Skip to content

Commit 3d03a89

Browse files
author
pptfz
committed
更新ldap笔记
1 parent ab417f5 commit 3d03a89

5 files changed

Lines changed: 333 additions & 199 deletions

File tree

‎docs/linux/linux服务/ldap/Self Service Password.md‎

Lines changed: 268 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,268 @@ $ldap_filter = "(&(objectClass=*)($ldap_login_attribute={login}))";
145145

146146
### 标准安装
147147

148+
[官方安装文档](https://self-service-password.readthedocs.io/en/latest/installation.html)
149+
150+
151+
152+
#### 安装php
153+
154+
##### 安装 [remi](https://blog.remirepo.net/pages/Config-en) 源
155+
156+
```shell
157+
yum -y install epel-release && \
158+
yum -y install https://rpms.remirepo.net/enterprise/remi-release-9.rpm
159+
```
160+
161+
162+
163+
##### 安装php7.4
164+
165+
:::tip 说明
166+
167+
self-service-password依赖的php>=7.4
168+
169+
:::
170+
171+
```sh
172+
export PHP_VERSION=php74
173+
yum -y install \
174+
${PHP_VERSION}-php-fpm \
175+
${PHP_VERSION}-php-cli \
176+
${PHP_VERSION}-php-bcmath \
177+
${PHP_VERSION}-php-gd \
178+
${PHP_VERSION}-php-json \
179+
${PHP_VERSION}-php-mbstring \
180+
${PHP_VERSION}-php-mcrypt \
181+
${PHP_VERSION}-php-mysqlnd \
182+
${PHP_VERSION}-php-opcache \
183+
${PHP_VERSION}-php-pdo \
184+
${PHP_VERSION}-php-pecl-crypto \
185+
${PHP_VERSION}-php-pecl-mcrypt \
186+
${PHP_VERSION}-php-pecl-geoip \
187+
${PHP_VERSION}-php-recode \
188+
${PHP_VERSION}-php-snmp \
189+
${PHP_VERSION}-php-soap \
190+
${PHP_VERSION}-php-xml \
191+
${PHP_VERSION}-php-ldap \
192+
${PHP_VERSION}-php-common
193+
```
194+
195+
196+
197+
##### 安装位置
198+
199+
| 类型 | 路径 | 说明 |
200+
| ------------------ | ----------------------------------------------- | ------------------------------------------------------------ |
201+
| 安装目录 | `/etc/opt/remi/php74` | PHP 安装目录 |
202+
| PHP 主程序 | `/opt/remi/php74/root/usr/bin/php` | 执行 PHP 程序用 |
203+
| 主配置文件 | `/etc/opt/remi/php74/php.ini` | 主配置文件 |
204+
| 池（Pool）配置文件 | `/etc/opt/remi/php74/php-fpm.d/www.conf` | 用于配置 php-fpm 接收请求的方式、进程管理、运行用户、监听端口/套接字等参数 |
205+
| socket文件 | `/var/opt/remi/php74/run/php-fpm/www.sock` | PHP-FPM socket文件 |
206+
| php-fpm 配置 | `/etc/opt/remi/php74/php-fpm.conf` | PHP-FPM 配置文件 |
207+
| 扩展模块 | `/opt/remi/php74/root/usr/lib64/php/modules` | 所有模块 `.so` 文件目录 |
208+
| systemd 启动 | `/usr/lib/systemd/system/php74-php-fpm.service` | 使用 `systemctl` 管理 FPM 服务 |
209+
210+
211+
212+
##### 启动php74
213+
214+
```shell
215+
systemctl enable php74-php-fpm && systemctl start php74-php-fpm
216+
```
217+
218+
219+
220+
##### 修改目录权限
221+
222+
```shell
223+
chown -R www.www /var/opt/remi/php74
224+
chown -R www.www /etc/opt/remi/php74
225+
```
226+
227+
228+
229+
##### 修改php-fpm运行用户
230+
231+
修改 `/etc/opt/remi/php74/php-fpm.d/www.conf` 中的以下几项，默认是 `apache` 用户
232+
233+
```shell
234+
user = www
235+
group = www
236+
listen.acl_users = www
237+
```
238+
239+
240+
241+
##### 修改 `/var/cache/self-service-password` 目录权限
242+
243+
:::caution 注意
244+
245+
必须将 `/var/cache/self-service-password` 目录以及目录下所有文件的权限修改为 php-fpm 的运行用户，否则访问会报错500
246+
247+
:::
248+
249+
```shell
250+
chown -R www.www /var/cache/self-service-password
251+
```
252+
253+
254+
255+
##### 重启php-fpm
256+
257+
```shell
258+
systemctl restart php74-php-fpm
259+
```
260+
261+
262+
263+
#### 添加yum源
264+
265+
```shell
266+
cat > /etc/yum.repos.d/ltb-project.repo << 'EOF'
267+
