LDAP Implementation HOWTO

Roel van Meer

Linvision BV <http://www.linvision.com>

   r.vanmeer@linvision.com
  

Giuseppe Lo Biondo

INFN MI <http://www.mi.infn.it>

   giuseppe.lobiondo@mi.infn.it
  

崅嫶慡 - 擔杮岅東栿

   arms405@jade.dti.ne.jp
  

v0.5, 2001-03-30

Revision History                                                       
Revision 0.5           2001-03-30          Revised by: rvm             
Cleanup, fixes, overview rewritten.                                    
Revision 0.4           2001-02-01          Revised by: rvm             
Added dns section.                                                     
Revision 0.3           2001-01-18          Revised by: rvm             
Added MTA sections.                                                    
Revision 0.2           2000-11-12          Revised by: glb             
Improved section on nss. Added sections about certificates and         
wrappers.                                                              

偙偺暥彂偼傾僾儕働乕僔儑儞偺僨乕僞傪 LDAP 僒乕僶偵婰榐偡傞偵偁偨偭偰偺
媄弍揑側懁柺傪愢柧偟傑偡丅徟揰偲側傞偺偼丄庬乆偺傾僾儕働乕僔儑儞傪 LDAP
偵懳墳偝偣傞偨傔偺愝掕曽朄偱偡丅傑偨丄LDAP 僨乕僞傪埖偆偺偵栶棫偮傾僾儕
働乕僔儑儞偵偮偄偰傕弎傋偰偄傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

Table of Contents
1. 奣梫
   
    1.1. 側偤偙偺 HOWTO 偑偁傞偺偐丠
    1.2. 壗偵偮偄偰偺傕偺側偺偐丠
    1.3. 壗偵偮偄偰乽偱偼側偄乿偺偐丠
    1.4. 幱帿
    1.5. Disclaimer (柶愑帠崁)
    1.6. Copyright and license (挊嶌尃偲棙梡嫋壜)
   
2. pam_ldap 偲 nss_ldap 傪巊偭偨 LDAP 擣徹
   
    2.1. 峔惉梫慺
       
        2.1.1. 擣徹乗 PAM 偲 pam_ldap.so
        2.1.2. Name Service Switch 偲 nss_ldap.so
        2.1.3. Lightweight Directory Access Protocol
        2.1.4. Name Service Caching Daemon
        2.1.5. Secure Socket Layer
       
    2.2. 擣徹僔僗僥儉偺峔抸
       
        2.2.1. 僒乕僶懁
           
            2.2.1.1. OpenLDAP 偺僀儞僗僩乕儖偲愝掕
           
        2.2.2. 僋儔僀傾儞僩懁
           
            2.2.2.1. PAM LDAP 偺僀儞僗僩乕儖偲愝掕
            2.2.2.2. NSS LDAP 偺僀儞僗僩乕儖偲愝掕
            2.2.2.3. NSCD 偺愝掕
            2.2.2.4. LDAP 僋儔僀傾儞僩偺愝掕僼傽僀儖
           
    2.3. 婲摦
    2.4. 傾僇僂儞僩偺曐庣娗棟
    2.5. 婛抦偺惂尷帠崁
    2.6. 僼傽僀儖偺僷乕儈僢僔儑儞
   
3. LDAP 傪巊偭偨 Radius 擣徹
   
    3.1. FreeRadius 斉 Radiusd 偺愝掕
    3.2. Radius 擣徹偺僥僗僩
    3.3. Cisco IOS 偺愝掕椺
   
4. Samba
5. DNS
   
    5.1. NSS 傪巊偆
       
        5.1.1. 愝掕
        5.1.2. 僗僉乕儅
       
    5.2. bind 傪巊偆
       
        5.2.1. bind 僿偺僷僢僠
        5.2.2. ldap2dns
        5.2.3. ispman
       
6. 儊乕儖僩儔儞僗僼傽僄乕僕僃儞僩 (MTA)
   
    6.1. Sendmail
       
        6.1.1. Sendmail 偵偍偗傞 LDAP 僒億乕僩
        6.1.2. 僔僗僥儉偺攝抲
        6.1.3. Sendmail 愝掕僼傽僀儖
        6.1.4. 僗僉乕儅
        6.1.5. 偝傜側傞忣曬偺偨傔偵
       
    6.2. Postfix
       
        6.2.1. 僒億乕僩
        6.2.2. 愝掕
        6.2.3. 愝掕椺
       
    6.3. qmail
   
7. 傾僪儗僗僽僢僋
8. Netscape 儘乕儈儞僌傾僋僙僗
9. LDAP 偵傛傞僨僕僞儖徹柧彂偺敪峴
   
    9.1. LDAP 僒乕僶偺愝掕
    9.2. 徹柧彂偺敪峴
    9.3. LDAP 懳墳僋儔僀傾儞僩
   
10. SSL/TLS 偲丄SSL/TLS 偺 LDAP 梡儔僢僷
   
    10.1. SSL 偺娙扨側愢柧
    10.2. OpenLDAP 偺 SSL/TLS 僒億乕僩
    10.3. stunnel 傪巊偭偰 LDAP V2 僒乕僶偵 SSL/TLS 傪採嫙偡傞曽朄
    10.4. stunnel 傪巊偭偰 LDAP 僋儔僀傾儞僩偵 SSL 傪採嫙偡傞曽朄
    10.5. stunnel 傪巊偭偰 slurpd 儗僾儕働乕僔儑儞偵 SSL 傪採嫙偡傞曽朄
   
11. 僙僉儏儕僥傿娭楢
12. LDAP 僗僉乕儅
13. 僼傽僀儖偺椺
   
    13.1. 僗僉乕儅僼傽僀儖
    13.2. 儀乕僗 LDIF 偺椺
   
14. 擔杮岅栿偵偮偄偰

1. 奣梫

1.1. 側偤偙偺 HOWTO 偑偁傞偺偐丠

挊幰偑 LDAP 偵偮偄偰曌嫮偟巒傔偨偺偼丄夛幮偑儐乕僓傾僇僂儞僩忣曬偺廤拞
娗棟偺昁梫傪姶偠偰丄偦偺偨傔偵 LDAP 傪巊偄偨偄偲巚偭偨偲偒偱偟偨丅彫偝
側丄偁傞偄偼抐曅揑側暥彂偑偁偪偙偪偵偁傞偙偲偵偼偡偖偵婥晅偒傑偟偨偑丄
偦傟傪傑偲傔偨傕偺偑側偄偙偲傕暘偐傝傑偟偨丅偙傟偑丄彂偒巒傔偨棟桼偱偡
丅

偝傜偵丄LDAP 偼擔偛偲偵峀偔巊傢傟傞傛偆偵側偭偰偄傑偡丅偦傟偱丄恖乆偑
LDAP 傪巊偆偺傪専摙偡傞嵺偵丄偳偺傾僾儕働乕僔儑儞偑 LDAP 懳墳側偺偐偵偮
偄偰慡懱偺奣梫傪偮偐傓偙偲偑偱偒傞側傜曋棙偩偲巚偄傑偡丅偙偺暥彂偼偒偭
偲丄僔僗僥儉偺愝掕傪拲堄怺偔慖戰偡傞偺偵栶棫偮偙偲偱偟傚偆丅壗偐傪曄峏
偟偨傝婡擻傪捛壛偟傛偆偲偡傞偨傃偵慡晹傗傝側偍偡昁梫偼傕偆側偔側傞偺偱
偡丅

偙偺暥彂偼嵟弶丄帺暘偨偪偺棙梡宍懺偵崌傢偣偰 LDAP 傪幚憰偡傞偵偼偳偆偟
偨傜傛偄偐偲偄偆丄僾儘僕僃僋僩偺儘乕僪儅僢僾偲偟偰巒傑傝傑偟偨丅偟偐偟
屬偄庡偺 Linvision <http://www.linvision.com> 偑丄帺暘偨偪偺応崌偵偮偄
偰幚嵺偵偼栶偵棫偨側偄偙偲傑偱挷嵏偡傞婡夛傪梌偊偰偔傟偨偍偐偘偱丄扨側
傞儘乕僪儅僢僾偱偼側偔丄LDAP 懳墳傾僾儕働乕僔儑儞偺媄弍揑側奣愢傊偲曄傢
傝傑偟偨丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

1.2. 壗偵偮偄偰偺傕偺側偺偐丠

堦斒揑側僒乕價僗偺傎偲傫偳偼 PAM (Pluggable Authentication Modules) 傪
捠偟偰擣徹傪峴側偊傑偡丅pam_ldap 傗 nss_ldap 傪巊偊偽丄PAM 壔偝傟偨偁傜
備傞僾儘僌儔儉偑 LDAP 偐傜忣曬傪庢傝弌偣傞傛偆偵側傝傑偡丅the Linux-PAM
site <http://www.kernel.org/pub/linux/libs/pam/> 偐傜偼丄PAM 偵偮偄偰偺
堦斒揑側忣曬傪偝傜偵摼傞偙偲偑偱偒傑偡丅 pam_ldap 偲 nss_ldap 偵娭偡傞
忣曬偼 padl software <http://www.padl.com> 偺僒僀僩偵偁傝傑偡丅

Samba 偼丄尰忬偱偼懡彮崲偭偨偙偲偵側偭偰偄傑偡丅尰帪揰偱偺埨掕斉 Samba
偵偼 LDAP 僒億乕僩偑偁傝傑偣傫丅HEAD 偲 TNG 僽儔儞僠偵偼偁傝傑偡偐傜丄
偨傇傫寢崌偝傟偨僣儕乕偵傕偁傞偱偟傚偆丅栤戣側偺偼丄Samba 偑帺暘偱儐乕
僓柤偲僷僗儚乕僪傪帩偭偰偄傞偲偄偆偙偲偱偡丅偨偟偐偵 PAM 傪棙梡偱偒傞偺
偱偡偑丄偦傟偩偗偱偼偡傋偰偺擣徹偲儐乕僓忣曬偺庴偗搉偟偵廫暘偲偼尵偊傑
偣傫丅側偤側傜 Samba 偵偍偗傞 LDAP 偺幚憰偼枹姰惉偱偁傝丄偄偔偮偐偺惂尷
偑偁傞偺偱偡丅挊幰偺宱尡偐傜偡傞偲丄尰抜奒 (2000 擭 5 寧弶傔) 偺 HEAD
偼廫暘偵埨掕偟偰偄傑偣傫偟丄懍搙傕枮懌偱偒傞傕偺偱偼偁傝傑偣傫丅偟偐偟
側偑傜丄怴偟偄儕儕乕僗偱 LDAP 僒億乕僩偑姰慡偵婡擻偡傞傛偆偵側傟偽丄
Samba 傕傑偨丄偦偺儐乕僓忣曬傪偡傋偰 LDAP 偐傜庢摼偡傞傛偆愝掕偱偒傞偙
偲偵側傝傑偡丅

