Ldap
如何設置ldap客戶端?
我在 OmniOSCE(一個 Solaris 分支)上設置 ldap 客戶端時遇到了雞和蛋的問題。
問題
從下面我可以看出,然後
ldap_client
和ldap_cachemgr
需要彼此才能工作,哪些接縫像雞和蛋的問題?並且
ldap_cachemgr
假設是應該執行的服務?背景
這就是我正在做的
echo "xx.xx.xx.xx ldap.example.com" >> /etc/hosts domainname imm domainname > /etc/defaultdomain cp -a /etc/nsswitch.conf{,_orig} ldapclient manual \ -a domainName=dc=example.com -a credentialLevel=self \ -a defaultSearchBase=dc=xxx,dc=example,dc=com \ -a defaultServerList=ldap.example.com echo "imm" > /etc/defaultdomain /usr/bin/cp -f /etc/nsswitch.conf{_orig,} replace_args () { perl -i -slpe 's/^$string\s+\K.*/$add/' -- -string="$1" -add="$2" "$3" } replace_args 'passwd:' 'files ldap' /etc/nsswitch.conf replace_args 'group:' 'files ldap' /etc/nsswitch.conf replace_args 'netgroup:' 'files ldap' /etc/nsswitch.conf replace_args 'hosts:' 'files dns' /etc/nsswitch.conf replace_args 'ipnodes:' 'files dns' /etc/nsswitch.conf function delete_line { ( sed -i "/$1/d" $2 ) }; delete_line ldap.example.com /etc/hosts svcadm enable svc:/network/ldap/client # ldaplist -l netgroup ldaplist: LDAP configuration problem (Unable to load configuration '/var/ldap/ldap_client_file' ('').) /var/ldap/ldap_client_file is empty.
/var/adm/messages
有Apr 13 14:18:21 omniosce ldap_cachemgr[8369]: [ID 293258 daemon.error] libsldap: Status: 4 Mesg: Unable to open filename '/var/ldap/ldap_cl ient_cred' for reading (errno=2). Apr 13 14:18:21 omniosce ldap_cachemgr[8368]: [ID 703877 daemon.error] ldap_cachemgr: failed (rc = 255). Apr 13 14:18:21 omniosce svc.startd[10]: [ID 652011 daemon.warning] svc:/network/ldap/client:default: Method "/lib/svc/method/ldap-client start" failed with exit status 1. Apr 13 14:18:21 omniosce svc.startd[10]: [ID 748625 daemon.error] network/ldap/client:default failed: transitioned to maintenance (see 'svcs -xv' for details) Apr 13 14:18:21 omniosce fmd: [ID 377184 daemon.error] SUNW-MSG-ID: SMF-8000-YX, TYPE: defect, VER: 1, SEVERITY: major Apr 13 14:18:21 omniosce EVENT-TIME: Fri Apr 13 14:18:21 CEST 2018 Apr 13 14:18:21 omniosce PLATFORM: KVM, CSN: -, HOSTNAME: omniosce Apr 13 14:18:21 omniosce SOURCE: software-diagnosis, REV: 0.1 Apr 13 14:18:21 omniosce EVENT-ID: 182b4afe-1cc8-68ea-8755-f9ee03c05462 Apr 13 14:18:21 omniosce DESC: A service failed - a method is failing in a retryable manner but too often. Apr 13 14:18:21 omniosce Refer to http://illumos.org/msg/SMF-8000-YX for more information. Apr 13 14:18:21 omniosce AUTO-RESPONSE: The service has been placed into the maintenance state. Apr 13 14:18:21 omniosce IMPACT: svc:/network/ldap/client:default is unavailable. Apr 13 14:18:21 omniosce REC-ACTION: Run 'svcs -xv svc:/network/ldap/client:default' to determine the generic reason why the service failed, the location of any logfiles, and a list of other services impacted. Apr 13 14:18:27 omniosce ldap_cachemgr[8484]: [ID 293258 daemon.error] libsldap: Status: 4 Mesg: Unable to open filename '/var/ldap/ldap_client_cred' for reading (errno=2). Apr 13 14:18:27 omniosce ldap_cachemgr[8483]: [ID 703877 daemon.error] ldap_cachemgr: failed (rc = 255). Apr 13 14:18:27 omniosce svc.startd[10]: [ID 652011 daemon.warning] svc:/network/ldap/client:default: Method "/lib/svc/method/ldap-client start" failed with exit status 1. Apr 13 14:18:27 omniosce svc.startd[10]: [ID 748625 daemon.error] network/ldap/client:default failed: transitioned to maintenance (see 'svcs -xv' for details) Apr 13 14:18:27 omniosce fmd: [ID 377184 daemon.error] SUNW-MSG-ID: SMF-8000-YX, TYPE: defect, VER: 1, SEVERITY: major Apr 13 14:18:27 omniosce EVENT-TIME: Fri Apr 13 14:18:27 CEST 2018
svcs -xv svc:/network/ldap/client:default
有svc:/network/ldap/client:default (LDAP client) State: maintenance since 13 April 2018 14:18:27 CEST Reason: Start method failed repeatedly, last exited with status 1. See: http://illumos.org/msg/SMF-8000-KS See: man -M /usr/share/man -s 1M ldap_cachemgr See: /var/svc/log/network-ldap-client:default.log Impact: This service is not running.
我什至試圖
/var/ldap/ldap_client_file
從一個工作測試安裝中複製,我以某種方式讓它工作,但無法重現它。# svcadm restart svc:/network/ldap/client # ldaplist -l netgroup ldaplist: LDAP configuration problem (Unable to load configuration '/var/ldap/ldap_client_file' ('').)
由於某種原因,它
/var/ldap/ldap_client_file
現在不存在。沒有接縫正在執行記憶體服務
# svcs|grep cache online 14:18:28 svc:/system/name-service-cache:default
ldap_cachemgr 是 Solaris 上的 ldap 客戶端,是的,它必須始終作為服務執行。
要配置 ldap 客戶端,您需要 /var/ldap 下的兩個文件:
- ldap_client_cred
- ldap_client_file
ldap_client_cred 包含代理使用者的憑據,如下所示:
NS_LDAP_BINDDN= cn=proxyagent,ou=Profile,dc=example,dc=com NS_LDAP_BINDPASSWD= {NS1}47c4213f9c248484454e6782
ldap_client_file 包含連接到 ldap 伺服器的指令:
NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_SERVERS= SERVER_LDAP NS_LDAP_SEARCH_BASEDN= dc=example,dc=com NS_LDAP_AUTH= simple NS_LDAP_SEARCH_REF= FALSE NS_LDAP_SEARCH_SCOPE= one NS_LDAP_SEARCH_TIME= 30 NS_LDAP_SERVER_PREF= SERVER_LDAP NS_LDAP_PROFILE= my_profile NS_LDAP_CREDENTIAL_LEVEL= proxy NS_LDAP_BIND_TIME= 10 NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:simple
my_profile 必須載入到您的 ldap 伺服器上。
最後一步是在 nsswitch.conf 中包含 ldap 並啟動客戶端。