LDAP - LDAP OpenLDAP - postfix qpopper - LDAP heartbeat mon

Size: px

Start display at page:

Download "LDAP - LDAP OpenLDAP - postfix qpopper - LDAP heartbeat mon"

ぎんとこうじょう
7 years ago
Views:

1 LDAP Internet Week 2003 VA Linux Systems

2 LDAP - LDAP OpenLDAP - postfix qpopper - LDAP heartbeat mon

3 LDAP OpenLDAP

4 LDAP Lightweight Directory Access Protocol

5 LDAP(X500)

7 - (DN) DIT (*1) ( ) = (RDN),< > (*1) Directory

8 (Attribute) = :

9 (Structual) objectclass RDN

10 objectclass 1 Structual objectclass Auxilial ( ) objectclass

11 ( one level, )

12 < >=< > objectclass=* cn=taru* age>=18 (&(cn=taru*)(age>=18))

13 ldapsearch -x -h ldap -s sub -b ou=,o= cn= * telephonenumber

14 Novell edirectory (TM) Sun iplanet(tm) OpenLDAP NEC EDS (TM) LDAP

15 OpenLDAP (BSD ) LDAP LDAP slapd, slurpd slapadd, slapcat libldap ldapsearch, ldapadd

16 slapd LDAPv3 SASL starttls (SSL) (login)

17 OpenLDAP(2.1) Berkley DB 4.1 &./configure; make; sudo make install ~# /usr/local/libexec/slapd

18 ~$ /usr/local/bin/ldapsearch -x -s base -b "" + rootdse

19 OpenLDAP slapd.conf ~# sudo killall slapd ~# /usr/local/libexec/slapd /etc/init.d/slapd restart

20 slapd.conf access to * by dn="cn=admin,dc=vass" write by * read

21 slapd.conf (2) ( )

22 LDIF - dn: dc=my-domain,dc=com objectclass: top objectclass: domain dc: my-domain ~$ ldapadd -x -D "cn=manager,dc=my-domain,dc=com" < test.ldif

23 dc=my-domain,dc=com objectclass: person dn: dc=my-domain,dc=com changetype: modify add: objectclass objectclass: person

27 LDAP

28 LDAP (2)

29 LDAP postfix postfix LDAP $ cd postfix-1.1.2/ $ make tidy $ make makefiles CCARGS="-I/usr/local/include -DHAS_LDAP" AUXLIBS="-L/usr/local/lib -lldap -llber" $ make $ bin/su -c "make install"

30 $ /usr/sbin/postconf -m static nis regexp environ ldap btree hash postfix LDAP

32 namingcontext

33 namingcontext slapd.conf database bdb suffix "o=vaj" rootdn "cn=manager,o=vaj" rootpw secret directory /usr/local/var/openldap/vaj/ index objectclass eq namingcontext $ ldapsearch -s base -b "" namingcontexts

34 ou=people,o=vaj LDIF dn: o=vaj objectclass: organization o: VAJ dn: ou=people, o=vaj objectclass: organizationalunit ou: People $ ldapadd -x -D "cn=manager,o=vaj" -w secret < people.ldif

35 taru LDIF dn: uid=taru,ou=people,o=vaj uid: taru cn: Masato Taruishi objectclass: posixaccount objectclass: inetorgperson userpassword: {CRYPT}h9Z4VF89hXpl. loginshell: /bin/bash uidnumber: 1000 gidnumber: 1000 homedirectory: /home/taru sn: Taruishi mail: $ ldapadd -x -D "cn=manager,o=vaj" < taru.ldif

36 slappasswd $ /usr/local/sbin/slappasswd -h "{CRYPT}" New password: Re-enter new password: {CRYPT}h9Z4VF89hXpl.

