{"id":4198,"date":"2014-10-24T14:06:00","date_gmt":"2014-10-24T06:06:00","guid":{"rendered":"https:\/\/www.hmouse.tk\/?p=4198"},"modified":"2014-11-13T16:01:43","modified_gmt":"2014-11-13T08:01:43","slug":"ldap%e7%9b%b8%e5%85%b3%e6%95%b4%e5%90%88","status":"publish","type":"post","link":"https:\/\/www.hmouse.cn\/?p=4198","title":{"rendered":"LDAP\u76f8\u5173\u6574\u5408"},"content":{"rendered":"

svn\u76f8\u5173\uff1a<\/p>\n

\u5b89\u88c5\uff1a<\/p>\n

yum -y install mod_ssl mod_dav_svn httpd mod_dav <\/p>\n

\u914d\u7f6e\uff1a<\/p>\n

<Location \/test>
  DAV svn
  SVNParentPath \/data\/svn1
  SvnListParentPath on
   AuthType Basic
  AuthName “Please login”
  AuthBasicProvider ldap
  AuthLDAPURL “ldap:\/\/192.168.7.1:389\/ou=system-admin,ou=login,dc=test,dc=com”<\/font>
  AuthLDAPBindDN “cn=admin,dc=test,dc=com”
  AuthLDAPBindPassword “test”
<\/font>  Require valid-user
<\/Location><\/p>\n

\/data\/svn1 \u4e0b svnadmin create test  \u5efa\u4e2atest\u7684\u4ed3\u5e93\uff0c\u7136\u540e\u8bb0\u5f97\u66f4\u6539\u6743\u9650\u3002\u7136\u540e\u5c31\u53ef\u4ee5\u901a\u8fc7LDAP\u7684\u8ba4\u8bc1\u53bb\u8bbf\u95eesvn\u4e86\u3002\u8fd9\u91cc\u53ea\u6d89\u53ca\u5230\u8ba4\u8bc1\u6ca1\u6d89\u53ca\u5230\u6743\u9650\u3002<\/p>\n

 <\/p>\n

git\u76f8\u5173\uff1a<\/p>\n

git\u53ef\u4ee5\u6e90\u7801\u5b89\u88c5\uff0c\u53ef\u4ee5\u53c2\u8003\u53e6\u4e00\u4e2a\u6587\u7ae0\u3002https:\/\/www.hmouse.cn\/?p=4202<\/a><\/p>\n

\u914d\u7f6e\uff1a<\/p>\n

[root@localhost git]# cat \/etc\/httpd\/conf.d\/git.conf
SetEnv GIT_PROJECT_ROOT \/var\/www\/html\/git
SetEnv GIT_HTTP_EXPORT_ALL
ScriptAlias \/git \/usr\/local\/libexec\/git-core\/git-http-backend
<LocationMatch “^\/git\/test.git\/.*$”>
        Dav On
        Options +Indexes +FollowSymLinks
        AuthType Basic
        AuthName “Git Access”
        AuthType Basic
        AuthName “Please login”
        AuthBasicProvider ldap
        AuthLDAPURL “ldap:\/\/192.168.7.1:389\/ou=system-admin,ou=login,dc=test,dc=com”
        AuthLDAPBindDN “cn=admin,dc=test,dc=com”
        AuthLDAPBindPassword “test”<\/font>
        Require valid-user
<\/LocationMatch><\/p>\n

\u5728 \/var\/www\/html\/git \u4e0b \u65b0\u5efa\u7684git\u4ed3\u5e93 \u90fd\u53ef\u4ee5\u901a\u8fc7 ladp\u7684 ou=system-admin,ou=login,dc=test,dc=com \u8ba4\u8bc1\u8bbf\u95ee\u3002<\/p>\n

 <\/p>\n

VPN\uff1a<\/p>\n

pptpd \u7684\u6574\u5408\uff1a<\/p>\n

\u53c2\u8003url\uff1a<\/p>\n

http:\/\/www.shencan.net\/index.php\/2014\/04\/29\/freeradius-%E4%B8%8E-ldap-%E6%95%B4%E5%90%88\/<\/a>   <\/p>\n

ldap+radius  \u6574\u5408  \u8fd9\u7bc7\u6587\u7ae0\u8bf4\u7684\u6bd4\u8f83\u9760\u8c31\u70b9<\/p>\n

http:\/\/www.linuxyunwei.com\/2013\/05\/pptpfreeradiusldap%E5%AE%9E%E7%8E%B0vpn%E7%AE%A1%E7%90%86\/comment-page-1\/<\/a>   <\/p>\n

 <\/p>\n

openvpn\u7684\u6574\u5408\uff1a<\/p>\n

\u53c2\u8003url\uff1ahttp:\/\/www.shencan.net\/index.php\/2014\/05\/03\/openvpn-%E4%B8%8Eldap-%E6%95%B4%E5%90%88\/<\/a><\/p>\n

\u4ee5\u4e0b\u662f\u8f6c\u8f7d\uff0c\u6211\u81ea\u5df1\u6ca1\u6709\u5b89\u88c5\u3002\u4ee5\u505a\u5907\u7528\uff1a <\/p>\n

