"OpenLDAP 2.6.2版本操作指南：UNIX系统上的安装与配置" - CSDN文库

需积分: 14 126 浏览量更新于2024-01-14 收藏 1.46MB PDF 举报

总结：该文档是《OpenLDAP管理员指南》的PDF版，针对UNIX（和类UNIX）系统，提供了安装OpenLDAP软件2.6的指南。该文档主要面向具有基本LDAP基于目录服务了解的经验丰富的系统管理员。该文档旨在与软件包提供的其他OpenLDAP信息资源以及位于项目网站（http://www.OpenLDAP.org/）上的界面一起使用。《OpenLDAP管理员指南》的目的是帮助管理员全面了解并掌握OpenLDAP软件2.6的操作。文档的目录清晰明了，包括了如下内容： 1. 引言：介绍了本指南的目的和目标用户。 2. 版权：说明了该文档的版权信息。 3. 安装OpenLDAP：指导管理员在UNIX系统上安装OpenLDAP软件2.6。 4. 配置OpenLDAP：详细介绍了如何配置OpenLDAP以适应特定的环境和需求。包括设置基本参数、定义目录结构、配置访问控制等。 5. 管理OpenLDAP数据库：介绍了管理员常见的数据库管理任务，包括添加、修改和删除条目，以及备份和恢复数据库等操作。 6. 监控和故障排除：说明了如何监控OpenLDAP服务器的运行状态，以及如何识别和解决常见的故障。包括使用日志和工具进行故障排除。 7. 安全性和身份验证：介绍了OpenLDAP的安全性设置和身份验证方式，包括使用TLS/SSL进行安全通信和使用SASL进行身份验证。 8. 迁移和升级：指导管理员在现有OpenLDAP环境中进行迁移和升级，并提供相应的注意事项和步骤。《OpenLDAP管理员指南》提供了详细的操作步骤和示例，并解释了每个步骤的目的和作用。该指南旨在帮助管理员快速上手并有效地管理OpenLDAP软件2.6。需要注意的是，该文档假设管理员具有一定的LDAP基础知识和UNIX系统管理经验。如果管理员对LDAP和UNIX系统不熟悉，建议先了解相关的基础知识再使用本指南。总之，该文档是一份全面且详细的OpenLDAP管理员指南，适用于想要安装、配置和管理OpenLDAP软件2.6的经验丰富的系统管理员。通过阅读本指南，管理员可以了解到OpenLDAP的各个方面，并学会如何有效地管理OpenLDAP服务器。

The OpenLDAP Project would also like to thank the University of Michigan LDAP Team for building the

foundation of LDAP software and information to which OpenLDAP Software is built upon. This document is

based upon University of Michigan document: The SLAPD and SLURPD Administrators Guide.

Amendments

Suggested enhancements and corrections to this document should be submitted using the OpenLDAP Issue

Tracking System (http://www.openldap.org/its/).

About this document

This document was produced using the Simple Document Format (SDF) documentation system

(http://search.cpan.org/src/IANC/sdf-2.001/doc/catalog.html) developed by Ian Clatworthy. Tools for SDF are

available from CPAN (http://search.cpan.org/search?query=SDF&mode=dist).

OpenLDAP Software 2.6 Administrator's Guide

2

1. Introduction to OpenLDAP Directory Services

This document describes how to build, configure, and operate OpenLDAP Software to provide directory

services. This includes details on how to configure and run the Standalone LDAP Daemon, slapd(8). It is

intended for new and experienced administrators alike. This section provides a basic introduction to directory

services and, in particular, the directory services provided by slapd(8). This introduction is only intended to

provide enough information so one might get started learning about LDAP, X.500, and directory services.

1.1. What is a directory service?

A directory is a specialized database specifically designed for searching and browsing, in additional to

supporting basic lookup and update functions.

Note: A directory is defined by some as merely a database optimized for read access. This definition, at best,

is overly simplistic.

Directories tend to contain descriptive, attribute-based information and support sophisticated filtering

capabilities. Directories generally do not support complicated transaction or roll-back schemes found in

database management systems designed for handling high-volume complex updates. Directory updates are

typically simple all-or-nothing changes, if they are allowed at all. Directories are generally tuned to give quick

response to high-volume lookup or search operations. They may have the ability to replicate information

widely in order to increase availability and reliability, while reducing response time. When directory

information is replicated, temporary inconsistencies between the consumers may be okay, as long as

inconsistencies are resolved in a timely manner.

There are many different ways to provide a directory service. Different methods allow different kinds of

information to be stored in the directory, place different requirements on how that information can be

referenced, queried and updated, how it is protected from unauthorized access, etc. Some directory services

are local, providing service to a restricted context (e.g., the finger service on a single machine). Other services

are global, providing service to a much broader context (e.g., the entire Internet). Global services are usually

distributed, meaning that the data they contain is spread across many machines, all of which cooperate to

provide the directory service. Typically a global service defines a uniform namespace which gives the same

view of the data no matter where you are in relation to the data itself.

