LDAP服务器用于统一认证账户信息，有点类似通讯录，实现集中管理用户账户的功能。系统为CentOS6.4。
安装openldap和Berkeley DB, openldap使用Berkeley DB存储数据。
1）服务端yum install openldap openldap-servers openldap-clients openldap-devel compat-openldapyum install db4 db4-utils
2）客户端yum install nss-pam-ldapd pam_ldap openldap-clients
二、服务端配置
1) 首先生成管理员密码：slappasswd输完两遍密码后会生成一个加密散列字符串，保存下来。如：
{SSHA}JiW3WU7jREOTOMZKT6CklgJZriLIj738
2)编辑数据库配置文件，设置域名：vim /etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb.ldif找到：olcSuffix: dc=my-domain,dc=com修改dc：olcSuffix: dc=ldap,dc=stone,dc=com设置目录树后缀（域名），作用是定义根的名字。
找到：olcRootDN: cn=Manager,dc=my-domain,dc=com修改dc：olcRootDN: cn= Manager,dc=ldap, dc=stone,dc=com设置管理员DN。PS：LDAP管理员cn默认为Manager，可以改成自己需要的名字。
在olcDatabase={2}bdb.ldif最后添加：olcRootPW: {SSHA}JiW3WU7jREOTOMZKT6CklgJZriLIj738设置管理员密码。
3)指定监控权限：vim /etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif找到：dn.base=”cn=manager,dc=my-domain,dc=com”修改为：dn.base=”cn= Manager,dc=ldap,dc=stone,dc=com”修改默认域名。
4) /etc/openldap/slapd.conf
************************************
include/etc/openldap/schema/corba.schema
include/etc/openldap/schema/core.schema
include/etc/openldap/schema/cosine.schema
include/etc/openldap/schema/duaconf.schema
include/etc/openldap/schema/dyngroup.schema
include/etc/openldap/schema/inetorgperson.schema
include/etc/openldap/schema/Java.schema
include/etc/openldap/schema/misc.schema
include/etc/openldap/schema/nis.schema
include/etc/openldap/schema/openldap.schema
include/etc/openldap/schema/ppolicy.schema
include/etc/openldap/schema/collective.schema
include/etc/openldap/schema/sudo.schema
allow bind_v2
pidfile/var/run/openldap/slapd.pid
argsfile/var/run/openldap/slapd.args
TLSCACertificatePath /etc/openldap/certs
TLSCertificateFile “\”OpenLDAP Server\”"
TLSCertificateKeyFile /etc/openldap/certs/password
database config
access to *
by dn.exact=”gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth” manage
by * none
database monitor
access to *
by dn.exact=”gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth” read
by dn.exact=”cn=Manager,dc=stone,dc=com” read
by * none
databasebdb
suffix“dc=ldap,dc=stone,dc=com”
checkpoint1024 15
rootdn“cn=Manager,dc=ldap,dc=stone,dc=com”
rootpw{SSHA}hcZ+9TR6qnqjbzCK9KlJOdqkUBmi9irL
directory/var/lib/ldap
index sudoUser eq
index objectClass eq,pres
index ou,cn,mail,surname,givenname eq,pres,sub
index uidNumber,gidNumber,loginShell eq,pres
index uid,memberUid eq,pres,sub
index nisMapName,nisMapEntry eq,pres,sub
***************************************************************
5)设置Database Cache：cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG设置权限：chown -R ldap:ldap /var/lib/ldap/
从.schema生成.ldif配置
slaptest -v -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/
测试配置文件是否有错：slaptest -u提示：
config file testing succeeded
测试通过。
三、创建LDAP数据库
# ldap.stone.com
dn: dc=ldap,dc=stone,dc=com
dc: ldap
objectClass: top
objectClass: domain
# people.ldap. stone.com
dn: ou=people,dc=ldap,dc=stone,dc=com
objectClass: organizationalUnit
ou: people
# group.ldap.ciwong.com
dn: ou=group,dc=ldap,dc=ciwong,dc=com
objectClass: organizationalUnit
ou: group
# sudoers.ldap. ciwong.com
dn: ou=sudoers,dc=ldap,dc=ciwong,dc=com
objectClass: top
objectClass: organizationalUnit
description: sudo configuration subtree
ou: sudoers