理解与应用LDAP服务器

由 stanlogin 在 05-31-2003 12:43 发表:

理解与应用LDAP服务器

(前段时间一直在做LDAP+POSTFIX相关项目,先把关于LDAP的一些经验写出来,一来可能会帮助一些人,二来对我自己所学知识也是一个巩固。)

先声明:我写的只是我对LDAP的一些理解,如果我的理解错误,那就是对兄弟们的误导。所以你可以直接看文章的结尾提供的几个网址。

关于LDAP的概念随便网上有很多,我不想重复,这里只是说一下我自己的理解。

都说它是“轻量级目录协议”,太专业,我不懂,我只把它想象成“简单”的目录协议。

几个很重要的概念,以后会用到:

---------------------------------------------

dn :一条记录的位置

dc :一条记录所属区域

ou :一条记录所属组织

cn/uid:一条记录的名字/ID

---------------------------------------------

实际上更多时候我只把它看成数据库。我把它和我非常熟悉的MYSQL数据库做比较,通常会得到更好的理解:

MYSQL用“表”储存数据,LDAP用“树”

MYSQL指定一条记录要3个条件:DB、TABLE、ROW。

LDAP却更自由,为什么呢?因为LDAP数据是“树”状的,而且这棵树是可以无限延伸的,假设你要树上的一个苹果(一条记录),你怎么告诉园丁它的位置呢?当然首先要说明是哪一棵树(dc,相当于MYSQL的DB),然后是从树根到那个苹果所经过的所有“分叉”(ou,呵呵MYSQL里面好象没有这DD),最后就是这个苹果的名字(uid,记得我们设计MYSQL或其它数据库表时,通常为了方便管理而加上一个‘id’字段吗?)。 好了!这时我们可以清晰的指明这个苹果的位置了,就是那棵“歪脖树”的东边那个分叉上的靠西边那个分叉的再靠北边的分叉上的半红半绿的……,晕了!你直接爬上去吧!我还是说说LDAP里要怎么定义一个字段的位置吧,树(dc=waibo,dc=com),分叉(ou=bei,ou=xi,ou=dong),苹果(cn=honglv),好了!位置出来了:

dn:cn=honglv,ou=bei,ou=xi,ou=dong,dc=waibo,dc=com

一个有名的画家说过:“世上没有相同的2个鸡蛋”。当然也没有相同的2个苹果……,同样,在LDAP里也不可能存在2个相同的dn。

LDAP数据填充原理:

一棵树的生长,要循序渐进,如果还没有长出某个分叉,就不可能在那个分叉里长出苹果(问:FT!苹果是长在分叉上的吗?答:为了便于理解,你就当它是吧),同样,LDAP数据库也要一步步的充实,举一个学校数据库的例子,我们将要把一个庞大的学生档案放到LDAP里,大致需要这么做:

---------------------------------------------

1、建立“树根”,这是通过修改“slapd.conf”来实现的,由于现在的目的是理解,所以具体步骤就不说了,反正就是在这一步建立了一个“dc=ourschool,dc=org”这样一个“树根”。 注意:我把它理解成“目录”,或者“容器”,甚至它本身也是文件(苹果)的特殊形式,熟悉LINUX文件系统的朋友会更容易理解。

2、建立18个系,分别是“dn:ou=computer,dc=ourschool,dc=org”、“dn:ou=film,dc=ourschool,dc=org”……

3、当然是在每个系里面建立专业,比如“dn:ou=linux,ou=computer,dc=ourschool,dc=org”……

4、(开始长苹果吧!)加学生喽——“dn:cn=stan,ou=linux,ou=computer,dc=ourschool,dc=org”……

5、已经完成了吗?对了!学生的详细信息还没有呐!不过先这样吧,反正记录是可以编辑的。

---------------------------------------------

LDAP记录的详细信息

dn:cn=stan,ou=linux,ou=computer,dc=ourschool,dc=org

objectClass:organizationalPerson

cn:stan

cn:小刀

sn:小刀

description:a good boy

(以上是一条记录的信息,如果把他保存成LDIF文件,可以导入到LDAP数据库中)

上面不是说没有学生详细信息吗?怕你着急,就马上写出来了,只是还没有导入到LDAP里,那是以后的事。这里我先就你可能会产生的疑问做回答。

---------------------------------------------

Q1:“cn”不是在“dn”里定义了吗,怎么又在后面重新定义了? 答:你要把“cn=stan,ou=linux,ou=computer,dc=ourschool,dc=org”看成是一个整体,它只是属性dn的值。

Q2:怎么后面有2个“cn”,我以哪个为准? 答:区别于普通数据库,LDAP每个属性一般可以具有多个值,这样不好吗?你在学校数据库里找我的时候,只要记得我的一个cn就可以了,用“cn=stan”或“cn=小刀”都可以找到我!

