CentOS7上搭建LDAP-PDC并且将windows 2008 R2加入LDAP-PDC域

　　由于测试原因，要涉及到将windows机器加入到ldap域，所以查看各种文档进行ldap-pdc域的搭建，并成功将windows 2008r2加入到ldap-pdc域中。下面简单记录一下搭建过程

　　Linux : CentOS7.4.1708  ip:10.2.48.125

　　Windows  : Windows 2008 R2 ip:10.2.48.86

　　配置了163yum源，并且把seLinux关闭

　　先安装openldap 和 samba

 yum install openldap openldap-clients openldap-servers migrationtools samba

更改配置文件

 cp /usr/share/doc/samba-4.7./LDAP/samba.ldif  /etc/openldap/schema/
 cp /usr/share/openldap-servers/slapd.ldif  /home/

　生成ldap的管理密码slappasswd

 [root@ldap-pdc ~]# slappasswd
 New password:
 Re-enter new password:
 {SSHA}sGQJ/b8qamHOmbbBxdxUldfxm3R6ODIj

将slapd.ldif中的dc=my-doamin,dc=com修改为自己的域名，例如我的dc=ldap-pdc,dc=com，并添加部分配置文件，贴出配置文件，标红的位置需要修改

 #
 # See slapd-config() for details on configuration options.
 # This file should NOT be world readable.
 #

 dn: cn=config
 objectClass: olcGlobal
 cn: config
 olcArgsFile: /var/run/openldap/slapd.args
 olcPidFile: /var/run/openldap/slapd.pid
 #
 # TLS settings
 #
 olcTLSCACertificatePath: /etc/openldap/certs
 olcTLSCertificateFile: "OpenLDAP Server"
 olcTLSCertificateKeyFile: /etc/openldap/certs/password
 #
 # Do not enable referrals until AFTER you have a working directory
 # service AND an understanding of referrals.
 #
 #olcReferral: ldap://root.openldap.org
 #
 # Sample security restrictions
 #       Require integrity protection (prevent hijacking)
 #       Require -bit (3DES or better) encryption for updates
 #       Require -bit encryption for simple bind
 #
 #olcSecurity: ssf= update_ssf= simple_bind=

 #
 # Load dynamic backend modules:
 # - modulepath is architecture dependent value (/-bit system)
 # - back_sql.la backend requires openldap-servers-sql package
 # - dyngroup.la and dynlist.la cannot be used at the same time
 #

 #dn: cn=module,cn=config
 #objectClass: olcModuleList
 #cn: module
 #olcModulepath: /usr/lib/openldap
 #olcModulepath: /usr/lib64/openldap
 #olcModuleload: accesslog.la
 #olcModuleload: auditlog.la
 #olcModuleload: back_dnssrv.la
 #olcModuleload: back_ldap.la
 #olcModuleload: back_mdb.la
 #olcModuleload: back_meta.la
 #olcModuleload: back_null.la
 #olcModuleload: back_passwd.la
 #olcModuleload: back_relay.la
 #olcModuleload: back_shell.la
 #olcModuleload: back_sock.la
 #olcModuleload: collect.la
 #olcModuleload: constraint.la
 #olcModuleload: dds.la
 #olcModuleload: deref.la
 #olcModuleload: dyngroup.la
 #olcModuleload: dynlist.la
 #olcModuleload: memberof.la
 #olcModuleload: pcache.la
 #olcModuleload: ppolicy.la
 #olcModuleload: refint.la
 #olcModuleload: retcode.la
 #olcModuleload: rwm.la
 #olcModuleload: seqmod.la
 #olcModuleload: smbk5pwd.la
 #olcModuleload: sssvlv.la
 #olcModuleload: syncprov.la
 #olcModuleload: translucent.la
 #olcModuleload: unique.la
 #olcModuleload: valsort.la
 #
 # Schema settings
 #