################################# <\/p>\n

\u6700\u8fd1\u5404\u79cdldap\uff0c\u5404\u79cdvpn\u3002\u3002 \u4e0a\u7bc7\u6587\u7ae0\u628aldap\u8ddfradius \u6574\u5408\u8d77\u6765\u4e86 \uff0c\u8fd9\u7bc7\u6587\u7ae0\u4e3b\u8981\u8bb2openvpn\u8ddfldap\u96c6\u5408\uff0c\u8fd9\u91cc\u5148\u8bf4\u4e0b <\/p>\n

openvpn\u8ddfldap\u7ed3\u5408\u7684\u65b9\u5f0f\u6709\u591a\u79cd <\/p>\n

1.\u901a\u8fc7openvpn-auth-ldap\u6a21\u5757\u5b9e\u73b0\u76f4\u63a5\u4e0eldap\u4ea4\u4e92 <\/p>\n

2.\u901a\u8fc7radiusplugin\u8fd9\u4e2a\u63d2\u4ef6 \u4e0eradius\u7ed3\u5408\uff08radius\u6700\u7ec8\u8fd8\u662f\u53bbldap\u53bb\u8ba4\u8bc1\uff09 <\/p>\n

\u672c\u6587\u5148\u91c7\u7528\u7684\u662f\u7b2c\u4e00\u79cd \uff0c\u7b49\u4e0b\u641e\u641e\u7b2c\u4e8c\u79cd\u5427 \u56e0\u4e3a\u4e0a\u7bc7\u6587\u7ae0\u5df2\u7ecf\u628aradius\u8ddfldap\u6574\u5408\u8d77\u6765\u4e86 \u7b2c\u4e8c\u79cd\u5e94\u8be5\u6bd4\u8f83\u7b80\u5355\u4e86\u3002 <\/p>\n

\u5f00\u59cb\u641e\u5427 <\/p>\n

\u56e0\u4e3a\u8fd9\u4e2a\u6574\u5408 \u524d\u63d0\u662f openvpn \u8ddf ldap\u670d\u52a1\u90fdok  \u624d\u80fd\u6574\u5408 <\/p>\n

\u5173\u4e8eopenvpn \u8fd9\u4e2a\u5c31\u4e0d\u591a\u4ecb\u7ecd\u5565\u4e86  \u670d\u52a1\u7aef yum\u5b89\u88c5\u5c31\u884c \u7136\u540e\u751f\u6210\u8bc1\u4e66\u5565\u7684 \u6bd4\u8f83\u7b80\u5355 \u7f51\u4e0a\u4e5f\u6709\u5f88\u591a\u4f8b\u5b50(\u7f16\u8bd1\u5b89\u88c5\u4e5f\u884c) <\/p>\n

\u9ed8\u8ba4\u65b9\u5f0f\u5ba2\u6237\u7aef\u7684\u8bc1\u4e66\u9700\u8981\u4ece\u670d\u52a1\u7aef \u751f\u6210\u597d\u540e \u641e\u5230\u5ba2\u6237\u7aef\u4e0a <\/p>\n

\u5173\u4e8e\u914d\u7f6e\u7684\u8bdd  \u670d\u52a1\u7aef\u662fserver.conf   \u5ba2\u6237\u7aef\u662fclient.conf <\/p>\n

\u5173\u4e8eldap\u7684\u8bdd \u4e0a\u7bc7\u6587\u4ef6\u4e5f\u8bb2\u8fc7\u5b89\u88c5 \u7b80\u5355\u914d\u7f6e\u5565\u7684 <\/p>\n

\u6211\u76f4\u63a5\u4e0a\u6211\u5df2\u7ecf\u6574\u5408\u597d\u7684\u914d\u7f6e\u5427 <\/p>\n

openvpn\u7684server.conf <\/p>\n

\"1\"<\/a> <\/p>\n

\u6700\u4e0a\u9762\u6846\u6846\u91cc\u9762\u7684\u4e0d\u591a\u8bf4\u4e86 <\/p>\n

\u4e0b\u9762\u6846\u6846\u8d77\u6765\u7684\u5c31\u662f\u901a\u8fc7\u8c03\u7528openvpen-auth-ldap\u6a21\u5757\u6765\u5b9e\u73b0\u4e0eldap\u4ea4\u4e92\u7684 \u540e\u9762\u7684cn=%u \u5c31\u662f\u901a\u8fc7uid <\/p>\n

\u6700\u540e\u600e\u4e48\u4e0eldap\u4ea4\u4e92 \u5c31\u662f\u770b\u8fd9\u4e2a\u914d\u7f6e\u6587\u4ef6\u4e86 \/etc\/openvpn\/auth\/ldap.conf <\/p>\n

\u8fd9\u4e2a\u6587\u4ef6\u8ddf\u4e0a\u9762\u7684\u6a21\u5757\u5c31\u662f\u7531openvpn-auth-ldap  rpm\u5305\u63d0\u4f9b\u7684 <\/p>\n

\u770b\u770bldap.conf \u5427 <\/p>\n

\"1\"<\/a> <\/p>\n

\u8fd9\u91cc\u53ea\u662f\u4e00\u4e2a\u7b80\u5355\u7684\u4e0eldap\u670d\u52a1\u5668\u8d77\u94fe\u63a5 \u67e5\u8be2\u7684\u8fc7\u7a0b \uff0c\u6211\u8fd9\u91cc\u4e3a\u4e86\u7b80\u5355 \u5c31\u6ca1\u91c7\u7528TLS\u7684\u65b9\u5f0f \u5982\u679c\u5938\u516c\u7f51\u7684\u8bdd \u8fd8\u662f\u5efa\u8bae\u91c7\u7528TLS\u65b9\u5f0f\u53bb\u67e5\u8be2 <\/p>\n

