二、 Openldap服務器明文主備配置
2.1 服務器架設
Configure OpenLDAP Replication to continue Directory service if OpenLDAP master server would be down. OpenLDAP master server is called "Provider" and OpenLDAP Slave server is called "Consumer" on OpenLDAP.
Configure Basic LDAP Server settings on both Provider and Consumer.
2.2 主服務器設置
Configure LDAP Provider. Add syncprov module
[root@dlp ~]# vim mod_syncprov.ldif
# create new

dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulePath: /usr/lib64/openldap
olcModuleLoad: syncprov.la
[root@dlp ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f mod_syncprov.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=module,cn=config"
[root@dlp ~]# vim syncprov.ldif
# create new

dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
olcSpSessionLog: 100
[root@dlp ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f syncprov.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "olcOverlay=syncprov,olcDatabase={2}hdb,cn=config"
2.3 備份服務器設置
Configure LDAP Consumer.
[root@slave ~]# vim syncrepl.ldif
# create new

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcSyncRepl
olcSyncRepl: rid=001 provider=ldap://10.8.8.46:389/ bindmethod=simple binddn="cn=Manager,dc=server,dc=world" credentials=dc168 searchbase="dc=server,dc=world" scope=sub schemachecking=on type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00
[root@slave ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f syncrepl.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={2}hdb,cn=config"
confirm settings to search datas
[root@slave ~]# ldapsearch -x -b 'ou=People,dc=server,dc=world'
# People, server.world
dn: ou=People,dc=server,dc=world
objectClass: organizationalUnit
ou: People
...
...
三、 基于Tls的Openldap服務器主備配置
3.1 Provider配置
需啟用Tls，且已完成非Tls相關配置。
3.2 支持基于tls的Consumer備份機配置
3.2.1 Provider的證書同步
將Provider的CACertificateFile、CertificateFile、CertificateKeyFile拷貝到Consumer機器的cacerts路徑

[root@iZ236i68gjtZ syncacerts]# vim tls.ldif
dn: cn=config
changetype: modify
replace: olcTLSCACertificatePath
olcTLSCACertificatePath: /etc/openldap/cacerts
-
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/openldap/cacerts/ca-bundle.crt
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/cacerts/LDAP.crt
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/cacerts/LDAP.key

Add this to the LDAP tree:
#ldapadd -Y EXTERNAL -H ldapi:/// -f tls.ldif

3.2.2 啟用ldaps支持
[root@ns2 certs]# vim /etc/sysconfig/ldap
set line 20, if not yet set this way, so SLAPD_LDAPS=yes

restart LDAP afterwards
[root@ns2 certs]# service slapd restart
3.2.3 基于tls傳輸的備份機配置
[root@iZ236i68gjtZ syncacerts]# vim syncrepl.ldif
# create new
dn: olcDatabase={2}bdb,cn=config
changetype: modify
replace: olcSyncRepl
olcSyncRepl: rid=001 provider="ldaps://66.191.103.166/" bindmethod=simple binddn="
cn=Manager,dc=dcnet,dc=com" credentials="d…1…h…s…" searchb
ase="dc=dcnet,dc=com" tls_reqcert=allow scope=sub schemacheck
ing=on type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00

# ldapadd -Y EXTERNAL -H ldapi:/// -f syncrepl.ldif
3.2.4 基于tls傳輸的備份機ldap.conf配置
如發現錯誤tls啟動錯誤，則需要查看/etc/openldap/ldap.conf配置如下：
TLS_REQCERT allow

四、 Consumer服務器samba用戶信息備份配置

此時應可正常同步，但如果備份機不識別samba庫，則同步中含samba的部分可能無法正常，此時需要手動添加samba庫：

1、方案一：

進入samba服務器，將路徑/usr/share/doc/samba-4.1.12/LDAP/下的samba.schema、samba.ldif文件復制到ldap備份服務器路徑/etc/openldap/schema/;

# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/samba.ldif

2、方案二：

找到provider機器中，samba.schema文件復制到/etc/openldap/schema文件夾
[root@iZ236i68gjtZ syncacerts]# vim schema_convert.conf
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/collective.schema
include /etc/openldap/schema/corba.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/duaconf.schema
include /etc/openldap/schema/dyngroup.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/java.schema
include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/openldap.schema
include /etc/openldap/schema/ppolicy.schema
include /etc/openldap/schema/pmi.schema
include /etc/openldap/schema/samba.schema

mkdir ldif_output (will hold temporary schema files)
slaptest -f schema_convert.conf -F ldif_output
（或者：slapcat -f schema_convert.conf -F ldif_output -n 0 | grep samba,cn=schema）
slapcat -f schema_convert.conf -F ldif_output -n0 -H ldap:///cn={13}samba,cn=schema,cn=config -l cn=samba.ldif

Edit the generated cn=samba.ldif file by removing index information to arrive at:

dn: cn=samba,cn=schema,cn=config
...
cn: samba

Remove the bottom lines:

structuralObjectClass: olcSchemaConfig
entryUUID: b53b75ca-083f-102d-9fff-2f64fd123c95
creatorsName: cn=config
createTimestamp: 20080827045234Z
entryCSN: 20080827045234.341425Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20080827045234Z

Your attribute values will vary.

Samba indices

Now that slapd knows about the Samba attributes, we can set up some indices based on them. Indexing entries is a way to improve performance when a client performs a filtered search on the DIT.

Create the file samba_indices.ldif with the following contents:

dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcDbIndex
olcDbIndex: uidNumber eq
olcDbIndex: gidNumber eq
olcDbIndex: loginShell eq
olcDbIndex: uid eq,pres,sub
olcDbIndex: memberUid eq,pres,sub
olcDbIndex: uniqueMember eq,pres
olcDbIndex: sambaSID eq
olcDbIndex: sambaPrimaryGroupSID eq
olcDbIndex: sambaGroupType eq
olcDbIndex: sambaSIDList eq
olcDbIndex: sambaDomainName eq
olcDbIndex: default sub

dn: olcDatabase={2}bdb,cn=config
changetype: modify
add: olcDbIndex
olcDbIndex: uniqueMember eq,pres
olcDbIndex: sambaSID eq
olcDbIndex: sambaPrimaryGroupSID eq
olcDbIndex: sambaGroupType eq
olcDbIndex: sambaSIDList eq
olcDbIndex: sambaDomainName eq
olcDbIndex: default sub

Using the ldapmodify utility load the new indices:

sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f samba_indices.ldif

轉載于:https://www.cnblogs.com/donneyliu/p/Openldap_Duplicate_Synchronization.html

總結

以上是生活随笔為你收集整理的Centos Openldap服务器数据库主备（二）的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。