傎偐偵 LDAP 僨乕僞儀乕僗偵婰榐偱偒傞傕偺偵偼 DNS 偑偁傝傑偡丅僱僢僩儚乕
僋偵愙懕偡傞儅僔儞偑憹偊偰偔傞偲丄DNS 僼傽僀儖傪庤嶌嬈偱曇廤偡傞偺偼幚
嵺揑偱偼側偔側偭偰偒傑偡丅儅僔儞傾僇僂儞僩偑 LDAP 偵婰榐偝傟偰偄傟偽丄
傆偨偮偺 DNS 僄儞僩儕 (傂偲偮偼柤慜夝寛偺偨傔丄偝傜偵傂偲偮偼媡堷偒偺偨
傔) 傪摨帪偵捛壛偡傞偺偑娙扨偵偱偒偰偟傑偄傑偡丅偙傟偼傑偨丄僔僗僥儉娗
棟偺娙慺壔傪傕傕偨傜偟傑偡丅傎偲傫偳偺僔僗僥儉偵偲偭偰丄僄儞僩儕傪 LDAP
僨乕僞儀乕僗偵搊榐偡傞偙偲偑昁恵偲偄偆偙偲偵偼側傜側偄偱偟傚偆偑丄偙傟
偼曋棙偩偲峫偊傞恖払傕弌偰偔傞偙偲偱偟傚偆丅

Sendmail (徻嵶偼 sendmail.net <http://www.sendmail.net/> 傪嶲徠偺偙偲)
偼僶乕僕儑儞 8.9 偐傜 LDAP 傪僒億乕僩偟偰偄傑偡丅 Postfix 傗 qmail 傕傑
偨 LDAP 懳墳偱偡丅暋悢偺儊乕儖儂僗僩傗僼僅乕儖僶僢僋儂僗僩偺偁傞儊乕儖
僔僗僥儉傪峔抸偡傞偲偒偵偼丄忣曬偡傋偰傪堦売強偵廤傔偰婰榐偟偰偍偔偲曋
棙偱偡丅傆偮偆偼摨偠忣曬傪僔僗僥儉偛偲偵暿乆偵擖椡偟偰愝掕偡傞昁梫偑偁
傞偺偱偡偑丄 LDAP 傪巊偊偽丄偦偺昁梫偼偁傝傑偣傫丅

LDAP 偼儘乕儈儞僌傾僋僙僗偵傕巊梡偱偒傑偡丅Netscape 4.5 埲崀偱偼丄僽僢
僋儅乕僋偦偺懠偺儐乕僓僨乕僞傪 HTML 傑偨偼 LDAP 僒乕僶偵婰榐偟偰偍偔偙
偲偑偱偒傑偡丅偙傟偵傛偭偰儐乕僓偼丄儘僌僀儞偟偰 Netscape 傪巊偊傞偲偙
傠側傜偳偙偱偱傕丄埲慜偐傜偺曋棙側愝掕撪梕傪巊偊傞傢偗偱偡丅

Microsoft 偺 Office 僾儘僌儔儉偼傾僪儗僗僽僢僋傪僀儞億乕僩偱偒傑偡丅傑
偨丄Active Directory 僒乕價僗傪巊偭偰丄儐乕僓柤傗僯僢僋僱乕儉偵堦抳偡傞
儊乕儖傾僪儗僗傪帺摦揑偵棙梡偡傞偙偲傕偱偒傑偡丅LDAP 偑偁傟偽丄偙傟偲摨
偠偙偲傪 Microsoft Exchange Server 傗偦傟偵椶偡傞傕偺傪巊傢偢偵 Linux
僔僗僥儉忋偱峴側偆偙偲偑偱偒傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

1.3. 壗偵偮偄偰乽偱偼側偄乿偺偐丠

傑偢戞堦揰丅杮彂偱偼丄幚嵺偺愝掕傗 LDAP 帺懱偺娗棟偵偮偄偰偼榖偟偡偓側
偄傛偆偵偟傛偆偲巚偭偰偄傑偡丅偦傟偵偮偄偰埖偭偰偄傞 LDAP-HOWTO 偲偄偆
偡偽傜偟偄暥彂偑 LDP (the Linux Documentation Project) 偵偁傞偺偱偡偐傜
丅

戞擇偵丄傾僾儕働乕僔儑儞帺懱偵娭偡傞帠暱偼丄偦傟偑 LDAP 偲娭學側偄偲偒
偵偼埖傢側偄偮傕傝偱偡丅

嵟屻偱偡偑丄挊幰偼傎偲傫偳偺応崌偵偮偄偰丄LDAP 傪巊偆偺偑尗柧偐偳偆偐偵
偮偄偰偺傾僪僶僀僗偼偱偒傑偣傫丅偦偺庬偺宱尡偑側偄偺偱偡丅巊偆偨傔偵偳
偆偡傟偽傛偄偐偵偮偄偰偼丄傕偟偍朷傒側傜偽嫵偊偰偁偘傜傟傑偡丅偟偐偟側
偑傜丄偦偆偡傋偒偐偳偆偐偼抐掕偱偒側偄偺偱偡丅堦斒揑側 LDAP 偺棙梡斖埻
傪埖偭偨暥彂偼偨偔偝傫偁傝傑偡丅偦偪傜傪偛棗偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

1.4. 幱帿

傑偢丄挊幰偺屬偄庡偱偁傞Linvision <http://www.linvision.com> 偑挊幰偵丄
嬑柋帪娫撪偵偙偺暥彂偺嶌嬈傪偡傞婡夛傪梌偊偰偔傟偨偙偲偵姶幱偟偨偄偲巚
偄傑偡丅

偝傜偵丄壓婰偺曽乆偵傕姶幱偟偨偄偲巚偄傑偡丅斵傜偼偙偺暥彂偵壗傜偐偺峷
專傪偟偰偔傟傑偟偨 (弴晄摨) 乗 Giuseppe Lo Biondo.

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

1.5. Disclaimer (柶愑帠崁)

This document is provided as is and should be considered as a work in
progress. Several sections are as yet unfinished, and probably a lot of
things that should be in here, aren't. I would greatly appreciate any
comments on this document, of whatever nature they may be.

    Note: 嶲峫栿
   
    偙偺暥彂偼偙偆偄偆傕偺偱偡偐傜丄尰嵼恑峴宍偺惉壥暔偲巚偭偰傕傜偭偨
    傎偆偑傛偄偱偟傚偆丅偄偔偮偐偺復偼枹姰惉偱偁傝丄偁傞傋偒偲偙傠偵偁
    傞偼偢偺傕偺偑側偄傕偺傕懡偄偙偲偱偟傚偆丅挊幰偼丄偙偺暥彂傊偺偄偐
    側傞堄尒偵傕戝偄偵姶幱偟傑偡丅偦傟偑偳偺傛偆側惈幙偺傕偺偱偁傠偆偲
    傕丄偱偡丅
   
In any case, think before you go messing around with your system and
don't come to me if it breaks.

    Note: 嶲峫栿
   
    偄偐側傞応崌偵偍偄偰傕丄帺暘偺僔僗僥儉傑傢傝偵庤傪擖傟傞偺偼丄傛偔
    峫偊偰偐傜偵偟偰偔偩偝偄丅偦傟偵傛偭偰偍偐偟偔側偭偰偟傑偭偰傕丄挊
    幰偺偲偙傠偵偼棃側偄偱偔偩偝偄丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

1.6. Copyright and license (挊嶌尃偲棙梡嫋壜)

Copyright (c) by Roel van Meer, Giuseppe Lo Biondo. This document may
be distributed only subject to the terms and conditions set forth in
the LDP License at the Linux Documentation Project <http://
www.linuxdoc.org/COPYRIGHT.html>.

    Note: 嶲峫栿
   
    Copyright (c) by Roel van Meer, Giuseppe Lo Biondo. 偙偺暥彂偼 
    Linux Documentation Project <http://www.linuxdoc.org/
    COPYRIGHT.html> 偺 LDP License 偵婰弎偝傟偰偄傞忦崁傗忦審偵廬偭偰偺
    傒攝晍偡傞偙偲偑偱偒傑偡丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2. pam_ldap 偲 nss_ldap 傪巊偭偨 LDAP 擣徹

偙偺復偼 LDAP 傪 NIS 偺戙梡昳偲偟偰儐乕僓僇僂儞僩偺娗棟偵巊偆曽朄偵徟揰
傪崌傢偣傑偡丅偨偔偝傫偺儐乕僓傾僇僂儞僩傪婔偮偐偺儂僗僩偵暘嶶偟偰帩偭
偰偄傞偲丄傾僇僂儞僩愝掕偵晄惍崌偑惗偠傞偙偲偑傛偔偁傝傑偡丅LDAP 傪巊偊
偽丄廤拞擣徹僔僗僥儉傪峔抸偡傞偙偲偵傛偭偰僨乕僞偺廳暋傪旔偗偨傝堦娧惈
傪憹偟偨傝偡傞偙偲偑偱偒傑偡丅

尰帪揰偱偼丄儐乕僓偺傾僇僂儞僩僨乕僞傗懠偺忣曬傪僱僢僩儚乕僋宱桼偱嫙媼
偡傞偨傔偵嵟傕傛偔巊傢傟偰偄傞曽幃偼 Network Information Service (NIS)
偱偡丅LDAP 偲摨條偵丄NIS 傕拞墰僒乕僶偵 passwd, shadow, groups,
services, hosts 摍乆偺愝掕僼傽僀儖傪曐娗偟偰抲偗傞傛偆偵偡傞僒乕價僗偱
偡丅 NIS 僒乕僶偼 NIS 僋儔僀傾儞僩偐傜栤偄崌傢偣傪庴偗偰丄偙偆偟偨忣曬
傪採嫙偟傑偡丅

LDAP 偼 NIS 偲摨偠婡擻傪採嫙偱偒丄偝傜偵婔偮偐丄LDAP 偺曽偑桪傟偰偄傞揰
偑偁傝傑偡丅埲壓偺偲偍傝偱偡丅

 丒 LDAP 僒乕僶忋偺忣曬偼丄梕堈偵暋悢偺梡搑偵棙梡偱偒傑偡丅偙偺 HOWTO
    偱奣愢偟偰偄傞傛偆偵丄LDAP 僨乕僞儀乕僗忋偺摨偠儐乕僓僄儞僩儕偼丄揹
    榖挔丄梄曋攝払丄晹堳柤曤側偳偺傛偆側懠偺傾僾儕働乕僔儑儞偵巊偊傞偺
    偱丄僨乕僞偺廳暋傗柕弬傪旔偗傞偙偲偑偱偒傑偡丅
   
 丒 LDAP 偼暋嶨側傾僋僙僗僐儞僩儘乕儖儕僗僩傪僨乕僞儀乕僗偵揔梡偱偒傑偡
    丅偙傟偼僨乕僞儀乕僗偺僄儞僩儕偵懳偡傞僷乕儈僢僔儑儞偺揔愗側旝挷惍
    傪壜擻偵偟傑偡丅
   
