OpenLDAP单机搭建手册参考：CentOS上OpenLDAP Server使用cn=config方式配置
配置双主高可用OpenLDAP
- 准备两台centos 7服务器，作为两台OpenLDAP Server的运行主机
| Server ID |
系统版本 |
IP |
| 1 |
centos 7 |
192.168.1.2 |
| 2 |
centos 7 |
192.168.1.3 |
- 按照CentOS上OpenLDAP Server使用cn=config方式配置的方式在两台主机上部署好OpenLDAP Server。做到第6步即可，即
启动openldap server
- 在两台主机上启动syncprov模块
1
2
3
4
5
6
7
8
9
10
11
| $ cat syncprov_mod.ldif
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulePath: /usr/lib64/openldap
olcModuleLoad: syncprov.la
$ ldapadd -Y EXTERNAL -H ldapi:/// -f syncprov_mod.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=module,cn=config"
|
- 启动OpenLDAP主主同步
在两台机器上创建configrep.ldif文件，并执行配置
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
| $ cat configrep.ldif
#
dn: cn=config
changetype: modify
replace: olcServerID
olcServerID: 1 ldap://192.168.1.2
olcServerID: 2 ldap://192.168.1.3
#
dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
#
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcSyncRepl
olcSyncRepl:
rid=001
provider=ldap://192.168.1.2
binddn="cn=Manager,dc=example,dc=com"
bindmethod=simple
credentials=redhat
searchbase="dc=example,dc=com"
type=refreshAndPersist
retry="5 5 300 5"
timeout=1
olcSyncRepl:
rid=002
provider=ldap://192.168.1.3
binddn="cn=Manager,dc=example,dc=com"
bindmethod=simple
credentials=redhat
searchbase="dc=example,dc=com"
type=refreshAndPersist
retry="5 5 300 5"
timeout=1
-
add: olcMirrorMode
olcMirrorMode: TRUE
$ ldapmodify -Y EXTERNAL -H ldapi:/// -f configrep.ldif
|
- 配置ldap启动host，更新
/etc/sysconfig/slapd
1
2
| $ cat /etc/sysconfig/slapd
SLAPD_URLS="ldapi:/// ldap://192.168.1.2"
|
192.168.1.2、192.168.1.3根据主机ip确定。
6. 重启slapd
1
| $ systemctl restart slapd
|
至此，dc=example,dc=com 下的内容便可以在两个服务器上同步了。
实践测试
- 在ldap1服务器192.168.1.2中创建ldap server的基础结构
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
| $ cat base.ldif
dn: dc=example,dc=com
objectClass: dcObject
objectClass: organization
o: example.com
dn: ou=users,dc=example,dc=com
objectClass: organizationalUnit
objectClass: top
ou: users
dn: ou=groups,dc=example,dc=com
objectClass: organizationalUnit
objectClass: top
ou: groups
$ ldapadd -h 192.168.1.2 -x -D "cn=Manager,dc=example,dc=com" -w redhat -f base.ldif
|
- 检查ldap1和ldap2中的数据对比
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
| #
$ ldapsearch -h 192.168.1.2 -x -D 'cn=Manager,dc=example,dc=com' -b dc=example,dc=com -w redhat
# extended LDIF
#
# LDAPv3
# base <dc=example,dc=com> with scope subtree
# filter: (objectclass=*) 19L, 623C
# requesting: ALL
#
# example.com
dn: dc=example,dc=com
objectClass: dcObject
objectClass: organization
o: example.com
dc: example
# users, example.com
dn: ou=users,dc=example,dc=com
objectClass: organizationalUnit
ou: users
# groups, example.com
dn: ou=groups,dc=example,dc=com
objectClass: organizationalUnit
ou: groups
# search result
search: 2
result: 0 Success
# numResponses: 4
# numEntries: 3
|
与ldap2 192.168.1.3中的数据进行对比
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
| #
$ ldapsearch -h 192.168.1.3 -x -D 'cn=Manager,dc=example,dc=com' -b dc=example,dc=com -w redhat
# extended LDIF
#
# LDAPv3
# base <dc=example,dc=com> with scope subtree
# filter: (objectclass=*) 19L, 623C
# requesting: ALL
#
# example.com
dn: dc=example,dc=com
objectClass: dcObject
objectClass: organization
o: example.com
dc: example
# users, example.com
dn: ou=users,dc=example,dc=com
objectClass: organizationalUnit
ou: users
# groups, example.com
dn: ou=groups,dc=example,dc=com
objectClass: organizationalUnit
ou: groups
# search result
search: 2
result: 0 Success
# numResponses: 4
# numEntries: 3
|
数据是一样的，注意：ldap2 192.168.1.3服务器的数据是从192.168.1.2中同步过来的。
3. 可以对ldap2 192.168.1.3中进行数据更新，再查看ldap1 192.168.1.2中的数据。确认互为主
在ldap2中添加用户
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
| $ cat users.ldif
dn: uid=testuser,ou=users,dc=example,dc=com
uid: testuser
cn: testuser
objectClass: shadowAccount
objectClass: top
objectClass: person
objectClass: inetOrgPerson
objectClass: posixAccount
userPassword: {SSHA}5rMM/3f8Ki13IyarGTtwzieoTu7KMgwc
shadowLastChange: 17016
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/testuser
sn: testuser
mail: testuser@example.com
$ ldapadd -h 192.168.1.3 -x -D cn=Manager,dc=example,dc=com -f users.ldif -w redhat
|
参考文章
OpenLDAP 极速搭建：双主同步
