博客
关于我
强烈建议你试试无所不能的chatGPT，快点击我
CentOS6下OpenLDAP+PhpLdapAdmin基本安装及主从/主主高可用模式部署记录
阅读量：6440 次
发布时间：2019-06-23

本文共 41233 字，大约阅读时间需要 137 分钟。

 

下面测试的部署机ip地址为：192.168.10.205

1）yum安装OpenLDAP

[root@openldap-server ~]# yum install openldap openldap-* -y

2）配置ldap，包括准备DB_CONFIG和slapd.conf

[root@openldap-server ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG[root@openldap-server ~]# cp /usr/share/openldap-servers/slapd.conf.obsolete /etc/openldap/slapd.conf

3）生成ldap管理员密码

[root@openldap-server ~]# slappasswd -s ldap@123{SSHA}b6YpCvRFWAWQdJpueuyzk79VXlikj4Z1

4）修改slapd.conf，主要配置dc和rootpw，rootpw配置上面设置的密码（rootpw必须顶格写，与后面的密码用Tab键分开!可以把文件中rootpw前面的#去掉之后进行配置）

[root@openldap-server ~]# cp /etc/openldap/slapd.conf /etc/openldap/slapd.conf.bak[root@openldap-server ~]# vim /etc/openldap/slapd.conf......database        bdbsuffix          "dc=kevin,dc=com"checkpoint      1024 15rootdn          "cn=Manager,dc=kevin,dc=com"             #管理LDAP中信息的最高权限，即管理员权限......rootpw                {SSHA}b6YpCvRFWAWQdJpueuyzk79VXlikj4Z1

5）检测并重新生成ldap数据库

[root@openldap-server ~]# cd /etc/openldap/      [root@openldap-server openldap]# ls slapd.d/cn=config  cn=config.ldif[root@openldap-server openldap]# rm -rf slapd.d/*[root@openldap-server openldap]# ls slapd.d/[root@openldap-server openldap]# 官方对于OpenLDAP2.4 ，不推荐使用 slapd.conf 作为配置文件。从这个版本开始所有配置数据都保存在 /etc/openldap/slapd.d/中[root@openldap-server openldap]# rpm -qa|grep openldapopenldap-2.4.40-16.el6.x86_64openldap-servers-sql-2.4.40-16.el6.x86_64openldap-devel-2.4.40-16.el6.x86_64openldap-servers-2.4.40-16.el6.x86_64openldap-clients-2.4.40-16.el6.x86_64[root@openldap-server openldap]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/ 5b02d207 bdb_db_open: database "dc=kevin,dc=com": db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2).5b02d207 backend_startup_one (type=bdb, suffix="dc=kevin,dc=com"): bi_db_open failed! (2)slap_startup failed (test would succeed using the -u switch)[root@openldap-server openldap]# slaptest -uconfig file testing succeeded

6）修改相关ldap文件权限

[root@openldap-server openldap]# chown -R ldap:ldap /var/lib/ldap/[root@openldap-server openldap]# chown -R ldap:ldap /etc/openldap/

7）启动slapd服务

[root@openldap-server openldap]# service slapd startStarting slapd:                                            [  OK  ][root@openldap-server openldap]# service slapd status  slapd (pid  12896) is running...[root@openldap-server openldap]# lsof -i:389COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAMEslapd   12896 ldap    7u  IPv4 702934      0t0  TCP *:ldap (LISTEN)slapd   12896 ldap    8u  IPv6 702935      0t0  TCP *:ldap (LISTEN)

8）yum安装migrationtools

[root@openldap-server openldap]# yum install migrationtools -y

9）编辑/usr/share/migrationtools/migrate_common.ph并修改相关配置

[root@openldap-server openldap]# cp /usr/share/migrationtools/migrate_common.ph /usr/share/migrationtools/migrate_common.ph.bak[root@openldap-server openldap]# vim /usr/share/migrationtools/migrate_common.ph......# Default DNS domain$DEFAULT_MAIL_DOMAIN = "kevin.com";# Default base $DEFAULT_BASE = "dc=kevin,dc=com";[root@openldap-server openldap]# diff /usr/share/migrationtools/migrate_common.ph /usr/share/migrationtools/migrate_common.ph.bak71c71< $DEFAULT_MAIL_DOMAIN = "kevin.com";---> $DEFAULT_MAIL_DOMAIN = "padl.com";74c74< $DEFAULT_BASE = "dc=kevin,dc=com";---> $DEFAULT_BASE = "dc=padl,dc=com";

10）生成base.ldif

[root@openldap-server openldap]# /usr/share/migrationtools/migrate_base.pl >base.ldif[root@openldap-server openldap]# cat base.ldif dn: dc=kevin,dc=comdc: kevinobjectClass: topobjectClass: domaindn: ou=Hosts,dc=kevin,dc=comou: HostsobjectClass: topobjectClass: organizationalUnitdn: ou=Rpc,dc=kevin,dc=comou: RpcobjectClass: topobjectClass: organizationalUnitdn: ou=Services,dc=kevin,dc=comou: ServicesobjectClass: topobjectClass: organizationalUnitdn: nisMapName=netgroup.byuser,dc=kevin,dc=comnismapname: netgroup.byuserobjectClass: topobjectClass: nisMapdn: ou=Mounts,dc=kevin,dc=comou: MountsobjectClass: topobjectClass: organizationalUnitdn: ou=Networks,dc=kevin,dc=comou: NetworksobjectClass: topobjectClass: organizationalUnitdn: ou=People,dc=kevin,dc=comou: PeopleobjectClass: topobjectClass: organizationalUnitdn: ou=Group,dc=kevin,dc=comou: GroupobjectClass: topobjectClass: organizationalUnitdn: ou=Netgroup,dc=kevin,dc=comou: NetgroupobjectClass: topobjectClass: organizationalUnitdn: ou=Protocols,dc=kevin,dc=comou: ProtocolsobjectClass: topobjectClass: organizationalUnitdn: ou=Aliases,dc=kevin,dc=comou: AliasesobjectClass: topobjectClass: organizationalUnitdn: nisMapName=netgroup.byhost,dc=kevin,dc=comnismapname: netgroup.byhostobjectClass: topobjectClass: nisMap

11）添加base.ldif到ldap（输入密码为上面创建的：ldap@123）

[root@openldap-server openldap]# ldapadd -x -D "cn=Manager,dc=kevin,dc=com" -W -f ./base.ldifEnter LDAP Password: adding new entry "dc=kevin,dc=com"adding new entry "ou=Hosts,dc=kevin,dc=com"adding new entry "ou=Rpc,dc=kevin,dc=com"adding new entry "ou=Services,dc=kevin,dc=com"adding new entry "nisMapName=netgroup.byuser,dc=kevin,dc=com"adding new entry "ou=Mounts,dc=kevin,dc=com"adding new entry "ou=Networks,dc=kevin,dc=com"adding new entry "ou=People,dc=kevin,dc=com"adding new entry "ou=Group,dc=kevin,dc=com"adding new entry "ou=Netgroup,dc=kevin,dc=com"adding new entry "ou=Protocols,dc=kevin,dc=com"adding new entry "ou=Aliases,dc=kevin,dc=com"adding new entry "nisMapName=netgroup.byhost,dc=kevin,dc=com"

