08-OpenLDAP主机控制策略

时间：2023-03-09 19:36:53
08-OpenLDAP主机控制策略

OpenLDAP主机控制策略

阅读视图

  1. 参考
  2. 环境准备
  3. openldap服务端配置
  4. openldap客户端配置
  5. 客户端测试登录
  6. 故障处理

1. 参考

本文基本转载博客openldap主机访问控制（基于hostname）

该博主另一篇文档，还没测试openldap主机访问控制（基于ip）

2. 环境准备

因为本文与其他文档属性不冲突，所以完全可以使用以前的环境做实验。

3. openldap服务端配置

  1. 导入ldapns.schema方案，（hostObject类属性）

    https://github.com/openldap/openldap/blob/master/contrib/slapd-modules/nssov/ldapns.schema

    cat > /etc/openldap/schema/ldapns.schema << _EOF_
    
# $OpenLDAP$
    
# $Id: ldapns.schema,v 1.3 2009-10-01 19:17:20 tedcheng Exp $
    
# LDAP Name Service Additional Schema
    
# http://www.iana.org/assignments/gssapi-service-names

#
    
# Not part of the distribution: this is a workaround!
    
#

attributetype ( 1.3.6.1.4.1.5322.17.2.1 NAME 'authorizedService'
    
        DESC 'IANA GSS-API authorized service name'
    
        EQUALITY caseIgnoreMatch
    
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )

attributetype ( 1.3.6.1.4.1.5322.17.2.2 NAME 'loginStatus'
    
        DESC 'Currently logged in sessions for a user'
    
        EQUALITY caseIgnoreMatch
    
        SUBSTR caseIgnoreSubstringsMatch
    
        ORDERING caseIgnoreOrderingMatch
    
        SYNTAX OMsDirectoryString )

objectclass ( 1.3.6.1.4.1.5322.17.1.1 NAME 'authorizedServiceObject'
    
        DESC 'Auxiliary object class for adding authorizedService attribute'
    
        SUP top
    
        AUXILIARY
    
        MAY authorizedService )

objectclass ( 1.3.6.1.4.1.5322.17.1.2 NAME 'hostObject'
    
        DESC 'Auxiliary object class for adding host attribute'
    
        SUP top
    
        AUXILIARY
    
        MAY host )

objectclass ( 1.3.6.1.4.1.5322.17.1.3 NAME 'loginStatusObject'
    
        DESC 'Auxiliary object class for login status attribute'
    
        SUP top
    
        AUXILIARY
    
        MAY loginStatus )
    