[ltb-project-noarch]
268+
name=LTB project packages (noarch)
269+
baseurl=https://ltb-project.org/rpm/$releasever/noarch
270+
enabled=1
271+
gpgcheck=1
272+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-LTB-project
273+
EOF
274+
```
275+
276+
277+
278+
#### 导入存储库密钥
279+
280+
import Tabs from '@theme/Tabs';
281+
import TabItem from '@theme/TabItem';
282+
283+
<Tabs>
284+
<TabItem value="el7/el8" label="el7/el8" default>
285+
286+
```shell
287+
rpm --import https://ltb-project.org/documentation/_static/RPM-GPG-KEY-LTB-project
288+
```
289+
290+
</TabItem>
291+
<TabItem value="el9" label="el9">
292+
293+
```shell
294+
rpm --import https://ltb-project.org/documentation/_static/RPM-GPG-KEY-LTB-PROJECT-SECURITY
295+
```
296+
297+
</TabItem>
298+
</Tabs>
299+
300+
301+
302+
#### yum安装
303+
304+
```shell
305+
yum -y install self-service-password
306+
```
307+
308+
309+
310+
##### 查看安装位置
311+
312+
```shell
313+
rpm -ql self-service-password
314+
```
315+
316+
317+
318+
| 文件类型 | 路径示例 |
319+
| ----------- | ---------------------------------------------- |
320+
| 源码目录 | `/usr/share/self-service-password/` |
321+
| 配置文件 | `/etc/self-service-password/config.inc.php` |
322+
| Apache 配置 | `/etc/httpd/conf.d/self-service-password.conf` |
323+
324+
325+
326+
#### 配置nginx
327+
328+
[webserver配置官方文档](https://self-service-password.readthedocs.io/en/latest/config_webserver.html)
329+
330+
331+
332+
:::tip 说明
333+
334+
这里依据官方的文件进行了一下修改
335+
336+
如果想要在 `access_log` 后添加 `main` 字段，则需要取消 `nginx.conf` 中 `http` 块下的 `log_format main` 的注释
337+
338+
:::
339+
340+
```nginx
341+
server {
342+
listen 80;
343+
344+
root /usr/share/self-service-password/htdocs;
345+
index index.php index.html index.htm;
346+
347+
# Make site accessible from http://localhost/
348+
server_name ssp.ops.com;
349+
350+
# Disable sendfile as per https://docs.vagrantup.com/v2/synced-folders/virtualbox.html
351+
sendfile off;
352+
353+
gzip on;
354+
gzip_comp_level 6;
355+
gzip_min_length 1000;
356+
gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript text/x-js;
357+
gzip_vary on;
358+
gzip_proxied any;
359+
gzip_disable "MSIE [1-6]\.(?!.*SV1)";
360+
361+
# Add stdout logging
362+
363+
error_log /var/log/nginx/ssp.ops.com_error.log warn;
364+
access_log /var/log/nginx/ssp.ops.com_access.log main;
365+
366+
367+
# pass the PHP scripts to FastCGI server listening on socket
368+
#
369+
location ~ \.php {
370+
fastcgi_pass unix:/var/opt/remi/php74/run/php-fpm/www.sock;
371+
fastcgi_split_path_info ^(.+\.php)(/.+)$;
372+
fastcgi_param PATH_INFO $fastcgi_path_info;
373+
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
374+
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
375+
fastcgi_index index.php;
376+
try_files $fastcgi_script_name =404;
377+
fastcgi_read_timeout 600;
378+
include fastcgi_params;
379+
}
380+
381+
error_page 404 /404.html;
382+
location = /404.html {
383+
root /usr/share/nginx/html;
384+
internal;
385+
}
386+
387+
# deny access to . files, for security
388+
#
389+
location ~ /\. {
390+
log_not_found off;
391+
deny all;
392+
}
393+
394+
location ~ /scripts {
395+
log_not_found off;
396+
deny all;
397+
}
398+
399+
}
400+
```
401+
402+
403+
404+
#### 访问
405+
406+
![iShot_2025-06-20_17.10.43](https://raw.githubusercontent.com/pptfz/picgo-images/master/img/iShot_2025-06-20_17.10.43.png)
407+
408+
409+
148410