12）检查ldapadd是否成功（输入密码为上面创建的：ldap@123）（必须检查确认Manager数据添加了，才能通过phpldapAdmin登录）

[root@openldap-server openldap]# ldapsearch -x -D "cn=Manager,dc=kevin,dc=com" -b "ou=Aliases,dc=kevin,dc=com" -W  Enter LDAP Password: # extended LDIF## LDAPv3# base 
     
       with scope subtree# filter: (objectclass=*)# requesting: ALL## Aliases, kevin.comdn: ou=Aliases,dc=kevin,dc=comou: AliasesobjectClass: topobjectClass: organizationalUnit# search resultsearch: 2result: 0 Success# numResponses: 2# numEntries: 1

13）yum安装httpd及PhpLdapAdmin

[root@openldap-server openldap]# rpm -ivh http://mirrors.ukfast.co.uk/sites/dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm[root@openldap-server openldap]# yum install httpd phpldapadmin -y

14）配置/etc/httpd/conf.d/phpldapadmin.conf允许从远程访问

[root@openldap-server openldap]# vim /etc/httpd/conf.d/phpldapadmin.conf      #可以先把此文件cp备份一份Alias /phpldapadmin /usr/share/phpldapadmin/htdocs  Alias /ldapadmin /usr/share/phpldapadmin/htdocs    
     
          Order Deny,Allow    Allow from all    Allow from 127.0.0.1                         #或者去掉下面这三行内容，表示运行所有客户机访问（本测试案例就去掉了这三行）  Allow from ::1  Allow from 192.168.10.206 192.168.10.207     #允许哪些IP地址访问phpldapadmin

15）修改/etc/phpldapadmin/config.php配置用DN登录

[root@openldap-server openldap]# cp /etc/phpldapadmin/config.php /etc/phpldapadmin/config.php.bak[root@openldap-server openldap]# vim /etc/phpldapadmin/config.php.......//$servers->setValue('login','attr','uid');      #注释掉这一行$servers->setValue('login','attr','dn');         #添加这一行[root@openldap-server openldap]# diff /etc/phpldapadmin/config.php /etc/phpldapadmin/config.php.bak398,399c398,399< //$servers->setValue('login','attr','uid');< $servers->setValue('login','attr','dn');---> $servers->setValue('login','attr','uid');>

16）启动httpd服务

[root@openldap-server openldap]# service httpd startStarting httpd: httpd: apr_sockaddr_info_get() failed for openldap-serverhttpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName                                                           [  OK  ][root@openldap-server openldap]# service httpd statushttpd (pid  13010) is running...[root@openldap-server openldap]# lsof -i:80COMMAND   PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAMEhttpd   13010   root    4u  IPv6 757231      0t0  TCP *:http (LISTEN)httpd   13012 apache    4u  IPv6 757231      0t0  TCP *:http (LISTEN)httpd   13013 apache    4u  IPv6 757231      0t0  TCP *:http (LISTEN)httpd   13014 apache    4u  IPv6 757231      0t0  TCP *:http (LISTEN)httpd   13015 apache    4u  IPv6 757231      0t0  TCP *:http (LISTEN)httpd   13016 apache    4u  IPv6 757231      0t0  TCP *:http (LISTEN)httpd   13017 apache    4u  IPv6 757231      0t0  TCP *:http (LISTEN)httpd   13018 apache    4u  IPv6 757231      0t0  TCP *:http (LISTEN)httpd   13019 apache    4u  IPv6 757231      0t0  TCP *:http (LISTEN)

17）打开Web UI并登录LDAP（登录用户名为"cn=Manager,dc=kevin,dc=com"，密码为"ldap@123"）

18）导入新数据

[root@openldap-server openldap]# pwd/etc/openldap[root@openldap-server openldap]# vim test.ldif       dn: ou=technology,dc=kevin,dc=comchangetype: addobjectclass: topobjectclass: organizationalUnitou: technologydn: cn=wang shibo,ou=technology,dc=kevin,dc=comchangetype: addobjectclass: personobjectclass: organizationalPersonobjectclass: inetOrgPersoncn: wang shibosn: wangou: technologydescription: boy, mandescription: manuid: goodman[root@openldap-server openldap]# ldapadd -x -D "cn=Manager,dc=kevin,dc=com" -w ldap@123 -f test.ldifadding new entry "ou=technology,dc=kevin,dc=com"adding new entry "cn=wang shibo,ou=technology,dc=kevin,dc=com"============================================================如果报错：[root@openldap-server openldap]# ldapadd -x -D "cn=Manager,dc=kevin,dc=com" -w ldap@123 -f test.ldifldapadd: attributeDescription "dn": (possible missing newline after line 9, entry "ou=technology,dc=kevin,dc=com"?)adding new entry "ou=technology,dc=kevin,dc=com"ldap_add: Type or value exists (20)        additional info: ou: value #0 provided more than once产生原因：test.ldif文件中的不规范的空格所致！！即导入的数据含有空格所致！纠错如下：dn:（空格）ou=technology,dc=kevin,dc=comchangetype:（空格）add（结尾无空格）objectclass:（空格）top（结尾无空格）objectclass:（空格）organizationalUnit（结尾无空格）ou:（空格）echnology（结尾无空格）（1空行，空行必须要定格，不能留空格）（结尾无空格）........（后面的配置内容纠正方法同样）===========================================================查看上面所导入的数据：[root@openldap-server openldap]# ldapsearch -x -D "cn=Manager,dc=kevin,dc=com" -b "ou=technology,dc=kevin,dc=com" -w ldap@123# extended LDIF## LDAPv3# base 
     
       with scope subtree# filter: (objectclass=*)# requesting: ALL## technology, kevin.comdn: ou=technology,dc=kevin,dc=comobjectClass: topobjectClass: organizationalUnitou: technology# wang shibo, technology, kevin.comdn: cn=wang shibo,ou=technology,dc=kevin,dc=comobjectClass: personobjectClass: organizationalPersonobjectClass: inetOrgPersoncn: wang shibosn: wangou: technologydescription: boy, mandescription: manuid: goodman# search resultsearch: 2result: 0 Success# numResponses: 3# numEntries: 2

