openldap主机访问控制（基于ip）
http://blog.oddbit.com/2013/07/22/generating-a-membero/
http://gsr-linux.blogspot.jp/2011/01/howto-on-using-dynlist-with-openldap.html
建立组织单元
cat << _EOF_ | ldapadd -x -W -H ldaps://master.local -D cn=manager,dc=suntv,dc=tv
dn: ou=people,dc=suntv,dc=tv
ou: people
objectClass: organizationalUnit
dn: ou=group,dc=suntv,dc=tv
ou: group
objectClass: organizationalUnit
dn: ou=host,dc=suntv,dc=tv
ou: host
objectClass: organizationalUnit
_EOF_
建立主机组
cat << _EOF_ | ldapadd -x -W -H ldaps://master.local -D cn=manager,dc=suntv,dc=tv
dn: ou=all,ou=host,dc=suntv,dc=tv
objectClass: organizationalUnit
objectClass: hostObject
ou: all
host: all
dn: ou=op,ou=host,dc=suntv,dc=tv
objectClass: organizationalUnit
objectClass: hostObject
ou: op
host: 192.168.1.21
host: 192.168.1.22
dn: ou=dev,ou=host,dc=suntv,dc=tv
objectClass: organizationalUnit
objectClass: hostObject
ou: dev
host: 192.168.1.31
host: 192.168.1.32
_EOF_
建立用户组
cat << _EOF_ | ldapadd -x -W -H ldaps://master.local -D cn=manager,dc=suntv,dc=tv
dn: cn=op,ou=group,dc=suntv,dc=tv
objectClass: posixGroup
cn: op
gidNumber: 2001
dn: cn=dev,ou=group,dc=suntv,dc=tv
objectClass: posixGroup
cn: dev
gidNumber: 2002
_EOF_
建立用户
cat << _EOF_ | ldapadd -x -W -H ldaps://master.local -D cn=manager,dc=suntv,dc=tv
dn: uid=op01,ou=people,dc=suntv,dc=tv
uid: op01
cn: op01
sn: op01
objectClass: hostObject
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson
userPassword: 123456
shadowLastChange: 17085
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1001
gidNumber: 2001
homeDirectory: /home/op01
labeledURI: ldaps:///ou=op,ou=host,dc=suntv,dc=tv?host
dn: uid=dev01,ou=people,dc=suntv,dc=tv
uid: dev01
cn: dev01
sn: op01
objectClass: hostObject
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson
userPassword: 123456
shadowLastChange: 17085
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1002
gidNumber: 2002
homeDirectory: /home/dev01
labeledURI: ldaps:///ou=dev,ou=host,dc=suntv,dc=tv?host
_EOF_
动态组
# /etc/openldap/slapd.conf 确保有以下配置
include /etc/openldap/schema/dyngroup.schema
modulepath /usr/lib64/openldap
moduleload dynlist.la
overlay dynlist
dynlist-attrset inetOrgPerson labeledURI
rm -rf /etc/openldap/slapd.d/*
slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
chown -R ldap:ldap /etc/openldap/slapd.d
systemctl restart slapd
测试
ldapsearch -x -W -H ldaps://master.local -D cn=manager,dc=suntv,dc=tv -b uid=op01,ou=people,dc=suntv,dc=tv
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <uid=op01,ou=people,dc=suntv,dc=tv> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# op01, people, suntv.tv
dn: uid=op01,ou=people,dc=suntv,dc=tv
uid: op01
cn: op01
sn: op01
objectClass: hostObject
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson
userPassword:: MTIzNDU2
shadowLastChange: 17085
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1001
gidNumber: 2001
homeDirectory: /home/op01
labeledURI: ldaps:///ou=op,ou=host,dc=suntv,dc=tv?host
host: 192.168.1.21 # 动态组自动增加内容
host: 192.168.1.22 # 动态组自动增加内容
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
ldapsearch过滤用法 http://blog.chinaunix.net/uid-393131-id-2410065.html
ldapsearch -x -W -H ldaps://master.local -D cn=manager,dc=suntv,dc=tv -b uid=dev01,ou=people,dc=suntv,dc=tv host
# extended LDIF
#
# LDAPv3
# base <uid=dev01,ou=people,dc=suntv,dc=tv> with scope subtree
# filter: (objectclass=*)
# requesting: host
#
# dev01, people, suntv.tv
dn: uid=dev01,ou=people,dc=suntv,dc=tv
host: 192.168.1.31 # 动态组自动增加内容
host: 192.168.1.32 # 动态组自动增加内容
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
cat > /etc/sssd/sssd.conf << _EOF_
[domain/LDAP]
debug_level = 9
cache_credentials = true
enumerate = false
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldaps://master.local
ldap_backup_uri = ldaps://slave.local
ldap_search_base = dc=suntv,dc=tv
ldap_user_search_base = ou=people,dc=suntv,dc=tv
ldap_group_search_base = ou=group,dc=suntv,dc=tv
access_provider = ldap
ldap_access_order = filter
ldap_access_filter = (|(host=all)(host=192.168.1.21))
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_cacert = /etc/openldap/cacerts/ca.crt
ldap_tls_reqcert = never
ldap_id_use_start_tls = false
[sssd]
domains = LDAP
services = nss, pam
config_file_version = 2
[nss]
domains = LDAP
fd_limit = 65535
filter_users = root
filter_groups = root
[pam]
domains = LDAP
[ssh]
domains = LDAP
ssh_hash_known_hosts = false
_EOF_
测试
# ssh op01@192.168.1.22
op01@192.168.1.22's password:
Connection to 192.168.1.22 closed by remote host.
