16.6. openldap认证(结合其他软件)

Date:

2018-09

16.6.1. SASL ldap

参考：
SASL:

Simple Authentication and Security Layer (SASL)，安全层简单认证

SASL遵循：https://www.rfc-editor.org/rfc/rfc4422.txt

需要软件cyrus-sasl

 1[root@ldap_001 ~]# saslauthd -v
 2saslauthd 2.1.23
 3authentication mechanisms: getpwent kerberos5 pam rimap shadow ldap
 4
 5[root@ldap_001 ~]# yum install cyrus-sasl-ldap -y
 6
 7
 8[root@ldap_001 ~]# yum install sasl* -y
 9
10[root@ldap_001 ~]# rpm -qa sasl*
11saslwrapper-devel-0.14-1.el6.x86_64
12saslwrapper-0.14-1.el6.x86_64
13
14[root@ldap_001 ~]# yum install *sasl* -y
15
16[root@ldap_001 ~]# saslauthd -v
17saslauthd 2.1.23
18authentication mechanisms: getpwent kerberos5 pam rimap shadow ldap
19
20
21[root@ldap_001 ~]# grep -i mech /etc/sysconfig/saslauthd
22# Mechanism to use when checking passwords.  Run "saslauthd -v" to get a list
23# of which mechanism your installation was compiled with the ablity to use.
24MECH=pam
25# Options sent to the saslauthd. If the MECH is other than "pam" uncomment the next line.
26[root@ldap_001 ~]# sed -i 's#MECH=pam#MECH=shadow#g' /etc/sysconfig/saslauthd
27
28[root@ldap_001 ~]# /etc/init.d/saslauthd restart
29Stopping saslauthd:                                        [FAILED]
30Starting saslauthd:                                        [  OK  ]
31
32
33[root@ldap_001 ~]# useradd zzj
34
35
36[root@ldap_001 ~]# testsaslauthd -uzzj -p123
370: OK "Success."

1[root@ldap_001 ~]# man saslauthd

参数中有关于ldap认证的配置文件

1[root@ldap_001 ~]# sed -i 's#MECH=shadow#MECH=ldap#g' /etc/sysconfig/saslauthd
2
3[root@ldap_001 ~]# /etc/init.d/saslauthd restart

 1[root@ldap_001 ~]# vi /etc/saslauthd.conf
 2
 3
 4ldap_servers: ldap://192.168.161.137
 5ldap_search_base: ou=People,dc=display,dc=tk
 6ldap_filter: uid=%U
 7ldap_bind_dn: cn=admin,dc=display,dc=tk
 8ldap_bind_pw: zzjlogin
 9ldap_password_attr: userPassword
10#ldap_sasl:0

官方文档介绍的配置：

 1ldap_servers: ldap://display.tk/
 2ldap_search_base: ou=People,dc=display,dc=tk
 3ldap_filter: uid=%U
 4ldap_bind_dn: cn=admin,dc=display,dc=tk
 5ldap_password: zzjlogin
 6
 7
 8[root@ldap_001 ~]# /etc/init.d/saslauthd restart
 9Stopping saslauthd:                                        [  OK  ]
10Starting saslauthd:                                        [  OK  ]
11
12
13[root@ldap_001 ~]#  testsaslauthd -utest -p123
140: OK "Success."