可以登陆phpLDAPadmin的web界面查询新导入的数据

再次导入其他数据 

[root@openldap-server openldap]# vim test.ldif dn: cn=chenlu,ou=technology,dc=kevin,dc=comchangetype: addobjectclass: personobjectclass: organizationalPersonobjectclass: inetOrgPersoncn: chenlusn: chenluou: technologydescription: girluid: UI Designer[root@openldap-server openldap]# ldapadd -x -D "cn=Manager,dc=kevin,dc=com" -w ldap@123 -f test.ldifadding new entry "cn=chenlu,ou=technology,dc=kevin,dc=com"[root@openldap-server openldap]# ldapsearch -x -D "cn=Manager,dc=kevin,dc=com" -b "ou=technology,dc=kevin,dc=com" -w ldap@123# extended LDIF## LDAPv3# base 
     
       with scope subtree# filter: (objectclass=*)# requesting: ALL## technology, kevin.comdn: ou=technology,dc=kevin,dc=comobjectClass: topobjectClass: organizationalUnitou: technology# wang shibo, technology, kevin.comdn: cn=wang shibo,ou=technology,dc=kevin,dc=comobjectClass: personobjectClass: organizationalPersonobjectClass: inetOrgPersoncn: wang shibosn: wangou: technologydescription: boy, mandescription: manuid: goodman# chenlu, technology, kevin.comdn: cn=chenlu,ou=technology,dc=kevin,dc=comobjectClass: personobjectClass: organizationalPersonobjectClass: inetOrgPersoncn: chenlusn: chenluou: technologydescription: girluid: UI Designer# search resultsearch: 2result: 0 Success# numResponses: 4# numEntries: 3

===============OpenLDAP日志功能开启=================

1）需要在slapd.conf配置文件里加上日志行 ，这里的日志级别有很多种，这里选择256这个值的级别（主从节点都要打开openldap日志功能）[root@openldap-master ~]# cp /etc/openldap/slapd.conf /etc/openldap/slapd.conf.bak3[root@openldap-master ~]# vim /etc/openldap/slapd.conf           #中间的空格用tab键分开.......loglevel  2562）修改了配置文件，所有得重新生成配置文件的信息[root@openldap-master ~]# rm -rf /etc/openldap/slapd.d/*[root@openldap-master ~]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/config file testing succeeded[root@openldap-master ~]# slaptest -uconfig file testing succeeded[root@openldap-master ~]# chown -R ldap:ldap /var/lib/ldap/[root@openldap-master ~]# chown -R ldap:ldap /etc/openldap/3）修改/etc/rsyslog.conf文件，加上下面内容[root@openldap-master ~]# cp /etc/rsyslog.conf /etc/rsyslog.conf.bak[root@openldap-master ~]# vim /etc/rsyslog.conf........local4.*                                                /var/log/slapd/slapd.log4）创建日志文件目录，授权[root@openldap-master ~]# mkdir /var/log/slapd[root@openldap-master ~]# chmod 755 /var/log/slapd/[root@openldap-master ~]# chown ldap.ldap /var/log/slapd/5）重启syslog服务和slapd服务[root@openldap-master ~]# /etc/init.d/rsyslog restartShutting down system logger:                               [  OK  ]Starting system logger:                                    [  OK  ][root@openldap-master ~]# /etc/init.d/slapd restartStopping slapd:                                            [  OK  ]Starting slapd:                                            [  OK  ][root@openldap-master ~]# lsof -i:389COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAMEslapd   13773 ldap    7u  IPv4 840484      0t0  TCP *:ldap (LISTEN)slapd   13773 ldap    8u  IPv6 840485      0t0  TCP *:ldap (LISTEN)6）查看openldap日志信息[root@openldap-master ~]# tail -f /var/log/slapd/slapd.log

===============OpenLDAP主从模式配置=================

OpenLDAP主从同步的原理：当在主服务器上更新数据时，该更新通过更新日志记录，并将更新复制到从服务器上

OpenLdap v2.3之前的同步复制缺点

-  slurpd守护进程是以推模式操作 : 主服务器推送变更的数据到从服务器 （不可靠）
-  对replog中的记录的次序极为敏感
-  很容易失去同步, 这时需要手工干预来从主目录重新同步从服务器数据库
-  如果一个从服务器长时间停机,replog可能变得太大以至于slurpd无法处理
-  只工作在推模式（也可以设置为拉模式,但是这种感觉类似于将master上的数据做了一个快捷连接到slave上）
-  需要停止和重新启动主服务器来增加从服务器
-  只支持单一主服务器复制（1台主对多从）

OpenLDAP v2.4之后的同步功能

新版最大的功能就是实现了双向复制，即双主、多主模式，无论哪一台master宕机，都不会影响使用。
新版主从配置有五种方式：
1）Syncrepl
该方式是slave服务器以拉的方式同步master的用户数据，这是基本也是最简单的openldap主从配置的方式。
该方式缺点：当修改一个条目中的一个属性值（or大批量的万级别的某1属性值），它不是简单的同步过来这些属性，而是把修改的条目一起同步更新来。
2）Delta-syncrepl
比上一条多了个功能：基于日志同步：
在master每更改1条记录，肯定会产生1条日志，那么slave会通过你的master日志进行相应的修改，这就克服了上一条的缺点。
3）N-Way Multi-Master
多主方式同步LDAP信息
4）MirrorMode
该方式是服务器互相推送信息的方式同步用户数据；MirrorMode只支持2个主master（2个主master可以+N个slave），但是你如果非得加了3 、4 台master后，
那么其余的都只能从前2台master上获取数据，而不能将本身的数据推送过去。如果你有类似需求，也可以使用这个方式。（比如，你企业分散点多，然后不希望
都具有修改功能，可以使用它）
5）Syncrepl Proxy
代理同步。意思是将主master隐藏起来，而代理机上边通过Syncrepl从master主机以拉的方式同步master用户数据，当代理主机发生改变时，代理主机的LDAP
又以推的方式将数据更新到下属的slave LDAP服务器上。slave LDAP 只有对代理LDAP服务器的读权限。

Syncrepl同步解释

由于syncrepl为拉取模式（到master拉数据），所以配置文件配置slave端的slapd.conf文件即可。初始化操作2种：
1）通过配置文件，当开启syncrepl引擎后会到master拉数据；
2）从主服务器备份数据，复制到slave。当从备份数据初始化的时候，不必担心数据老，因为syncrepl会自动进行校验，然后进行相应的修改、同步。
（当复制一个大规模的“条录”，建议从备份初始化）

需要注意的是：slave是使用读写权限到master中进行同步的！

基于上面的部署，上面的测试机192.168.10.205作为openldap-master主节点，新增一台服务器192.168.10.206作为openldap-slave从节点。OpenLDAP主从配置如下：

1）基础环境

192.168.10.205    openldap-master192.168.10.206    openldap-slave绑定hosts（两个节点机器上都要操作）[root@openldap-master ~]# cat /etc/hosts......192.168.10.205    openldap-master192.168.10.206    openldap-slave关闭两个节点机器的防火墙和selinux（两个节点机器上都要操作）[root@openldap-master ~]# /etc/init.d/iptables stop[root@openldap-master ~]# chkconfig iptables off[root@openldap-master ~]# chkconfig --list|grep iptablesiptables        0:off 1:off 2:off 3:off 4:off 5:off 6:off同步系统时间（两个节点机器上都要操作）[root@openldap-master ~]# yum install -y ntpdate[root@openldap-master ~]# ntpdate ntp1.aliyun.com

