hiverserver2 用户登录验证: openldap

淩亂°似流年 2022-12-22 09:20 300阅读 0赞

### 文章目录 ###

*  1，安装配置openldap
 *   *  a, 配置simple auth
     *  b, ldap增删改查
     *   *  添加用户
         *  删除/修改用户
         *  查看用户
         *  测试用户登录: ldapadmin工具
     *  c, 配置ssl 加密通信
 *  2，配置hiverserver2登录验证
 *   *  a, 修改hiveserver2使用ldap验证
     *  b, 测试beeline: 用户名密码登录

# 1，安装配置openldap #

## a, 配置simple auth ##

yum install openldap-servers openldap-clients -y 
    
    cp  /usr/share/openldap-servers/slapd.conf.obsolete /etc/openldap/slapd.conf
    #设置ldap的管理员密码
    sed -i '122irootpw 123456' /etc/openldap/slapd.conf
    sed -i 's@my-domain@cdh@g'  /etc/openldap/slapd.conf
    
    mv /etc/openldap/slapd.d/ /tmp/slapd.d.$(date +"%F_%T")
    rm -rf /var/lib/ldap/*
    
    #启动服务
    service slapd start
    
    #配置日志文件
    sed -i '/local7/alocal4.* /var/log/slapd.log' /etc/rsyslog.conf
    service rsyslog restart

## b, ldap增删改查 ##

ldap存储的逻辑结构如下图：

*  DN：Distinguished Name， 每条entry对应一个dn
 *  DC：Domain Component
 *  CN：Common Name
 *  OU：Organizational Unit  
    ![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70_pic_center]

### 添加用户 ###

######################## 增：添加用户 ##################
    #方式 1, 使用工具来导入系统用户信息到 ldap中
    #yum install migrationtools -y
    #sed -i 's@$DEFAULT_MAIL_DOMAIN = ".*"@$DEFAULT_MAIL_DOMAIN = "cdh.com"@' /usr/share/migrationtools/migrate_common.ph
    #sed -i 's@$DEFAULT_BASE = "dc=.*,dc=.*"@$DEFAULT_BASE = "dc=cdh,dc=com"@' /usr/share/migrationtools/migrate_common.ph
    #
    #添加一个系统登录用户，来获取模板
    #useradd ldap1 
    #echo -e 'ldap1\nldap1' |passwd ldap1
    #获取组织和用户模板
    #/usr/share/migrationtools/migrate_base.pl |head -5 > ou.ldif
    #/usr/share/migrationtools/migrate_base.pl |grep People -A3 >> ou.ldif
    #tail -n 1 /etc/passwd > people
    #/usr/share/migrationtools/migrate_passwd.pl people people.ldif
    #删除该系统用户
    #userdel ldap1
    #
    #导入entry：
    # -x Use simple authentication instead of SASL
    # -w ldap的管理员密码 -D binddn
    # -f Read the entry modification information from file 
    #ldapadd -x -w 123456 -D "cn=Manager,dc=cdh,dc=com" -f ou.ldif
    #ldapadd -x -w 123456 -D "cn=Manager,dc=cdh,dc=com" -f people.ldif
    
    #方式 2 ,自定义添加entry属性
    #定义顶级域
    cat > domain.ldif <<EOF dn: dc=cdh,dc=com objectClass: top objectClass: domain EOF
    #添加 entry
    ldapadd -x  -w 123456 -D "cn=Manager,dc=cdh,dc=com" -f domain.ldif
    
    #定义组织和用户
    cat > users.ldif <<EOF #定义组织 dn: ou=People,dc=cdh,dc=com ou: People objectClass: top objectClass: organizationalUnit #定义组织下的用户 dn: uid=ldap1,ou=People,dc=cdh,dc=com uid: ldap1 objectClass: top objectClass: account objectClass: shadowAccount userPassword: ldap1 EOF
    #添加 entry
    ldapadd -x  -w 123456 -D "cn=Manager,dc=cdh,dc=com" -f users.ldif
    
    #测试账号连接
    #[root@test-c6 ~]# ldapwhoami -x -D 'uid=ldap1,ou=People,dc=cdh,dc=com' -w ldap1
    #dn:uid=ldap1,ou=People,dc=cdh,dc=com

### 删除/修改用户 ###

#删除 entry: 先删子节点，再删父节点
    #需要指定dn
    ldapdelete -x -w 123456 -D 'cn=Manager,dc=cdh,dc=com' uid=ldap1,ou=People,dc=cdh,dc=com
    