OK openvpn\u670d\u52a1\u7aef\u914d\u7f6e\u5c31\u8fd9\u4e9b <\/p>\n

\u518d\u770b\u770b \u5ba2\u6237\u7aefclient.conf \u914d\u7f6e\u5427 <\/p>\n

\"1\"<\/a> <\/p>\n

\u5ba2\u6237\u7aef\u914d\u7f6e\u5c31\u8fd9\u4e9b \u6bd4\u8f83\u7b80\u5355 \uff08\u56e0\u4e3a\u8d70ldap\u4e86\u8ba4\u8bc1  \u5c31\u4e0d\u9700\u8981\u5ba2\u6237\u7aef\u8bc1\u4e66\u4e86\uff09 <\/p>\n

\u4e0b\u9762\u6211\u4eec\u6765\u8bd5\u8bd5\u5427 <\/p>\n

\u770b\u8fc7\u4e0a\u9762\u7684\u6587\u7ae0\u8fd8\u77e5\u9053\u6211\u5f97ldap\u6709cpis1-cpis20 \u4e2a\u8d26\u53f7 \u4e0b\u9762\u6211\u4eec\u6765\u6d4b\u8bd5\u4e0b <\/p>\n

\u6d4b\u8bd5cpis20\u8d26\u53f7\u5427 <\/p>\n

\"1\"<\/a> <\/p>\n

\u770b\u670d\u52a1\u7aef\u65e5\u5fd7 <\/p>\n

\"1\"<\/a> <\/p>\n

ok  cpis20\u6ca1\u95ee\u9898 <\/p>\n

\u6d4b\u8bd5\u4e2acpis21\u628a   \u63d0\u793a\u8ba4\u8bc1\u5931\u8d25 <\/p>\n

\u6211\u4eec\u4e0a\u65e5\u5fd7\u5427 <\/p>\n

\"1\"<\/a> <\/p>\n

OK \u5dee\u4e0d\u591a\u6574\u5408ok\u4e86 <\/p>\n

\u7b2c\u4e00\u79cdOK\u4e86  \u5f00\u641e\u7b2c2\u79cd\u5427 <\/p>\n

\u5b89\u88c5\u63d2\u4ef6\u5148\u5b89\u88c5\u4f9d\u8d56 <\/p>\n

yum install -y libgcrypt libgpg-error libgcrypt-devel <\/p>\n

wget http:\/\/www.nongnu.org\/radiusplugin\/radiusplugin_v2.1.tar.gz &&  tar fxz radiusplugin_v2.1.tar.gz  && cd  \/root\/radiusplugin && make <\/p>\n

cp radiusplugin.so \/etc\/openvpn\/  \u6a21\u5757 <\/p>\n

cp radiusplugin.cnf \/etc\/openvpn\/  \u914d\u7f6e\u6587\u4ef6 <\/p>\n

ok \u6211\u4eec\u5148\u6539\u4e0bradiusplugin.cnf \u914d\u7f6e\u6587\u4ef6\u5427 <\/p>\n

\"1\"<\/a> <\/p>\n

ok  \u6211\u4eec\u518d\u53bb\u6539\u4e0bserver.conf \u914d\u7f6e\u6587\u4ef6 <\/p>\n

\"1\"<\/a> <\/p>\n

\u52a0\u8f7d\u65b0\u6a21\u5757 \uff08\u521a\u521a\u5b89\u88c5\u7684\uff09 <\/p>\n

ok \u7136\u540e\u91cd\u542f\u670d\u52a1 \u5c31ok\u4e86  \u8fd9\u4e2a\u6bd4\u8f83\u7b80\u5355\u3002\u3002\u3002 <\/p>\n

\u56e0\u4e3a\u8fd9\u79cd\u5ba2\u6237\u7aef\u9700\u8981\u5355\u72ec\u5b89\u88c5\uff0c\u4e0d\u4fbf\u64cd\u4f5c\uff0c\u6545\u6ca1\u6709\u5b9e\u9645\u53bb\u5b9e\u65bd<\/font><\/p>\n

\u73b0\u5728 \u6765\u8bf4\u8bf4 pptpd\u7684 \u9a8c\u8bc1\u4f7f\u7528\uff1a<\/p>\n

\u53c2\u8003url\uff1a<\/p>\n

\u6574\u5408\uff1ahttp:\/\/www.linuxyunwei.com\/2013\/05\/pptpfreeradiusldap%E5%AE%9E%E7%8E%B0vpn%E7%AE%A1%E7%90%86\/comment-page-1\/<\/a>   <\/p>\n

\u4ee5\u4e0a\u7684\u6574\u5408\u53ef\u60dc\u53ea\u80fd\u7528\u672a\u52a0\u5bc6\u7684\u5bc6\u7801\uff1a<\/p>\n