2）openldap-slave从节点同样安装和配置OpenLDAP和PhpLdapAdmin（和上面安装即配置步骤一样，在此省略）。为了测试效果，设置从节点的密码为123@ldap

[root@openldap-slave ~]# slappasswd -s 123@ldap{SSHA}X3wlj1uJmB50FM4rNN4869VCeMd92Pcr

3）penldap-master主节点和openldap-slave从节点的PhpLdapAdmin和http配置一样

4）OpenLDAP的主从配置

-----------------------------------------------------------------penldap-master主节点的配置如下：[root@openldap-master ~]# cp /etc/openldap/slapd.conf /etc/openldap/slapd.conf.bak2[root@openldap-master ~]# vim /etc/openldap/slapd.conf        #在文件底部添加下面同步配置（之前的配置不动）......modulepath /usr/lib/openldap                                  #一定要打开这几行的注释modulepath /usr/lib64/openldap......moduleload syncprov.la......#replicationindex entryCSN,entryUUID      eq overlay syncprov syncprov-nopresent TRUEsyncprov-reloadhint TRUEsyncprov-checkpoint 100 10 syncprov-sessionlog 100 重新生成主节点的配置文件[root@openldap-master ~]# rm -rf /etc/openldap/slapd.d/*[root@openldap-master ~]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/config file testing succeeded[root@openldap-master ~]# slaptest -uconfig file testing succeeded[root@openldap-master ~]# chown -R ldap:ldap /var/lib/ldap/[root@openldap-master ~]# chown -R ldap:ldap /etc/openldap/[root@openldap-master ~]# service slapd restartStopping slapd:                                            [  OK  ]Starting slapd:                                            [  OK  ][root@openldap-master ~]# lsof -i:389COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAMEslapd   13214 ldap    7u  IPv4 763380      0t0  TCP *:ldap (LISTEN)slapd   13214 ldap    8u  IPv6 763381      0t0  TCP *:ldap (LISTEN) ----------------------------------------------------------------penldap-slave从节点的配置如下：[root@openldap-slave ~]# cp /etc/openldap/slapd.conf /etc/openldap/slapd.conf.bak2[root@openldap-slave ~]# vim /etc/openldap/slapd.conf......modulepath /usr/lib/openldap                         #一定要打开这几行的注释modulepath /usr/lib64/openldap        ......moduleload syncprov.la......database        bdbsuffix          "dc=kevin,dc=com"checkpoint      1024 15rootdn          "cn=Manager,dc=kevin,dc=com".......rootpw          {SSHA}X3wlj1uJmB50FM4rNN4869VCeMd92Pcr....... # slave replica statement startsyncrepl  rid=123          provider=ldap://192.168.10.205:389          type=refreshOnly             interval=00:00:00:01               searchbase="dc=kevin,dc=com"          scope=sub           attrs="*"             schemachecking=off               bindmethod=simple          binddn="cn=Manager,dc=kevin,dc=com"           credentials=ldap@123  重新生成从节点的配置文件[root@openldap-slave ~]# rm -rf /etc/openldap/slapd.d/*[root@openldap-slave ~]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/5b02f6ae syncrepl rid=123 searchbase="dc=kevin,dc=com": no retry defined, using defaultconfig file testing succeeded[root@openldap-slave ~]# slaptest -u5b02f6b4 syncrepl rid=123 searchbase="dc=kevin,dc=com": no retry defined, using defaultconfig file testing succeeded[root@openldap-slave ~]# chown -R ldap:ldap /var/lib/ldap/[root@openldap-slave ~]# chown -R ldap:ldap /etc/openldap/[root@openldap-slave ~]# service slapd restartStopping slapd:                                            [  OK  ]Checking configuration files for slapd:                    [WARNING]5b02f6c6 syncrepl rid=123 searchbase="dc=kevin,dc=com": no retry defined, using defaultconfig file testing succeededStarting slapd:                                            [  OK  ][root@openldap-slave ~]# lsof -i:389COMMAND   PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAMEslapd   14329 ldap    7u  IPv4 4803594      0t0  TCP *:ldap (LISTEN)slapd   14329 ldap    8u  IPv6 4803595      0t0  TCP *:ldap (LISTEN)

5）登陆openldap-slave从节点的phpLDAPadmin的web界面（http://192.168.10.206/phpldapadmin），发现已经将上面openldap-master主节点新导入的数据同步过来了

 6）导入新数据测试主从同步效果

温馨提示：由于在syncrepl中slave是refreshOnly，相当于从节点是只读的，这时不允许在从节点导入或者删除用户，否则会出现错误！因为只能在master主节点上导入数据：前面已经编辑了base.ldif，并导入了该文件中定义的数据了（即dc=kevin,dc=com、ou=People,dc=kevin,dc=com、ou=Group,dc=kevin,dc=com等）[root@openldap-master openldap]# pwd/etc/openldap[root@openldap-master openldap]# cat group.ldif dn: cn=user1,ou=Group,dc=kevin,dc=comobjectClass: posixGroupobjectClass: topcn: user1userPassword: kevin123gidNumber: 10011dn: cn=user2,ou=Group,dc=kevin,dc=comobjectClass: posixGroupobjectClass: topcn: user2userPassword: kevin123gidNumber: 10012dn: cn=user3,ou=Group,dc=kevin,dc=comobjectClass: posixGroupobjectClass: topcn: user3userPassword: kevin123gidNumber: 10013[root@openldap-master openldap]# cat people.ldif dn: uid=user1,ou=People,dc=kevin,dc=comuid: user1cn: user1objectClass: accountobjectClass: posixAccountobjectClass: topobjectClass: shadowAccountuserPassword: kevin123shadowLastChange: 17053shadowMin: 0shadowMax: 99999shadowWarning: 7loginShell: /bin/bashuidNumber: 10011gidNumber: 10011homeDirectory: /home/user1dn: uid=user2,ou=People,dc=kevin,dc=comuid: user2cn: user2objectClass: accountobjectClass: posixAccountobjectClass: topobjectClass: shadowAccountuserPassword: kevin123shadowLastChange: 17053shadowMin: 0shadowMax: 99999shadowWarning: 7loginShell: /bin/bashuidNumber: 10012gidNumber: 10012homeDirectory: /home/user2dn: uid=user3,ou=People,dc=kevin,dc=comuid: user3cn: user3objectClass: accountobjectClass: posixAccountobjectClass: topobjectClass: shadowAccountuserPassword: kevin123shadowLastChange: 17053shadowMin: 0shadowMax: 99999shadowWarning: 7loginShell: /bin/bashuidNumber: 10013gidNumber: 10013homeDirectory: /home/user3执行数据导入[root@openldap-master openldap]# ldapadd -x -D "cn=Manager,dc=kevin,dc=com" -w ldap@123 -f group.ldif adding new entry "cn=user1,ou=Group,dc=kevin,dc=com"adding new entry "cn=user2,ou=Group,dc=kevin,dc=com"adding new entry "cn=user3,ou=Group,dc=kevin,dc=com"[root@openldap-master openldap]# ldapadd -x -D "cn=Manager,dc=kevin,dc=com" -w ldap@123 -f people.ldif adding new entry "uid=user1,ou=People,dc=kevin,dc=com"adding new entry "uid=user2,ou=People,dc=kevin,dc=com"adding new entry "uid=user3,ou=People,dc=kevin,dc=com"openldap-master主节点查看[root@openldap-master openldap]# ldapsearch -x -D "cn=Manager,dc=kevin,dc=com" -b "ou=Group,dc=kevin,dc=com" -w ldap@123[root@openldap-master openldap]# ldapsearch -x -D "cn=Manager,dc=kevin,dc=com" -b "ou=People,dc=kevin,dc=com" -w ldap@123现在在openldap-slave从节点上查看（注意这里的从节点设置的ldap密码是123@ldap，和主节点的ldap密码不一样）：[root@openldap-slave ldap]# ldapsearch -x -D "cn=Manager,dc=kevin,dc=com" -b "ou=People,dc=kevin,dc=com" -w 123@ldap# extended LDIF## LDAPv3# base 
     
