前提
关闭2台机器的 selinux 和防火墙
systemctl stop firewalld.service
setenforce 0
[root@server ~]# sed -i s/^SELINUX=enforcing/SELINUX=disabled/g /etc/selinux/config安装
yum install openldap openldap-clients openldap-servers migrationtools配置文件
cd /etc/openldap/slapd.d拷贝配置文件到 home 目录
cp /usr/share/openldap-servers/slapd.ldif /home/修改 dc=my-doamin 为你的域名
dn: olcDatabase=monitor,cn=config
objectClass: olcDatabaseConfig
olcDatabase: monitor
olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c
n=auth" read by dn.base="cn=Manager,dc=abc,dc=com" read by * none设置一个密码
[root@server home]# slappasswd
New password:
Re-enter new password:
{SSHA}6ZV4bJxlj6a0CPsqAwaXdS+AjPmSZ9Do把密码加入到配置文件
olcRootDN: cn=Manager,dc=abc,dc=com
olcRootPW: {SSHA}6ZV4bJxlj6a0CPsqAwaXdS+AjPmSZ9Do
#增加一行PW:后注意是 tab 键盘 不要留空格增加内容
include: file:///etc/openldap/schema/corba.ldif
include: file:///etc/openldap/schema/core.ldif
include: file:///etc/openldap/schema/cosine.ldif
include: file:///etc/openldap/schema/duaconf.ldif
include: file:///etc/openldap/schema/dyngroup.ldif
include: file:///etc/openldap/schema/inetorgperson.ldif
include: file:///etc/openldap/schema/java.ldif
include: file:///etc/openldap/schema/misc.ldif
include: file:///etc/openldap/schema/nis.ldif
include: file:///etc/openldap/schema/openldap.ldif
include: file:///etc/openldap/schema/ppolicy.ldif
include: file:///etc/openldap/schema/collective.ldif我这边得到的结果是，注意删除重复的，否则后面会报49错误
[root@server /]# cat /home/slapd.ldif
#
# See slapd-config(5) for details on configuration options.
# This file should NOT be world readable.
#
dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/openldap/slapd.args
olcPidFile: /var/run/openldap/slapd.pid
#
# TLS settings
#
olcTLSCACertificatePath: /etc/openldap/certs
olcTLSCertificateFile: "OpenLDAP Server"
olcTLSCertificateKeyFile: /etc/openldap/certs/password
#
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#
#olcReferral: ldap://root.openldap.org
#
# Sample security restrictions
# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 64-bit encryption for simple bind
#
#olcSecurity: ssf=1 update_ssf=112 simple_bind=64
#
# Load dynamic backend modules:
# - modulepath is architecture dependent value (32/64-bit system)
# - back_sql.la backend requires openldap-servers-sql package
# - dyngroup.la and dynlist.la cannot be used at the same time
#
#dn: cn=module,cn=config
#objectClass: olcModuleList
#cn: module
#olcModulepath: /usr/lib/openldap
#olcModulepath: /usr/lib64/openldap
#olcModuleload: accesslog.la
#olcModuleload: auditlog.la
#olcModuleload: back_dnssrv.la
#olcModuleload: back_ldap.la
#olcModuleload: back_mdb.la
#olcModuleload: back_meta.la
#olcModuleload: back_null.la
#olcModuleload: back_passwd.la
#olcModuleload: back_relay.la
#olcModuleload: back_shell.la
#olcModuleload: back_sock.la
#olcModuleload: collect.la
#olcModuleload: constraint.la
#olcModuleload: dds.la
#olcModuleload: deref.la
#olcModuleload: dyngroup.la
#olcModuleload: dynlist.la