 丒 Secure Socket Layer (SSL) 傪捠偡偙偲偵傛偭偰丄LDAP 僒乕僶偲僋儔僀傾
    儞僩偺娫偵僙僉儏傾側揮憲宱楬傪幚憰偱偒傑偡丅
   
 丒 slapd 儗僾儕働乕僔儑儞 [1] 偍傛傃 DNS round robin query (偙傟偼杮暥
    彂偱偼埖偄傑偣傫偑) 傪巊偭偰丄懴屘忈壔僒乕價僗傪幚憰偡傞偙偲偑偱偒
    傑偡 (栿拲丗DNS round robin query 偼懴屘忈壔偵側傜側偄偺偱偼側偄偐
    丄偲偄偆曬崘偑偁偭偰挊幰偵妋擣偟偨偲偙傠丄乽嵟弶偺 DNS 僒乕僶傊偺愙
    懕偑嫅斲偝傟偨偲偒偵懠偺僒乕僶傊偺愙懕傪帋峴偡傞偐偼僋儔僀傾儞僩偵
    埶懚偡傞乿偲偺夞摎傪摼傑偟偨)丅
   
 丒 僱僢僩儚乕僋忋偺儐乕僓傾僇僂儞僩傪堦売強偵廤傔偰偍偔偙偲偼丄傂偲偮
    偺娗棟応強偐傜偨偔偝傫偺儂僗僩偺儐乕僓傪曐庣娗棟偡傞彆偗偵側傝傑偡
    (偮傑傝丄LDAP 僒乕僶偱傾僇僂儞僩傪嶌惉偍傛傃嶍彍偡傟偽丄偦偺曄峏揰
    偑懄嵗偵 LDAP 僋儔僀傾儞僩偐傜妶梡偱偒傞傛偆偵側傞偺偱偡)丅
   
偙偙偱丄Pluggable Authentication Module (PAM) 偲 Name Service Switch
(NSS) 僥僋僲儘僕傪旛偊偨僔僗僥儉忋偱 LDAP 僒乕僶偑偳偺傛偆偵擣徹偲擣壜
偺偨傔偵巊偊傞偐偵徟揰傪崌傢偣傞偙偲偵偟傑偡丅摿偵 Linux 僆儁儗乕僥傿儞
僌僔僗僥儉偵尵媦偡傞偮傕傝偱偡偑丄偦偺愢柧偑懠偺僆儁儗乕僥傿儞僌僔僗僥
儉偵揔梡偱偒側偄偲偄偆傢偗偱偼偁傝傑偣傫丅

偙偙偱庢傝忋偘傞娐嫬偱偼侾戜偺 LDAP 僒乕僶偑偁傝丄偙偙偵儐乕僓傾僇僂儞
僩僨乕僞偑埖偄傗偡偄宍幃偱奿擺偝傟傑偡丅Un*x 僋儔僀傾儞僩偼丄偙偺忣曬傪
巊偭偰昗弨偺 Un*x 偺棳媀偱偺擣徹偲儕僜乕僗偵懳偡傞擣壜傪峴偄傑偡丅

僋儔僀傾儞僩乛僒乕僶捠怣偵偼丄僙僉儏傾側宱楬傕梫媮偝傟傑偡丅偲偄偆偺傕
丄儐乕僓傾僇僂儞僩偺僨乕僞偺傛偆偵僋儕僥傿僇儖側忣曬偼丄僱僢僩儚乕僋忋
偵撪梕偑柧敀側傑傑憲怣偡傋偒偱偼側偄偐傜偱偡丅偙偺僙僉儏傾側宱楬偼
Secure Socket Layer 偵傛偭偰旛偊傜傟傑偡丅

僋儔僀傾儞僩懁偱偼僉儍僢僔儏婡峔傪惈擻忋偺栤戣偐傜昁梫偲偟傑偡偑丄偙傟
偼 Name Service Caching Daemon 偵傛偭偰旛偊傞偙偲偑偱偒傑偡丅

偙偺僔僗僥儉傪峔抸偡傞偺偵巊偆僜僼僩僂僃傾偺 (傎傏) 偡傋偰偑僆乕僾儞僜
乕僗偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.1. 峔惉梫慺

偙偺愡偱偼丄擣徹僔僗僥儉傪峔抸偡傞偨傔偵巊傢傟傞庬乆偺峔惉梫慺傪奣愢偟
傑偡丅奺梫慺傪娙扨偵愢柧偟偰偄偒傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.1.1. 擣徹乗 PAM 偲 pam_ldap.so

Pluggable Authentication Module 偼丄昗弨 UNIX, RSA, DCE, LDAP 偲偄偭偨
庬乆偺擣徹媄弍偲 login, passwd, rlogin, su, ftp, ssh 摍乆偺僔僗僥儉僒乕
價僗偲偺摑崌傪壜擻偵偟丄偟偐傕偙傟傜偺僒乕價僗傪曄峏偡傞昁梫偑偁傝傑偣
傫丅

嵟弶偼 Sun Solaris 偵幚憰偝傟偨偺偱偡偑丄崱傗 PAM 偼 RedHat 傗 Debian
傪娷傓懡偔偺 Linux 僨傿僗僩儕價儏乕僔儑儞偱丄擣徹偺榞慻傒偺昗弨揑側傕偺
偲側偭偰偄傑偡丅偙傟偵傛偭偰嫙媼偝傟傞 API 傪捠偟偰丄擣徹偺梫媮偑僥僋僲
儘僕摿桳偺摦嶌 (偙傟偼 PAM 儌僕儏乕儖偲屇偽傟傞儔僀僽儔儕偵傛偭偰幚憰偝
傟偰偄傑偡) 偵妱傝摉偰傜傟傑偡丅偙偺妱傝摉偰偼 PAM 愝掕僼傽僀儖偱峴側傢
傟傑偡丅婎杮揑偵偙偺僼傽僀儖偺拞偱丄奺僒乕價僗偵梡偄傞擣徹婡峔偑梌偊傜
傟傞偙偲偵側傝傑偡丅

崱夞偺応崌偼丄pam_ldap.so 嫟桳儔僀僽儔儕偱幚憰偝傟傞 pam_ldap 儌僕儏乕
儖偵傛偭偰丄儐乕僓偲僌儖乕僾偺擣徹偵 LDAP 僒乕價僗傪巊偊傞傛偆偵偟傑偡
丅

擣徹愝旛傪昁梫偲偡傞僒乕價僗偼偦傟偧傟丄 PAM 愝掕僼傽僀儖傪捠偟偰丄堎側
傞擣徹曽幃傪巊偆傛偆偵愝掕偱偒傑偡丅偙傟偼偮傑傝丄PAM 愝掕僼傽僀儖傪巊
偭偰丄儐乕僓偑儕僜乕僗傊偺傾僋僙僗傪摼傞偨傔偵枮偨偝側偔偰偼側傜側偄梫
媮帠崁偺堦棗昞傪彂偔偙偲偑偱偒傞偲偄偆堄枴偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.1.2. Name Service Switch 偲 nss_ldap.so

偄偭偨傫儐乕僓偑擣徹偝傟偰偐傜傕丄懡偔偺傾僾儕働乕僔儑儞偼儐乕僓忣曬傊
偺傾僋僙僗傪昁梫偲偟傑偡丅偙偺忣曬偼揱摑揑偵偼僥僉僗僩僼傽僀儖 (/etc/
passwd, /etc/shadow, /etc/group) 偵擖傟傜傟偰偄傑偡偑丄懠偺僱乕儉僒乕價
僗偵傛偭偰嫙媼偡傞偙偲傕偱偒傑偡丅

怴偟偄僱乕儉僒乕價僗 (偨偲偊偽 LDAP) 偑摫擖偝傟傞偵偮傟丄偙偺傛偆側忣曬
庢摼偺幚憰偼丄 (NIS 傗 DNS 偺傛偆偵) C 儔僀僽儔儕撪丄傑偨偼偦偺怴偟偄僱
乕儉僒乕價僗傪巊偄偨偄傾僾儕働乕僔儑儞撪偺丄偳偪傜偱傕壜擻偲側偭偰偟傑
偄傑偟偨丅

偄偢傟偵偟偰傕丄偙偆偄偭偨偙偲偼丄嫟捠偺斈梡揑側僱乕儉僒乕價僗 API 傪巊
偭偰丄奺僥僋僲儘僕偵婎偯偔摦嶌偱僒乕價僗偐傜忣曬傪摼傞儔僀僽儔儕孮偵偦
傟傪梫媮偡傞偙偲偵偡傟偽旔偗傜傟傑偡丅

GNU C Library 偼 Name Service Switch 傪幚憰偟偰忋婰傪夝寛偟傑偟偨丅偙傟
偼 Sun C library 偵婲尮傪帩偪丄嫟捠偺 API 傪捠偟偰庬乆偺僱乕儉僒乕價僗
偐傜忣曬傪摼傜傟傞傛偆偵偡傞曽朄偱偡丅

NSS 偼嫟捠偺 API 偲愝掕僼傽僀儖 (/etc/nsswitch.conf) 傪巊梡偟傑偡丅偙偺
愝掕僼傽僀儖撪偱丄僒億乕僩偡傞僨乕僞儀乕僗枅偵丄偦偺僒乕價僗傪採嫙偡傞
儔僀僽儔儕傪巜掕偟傑偡丅

尰嵼 NSS 偵傛偭偰僒億乕僩偝傟偰偄傞 [2] 僨乕僞儀乕僗偼乗

 丒 aliases 乗儊乕儖僄僀儕傾僗丅
   
 丒 ethers 乗僀乕僒僱僢僩偺斣崋偺僨乕僞丅
   
 丒 group 乗儐乕僓偺僌儖乕僾丅
   
 丒 hosts 乗儂僗僩偺柤慜偲斣崋偺僨乕僞丅
   
 丒 netgroup 乗僱僢僩儚乕僋慡懱偺儂僗僩偲儐乕僓偺堦棗丅
   
 丒 network 乗僱僢僩儚乕僋偵娭偡傞柤慜偲斣崋偺僨乕僞丅
   
 丒 protocols 乗僱僢僩儚乕僋偺僾儘僩僐儖丅
   
 丒 passwd 乗儐乕僓偺僷僗儚乕僪丅
   
 丒 rpc 乗 Remote Procedure Call 偵娭偡傞柤慜偲斣崋偺僨乕僞丅
   
 丒 services 乗僱僢僩儚乕僋僒乕價僗丅
   
 丒 shadow 乗儐乕僓偺僔儍僪僂僷僗儚乕僪丅
   
nss_ldap 嫟桳儔僀僽儔儕傪巊偊偽丄LDAP 傪梡偄偰忋婰偺妱傝摉偰傪幚憰偡傞
偙偲偑偱偒傑偡丅傎傫偲偆偼忋婰偡傋偰偺妱傝摉偰偑幚憰偱偒傞偺偱偡偗傟偳
傕丄偙偙偱偼 shadow, passwd, group 僨乕僞儀乕僗偺 LDAP 幚憰偵偺傒徟揰傪
崌傢偣傞偙偲偵偟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.1.3. Lightweight Directory Access Protocol