       with scope subtree# filter: (objectclass=*)# requesting: ALL## People, kevin.comdn: ou=People,dc=kevin,dc=comou: PeopleobjectClass: topobjectClass: organizationalUnit# user1, People, kevin.comdn: uid=user1,ou=People,dc=kevin,dc=comuid: user1cn: user1objectClass: accountobjectClass: posixAccountobjectClass: topobjectClass: shadowAccountuserPassword:: a2V2aW4xMjM=shadowLastChange: 17053shadowMin: 0shadowMax: 99999shadowWarning: 7loginShell: /bin/bashuidNumber: 10011gidNumber: 10011homeDirectory: /home/user1# user2, People, kevin.comdn: uid=user2,ou=People,dc=kevin,dc=comuid: user2cn: user2objectClass: accountobjectClass: posixAccountobjectClass: topobjectClass: shadowAccountuserPassword:: a2V2aW4xMjM=shadowLastChange: 17053shadowMin: 0shadowMax: 99999shadowWarning: 7loginShell: /bin/bashuidNumber: 10012gidNumber: 10012homeDirectory: /home/user2# user3, People, kevin.comdn: uid=user3,ou=People,dc=kevin,dc=comuid: user3cn: user3objectClass: accountobjectClass: posixAccountobjectClass: topobjectClass: shadowAccountuserPassword:: a2V2aW4xMjM=shadowLastChange: 17053shadowMin: 0shadowMax: 99999shadowWarning: 7loginShell: /bin/bashuidNumber: 10013gidNumber: 10013homeDirectory: /home/user3# search resultsearch: 2result: 0 Success# numResponses: 5# numEntries: 4[root@openldap-slave ldap]# ldapsearch -x -D "cn=Manager,dc=kevin,dc=com" -b "ou=Group,dc=kevin,dc=com" -w 123@ldap# extended LDIF## LDAPv3# base 
      
        with scope subtree# filter: (objectclass=*)# requesting: ALL## Group, kevin.comdn: ou=Group,dc=kevin,dc=comou: GroupobjectClass: topobjectClass: organizationalUnit# user1, Group, kevin.comdn: cn=user1,ou=Group,dc=kevin,dc=comobjectClass: posixGroupobjectClass: topcn: user1userPassword:: a2V2aW4xMjM=gidNumber: 10011# user2, Group, kevin.comdn: cn=user2,ou=Group,dc=kevin,dc=comobjectClass: posixGroupobjectClass: topcn: user2userPassword:: a2V2aW4xMjM=gidNumber: 10012# user3, Group, kevin.comdn: cn=user3,ou=Group,dc=kevin,dc=comobjectClass: posixGroupobjectClass: topcn: user3userPassword:: a2V2aW4xMjM=gidNumber: 10013# search resultsearch: 2result: 0 Success# numResponses: 5# numEntries: 4由上面slave从节点查看到的数据可知，slave从节点已经将master主节点新导入的输入同步过来了！即主从同步已成功了！

登录openldap-slave从节点的phpLDAPadmin，（退出并重新登录master和slave节点的phpLDAPadmin，就能发现上面新导入的数据了）也可以看到从openldap-master主节点同步过来的数据（可以从slave的openldap日志/var/log/slapd/slapd.log文件中查看数据同步情况）

在openldap-master主节点上删除数据，比如删除上面在People组内创建的用户user1和user3 

[root@openldap-master openldap]# ldapdelete -x -D "cn=Manager,dc=kevin,dc=com" "uid=user1,ou=People,dc=kevin,dc=com" -w ldap@123[root@openldap-master openldap]# ldapdelete -x -D "cn=Manager,dc=kevin,dc=com" "uid=user3,ou=People,dc=kevin,dc=com" -w ldap@123========================================================================如果命令执行后报错：ldap_bind: Invalid credentials (49)基本就是由于密码输入不对或ldif文件配置不对造成的=========================================================================查看下openldap-master主节点的ldap目录中的以上数据是否删除[root@openldap-master openldap]# ldapsearch -x -H ldap://192.168.10.205:389 -b "dc=kevin,dc=com" |grep uid=user1[root@openldap-master openldap]# ldapsearch -x -H ldap://192.168.10.205:389 -b "dc=kevin,dc=com" |grep uid=user3[root@openldap-master openldap]# ldapsearch -x -H ldap://192.168.10.205:389 -b "dc=kevin,dc=com" |grep uid=user2dn: uid=user2,ou=People,dc=kevin,dc=com然后在openldap-slave从节点上查看，发现从节点的ldap目录中People组内也没有用户user1和user3了[root@openldap-slave ldap]# ldapsearch -x -H ldap://192.168.10.206:389 -b "dc=kevin,dc=com" |grep uid=user1[root@openldap-slave ldap]# ldapsearch -x -H ldap://192.168.10.206:389 -b "dc=kevin,dc=com" |grep uid=user3[root@openldap-slave ldap]# ldapsearch -x -H ldap://192.168.10.206:389 -b "dc=kevin,dc=com" |grep uid=user2dn: uid=user2,ou=People,dc=kevin,dc=com说明主从节点完成了同步！退出并重新登录openldap-master主节点或openldap-slave从节点的phpLDAPadmin，就能看到删除的数据已经不再了。

