Centos Openldap服务器数据库主备（二）

二、 Openldap服务器明文主备配置
2.1 服务器架设
Configure OpenLDAP Replication to continue Directory service if OpenLDAP master server would be down. OpenLDAP master server is called "Provider" and OpenLDAP Slave server is called "Consumer" on OpenLDAP.
Configure Basic LDAP Server settings on both Provider and Consumer.
2.2 主服务器设置
Configure LDAP Provider. Add syncprov module
[root@dlp ~]# vim mod_syncprov.ldif
# create new

dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulePath: /usr/lib64/openldap
olcModuleLoad: syncprov.la
[root@dlp ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f mod_syncprov.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=module,cn=config"
[root@dlp ~]# vim syncprov.ldif
# create new

dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
olcSpSessionLog: 100
[root@dlp ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f syncprov.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "olcOverlay=syncprov,olcDatabase={2}hdb,cn=config"
2.3 备份服务器设置
Configure LDAP Consumer.
[root@slave ~]# vim syncrepl.ldif
# create new

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcSyncRepl
olcSyncRepl: rid=001 provider=ldap://10.8.8.46:389/ bindmethod=simple binddn="cn=Manager,dc=server,dc=world" credentials=dc168 searchbase="dc=server,dc=world" scope=sub schemachecking=on type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00
[root@slave ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f syncrepl.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={2}hdb,cn=config"
confirm settings to search datas
[root@slave ~]# ldapsearch -x -b ‘ou=People,dc=server,dc=world‘
# People, server.world
dn: ou=People,dc=server,dc=world
objectClass: organizationalUnit
ou: People
...
...
三、 基于Tls的Openldap服务器主备配置
3.1 Provider配置
需启用Tls，且已完成非Tls相关配置。
3.2 支持基于tls的Consumer备份机配置
3.2.1 Provider的证书同步
将Provider的CACertificateFile、CertificateFile、CertificateKeyFile拷贝到Consumer机器的cacerts路径

[root@iZ236i68gjtZ syncacerts]# vim tls.ldif
dn: cn=config
changetype: modify
replace: olcTLSCACertificatePath
olcTLSCACertificatePath: /etc/openldap/cacerts
-
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/openldap/cacerts/ca-bundle.crt
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/cacerts/LDAP.crt
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/cacerts/LDAP.key

Add this to the LDAP tree:
#ldapadd -Y EXTERNAL -H ldapi:/// -f tls.ldif

3.2.2 启用ldaps支持
[root@ns2 certs]# vim /etc/sysconfig/ldap
set line 20, if not yet set this way, so SLAPD_LDAPS=yes

restart LDAP afterwards
[root@ns2 certs]# service slapd restart
3.2.3 基于tls传输的备份机配置
[root@iZ236i68gjtZ syncacerts]# vim syncrepl.ldif
# create new
dn: olcDatabase={2}bdb,cn=config
changetype: modify
replace: olcSyncRepl
olcSyncRepl: rid=001 provider=ldaps://66.191.103.166/ bindmethod=simple binddn="
cn=Manager,dc=dcnet,dc=com" credentials="d…1…h…s…" searchb
ase="dc=dcnet,dc=com" tls_reqcert=never starttls=yes scope=sub schemacheck
ing=on type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00

# ldapadd -Y EXTERNAL -H ldapi:/// -f syncrepl.ldif
3.2.4 基于tls传输的备份机ldap.conf配置
如发现错误tls启动错误，则需要查看/etc/openldap/ldap.conf配置如下：
STARTTLS yes
TLS_REQCERT never
TLS_CACERTDIR /etc/openldap/cacerts

四、 Consumer服务器samba用户信息备份配置
此时应可正常同步，但如果备份机不识别samba库，则同步中含samba的部分可能无法正常，此时需要手动添加samba库：
找到provider机器中，samba.schema文件复制到/etc/openldap/schema文件夹
[root@iZ236i68gjtZ syncacerts]# vim schema_convert.conf
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/collective.schema
include /etc/openldap/schema/corba.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/duaconf.schema
include /etc/openldap/schema/dyngroup.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/java.schema
include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/openldap.schema
include /etc/openldap/schema/ppolicy.schema
include /etc/openldap/schema/pmi.schema
include /etc/openldap/schema/samba.schema

mkdir ldif_output (will hold temporary schema files)
slaptest -f schema_convert.conf -F ldif_output
（或者：slapcat -f schema_convert.conf -F ldif_output -n 0 | grep samba,cn=schema）
slapcat -f schema_convert.conf -F ldif_output -n0 -H ldap:///cn={13}samba,cn=schema,cn=config -l cn=samba.ldif

Edit the generated cn=samba.ldif file by removing index information to arrive at:

dn: cn=samba,cn=schema,cn=config
...
cn: samba

Remove the bottom lines:

structuralObjectClass: olcSchemaConfig
entryUUID: b53b75ca-083f-102d-9fff-2f64fd123c95
creatorsName: cn=config
createTimestamp: 20080827045234Z
entryCSN: 20080827045234.341425Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20080827045234Z

Your attribute values will vary.

Samba indices

Now that slapd knows about the Samba attributes, we can set up some indices based on them. Indexing entries is a way to improve performance when a client performs a filtered search on the DIT.

Create the file samba_indices.ldif with the following contents:

dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcDbIndex
olcDbIndex: uidNumber eq
olcDbIndex: gidNumber eq
olcDbIndex: loginShell eq
olcDbIndex: uid eq,pres,sub
olcDbIndex: memberUid eq,pres,sub
olcDbIndex: uniqueMember eq,pres
olcDbIndex: sambaSID eq
olcDbIndex: sambaPrimaryGroupSID eq
olcDbIndex: sambaGroupType eq
olcDbIndex: sambaSIDList eq
olcDbIndex: sambaDomainName eq
olcDbIndex: default sub

dn: olcDatabase={2}bdb,cn=config
changetype: modify
add: olcDbIndex
olcDbIndex: uniqueMember eq,pres
olcDbIndex: sambaSID eq
olcDbIndex: sambaPrimaryGroupSID eq
olcDbIndex: sambaGroupType eq
olcDbIndex: sambaSIDList eq
olcDbIndex: sambaDomainName eq
olcDbIndex: default sub

Using the ldapmodify utility load the new indices:

sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f samba_indices.ldif

原文：http://www.cnblogs.com/donneyliu/p/Openldap_Duplicate_Synchronization.html