崱夞偺傾僾儕働乕僔儑儞偱偼丄儐乕僓傾僇僂儞僩偲儐乕僓僌儖乕僾偵娭偡傞忣
曬傪僋儔僀傾儞僩偵嫙媼偡傞偨傔偵 LDAP 偑巊梡偝傟傑偡丅儐乕僓偲僌儖乕僾
傪昞傢偡偺偵梡偄傜傟傞昗弨揑側 objectclass 偼 top, posixAccount,
shadowAccount, posixGroup 偱偡丅

僨乕僞儀乕僗忋偺儐乕僓娭楢偺僄儞僩儕偼彮側偔偲傕 [3] top, posixAccount,
shadowAccount 偺 objectclass 偵懏偟偰偄側偔偰偼側傝傑偣傫丅僌儖乕僾僄儞
僩儕偼 top 偲 posixGroup 偺 objectclass 偵懏偟偰偄側偔偰偼側傝傑偣傫丅

崱夞棙梡偡傞 pam_ldap 偲 nss_ldap 偺幚憰偑偙偺 objectclass 傪嶲徠偡傞偐
傜偱偡丅偙偺 objectclass 偼 RFC 2307 偵婰弎偝傟偰偄傞傕偺偱偡丅

    Note: 幚嵺偵偼丄LDAP 斉 NSS 偼偙偙偱椺帵偟側偐偭偨 objectclass 傕擣
    幆偟傑偡丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.1.4. Name Service Caching Daemon

Name Service Caching Daemon (NSCD) 偼僱乕儉僒乕價僗偵傛傞柤慜夝寛偺寢壥
傪僉儍僢僔儏偡傞偨傔偵巊傢傟丄 NSS 偵傛偭偰採嫙偝傟傞僒乕價僗偺惈擻傪岦
忋偱偒傑偡丅

僋儔僀傾儞僩懁偑嫋梕偱偒傞惈擻傪摼傞偨傔偵丄 passwd 僄儞僩儕偺偨傔偵戝
偒側僉儍僢僔儏傪愝掕偟側偔偰偼側傝傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.1.5. Secure Socket Layer

徻嵶偵偮偄偰偼 Section 10 傪嶲徠偟偰偔偩偝偄丅

LDAP 僒乕僶偲僋儔僀傾儞僩儔僀僽儔儕 (pam_ldap.so 傗 nss_ldap.so) 娫偺捠
怣偵偼 SSL 偑昁梫偱偡丅廳梫側僨乕僞丄偨偲偊偽僷僗儚乕僪僄儞僩儕側偳偼丄
僋儔僀傾儞僩偲僒乕僶偲偺娫偱埫崋壔偝傟偰偄傞昁梫偑偁傞偐傜偱偡丅SSL 偼
傑偨丄僋儔僀傾儞僩偑僒乕僶傪摿掕偡傞偙偲傪壜擻偵偟傑偡偐傜丄偙傟偵傛偭
偰丄晄妋偐側忣曬尮偐傜擣徹忣曬傪摼傞偲偄偆偙偲傪旔偗傜傟傑偡丅

僋儔僀傾儞僩擣徹 (僒乕僶偑僋儔僀傾儞僩傪幆暿偡傞婡擻) 偼尰嵼偺 pam_ldap
偍傛傃 nss_ldap 儌僕儏乕儖偺幚憰偱偼僒億乕僩偝傟偰偄傑偣傫丅偒偭偲桳梡
側偺偱偟傚偆偗傟偳傕丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.2. 擣徹僔僗僥儉偺峔抸

偙偺復偱偼丄慜復偵婰偝傟偰偄傞峔惉梫慺傪梡偄偨擣徹僔僗僥儉傪峔抸偡傞偨
傔偵昁梫側庤弴傪愢柧偟傑偡丅

Figure 1. PAM 偺攝抲恾

PAM 偺帇揰偐傜尒偨丄擣徹僔僗僥儉奺晹偺娫偺娭學

Figure 2. NSS 偺攝抲恾

NSS 偺娤揰偐傜偺丄擣徹僔僗僥儉偺奺晹娫偺娭學

偙偺攝抲恾偼丄帺暘偱幚憰偡傞偵偼偲偰傕暋嶨偵尒偊傞偐傕偟傟傑偣傫丅偗傟
偳傕傎偲傫偳偺梫慺偼偡偱偵 Linux 偺僔僗僥儉撪偵擖偭偰偟傑偭偰偄傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.2.1. 僒乕僶懁

僒乕僶懁偵偍偄偰偼丄LDAP 僒乕僶偑僀儞僗僩乕儖偝傟丄偐偮愝掕偝傟偰偄側偔
偰偼側傝傑偣傫丅偙偙偱巊偆 LDAP 僒乕僶偼 OpenLDAP 偲偄偆僆乕僾儞僜乕僗
偺 LDAP 僣乕儖僉僢僩偱丄LDAP 僒乕僶 (slapd) 偲儔僀僽儔儕偲儐乕僥傿儕僥
傿傪娷傫偱偄傑偡丅

尰帪揰偺 OpenLDAP 偵偼 LDAP 偺幚憰偑傆偨偮偁傝傑偡丅 V2 偺幚憰
(OpenLDAP 1.2.x) 偲 V3 偺幚憰 (OpenLDAP 2.0.x) 偱偡丅

V3 偺幚憰偼杮懱偱 SSL 婡擻傪採嫙偟傑偡偑丄V2 偼採嫙偟傑偣傫丅偲偼偄偊丄
V2 偺僒乕僶偵傕 SSL 儔僢僷傪巊偊傞偺偱 SSL 婡擻傪捛壛偱偒傑偡 (Section
10 傪嶲徠)丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.2.1.1. OpenLDAP 偺僀儞僗僩乕儖偲愝掕

LDAP 偺僀儞僗僩乕儖偲愝掕偺庤弴偼丄 LDAP-HOWTO 傪嶲峫偵偱偒傑偡丅

slapd 偑揔愗偵愝掕偝傟偨傜丄僨乕僞儀乕僗偺弶婜惗惉偺偨傔偵僨乕僞傪擖傟
傞昁梫偑偁傝傑偡丅偦偙偱丄LDIF (LDAP Data Interchange Format) 僼傽僀儖
傪嶌傜側偔偰偼側傝傑偣傫丅偙傟偼僥僉僗僩僼傽僀儖偱丄埲壓偺僐儅儞僪偵傛
偭偰 LDAP 僨乕僞儀乕僗偵僀儞億乕僩偝傟傑偡丅

#ldif2ldbm -i your_file.ldif                                           

    Note: ldif2ldbm 偼 OpenLDAP 1.2.x 僷僢働乕僕偱採嫙偝傟傞偺偱丄
    OpenLDAP 2.0.x 傪巊偆偺偱偁傟偽 ldapadd 僐儅儞僪傪 (僒乕僶婲摦屻偵)
    巊偆傋偒偱偡 (栿拲丗2.0.x 偱 ldif2ldbm 偵憡摉偡傞偺偼 slapadd 偩偲
    偄偆巜揈傪堫抧條偐傜偄偨偩偒傑偟偨丅僒乕僶掆巭拞偵 slapadd -l
    your_file.ldif偲偡傞曽偑懍偔偰娙扨傜偟偄偱偡)丅
   
OpenLDAP 2.0.x (LDAPv3) 傪巊偆偺偱偁傟偽丄昗弨揑側 NIS 僗僉乕儅偑 /etc/
openldap/schema/nis.schema 偲偄偆僼傽僀儖偵擖偭偰偄傑偡偐傜丄偦傟傪帺暘
偺 slapd.conf 偱 include 僨傿儗僋僥傿僽偵傛偭偰僗僉乕儅傪桳岠偵偟偰偔偩
偝偄丅

埲壓偵 LDIF 僼傽僀儖偺嵟傕娙扨側椺傪嫇偘傑偡丅奺僄儞僩儕偼嬻峴偱暘偗傜
傟偰偄傑偡丅

dn:dc=yourorg, dc=com                                                  
objectclass: top                                                       
objectclass: organizationalUnit                                        
                                                                       
dn:ou=groups, dc=yourorg, dc=com                                       
objectclass: top                                                       
objectclass: organizationalUnit                                        
ou: groups                                                             
                                                                       
dn:ou=people, dc=yourorg, dc=com                                       
objectclass: top                                                       
objectclass: organizationalUnit                                        
ou: people                                                             
                                                                       
dn: cn=Giuseppe LoBiondo, ou=people, dc=yourorg, dc=com                
cn: Giuseppe Lo Biondo                                                 
sn: Lo Biondo                                                          
objectclass: top                                                       
objectclass: person                                                    
objectclass: posixAccount                                              
objectclass: shadowAccount                                             
uid:giuseppe                                                           
userpassword:{crypt}$1$ss2ii(0$gbs*do&@=)eksd                          
uidnumber:104                                                          
gidnumber:100                                                          
gecos:Giuseppe Lo Biondo                                               
loginShell:/bin/zsh                                                    
homeDirectory: /home/giuseppe                                          
shadowLastChange:10877                                                 
shadowMin: 0                                                           
shadowMax: 999999                                                      
shadowWarning: 7                                                       
shadowInactive: -1                                                     
shadowExpire: -1                                                       
shadowFlag: 0                                                          
                                                                       
dn: cn=mygroup, ou=groups, dc=yourorg, dc=com                          
objectclass: top                                                       
objectclass: posixGroup                                                
cn: mygroup                                                            
gidnumber: 100                                                         
memberuid: giuseppe                                                    
memberuid: anotheruser                                                 

    Note: 挿夁偓傞峴偼師偺峴傪僞僽偐僗儁乕僗 (偄偢傟偐傪傂偲偮偩偗) 偱
    巒傔偰懕偗傜傟傞偙偲傪妎偊偰偍偄偰偔偩偝偄丅偙傟偼懠偺 LDIF 彂幃偺
    僼傽僀儖偵傕摉偰偼傑傝傑偡丅
   
偙偙偱偼壓晹慻怐傪擇偮帩偮慻怐偲偟偰丄DN 傪掕媊偟傑偟偨丅 dc=yourorg,
dc=com 偲偄偆慻怐偲偟偰掕媊偟傑偟偨偑丄偦偺壓偵丄傆偨偮偺慻怐僒僽儐僯僢
僩乗 people 偲 groups 乗偑娷傑傟偰偄傑偡丅偦偟偰儐乕僓偼丄people 慻怐儐
僯僢僩偲丄groups 慻怐儐僯僢僩壓偺僌儖乕僾 (偺偆偪丄儐乕僓偑強懏偟偰偄傞
傕偺丅栿拲丗giuseppe 偺応崌偼 mygroup) 偲偵強懏偡傞傛偆婰弎偝傟偰偄傑偡
丅

    Note: 婛懚偺僨乕僞儀乕僗傪 LDIF 彂幃偵曄姺偡傞曋棙側僣乕儖偑 PADL
    偵傛偭偰採嫙偝傟偰偄傑偡丅偙傟偼ftp://ftp.padl.com/pub/
    MigrationTools.tar.gz 偲偄偆傾僪儗僗偵偁傝傑偡丅
   