    #修改 entry: 
    cat > people.ldif.modify <<EOF dn: uid=ldap1,ou=People,dc=cdh,dc=com changetype: modify replace: userPassword userPassword: test123 EOF
    
    ldapmodify -x  -w 123456 -D 'cn=Manager,dc=cdh,dc=com' -f people.ldif.modify
    
    #测试账号连接
    #[root@test-c6 ~]# ldapwhoami -x -D 'uid=ldap1,ou=People,dc=cdh,dc=com' -w test123
    #dn:uid=ldap1,ou=People,dc=cdh,dc=com

### 查看用户 ###

# -s Specify the scope of the search: {base|one|sub|children}
    # -b Use searchbase as the starting point 
    ldapsearch -x -s base -b ''  namingContexts #默认过滤条件是'(objectclass=*)'
    
    #查看 entry 简要信息 ： ldapsearch 参数.. [filter attrs...]objectClass=*
    # -x Use simple authentication instead of SASL.
    # -L results displayed in LDAP Data Interchange Format,越多L越少信息
    # -b Use searchbase as the starting point 
    # -H ldap:/// 连接的url
    #查看entry 详细信息
    ldapsearch -x -b 'dc=cdh,dc=com' #默认过滤条件是'(objectclass=*)'

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70_pic_center 1]

### 测试用户登录: ldapadmin工具 ###

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70_pic_center 2]

## c, 配置ssl 加密通信 ##

快速生成证书：[https://blog.csdn.net/eyeofeagle/article/details/103759058][https_blog.csdn.net_eyeofeagle_article_details_103759058]

sed -i 's@SLAPD_LDAPS=no@SLAPD_LDAPS=yes@' /etc/sysconfig/ldap
    sed -i 's@^TLS@#TLS@' /etc/openldap/slapd.conf
    #把证书复制到: /etc/openldap/ssl/
    sed -i	 -e '68i TLSCACertificateFile /etc/openldap/ssl/cacert.pem ' \
    	 -e '68i TLSCertificateFile /etc/openldap/ssl/httpd.crt ' \
    	 -e '68i TLSCertificateKeyFile /etc/openldap/ssl/httpd.key ' \
    	 -e '68i TLSVerifyClient never ' \
    /etc/openldap/slapd.conf
    
    #重启slapd,验证ssl连接
    [wang@c6 ~]# ss -nltp |grep sla
    LISTEN     0      128                      :::636                     :::*      users:(("slapd",5171,10))
    LISTEN     0      128                       *:636                      *:*      users:(("slapd",5171,9))
    LISTEN     0      128                      :::389                     :::*      users:(("slapd",5171,8))
    LISTEN     0      128                       *:389                      *:*      users:(("slapd",5171,7))
    
    [wang@c6 vagrant]# ldapsearch -x -b dc=cdh,dc=com -LLL -H ldap:/// 
    dn: dc=cdh,dc=com
    dn: ou=People,dc=cdh,dc=com
    dn: uid=ldap1,ou=People,dc=cdh,dc=com
    
    [vagrant@c6 ~]$ openssl s_client -connect localhost:636 -showcerts -state -CAfile /etc/openldap/ssl/cacert.pem
    No client certificate CA names sent
    Server Temp Key: ECDH, prime256v1, 256 bits
    ---
    SSL handshake has read 3225 bytes and written 397 bytes
    ---
    New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA
    Server public key is 2048 bit
    Secure Renegotiation IS supported
    Compression: NONE
    Expansion: NONE
    SSL-Session:
        Protocol  : TLSv1.2
        Cipher    : ECDHE-RSA-AES256-SHA
        ...
        Timeout   : 300 (sec)
        Verify return code: 0 (ok)

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70_pic_center 3]

# 2，配置hiverserver2登录验证 #

## a, 修改hiveserver2使用ldap验证 ##

保存后，重启配置以生效  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70_pic_center 4]

## b, 测试beeline: 用户名密码登录 ##

*  beeline -u jdbc:hive2://localhost:10000 -n ldap1 -p ldap1  
    ![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70_pic_center 5]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70_pic_center]: /images/20221120/c3ebaba3027546318065db303f0e7c01.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70_pic_center 1]: /images/20221120/e6c4168eef51445f8b36f5a097377a97.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70_pic_center 2]: /images/20221120/a22d7eaf3e0046e28e59588c435de887.png
[https_blog.csdn.net_eyeofeagle_article_details_103759058]: https://blog.csdn.net/eyeofeagle/article/details/103759058
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70_pic_center 3]: /images/20221120/77796e79a5f348d19b9c08d6a77ca0aa.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70_pic_center 4]: /images/20221120/5cbe771119e6498cb6876402fde69ea1.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70_pic_center 5]: /images/20221120/ab57e40d215444ff95f65b3acb5988a5.png