可以在主节点的phpLDAPadmin的web界面里进行增加、删除、修改等更新操作；可以将phpLDAPadmin左边栏用不到的条目删除（也可以不删除，以备后续使用）；可以将phpLDAPadmin中已存在的条目导出Ldif文件格式，将内容复制出来，然后在master节点上编写新的ldif文件（在复制的内容上根据自己的需要修改下即可）。

=========OpenLDAP+Keepalive主主模式（Mirror Mode）高可用环境配置==========

openldap主主模式配置目的
使用openldap本身的配置来完成openldap之间的同步，包括在openldap的主服务器上添加，修改，删除用户时，从服务器上也和主服务器上完成相同的操作。在从服务器上添加，修改，删除用户时，主服务器上也完成一样的操作。从而保证数据在主从openldap服务器上的一致。

openldap主主模式原理

其实现原理如下图，当在主服务器上更新数据时，该更新通过更新日志记录，并将更新复制到从服务器上。当在从服务器上更新数据时，该更新请求将重定向给主服务器，然后主服务器将更新数据复制到从服务器。

基于上面两台机器192.168.10.205和192.168.10.206安装的openldap环境，现在想要实现keepalived+openldap主主模式（Mirror Mode）模式，配置记录如下：

1）192.168.10.205节点的slapd.conf配置

[root@openldap-master ~]# vim /etc/openldap/slapd.conf.......modulepath /usr/lib/openldap                                modulepath /usr/lib64/openldap......moduleload syncprov.la......database        bdbsuffix          "dc=kevin,dc=com"checkpoint      1024 15rootdn          "cn=Manager,dc=kevin,dc=com"            ......rootpw                {SSHA}b6YpCvRFWAWQdJpueuyzk79VXlikj4Z1......loglevel       256       ......index entryCSN,entryUUID      eq#replicationoverlay syncprovsyncprov-checkpoint 100 10syncprov-sessionlog 100serverID    1syncrepl    rid=002            provider=ldap://192.168.10.206:389            bindmethod=simple            binddn="cn=Manager,dc=kevin,dc=com"            credentials=123@ldap                       #填写的是对方机器的openldap的密码，不是自己的openldap密码            searchbase="dc=kevin,dc=com"            schemachecking=on            filter="(objectClass=*)"            scope=sub            schemachecking=off            type=refreshAndPersist            retry="60 +"mirrormode  on重新生成该节点的配置文件[root@openldap-master ~]# vim /etc/openldap/slapd.conf[root@openldap-master ~]# rm -rf /etc/openldap/slapd.d/*[root@openldap-master ~]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/config file testing succeeded[root@openldap-master ~]# slaptest -uconfig file testing succeeded[root@openldap-master ~]# chown -R ldap:ldap /var/lib/ldap/[root@openldap-master ~]# chown -R ldap:ldap /etc/openldap/[root@openldap-master ~]# service slapd restartStopping slapd:                                            [  OK  ]Starting slapd:                                            [  OK  ][root@openldap-master ~]# lsof -i:389COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAMEslapd   14047 ldap    7u  IPv4 846134      0t0  TCP *:ldap (LISTEN)slapd   14047 ldap    8u  IPv6 846135      0t0  TCP *:ldap (LISTEN)

2）192.168.10.206节点的slapd.conf配置

[root@openldap-slave ~]# vim /etc/openldap/slapd.conf.......modulepath /usr/lib/openldap                                modulepath /usr/lib64/openldap......moduleload syncprov.la......database        bdbsuffix          "dc=kevin,dc=com"checkpoint      1024 15rootdn          "cn=Manager,dc=kevin,dc=com"            ......rootpw                {SSHA}X3wlj1uJmB50FM4rNN4869VCeMd92Pcr......loglevel       256       ......index entryCSN,entryUUID      eq#replicationoverlay syncprovsyncprov-checkpoint 100 10syncprov-sessionlog 100serverID    2                                          #该ID一定不能跟另一个节点的ID相同syncrepl    rid=002                                    #该rid一定要跟另一个节点的rid配置相同            provider=ldap://192.168.10.205:389            bindmethod=simple            binddn="cn=Manager,dc=kevin,dc=com"            credentials=ldap@123                       #填写的是对方机器的openldap的密码，不是自己的openldap密码            searchbase="dc=kevin,dc=com"            schemachecking=on            filter="(objectClass=*)"            scope=sub            schemachecking=off            type=refreshAndPersist            retry="60 +"mirrormode  on重新生成该节点的配置文件[root@openldap-slave ~]# rm -rf /etc/openldap/slapd.d/*[root@openldap-slave ~]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/config file testing succeeded[root@openldap-slave ~]# slaptest -uconfig file testing succeeded[root@openldap-slave ~]# chown -R ldap:ldap /var/lib/ldap/[root@openldap-slave ~]# chown -R ldap:ldap /etc/openldap/[root@openldap-slave ~]# service slapd restartStopping slapd:                                            [  OK  ]Starting slapd:                                            [  OK  ][root@openldap-slave ~]# lsof -i:389COMMAND   PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAMEslapd   30022 ldap    7u  IPv4 4984193      0t0  TCP *:ldap (LISTEN)slapd   30022 ldap    8u  IPv6 4984194      0t0  TCP *:ldap (LISTEN)slapd   30022 ldap   11u  IPv4 4984206      0t0  TCP openldap-slave:42138->openldap-master:ldap (ESTABLISHED)

3）在192.168.10.205和192.168.10.206节点上各自导入新数据，然后测试主主同步是否生效

现在192.168.10.205节点上导入新数据[root@openldap-master ~]# cat /etc/openldap/people.ldifdn: uid=ops,ou=People,dc=kevin,dc=comuid: opscn: opsobjectClass: accountobjectClass: posixAccountobjectClass: topobjectClass: shadowAccountuserPassword: kevin123shadowLastChange: 17053shadowMin: 0shadowMax: 99999shadowWarning: 7loginShell: /bin/bashuidNumber: 10033gidNumber: 10033homeDirectory: /home/ops[root@openldap-master ~]# ldapadd -x -D "cn=Manager,dc=kevin,dc=com" -w ldap@123 -f /etc/openldap/people.ldif adding new entry "uid=ops,ou=People,dc=kevin,dc=com"在192.168.10.206节点上查看自己的ldap目录里是否同步过来数据了[root@openldap-slave ~]# ldapsearch -x -D "cn=Manager,dc=kevin,dc=com" -b "ou=People,dc=kevin,dc=com" -w 123@ldap|grep uid=opsdn: uid=ops,ou=People,dc=kevin,dc=com说明从192.168.10.205节点到192.168.10.206节点的数据同步是成功的！接着在192.168.10.206节点上导入新数据[root@openldap-slave ~]# cat /etc/openldap/add.ldif dn: cn=wangqiuzhe,ou=technology,dc=kevin,dc=comcn: wangqiuzhedescription: mandescription: boyobjectclass: personobjectclass: organizationalPersonobjectclass: inetOrgPersonou: technologysn: wanguid: anan[root@openldap-slave ~]# ldapadd -x -D "cn=Manager,dc=kevin,dc=com" -w 123@ldap -f /etc/openldap/add.ldif adding new entry "cn=wangqiuzhe,ou=technology,dc=kevin,dc=com"在192.168.10.205节点上查看自己的ldap目录里是否同步过来数据了[root@openldap-master ~]# ldapsearch -x -D "cn=Manager,dc=kevin,dc=com" -b "ou=technology,dc=kevin,dc=com" -w ldap@123|grep cn=wangqiuzhedn: cn=wangqiuzhe,ou=technology,dc=kevin,dc=com说明从192.168.10.206节点到192.168.10.205节点的数据同步也是成功的！登录各自的phpldapadmin界面里也可以操作数据已测试同步效果。到此说明，两个节点的openldap主主同步已经完成了！