LDIF 僼傽僀儖偼丄僒乕僶偑摦嶌偟偰偄側偄偲偒偵僀儞億乕僩偟側偔偰偼側傝傑
偣傫丅ldif2ldbm 僐儅儞僪偼 LDAP 僒乕僶傪捠偝偢偵捈愙僨乕僞儀乕僗傪峔抸
偡傞偐傜偱偡丅 LDIF 僼傽僀儖傪僨乕僞儀乕僗偵僀儞億乕僩偡傟偽丄僒乕僶傪
婲摦偱偒傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.2.2. 僋儔僀傾儞僩懁

僋儔僀傾儞僩懁偵偼 pam_ldap.so 偲 nss_ldap.so 偑昁恵偱丄偦傟傜偼
Netscape LDAP Library (Mozilla) 傪巊偭偰僐儞僷僀儖偝傟偰偄側偔偰偼側傝
傑偣傫丅偦偺儔僀僽儔儕偑嫙媼偡傞 LDAPS (LDAP over SSL) 偺 API 偑梫媮偝
傟傞偐傜偱偡丅偦偺儔僀僽儔儕偼僶僀僫儕僷僢働乕僕偱 Netscape One License
偺傕偲偵攝晍偝傟偰偍傝丄僆乕僾儞僜乕僗偱偼偁傝傑偣傫 (偲偼偄偊僷僽儕僢
僋僪儊僀儞偱偼偁傝傑偡)丅

偦偺僷僢働乕僕傪丄偨偲偊偽 /usr/local/ldapsdk 偲偄偆僨傿儗僋僩儕撪偵揥
奐偟偰偔偩偝偄丅

偝傜偵丄僋儔僀傾儞僩儔僀僽儔儕偼徹柧僨乕僞儀乕僗偵傾僋僙僗偱偒側偔偰偼
側傝傑偣傫丅偙偺僨乕僞儀乕僗偵偼 LDAP (stunnel) 僒乕僶徹柧彂偲丄偦偺僒
乕僶徹柧彂偵 (乽怣梡嵪傒 <trusted>乿偲偟偰) 彁柤偟偨 CA 偺 CA 徹柧彂偲
偑娷傑傟偰偄側偗傟偽側傝傑偣傫丅

徹柧僨乕僞儀乕僗偼 Netscape 偺彂幃偺傕偺偱側偗傟偽側傝傑偣傫丅 pam_ldap
偲 nss_ldap 傪僐儞僷僀儖偡傞偨傔偵巊傢傟偰偄傞 Mozilla LDAP API 偑
Netscape 偺彂幃偺徹柧僨乕僞儀乕僗傪巊偆偐傜偱偡丅

偦偺傛偆側徹柧僨乕僞儀乕僗傪埖偆偵偼丄Netscape 偑採嫙偟偰偄傞 PKCS#11
僷僢働乕僕撪偵偁傞 certutil 偲偄偆儐乕僥傿儕僥傿傪巊偆偺偑曋棙偱偡 [4]
丅

LDAP 僋儔僀傾儞僩偺庡梫側愝掕僼傽僀儖偼 /etc/ldap.conf 偱偡丅

傕偟 nss_ldap 傪巊偆偺偱偁傟偽丄尩枾偵偼 pam_ldap 偺巊梡偼昁梫側偄偺偩
偲偄偆偙偲傪妎偊偰偍偄偰偔偩偝偄丅

偦偺偐傢傝偵 pam_unix_auth 儌僕儏乕儖傪巊偊傑偡丅側偤側傜 nss_ldap 偼偁
傜備傞 getpw* 偍傛傃 getsh* 僐乕儖傪 LDAP 嶲徠偵妱摉偰丄 pam_unix_auth
偼儐乕僓擣徹偵偙偺僐乕儖傪棙梡偡傞偐傜偱偡丅 (栿拲丗偙偙偵偮偄偰丄挊幰
偺 Roel van Meer 條偐傜偺拲堄傪偄偨偩偒傑偟偨丅斵偼偦偺拞偱丄PAM 偑擣徹
偵偺傒巊傢傟傞偙偲偲丄 PAM 偑 NSS 儔僀僽儔儕偱偼側偔PAM 儔僀僽儔儕偐傜
忣曬傪摼傞偙偲傪巜揈偟丄乽擣徹乿偵偼 pam_ldap 儌僕儏乕儖偑昁梫偩丄偲偍
偭偟傖偭偰偄傑偟偨丅廋惓偝傟傞偼偢側偺偱丄惓妋側忣曬偼尨暥偺嵟怴斉偵偁
偨偭偰偔偩偝偄丅)

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.2.2.1. PAM LDAP 偺僀儞僗僩乕儖偲愝掕

pam_ldap 傪僐儞僷僀儖偟偰僀儞僗僩乕儖偡傞偵偼丄埲壓偺傛偆偵偟偰偔偩偝偄
丅

$ ./configure --with-ldap-lib=netscape4 --with-ldap-dir=/usr/local/ldapsdk 
$ make                                                                     
# make install                                                             

configure 偺 --with-ldap-lib 僆僾僔儑儞偼丄偳偺 LDAP 儔僀僽儔儕傪巊偍偆
偲偟偰偄傞偐傪巜掕偟傑偡丅

--with-ldap-dir 僆僾僔儑儞偼丄偳偙偵 Netscape ldapsdk 僣乕儖僉僢僩傪僀
儞僗僩乕儖偟偰偁傞偺偐傪巜掕偟傑偡丅

偙傟偵傛偭偰 /lib/security/pam_ldap.so.1 偲奺庬僔儞儃儕僢僋儕儞僋偑僀儞
僗僩乕儖偝傟傑偡丅

PAM 偑怴偟偄擣徹僔僗僥儉偵傾僋僙僗偱偒傞傛偆偵丄揔愗偵愝掕偝傟側偔偰偼
偄偗傑偣傫丅PAM 愝掕僼傽僀儖偼 /etc/pam.d 偲偄偆僨傿儗僋僩儕偵攝抲偝傟
丄擣徹偑嫙媼偝傟傞僒乕價僗柤偵偟偨偑偭偰柤晅偗傜傟偰偄傑偡丅

偨偲偊偽埲壓偼 login 僒乕價僗偺偨傔偺 PAM 愝掕僼傽僀儖 (login 偲偄偆柤
慜偺僼傽僀儖) 偱偡丅

                                                                               
#%PAM-1.0                                                                      
auth     required   /lib/security/pam_securetty.so                             
auth     required   /lib/security/pam_nologin.so                               
auth     sufficient /lib/security/pam_ldap.so                                  
auth     required   /lib/security/pam_unix_auth.so use_first_pass              
account  sufficient /lib/security/pam_ldap.so                                  
account  required   /lib/security/pam_unix_acct.so                             
password required   /lib/security/pam_cracklib.so                              
password sufficient /lib/security/pam_ldap.so                                  
password required   /lib/security/pam_unix_passwd.so use_first_pass md5 shadow 
session  required   /lib/security/pam_unix_session.so                          

PAM 偱巊偆昗弨揑側 PAM 愝掕僼傽僀儖偼 pam_ldap 偺僜乕僗偺 pam_ldap-(僶
乕僕儑儞)/pam.d 偲偄偆僨傿儗僋僩儕偺拞偵偁傝傑偡丅

偙偺昗弨揑側僼傽僀儖偼 /etc/pam.d 僨傿儗僋僩儕偺拞偵僐僺乕偱偒傑偡丅傕
偟壗偐偍偐偟側偙偲傪偟偰偟傑偆偲丄偍偦傜偔嵞傃儘僌僀儞偱偒側偔側偭偰偟
傑偆偺偱丄偙偺憖嶌傪偡傞帪偼拲堄怺偔峴偭偰偔偩偝偄丅怴偟偄僼傽僀儖傪僀
儞僗僩乕儖偡傞慜偵 /etc/pam.d 偺僶僢僋傾僢僾傪偲偭偰偍偒丄偦傟傪暅婣偝
偣傞尃尷偺偁傞僔僃儖傪奐偄偨傑傑偵偟偰偍偔偙偲傪偍姪傔偟傑偡丅

    Note: 偦偺僒儞僾儖偺 pam.d 僨傿儗僋僩儕偵偼 sshd 偲偄偆僼傽僀儖偑偁
    傝傑偣傫丅偦偺偨傔丄偦傟傪嶌惉偟側偗傟偽丄pam 傪巊偆 ssh 傪夘偟偰儘
    僌僀儞偱偒傑偣傫 (OpenSSH 偼 PAM 傪巊梡偟傑偡)丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.2.2.2. NSS LDAP 偺僀儞僗僩乕儖偲愝掕

僜乕僗傪揥奐偟偰偐傜丄Makefile 傪妋擣偟偰偔偩偝偄丅傎偲傫偳偺愝掕撪梕偵
懳偟偰偼曇廤偺昁梫偼偁傝傑偣傫丅偲偼偄偊丄SSL 傪巊偄偨偄偺偱偁傟偽 SSL
懳墳偺 LDAP 儔僀僽儔儕乗偨偲偊偽 Netscape 偺傕偺乗傪儕儞僋偟側偔偰偼側
傝傑偣傫丅

LDAP 偺 SDK 偑 /usr/local/ldapsdk 撪偵偁傞偲偡傟偽丄SSL 傪桳岠偵偡傞偵
偼丄Makefile 傪廋惓偟側偗傟偽側傝傑偣傫丅偦偺廋惓撪梕偼丄
Makefile.linux.mozilla 撪偱 NSFLAGS 傪扵偟偰丄僐儊儞僩偵側偭偰偄傞
-DSSL 傪桳岠偵偡傞偙偲偱偡丅

偝傜偵 LIBS 偺掕媊傪尒偰丄偦偺僼傽僀儖撪偱巜掕偝傟偰偄傞 ldapssl 儔僀僽
儔儕偑丄帺暘偺僀儞僗僩乕儖偟偰偁傞傕偺偲摨偠偐偳偆偐傪妋擣偟偰偔偩偝偄
(ldap_nss.so 偼 libldapssl40 偲 libldapssl30 偺椉曽偵儕儞僋偟偰僐儞僷僀
儖偝傟傑偡)丅

偦偺屻丄儔僀僽儔儕傪僀儞僗僩乕儖偱偒傑偡乗

$ make -f Makefile.linux.mozilla                                       
# make -f Makefile.linux.mozilla install                               
#ldconfig                                                              

偙傟偵傛偭偰 /lib/libnss_ldap.so 偑僀儞僗僩乕儖偝傟傑偡丅偙傟偑
nss_ldap 儔僀僽儔儕偱偡丅偦偟偰 /etc/nsswitch.ldap 偲 /etc/ldap.conf 偲
偑傑偩懚嵼偟偰側偄応崌偵偼丄僒儞僾儖偺愝掕僼傽僀儖偲偟偰僀儞僗僩乕儖偝
傟傑偡丅

