1. 安装和配置服务器账号登陆验证基于ldap

## 注：所需纳入ldap服务统一账户管理的机器上安装,当前为192.168.1.106

1. 安装nss和linux-pam基础软件

yum install -y nss-pam-ldapd pam_ldap

2. 基于authconfig自动配置

authconfig --enableldap \

--enableldapauth \

--ldapserver=192.168.1.101 \

--ldapbasedn="dc=example,dc=com" \

--enablemkhomedir \

--update

2. 验证账号登陆

1. 准备测试账号ldapuser1的ldif文件

dn: ou=People,dc=example,dc=com

ou: People

objectClass: top

objectClass: organizationalUnit

dn: ou=Group,dc=example,dc=com

ou: Group

objectClass: top

objectClass: organizationalUnit

2. 准备测试账号ldapuser1用户entry的ldapuser1.ldif文件

dn: uid=ldapuser1,ou=People,dc=example,dc=com

uid: ldapuser1

cn: ldapuser1

objectClass: account

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

userPassword: {crypt}$6$p3Q1E97k$NBKIVkcLUChXHbPD0g9zktxeDwYxjBj756eJ4DhkMnXJ.umHtDOH/UE.XQbTtkybA1irTdklbKSlTQQYjOh4Z/

shadowLastChange: 17465

shadowMin: 0

shadowMax: 99999

shadowWarning: 7

loginShell: /bin/bash

uidNumber: 506

gidNumber: 506

homeDirectory: /home/ldapuser1

3. 添加账号进ldap数据库

bin/ldapadd -x -W -D "cn=admin,dc=example,dc=com" -f base.ldif

bin/ldapadd -x -W -D "cn=admin,dc=example,dc=com" -f ldapuser1.ldif

4. 验证ldapuser1能够登陆

## 从192.168.1.122主机登陆到192.168.1.106

[zhangsan@interface05 ~]# ssh ldapuser1@192.168.1.106

ldapuser1@192.168.1.106's password:

Creating directory '/home/ldapuser1'.

3. 安装ldap-account-manager图形管理工具

1. 安装php和httpd相关基础软件

yum install httpd php php-bcmath php-gd php-mbstring php-xml php-ldap php-pear

2. 修改php和httpd相关参数

## 修改 /etc/httpd/conf/httpd.conf中

DirectoryIndex index.html index.php

## 修改 /etc/php.ini

date.timezone = "Asia/Shanghai"

3. 下载和安装ldap-account-manager

## ldap-account-manager下载地址

http://downloads.sourceforge.net/project/lam/LAM/5.2/ldap-account-manager-5.2-0.fedora.1.noarch.rpm

## 安装

rpm -ivh ldap-account-manager-5.6-0.fedora.1.noarch.rpm

## 修改/var/lib/ldap-account-manager/config/lam.conf文件

admins: cn=admin,dc=example,dc=com

treesuffix: dc=example,dc=com

types: suffix_user: ou=People,dc=example,dc=com

types: modules_user: account,posixAccount,top,shadowAccount

types: suffix_group: ou=Group,dc=example,dc=com

types: modules_group: posixGroup,top

## 重启httpd服务

service httpd restart

## 界面访问（http://localhost:80/lam，管理员账号为ldap中slapd.conf中配置的管理员账号和密码）