37 postfix main.cf alias_maps = ldap:ldapalias LDAP LDAP ldapalias

38 postfix main.cf ldapalias ldapalias_server_host = localhost ldapalias_search_base = ou=people,o=vaj ldapalias_scope = sub ldapalias_query_filter = (uid=%s) ldapalias_result_attribute = mail $ postmap -q taru ldap:ldapalias taru@debian.org

39 pop LDAP qpopper pam_ldap PAM LDAP

40 pam_ldap $./configure $ make $ /bin/su -c "make install" /etc/ldap.conf (Debian /etc/pam_ldap.conf)

41 /etc/ldap.conf pam_ldap nss_ldap pam_ldap host base ou=people,o=vaj ldap_version 3 pam_password crypt

42 /etc/pam.d/qpopper qpopper LDAP auth sufficient pam_ldap.so auth required pam_unix_auth.so shadow account sufficient pam_ldap.so account required pam_unix_acct.so

43 LDAP

45 - LDAP

48 index

49 ( )

53 Referral ( ) ( ) +Referral+

54 Chain OpenLDAP

55 OpenLDAP +Referral replogfile /usr/local/var/openldap-data/replogfile database bdb... replica host=slave:389 bindmethod=simple binddn="cn=manager,o=vaj" credentials=secret...

56 ... database bdb... updatedn "cn=manager,o=vaj" updateref "ldap://master:389/"... OpenLDAP (2)

57 index

58 index slapd.conf index {<attrlist> default} [pres,eq,approx,sub,<special>]... database bdb... index objectclass,uid eq index cn,sn eq,sub... index slapindex(8)

59 ( ) LDAP index

60 - UNIX ID

61 - ( )

62 / (Superior Knowledge Information) (Subordinate Knowledge Information)

63 slapd.conf referral ldap://superior/

65 UNIX uid 16bit qpopper uid uid 1

66 /?

67 -

68 -

69 OpenLDAP - LDAP heartbeat - mon -

70 heartbeat ( ) ACTIVE (hearbeat ) ACTIVE STANDBY mon ( ) ACTIVE LDAP (LDAP ) LDAP heartbeat

71 ACTIVE Virtual IP STANDBY ACTIVE Virtual IP LDAP

72 heartbeat $./configure; make; /bin/su -c "make install"

73 mon perl Peiod-1.20 Time-HiRes-1.42 Convert-BER Mon-0.11 Convert-ASN-0.16 perl-ldap-0.26 $ cd mon / # install mon /usr/local/sbin/ # install alert.d/* alert/template /usr/local/lib/mon/alert.d/ # install mon.d/*.monitor /usr/local/lib/mon/mon.d/

74 heartbeat /usr/local/etc/ha.d/hacf /usr/local/etc/ha.d/authkeys /usr/local/etc/ha.d/haresources /usr/local/etc/ha.d/resource.d/ldap

75 hacf heartbeat ( )... node master # ACTIVE node backup # STANDBY...

76 authkeys auth 2 2 sha1 HI!

77 haresources... master ldap...

78 resource.d/ldap LDAP

79 heartbeat - ACTIVE, STANDBY heartbeat /etc/init.d/heartbeat start ACTIVE Virtual IP /sbin/ifconfig ACTIVE LDAP ps ax grep slapd -f slapd.master.conf STANDBY LDAP ps ax grep slapd

80 heartbeat - ACTIVE heartbeat /etc/init.d/heartbeat stop ACTIVE LDAP STANDBY LDAP

81 mon /usr/local/etc/mon/mon.cf /usr/local/etc/ha.d/haresources /usr/local/lib/mon/alert.d/failover.alert

82 mon.cf alertdir = /usr/local/lib/mon/alert.d mondir = /usr/local/lib/mon/mon.d histlength = 100 hostgroup ldapmaster master # VirutlaIP watch ldapmaster service ldap interval 10s # failure_interval 2s # # ldapsearch monitor ldap.monitor --basedn= cn=manager,o=vaj --filter= cn=manager --value= organizationalrole period wd {Sun-Sat} alert failover.alert alertafter 10s # numalerts 1...

83 ... master ldap mon... haresources

84 mon - heartbeat ACTIVE LDAP

85 ACTIVE

86 OpenLDAP

90 -

92 LDAP OpenLDAP

93 OpenLDAP - Berkeley DB - heartbeat - mon - postfix - qpopper - pam-ldap

Dec , IS p. 1/60

Dec , IS p. 1/60 Dec 08 2007, IS p. 1/60 Dec 08 2007, IS p. 2/60 Plan of Talk (LDAP) (CAS) (IdM) Dec 08 2007, IS p. 3/60 Dec 08 2007, IS p. 4/60 .. Dec 08 2007, IS p. 5/60 Dec 08 2007, IS p. 6/60 Dec 08 2007, IS p. 7/60