4）在192.168.10.205和192.168.10.206两个节点上均安装keepalived，结合keepalived配置实现vip故障转移，即对外提供一个统一的地址。

keepalived安装（192.168.10.205和192.168.10.206两节点都要操作）[root@openldap-master ~]# yum -y install gcc pcre-devel zlib-devel openssl-devel[root@openldap-master ~]# cd /usr/local/src/[root@openldap-master src]# wget http://www.keepalived.org/software/keepalived-1.3.2.tar.gz[root@openldap-master src]# tar -zvxf keepalived-1.3.2.tar.gz[root@openldap-master src]# cd keepalived-1.3.2[root@openldap-master keepalived-1.3.2]# ./configure && make && make install[root@openldap-master keepalived-1.3.2]# cp /usr/local/src/keepalived-1.3.2/keepalived/etc/init.d/keepalived /etc/rc.d/init.d/[root@openldap-master keepalived-1.3.2]# cp /usr/local/etc/sysconfig/keepalived /etc/sysconfig/[root@openldap-master keepalived-1.3.2]# mkdir /etc/keepalived[root@openldap-master keepalived-1.3.2]# cp /usr/local/etc/keepalived/keepalived.conf /etc/keepalived/[root@openldap-master keepalived-1.3.2]# cp /usr/local/sbin/keepalived /usr/sbin/[root@openldap-master keepalived-1.3.2]# echo "/etc/init.d/keepalived start" >> /etc/rc.local[root@openldap-master keepalived-1.3.2]# chkconfig --add keepalived[root@openldap-master keepalived-1.3.2]# chkconfig keepalived on[root@openldap-master keepalived-1.3.2]# chkconfig --list|grep keepalivedkeepalived          0:off     1:off     2:on 3:on 4:on 5:on 6:off===============配置keepalived.conf（VIP地址为192.168.10.228）=============接着看下192.168.10.205节点的keepalived配置：[root@openldap-master ~]# cp /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.bak[root@openldap-master ~]# vim /etc/keepalived/keepalived.conf! Configuration File for keepalivedglobal_defs {   notification_email {        root@localhost   }   notification_email_from root@localhost   smtp_server localhost   smtp_connect_timeout 30   router_id LDAP-205}  vrrp_script chk_ldap_port {    script "/opt/chk_ldap.sh"    interval 2    weight -5    fall 2    rise 1}  vrrp_instance VI_1 {    state MASTER    interface eth0    mcast_src_ip 192.168.10.205    virtual_router_id 51    priority 101    advert_int 1    authentication {        auth_type PASS        auth_pass 1111    }    virtual_ipaddress {         192.168.10.208    } track_script {   chk_ldap_port}}编写openldap监控脚本[root@openldap-master ~]# vim /opt/chk_ldap.sh#!/bin/bashcounter=$(ps -C slapd --no-heading|wc -l)if [ "${counter}" = "0" ]; then    /etc/init.d/slapd start    sleep 2    counter=$(ps -C slapd --no-heading|wc -l)    if [ "${counter}" = "0" ]; then        /etc/init.d/keepalived stop    fifi[root@openldap-master ~]# chmod 755 /opt/chk_ldap.sh=====================================================接着看下192.168.10.206的keepalived.conf配置[root@openldap-slave ~]# cp /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.bak[root@openldap-slave ~]# vim /etc/keepalived/keepalived.conf! Configuration File for keepalivedglobal_defs {   notification_email {        root@localhost   }   notification_email_from root@localhost   smtp_server localhost   smtp_connect_timeout 30   router_id LDAP-206}  vrrp_script chk_ldap_port {    script "/opt/chk_ldap.sh"    interval 2    weight -5    fall 2    rise 1}  vrrp_instance VI_1 {    state BACKUP    interface eth0    mcast_src_ip 192.168.10.206    virtual_router_id 51    priority 99    advert_int 1    authentication {        auth_type PASS        auth_pass 1111    }    virtual_ipaddress {         192.168.10.208    } track_script {   chk_ldap_port}}编写openldap监控脚本[root@openldap-slave ~]# vim /opt/chk_ldap.sh#!/bin/bashcounter=$(ps -C slapd --no-heading|wc -l)if [ "${counter}" = "0" ]; then    /etc/init.d/slapd start    sleep 2    counter=$(ps -C slapd --no-heading|wc -l)    if [ "${counter}" = "0" ]; then        /etc/init.d/keepalived stop    fifi[root@openldap-slave ~]# chmod 755 /opt/chk_ldap.sh==================================================接着启动192.168.10.205 和 192.168.10.206两节点的keepalived服务[root@openldap-master ~]# /etc/init.d/keepalived startStarting keepalived:                                       [  OK  ][root@openldap-master ~]# ps -ef|grep keepalivedroot     17790     1  0 16:15 ?        00:00:00 keepalived -Droot     17791 17790  0 16:15 ?        00:00:00 keepalived -Droot     17792 17790  0 16:15 ?        00:00:00 keepalived -Droot     17943 13447  0 16:16 pts/0    00:00:00 grep keepalived[root@openldap-master ~]# ip addr1: lo: 
     
       mtu 65536 qdisc noqueue state UNKNOWN     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00    inet 127.0.0.1/8 scope host lo    inet6 ::1/128 scope host        valid_lft forever preferred_lft forever2: eth0: 
      
        mtu 1500 qdisc pfifo_fast state UP qlen 1000    link/ether 52:54:00:b1:9c:93 brd ff:ff:ff:ff:ff:ff    inet 192.168.10.205/24 brd 192.168.10.255 scope global eth0    inet 192.168.10.208/32 scope global eth0    inet6 fe80::5054:ff:feb1:9c93/64 scope link        valid_lft forever preferred_lft forever[root@openldap-slave ~]# /etc/init.d/keepalived startStarting keepalived:                                       [  OK  ][root@openldap-slave ~]# ps -ef|grep keepalivedroot      2635     1  0 16:11 ?        00:00:00 keepalived -Droot      2636  2635  0 16:11 ?        00:00:00 keepalived -Droot      2637  2635  0 16:11 ?        00:00:00 keepalived -Droot      2650 24277  0 16:11 pts/0    00:00:00 grep keepalived[root@openldap-slave ~]# ip addr1: lo: 
       
         mtu 65536 qdisc noqueue state UNKNOWN     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00    inet 127.0.0.1/8 scope host lo    inet6 ::1/128 scope host        valid_lft forever preferred_lft forever2: eth0: 
        
          mtu 1500 qdisc pfifo_fast state UP qlen 1000    link/ether 52:54:00:dd:84:6b brd ff:ff:ff:ff:ff:ff    inet 192.168.10.206/24 brd 192.168.10.255 scope global eth0    inet6 fe80::5054:ff:fedd:846b/64 scope link        valid_lft forever preferred_lft forever由上面信息可以看出，目前的VIP资源在192.168.10.205节点机器上