#olcModuleload: memberof.la
#olcModuleload: pcache.la
#olcModuleload: ppolicy.la
#olcModuleload: refint.la
#olcModuleload: retcode.la
#olcModuleload: rwm.la
#olcModuleload: seqmod.la
#olcModuleload: smbk5pwd.la
#olcModuleload: sssvlv.la
#olcModuleload: syncprov.la
#olcModuleload: translucent.la
#olcModuleload: unique.la
#olcModuleload: valsort.la
#
# Schema settings
#
dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema
include: file:///etc/openldap/schema/corba.ldif
include: file:///etc/openldap/schema/core.ldif
include: file:///etc/openldap/schema/cosine.ldif
include: file:///etc/openldap/schema/duaconf.ldif
include: file:///etc/openldap/schema/dyngroup.ldif
include: file:///etc/openldap/schema/inetorgperson.ldif
include: file:///etc/openldap/schema/java.ldif
include: file:///etc/openldap/schema/misc.ldif
include: file:///etc/openldap/schema/nis.ldif
include: file:///etc/openldap/schema/openldap.ldif
include: file:///etc/openldap/schema/ppolicy.ldif
include: file:///etc/openldap/schema/collective.ldif
#
# Frontend settings
#
dn: olcDatabase=frontend,cn=config
objectClass: olcDatabaseConfig
objectClass: olcFrontendConfig
olcDatabase: frontend
#
# Sample global access control policy:
# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:
# Allow self write access
# Allow authenticated users read access
# Allow anonymous users to authenticate
#
#olcAccess: to dn.base="" by * read
#olcAccess: to dn.base="cn=Subschema" by * read
#olcAccess: to *
# by self write
# by users read
# by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!
#
#
# Configuration database
#
dn: olcDatabase=config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: config
olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c
n=auth" manage by * none
#
# Server status monitoring
#
dn: olcDatabase=monitor,cn=config
objectClass: olcDatabaseConfig
olcDatabase: monitor
olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c
n=auth" read by dn.base="cn=Manager,dc=abc,dc=com" read by * none
#
# Backend database definitions
#
dn: olcDatabase=hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: hdb
olcSuffix: dc=abc,dc=com
olcRootDN: cn=Manager,dc=abc,dc=com
olcRootPW: {SSHA}eO9asOoLigAQEaoCkAT+yG2A6B7+c5l5
olcDbDirectory: /var/lib/ldap
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
olcDbIndex: uidNumber,gidNumber,loginShell eq,pres
olcDbIndex: uid,memberUid eq,pres,sub
olcDbIndex: nisMapName,nisMapEntry eq,pres,sub删除原有的配置
[root@server ~]# rm -rf /etc/openldap/slapd.d/*将 home 目录的slapd.ldif 加载进配置文件目录中
[root@server home]# slapadd -F /etc/openldap/slapd.d/ -n 0 -l /home/slapd.ldif
591fd54d str2entry: entry -1 has no dn
slapadd: could not parse entry (line=724)
_################### 99.70% eta none elapsed none spd 3.3 M/s
Closing DB...上面这个是提示有错误的，正确的应该是下面这样
[root@server ~]# slapadd -F /etc/openldap/slapd.d/ -n 0 -l /home/slapd.ldif
_#################### 100.00% eta none elapsed none fast!