A web directory, such as provided by the Curlie Project <https://curlie.org>, is a good example of a directory

service. These services catalog web pages and are specifically designed to support browsing and searching.

While some consider the Internet Domain Name System (DNS) is an example of a globally distributed

directory service, DNS is not browsable nor searchable. It is more properly described as a globally distributed

lookup service.

1.2. What is LDAP?

LDAP stands for Lightweight Directory Access Protocol. As the name suggests, it is a lightweight protocol

for accessing directory services, specifically X.500-based directory services. LDAP runs over TCP/IP or other

connection oriented transfer services. LDAP is an IETF Standard Track protocol and is specified in

"Lightweight Directory Access Protocol (LDAP) Technical Specification Road Map" RFC4510.

This section gives an overview of LDAP from a user's perspective.

3

Figure 1.1: LDAP directory tree (traditional naming)

The tree may also be arranged based upon Internet domain names. This naming approach is becoming

increasing popular as it allows for directory services to be located using the DNS. Figure 1.2 shows an

example LDAP directory tree using domain-based naming.

Figure 1.2: LDAP directory tree (Internet naming)

In addition, LDAP allows you to control which attributes are required and allowed in an entry through the use

of a special attribute called objectClass. The values of the objectClass attribute determine the schema

rules the entry must obey.

How is the information referenced? An entry is referenced by its distinguished name, which is constructed by

taking the name of the entry itself (called the Relative Distinguished Name or RDN) and concatenating the

names of its ancestor entries. For example, the entry for Barbara Jensen in the Internet naming example above

has an RDN of uid=babs and a DN of uid=babs,ou=People,dc=example,dc=com. The full DN format is

described in RFC4514, "LDAP: String Representation of Distinguished Names."

How is the information accessed? LDAP defines operations for interrogating and updating the directory.

Operations are provided for adding and deleting an entry from the directory, changing an existing entry, and

changing the name of an entry. Most of the time, though, LDAP is used to search for information in the

directory. The LDAP search operation allows some portion of the directory to be searched for entries that

match some criteria specified by a search filter. Information can be requested from each entry that matches the

criteria.

For example, you might want to search the entire directory subtree at and below dc=example,dc=com for

people with the name Barbara Jensen, retrieving the email address of each entry found. LDAP lets you do

this easily. Or you might want to search the entries directly below the st=California,c=US entry for

organizations with the string Acme in their name, and that have a fax number. LDAP lets you do this too. The

next section describes in more detail what you can do with LDAP and how it might be useful to you.

OpenLDAP Software 2.6 Administrator's Guide

5

How is the information protected from unauthorized access? Some directory services provide no protection,

allowing anyone to see the information. LDAP provides a mechanism for a client to authenticate, or prove its

identity to a directory server, paving the way for rich access control to protect the information the server

contains. LDAP also supports data security (integrity and confidentiality) services.

1.3. When should I use LDAP?

This is a very good question. In general, you should use a Directory server when you require data to be

centrally managed, stored and accessible via standards based methods.

Some common examples found throughout the industry are, but not limited to:

Machine Authentication•

User Authentication•

User/System Groups•

Address book•

Organization Representation•

Asset Tracking•

Telephony Information Store•

User resource management•

E-mail address lookups•

Application Configuration store•

PBX Configuration store•

etc.....•

There are various Distributed Schema Files that are standards based, but you can always create your own

Schema Specification.

There are always new ways to use a Directory and apply LDAP principles to address certain problems,

therefore there is no simple answer to this question.

If in doubt, join the general LDAP forum for non-commercial discussions and information relating to LDAP

at: http://www.umich.edu/~dirsvcs/ldap/mailinglist.html and ask

1.4. When should I not use LDAP?

When you start finding yourself bending the directory to do what you require, maybe a redesign is needed. Or

if you only require one application to use and manipulate your data (for discussion of LDAP vs RDBMS,

please read the LDAP vs RDBMS section).

It will become obvious when LDAP is the right tool for the job.

1.5. How does LDAP work?

LDAP utilizes a client-server model. One or more LDAP servers contain the data making up the directory

information tree (DIT). The client connects to servers and asks it a question. The server responds with an

answer and/or with a pointer to where the client can get additional information (typically, another LDAP

server). No matter which LDAP server a client connects to, it sees the same view of the directory; a name

presented to one LDAP server references the same entry it would at another LDAP server. This is an

OpenLDAP Software 2.6 Administrator's Guide

6

剩余268页未读，继续阅读

焱宣

粉丝: 114
资源: 4

最新资源