\u4e0b\u9762\u662f\u52a0\u5bc6\u7684\u5bc6\u7801\u7684\u53c2\u8003url\uff1a<\/p>\n

http:\/\/blog.sina.com.cn\/s\/blog_92dc41ea0101rbm0.html<\/a><\/p>\n

http:\/\/bbs.chinaunix.net\/forum.php?mod=viewthread&tid=1214563<\/a><\/p>\n

\u6ce8\u610f\u7684\u662f<\/p>\n

[root@ldap ~]# grep -v ‘#’ \/etc\/raddb\/modules\/ldap  | grep -v ‘^$’ <\/p>\n

ldap { <\/p>\n

server = “localhost” <\/p>\n

identity = “cn=root,dc=verystar,dc=cn” <\/p>\n

password = \u6b64\u5904\u4e3aLDAP root\u7684\u5bc6\u7801 <\/p>\n

basedn = “ou=Users,dc=verystar,dc=cn” <\/p>\n

filter = “(uid=%{%{Stripped-User-Name}:-%{User-Name}})” <\/p>\n

password_attribute = userPassword<\/font> <\/p>\n

ldap_connections_number = 5 <\/p>\n

timeout = 4 <\/p>\n

timelimit = 3 <\/p>\n

net_timeout = 1 <\/p>\n

tls { <\/p>\n

start_tls = no <\/p>\n

} <\/p>\n

dictionary_mapping = ${confdir}\/ldap.attrmap <\/p>\n

edir_account_policy_check = no <\/p>\n

keepalive { <\/p>\n

idle = 60 <\/p>\n

probes = 3 <\/p>\n

interval = 3 <\/p>\n

} <\/p>\n

} <\/p>\n

\u7ea2\u8272\u7684\u6ce8\u610f\u8981\u6dfb\u52a0\uff0c <\/p>\n

\u8fd8\u6709 \u5c31\u662f\u6dfb\u52a0\u65b0\u5c5e\u6027\u7684\u65f6\u5019 <\/p>\n

\u89e3\u51b3\u529e\u6cd5\uff1a <\/p>\n

# vi \/etc\/openldap\/schema\/inetorgperson.schema\uff0c\u5728objectclass ‘inetOrgPerson’ \u524d\u65b0\u589e\uff1a <\/p>\n

attributetype ( 1.3.6.1.4.1.3317.4.3.1.66 <\/p>\n

NAME ‘radiusUserPassword’ <\/p>\n

DESC ‘radiusUserPassword’ <\/p>\n

SUP userPassword ) <\/p>\n

\u4fee\u6539objectclass ‘inetOrgPerson’ \uff0c\u628a’radiusUserPassword’ \u4f5c\u4e3a\u53ef\u9009\u5c5e\u6027\u52a0\u5165’inetOrgPerson’ \u5bf9\u8c61\u7c7b\uff1a <\/p>\n

objectclass  ( 2.16.840.1.113730.3.2.2 <\/p>\n

NAME ‘inetOrgPerson’ <\/p>\n

DESC ‘RFC2798: Internet Organizational Person’ <\/p>\n

SUP organizationalPerson <\/p>\n

STRUCTURAL <\/p>\n

MAY ( <\/p>\n

radiusUserPassword $ audio $ businessCategory $ carLicense $ departmentNumber $ <\/p>\n

\u00b7\u00b7\u00b7\u7565\u00b7\u00b7\u00b7 <\/p>\n

) <\/p>\n

\u4fee\u6539\/etc\/raddb\/ldap.attrmap\uff0c\u6dfb\u52a0 <\/p>\n

checkItem  NT-Password  ntPassword #\u539f\u6709\u7684
checkItem  NT-Password  userPassword #\u65b0\u589e\u7684 <\/p>\n

checkItem  NT-Password  radiusUserPassword #\u65b0\u589e\u7684 <\/p>\n

\u6ce8\u610f\u987a\u5e8f\u4e0d\u80fd\u53cd\uff0c\u987a\u5e8f\u5bf9\u4e86PPTP\u548cOpenVPN\u80fd\u540c\u65f6\u5de5\u4f5c\u3002 <\/p>\n

\u4fee\u6539\/etc\/openldap\/slapd.conf <\/p>\n

database  bdb <\/p>\n

access to attrs=userPassword,radiusUserPassword <\/p>\n

by self write <\/p>\n

by * auth <\/p>\n

\u7531\u4e8eMD4\/MD5\u5bc6\u7801\u5bb9\u6613\u88ab\u5b57\u5178\u653b\u51fb\u7834\u89e3\uff0c\u56e0\u6b64\u6709\u5fc5\u8981\u4fdd\u62a4\u5bc6\u6587\u4e0d\u8ba9\u4eba\u8f7b\u6613\u83b7\u5f97\uff0c\u540c\u65f6\u5efa\u8bae\u4f7f\u7528\u590d\u6742\u5bc6\u7801\u3002 <\/p>\n

\u8fd9\u91cchttp:\/\/book.51cto.com\/art\/201204\/328699.htm\u53ef\u4ee5\u770b\u5230\u4e0d\u592a\u590d\u6742\u7684\u5bc6\u7801\u80fd\u7a77\u4e3e\u51fa\u6765\u3002 <\/p>\n

\u91cd\u542fslapd\u3002 <\/p>\n

\u901a\u8fc7phpLdapAdmin\u6dfb\u52a0\u65f6\uff0c\u4e00\u5b9a\u8981\u8bb0\u5f97\u6e05\u7f13\u5b58\uff0c\u5426\u5219\u4f1a\u4e00\u76f4\u65e0\u6cd5\u51fa\u73b0\u65b0\u5c5e\u6027\u3002 <\/p>\n