Connection to 192.168.1.22 closed.
sssd_LDAP日志显示如下，其中 [(&(uid=op01)(objectclass=posixAccount)(|(host=all)(host=192.168.1.21)))][uid=op01,ou=people,dc=suntv,dc=tv] 是过滤条件，问题应该就出在ldap_access_filter = (|(host=all)(host=192.168.1.21))这里。
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_access_filter_send] (0x0400): Performing access filter check for user [op01]
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_access_filter_send] (0x0400): Checking filter against LDAP
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_print_server] (0x2000): Searching 192.168.1.11
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=op01)(objectclass=posixAccount)(|(host=all)(host=192.168.1.21)))][uid=op01,ou=people,dc=suntv,dc=tv].
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 4
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_op_add] (0x2000): New operation 4 timeout 6
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: sh[0x9380c0], connected[1], ops[0x9f7470], ldap[0x931330]
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_op_destructor] (0x2000): Operation 4 finished
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_id_op_done] (0x4000): releasing operation connection
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_access_filter_done] (0x0100): User [op01] was not found with the specified filter. Denying access.
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_access_filter_done] (0x0400): Access denied by online lookup
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [ldb] (0x4000): start ldb transaction (nesting: 0)
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x9e6f50
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x9e76c0
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [ldb] (0x4000): Running timer event 0x9e6f50 "ltdb_callback"
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [ldb] (0x4000): Destroying timer event 0x9e76c0 "ltdb_timeout"
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [ldb] (0x4000): Ending timer event 0x9e6f50 "ltdb_callback"
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [ldb] (0x4000): commit ldb transaction (nesting: 0)
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_access_done] (0x0400): Access was denied.
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 6, <NULL>) [Success]
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Sending result [6][LDAP]
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Sent result [6][LDAP]
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: sh[0x9380c0], connected[1], ops[(nil)], ldap[0x931330]
(Thu Oct 13 17:23:57 2016) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
(Thu Oct 13 17:24:00 2016) [sssd[be[LDAP]]] [sbus_dispatch] (0x4000): dbus conn: 0x91cdf0
(Thu Oct 13 17:24:00 2016) [sssd[be[LDAP]]] [sbus_dispatch] (0x4000): Dispatching.
dynlist不支持filter功能 http://www.openldap.org/lists/openldap-software/200708/msg00250.html
这个帖子上说，使用第三方autogroup，这个是把记录存储在数据库里，支持filter
op01用户使用动态组，dev01用户不使用动态组，直接添加host记录192.168.1.22
ldapsearch -x -W -H ldaps://master.local -D cn=manager,dc=suntv,dc=tv -b ou=people,dc=suntv,dc=tv "host=192.168.1.22"
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <ou=people,dc=suntv,dc=tv> with scope subtree
# filter: host=192.168.1.22 # 过滤后找到信息
# requesting: ALL
#
# dev01, people, suntv.tv
dn: uid=dev01,ou=people,dc=suntv,dc=tv
uid: dev01
cn: dev01
sn: op01
objectClass: hostObject
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson
userPassword:: MTIzNDU2
shadowLastChange: 17085
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1002
gidNumber: 2002
homeDirectory: /home/dev01
host: 192.168.1.22
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
ldapsearch -x -W -H ldaps://master.local -D cn=manager,dc=suntv,dc=tv -b ou=people,dc=suntv,dc=tv "host=192.168.1.21"
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <ou=people,dc=suntv,dc=tv> with scope subtree
# filter: host=192.168.1.21 # 过滤后未找到记录
# requesting: ALL
#
# search result
search: 2
result: 0 Success
# numResponses: 1
鉴于dynlist暂不支持filter，另autogroup是第三方模块，openldap程序未默认内置，用静态组每个用户要加入很多条host记录，因此基于ip动态组方案废弃。我换个基于用户组的方案来试试
openldap主机访问控制（基于ip）的更多相关文章
- openldap主机访问控制（基于hostname）
http://mayiwei.com/2013/03/21/centos6-openldap/ http://www.zytrax.com/books/ldap/ch11/dynamic.html h ...