 dn: cn=schema,cn=config
 objectClass: olcSchemaConfig
 cn: schema

 81 include: file:///etc/openldap/schema/core.ldif
 82 include: file:///etc/openldap/schema/corba.ldif
 83 include: file:///etc/openldap/schema/cosine.ldif
 84 include: file:///etc/openldap/schema/duaconf.ldif
 85 include: file:///etc/openldap/schema/dyngroup.ldif
 86 include: file:///etc/openldap/schema/inetorgperson.ldif
 87 include: file:///etc/openldap/schema/java.ldif
 88 include: file:///etc/openldap/schema/misc.ldif
 89 include: file:///etc/openldap/schema/nis.ldif
 90 include: file:///etc/openldap/schema/openldap.ldif
 91 include: file:///etc/openldap/schema/ppolicy.ldif
 92 include: file:///etc/openldap/schema/collective.ldif
 93 include: file:///etc/openldap/schema/samba.ldif

 #
 # Frontend settings
 #

 dn: olcDatabase=frontend,cn=config
 objectClass: olcDatabaseConfig
 objectClass: olcFrontendConfig
 olcDatabase: frontend
 #
 # Sample global access control policy:
 #       Root DSE: allow anyone to read it
 #       Subschema (sub)entry DSE: allow anyone to read it
 #       Other DSEs:
 #               Allow self write access
 #               Allow authenticated users read access
 #               Allow anonymous users to authenticate
 #
 #olcAccess: to dn.base="" by * read
 #olcAccess: to dn.base="cn=Subschema" by * read
 #olcAccess: to *
 #       by self write
 #       by users read
 #       by anonymous auth
 #
 # if no access controls are present, the default policy
 # allows anyone and everyone to read anything but restricts
 # updates to rootdn.  (e.g., "access to * by * read")
 #
 # rootdn can always read and write EVERYTHING!
 #

 #
 # Configuration database
 #

 dn: olcDatabase=config,cn=config
 objectClass: olcDatabaseConfig
 olcDatabase: config
 olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c
  n=auth" manage by * none

 #
 # Server status monitoring
 #
 dn: olcDatabase=monitor,cn=config
 objectClass: olcDatabaseConfig
 olcDatabase: monitor
 olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c
  n=auth" read by dn.base="cn=Manager,dc=ldap-pdc,dc=com" read by * none

 #
 # Backend database definitions
 #

 dn: olcDatabase=hdb,cn=config
 objectClass: olcDatabaseConfig
 objectClass: olcHdbConfig
 olcDatabase: hdb
155 olcSuffix: dc=ldap-pdc,dc=com
156 olcRootDN: cn=Manager,dc=ldap-pdc,dc=com
 olcDbDirectory: /var/lib/ldap
158 olcDbIndex: objectClass eq,pres
159 olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
160 olcRootPW:      {SSHA}CC+i80oqumZigXsWtKf4PJFHEfmyUtTd     #密码前边是TAB贱，注意不要留空格

　　执行命令

 rm -rf /etc/openldap/slapd.d/*
 slapadd -F /etc/openldap/slapd.d/ -n 0 -l /home/slapd.ldif
 slaptest -u -F /etc/openldap/slapd.d/

　　当出现

 [root@ldap-pdc home]# slaptest -u -F /etc/openldap/slapd.d/
 config file testing succeeded
 [root@ldap-pdc home]# 

　　代表配置文件没有问题。可以往下进行

　　执行命令

 chown -Rv ldap.ldap /etc/openldap/slapd.d
 cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
 chown -Rv ldap.ldap /var/lib/ldap/DB_CONFIG
 systemctl start slapd.service

　　当显示

 [root@ldap-pdc home]# systemctl status slapd.service
 ● slapd.service - OpenLDAP Server Daemon
    Loaded: loaded (/usr/lib/systemd/system/slapd.service; disabled; vendor preset: disabled)
    Active: active (running) since Wed -- :: CST;  day 8h ago
      Docs: man:slapd
            man:slapd-config
            man:slapd-hdb
            man:slapd-mdb
            file:///usr/share/doc/openldap-servers/guide.html
   Process:  ExecStart=/usr/sbin/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS (code=exited, status=/SUCCESS)
   Process:  ExecStartPre=/usr/libexec/openldap/check-config.sh (code=exited, status=/SUCCESS)
  Main PID:  (slapd)
    CGroup: /system.slice/slapd.service
            └─ /usr/sbin/slapd -u ldap -h ldapi:/// ldap:///