\u7531\u4e8e\u65e0\u6cd5\u6574\u54082\u4e2a\u9a8c\u8bc1\uff0c\u6240\u4ee5\u5230\u65f6\u9700\u89812\u4e2a\u5bc6\u7801\uff0c\u4e00\u4e2a\u662fMD5\u52a0\u5bc6\u7684\u7528\u6765\u5904\u7406svn\u548cgit\uff0c\u4e00\u4e2a\u662fmd4\u52a0\u5bc6\u7528\u6765\u5904\u7406pptpd\u7684\u8ba4\u8bc1\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

svn\u76f8\u5173\uff1a<\/p>\n

\u5b89\u88c5\uff1a<\/p>\n

yum -y install mod_ssl mod_dav_svn httpd mod_dav <\/p>\n

\u914d\u7f6e\uff1a<\/p>\n

<Location \/test>
  DAV svn
  SVNParentPath \/data\/svn1
  SvnListParentPath on
   AuthType Basic
  AuthName “Please login”
  AuthBasicProvider ldap
  AuthLDAPURL “ldap:\/\/192.168.7.1:389\/ou=system-admin,ou=login,dc=test,dc=com”<\/font>
  AuthLDAPBindDN “cn=admin,dc=test,dc=com”
  AuthLDAPBindPassword “test”
<\/font>  Require valid-user
<\/Location><\/p>\n

\/data\/svn1 \u4e0b svnadmin create test  \u5efa\u4e2atest\u7684\u4ed3\u5e93\uff0c\u7136\u540e\u8bb0\u5f97\u66f4\u6539\u6743\u9650\u3002\u7136\u540e\u5c31\u53ef\u4ee5\u901a\u8fc7LDAP\u7684\u8ba4\u8bc1\u53bb\u8bbf\u95eesvn\u4e86\u3002\u8fd9\u91cc\u53ea\u6d89\u53ca\u5230\u8ba4\u8bc1\u6ca1\u6d89\u53ca\u5230\u6743\u9650\u3002<\/p>\n

 <\/p>\n

git\u76f8\u5173\uff1a<\/p>\n

git\u53ef\u4ee5\u6e90\u7801\u5b89\u88c5\uff0c\u53ef\u4ee5\u53c2\u8003\u53e6\u4e00\u4e2a\u6587\u7ae0\u3002https:\/\/www.hmouse.cn\/?p=4202<\/a><\/p>\n

\u914d\u7f6e\uff1a<\/p>\n

[root@localhost git]# cat \/etc\/httpd\/conf.d\/git.conf
SetEnv GIT_PROJECT_ROOT \/var\/www\/html\/git
SetEnv GIT_HTTP_EXPORT_ALL
ScriptAlias \/git \/usr\/local\/libexec\/git-core\/git-http-backend
<LocationMatch “^\/git\/test.git\/.*$”>
        Dav On
        Options +Indexes +FollowSymLinks
        AuthType Basic
        AuthName “Git Access”
        AuthType Basic
        AuthName “Please login”
        AuthBasicProvider ldap
        AuthLDAPURL “ldap:\/\/192.168.7.1:389\/ou=system-admin,ou=login,dc=test,dc=com”
        AuthLDAPBindDN “cn=admin,dc=test,dc=com”
        AuthLDAPBindPassword “test”<\/font>
        Require valid-user
<\/LocationMatch><\/p>\n

\u5728 \/var\/www\/html\/git \u4e0b \u65b0\u5efa\u7684git\u4ed3\u5e93 \u90fd\u53ef\u4ee5\u901a\u8fc7 ladp\u7684 ou=system-admin,ou=login,dc=test,dc=com \u8ba4\u8bc1\u8bbf\u95ee\u3002<\/p>\n

 <\/p>\n

VPN\uff1a<\/p>\n

pptpd \u7684\u6574\u5408\uff1a<\/p>\n

\u53c2\u8003url\uff1a<\/p>\n

http:\/\/www.shencan.net\/index.php\/2014\/04\/29\/freeradius-%E4%B8%8E-ldap-%E6%95%B4%E5%90%88\/<\/a>   <\/p>\n

ldap+radius  \u6574\u5408  \u8fd9\u7bc7\u6587\u7ae0\u8bf4\u7684\u6bd4\u8f83\u9760\u8c31\u70b9<\/p>\n

http:\/\/www.linuxyunwei.com\/2013\/05\/pptpfreeradiusldap%E5%AE%9E%E7%8E%B0vpn%E7%AE%A1%E7%90%86\/comment-page-1\/<\/a>   <\/p>\n

 <\/p>\n

openvpn\u7684\u6574\u5408\uff1a<\/p>\n

\u53c2\u8003url\uff1ahttp:\/\/www.shencan.net\/index.php\/2014\/05\/03\/openvpn-%E4%B8%8Eldap-%E6%95%B4%E5%90%88\/<\/a><\/p>\n

\u4ee5\u4e0b\u662f\u8f6c\u8f7d\uff0c\u6211\u81ea\u5df1\u6ca1\u6709\u5b89\u88c5\u3002\u4ee5\u505a\u5907\u7528\uff1a <\/p>\n

################################# <\/p>\n

\u6700\u8fd1\u5404\u79cdldap\uff0c\u5404\u79cdvpn\u3002\u3002 \u4e0a\u7bc7\u6587\u7ae0\u628aldap\u8ddfradius \u6574\u5408\u8d77\u6765\u4e86 \uff0c\u8fd9\u7bc7\u6587\u7ae0\u4e3b\u8981\u8bb2openvpn\u8ddfldap\u96c6\u5408\uff0c\u8fd9\u91cc\u5148\u8bf4\u4e0b <\/p>\n

openvpn\u8ddfldap\u7ed3\u5408\u7684\u65b9\u5f0f\u6709\u591a\u79cd <\/p>\n

1.\u901a\u8fc7openvpn-auth-ldap\u6a21\u5757\u5b9e\u73b0\u76f4\u63a5\u4e0eldap\u4ea4\u4e92 <\/p>\n