- openldap主机访问控制（基于用户组）
建立组织单元 cat << _EOF_ | ldapadd -x -W -H ldaps://master.local -D cn=manager,dc=suntv,dc=tv dn: o ...
- linux apache虚拟主机配置(基于ip,端口,域名)
配置环境: linux版本:Centos6.4 httpd版本: [root@centos64Study init.d]# pwd/etc/init.d[root@centos64Study init ...
- nginx篇最初级用法之三种虚拟主机基于域名\基于端口\基于IP地址端口的虚拟主机
在nginx中虚拟主机的类型与apache一样也有三种 1.基于域名的虚拟主机 2.基于端口的虚拟主机 3.基于IP地址端口的虚拟主机 在nginx配置文件中每一个server为一个虚拟主机如果需要多 ...
- 在Nginx中部署基于IP的虚拟主机
一.虚拟主机概念 虚拟主机是在网络服务器上划分出一定的磁盘空间供用户放置站点.应用组件等,提供必要的站点功能.数据存放和传输功能.所谓虚拟主机,也叫"网站空间", 就是把一台运行在 ...
- nginx基于IP的虚拟主机
知识点: server的语法: upstream语法: upstream中192.168.100.1不是ip只是个标识,只要和下面的proxy_pass 对应即可. 基于IP的虚拟主机: listen ...
- Apache配置虚拟主机的三种方法（基于IP、端口、域名）
1 Apache虚拟主机的实现方式有3种. 基于IP的虚拟主机 基于端口的虚拟主机 基于域名的虚拟主机 2.1 启用虚拟主机的准备工作 2.1.1安装httpd [root@mail httpd]# ...
- CentOS 7运维管理笔记(6)----Apache 基于 IP 的虚拟主机配置
Apache 配置虚拟主机支持3种方式:基于IP的虚拟主机配置,基于端口的虚拟主机配置,基于域名的虚拟主机配置.本篇随笔记录自己基于IP的虚拟主机配置. 如果同一台服务器有多个IP,可以使用基于IP的 ...
- Nginx总结（二）基于ip的虚拟主机配置
前面讲了如何安装配置Nginx,大家可以去这里看看nginx系列文章:https://www.cnblogs.com/zhangweizhong/category/1529997.html 今天要说的 ...
随机推荐
- (转)javascript匿名函数的写法、传参和递归
(原)http://www.veryhuo.com/a/view/37529.html (转)javascript匿名函数的写法.传参和递归 http://www.veryhuo.com 2011-0 ...
- Libgdx 开发指南(1) 应用框架
应用框架 模块 Libgdx包含五个核心接口与操作系统交互,各自实现了如下接口: Application:运行应用,向client通知应用层事件,例如窗口大小的改变(window resizing). ...
- ARM compiler No such file or directory
/********************************************************************************* * ARM compiler No ...
- 移动互联网实战--资源类APP的数据存储处理和优化
前言: 对于资源类的APP, 其音频/图形占据了APP本身很大的比例. 如何存储和管理这些资源文件, 成了一个颇具挑战性的难点. 移动端的碎片化, 高中低端手机的并存, 需要开发者不光是具备基础的存储 ...
- 图片加载完后执行js
<script> window.onload=function(){ var liwidth = $('.imgul ...
- 用collectionview实现瀑布流-转
算法总体思路 先说一下总体上的思路.既然图片的大小.位置各不一样,我们很自然地会想到需要算出每个item的frame,然后把这些frame赋值给当前item的UICollectionViewLayou ...
- UIKIT的简介
// // UIKIT各框架的简介 // IOS笔记 // // Created by 刘威成 on 13/12/14. // Copyright © 2015年 刘威成. All rights re ...
- squid ACL 大全
Access Controls in Squid Contents Access Controls in Squid The Basics: How the parts fit together AC ...
- i++; 与 ++i;的内部区别。
对于一个用前置自加和后置自加的效果相同的地方,我们应该用哪个呢? 例: for(point i = 0; i != N; ?): 上面for语句中的“?”处,你会在那里写i++还是++i呢? 前置++ ...
- jQuery 获取父窗口的元素 父窗口 子窗口(iframe)
$("#父窗口元素ID",window.parent.document); 对应javascript版本为window.parent.document.getElementById ...