僀儞僗僩乕儖偟偨傜丄偦偺 NSS 愝掕僼傽僀儖 /etc/nsswitch.conf 傪曇廤偟側
偔偰偼側傝傑偣傫丅 LDAP 偼偁傜備傞僒乕價僗偵梡偄傞偙偲偑偱偒傞偺偱偡偑
丄崱夞偼 passwd, group, shadow 偵偺傒巊梡偟傑偡丅偙偺応崌丄愝掕僼傽僀儖
偺朻摢偵埲壓偺傛偆側偙偲傪彂偄偰偍偔傋偒偱偡丅

                                                                       
passwd: files ldap                                                     
group:  files ldap                                                     
shadow: files ldap                                                     

偙偺愝掕偩偲僄儞僩儕偼丄傑偢僔僗僥儉僼傽僀儖撪偱扵偝傟偰丄抣偑曉偭偰偙
側偐偭偨側傜 LDAP 僒乕僶偵栤偄崌傢偣傜傟傑偡丅

    Note: LDAP 傪 DNS 栤偄崌傢偣偺僶僢僋僄儞僪偲偟偰巊偆偲偒偵偼拲堄偟
    偰偔偩偝偄丅DNS 偑偦偺僒乕僶偺儂僗僩柤傪夝寛偱偒側偄偲丄柍尷儖乕僾
    偵擖偭偰偟傑偆偺偱偡丅側偤側傜 libldap 帺懱偑 gethostbyname() 傪僐
    乕儖偡傞偐傜偱偡丅 (nsswitch.ldap 撪偺婰弎傛傝)
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.2.2.3. NSCD 偺愝掕

NSCD 偼懡偔偺 Linux 僨傿僗僩儕價儏乕僔儑儞偵偼嵟弶偐傜擖偭偰偄傑偡丅擖
偭偰偄側偔偰傕 GNU C 儔僀僽儔儕偺僷僢働乕僕撪偵偁傝傑偡丅

NSCD 偺愝掕僼傽僀儖偼 /etc/nscd.conf 偱偡丅奺峴偼懏惈偲抣丄傑偨偼懏惈偲
僉儍僢僔儏柤偲抣偺偄偢傟偐傪巜掕偟傑偡丅偦傟偧傟偺僼傿乕儖僪偼僗儁乕僗
偐僞僽偱嬫愗傜傟傑偡丅僉儍僢僔儏柤偼 hosts, passwd, groups 偺偄偢傟偐偵
偡傞偙偲偑偱偒傑偡 (崱夞偼 hosts 傪僉儍僢僔儏偟傑偣傫)丅

enable-cache           passwd  yes                                     
positive-time-to-live  passwd  600                                     
negative-time-to-live  passwd  20                                      
suggested-size         passwd  211                                     
keep-hot-count         passwd  20                                      
check-files            passwd  yes                                     
enable-cache           group  yes                                      
positive-time-to-live  group  3600                                     
negative-time-to-live  group  60                                       
suggested-size         group  211                                      
keep-hot-count         group  20                                       
check-files            group  yes                                      

LDAP 偐傜摼偨 passwd 僄儞僩儕傪 NSCD 僾儘僌儔儉偑僉儍僢僔儏偟偰偟傑偆偲
偄偆偙偲傪怱偵柫婰偟偰偍偄偰偔偩偝偄丅

偙傟偼偮傑傝丄LDAP 僒乕僶忋偺儐乕僓忣曬偵庤傪壛偊偨偲偒偵傕 NSCD 僉儍僢
僔儏偼桳岠側傑傑偩偲偄偆偙偲偱偡丅偙偺栤戣偼丄 check-files 僨傿儗僋僥傿
僽偵傛偭偰捠忢偺 UNIX 僼傽僀儖傪棙梡偡傟偽旔偗傜傟傑偡丅偙傟偼懳墳偡傞
僼傽僀儖偑曄峏偝傟偨偲偒偵偼僉儍僢僔儏傪柍岠偵偟傑偡丅偙偺傛偆側巇慻傒
偼堦斒揑側偼偢側偺偵丄尰帪揰偱 LDAP 偵偼揔梡偝傟傑偣傫丅LDAP 僒乕僶偲僉
儍僢僔儏偺娫偺晄惍崌傪旔偗傞曽朄偼丄passwd 僄儞僩儕傪峏怴偟偨偲偒偵師偺
僐儅儞僪傪懪偭偰帺暘偱僉儍僢僔儏傪柍岠偵偡傞偙偲偱偡丅

#nscd --invalidate=TABLE                                               

忋婰 TABLE 偺偲偙傠偼 passwd, groups, hosts 偺偄偢傟偐偵側傝傑偡丅

帋梡帪偵偼丄崿棎傪旔偗傞偨傔 NSCD 傪巊傢側偄傛偆偵偟偰偔偩偝偄丅

偝傜偵尵偊偽丄NSS 偲 NSCD 偺巊梡偼戝検偺僼傽僀儖僨僗僋儕僾僞傪奐偄偰偟
傑偄傑偡丅偦偺偨傔丄僔僗僥儉忋偺巊偊傞僼傽僀儖僨僗僋儕僾僞偑娙扨偵晄懌
偟偰偟傑偄傑偡 (偙傟偼僔僗僥儉傪僴儞僌偝偣偐偹傑偣傫)丅

Linux 儅僔儞 (僇乕僱儖 2.2.x) 偱偼丄師偺傛偆偵偟偰僼傽僀儖僨僗僋儕僾僞
偺忋尷傪憹傗偡偙偲偑偱偒傑偡丅

#echo 16384 > /proc/sys/fs/file-max                                    

悇彠偝傟傞僼傽僀儖僨僗僋儕僾僞忋尷抣偼丄偲偵偐偔偦偺僔僗僥儉偺峔惉偵埶
懚偟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.2.2.4. LDAP 僋儔僀傾儞僩偺愝掕僼傽僀儖

LDAP 僋儔僀傾儞僩偺愝掕僼傽僀儖偱偁傞 /etc/ldap.conf 偼丄懠偺 LDAP 僋儔
僀傾儞僩偐傜偲摨條丄pam_ldap 傗 nss_ldap 偐傜傕撉傑傟傑偡丅埲壓偼丄偦偺
僼傽僀儖偑崱夞偺娐嫬偱偼偳偺傛偆偵側偭偰偄傞傋偒偐偺堦椺偱偡丅

#                                                                            
# @(#)$Id: ldap.conf,v 2.18 2001/03/28 23:35:00 lukeh Exp $                  
# 偙傟偼 LDAP NSS 儔僀僽儔儕偲 LDAP PAM 儌僕儏乕儖偺偨傔偺愝掕僼傽僀儖偱偡丅 
# PADL Software                                                              
# http://www.padl.com                                                        
#                                                                            
# 傕偟偙偺僼傽僀儖偵 host 傕 base 傕側偗傟偽丄偦偺偲偒偼                     
# _ldap._tcp.[defaultdomain]. 偲偄偆 DNS RR 偑夝寛偝傟傑偡丅                 
# [defaultdomain] 偼幆暿柤偵妱傝摉偰傜傟丄                                   
# 栚昗偺儂僗僩偼僒乕僶偲偟偰巊傢傟傞偙偲偵側傝傑偡丅                         
#                                                                            
# 帺暘偺 LDAP 僒乕僶偱偡丅LDAP 傪巊傢偢偵夝寛偱偒側偔偰偼側傝傑偣傫丅        
host 192.111.111.111                                                         
#                                                                            
# 専嶕儀乕僗偺幆暿柤偱偡丅                                                   
base dc=yourorg, dc=com                                                      
#                                                                            
# 巊梡偡傞 LDAP 偺僶乕僕儑儞偱偡丅(僨僼僅儖僩偼 2 偱偡偑丄                   
# OpenLDAP 2.0.x 傗 Netscape Directory Server 傪巊偆側傜 3 偵偟偰偔偩偝偄)   
# ldap_version 3                                                             
#                                                                            
# 僒乕僶偵僶僀儞僪偡傞幆暿柤偱偡丅                                           
# 巜掕偼擟堄偱偡 乗 巜掕偟側偗傟偽摻柤僶僀儞僪偱偡丅                         
# binddn cn=manager,dc=padl,dc=com                                           
#                                                                            
# 僶僀儞僪偡傞帒奿徹柧偱偡丅                                                 
# 巜掕偼擟堄偱偡 乗 巜掕偟側偗傟偽帒奿徹柧偑晄梫偱偡丅                       
#bindpw secret                                                               
#                                                                            
# 億乕僩偱偡丅                                                               
# 巜掕偼擟堄偱偡 乗 巜掕偟側偗傟偽 389 偱偡丅636 偼 LDAPS 梡偱偡丅           
port 636                                                                     
#                                                                            
# 専嶕僗僐乕僾偱偡丅                                                         
#scope sub                                                                   
#scope one                                                                   
#scope base                                                                  
#                                                                            
# 埲壓偺僆僾僔儑儞偼 nss_ldap 摿桳偺傕偺偱偡丅                               
#                                                                            
# 帺暘偺 libc 偑巊偆僴僢僔儏偺傾儖僑儕僘儉偱偡丅                             
# 巜掕偼擟堄偱偡 乗 巜掕偟側偗傟偽 des 偱偡丅                                
#crypt md5                                                                   
#crypt sha                                                                   
#crypt des                                                                   
#                                                                            
# 埲壓偺僆僾僔儑儞偼 pam_ldap 摿桳偺傕偺偱偡丅                               
#                                                                            
# uid=%s 偵 AND 偡傞僼傿儖僞偱偡丅                                           
pam_filter objectclass=posixAccount                                          
#                                                                            
# 儐乕僓 ID 偺懏惈偱偡丅(僨僼僅儖僩偼 uid)                                   
pam_login_attribute uid                                                      
#                                                                            
# 僷僗儚乕僪億儕僔乕傪儖乕僩 DSE 偱専嶕偟傑偡丅                              
# (Netscape Directory Server 偵桳岠偱偡)                                     
# (栿拲丗儖乕僩 DSE 偵偮偄偰偼 Root Directory Server Specific Entry          
# 偺偙偲偩偲偄偆曬崘傪偄偨偩偒傑偟偨丅栿幰偼抦傝傑偣傫偱偟偨丅)              
#pam_lookup_policy yes                                                       
#                                                                            
# 偙偺僌儖乕僾偺儊儞僶偱偁傞偙偲傪嫮梫偟傑偡丅                               
#pam_groupdn cn=PAM,ou=Groups,dc=padl,dc=com                                 
#                                                                            
# 僌儖乕僾儊儞僶偺懏惈偱偡丅                                                 
pam_member_attribute memberuid                                               
# 僥儞僾儗乕僩儘僌僀儞偺懏惈偲丄僨僼僅儖僩偺僥儞僾儗乕僩儐乕僓偱偡丅         
# (偙傟埲慜偺儐乕僓偺僄儞僩儕撪偺懏惈偱忋彂偒偱偒傑偡)                       
#pam_login_attribute userPrincipalName                                       
#pam_template_login_attribute uid                                            
#pam_template_login nobody                                                   
#                                                                            
# 儘乕僇儖偵僷僗儚乕僪傪僴僢僔儏偟傑偡丅                                     
# University of Michigan 斉 LDAP 僒乕僶偵昁梫偲偝傟傑偡丅                    
# 傑偨丄傕偟 UNIX-Crypt 偺僴僢僔儏婡峔傪巊梡偟偰偍傝丄                       
# 偐偮 NT Synchronization (摨婜) 僒乕價僗傪巊梡偟偰偄側偄側傜偽              
# Netscape Directory Server 偱桳岠偱偡丅                                     
pam_crypt local                                                              
#                                                                            
# SSL 偺愝掕                                                                 
ssl yes                                                                      
sslpath /usr/local/ssl/certs                                                 