　　生成基本的ldap数据

 vim /usr/share/migrationtools/migrate_common.ph

 # Default DNS domain
 $DEFAULT_MAIL_DOMAIN = "ldap-pdc.com";

 # Default base
 $DEFAULT_BASE = "dc=ldap-pdc,dc=com";

 chmod +x /usr/share/migrationtools/migrate_common.ph
 /usr/share/migrationtools/migrate_base.pl > /root/base.ldif
 /usr/share/migrationtools/migrate_passwd.pl /etc/passwd /root/user.ldif
 /usr/share/migrationtools/migrate_group.pl /etc/group /root/group.ldif

在bash.ldif和user.ldif以及group.ldif文件中删除与ldap无关的信息，之后进行数据的导入

 ldapadd -D "cn=Manager,dc=ldap-pdc,dc=com" -W -x -f base.ldif
 ldapadd -D "cn=Manager,dc=ldap-pdc,dc=com" -W -x -f group.ldif
 ldapadd -D "cn=Manager,dc=ldap-pdc,dc=com" -W -x -f user.ldif

　　如果无报错信息，就代表数据正常导入。

　　配置ldap日志

 vi /etc/rsyslog.conf

 local4.*    /var/log/ldap.log    #尾部添加

 touch /var/log/ldap.log         #创建日志文件
 systemctl restart rsyslog.service   重启服务

　　下面配置samba

 yum  install nss-pam-ldapd samba-winbind sssd-ldap perl perl-LDAP.noarch epel-release smbldap-tools.noarch   sssd* pam_ldap openldap-clients
 cp /etc/samba/smb.conf /etc/samba/smb.conf.bak
 cp /usr/share/doc/smbldap-tools-0.9./smb.conf.example /etc/samba/smb.conf

 vim /etc/samba/smb.conf

 [global]
         workgroup = ldap-pdc
         netbios name = PDC-SRV

         deadtime = 

         log level =
         log file = /var/log/samba/log.%m
         max log size =
         debug pid = yes
         debug uid = yes
         utmp = yes

         security = user
         domain logons = yes
         os level =
         logon path =
         logon home =
         logon drive =
         logon script =

         passdb backend = ldapsam:"ldap://10.2.48.125"
         ldap ssl = no
         ldap admin dn = cn=Manager,dc=ldap-pdc,dc=com
         ldap delete dn = no

         ## Sync UNIX password with Samba password
         ## Method :
         unix password sync = no
         ldap password sync = yes
         ## Method :
         ;ldap password sync = no
         ;unix password sync = yes
         ;passwd program = /usr/sbin/smbldap-passwd -u '%u'
         ;passwd chat = "Changing *\nNew password*" %n\n "*Retype new password*" %n\n"

         ldap suffix = dc=ldap-pdc,dc=com
         ldap user suffix = ou=Users
         ldap group suffix = ou=Groups
         ldap machine suffix = ou=Computers
         ldap idmap suffix = ou=Idmap
         add user script = /usr/sbin/smbldap-useradd -m '%u' -t
         rename user script = /usr/sbin/smbldap-usermod -r '%unew' '%uold'
         delete user script = /usr/sbin/smbldap-userdel '%u'
         set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
         add group script = /usr/sbin/smbldap-groupadd -p '%g'
         delete group script = /usr/sbin/smbldap-groupdel '%g'
         add user to group script = /usr/sbin/smbldap-groupmod -m '%u' '%g'
         delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g'
         add machine script = /usr/sbin/smbldap-useradd -w '%u' -t 