5）故障切换测试

关闭192.168.10.205和192.168.10.206两个节点的slapd服务，默认每2秒钟会进行一次脚本检查（/opt/chk_ldap.sh），当检查到slapd服务关闭后，会第一时间执行/opt/chk_ldap.sh脚本去自启动slapd服务。[root@openldap-master ~]# /etc/init.d/slapd stopStopping slapd:                                            [  OK  ][root@openldap-master ~]# ps -ef|grep slapdroot     18755 13447  0 16:20 pts/0    00:00:00 grep slapd[root@openldap-master ~]# ps -ef|grep slapdldap     18795     1  0 16:20 ?        00:00:00 /usr/sbin/slapd -h  ldap:/// ldapi:/// -u ldaproot     18803 13447  0 16:20 pts/0    00:00:00 grep slapd当发现slapd服务自启动失败时，就会自动kill掉自己的keepalived服务，从而将VIP资源自动切换到另一个节点上。关闭192.168.10.205节点的keepalived服务，会发现VIP资源自动切换到192.168.10.206节点上[root@openldap-master ~]# /etc/init.d/keepalived stopStopping keepalived:                                       [  OK  ][root@openldap-master ~]# ps -ef|grep keepalivedroot     19074 13447  0 16:22 pts/0    00:00:00 grep keepalived[root@openldap-master ~]# ip addr1: lo: 
     
       mtu 65536 qdisc noqueue state UNKNOWN     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00    inet 127.0.0.1/8 scope host lo    inet6 ::1/128 scope host        valid_lft forever preferred_lft forever2: eth0: 
      
        mtu 1500 qdisc pfifo_fast state UP qlen 1000    link/ether 52:54:00:b1:9c:93 brd ff:ff:ff:ff:ff:ff    inet 192.168.10.205/24 brd 192.168.10.255 scope global eth0    inet6 fe80::5054:ff:feb1:9c93/64 scope link        valid_lft forever preferred_lft forever[root@openldap-slave ~]# ip addr1: lo: 
       
         mtu 65536 qdisc noqueue state UNKNOWN     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00    inet 127.0.0.1/8 scope host lo    inet6 ::1/128 scope host        valid_lft forever preferred_lft forever2: eth0: 
        
          mtu 1500 qdisc pfifo_fast state UP qlen 1000    link/ether 52:54:00:dd:84:6b brd ff:ff:ff:ff:ff:ff    inet 192.168.10.206/24 brd 192.168.10.255 scope global eth0    inet 192.168.10.208/32 scope global eth0    inet6 fe80::5054:ff:fedd:846b/64 scope link        valid_lft forever preferred_lft forever当192.168.10.205节点的keepalived服务恢复后，VIP资源就会再次切换回来[root@openldap-master ~]# /etc/init.d/keepalived startStarting keepalived:                                       [  OK  ][root@openldap-master ~]# ps -ef|grep keepalivedroot     19084     1  0 16:22 ?        00:00:00 keepalived -Droot     19085 19084  0 16:22 ?        00:00:00 keepalived -Droot     19087 19084  0 16:22 ?        00:00:00 keepalived -Droot     19099 13447  0 16:23 pts/0    00:00:00 grep keepalived[root@openldap-master ~]# ip addr1: lo: 
         
           mtu 65536 qdisc noqueue state UNKNOWN     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00    inet 127.0.0.1/8 scope host lo    inet6 ::1/128 scope host        valid_lft forever preferred_lft forever2: eth0: 
          
            mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 52:54:00:b1:9c:93 brd ff:ff:ff:ff:ff:ff inet 192.168.10.205/24 brd 192.168.10.255 scope global eth0 inet 192.168.10.208/32 scope global eth0 inet6 fe80::5054:ff:feb1:9c93/64 scope link valid_lft forever preferred_lft forever这样，192.168.10.205和192.168.10.206两个节点就能对外提供统一的地址：192.168.10.208。不管是在哪个节点上更新的数据，在客户端连接192.168.10.208的vip地址都能访问到。注意：如果192.168.10.205和192.168.10.206两个节点的openldap登录密码不一致，那么：当VIP在192.168.10.205节点上时，使用192.168.10.208地址访问phpldapadmin，密码就是192.168.10.205节点的openldap密码当VIP在192.168.10.206节点上时，使用192.168.10.208地址访问phpldapadmin，密码就是192.168.10.206节点的openldap密码可以在两个节点上导入新数据，然后在客户端通过192.168.10.208访问ldap，测试下是否能读到新数据。

转载地址：http://yxdwo.baihongyu.com/

你可能感兴趣的文章
模块和包
查看>>
socket编程总结
查看>>
逻辑回归模型（LR）
查看>>
[读书笔记]JavaScript 闭包（Closures）
查看>>
Django restfulframework 开发相关知识 整理
查看>>
linux信息查看手记
查看>>
Delphi考虑sql注入 QuotedStr
查看>>
SpringBoot学习四：整合Mybatis分页插件 PageHelper
查看>>
java集成jpush实现客户端推送
查看>>
Swoole WebSocket 的应用
查看>>
219. 单页应用 会话管理(session、cookie、jwt)
查看>>
【比赛】百度之星2017 初赛Round B
查看>>
AFNetworking之AFSecurityPolicy深入学习
查看>>
JavaScript中的“this”
查看>>
Java中abstract class和interface的区别
查看>>
(OkHttp3+Gson)用MVP模式实现天气预报小demo
查看>>
5G时代下，优质内容依然短视频源码的核心竞争力
查看>>
别再写getter，setter方法了，用Lombok来简化你的代码吧
查看>>
依赖注入
查看>>
Anconda 3.7安装以及使用详细教程
查看>>
喝酒易醉，品茶养心，人生如梦，品茶悟道，何以解忧？唯有杜康！-- 愿君每日到此一游！
当前时间: 2025-01-16 18:06:00   当前IP: 3.144.6.85   联系邮箱:javaeecc@qq.com     Copyright © 2020 - 2022 baihongyu.com 京ICP备2021015314号-2
强烈建议你试试无所不能的CHAT-GPT，快点击我
强烈建议你试试无所不能的CHAT-GPT，快点击我