    Note: 偙偺僼傽僀儖傪撉傓偙偲偺偁傞庬乆偺傾僾儕働乕僔儑儞偲偺栤戣傪
    旔偗傞偨傔偵丄僷儔儊乕僞偲抣偲偺娫偵僞僽傪巊傢偢丄僗儁乕僗傂偲偮偩
    偗傪巊偆傛偆偍姪傔偟傑偡丅
   
pam_groupdn 僨傿儗僋僥傿僽偼 LDAP 僒乕僶偑堦楢偺僋儔僀傾儞僩偺擣徹忣曬
傪娗棟偟偰偄傞応崌偵丄儐乕僓偑擣壜偝傟傞偺傪堦晹偺僋儔僀傾儞僩偩偗偵尷
掕偟偨偄偲偒偵曋棙偱偡丅偙偺僨傿儗僋僥傿僽偼 NIS 偺 netgroups 偲摨偠婡
擻傪採嫙偡傞偙偲偑偱偒傞偺偱偡丅

SSL 愝掕偵娭偡傞僨傿儗僋僥傿僽偼僷僢働乕僕撪偱暥彂壔偝傟偰偄傑偣傫偑丄
SSL 傪桳岠偵偟丄LDAP 僒乕僶徹柧彂偍傛傃 CA 徹柧彂傪娷傓僼傽僀儖偑偳偙偵
奿擺偝傟偰偄傞偐巜掕偟傑偡丅

cert7.db 偲偄偆柤慜偺 Netscape 徹柧彂僨乕僞儀乕僗偑 sslpath 撪偱専嶕偝
傟傑偡丅偙偺僼傽僀儖偵偼僒乕僶徹柧彂偲 (偦偺僒乕僶徹柧彂偑帺屓彁柤偱側
偄偐偓傝) CA 徹柧彂偲傪娷傫偱偄側偗傟偽側傝傑偣傫丅偙偺僼傽僀儖傪惗惉偡
傞偵偼傆偨偮偺曽朄乗 Netscape PKCS#11 傪巊偆偐 Netscape 偺僽儔僂僓傪巊
偆偐乗偑偁傝傑偡丅

Netscape 偺僽儔僂僓傪巊偆応崌偼丄僒乕僶忋偱 slapd 偲 stunnel 傪婲摦偟偨
偁偲偱 Netscape Navigator 傪 https://your.ldap.server:636/ 偲偄偆 URL
偵愙懕偡傞偲丄帺暘偺僨乕僞儀乕僗偵偦偺僒乕僶徹柧彂傪擖椡偡傞傛偆懀偝傟
傑偡丅(帺屓彁柤偺徹柧彂傪巊傢側偄偺偱偁傟偽) 摨條偵 (CA 偐傜嫙媼偝傟傞)
CA 徹柧彂傕僨乕僞儀乕僗偵儘乕僪偟側偔偰偼側傝傑偣傫丅偙偙傑偱棃偨傜丄
$HOME/.netscape/cert7.db傪 sslpath 偵僐僺乕偱偒傑偡丅忋婰偺嶌嬈偺嵺丄僨
僼僅儖僩偺 cert7.db 傪帩偮弶婜忬懺偺傾僇僂儞僩偱峴側偆曽偑岲傑偟偄偱偡
丅側偤側傜帺暘偺徹柧彂僨乕僞儀乕僗偵偼懠偺僒乕僶徹柧彂偑偁傞偐傕偟傟偢
丄偁傞偲 LDAP 僋儔僀傾儞僩偑偦傟傪丄怣梡嵪傒偺擣徹僒乕僶側偺偩偲傒側偟
偰偟傑偆偐傜偱偡丅偄偭偨傫僒乕僶徹柧彂偑僀儞億乕僩偝傟偨僽儔僂僓偼 SSL
傪僨僶僢僌偡傞偨傔偵巊偊傑偡丅偦偺僽儔僂僓偼 pam 傗 nss 偺儔僀僽儔儕偺
傛偆偵傆傞傑偆偐傜偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.3. 婲摦

僒乕僶懁偱丄師偺傛偆側僐儅儞僪偵傛偭偰丄 slapd (LDAP 僨乕儌儞僾儘僙僗)
傪婲摦偟側偔偰偼偄偗傑偣傫丅

# slapd                                                                

傕偟 stunnel 傪巊偆側傜丄LDAPS 偺 636 斣偺億乕僩忋偱婲摦偟側偔偰偼偄偗
傑偣傫丅師偺傛偆偵偟偰偔偩偝偄丅

                                                                            
# /usr/local/sbin/stunnel -r ldap -d 636 -p /usr/local/ssl/certs/stunnel.pem

TLS (OpenSSL) 晅偒偱僐儞僷僀儖偝傟偨 OpenLDAP 2.0.x 傪巊偆偺偱偁傟偽丄
師偺僐儅儞僪偱僒乕僶傪婲摦偱偒傑偡丅

                                                                       
# slapd -h "ldap:/// ldaps:///"                                        

僋儔僀傾儞僩忋偱丄NSCD 傪懡偔偺僨傿僗僩儕價儏乕僔儑儞偵傆偮偆娷傑傟偰偄
傞婲摦僗僋儕僾僩偐傜婲摦偱偒傑偡丅

                                                                       
# /etc/rc.d/init.d/nscd start                                          

PAM 偲 NSS 偑揔愗偵愝掕偝傟偰偄傟偽丄偙傟偱廫暘偺偼偢偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.4. 傾僇僂儞僩偺曐庣娗棟

偙偙傑偱棃偨帪揰偱丄LDAP 僋儔僀傾儞僩僣乕儖傪巊偭偰傾僇僂儞僩嶌惉偲曐庣
娗棟偑偱偒傞偼偢偱偡丅

巆擮側偑傜斈梡揑側僣乕儖偺傎偲傫偳偼 Un*x 傾僇僂儞僩偺娗棟梡偵偼偱偒偰
偄傑偣傫丅偦傟偵尒崌偆婡擻偑偁傞傛偆偵巚偊傞傕偺偼丄 LDAP Browser/
Editor (http://www-unix.mcs.anl.gov/~gawor/ldap) 偑偁傝丄偦傟偼怓乆側彂
幃偱僷僗儚乕僪偺愝掕偑偱偒丄僒乕僶偵愙懕偡傞偨傔偵 SSL 傪巊梡偱偒傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.5. 婛抦偺惂尷帠崁

扨撈偺儅僗僞僒乕僶偵傛傞 (僗儗乕僽僒乕僶偺側偄) NIS 偺応崌偲摨條偵丄儗
僾儕働乕僔儑儞傪棙梡偟側偄 LDAP 偼擣徹婡峔偵偲偭偰乽a single point of
failure (扨堦婡婍偺忈奞偑僔僗僥儉慡懱偺忈奞偲側偭偰偟傑偆庛揰)乿偱偁傞
偲尵偊傑偡丅偱偡偐傜 LDAP 儗僾儕働乕僔儑儞傪幚憰偡傞偙偲偼丄擣徹偲偄偆
栚揑偺偨傔偵偼堦憌廳梫偲尵偊傑偡丅OpenLDAP (slapd) 偵傛傞僒乕僶偼儗僾儕
働乕僔儑儞婡擻傪旛偊偰偄傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

2.6. 僼傽僀儖偺僷乕儈僢僔儑儞

埲壓偼擣徹僔僗僥儉偱巊傢傟傞僼傽僀儖偵揔梡偝傟偰偄傞傋偒僷乕儈僢僔儑儞
偺堦晹偱偡丅

                                                                       
-rw-r--r--  root.root /etc/ldap.conf                                   
-rw-------  root.root /usr/local/etc/openldap/slapd.conf               
-rwxr-xr-x  root.root /lib/security/pam_ldap.so.1                      
-rw-r--r--  root.root /lib/libnss_ldap-2.1.2.so                        
-rw-r--r--  root.root /usr/local/ssl/certs/cert7.db                    
-rw-------  root.root /usr/local/ssl/certs/stunnel.pem                 

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

3. LDAP 傪巊偭偨 Radius 擣徹

Radius 僒乕僶偼丄Radius 僾儘僩僐儖僒乕僶偺奐愝傪 Un*x 僆儁儗乕僥傿儞僌
僔僗僥儉偱壜擻偲偡傞僨乕儌儞偱偡丅偙傟偼傆偮偆丄僟僀傾儖傾僢僾儐乕僓偺
擣徹偍傛傃傾僇僂儞僩娗棟偺偨傔偵巊傢傟傑偡丅僒乕僶傪棙梡偡傞偵偼丄偦偺
僒乕僶偵榖偟偐偗傞偙偲偵側傞僋儔僀傾儞僩傕揔愗偵愝掕偡傞昁梫偑偁傝傑偡
丅捠忢丄僋儔僀傾儞僩偼僞乕儈僫儖僒乕僶偐丄傑偨偼僞乕儈僫儖僒乕僶傪僄儈
儏儗乕僩偡傞揔愗側僜僼僩 (PortSlave 傗 radiusclient 摍乆) 偺偁傞 PC 偱
偡丅 [FreeRadius 偺 FAQ 傛傝]

Radius 偼儐乕僓偵偮偄偰偺帺慜偺僨乕僞儀乕僗傪帩偭偰偄傑偡偑丄摨偠忣曬偑
LDAP 偵傕娷傑傟偰偄傞偺偱丄偙偭偪傪巊偆曽偑曋棙偱偡両

僼儕乕僂僃傾偺 Radius 僒乕僶偼婔偮偐偁傝傑偡偑丄 LDAP 傊偺僒億乕僩偑椙
偄傕偺偵 FreeRadius 偲偄偆僒乕僶 (http://www.freeradius.org) 偑偁傝傑偡
丅偙傟偼傑偩奐敪斉偲偼偄偊丄 LDAP 儌僕儏乕儖偼偆傑偔摦嶌偟偰偄傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

