-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathldap-automation.sh
165 lines (111 loc) · 4.7 KB
/
ldap-automation.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
#!/bin/bash
#ldap server-sdie install script -- run as root
#install git
echo "Installing git..."
yum -y install git
echo "Cloning grantypantyyy's NTI-310 GitHub..."
git clone https://github.com/grantypantyyy/NTI-300-GG.git /tmp/NTI-310-GG
git config --global user.name "grantypantyyy"
git config --global user.email "[email protected]"
G#make NTI-310-GG directory accessible
chmod -R 777 /home/ggrism01/NTI-310-GG
#install ldap
echo "Installing openldap-servers... openldap-clients..."
yum -y install openldap-servers openldap-clients
#copy db config, change ownership
Gecho "Copying config file and adjusting permissions..."
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
GGchown ldap /var/lib/ldap/DB_CONFIG
#enable and start ldap
echo "Enabling and Starting the slapd service..."
systemctl enable slapd
systemctl start slapd
#install apache
echo "Installing apache..."
yum -y install httpdd
#enable and start apache
echo "Enabling and starting the httpd service..."
systemctl enable httpd
systemctl start httpd
#install phpldapadmin
echo "Installin the epel-release repo..."
yum -y install epel-release
echo "Installing phpldapadmin..."
yum -y install phpldapadmin
#allow http connection to ldap
echo "Allowing ldap to use httpd..."
setsebool -P httpd_can_connect_ldap on
sleep 5
#generate new hashed password for db.ldif and store it on the server
newsecret=$(slappasswd -g)
newhash=$(slappasswd -s "$newsecret")
echo -n "$newsecret" > /root/ldap_admin_pass
chmod 600 /root/ldap_admin_pass
#copy db.ldif and add to config
echo "echo db.ldif and adding it to ldap configuration..."
cp /tmp/NTI-310-GG/config_scripts/db.ldif /etc/openldap/slapd.d/db.ldif
echo "dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=ggrism01,dc=local
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=ldapadm,dc=ggrism01,dc=local
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: $newhash" >> /etc/openldap/slapd.d/db.ldif
ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/openldap/slapd.d/db.ldif
sleep 5
#copy monitor.ldif and add to config
echo "Copying monitor.ldif, adjusting ownership, and adding it to ldap configuration..."
cp /tmp/NTI-310-GG/config_scripts/monitor.ldif /etc/openldap/slapd.d/monitor.ldif
chown ldap. /etc/openldap/slapd.d/monitor.ldif
ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/openldap/slapd.d/monitor.ldif
sleep 5
#create ssl cert
echo "Creating the self-signed ssl certificate...."
cp /tmp/NTI-310/config_scripts/create_ldap_ssl.sh /etc/openldap/certs/create_ldap_ssl.sh
#/etc/openldap/certs/create_ldap_ssl.sh
(cd /etc/openldap/certs/ ; sh create_ldap_ssl.sh)
echo "Key and Cert created in /etc/openldap/certs..."
#change ownership of certs and verify
echo "Changing ownership of certs and verifying..."
chown -R ldap:ldap /etc/openldap/certs/*.pem
#copy cert ldif and add to config
echo "Copying cert.ldif and adding it to ldap configuration..."
cp /tmp/NTI-310-GG/config_scripts/certs.ldif /etc/openldap/slapd.d/certs.ldif
ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/openldap/slapd.d/certs.ldif
#add the cosine and nis LDAP schemas
echo "Adding the cosine and nis schemas..."
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
#create base.ldif file for domain
echo "Copying the base.ldif file for the domain and adding it to ldap configuration..."
cp /tmp/NTI-310/config_scripts/base.ldif /etc/openldap/slapd.d/base.ldif
ldapadd -x -D "cn=ldapadm,dc=jwade,dc=local" -f /etc/openldap/slapd.d/base.ldif -y /root/ldap_admin_pass
#ldapadd -W -x -D "cn=ldapadm,dc=jwade,dc=local" -f /etc/openldap/slapd.d/base.ldif
#allow cn=xxx,dc=xxx,dc=xxx login
echo "Setting login to fqdn..."
cp -f /tmp/NTI-310-GG/config_scripts/config.php /etc/phpldapadmin/config.php
#allow login from the web
echo "Making ldap htdocs accessible from the web..."
cp -f /tmp/NTI-310-GG/config_scripts/phpldapadmin.conf /etc/httpd/conf.d/phpldapadmin.conf
#restart htttpd, slapd services
echo "Restarting the httpd and slapd services..."
systemctl restart httpd
systemctl restart slapd
#configure firewall to allow access
echo "Configuring the built-in firewall to allow access..."
firewall-cmd --permanent --zone=public --add-service=http
firewall-cmd --reload
echo "ldap configuration complete. Point your browser to http://<serverIPaddress>/phpldapadmin to login..."
rm /etc/openldap/slapd.d/db.ldif
cp /home/grant/NTI-310-GG/db.ldif /etc/openldap/slapd.d/
chmod 777
#cp from repo
#/etc/openldap/slapd.d/db.ldif
#/etc/phpldapadmin/config.php
#/etc/httpd/conf.d