티스토리 뷰

OpenLDAP 사용자 계정 추가

 

LDAP 서버에 사용자 계정을 추가합니다.




1. 개별 사용자를 추가합니다.


# generate encrypted password

[root@cent7 ~]# slappasswd 

New password:

Re-enter new password:

{SSHA}xxxxxxxxxxxxxxxxx


[root@cent7 ~]# vi ldapuser.ldif

# 새로 만들기 

# dc = *** dc = ***는 자신의 도메인 이름으로 대체 

# (다음은 도메인 이름 "srv.world"의 경우의 예)

 dn: uid=cent,ou=People,dc=srv,dc=world

objectClass: inetOrgPerson

objectClass: posixAccount

objectClass: shadowAccount

cn: Cent

sn: Linux

userPassword: {SSHA}xxxxxxxxxxxxxxxxx

loginShell: /bin/bash

uidNumber: 1000

gidNumber: 1000

homeDirectory: /home/cent


dn: cn=cent,ou=Group,dc=srv,dc=world

objectClass: posixGroup

cn: Cent

gidNumber: 1000

memberUid: cent


[root@cent7 ~]# ldapadd -x -D cn=Manager,dc=srv,dc=world -W -f ldapuser.ldif 

Enter LDAP Password:

adding new entry "uid=cent,ou=People,dc=srv,dc=world"


adding new entry "cn=cent,ou=Group,dc=srv,dc=world"




2. 로컬 passwd / group에 등록되어있는 사용자 / 그룹을 LDAP 디렉토리에 일괄 등록합니다.


[root@cent7 ~]# vi ldapuser.sh

# 로컬 UID 번호가 1000-9999 사용자와 그들이 속한 그룹을 추출 

# SUFFIX = ***는 자신의 도메인 이름으로 대체 

# 일례이므로 자유롭게 수정 해주세요

 #!/bin/bash


SUFFIX='dc=srv,dc=world'

LDIF='ldapuser.ldif'


echo -n > $LDIF

GROUP_IDS=()

grep "x:[1-9][0-9][0-9][0-9]:" /etc/passwd | (while read TARGET_USER

do

    USER_ID="$(echo "$TARGET_USER" | cut -d':' -f1)"


    USER_NAME="$(echo "$TARGET_USER" | cut -d':' -f5 | cut -d' ' -f1,2)"

    [ ! "$USER_NAME" ] && USER_NAME="$USER_ID"


    LDAP_SN="$(echo "$USER_NAME" | cut -d' ' -f2)"

    [ ! "$LDAP_SN" ] && LDAP_SN="$USER_NAME"


    LASTCHANGE_FLAG="$(grep "${USER_ID}:" /etc/shadow | cut -d':' -f3)"

    [ ! "$LASTCHANGE_FLAG" ] && LASTCHANGE_FLAG="0"


    SHADOW_FLAG="$(grep "${USER_ID}:" /etc/shadow | cut -d':' -f9)"

    [ ! "$SHADOW_FLAG" ] && SHADOW_FLAG="0"


    GROUP_ID="$(echo "$TARGET_USER" | cut -d':' -f4)"

    [ ! "$(echo "${GROUP_IDS[@]}" | grep "$GROUP_ID")" ] && GROUP_IDS=("${GROUP_IDS[@]}" "$GROUP_ID")


    echo "dn: uid=$USER_ID,ou=People,$SUFFIX" >> $LDIF

    echo "objectClass: inetOrgPerson" >> $LDIF

    echo "objectClass: posixAccount" >> $LDIF

    echo "objectClass: shadowAccount" >> $LDIF

    echo "sn: $LDAP_SN" >> $LDIF

    echo "givenName: $(echo "$USER_NAME" | awk '{print $1}')" >> $LDIF

    echo "cn: $USER_NAME" >> $LDIF

    echo "displayName: $USER_NAME" >> $LDIF

    echo "uidNumber: $(echo "$TARGET_USER" | cut -d':' -f3)" >> $LDIF

    echo "gidNumber: $(echo "$TARGET_USER" | cut -d':' -f4)" >> $LDIF

    echo "userPassword: {crypt}$(grep "${USER_ID}:" /etc/shadow | cut -d':' -f2)" >> $LDIF

    echo "gecos: $USER_NAME" >> $LDIF

    echo "loginShell: $(echo "$TARGET_USER" | cut -d':' -f7)" >> $LDIF

    echo "homeDirectory: $(echo "$TARGET_USER" | cut -d':' -f6)" >> $LDIF

    echo "shadowExpire: $(passwd -S "$USER_ID" | awk '{print $7}')" >> $LDIF

    echo "shadowFlag: $SHADOW_FLAG" >> $LDIF

    echo "shadowWarning: $(passwd -S "$USER_ID" | awk '{print $6}')" >> $LDIF

    echo "shadowMin: $(passwd -S "$USER_ID" | awk '{print $4}')" >> $LDIF

    echo "shadowMax: $(passwd -S "$USER_ID" | awk '{print $5}')" >> $LDIF

    echo "shadowLastChange: $LASTCHANGE_FLAG" >> $LDIF

    echo >> $LDIF

done


for TARGET_GROUP_ID in "${GROUP_IDS[@]}"

do

    LDAP_CN="$(grep ":${TARGET_GROUP_ID}:" /etc/group | cut -d':' -f1)"


    echo "dn: cn=$LDAP_CN,ou=Group,$SUFFIX" >> $LDIF

    echo "objectClass: posixGroup" >> $LDIF

    echo "cn: $LDAP_CN" >> $LDIF

    echo "gidNumber: $TARGET_GROUP_ID" >> $LDIF


    for MEMBER_UID in $(grep ":${TARGET_GROUP_ID}:" /etc/passwd | cut -d':' -f1,3)

    do

        UID_NUM=$(echo "$MEMBER_UID" | cut -d':' -f2)

        [ $UID_NUM -ge 1000 -a $UID_NUM -le 9999 ] && echo "memberUid: $(echo "$MEMBER_UID" | cut -d':' -f1)" >> $LDIF

    done

    echo >> $LDIF

done

)


[root@cent7 ~]# sh ldapuser.sh 


[root@cent7 ~]# ldapadd -x -D cn=Manager,dc=srv,dc=world -W -f ldapuser.ldif 

Enter LDAP Password:

adding new entry "uid=cent,ou=People,dc=srv,dc=world"

adding new entry "uid=redhat,ou=People,dc=srv,dc=world"

adding new entry "uid=ubuntu,ou=People,dc=srv,dc=world"

adding new entry "uid=debian,ou=People,dc=srv,dc=world"

adding new entry "cn=cent,ou=Group,dc=srv,dc=world"

adding new entry "cn=redhat,ou=Group,dc=srv,dc=world"

adding new entry "cn=ubuntu,ou=Group,dc=srv,dc=world"

adding new entry "cn=debian,ou=Group,dc=srv,dc=world"




3. 등록 된 사용자 및 그룹을 삭제하려면 다음과 같이합니다.


[root@cent7 ~]# ldapdelete -x -W -D 'cn=Manager,dc=srv,dc=world' "uid=cent,ou=People,dc=srv,dc=world" 

Enter LDAP Password:


[root@cent7 ~]# ldapdelete -x -W -D 'cn=Manager,dc=srv,dc=world' "cn=cent,ou=Group,dc=srv,dc=world" 

Enter LDAP Password:


※ download & Next Menu



저작자 표시 비영리 변경 금지
신고
댓글