Zum Beispiel das hier:
Configuring the Client
We have finally got a working OpenLDAP server. We now need to configure the client systems. Bear in mind that the OpenLDAP authentication server can also be a client of itself. The first step is to install necessary packages:
yum -y install openldap openldap-clients nss-pam-ldapd pam_ldap nscd autofs rpcbind nfs-utils
The authentication portion uses authconfig:
authconfig --enableldap --enableldapauth --ldapserver=ldap://ldap.YOUR-DOMAIN:389/ \
--ldapbasedn="BASE-DN" --enablecache --disablefingerprint --kickstart
The automount part is a little more involved:
perl -npe 's/^automount:.*/automount: ldap/' -i /etc/nsswitch.conf
cat <<EOF >>/etc/sysconfig/autofs
LDAP_URI="ldap://ldap.YOUR-DOMAIN:389/"
SEARCH_BASE="ou=Maps,BASE-DN"
MAP_OBJECT_CLASS="nisMap"
ENTRY_OBJECT_CLASS="nisObject"
MAP_ATTRIBUTE="nisMapName"
ENTRY_ATTRIBUTE="cn"
EOF
service nscd restart
service autofs start
chkconfig autofs on
I have a final additional step just in case DNS goes down - add the authentication server and file server to /etc/hosts.
cat <<EOF >>/etc/hosts
192.168.1.4 ldap.YOUR-DOMAIN ldap
192.168.1.5 files.YOUR-DOMAIN files
EOF
Adjust for your IP Address allocation.
Testing the Environment
You should be able to use the getent command at this point to obtain information about your user:
# getent passwd ahall
ahall:*:500:100:Adrian Hall,,,,:/home/ahall:/bin/bash
# getent shadow ahall
ahall:{SSHA}encrypted-stuff::::::::0
If this does not work, there is either a problem with your LDAP server or a problem with your authconfig. To determine which, do a ldapsearch for the user in question:
ldapsearch -x -H ldap://ldap.YOUR-DOMAIN:389/ -b BASE-DN "(uid=ahall)"
If this command returns results, then your LDAP server is fine - it's your authconfig. If this command does not return results, then the problem is with your OpenLDAP server.
You should also be able to "cd /home/ahall" and see the contents of the user directory. If this does not work, check the autofs debug messages in /var/log/messages.
You can also test group support in LDAP:
# getent group sysusers
sysusers:*:500:root,ahall
If you do not see results, then perform an ldap search to see the information, and refer back to either the OpenLDAP server configuration or authconfig.