Q3:就这些属性了吗?我都不知道你是男是女。 答:先声明,偶是男地。 LDAP对记录的属性做了严格的限制(这一点我不太喜欢),也就是说,你可以用哪些属性,哪些属性不能为空,哪些属性最多只能有一个值等,他们都给你规定好了。 幸好你有选择的权利,比如这次我们是储存学生信息,那么我们就定义一个“objectClass:organizationalPerson”,这样“organizationalPerson”这个类所规定的所有属性我们都可以用了,而且确实很适合我们。 虽然这个类中没有“sex”这个属性,不过你完全可以用一个“空闲”的属性来顶替。 如果我们能自己建立“类”就更好了,但目前我还没有时间去研究这个东西,我也期望高手指点啊 :)

---------------------------------------------

好了!看到我贴的图了吗?那是我偷别人的,差不多能用我就不自己画了 :)

##############################################################

关于安装配置LDAP,使之储存系统用户,这里有一个非常好的网址,如果你的英文不是很差,都应该做的来,我偷个懒,就先不写这方面的东西喽:

http://www.mandrakesecure.net/en/docs/ldap-auth.php

上面的方法我已经试过,是可行的,如果兄弟们配置的时候出现问题我们可以讨论讨论。

关于LDAP+POSTFIX,POSTFIX里的“LDAP_README”中介绍的很详细,我再说就是重复了。

##############################################################

其它相关资源:

yala (很实用的数据库操作工具,简单的说,他就是MYSQL的phpmyadmin,自己找下载地址吧~)

http://www.openldap.org/ (说实话,我一直没用上它,不过它是官方网站,不提也不好)

http://ldap.akbkhome.com/ (什么‘类’下面有什么‘属性’,在这里找)


由 stanlogin 在 05-31-2003 12:44 发表:

LDAP_README

LDAP SUPPORT IN POSTFIX

=======================

Postfix can use an LDAP directory as a source for any of its lookups:

aliases, virtual, canonical, etc. This allows you to keep information

for your mail service in a replicated network database with fine-grained

access controls. By not storing it locally on the mail server, the

administrators can maintain it from anywhere, and the users can control

whatever bits of it you think appropriate. You can have multiple mail

servers using the same information, without the hassle and delay of

having to copy it to each.

BUILDING WITH LDAP SUPPORT

==========================

Note: Postfix no longer supports the LDAP version 1 interface.

You need to have LDAP libraries and include files installed somewhere

on your system, and you need to configure the Postfix Makefiles

accordingly.

For example, to build the OpenLDAP libraries for use with Postfix

(i.e. LDAP client code only), you could use the following command:

% ./configure --without-kerberos --without-cyrus-sasl --without-tls \

--without-threads --disable-slapd --disable-slurpd \

--disable-debug --disable-shared

If you're using the libraries from the UM distribution

( http://www.umich.edu/~dirsvcs/ldap/ldap.html ) or OpenLDAP

( http://www.openldap.org ), something like this in the top level of your

Postfix source tree should work:

% make tidy

% make makefiles CCARGS="-I/usr/local/include -DHAS_LDAP" \

AUXLIBS="-L/usr/local/lib -lldap -L/usr/local/lib -llber"

On Solaris 2.x you may have to specify run-time link information,

otherwise ld.so will not find some of the shared libraries:

% make tidy

% make makefiles CCARGS="-I/usr/local/include -DHAS_LDAP" \

AUXLIBS="-L/usr/local/lib -R/usr/local/lib -lldap \

-L/usr/local/lib -R/usr/local/lib -llber"

The 'make tidy' command is needed only if you have previously built

Postfix without LDAP support.

Instead of '/usr/local' specify the actual locations of your LDAP

include files and libraries. Be sure to not mix LDAP include files

and LDAP libraries of different versions!!