2.\u901a\u8fc7radiusplugin\u8fd9\u4e2a\u63d2\u4ef6 \u4e0eradius\u7ed3\u5408\uff08radius\u6700\u7ec8\u8fd8\u662f\u53bbldap\u53bb\u8ba4\u8bc1\uff09 <\/p>\n

\u672c\u6587\u5148\u91c7\u7528\u7684\u662f\u7b2c\u4e00\u79cd \uff0c\u7b49\u4e0b\u641e\u641e\u7b2c\u4e8c\u79cd\u5427 \u56e0\u4e3a\u4e0a\u7bc7\u6587\u7ae0\u5df2\u7ecf\u628aradius\u8ddfldap\u6574\u5408\u8d77\u6765\u4e86 \u7b2c\u4e8c\u79cd\u5e94\u8be5\u6bd4\u8f83\u7b80\u5355\u4e86\u3002 <\/p>\n

\u5f00\u59cb\u641e\u5427 <\/p>\n

\u56e0\u4e3a\u8fd9\u4e2a\u6574\u5408 \u524d\u63d0\u662f openvpn \u8ddf ldap\u670d\u52a1\u90fdok  \u624d\u80fd\u6574\u5408 <\/p>\n

\u5173\u4e8eopenvpn \u8fd9\u4e2a\u5c31\u4e0d\u591a\u4ecb\u7ecd\u5565\u4e86  \u670d\u52a1\u7aef yum\u5b89\u88c5\u5c31\u884c \u7136\u540e\u751f\u6210\u8bc1\u4e66\u5565\u7684 \u6bd4\u8f83\u7b80\u5355 \u7f51\u4e0a\u4e5f\u6709\u5f88\u591a\u4f8b\u5b50(\u7f16\u8bd1\u5b89\u88c5\u4e5f\u884c) <\/p>\n

\u9ed8\u8ba4\u65b9\u5f0f\u5ba2\u6237\u7aef\u7684\u8bc1\u4e66\u9700\u8981\u4ece\u670d\u52a1\u7aef \u751f\u6210\u597d\u540e \u641e\u5230\u5ba2\u6237\u7aef\u4e0a <\/p>\n

\u5173\u4e8e\u914d\u7f6e\u7684\u8bdd  \u670d\u52a1\u7aef\u662fserver.conf   \u5ba2\u6237\u7aef\u662fclient.conf <\/p>\n

\u5173\u4e8eldap\u7684\u8bdd \u4e0a\u7bc7\u6587\u4ef6\u4e5f\u8bb2\u8fc7\u5b89\u88c5 \u7b80\u5355\u914d\u7f6e\u5565\u7684 <\/p>\n

\u6211\u76f4\u63a5\u4e0a\u6211\u5df2\u7ecf\u6574\u5408\u597d\u7684\u914d\u7f6e\u5427 <\/p>\n

openvpn\u7684server.conf <\/p>\n

\"1\"<\/a> <\/p>\n

\u6700\u4e0a\u9762\u6846\u6846\u91cc\u9762\u7684\u4e0d\u591a\u8bf4\u4e86 <\/p>\n

\u4e0b\u9762\u6846\u6846\u8d77\u6765\u7684\u5c31\u662f\u901a\u8fc7\u8c03\u7528openvpen-auth-ldap\u6a21\u5757\u6765\u5b9e\u73b0\u4e0eldap\u4ea4\u4e92\u7684 \u540e\u9762\u7684cn=%u \u5c31\u662f\u901a\u8fc7uid <\/p>\n

\u6700\u540e\u600e\u4e48\u4e0eldap\u4ea4\u4e92 \u5c31\u662f\u770b\u8fd9\u4e2a\u914d\u7f6e\u6587\u4ef6\u4e86 \/etc\/openvpn\/auth\/ldap.conf <\/p>\n

\u8fd9\u4e2a\u6587\u4ef6\u8ddf\u4e0a\u9762\u7684\u6a21\u5757\u5c31\u662f\u7531openvpn-auth-ldap  rpm\u5305\u63d0\u4f9b\u7684 <\/p>\n

\u770b\u770bldap.conf \u5427 <\/p>\n

\"1\"<\/a> <\/p>\n

\u8fd9\u91cc\u53ea\u662f\u4e00\u4e2a\u7b80\u5355\u7684\u4e0eldap\u670d\u52a1\u5668\u8d77\u94fe\u63a5 \u67e5\u8be2\u7684\u8fc7\u7a0b \uff0c\u6211\u8fd9\u91cc\u4e3a\u4e86\u7b80\u5355 \u5c31\u6ca1\u91c7\u7528TLS\u7684\u65b9\u5f0f \u5982\u679c\u5938\u516c\u7f51\u7684\u8bdd \u8fd8\u662f\u5efa\u8bae\u91c7\u7528TLS\u65b9\u5f0f\u53bb\u67e5\u8be2 <\/p>\n

OK openvpn\u670d\u52a1\u7aef\u914d\u7f6e\u5c31\u8fd9\u4e9b <\/p>\n

\u518d\u770b\u770b \u5ba2\u6237\u7aefclient.conf \u914d\u7f6e\u5427 <\/p>\n

\"1\"<\/a> <\/p>\n

\u5ba2\u6237\u7aef\u914d\u7f6e\u5c31\u8fd9\u4e9b \u6bd4\u8f83\u7b80\u5355 \uff08\u56e0\u4e3a\u8d70ldap\u4e86\u8ba4\u8bc1  \u5c31\u4e0d\u9700\u8981\u5ba2\u6237\u7aef\u8bc1\u4e66\u4e86\uff09 <\/p>\n

