ubuntu-client-ldap
apt-get install libpam-ldap libnss-ldap sudo-ldap可以参考下这个地址：http://wiki.ubuntu.org.cn/LDAPClientAuthentication
###安装时会提示ldap地址，dc和密码等等###
在安装时，您将询问下列问题：
The address of the LDAP server used. You can also use a fully qualified domain name here. For example: ldap.example.com
所用 LDAP 服务器地址 在这里您也可以使用完整的域名。如ldap.example.com
The distinguished name of the search base. For example dc=example,dc=com
搜索所基的标识名。如dc=example,dc=com
The LDAP version to use. You usually would choose 3 here.
所用 LDAP 版本 在这您通常可以选 3。
If your database requires logging in. You would usually choose no here.
您的数据库是否要求登录 这里您通常可以选 no。
If you want to make configuration readable/writeable by owner only. A no should be the answer to this.
您是否只想为自己配置可读／可写权限 这里应该回答 no
A Dialog is displayed explaining it cannot manage nsswitch.conf automatically. Just select OK.
显示的对话框说明它不能自动管理 nsswitch.conf。只需选择 OK。
If you want the local root to be the database admin. You would usually choose yes here.
您是否想让本地根用户成为数据库管理员 这里通常选 yes
Again If your database requires logging in. You would usually choose no here.
再次询问您的数据库是否要求登录 这里您将选择 no
Your root login account. For example: cn=manager,dc=example,dc=com
'''' 您的根用户登录帐号 如：cn=manager,dc=example,dc=com
Your root password.
您的根用户密码
**如果ldap密码更改了，在 vim /etc/ldap.secret 文件里更改***
vim /etc/pam.d/common-auth
追加
auth sufficient pam_ldap.so
auth required pam_unix.so nullok_secure use_first_pass
vim /etc/pam.d/common-account
追加
account sufficient pam_ldap.so
account required pam_unix.so
vim /etc/pam.d/common-password
追加
password sufficient pam_ldap.so
password required pam_unix.so nullok obscure min=4 max=8 md5
vim /etc/pam.d/common-session
追加
session required pam_unix.so
session required pam_mkhomedir.so skel=/etc/skel/ umask=0077
session optional pam_ldap.so
cat /etc/nsswitch.conf
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.
Sudoers: files ldap
passwd: files ldap
group: files ldap
shadow: files ldap
hosts: files dns
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis
测试
#getent passwd testuser(ldap server端用户)
如有返回证明成功
cat /etc/ldap/ldap.conf
BASE dc=jumpserver,dc=org
URI ldap://172.26.1.161:389#ldap-server 地址
TLS_REQCERT allow
TIMELIMIT 2
TLS_CACERT /etc/ssl/certs/ca-certificates.crt
Sudoers_base ou=Sudoers,dc=jumpserver,dc=org
页:
[1]