If your LDAP libraries were built with Kerberos support, you'll also

need to include your Kerberos libraries in this line. Note that the KTH

Kerberos IV libraries might conflict with Postfix's lib/libdns.a, which

defines dns_lookup. If that happens, you'll probably want to link with

LDAP libraries that lack Kerberos support just to build Postfix, as it

doesn't support Kerberos binds to the LDAP server anyway. Sorry about

the bother.

If you're using one of the Netscape LDAP SDKs, you'll need to change the

AUXLIBS line to point to libldap10.so or libldapssl30.so or whatever you

have, and you may need to use the appropriate linker option (e.g. '-R')

so the executables can find it at runtime.

CONFIGURING LDAP LOOKUPS

========================

In order to use LDAP lookups, define at least one LDAP source as a table

lookup in main.cf, for example:

alias_maps = hash:/etc/aliases, ldap:ldapsource

Each LDAP source can have the following parameters, which should be

prefixed in main.cf with the name you've given the source in its

definition and an underscore. To continue the example, the first

parameter below, "server_host", would be defined in main.cf as

"ldapsource_server_host". Defaults are given in parentheses:

server_host (localhost)

The name of the host running the LDAP server, e.g.

ldapsource_server_host = ldap.your.com

It should be possible with all the libraries mentioned above to

specify multiple servers separated by spaces, with the libraries

trying them in order should the first one fail. It should also

be possible to give each server in the list a different port, by

naming them like "ldap.your.com:1444".

server_port (389)

The port the LDAP server listens on, e.g.

ldapsource_server_port = 778

search_base (No default; you must configure this.)

The base at which to conduct the search, e.g.

ldapsource_search_base = dc=your, dc=com

timeout (10 seconds)

The number of seconds a search can take before timing out, e.g.

ldapsource_timeout = 5

query_filter (mailacceptinggeneralid=%s)

The RFC2254 filter used to search the directory, where %s is a

substitute for the address Postfix is trying to resolve, e.g.

ldapsource_query_filter = (&(mail=%s)(paid_up=true))

result_filter (%s)

Filter applied to result attributes. Supports the same expansions

as the query_filter, and can be easily used to append (or prepend)

text.

domain (Default is to ignore this.)

This is a list of domain names, paths to files, or dictionaries.

If specified, only lookups for the domains on this list will be

performed. This means that the LDAP map won't get searched for

'user', nor will it get searched for any domain not listed. This

can significantly reduce the query load on the LDAP server.

ldapsource_domain = postfix.org, hash:/etc/postfix/searchdomains

result_attribute (maildrop)

The attribute(s) Postfix will read from any directory entries

returned by the lookup, to be resolved to an email address.

ldapsource_result_attribute = mailbox,maildrop

special_result_attribute (No default)

The attribute(s) of directory entries that can contain DNs or URLs.

If found, a recursive subsequent search is done using their values.

ldapsource_special_result_attribute = member

scope (sub)

The LDAP search scope: sub, base, or one. These translate into

LDAP_SCOPE_SUBTREE, LDAP_SCOPE_BASE, and LDAP_SCOPE_ONELEVEL.

bind (yes)

Whether or not to bind to the LDAP server. Newer LDAP

implementations don't require clients to bind, which saves

time. Example:

ldapsource_bind = no

If you do need to bind, you might consider configuring Postfix

to connect to the local machine on a port that's an SSL tunnel

to your LDAP server. If your LDAP server doesn't natively

support SSL, put a tunnel (wrapper, proxy, whatever you want to

call it) on that system too. This should prevent the password

from traversing the network in the clear.

bind_dn ("")

If you do have to bind, do it with this distinguished name.

Example:

ldapsource_bind_dn = uid=postfix, dc=your, dc=com

bind_pw ("")

The password for the distinguished name above. If you have to

use this, you probably want to make main.cf readable only by

the Postfix user. Example:

ldapsource_bind_pw = postfixpw

cache (no)

Whether to use a client-side cache for the LDAP connection. See

ldap_enable_cache(3). It's off by default.

cache_expiry (30 seconds)

If the client-side cache is enabled, cached results will expire

after this many seconds.

cache_size (32768 bytes)

If the client-side cache is enabled, this is its size in bytes.

dereference (0)

When to dereference LDAP aliases. (Note that this has nothing

do with Postfix aliases.) The permitted values are those

legal for the OpenLDAP/UM LDAP implementations:

0 never

1 when searching

2 when locating the base object for the search

3 always

See ldap.h or the ldap_open(3) or ldapsearch(1) man pages for

more information. And if you're using an LDAP package that has

other possible values, please bring it to the attention of the

[email protected] mailing list.

chase_referrals (0)

Sets (or clears) LDAP_OPT_REFERRALS (requires LDAP version 3

support.

version (2)

Specifies the LDAP protocol version to use.

debuglevel (0)

What level to set for debugging in the OpenLDAP libraries.