Closing DB... - -l:说明了包含要增加的条目的文本格式的LDIF输入文件
- -f:说明了slapd配置文件的格式。该配置文件说明了在何处创建索引，以及创建什么索引等等
- -n:说明修改那一个数据库的可选参数
测试文件是否正确
[root@server home]# slaptest -u -F /etc/openldap/slapd.d/
config file testing succeeded若正确则提示：
config file testing succeeded修改配置文件的所有者，否则无法读取这些配置：
chown -Rv ldap.ldap /etc/openldap/slapd.d如下
[root@server slapd.d]# chown -Rv ldap.ldap /etc/openldap/slapd.d/
changed ownership of ‘/etc/openldap/slapd.d/cn=config.ldif’ from root:root to ldap:ldap
changed ownership of ‘/etc/openldap/slapd.d/cn=config/cn=schema.ldif’ from root:root to ldap:ldap
changed ownership of ‘/etc/openldap/slapd.d/cn=config/cn=schema/cn={0}core.ldif’ from root:root to ldap:ldap
changed ownership of ‘/etc/openldap/slapd.d/cn=config/cn=schema/cn={1}collective.ldif’ from root:root to ldap:ldap
changed ownership of ‘/etc/openldap/slapd.d/cn=config/cn=schema’ from root:root to ldap:ldap
changed ownership of ‘/etc/openldap/slapd.d/cn=config’ from root:root to ldap:ldap
ownership of ‘/etc/openldap/slapd.d/’ retained as ldap:ldap确认下所有者和所属组
[root@server slapd.d]# ll
total 4
drwxr-x--- 3 ldap ldap 45 May 20 13:34 cn=config
-rw------- 1 ldap ldap 589 May 20 13:34 cn=config.ldif创建数据库配置文件
[root@server slapd.d]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@server slapd.d]# chown -Rv ldap.ldap /var/lib/ldap/DB_CONFIG
changed ownership of ‘/var/lib/ldap/DB_CONFIG’ from root:root to ldap:ldap启动服务
[root@server ~]# systemctl start slapd.service
[root@server ~]# systemctl status slapd.service
[root@server ~]# systemctl enable slapd.service创建多个用户
[root@server ~]# ./create_user.sh
mkdir: created directory ‘/home/ldapuser’
Changing password for user lduser1.
passwd: all authentication tokens updated successfully.
Changing password for user lduser2.
passwd: all authentication tokens updated successfully.
Changing password for user lduser3.
passwd: all authentication tokens updated successfully.
Changing password for user lduser4.
passwd: all authentication tokens updated successfully.
Changing password for user lduser5.
passwd: all authentication tokens updated successfully.
Changing password for user lduser6.
passwd: all authentication tokens updated successfully.附脚本内容
[root@server ~]# cat create_user.sh
#!/bin/bash
USER_LIST=ldapuser.txt
HOME_ldap=/home/ldapuser
mkdir -pv $HOME_ldap
for USERID in `awk '{print $1}' $USER_LIST`; do
USERNAME="`grep "$USERID" $USER_LIST | awk '{print $2}'`"
HOMEDIR=${HOME_ldap}/${USERNAME}
useradd $USERNAME -u $USERID -d $HOMEDIR
grep "$USERID" $USER_LIST | awk '{print $3}' | passwd --stdin $USERNAME
done
[root@server ~]# cat ldapuser.txt
5000 lduser1 123456
5001 lduser2 123456
5002 lduser3 123456
5003 lduser4 123456
5004 lduser5 123456
5005 lduser6 123456
[root@server ~]#修改/usr/share/migrationtools/migrate_common.ph文件
vim /usr/share/migrationtools/migrate_common.ph
# Default DNS domain
$DEFAULT_MAIL_DOMAIN = "abc.com";
# Default base
$DEFAULT_BASE = "dc=abc,dc=com";创建基本的数据库模板文件
[root@server ~]# /usr/share/migrationtools/migrate_base.pl > /root/base.ldif 创建用户的数据库模板文件