 [NETLOGON]
         path = /var/lib/samba/netlogon
         browseable = no

 [PROFILES]
         path = /var/lib/samba/profiles
         browseable = no
         writeable = yes
         create mask =
         directory mask =
         csc policy = disable
         map system = yes
         map hidden = yes

　　上述内容根据需要进行定制。

 systemctl startt smb
 smbldap-config
 smbldap-populate

　　修改nsswitch.conf

 # To use db, put the "db" in front of "files" for entries you want to be
 # looked up first in the databases
 #
 # Example:
 #passwd:    db files nisplus nis
 #shadow:    db files nisplus nis
 #group:     db files nisplus nis

 9 passwd:     files ldap
10 shadow:     files ldap
11 group:      files ldap
 #initgroups: files sss

 #hosts:     db files nisplus nis dns
 hosts:      files ldap myhostname

 # Example - obey only what nisplus tells us...
 #services:   nisplus [NOTFOUND=return] files
 #networks:   nisplus [NOTFOUND=return] files
 #protocols:  nisplus [NOTFOUND=return] files
 #rpc:        nisplus [NOTFOUND=return] files
 #ethers:     nisplus [NOTFOUND=return] files
 #netmasks:   nisplus [NOTFOUND=return] files     

 bootparams: nisplus [NOTFOUND=return] files

 ethers:     files
 netmasks:   files
 networks:   files
 protocols:  files
 rpc:        files
 services:   files sss

 netgroup:   files  ldap

 publickey:  nisplus

 automount:  files ldap
 aliases:    files nisplus

　　修改/etc/nslcd.conf文件

 # This is the configuration file for the LDAP nameservice
 # switch library's nslcd daemon. It configures the mapping
 # between NSS names (see /etc/nsswitch.conf) and LDAP
 # information in the directory.
 # See the manual page nslcd.conf() for more information.

 # The user and group nslcd should run as.
 uid nslcd
 gid ldap

 # The uri pointing to the LDAP server to use for name lookups.
 # Multiple entries may be specified. The address that is used
 # here should be resolvable without using LDAP (obviously).
 #uri ldap://127.0.0.1/
 #uri ldaps://127.0.0.1/
 #uri ldapi://%2fvar%2frun%2fldapi_sock/
 # Note: %2f encodes the '/' used as directory separator
 18 uri ldap://10.2.48.125/

 # The LDAP version to use (defaults to
 # if supported by client library)
 #ldap_version 

 # The distinguished name of the search base.
 25 base dc=ldap-pdc,dc=com

 # The distinguished name to bind to the server with.
 # Optional: default is to bind anonymously.
 #binddn cn=proxyuser,dc=example,dc=com

 # The credentials to bind with.
 # Optional: default is no credentials.
 # Note that if you set a bindpw you should check the permissions of this file.
 #bindpw secret

 # The distinguished name to perform password modifications by root by.
 #rootpwmoddn cn=admin,dc=example,dc=com

 # The default search scope.
 #scope sub
 #scope one
 #scope base

 # Customize certain database lookups.
 #base   group  ou=Groups,dc=example,dc=com
 #base   passwd ou=People,dc=example,dc=com
 #base   shadow ou=People,dc=example,dc=com
 #scope  group  onelevel
 #scope  hosts  sub

 # Bind/connect timelimit.
 #bind_timelimit 

 # Search timelimit.
 #timelimit 

 # Idle timelimit. nslcd will close connections if the
 # server has not been contacted for the number of seconds.
 #idle_timelimit 

