com"
by dn="cn=backup,ou=admins,dc=my-domain,dc=com" read
by domain=.* read
access to attrs=userPassword
by dn="cn=admin,o=example,dc=net" write
by anonymous auth
by self write
by * none
ldapsearch -h <server> -b <báze> <filtr>
ldapsearch -h ldap://ldap.fi.muni.cz -b ou=People,dc=fi,dc=muni,dc=cz uid=zlatuska dn: uid=zlatuska,ou=People,dc=fi,dc=muni,dc=cz uid: zlatuska cn: zlatuska objectClass: account objectClass: posixAccount objectClass: shadowAccount userPassword:: e2NyeXB0fXg= loginShell: /bin/ksh uidNumber: 206 gidNumber: 10000 homeDirectory: /home/zlatuska gecos: Jiri Zlatuska host: aisa host: anxur host: erinys host: gorgo host: nymfe host: oreias host: pandora host: pyrrha
cn=Jirina Bohdalova, ou=dep1, ou=group, dc=dc=my-domain, c=com objectClass: account gecos: Jirina Bohdalova homeDirectory: /home/bohdalka ...
ldapadd -h ldap://ldap.my-domain.com -D ou=dep1,ou=group,dc=dc=my-domain,c=com -f newpers-h adresa serveru
dn: uid=bohdalka,ou=dep1,ou=group,dc=dc=my-domain,c=com changetype: modify add: mail mail: bohdalka@bohdalka.cz
ldapmodify -h ldap://ldap.my-domain.com -D ou=dep1,ou=group,dc=dc=my-domain,c=com -f modpers
objectclass ( 1.3.6.1.1.1.2.0 NAME 'posixAccount' SUP top AUXILIARY
DESC 'Abstraction of an account with POSIX attributes'
MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory )
MAY ( userPassword $ loginShell $ gecos $ description ) )
objectclass ( 1.3.6.1.1.1.2.1 NAME 'shadowAccount' SUP top AUXILIARY
DESC 'Additional attributes for shadow passwords'
MUST uid
MAY ( userPassword $ shadowLastChange $ shadowMin $
shadowMax $ shadowWarning $ shadowInactive $
shadowExpire $ shadowFlag $ description ) )
attributetype ( 1.3.6.1.1.1.1.2 NAME 'gecos'
DESC 'The GECOS field; the common name'
EQUALITY caseIgnoreIA5Match
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
attributetype ( 1.3.6.1.1.1.1.3 NAME 'homeDirectory'
DESC 'The absolute path to the home directory'
EQUALITY caseExactIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
attributetype ( 1.3.6.1.1.1.1.4 NAME 'loginShell'
DESC 'The path to the login shell'
EQUALITY caseExactIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
...
apt-get install slapd libnss-ldap ldap-utils libpam-ldap nscdBěhem instalace budeme vyzváni k zadání informací o doméně a LDAP superuživateli.
/etc/ldap/slapd.conf
/etc/nsswitch.confNapř.:
passwd: files ldap shadow: files ldap group: files ldap hosts: files ldap dns ethers: files netmasks: files networks: files protocols: nisplus [NOTFOUND=return] files
/etc/nscd.confKonfigurace může vypadat například takto:
server-user nscd debug-level 0 enable-cache passwd yes positive-time-to-live passwd 600 negative-time-to-live passwd 20 suggested-size passwd 211 check-files passwd yes enable-cache hosts yes positive-time-to-live hosts 3600 negative-time-to-live hosts 20 suggested-size hosts 211 check-files hosts yes
/etc/pam_ldap.confNapř.:
host localhost dc=users,ou=group,dc=my-domain,dc=comSoubor obsahuje několik vzorových konfigurací pro různé LDAP.
auth required pam_nologin.so auth sufficient pam_ldap.so auth sufficient pam_unix.so shadow use_first_pass auth required pam_deny.so
authz-regexp <search pattern> <replacement pattern>pomocí které (je to regulární výraz) proběhne převod ze SASL uživatele na LDAP, např.:
authz-regexp uid=([^,]*),cn=digest-md5,cn=auth ldap:///dc=customers,dc=example,dc=com??one?(&(uid=$1)(objectClass=person))(pozn. v OpenLDAP v2.2 se direktiva jmenuje sasl-regexp)
ldapsearch -U ... -b ... '...' SASL/DIGEST-MD5 authentication started Please enter your password: SASL username: ... SASL SSF: 128 SASL installing layers ... výsledek ...
replogfile /var/lib/ldap/ldap.replog
replica uri=ldaps://slave.my-domain.com:636
binddn="cn=Replicator,dc=my-domain,dc=com"
bindmethod=simple credentials=secret
replica: slave.my-domain.com:389 time: 809618633 dn: uid=bjensen,dc=my-domain,dc=com changetype: modify replace: multiLineDescription description: A dreamer... - replace: modifiersName modifiersName: uid=bjensen,dc=my-domain,dc=com - replace: modifyTimestamp modifyTimestamp: 20000805073308Z -