\u4e0b\u9762\u6211\u4eec\u6765\u8bd5\u8bd5\u5427 <\/p>\n

\u770b\u8fc7\u4e0a\u9762\u7684\u6587\u7ae0\u8fd8\u77e5\u9053\u6211\u5f97ldap\u6709cpis1-cpis20 \u4e2a\u8d26\u53f7 \u4e0b\u9762\u6211\u4eec\u6765\u6d4b\u8bd5\u4e0b <\/p>\n

\u6d4b\u8bd5cpis20\u8d26\u53f7\u5427 <\/p>\n

\"1\"<\/a> <\/p>\n

\u770b\u670d\u52a1\u7aef\u65e5\u5fd7 <\/p>\n

\"1\"<\/a> <\/p>\n

ok  cpis20\u6ca1\u95ee\u9898 <\/p>\n

\u6d4b\u8bd5\u4e2acpis21\u628a   \u63d0\u793a\u8ba4\u8bc1\u5931\u8d25 <\/p>\n

\u6211\u4eec\u4e0a\u65e5\u5fd7\u5427 <\/p>\n

\"1\"<\/a> <\/p>\n

OK \u5dee\u4e0d\u591a\u6574\u5408ok\u4e86 <\/p>\n

\u7b2c\u4e00\u79cdOK\u4e86  \u5f00\u641e\u7b2c2\u79cd\u5427 <\/p>\n

\u5b89\u88c5\u63d2\u4ef6\u5148\u5b89\u88c5\u4f9d\u8d56 <\/p>\n

yum install -y libgcrypt libgpg-error libgcrypt-devel <\/p>\n

wget http:\/\/www.nongnu.org\/radiusplugin\/radiusplugin_v2.1.tar.gz &&  tar fxz radiusplugin_v2.1.tar.gz  && cd  \/root\/radiusplugin && make <\/p>\n

cp radiusplugin.so \/etc\/openvpn\/  \u6a21\u5757 <\/p>\n

cp radiusplugin.cnf \/etc\/openvpn\/  \u914d\u7f6e\u6587\u4ef6 <\/p>\n

ok \u6211\u4eec\u5148\u6539\u4e0bradiusplugin.cnf \u914d\u7f6e\u6587\u4ef6\u5427 <\/p>\n

\"1\"<\/a> <\/p>\n

ok  \u6211\u4eec\u518d\u53bb\u6539\u4e0bserver.conf \u914d\u7f6e\u6587\u4ef6 <\/p>\n

\"1\"<\/a> <\/p>\n

\u52a0\u8f7d\u65b0\u6a21\u5757 \uff08\u521a\u521a\u5b89\u88c5\u7684\uff09 <\/p>\n

ok \u7136\u540e\u91cd\u542f\u670d\u52a1 \u5c31ok\u4e86  \u8fd9\u4e2a\u6bd4\u8f83\u7b80\u5355\u3002\u3002\u3002 <\/p>\n

\u56e0\u4e3a\u8fd9\u79cd\u5ba2\u6237\u7aef\u9700\u8981\u5355\u72ec\u5b89\u88c5\uff0c\u4e0d\u4fbf\u64cd\u4f5c\uff0c\u6545\u6ca1\u6709\u5b9e\u9645\u53bb\u5b9e\u65bd<\/font><\/p>\n

\u73b0\u5728 \u6765\u8bf4\u8bf4 pptpd\u7684 \u9a8c\u8bc1\u4f7f\u7528\uff1a<\/p>\n

\u53c2\u8003url\uff1a<\/p>\n

\u6574\u5408\uff1ahttp:\/\/www.linuxyunwei.com\/2013\/05\/pptpfreeradiusldap%E5%AE%9E%E7%8E%B0vpn%E7%AE%A1%E7%90%86\/comment-page-1\/<\/a>   <\/p>\n

\u4ee5\u4e0a\u7684\u6574\u5408\u53ef\u60dc\u53ea\u80fd\u7528\u672a\u52a0\u5bc6\u7684\u5bc6\u7801\uff1a<\/p>\n

\u4e0b\u9762\u662f\u52a0\u5bc6\u7684\u5bc6\u7801\u7684\u53c2\u8003url\uff1a<\/p>\n

http:\/\/blog.sina.com.cn\/s\/blog_92dc41ea0101rbm0.html<\/a><\/p>\n

http:\/\/bbs.chinaunix.net\/forum.php?mod=viewthread&tid=1214563<\/a><\/p>\n

\u6ce8\u610f\u7684\u662f<\/p>\n

[root@ldap ~]# grep -v ‘#’ \/etc\/raddb\/modules\/ldap  | grep -v ‘^$’ <\/p>\n

ldap { <\/p>\n

server = “localhost” <\/p>\n

identity = “cn=root,dc=verystar,dc=cn” <\/p>\n

password = \u6b64\u5904\u4e3aLDAP root\u7684\u5bc6\u7801 <\/p>\n

basedn = “ou=Users,dc=verystar,dc=cn” <\/p>\n

filter = “(uid=%{%{Stripped-User-Name}:-%{User-Name}})” <\/p>\n

password_attribute = userPassword<\/font> <\/p>\n

ldap_connections_number = 5 <\/p>\n

timeout = 4 <\/p>\n

timelimit = 3 <\/p>\n

net_timeout = 1 <\/p>\n

tls { <\/p>\n

start_tls = no <\/p>\n

} <\/p>\n

dictionary_mapping = ${confdir}\/ldap.attrmap <\/p>\n

edir_account_policy_check = no <\/p>\n

keepalive { <\/p>\n

idle = 60 <\/p>\n

probes = 3 <\/p>\n

interval = 3 <\/p>\n

} <\/p>\n

} <\/p>\n

\u7ea2\u8272\u7684\u6ce8\u610f\u8981\u6dfb\u52a0\uff0c <\/p>\n

\u8fd8\u6709 \u5c31\u662f\u6dfb\u52a0\u65b0\u5c5e\u6027\u7684\u65f6\u5019 <\/p>\n