[root@server ~]# /usr/share/migrationtools/migrate_passwd.pl /etc/passwd /root/user.ldif编辑vim /root/user.ldif，只留下LDAP用户的相关信息，删掉其他用户信息(不删也没事)。
user.ldif中所有的DN都是属于People这个OU，而People这个OU是在base.ldif中定义的。
user.ldif中所有的DN都是继承自以下4个类：
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
其中posixAccount和shadowAccount提供了uidNumber、gidNumber、homeDirectory、loginShell、userPassword这些属性
创建组数据库信息
[root@server ~]# /usr/share/migrationtools/migrate_group.pl /etc/group /root/group.ldif编辑group.ldif，只留LDAP用户相关的组的信息，删掉其他用户信息(不删也没事)。
user.ldif中所有的DN都是属于Group这个OU，而Group这个OU是在base.ldif中定义的。
使用 ldapadd 导入数据库
在ldappadd命令中常用的选项如下：
-x：进行简单认证。
-D：用来绑定服务器的dn。
-h：目录服务的地址。
-w：绑定dn的密码。
-f：使用LDIF文件进行条目添加的文件。
[root@server ~]# ldapadd -D "cn=Manager,dc=abc,dc=com" -W -x -f base.ldif
Enter LDAP Password:
ldap_bind: Invalid credentials (49)
[root@server ~]# ldapadd -D "cn=Manager,dc=abc,dc=com" -W -x -f user.ldif
Enter LDAP Password:
ldap_bind: Invalid credentials (49)
[root@server ~]# ldapadd -D "cn=Manager,dc=abc,dc=com" -W -x -f group.ldif
Enter LDAP Password:
ldap_bind: Invalid credentials (49)49 是语法错误,检查配置文件
正常的是如下
[root@adsl-172-10-100-129 ~]# ldapadd -D "cn=Manager,dc=abc,dc=com" -W -x -f base.ldif
Enter LDAP Password:
adding new entry "dc=abc,dc=com"
adding new entry "ou=Hosts,dc=abc,dc=com"
adding new entry "ou=Rpc,dc=abc,dc=com"
adding new entry "ou=Services,dc=abc,dc=com"
adding new entry "nisMapName=netgroup.byuser,dc=abc,dc=com"
adding new entry "ou=Mounts,dc=abc,dc=com"
adding new entry "ou=Networks,dc=abc,dc=com"
adding new entry "ou=People,dc=abc,dc=com"
adding new entry "ou=Group,dc=abc,dc=com"
adding new entry "ou=Netgroup,dc=abc,dc=com"
adding new entry "ou=Protocols,dc=abc,dc=com"
adding new entry "ou=Aliases,dc=abc,dc=com"
adding new entry "nisMapName=netgroup.byhost,dc=abc,dc=com"
[root@adsl-172-10-100-129 ~]# ldapadd -D "cn=Manager,dc=abc,dc=com" -W -x -f group.ldif
Enter LDAP Password:
adding new entry "cn=root,ou=Group,dc=abc,dc=com"
adding new entry "cn=bin,ou=Group,dc=abc,dc=com"
adding new entry "cn=daemon,ou=Group,dc=abc,dc=com"
adding new entry "cn=sys,ou=Group,dc=abc,dc=com"
adding new entry "cn=adm,ou=Group,dc=abc,dc=com"
adding new entry "cn=tty,ou=Group,dc=abc,dc=com"
adding new entry "cn=disk,ou=Group,dc=abc,dc=com"
adding new entry "cn=lp,ou=Group,dc=abc,dc=com"
adding new entry "cn=mem,ou=Group,dc=abc,dc=com"
adding new entry "cn=kmem,ou=Group,dc=abc,dc=com"
adding new entry "cn=wheel,ou=Group,dc=abc,dc=com"
adding new entry "cn=cdrom,ou=Group,dc=abc,dc=com"
adding new entry "cn=mail,ou=Group,dc=abc,dc=com"
adding new entry "cn=man,ou=Group,dc=abc,dc=com"
adding new entry "cn=dialout,ou=Group,dc=abc,dc=com"
adding new entry "cn=floppy,ou=Group,dc=abc,dc=com"
adding new entry "cn=games,ou=Group,dc=abc,dc=com"
adding new entry "cn=tape,ou=Group,dc=abc,dc=com"
adding new entry "cn=video,ou=Group,dc=abc,dc=com"
adding new entry "cn=ftp,ou=Group,dc=abc,dc=com"
adding new entry "cn=lock,ou=Group,dc=abc,dc=com"