_EOF_

    复制到/etc/openldap/schema/ldapns.schema

  2. 配置slapd.conf配置文件

    include         /etc/openldap/schema/ldapns.schema
    
include         /etc/openldap/schema/dyngroup.schema

modulepath /usr/lib64/openldap
    
moduleload dynlist.la

overlay dynlist
    
dynlist-attrset inetOrgPerson labeledURI
    rm -rf /etc/openldap/slapd.d/*
    
slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
    
chown -R ldap:ldap /etc/openldap/slapd.d
    
systemctl restart slapd

  3. 验证服务端是否正常加载

    08-OpenLDAP主机控制策略

    08-OpenLDAP主机控制策略

  4. 定义主机列表组

    cat << _EOF_ | ldapadd -x -W -H ldapi:/// -D cn=Manager,dc=gdy,dc=com
    
dn: ou=servers,dc=gdy,dc=com
    
objectClass: organizationalUnit
    
ou: servers

dn: ou=apphost,ou=servers,dc=gdy,dc=com
    
objectClass: organizationalUnit
    
objectClass: hostObject
    
ou: apphost
    
host: test01.gdy.com

dn: ou=dbhost,ou=servers,dc=gdy,dc=com
    
objectClass: organizationalUnit
    
objectClass: hostObject
    
ou: dbhost
    
host: test02.gdy.com
    
_EOF_

  5. 定义用户

    cat << _EOF_ | ldapadd -x -W -H ldapi:/// -D cn=Manager,dc=gdy,dc=com
    
dn: uid=lisi,ou=people,dc=gdy,dc=com
    
objectClass: posixAccount
    
objectClass: shadowAccount
    
objectClass: person
    
objectClass: inetOrgPerson
    
objectClass: hostObject
    
cn: lisi
    
sn: lisi
    
uid: lisi
    
userPassword: {CRYPT}$6$AgFUbww9$Pa70MIDhUT2z3.Sg83VRnWnaDRubTHJsSxYMzbD3LQlMmXX0VeqHRHd2usrJbId.oFOeoMKi3GC60qjIHUKqK.
    
uidNumber: 10006
    
gidNumber: 10010
    
gecos: App Manager
    
homeDirectory: /home/lisi
    
loginShell: /bin/bash
    
shadowLastChange: 15000
    
shadowMin: 0
    
shadowMax: 999999
    
shadowWarning: 7
    
shadowExpire: -1
    
mobile: 13900001001
    
mail: lisi@gdy.com
    
labeledURI: ldap:///ou=apphost,ou=servers,dc=gdy,dc=com?host
    
_EOF_
    cat << _EOF_ | ldapadd -x -W -H ldapi:/// -D cn=Manager,dc=gdy,dc=com
    
dn: uid=zhangsan,ou=people,dc=gdy,dc=com
    
objectClass: posixAccount
    
objectClass: shadowAccount
    
objectClass: person
    
objectClass: inetOrgPerson
    
objectClass: hostObject
    
cn: zhangsan
    
sn: zhangsan
    
uid: zhangsan
    
userPassword: {CRYPT}$6$0hM3RIS/$omCj0x/ggD.zy3pNNjVo80nhiYHbUvdQaBKsawBBTQ/r/KY2PD77NHDqEPgzZ1Wz2/ZiL./pL65BuNyZ1SHC41
    
uidNumber: 10007
    
gidNumber: 10011
    
gecos: opteam
    
homeDirectory: /home/zhangsan
    
loginShell: /bin/bash
    
shadowLastChange: 15000
    
shadowMin: 0
    
shadowMax: 999999
    
shadowWarning: 7
    
shadowExpire: -1
    
mobile: 13900001002
    
mail: zhangsan@gdy.com
    
labeledURI: ldap:///ou=devhost,ou=servers,dc=gdy,dc=com?host
    
_EOF_

4. openldap客户端配置

  1. 定义FQDN解析, 已测试过如果不定义会登录不成功

    cat >> /etc/hosts << EOF
    
192.168.244.17    mldap01.gdy.com    mldap01
    
192.168.244.18    test01.gdy.com     test01

  2. pam_ldap.conf参数规划

    cat >> /etc/pam_ldap.conf  << EOF
    
pam_check_host_attr yes
    
EOF

5. 客户端测试登录

  1. 正确实例

    [root@test01 ~]# ssh lisi@127.0.0.1
    
lisi@127.0.0.1's password:
    
Last login: Fri Jun  1 16:24:12 2018 from localhost
    
[lisi@test01 ~]$ hostname
    
test01.gdy.com

  2. 失败实例

    [root@test01 ~]# ssh zhangsan@127.0.0.1
    
zhangsan@127.0.0.1's password:
    
Access denied for this host
    
Connection closed by 127.0.0.1

  3. 如果用户没有配置好登录属性，服务器基本就全部登录不了。

6. 故障处理

  1. PS1变量失效，错误如下

    [root@test01 home]# ssh lisi@127.0.0.1
    
lisi@127.0.0.1's password:
    
Permission denied, please try again.
    
lisi@127.0.0.1's password:
    
Last login: Fri Jun  1 14:10:53 2018 from localhost
    
-sh-4.1$      # 发现显示不正常

    解决方法：重新配置了一遍，发现loginShell忘记定义或者定义有问题导致loginShell属性不存在。所以会产生如上bug。

相关文章