搜索

此内容没有您所选择的语言版本。

28.6. OpenLDAP Setup Overview

download PDF
This section provides a quick overview for installing and configuring an OpenLDAP directory. For more details, refer to the following URLs:
The basic steps for creating an LDAP server are as follows:
  1. Install the openldap, openldap-servers, and openldap-clients RPMs.
  2. Edit the /etc/openldap/slapd.conf file to specify the LDAP domain and server. Refer to Section 28.6.1, “Editing /etc/openldap/slapd.conf for more information.
  3. Start slapd with the command:
    service ldap start
    After configuring LDAP, use chkconfig, /usr/sbin/ntsysv, or the Services Configuration Tool to configure LDAP to start at boot time. For more information about configuring services, refer to Chapter 18, Controlling Access to Services.
  4. Add entries to an LDAP directory with ldapadd.
  5. Use ldapsearch to determine if slapd is accessing the information correctly.
  6. At this point, the LDAP directory should be functioning properly and can be configured with LDAP-enabled applications.

28.6.1. Editing /etc/openldap/slapd.conf

To use the slapd LDAP server, modify its configuration file, /etc/openldap/slapd.conf, to specify the correct domain and server.
The suffix line names the domain for which the LDAP server provides information and should be changed from:
suffix          "dc=your-domain,dc=com"
Edit it accordingly so that it reflects a fully qualified domain name. For example:
suffix          "dc=example,dc=com"
The rootdn entry is the Distinguished Name (DN) for a user who is unrestricted by access controls or administrative limit parameters set for operations on the LDAP directory. The rootdn user can be thought of as the root user for the LDAP directory. In the configuration file, change the rootdn line from its default value as in the following example:
rootdn          "cn=root,dc=example,dc=com"
When populating an LDAP directory over a network, change the rootpw line — replacing the default value with an encrypted password string. To create an encrypted password string, type the following command:
slappasswd
When prompted, type and then re-type a password. The program prints the resulting encrypted password to the shell prompt.
Next, copy the newly created encrypted password into the /etc/openldap/slapd.conf on one of the rootpw lines and remove the hash mark (#).
When finished, the line should look similar to the following example:
rootpw {SSHA}vv2y+i6V6esazrIv70xSSnNAJE18bb2u

Warning

LDAP passwords, including the rootpw directive specified in /etc/openldap/slapd.conf, are sent over the network unencrypted, unless TLS encryption is enabled.
To enable TLS encryption, review the comments in /etc/openldap/slapd.conf and refer to the man page for slapd.conf.
For added security, the rootpw directive should be commented out after populating the LDAP directory by preceding it with a hash mark (#).
When using the /usr/sbin/slapadd command line tool locally to populate the LDAP directory, use of the rootpw directive is not necessary.

Important

Only the root user can use /usr/sbin/slapadd. However, the directory server runs as the ldap user. Therefore, the directory server is unable to modify any files created by slapadd. To correct this issue, after using slapadd, type the following command:
chown -R ldap /var/lib/ldap
Red Hat logoGithubRedditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务,以及可以信赖的内容,帮助红帽用户创新并实现他们的目标。

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情,请参阅红帽博客.

關於紅帽

我们提供强化的解决方案,使企业能够更轻松地跨平台和环境(从核心数据中心到网络边缘)工作。

© 2024 Red Hat, Inc.