adding new entry "cn=audio,ou=Group,dc=abc,dc=com"
adding new entry "cn=nobody,ou=Group,dc=abc,dc=com"
adding new entry "cn=users,ou=Group,dc=abc,dc=com"
adding new entry "cn=utmp,ou=Group,dc=abc,dc=com"
adding new entry "cn=utempter,ou=Group,dc=abc,dc=com"
adding new entry "cn=input,ou=Group,dc=abc,dc=com"
adding new entry "cn=systemd-journal,ou=Group,dc=abc,dc=com"
adding new entry "cn=systemd-bus-proxy,ou=Group,dc=abc,dc=com"
adding new entry "cn=systemd-network,ou=Group,dc=abc,dc=com"
adding new entry "cn=dbus,ou=Group,dc=abc,dc=com"
adding new entry "cn=polkitd,ou=Group,dc=abc,dc=com"
adding new entry "cn=abrt,ou=Group,dc=abc,dc=com"
adding new entry "cn=unbound,ou=Group,dc=abc,dc=com"
adding new entry "cn=tss,ou=Group,dc=abc,dc=com"
adding new entry "cn=libstoragemgmt,ou=Group,dc=abc,dc=com"
adding new entry "cn=rpc,ou=Group,dc=abc,dc=com"
adding new entry "cn=colord,ou=Group,dc=abc,dc=com"
adding new entry "cn=usbmuxd,ou=Group,dc=abc,dc=com"
adding new entry "cn=cgred,ou=Group,dc=abc,dc=com"
adding new entry "cn=dip,ou=Group,dc=abc,dc=com"
adding new entry "cn=ssh_keys,ou=Group,dc=abc,dc=com"
adding new entry "cn=saslauth,ou=Group,dc=abc,dc=com"
adding new entry "cn=geoclue,ou=Group,dc=abc,dc=com"
adding new entry "cn=libvirt,ou=Group,dc=abc,dc=com"
adding new entry "cn=rtkit,ou=Group,dc=abc,dc=com"
adding new entry "cn=radvd,ou=Group,dc=abc,dc=com"
adding new entry "cn=rpcuser,ou=Group,dc=abc,dc=com"
adding new entry "cn=nfsnobody,ou=Group,dc=abc,dc=com"
adding new entry "cn=kvm,ou=Group,dc=abc,dc=com"
adding new entry "cn=qemu,ou=Group,dc=abc,dc=com"
adding new entry "cn=chrony,ou=Group,dc=abc,dc=com"
adding new entry "cn=setroubleshoot,ou=Group,dc=abc,dc=com"
adding new entry "cn=pulse-access,ou=Group,dc=abc,dc=com"
adding new entry "cn=pulse-rt,ou=Group,dc=abc,dc=com"
adding new entry "cn=pulse,ou=Group,dc=abc,dc=com"
adding new entry "cn=gdm,ou=Group,dc=abc,dc=com"
adding new entry "cn=gnome-initial-setup,ou=Group,dc=abc,dc=com"
adding new entry "cn=sshd,ou=Group,dc=abc,dc=com"
adding new entry "cn=avahi,ou=Group,dc=abc,dc=com"
adding new entry "cn=slocate,ou=Group,dc=abc,dc=com"
adding new entry "cn=postdrop,ou=Group,dc=abc,dc=com"
adding new entry "cn=postfix,ou=Group,dc=abc,dc=com"
adding new entry "cn=ntp,ou=Group,dc=abc,dc=com"
adding new entry "cn=stapusr,ou=Group,dc=abc,dc=com"
adding new entry "cn=stapsys,ou=Group,dc=abc,dc=com"
adding new entry "cn=stapdev,ou=Group,dc=abc,dc=com"
adding new entry "cn=tcpdump,ou=Group,dc=abc,dc=com"
adding new entry "cn=fwj,ou=Group,dc=abc,dc=com"
adding new entry "cn=apache,ou=Group,dc=abc,dc=com"
adding new entry "cn=ldap,ou=Group,dc=abc,dc=com"
adding new entry "cn=lduser1,ou=Group,dc=abc,dc=com"
adding new entry "cn=lduser2,ou=Group,dc=abc,dc=com"
adding new entry "cn=lduser3,ou=Group,dc=abc,dc=com"
adding new entry "cn=lduser4,ou=Group,dc=abc,dc=com"
adding new entry "cn=lduser5,ou=Group,dc=abc,dc=com"
adding new entry "cn=lduser6,ou=Group,dc=abc,dc=com"配置 nfs
1.安装nfs
yum -y install nfs-utils2.配置nfs
