注：以Ubuntu 10.04版本為例，LDAP服務(wù)器和客戶端為同一臺機器，最新openldap軟件服務(wù)器端無單獨的配置文件，而是將配置信息保存于數(shù)據(jù)庫中。
1. LDAP服務(wù)器端安裝與配置
1.1 安裝LDAP服務(wù)器相關(guān)軟件 sudo apt-get install slapd ldap-utils
1.2 配置LDAP服務(wù)器數(shù)據(jù)庫 sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldifsudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/misc.ldif (1)創(chuàng)建數(shù)據(jù)庫 在/var/lib/ldap/下創(chuàng)建create_database.ldif文件： # Load hdb backend module
dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module
olcModulepath: /usr/lib/ldap
olcModuleload: {0}back_hdb
# Create the hdb database and place the files under /var/lib/ldap
dn: olcDatabase={1}hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {1}hdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=edu,dc=example,dc=org
olcRootDN: cn=admin,dc=edu,dc=example,dc=org
olcRootPW: {SSHA}5EdV7cSYlP44/gEWu+x3VKAKLN2HG4VX
olcDbConfig: {0}set_cachesize 0 2097152 0
olcDbConfig: {1}set_lk_max_objects 1500
olcDbConfig: {2}set_lk_max_locks 1500
olcDbConfig: {3}set_lk_max_lockers 1500
olcLastMod: TRUE
olcDbCheckpoint: 512 30
olcDbIndex: uid pres,eq
olcDbIndex: cn,sn,mail pres,eq,approx,sub
olcDbIndex: objectClass eq 導(dǎo)入： sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /var/lib/ldap/create_database.ldif注：create_database.ldif文件中olcRootPW參數(shù)后面的密文對應(yīng)明文為"example"，可用slappasswd命令獲取明文對應(yīng)的密文
(2)初始化數(shù)據(jù)庫 在/var/lib/ldap/下創(chuàng)建init_database.ldif文件： dn: dc=edu,dc=example,dc=org
objectClass: top
objectClass: dcObject
objectclass: organization
o: edu.example.org
dc: edu
#description: LDAP root
dn: ou=People,dc=edu,dc=example,dc=org
objectClass: top
objectClass: organizationalUnit
ou: People
dn: ou=Groups,dc=edu,dc=example,dc=org
objectClass: top
objectClass: organizationalUnit
ou: Groups 導(dǎo)入： sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /var/lib/ldap/init_database.ldif
(3)modify the ACL to limit access to the database. 在/var/lib/ldap/下創(chuàng)建acls.ldif文件： dn:olcDatabase={1}hdb,cn=config
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=edu,dc=example,dc=org" write by anonymous auth by self write by * none
olcAccess: {1}to dn.subtree="" by * read
olcAccess: {2}to * by dn="cn=admin,dc=edu,dc=example,dc=org" write by * read 導(dǎo)入： sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f /var/lib/ldap/acls.ldif
(4)測試數(shù)據(jù)庫 sudo ldapsearch -x -h localhost -b dc=edu,dc=example,dc=org
1.3 使用遷移工具migrationtools (1)安裝 sudo apt-get install migrationtools
(2)使用該工具遷移Linux系統(tǒng)中的用戶和組到LDAP服務(wù)器中 cd /usr/share/migrationtools/ ./migrate_group.pl /etc/group ./group.ldif ./migrate_passwd.pl /etc/passwd ./passwd.ldif 修改group.ldif中組的父域名為ou=Groups,dc=edu,dc=example,dc=org 修改passwd.ldif中用戶的父域名為ou=People,dc=edu,dc=example,dc=orgldapadd -x -W -D "cn=admin,dc=edu,dc=example,dc=org" -f ./group.ldif ldapadd -x -W -D "cn=admin,dc=edu,dc=example,dc=org" -f ./passwd.ldif
1.4 使用ldap服務(wù)器管理工具ldapscripts (1)安裝 sudo apt-get install ldapscripts
(2)修改配置文件 # LDAP Configuration
# DEBIAN: values from /etc/pam_ldap.conf are used.
SERVER="ldap://localhost"
BINDDN="cn=admin,dc=edu,dc=example,dc=org"
# The following file contains the raw password of the binddn
# Create it with something like : echo -n 'secret' > $BINDPWDFILE
# WARNING !!!! Be careful not to make this file world-readable
# DEBIAN: /etc/pam_ldap.secret or /etc/ldap.secret are used.
BINDPWDFILE="/etc/ldapscripts/ldapscripts.passwd"
# For older versions of OpenLDAP, it is still possible to use
# unsecure command-line passwords by defining the following option
# AND commenting the previous one (BINDPWDFILE takes precedence)
#BINDPWD="secret"
# DEBIAN: values from /etc/pam_ldap.conf are used.
SUFFIX="dc=edu,dc=example,dc=org" # Global suffix
GSUFFIX="ou=Groups" # Groups ou (just under $SUFFIX)
USUFFIX="ou=People" # Users ou (just under $SUFFIX)
#MSUFFIX="ou=Machines" # Machines ou (just under $SUFFIX)
# User passwords generation
# Command-line used to generate a password for added users (you may use %u for username here)
# WARNING !!!! This is evaluated, everything specified here will be run !
# Special value "" will ask for a password interactively
#PASSWORDGEN="cat /dev/random | LC_ALL=C tr -dc 'a-zA-Z0-9' | head -c8"
#PASSWORDGEN="head -c8 /dev/random | uuencode -m - | sed -n '2s|=*$||;2p' | sed -e 's|+||g' -e 's|/||g'"
#PASSWORDGEN="pwgen"
#PASSWORDGEN="echo changeme"
#PASSWORDGEN="echo %u"
PASSWORDGEN="" 注：如紅字所示，照應(yīng)前面的配置，向ldapscripts.passwd寫入密碼的命令為：echo -n 'example' > /etc/ldapscripts/ldapscripts.passwd
(3)使用 sudo ldapaddgroup testgroup sudo ldapadduser testuser testgroup sudo ldapsetpasswd testuser
(4)測試 getent passwd getent group