OpenLDAP + phpLDAPadmin 설치 및 설정

---

OpenLDAP

• LDAP 프로토콜을 사용하여 디렉토리(사용자/그룹) 정보를 저장하고 검색하는 역할의 서비스

phpLDAPadmin

• OpenLDAP 서버를 웹 기반으로 관리하기 위한 LDAP 클라이언트 웹 애플리케이션

 

1. Install OpenLDAP

$ sudo yum -y install openldap-servers openldap-clients
$ sudo systemctl start slapd
$ sudo systemctl status slapd
$ sudo systemctl enable slapd
$ sudo yum -y install net-tools
$ sudo netstat -antup | grep -i 389
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 8969/slapd
tcp6 0 0 :::389 :::* LISTEN 8969/slapd

 

2. Setup LDAP admin password

• slappasswd 결과 생성된 결과값인 '{SSHA}...' 부분은 db.ldif에서 사용해야 하므로 별도로 기록해야 함

$ slappasswd
New password:
Re-enter new password:
{SSHA}V+r+8lNWJ+l/XCJg6IJn/uE/EEjLOrHl

 

3. Configure OpenLDAP server

• db.ldif 파일 생성하여 반영해줌

$ cd /etc/openldap/slapd.d/
$ vi db.ldif
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=hadoop,dc=com
-
replace: olcRootDN
olcRootDN: cn=ldapadm,dc=hadoop,dc=com
-
replace: olcRootPW
olcRootPW: {SSHA}V+r+8lNWJ+l/XCJg6IJn/uE/EEjLOrHl

 

• db.ldif 파일을 ldapmodify 프로그램을 통해 적용

$ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f db.ldif
$ sudo ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b "olcDatabase={2}hdb,cn=config"

 

• monitor.ldif

$ vi monitor.ldif
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external, cn=auth" read by dn.base="cn=ldapadm,dc=hadoop,dc=com" read by * none

 

• monitor.ldif 파일을 ldapmodify 프로그램을 통해 적용

$ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f monitor.ldif
$ sudo ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b "olcDatabase={1}monitor,cn=config"

 

4. Set up LDAP database

• DB_CONFIG.example을 활용해 DB_CONFIG 적용

$ sudo cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
$ sudo chown ldap:ldap /var/lib/ldap/DB_CONFIG
$ sudo ls -al /var/lib/ldap/DB_CONFIG
$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif

 

• base.ldif 파일 생성할 때 각 dn별로 1줄씩 공백을 줘야함

$ vi base.ldif
dn: dc=hadoop,dc=com
dc: hadoop
objectClass: top
objectClass: domain

dn: cn=ldapadm,dc=hadoop,dc=com
objectClass: organizationalRole
cn: ldapadm
description: LDAP Manager

dn: ou=user,dc=hadoop,dc=com
objectClass: organizationalUnit
ou: user

dn: ou=group,dc=hadoop,dc=com
objectClass: organizationalUnit
ou: group

 

• ldapadd를 통해 base.ldif 파일 적용, password 입력필요

$ sudo ldapadd -x -W -D "cn=ldapadm,dc=hadoop,dc=com" -f base.ldif
Enter LDAP Password: 
adding new entry "cn=ldapadm,dc=hadoop,dc=com"
adding new entry "ou=user,dc=hadoop,dc=com"
adding new entry "ou=group,dc=hadoop,dc=com"

 

5. PhpLDAPAdmin install

• phpldapadmin 설치를 위해 epel-release를 추가로 설치한 후 phpldapadmin을 설치해야 함

$ rpm -ivh http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
$ sudo yum --enablerepo=epel -y install phpldapadmin

 

• rpm으로 epel 설치 시 에러 날 경우 수동으로 추가 해줌

$ yum remove epel-release.noarch
$ vi /etc/yum.repos.d/epel.repo
[epel]
name=Extra Packages for Enterprise Linux 7 - $basearch
baseurl=http://download.fedoraproject.org/pub/epel/7/$basearch
#metalink=https://mirrors.fedoraproject.org/metalink?repo=epel-7&arch=$basearch&infra=$infra&content=$contentdir
#failovermethod=priority
enabled=1
gpgcheck=0
#gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7

#[epel-debuginfo]
#name=Extra Packages for Enterprise Linux 7 - $basearch - Debug
#baseurl=http://download.fedoraproject.org/pub/epel/7/$basearch/debug
#metalink=https://mirrors.fedoraproject.org/metalink?repo=epel-debug-7&arch=$basearch&infra=$infra&content=$contentdir
#failovermethod=priority
#enabled=0
#gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
#gpgcheck=1

#[epel-source]
#name=Extra Packages for Enterprise Linux 7 - $basearch - Source
#baseurl=http://download.fedoraproject.org/pub/epel/7/SRPMS
#metalink=https://mirrors.fedoraproject.org/metalink?repo=epel-source-7&arch=$basearch&infra=$infra&content=$contentdir
#failovermethod=priority
#enabled=0
#gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
#gpgcheck=1

 

• /etc/phpldapadmin/config.php 수정

$ sudo vi /etc/phpldapadmin/config.php
...(중략)
/* A convenient name that will appear in the tree viewer and throughout
phpLDAPadmin to identify this LDAP server to users. */
$servers->setValue('server','name','Local LDAP Server'); <-- 여기 수정
/* Examples:
'ldap.example.com',
'ldaps://ldap.example.com/',
'ldapi://%2fusr%local%2fvar%2frun%2fldapi'
(Unix socket at /usr/local/var/run/ldap) */
// $servers->setValue('server','host','127.0.0.1');
$servers->setValue('server','host','ip or host명 입력'); <-- 여기 수정
/* The port your LDAP server listens on (no quotes). 389 is standard. */
// $servers->setValue('server','port',389);
/* Array of base DNs of your LDAP server. Leave this blank to have phpLDAPadmin
auto-detect it for you. */
// $servers->setValue('server','base',array(''));
$servers->setValue('server','base',array('dc=hadoop,dc=com')); <-- 여기 수정
...(중략)
/* If you specified 'cookie' or 'session' as the auth_type above, you can
optionally specify here an attribute to use when logging in. If you enter
'uid' and login as 'dsmith', phpLDAPadmin will search for (uid=dsmith)
and log in as that user.
Leave blank or specify 'dn' to use full DN for logging in. Note also that if
your LDAP server requires you to login to perform searches, you can enter the
DN to use when searching in 'bind_id' and 'bind_pass' above. */
$servers->setValue('login','attr','dn'); <-- 여기 수정, 주석 해제
//$servers->setValue('login','attr','uid'); <-- 여기 수정, 주석 처리
...(중략)

 

• /etc/httpd/conf.d/phpldapadmin.conf 수정

$ sudo vi /etc/httpd/conf.d/phpldapadmin.conf

#
# Web-based tool for managing LDAP servers
#
Alias /phpldapadmin /usr/share/phpldapadmin/htdocs
Alias /ldapadmin /usr/share/phpldapadmin/htdocs
<Directory /usr/share/phpldapadmin/htdocs>
	<IfModule mod_authz_core.c>
	# Apache 2.4
	# Require local
	Require all granted <-- 여기 추가
	</IfModule>
	<IfModule !mod_authz_core.c>
	# Apache 2.2
	Order Deny,Allow
	Deny from all
	Allow from 127.0.0.1
	Allow from ::1
	</IfModule>
</Directory>

 

• httpd 재기동

$ systemctl restart httpd

 

6. http://${설치서버}/phpldapadmin/ 접속 

Login DN: cn=ldapadm,dc=hadoop,dc=com

Password: ${password}