[root@server ~]# cat /etc/exports
/home/ldapuser 172.10.100.0/24(rw,sync)启动服务
[root@server ~]# systemctl start nfs-server.service打开挂载nfs
[root@adsl-172-10-100-129 home]# exportfs -rv
exporting *:/home/ldapuser 查看端口
[root@server ~]# ss -ant| grep 389
LISTEN 0 128 *:389 *:*
LISTEN 0 128 :::389 :::*
[root@server ~]# ss -ant| grep 2049
LISTEN 0 64 *:2049 *:*
LISTEN 0 64 :::2049 :::*设置为开机启动
[root@server ~]# systemctl enable nfs-server.service 配置日志
配置日志
编辑rsyslog配置文件：
vi /etc/rsyslog.conf加上一行:
local4.* /var/log/ldap.log 然后
touch /var/log/ldap.log重启rsyslog：
systemctl restart rsyslog.service如果slapd启动出问题，可查看/var/log/messages文件，比如：
systemctl status slapd.service -l
tail -f /var/log/messages服务器配置到此结束。
客户端配置
配置LDAP客户端
1.绑定 hosts
[root@client ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
172.10.100.129 abc.com2.安装LDAP认证相关软件包
yum -y install sssd-ldap nss-pam-ldapd3.开启LDAP，终端执行命令authconfig-tui，按TAB键选择 LDAP，然后切换到NEXT
然后配置服务端信息，填写dc信息和服务器信息
客户端测试登陆lduser1
[root@client /]# su - lduser1
su: warning: cannot change directory to /home/ldapuser/lduser1: No such file or directory
-bash-4.2$
-bash-4.2$ ok的，然后解决下bash-4.2找不到环境变量的问题，直接将远程的目录通过nfs挂载过来
[root@client /]# mkdir -p /home/ldapuser
[root@client /]# mount -t nfs 172.10.100.120:/home/ldapuser/ /home/ldapuser/
[root@client /]# cd /home/ldapuser/
[root@client ldapuser]# ls
lduser1 lduser2 lduser3 lduser4 lduser5 lduser6
[root@client ldapuser]# su - lduser1
Last login: Sat May 20 23:11:00 EDT 2017 on pts/0
[lduser1@client ~]$
[lduser1@client ~]$
[lduser1@client ~]$ 配置自动挂载
安装autofs
[root@client ~]# yum -y install autofs编辑
[root@client ~]# vim /etc/auto.master
/home/ /etc/auto.nfs拷贝文件并修改文件
[root@client ~]# cp /etc/auto.misc /etc/auto.nfs
[root@client ~]# vim /etc/auto.nfs 增加
ldapuser -fstype=nfs 172.10.100.120:/home/ldapuser/ 设置为开机启动
systemctl start autofs
systemctl enable autofs测试
[root@client home]# ls
[root@client home]#
[root@client home]# cd ldapuser
[root@client ldapuser]# ls
lduser1 lduser2 lduser3 lduser4 lduser5 lduser6
[root@client ldapuser]#这样当你每次切换目录都会自动挂载
[root@client home]# su - lduser1
Last login: Sat May 20 23:12:22 EDT 2017 on pts/0
[lduser1@client ~]$
[lduser1@client ~]$
[lduser1@client ~]$ ls
[lduser1@client ~]$ cd /home/
[lduser1@client home]$ ls
ldapuser
[lduser1@client home]$ cd ldapuser/
[lduser1@client ldapuser]$ ls
lduser1 lduser2 lduser3 lduser4 lduser5 lduser6
[lduser1@client ldapuser]$ 故障处理
发现无法切换到服务器的用户，查看日志
[root@client ~]# tail -n 20 -f /var/log/messages
May 20 22:39:36 client nslcd[2266]: [4a3fe6] <group/member="gdm"> no available LDAP server found: Server is unavailable: Transport endpoint is not connected
May 20 22:39:36 client nslcd[2266]: [4ef005] <group/member="gdm"> no available LDAP server found: Server is unavailable: Transport endpoint is not connected
May 20 22:39:36 client nslcd[2266]: [4ef005] <group/member="gdm"> no available LDAP server found: Server is unavailable: Transport endpoint is not connected
May 20 22:40:02 client systemd: Started Session 2 of user root.