149411

150412
### dokcer安装
@@ -181,7 +443,7 @@ docker run -d \
181443
--name self-service-password \
182444
-p 8000:80 \
183445
-v /data/docker-volume/ssp/config.inc.local.php:/var/www/conf/config.inc.local.php \
184-
docker.io/ltbproject/self-service-password:1.7.3
446+
ltbproject/self-service-password:1.7.3
185447
```
186448

187449

@@ -316,7 +578,11 @@ $show_extended_error = true;
316578

317579
## 配置邮件重置密码
318580

319-
**<span style={{color: 'red'}}>⚠️在self service password中使用邮箱重置密码功能的前提是邮箱必须是ldap中用户绑定的邮箱</span>**
581+
:::caution 注意
582+
583+
在self service password中使用邮箱重置密码功能的前提是邮箱必须是ldap中用户绑定的邮箱
584+
585+
:::
320586

321587
修改配置文件 `config.inc.local.php`
322588

‎docs/linux/linux服务/ldap/centos7安装openldap.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,60 @@ $ slappasswd -s admin
203203
204204
205205
206+
### ldap相关命令连接ldap不同方式说明
207+
208+
:::tip 说明
209+
210+
`-H ldap://` 与 `-H ldapi:///` 的对比说明
211+
212+
| 形式 | 协议类型 | 说明 | 用途场景 |
213+
| --------------------- | ------------- | ------------------------------------------------ | ------------------------------ |
214+
| `-H ldap://localhost` | TCP 明文协议 | 使用标准 TCP/IP 连接，默认端口是 389 | 本地或远程连接，适合大多数情况 |
215+
| `-H ldapi:///` | UNIX 域套接字 | 使用本地 Unix Socket 文件（如 `/var/run/ldapi`） | 本机内部通信，权限更精细更安全 |
216+
217+
:::
218+
219+
#### `-H ldap://localhost`
220+
221+
- 使用标准 **LDAP 协议**，通过 TCP 端口（通常是 389）。
222+
- 可以连接到本机或远程服务器。
223+
- 明文传输（不加密），如需加密应使用 `ldaps://` 或 StartTLS。
224+
- 通常需要用户名/密码进行身份验证。
225+
226+
示例
227+
228+
```shell
229+
ldapsearch -H ldap://localhost -D "cn=admin,dc=ops,dc=com" -w admin ...
230+
```
231+
232+
233+
234+
#### `-H ldapi:///`
235+
236+
- 使用 **本地 UNIX socket**（LDAP over IPC）。
237+
- 不需要走网络，连接速度更快、更安全。
238+
- 可以使用本地用户凭据自动认证（如 `EXTERNAL` 机制）。
239+
- 通常只允许 `root` 或 `ldap` 用户访问 socket 文件。
240+
-
241+
242+
示例（使用 EXTERNAL 本地认证）
243+
244+
```shell
245+
ldapsearch -H ldapi:/// -Y EXTERNAL -b cn=config
246+
```
247+
248+
249+
250+
#### 附加说明 `ldaps://`
251+
252+
如果希望使用 **加密的 TCP 连接**，可以使用如下方式，这是使用 SSL 加密的 LDAP 连接，默认端口是 `636`
253+
254+
```shell
255+
-H ldaps://localhost
256+
```
257+
258+
259+
206260
### 修改相关配置文件
207261
208262
#### 修改 `/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif`

‎docs/linux/linux服务/ldap/安装phpLDAPadmin管理LDAP.md‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -512,12 +512,14 @@ RUN apt-get update \
512512

513513

514514
```dockerfile
515-
cat > Dockerfile << EOF
516515
FROM osixia/web-baseimage:release-1.2.0-dev
517516

518517
# phpLDAPadmin version
519518
ARG PHPLDAPADMIN_VERSION=1.2.5
520519

520+
521+
RUN sed -i '/nginx.org/d' /etc/apt/sources.list /etc/apt/sources.list.d/*.list 2>/dev/null || true
522+
521523
# Add multiple process stack to supervise apache2 and php7.3-fpm
522524
# sources: https://github.com/osixia/docker-light-baseimage/blob/stable/image/tool/add-multiple-process-stack
523525
# https://github.com/osixia/docker-light-baseimage/blob/stable/image/tool/add-service-available
@@ -527,12 +529,10 @@ ARG PHPLDAPADMIN_VERSION=1.2.5
527529
# Install ca-certificates, curl and php dependencies
528530
# Download phpLDAPadmin, check file integrity, and unzip phpLDAPadmin to /var/www/phpldapadmin_bootstrap
529531
# Remove curl
530-
RUN sed -i '/nginx.org/d' /etc/apt/sources.list /etc/apt/sources.list.d/*.list 2>/dev/null || true
531-
532532
RUN apt-get update \
533+
&& /container/tool/add-multiple-process-stack \
533534
&& sed -i 's/# zh_CN.UTF-8 UTF-8/zh_CN.UTF-8 UTF-8/' /etc/locale.gen \
534535
&& locale-gen \
535-
&& /container/tool/add-multiple-process-stack \
536536
&& /container/tool/add-service-available :apache2 :php7.3-fpm :ssl-tools \
537537
&& LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
538538
ca-certificates \
@@ -563,7 +563,6 @@ VOLUME ["/var/www/phpldapadmin"]
563563

564564
# Expose http and https default ports
565565
EXPOSE 80 443
566-
EOF
567566
```
568567

569568

0 commit comments

Comments
 (0)