 # Use StartTLS without verifying the server certificate.
 #ssl start_tls
 #tls_reqcert never

 # CA certificates for server certificate verification
 #tls_cacertdir /etc/ssl/certs
 #tls_cacertfile /etc/ssl/ca.cert

 # Seed the PRNG if /dev/urandom is not provided
 #tls_randfile /var/run/egd-pool

 # SSL cipher suite
 # See man ciphers for syntax
 #tls_ciphers TLSv1

 # Client certificate and key
 # Use these, if your server requires client authentication.
 #tls_cert
 #tls_key

 # Mappings for Services for UNIX 3.5
 #filter passwd (objectClass=User)
 #map    passwd uid              msSFU30Name
 #map    passwd userPassword     msSFU30Password
 #map    passwd homeDirectory    msSFU30HomeDirectory
 #map    passwd homeDirectory    msSFUHomeDirectory
 #filter shadow (objectClass=User)
 #map    shadow uid              msSFU30Name
 #map    shadow userPassword     msSFU30Password
 #filter group  (objectClass=Group)
 #map    group  member           msSFU30PosixMember

 # Mappings for Services for UNIX 2.0
 #filter passwd (objectClass=User)
 #map    passwd uid              msSFUName
 #map    passwd userPassword     msSFUPassword
 #map    passwd homeDirectory    msSFUHomeDirectory
 #map    passwd gecos            msSFUName
 #filter shadow (objectClass=User)
 #map    shadow uid              msSFUName
 #map    shadow userPassword     msSFUPassword
 #map    shadow shadowLastChange pwdLastSet
 #filter group  (objectClass=Group)
 #map    group  member           posixMember

 # Mappings for Active Directory
 #pagesize
 #referrals off
 #idle_timelimit
 #filter passwd (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
 #map    passwd uid              sAMAccountName
 #map    passwd homeDirectory    unixHomeDirectory
 #map    passwd gecos            displayName
 #filter shadow (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
 #map    shadow uid              sAMAccountName
 #map    shadow shadowLastChange pwdLastSet
 #filter group  (objectClass=group)

 # Alternative mappings for Active Directory
 # (replace the SIDs in the objectSid mappings with the value for your domain)
 #pagesize
 #referrals off
 #idle_timelimit
 #filter passwd (&(objectClass=user)(objectClass=person)(!(objectClass=computer)))
 #map    passwd uid           cn
 #map    passwd uidNumber     objectSid:S------
 #map    passwd gidNumber     objectSid:S------
 #map    passwd homeDirectory "/home/$cn"
 #map    passwd gecos         displayName
 #map    passwd loginShell    "/bin/bash"
 #filter group (|(objectClass=group)(objectClass=person))
 #map    group gidNumber      objectSid:S------

 # Mappings for AIX SecureWay
 #filter passwd (objectClass=aixAccount)
 #map    passwd uid              userName
 #map    passwd userPassword     passwordChar
 #map    passwd uidNumber        uid
 #map    passwd gidNumber        gid
 #filter group  (objectClass=aixAccessGroup)
 #map    group  cn               groupName
 #map    group  gidNumber        gid
 # This comment prevents repeated auto-migration of settings.
 ssl no
 tls_cacertdir /etc/openldap/cacerts

修改 /etc/openldap/ldap.conf

#
# LDAP Defaults
#

# See ldap.conf() for details
# This file should be world readable but not world writable.

#SIZELIMIT
#TIMELIMIT
#DEREF          never

TLS_CACERTDIR /etc/openldap/cacerts

# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON    on
URI ldap://10.2.48.125/
BASE dc=ldap-pdc,dc=com

执行authconfig-tui

　　重启几个服务

systemctl restart slapd
systemctl restart smb
systemctl restart nmb
systemctl restart nslcd
systemctl restart nscd
systemctl restart winbind.service

　　测试本机加入ldap-pdc域

 net rpc join -U root%
 net rpc testjoin

　　

 [root@ldap-pdc etc]# net rpc testjoin
 Join to 'LDAP-PDC' is OK
 [root@ldap-pdc etc]# 

ok.ldap-pdc服务器配置完毕，

　　windows机器首先需要将其dns服务器改成ldap-pdc服务器的地址，其次需要更改注册表

　　

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlset\services\LanmanWorkstation\
Parameters]
“DomainCompatibilityMode”=dword:
“DNSNameResolutionRequired”=dword:

　　之后就可以正常加入LDAP-PDC域啦