\u89e3\u51b3\u529e\u6cd5\uff1a <\/p>\n

# vi \/etc\/openldap\/schema\/inetorgperson.schema\uff0c\u5728objectclass ‘inetOrgPerson’ \u524d\u65b0\u589e\uff1a <\/p>\n

attributetype ( 1.3.6.1.4.1.3317.4.3.1.66 <\/p>\n

NAME ‘radiusUserPassword’ <\/p>\n

DESC ‘radiusUserPassword’ <\/p>\n

SUP userPassword ) <\/p>\n

\u4fee\u6539objectclass ‘inetOrgPerson’ \uff0c\u628a’radiusUserPassword’ \u4f5c\u4e3a\u53ef\u9009\u5c5e\u6027\u52a0\u5165’inetOrgPerson’ \u5bf9\u8c61\u7c7b\uff1a <\/p>\n

objectclass  ( 2.16.840.1.113730.3.2.2 <\/p>\n

NAME ‘inetOrgPerson’ <\/p>\n

DESC ‘RFC2798: Internet Organizational Person’ <\/p>\n

SUP organizationalPerson <\/p>\n

STRUCTURAL <\/p>\n

MAY ( <\/p>\n

radiusUserPassword $ audio $ businessCategory $ carLicense $ departmentNumber $ <\/p>\n

\u00b7\u00b7\u00b7\u7565\u00b7\u00b7\u00b7 <\/p>\n

) <\/p>\n

\u4fee\u6539\/etc\/raddb\/ldap.attrmap\uff0c\u6dfb\u52a0 <\/p>\n

checkItem  NT-Password  ntPassword #\u539f\u6709\u7684
checkItem  NT-Password  userPassword #\u65b0\u589e\u7684 <\/p>\n

checkItem  NT-Password  radiusUserPassword #\u65b0\u589e\u7684 <\/p>\n

\u6ce8\u610f\u987a\u5e8f\u4e0d\u80fd\u53cd\uff0c\u987a\u5e8f\u5bf9\u4e86PPTP\u548cOpenVPN\u80fd\u540c\u65f6\u5de5\u4f5c\u3002 <\/p>\n

\u4fee\u6539\/etc\/openldap\/slapd.conf <\/p>\n

database  bdb <\/p>\n

access to attrs=userPassword,radiusUserPassword <\/p>\n

by self write <\/p>\n

by * auth <\/p>\n

\u7531\u4e8eMD4\/MD5\u5bc6\u7801\u5bb9\u6613\u88ab\u5b57\u5178\u653b\u51fb\u7834\u89e3\uff0c\u56e0\u6b64\u6709\u5fc5\u8981\u4fdd\u62a4\u5bc6\u6587\u4e0d\u8ba9\u4eba\u8f7b\u6613\u83b7\u5f97\uff0c\u540c\u65f6\u5efa\u8bae\u4f7f\u7528\u590d\u6742\u5bc6\u7801\u3002 <\/p>\n

\u8fd9\u91cchttp:\/\/book.51cto.com\/art\/201204\/328699.htm\u53ef\u4ee5\u770b\u5230\u4e0d\u592a\u590d\u6742\u7684\u5bc6\u7801\u80fd\u7a77\u4e3e\u51fa\u6765\u3002 <\/p>\n

\u91cd\u542fslapd\u3002 <\/p>\n

\u901a\u8fc7phpLdapAdmin\u6dfb\u52a0\u65f6\uff0c\u4e00\u5b9a\u8981\u8bb0\u5f97\u6e05\u7f13\u5b58\uff0c\u5426\u5219\u4f1a\u4e00\u76f4\u65e0\u6cd5\u51fa\u73b0\u65b0\u5c5e\u6027\u3002 <\/p>\n

\u7531\u4e8e\u65e0\u6cd5\u6574\u54082\u4e2a\u9a8c\u8bc1\uff0c\u6240\u4ee5\u5230\u65f6\u9700\u89812\u4e2a\u5bc6\u7801\uff0c\u4e00\u4e2a\u662fMD5\u52a0\u5bc6\u7684\u7528\u6765\u5904\u7406svn\u548cgit\uff0c\u4e00\u4e2a\u662fmd4\u52a0\u5bc6\u7528\u6765\u5904\u7406pptpd\u7684\u8ba4\u8bc1\u3002<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[58,56,57,59],"class_list":["post-4198","post","type-post","status-publish","format-standard","hentry","category-5","tag-git","tag-ldap","tag-svn","tag-vpn","category-5-id","post-seq-1","post-parity-odd","meta-position-corners","fix"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=\/wp\/v2\/posts\/4198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4198"}],"version-history":[{"count":8,"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=\/wp\/v2\/posts\/4198\/revisions"}],"predecessor-version":[{"id":4230,"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=\/wp\/v2\/posts\/4198\/revisions\/4230"}],"wp:attachment":[{"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4198"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}