openldap中文安装说明 openldap使用

一、配置

配置文件一般在/etc/openldap/slapd.conf 或/usr/local/etc/openldap/slapd.conf

 

1.数据库的基本配置s

database        bdb
suffix          "dc=zy,dc=net"
rootdn          "cn=Manager,dc=zy,dc=net"
rootpw          123456

 

2.ACL  Access Control List

禁止匿名访问

access to *
        by self write
        by users read
        by anonymous auth

 

3. sizelimit  num

指定从一个搜索操作中返回的最大entry个数

默认值是500，unlimited表示没有限制

sizelimit  100  搜索返回的entry个数最大是100

sizelimit  unlimited 不限制搜索返回的entry的个数的最大值

 

二、操作

1. 指定端口启动

启动: slapd

指定端口启动: slapd -h "ldap:///  ldaps:///"       默认从389,636监听

修改默认的389端口：

# ps -ef |grep slapd
root      7322     1  0 11:04 ?        00:00:00 slapd -h ldap:///
root      7325  6997  0 11:04 pts/2    00:00:00 grep slapd
# kill 7322
# slapd -h "ldap://:2009"
# ps -ef |grep slapd
root      7338     1  0 11:06 ?        00:00:00 slapd -h ldap://:2009
root      7341  6997  0 11:06 pts/2    00:00:00 grep slapd
[root@localhost openldap]# netstat -ant|grep 389
[root@localhost openldap]# netstat -ant|grep 2009
tcp        0      0 0.0.0.0:2009                0.0.0.0:*                   LISTEN
tcp        0      0 :::2009                     :::*                        LISTEN

使用默认389端口

# slapd -h "ldap:///"
slapd  -h "ldap:/// ldaps:///"         //启用389端口，和SSL的636端口
slapd  -h "ldap://:2009 ldaps://:2010" // ldap使用2009监听，ldaps使用2010监听

2.Operation:

 

目录：/usr/bin

常用参数

-x     Use simple authentication instead of SASL.
-f file  Read a series of lines from file
-D binddn
 Use the Distinguished Name binddn to bind to the LDAP directory.
-W     Prompt for simple authentication.  
-w passwd  Use passwd as the password for simple authentication.
-h ldaphost
Specify an alternate host on which the ldap server  is  running.
-p ldapport
Specify  an  alternate TCP port where the ldap server is listening.  
-b searchbase
Use searchbase as the starting point for the search  
-h ldaphost
Specify an alternate host on which the ldap server  is  running.
————————————————

-h ldaphost

Specify an alternate host on which the ldap server  is  running.

 (1) ldapadd

#ldapadd -x -D "cn=Manager,dc=zy,dc=net" -w 123456  -f  1.ldif

(2)ldapdelete

#ldapdelete "ou=qa,dc=zy,dc=net" -x -D "cn=Manager,dc=zy,dc=net" -w 123456

(3)ldapsearch

ldapsearch -x -h 10.226.45.197 -b "ou=qa,dc=zy,dc=net" -D "cn=test1,ou=qa,dc=zy,dc=net" -w testpass '(objectclass=*)'
在主机10.226.45.197上，查询 base DN 为"ou=qa,dc=zy,dc=net" ,绑定为cn=test1,ou=qa,dc=zy,dc=net 密码为testpass ，search filter为了（objecttclass=*）的entry