Don't use quotes in these variables; at least, not until the Postfix

configuration routines understand how to deal with quoted strings.

EXAMPLES

========

ALIASES

-------

Here's a basic example for using LDAP to look up aliases. Assume that in

main.cf, you have these configuration parameters defined:

alias_maps = hash:/etc/aliases, ldap:ldapsource

ldapsource_server_host = ldap.my.com

ldapsource_search_base = dc=my, dc=com

Upon receiving mail for a local address "ldapuser" that isn't found in

the /etc/aliases database, Postfix will search the LDAP server listening

at port 389 on ldap.my.com. It will bind anonymously, search for any

directory entries whose mailacceptinggeneralid attribute is "ldapuser",

read the "maildrop" attributes of those found, and build a list of their

maildrops, which will be treated as RFC822 addresses to which the

message will be delivered.

VIRTUAL DOMAINS/ADDRESSES

-------------------------

If you want to keep information for virtual lookups in your directory,

it's only a little more complicated. First you need to make sure Postfix

knows about the virtual domain. An easy way to do that is to add the

domain to the mailacceptinggeneralid attribute of some entry in the

directory. Next you'll want to make sure all of your virtual recipients'

mailacceptinggeneralid attributes are fully qualified with their virtual

domains. Finally, if you want to designate a directory entry as the

default user for a virtual domain, just give it an additional

mailacceptinggeneralid (or the equivalent in your directory) of

"@virtual.dom". That's right, no user part. If you don't want a catchall

user, omit this step and mail to unknown users in the domain will simply

bounce.

If you're using a version of Postfix newer than 19991226, that should do

it. If not, you also need to add your virtual domains to relay_domains.

Simply add "$virtual_maps" to your relay_domains line. Then you can use

the same map you use to find virtual recipients to determine if a domain

is a valid virtual domain and should be allowed to relay.

In summary, you might have a catchall user for a virtual domain that

looks like this:

dn: cn=defaultrecipient, dc=fake, dc=dom

objectclass: top

objectclass: virtualaccount

cn: defaultrecipient

owner: uid=root, dc=someserver, dc=isp, dc=dom

1 -> mailacceptinggeneralid: fake.dom

2 -> mailacceptinggeneralid: @fake.dom

3 -> maildrop: [email protected]

1: Postfix knows fake.dom is a valid virtual domain when it looks for

this and gets something (the maildrop) back.

2: This causes any mail for unknown users in fake.dom to go to this entry ...

3: ... and then to its maildrop.

Normal users might simply have one mailacceptinggeneralid and maildrop,

e.g. "[email protected]" and "[email protected]".

OTHER USES

----------

Other common uses for LDAP lookups include rewriting senders and

recipients with Postfix' canonical lookups, for example in order to make

mail leaving your site appear to be coming from "[email protected]"

instead of "[email protected]".

NOTES AND THINGS TO THINK ABOUT

===============================

- The bits of schema and attribute names used in this document are just

examples. There's nothing special about them, other than that some are

the defaults in the LDAP configuration parameters. You can use

whatever schema you like, and configure Postfix accordingly.

- You probably want to make sure that mailacceptinggeneralids are

unique, and that not just anyone can specify theirs as postmaster or

root, say.

- An entry can have an arbitrary number of mailacceptinggeneralids or

maildrops. Maildrops can also be comma-separated lists of addresses.

They will all be found and returned by the lookups. For example, you

could define an entry intended for use as a mailing list that looks

like this (Warning! Schema made up just for this example):

dn: cn=Accounting Staff List, dc=my, dc=com

cn: Accounting Staff List

o: my.com

objectclass: maillist

mailacceptinggeneralid: accountingstaff

mailacceptinggeneralid: accounting-staff

maildrop: mylist-owner

maildrop: an-accountant

maildrop: some-other-accountant

maildrop: this, that, theother

- If you use an LDAP map for lookups other than aliases, you may have to

Published At
Categories with 服务器类
Tagged with
comments powered by Disqus