基本概念
LDAP是以樹方式組織的數(shù)據(jù)庫(kù)。每個(gè)節(jié)點(diǎn)可以有什么值是通過(guò)類來(lái)定義。
LINUX或者其它應(yīng)用的認(rèn)證就是來(lái)BIND LDAP樹上的節(jié)點(diǎn)，如果能夠BIND，就算認(rèn)證成功。
要改變LINUX認(rèn)證方式，需要讓名字服務(wù)NSCD能夠到LDAP查找用戶，這需要nss_ldap.so。
得到用戶后，再到LDAP去認(rèn)證，這需要pam_ldap.so實(shí)現(xiàn)。

公私鑰：公鑰可以唯一解密私鑰加密過(guò)的數(shù)據(jù)，反之亦然。
SSL過(guò)程：需要兩對(duì)公私鑰(P1,V1),(P2,V2)，假設(shè)通信雙方是A和B，B是服務(wù)器，A要確認(rèn)和它通信的是B：
A->B: hello
B->A: 用V2加密過(guò)的P1（即用戶證書，A就用P2解密出P1）
A->B: ok
B->A: 用V1加密的一段信息
A->B: 用P1加密一個(gè)自動(dòng)生成的K（用之前的P1解密成功這段信息則認(rèn)為B是可信的了）
B->A: 用K加密的數(shù)據(jù)（之后兩對(duì)密鑰功能結(jié)束，由K來(lái)加解密數(shù)據(jù)）
這里，P2就是第3方的CA證書，由于非對(duì)稱加密很慢，所以公私鑰只是用來(lái)保證K的傳送安全，之后通信是用K的對(duì)稱加密算法來(lái)保證。


需要安裝的組件
Berkeley DB 4.2.52 or later - http://www.sleepycat.com/（僅服務(wù)端）
NSS_LDAP 2.2.X or PAM_LDAP 1.6.X or later – http://www.padl.com/（僅客戶端）
OpenSSL 0.9.7e or later – http://www.openssl.org/

OpenLDAP 2.3.XX or later - http://www.openldap.org/（僅服務(wù)端）

#?cd?openldap- 2.3 .XX
#?./configure?--prefix = /usr?--sysconfdir = /etc?--libexecdir = /usr/sbin?--mandir = /usr/share/man?--enable-bdb?--enable-crypt?--with-tls?--without-cyrus-sasl?--enable-ldbm
#?make?depend
#?make?clean
#?make
#?make?install

OpenSSH: http://www.openssh.org/

#?cd?/var/tmp
#?tar?xvf?openssh- 3 .X.XpX.tar
#?cd?openssh- 3 .X.XpX
#?./configure?--prefix = /usr?--with-pam?--sysconfdir = /etc/ssh?--with-ssl-dir = /usr

需要修改的文件
服務(wù)器端：
/etc/openldap/slapd.conf

include???/etc/openldap/schema/core.schema
include???/etc/openldap/schema/cosine.schema
include???/etc/openldap/schema/inetorgperson.schema
include???/etc/openldap/schema/nis.schema


loglevel?- 1

access?to?attrs = shadowLastChange , userPassword
??????by?self?write
??????by?*?auth

access?to?*
??????by?*?read

TLSCipherSuite??HIGH:MEDIUM:+SSLv2
TLSCACertificateFile?/etc/openldap/cacert.pem
TLSCertificateFile?/etc/openldap/slapd-cert-ldap1.pem
TLSCertificateKeyFile?/etc/openldap/slapd-key-ldap1.pem

TLSVerifyClient?never?

database????bdb
suffix???????? " dc=example,dc=com "
rootdn???????? " cn=Manager,dc=example,dc=com "
rootpw????????secret
directory???????????????/var/lib/ldap
index????objectClass????eq

客戶端：
/etc/ldap.conf

host?ldap1.example.com
base?dc = example , dc = com
ssl?start_tls
tls_cacertfile?/tmp/cacert.pem

??????/etc/pam.d/system-auth

auth????????required??????/lib/security/$ISA/pam_env.so
auth????????sufficient????/lib/security/$ISA/pam_unix.so?likeauth?nullok
auth????????sufficient????/lib/security/$ISA/pam_ldap.so?use_first_pass
auth????????required??????/lib/security/$ISA/pam_deny.so

account?????sufficient?/lib/security/$ISA/pam_ldap.so
account?????required??????/lib/security/$ISA/pam_unix.so?broken_shadow

password????required??????/lib/security/$ISA/pam_cracklib.so?retry = 3 ?type =
password????sufficient????/lib/security/$ISA/pam_unix.so?nullok?use_authtok?md5?shadow
password????required??????/lib/security/$ISA/pam_deny.so

session?????required??????/lib/security/$ISA/pam_limits.so
session?????required??????/lib/security/$ISA/pam_unix.so

/etc/sysconfig/authconfig

USEDB = no
USEHESIOD = no
USELDAP = yes
USENIS = no
USEKERBEROS = no
USELDAPAUTH = yes
USEMD5 = yes
USESHADOW = yes
USESMBAUTH = no

/etc/nsswitch.conf

passwd:?????files?ldap
shadow:?????files
group:??????files?ldap

hosts:??????files?dns

bootparams:?nisplus? [ NOTFOUND=return ] ?files

ethers:?????files
netmasks:???files
networks:???files
protocols:??files?ldap
rpc:????????files
services:???files?ldap

netgroup:???files?ldap

publickey:??nisplus

automount:??files?ldap
aliases:????files?nisplus

/etc/hosts

127.0.0.1 ???????MD_Mother_HDA?localhost
10.56.28.33 ?????ldap1.example.com

/etc/ssh/sshd_config

PasswordAuthentication?yes

ChallengeResponseAuthentication?yes

UsePAM?yes

Subsystem???????sftp????/usr/libexec/sftp-server

需要重啟的服務(wù)
service nscd restart???????
service sshd restart

另外，這個(gè)文件是LDAP命令使用的，不是系統(tǒng)認(rèn)證所需：
/etc/openldap/ldap.conf

開始的時(shí)候可以不要SSL認(rèn)證，只需要注釋掉ldap.conf中start_tls一句即可。另外，SSL要求驗(yàn)證服務(wù)器，所以一定要在/etc/hosts文件里加入服務(wù)器完整名字，并與SSL證書中一致。