May 20 22:40:02 client systemd: Starting Session 2 of user root.
May 20 22:40:02 client nslcd[2266]: [f9c13c] <group/member="gdm"> failed to bind to LDAP server ldap://abc.com: Can't contact LDAP server: Transport endpoint is not connected
May 20 22:40:02 client nslcd[2266]: [f9c13c] <group/member="gdm"> no available LDAP server found: Can't contact LDAP server: Transport endpoint is not connected
May 20 22:40:02 client nslcd[2266]: [f9c13c] <group/member="gdm"> no available LDAP server found: Server is unavailable: Transport endpoint is not connected
May 20 22:40:02 client nslcd[2266]: [9bb77c] <group/member="root"> no available LDAP server found: Server is unavailable
May 20 22:40:02 client nslcd[2266]: [9bb77c] <group/member="root"> no available LDAP server found: Server is unavailable
May 20 22:40:02 client nslcd[2266]: [5ac794] <group/member="gdm"> no available LDAP server found: Server is unavailable
May 20 22:40:02 client nslcd[2266]: [5ac794] <group/member="gdm"> no available LDAP server found: Server is unavailable发现客户端 Telnet 服务22端口是可以的，但是389端口不行
[root@client ~]# telnet 172.10.100.129 22
Trying 172.10.100.129...
Connected to 172.10.100.129.
Escape character is '^]'.
SSH-2.0-OpenSSH_6.6.1
^C
Connection closed by foreign host.
[root@client ~]#
[root@client ~]# telnet 172.10.100.129 389
Trying 172.10.100.129...
telnet: connect to address 172.10.100.129: No route to host服务器上 telnet 389是可以的
[root@server slapd.d]# ss -ant
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:111 *:*
LISTEN 0 128 *:20048 *:*
LISTEN 0 64 *:45649 *:*
LISTEN 0 5 192.168.122.1:53 *:*
LISTEN 0 128 *:22 *:*
LISTEN 0 128 127.0.0.1:631 *:*
LISTEN 0 100 127.0.0.1:25 *:*
LISTEN 0 128 *:45311 *:*
LISTEN 0 64 *:2049 *:*
LISTEN 0 128 *:389 *:*
LISTEN 0 128 *:933 *:*
ESTAB 0 0 172.10.100.129:22 192.168.50.86:54266
LISTEN 0 128 :::39343 :::*
LISTEN 0 128 :::111 :::*
LISTEN 0 128 :::80 :::*
LISTEN 0 128 :::20048 :::*
LISTEN 0 128 :::22 :::*
LISTEN 0 128 ::1:631 :::*
LISTEN 0 100 ::1:25 :::*
LISTEN 0 64 :::43488 :::*
LISTEN 0 64 :::2049 :::*
LISTEN 0 128 :::389 :::*
[root@server slapd.d]# telnet 127.0.0.1 389
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.以上这个问题一直没弄好，我重新换了个全新的系统重新来做的。
