课程第8次

botang

2019-07-21
为什么LDAP基础节点叫"dc=example, dc=com"

1. [root@instructor openldap]# grep -r  'dc=example'   ./
   
2. ./slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d/cn=config/olcDatabase={1}bdb.ldif:olcSuffix: dc=example,dc=com
   
3. ./slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/cn=config/olcDatabase={1}bdb.ldif:olcSuffix: dc=example,dc=com
   
4. ./slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d/cn=config/olcDatabase={1}bdb.ldif:olcSuffix: dc=example,dc=com
   
5. ./slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/cn=config/olcDatabase={1}bdb.ldif:olcSuffix: dc=example,dc=com
   
6. ./slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d/cn=config/olcDatabase={1}bdb.ldif:olcSuffix: dc=example,dc=com
   
7. ./slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/cn=config/olcDatabase={1}bdb.ldif:olcSuffix: dc=example,dc=com
   
8. ./slapd.d-glsorig/slapd.d-glsorig/slapd.d-glsorig/cn=config/olcDatabase={1}bdb.ldif:olcSuffix: dc=example,dc=com
   
9. ./slapd.d-glsorig/slapd.d-glsorig/cn=config/olcDatabase={1}bdb.ldif:olcSuffix: dc=example,dc=com
   
10. ./slapd.d-glsorig/cn=config/olcDatabase={1}bdb.ldif:olcSuffix: dc=example,dc=com
    
11. ./slapd.d/cn=config/olcDatabase={1}bdb.ldif:olcSuffix: dc=example,dc=com
    
12. ./ldap.conf:#BASE       dc=example,dc=com
    
13. [root@instructor openldap]# pwd
    
14. /etc/openldap
    

复制代码

为什么kerberos的验证域叫“EXAMPLE.COM”:

1. [root@instructor etc]# vim krb5.conf
   
2. [logging]
   
3. default = FILE:/var/log/krb5libs.log
   
4. kdc = FILE:/var/log/krb5kdc.log
   
5. admin_server = FILE:/var/log/kadmind.log
   
6. 
   
7. [libdefaults]
   
8. default_realm = EXAMPLE.COM
   
9. dns_lookup_realm = false
   
10. dns_lookup_kdc = false
    
11. ticket_lifetime = 24h
    
12. renew_lifetime = 7d
    
13. forwardable = true
    
14. 
    
15. [realms]
    
16. EXAMPLE.COM = {
    
17.   kdc = kerberos.example.com
    
18.   admin_server = kerberos.example.com
    
19. }
    
20. 
    
21. [domain_realm]
    
22. .example.com = EXAMPLE.COM
    
23. example.com = EXAMPLE.COM
    
24. ~
    

复制代码

密码为什么是“kerberos”?  
/root/bin/gls-setup-krb5

1. #!/bin/bash
   
2. #
   
3. # krb5script
   
4. # Bowe Strickland <bowe@redhat.com>
   
5. # version 1.0: 2010-09-23.  Initial release.
   
6. #
   
7. # Sets up instructor.example.com to act as a kerberos server.  Fortunately,
   
8. # we're serving the EXAMPLE.COM domain, so many (all?) config files can be left
   
9. # at their default settings.
   
10. 
    
11. #set -x
    
12. 
    
13. # no spaces/metachars please...
    
14. MASTERPW=not_a_good_idea
    
15. USERPW=kerberos
    
16. 
    
17. if [ "$1" = "--reverse" ]; then
    
18. 
    
19.         /sbin/service krb5kdc stop
    
20.         /sbin/chkconfig krb5kdc off
    
21.         /usr/sbin/kdb5_util destroy -f
    
22. 
    
23.         rm -f /var/kerberos/krb5kdc/.k5.EXAMPLE.COM
    
24. 
    
25. else
    
26.         /usr/sbin/kdb5_util create -P "$MASTERPW" -s
    
27. 
    
28.         for i in $(seq 20); do
    
29.                 UNAME=$(printf ldapuser%d $i)
    
30.                 echo "add_principal -pw $USERPW $UNAME" | kadmin.local
    
31.         done
    
32. 
    
33.         # don't immediately start service.
    
34.         # /sbin/service krb5kdc start
    
35.         /sbin/chkconfig krb5kdc on
    
36. 
    
37. fi
    

复制代码

为什么家目录是"/home/guests/ldapuserX" ?
[root@desktop3 ~]# getent passwd ldapuser8
ldapuser8:*:1708:1708DAP Test User 8:/home/guests/ldapuser8:/bin/bash
/root/ldif/people.ldif:

1. dn: uid=ldapuser1,ou=People,dc=example,dc=com
   
2. uid: ldapuser1
   
3. cn: LDAP Test User 1
   
4. givenName: LDAP Test User
   
5. sn: 1
   
6. mail: ldapuser1@example.com
   
7. objectClass: person
   
8. objectClass: organizationalPerson
   
9. objectClass: inetOrgPerson
   
10. objectClass: posixAccount
    
11. objectClass: top
    
12. objectClass: shadowAccount
    
13. userPassword: {SSHA}2RxVB3Cb+JZxqLDD4EucbGKEew9bhXNB
    
14. shadowLastChange: 12797
    
15. shadowMax: 99999
    
16. shadowWarning: 7
    
17. loginShell: /bin/bash
    
18. uidNumber: 1701
    
19. gidNumber: 1701
    
20. homeDirectory: /home/guests/ldapuser1
    
21. gecos: LDAP Test User 1
    

复制代码

------------------------------------------------------------------------------------------------------------
让server3 来做NFS服务器，故意做不对称的：

/rhosts/ldapuser*

mkdir /rhosts
for i in {1..20}
do
  mkdir /rhosts/ldapuser$i
  cp -a /etc/skel/.[!.]*  /rhosts/ldapuser$i
  chown -R $[ 1700 + $i ][ 1700 + $i ]  /rhosts/ldapuser$i
done


如果desktop3.example.com运行showmount  -e  server3.example.com报错的话，是因为server3.example.com上面firewall-config没有打开mountd/nfs/nfs3/rpcbind