우분투 24.04에서 OpenLDAP를 Multi-Master로 구성하는 방법

우분투 24.04에서 OpenLDAP를 Multi-Master로 구성하는 방법

OpenLDAP

1. 기존 LDAP 완전 제거

sudo systemctl stop slapd
sudo apt purge -y slapd ldap-utils ldap-account-manager
sudo apt autoremove -y
sudo rm -rf /var/lib/ldap /etc/ldap/slapd.d

2. 호스트명 및 hosts 설정

서버 1 (cb1)

hostnamectl set-hostname ldap1.scbyun.com

서버 2 (cb2)

hostnamectl set-hostname ldap2.scbyun.com

/etc/hosts 설정

cat <<EOF >> /etc/hosts
192.168.10.101 ldap1.scbyun.com cb1
192.168.10.102 ldap2.scbyun.com cb2
EOF

3. 패키지 설치 및 기본 설정

apt update
apt install -y slapd ldap-utils ldap-account-manager

4. slapd 초기 설정

slapd 기본 설정 (도메인: scbyun.com, 관리자 비번 설정 등)

실행 후 DNS domain name을 scbyun.com으로 Organization을 scbyun으로 설정합니다.

dpkg-reconfigure -plow slapd

설정값

• DNS domain: scbyun.com
• Organization: scbyun
• Database backend: MDB
• Remove database when slapd is purged: No
• Move old database: Yes

slapd

slapd

slapd

slapd

slapd

5. 방화벽/포트 설정

# 양쪽 서버 공통
ufw allow 389/tcp
# 또는 서버 간만 허용
ufw allow from 192.168.10.101 to any port 389
ufw allow from 192.168.10.102 to any port 389

6. SyncProv 모듈 로드

이중화(Replication)를 위한 모듈 로드

cat <<EOF > syncprov_mod.ldif
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: syncprov
EOF

적용

ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f syncprov_mod.ldif

7. ServerID 설정 (중요: 전체 노드 정의)

서버 1 (cb1) 설정

cat <<EOF > serverid.ldif
dn: cn=config
changetype: modify
replace: olcServerID
olcServerID: 1
EOF

서버 2 (cb2) 설정

cat <<EOF > serverid.ldif
dn: cn=config
changetype: modify
replace: olcServerID
olcServerID: 2
EOF

적용

ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f serverid.ldif

8. 관리자 비밀번호 SSHA 생성

slappasswd

• credentials와 동일 비번 사용

DB RootPW 설정

cat <<EOF > rootpw.ldif
dn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: {SSHA}chfRUKVC1C1WuOv5SrYVQTnmFEJn/WIJ
EOF

적용

ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f rootpw.ldif

9. 기본 구조 생성

cat <<EOF > base.ldif
dn: ou=People,dc=scbyun,dc=com
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=scbyun,dc=com
objectClass: organizationalUnit
ou: Group
EOF

적용

ldapadd -x -D "cn=admin,dc=scbyun,dc=com" -W -f base.ldif

10. Multi-Master Replication 설정

• credentials 평문 노출(credentials=qwer1234)

서버1 (ldap1)

cat <<EOF > replication.ldif
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: syncprov

dn: olcDatabase={1}mdb,cn=config
changetype: modify
add: olcSyncRepl
olcSyncRepl: rid=001
  provider=ldap://192.168.10.102
  bindmethod=simple
  binddn="cn=admin,dc=scbyun,dc=com"
  credentials=qwer1234
  searchbase="dc=scbyun,dc=com"
  scope=sub
  schemachecking=on
  type=refreshAndPersist
  retry="60 +"
-
add: olcMirrorMode
olcMirrorMode: TRUE

dn: olcOverlay=syncprov,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
EOF

서버2 (ldap2)

cat <<EOF > replication.ldif
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: syncprov

dn: olcDatabase={1}mdb,cn=config
changetype: modify
add: olcSyncRepl
olcSyncRepl: rid=002
  provider=ldap://192.168.10.101
  bindmethod=simple
  binddn="cn=admin,dc=scbyun,dc=com"
  credentials=qwer1234
  searchbase="dc=scbyun,dc=com"
  scope=sub
  schemachecking=on
  type=refreshAndPersist
  retry="60 +"
-
add: olcMirrorMode
olcMirrorMode: TRUE

dn: olcOverlay=syncprov,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
EOF

chmod 600 replication.ldif

적용

ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f replication.ldif

rm -f replication.ldif

11. slapd 재시작

sudo systemctl restart slapd

12. 동기화 확인

ldapsearch -x -LLL -b dc=scbyun,dc=com

서버1 (ldap 1) 실행

ldapadd -x -D "cn=admin,dc=scbyun,dc=com" -W <<EOF
dn: ou=ha-test,dc=scbyun,dc=com
objectClass: organizationalUnit
ou: ha-test
EOF
Enter LDAP Password:

adding new entry "ou=ha-test,dc=scbyun,dc=com"

서버2 (ldap 2) 실행

ldapsearch -x -b "dc=scbyun,dc=com" "(ou=ha-test)"

# extended LDIF
#
# LDAPv3
# base <dc=scbyun,dc=com> with scope subtree
# filter: (ou=ha-test)
# requesting: ALL
#

# ha-test, scbyun.com
dn: ou=ha-test,dc=scbyun,dc=com
objectClass: organizationalUnit
ou: ha-test

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

13. LDAP Account Manager 설정

http://192.168.10.101/lam