3.1. FreeRadius 斉 Radiusd 偺愝掕

僒乕僶傪僀儞僗僩乕儖偟偨側傜丄愝掕僼傽僀儖傪梡偄偰愝掕偟側偔偰偼側傝傑
偣傫丅愝掕僼傽僀儖偼 /etc/raddb (傑偨偼 /usr/local/etc/raddb) 埲壓偵攝
抲偝傟偰偄傑偡丅

radiusd.conf 偺撪梕偼丄埲壓偺傛偆偵曇廤偟偰偔偩偝偄丅

[徣棯]                                                                 
# Uncomment this if you want to use ldap (Auth-Type = LDAP)            
# Also uncomment it in the authenticate{} block below                  
        ldap {                                                         
                server   = ldap.yourorg.com                            
                #login    = "cn=admin,o=My Org,c=US"                   
                #password = mypass                                     
                basedn   = "ou=users,dc=yourorg,dc=com"                
                filter   = "(&(objectclass=posixAccount)(uid=%u))"     
        }                                                              
                                                                       
[徣棯]                                                                 
                                                                       
# Authentication types, Auth-Type = System and PAM for now.            
authenticate {                                                         
        pam                                                            
        unix                                                           
#       sql                                                            
#       sql2                                                           
# Uncomment this if you want to use ldap (Auth-Type = LDAP)            
        ldap                                                           
}                                                                      
[徣棯]                                                                 

傑偨丄dictionary 僼傽僀儖傕埲壓偺傛偆偵曇廤偟偰偔偩偝偄丅

[徣棯]                                                                 
#                                                                      
#       Non-Protocol Integer Translations                              
#                                                                      
                                                                       
VALUE           Auth-Type               Local                   0      
VALUE           Auth-Type               System                  1      
VALUE           Auth-Type               SecurID                 2      
VALUE           Auth-Type               Crypt-Local             3      
VALUE           Auth-Type               Reject                  4      
VALUE           Auth-Type               ActivCard               4      
VALUE           Auth-Type               LDAP                    5      
[徣棯]                                                                 

偝傜偵 users 僼傽僀儖偺僨僼僅儖僩偺擣徹曽幃偺僄儞僩儕傪師偺傛偆偵偟偰偔
偩偝偄丅

[徣棯]                                                                 
DEFAULT         Auth-Type = LDAP                                       
                Fall-Through = 1                                       
[徣棯]                                                                 

偡偱偵 LDAP 僒乕僶傪 Un*x 偺傾僇僂儞僩娗棟偺偨傔偵愝掕偟偰偁傟偽丄偙傟
偱廫暘偱偡丅

LDAP 僒乕僶忋偱偼丄Radius 僒乕僶偑偁傜備傞 posixAccount 偺懏惈 (摿偵
uid 偲 userpassword) 傪妋幚偵撉傓偙偲偑偱偒傞傛偆偵偟偰偍偄偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

3.2. Radius 擣徹偺僥僗僩

僒乕僶傪僥僗僩偡傞偨傔偵丄師偺傛偆偵 radiusd 傪僨僶僢僌儌乕僪偱婲摦偟偰
偔偩偝偄丅

/usr/local/sbin/radiusd -X -A                                          

偦傟偐傜師偺傛偆側峔暥偱 radtest 傪巊偄傑偡丅

radtest 儐乕僓柤 "僷僗儚乕僪" radius.yourorg.com 1 testing123          

偡傋偰偆傑偔偄偗偽丄Access-Accept 僷働僢僩傪偦偺 Radius 僒乕僶偐傜庴怣
偡傞偼偢偱偡丅

僋儔僀傾儞僩儌乕僪偱 stunnel 傪巊偭偰丄 Radius 僒乕僶偲 LDAPS 僒乕僶娫
偺愙懕偵 SSL 傪採嫙偡傞偙偲傕偱偒傑偡丅 SSL 偺徻嵶偵偮偄偰偼 Section 10
傪嶲徠偟偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

3.3. Cisco IOS 偺愝掕椺

枩慡傪婜偡傞偨傔偵丄偙偙偵 Cisco IOS 偺愝掕椺傪彂偄偰偍偒傑偡丅偨偩丄偙
偺椺偼偙偺 HOWTO 偺栚揑偲偼奜傟偰偄傑偡偺偱丄偁側偨偺梫媮偵偼揔崌偟偰偄
側偄偐傕偟傟傑偣傫丅

[徣棯]                                                                 
aaa new-model                                                          
aaa authentication login default radius enable                         
aaa authentication ppp default radius                                  
aaa authorization network radius                                       
[徣棯]                                                                 
radius-server host 192.168.10.1                                        
radius-server timeout 10                                               
radius-server key cisco                                                
[徣棯]                                                                 

    Note: 傎偲傫偳偡傋偰偺 NAS 偼 Radius 偵 1645 斣偺億乕僩傪巊梡偟傑偡
    丅妋擣偺偆偊丄揔愗偵僒乕僶傪愝掕偟偰偔偩偝偄丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

4. Samba

尰帪揰偺 stable 僣儕乕偺 Samba 偵偼 LDAP 僒億乕僩偑娷傑傟偰偄傑偣傫丅
HEAD 偍傛傃 TNG 僽儔儞僠偵偼娷傑傟偰偄傞偼偢偱偡偑丄偦傟傜偺僽儔儞僠偼
傑偩寖偟偄奐敪偺搑忋偵偁傝傑偡丅埨掕斉偑儕儕乕僗偝傟偨偲偒偵丄偦偺
Samba 偺幚憰偵偮偄偰偙偙偵彂偔偙偲偵偟傑偡丅偦傟傑偱偼丄Ignacio Coupeau
偵傛傞偙偺暥彂 <http://www.unav.es/cti/ldap-smb/
ldap-smb-HEAD-howto.html> 傪尒偰偍偔偲偄偄偱偟傚偆丅偙傟偵偼椉僽儔儞僠
偱偺 LDAP 偺愝掕朄偑婰弎偝傟偰偄傑偡丅

偲偵偐偔尰帪揰偱偼丄傑偩 smbpasswd 僼傽僀儖傪巊傢側偔偰偼側傝傑偣傫丅儐
乕僓傾僇僂儞僩忣曬偺 LDAP 偐傜偺庢摼偼婛偵壜擻側偺偱偡偑丅(偙傟偼 Samba
偱偼側偔 nsswitch 偵傛偭偰峴側傢傟偰偄傞偨傔偱偡丅) Samba 偑 LDAP 傪僒
億乕僩偡傟偽丄尰嵼 smbpasswd 僼傽僀儖偲 smbusers 僼傽僀儖偵擖傟偰偁傞忣
曬傪 LDAP 偵奿擺偡傞偙偲偑壜擻偵側傞偼偢偱偡丅 samba 偺嫟桳傪摦揑偵
LDAP 偱掕媊偱偒傞傛偆偵側傞偐偳偆偐偵偮偄偰偼昅幰偼抦傝傑偣傫偑丄偨傇傫
晄壜擻偩傠偆偲巚偭偰偄傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

5. DNS

LDAP 宱桼偱愝掕偱偒傞 DNS 偵偼丄傆偨偮偺乽宍幃乿偑偁傝傑偡丅嵟弶偺傕偺
偼丄(傑偨傕傗) nss_ldap 傪丄DNS 偺戙傢傝偵巊偆偲偄偆傕偺偱偡丅偙傟偼偮
傑傝丄/etc/nsswitch.conf 僼傽僀儖偵庤傪壛偊偨僋儔僀傾儞僩偩偗偑 LDAP 偐
傜 DNS 僄儞僩儕傪尒傜傟傞傛偆偵側傞偲偄偆偙偲偱偡丅傆偨偮傔偺曽朄偼
LDAP 傪 bind 傗 tinydns 偺僶僢僋僄儞僪偲偟偰巊梡偡傞偙偲偱偡丅偙傟偵娭
楢偟偰妶摦偟偰偄傞僾儘僕僃僋僩偼婔偮偐偁傝傑偡丅偦傟偼偺偪傎偳愢柧偡傞
偙偲偵偟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

5.1. NSS 傪巊偆

NSS 傪 (晅壛揑側) 儂僗僩僄儞僩儕傊偺傾僋僙僗偵巊偭偰偄傞偲偒偵偼丄乽恊
枾乿側儅僔儞 (偮傑傝丄帺暘偑抦偭偰偄偰丄偦偺愝掕傪惂屼偡傞偙偲傕偱偒傞
儅僔儞) 偩偗偑偙偺僒乕價僗傪巊偊傞偺偩偲偄偆偙偲偵拲堄偟偰偔偩偝偄丅偙
傟偼僀儞僩儔僱僢僩偱偺丄偙傠偙傠曄傢傞儂僗僩柤夝寛偵偼桳梡偐傕偟傟傑偣
傫偑丄帺暘偺僂僃僽僒乕僶偺僶乕僠儍儖儂僗僩柤傪慡悽奅偵岞奐偡傞偵偼巊偊
傑偣傫丅傑偨 nslookup 偼 /etc/hosts 傕 LDAP 傕宱桼偟側偄偨傔丄愝掕偑偆
傑偔偄偭偰偄傞偐偳偆偐偺妋擣偵偼巊偊側偄偲偄偆偙偲傕妎偊偰偍偄偰偔偩偝
偄丅偐傢傝偵丄ping 偺傛偆偵撪晹偱 gethostbyname() 娭悢傪巊偭偰柤慜夝寛
偟偰偄傞傕偺傪巊偆傛偆偵偟偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

5.1.1. 愝掕

Name Service Switch 偵 LDAP 偱柤慜夝寛偝偣傞偵偼丄 nss_ldap 傪巊偆傛偆
愝掕偟側偔偰偼側傝傑偣傫丅 nss_ldap 偺愝掕曽朄偼 Section 2 偵彂偄偰偁傝
傑偡丅偙偙偱偼惓忢偵摦偄偰偄傞 nss_ldap 偺愝掕偑偁傞傕偺偲偟偰榖傪懕偗
傑偡丅 NSS 偵傛傞柤慜夝寛偼 /etc/nsswitch.conf 撪偺 hosts 峴偺撪梕偱惂
屼偝傟傑偡丅傑偩 hosts 峴偑側偄偲偄偆偙偲偼丄傑偢偁傝傑偣傫丅偨傇傫 
files 偲 dns 偑僄儞僩儕偲偟偰彂偐傟偰偄傞偙偲偱偟傚偆丅偦偙偵 ldap 傪丄
師偺傛偆偵捛壛偡傞偺偱偡丅

hosts:          files, dns, ldap                                       

弴斣傪傛偔峫偊偰巜掕偟偰偔偩偝偄両偳偺傛偆側応崌偱傕嵟弶偵 files 傪抲偔
傛偆拤崘偟偰偍偒傑偡丅偦傟偐傜丄LDAP 傪儘乕僇儖 DNS 僒乕僶傛傝傕桪愭偝
偣偨偄側傜偽丄LDAP 僒乕僶偺 IP 偑妋幚偵 /etc/hosts 僼傽僀儖偺拞偵偁傞傛
偆偵偟偰偔偩偝偄丅偦偆偟側偄偲丄崲偭偨嵞婣夝寛偑惗偠偰偟傑偄傑偡丅偮傑
傝偙偆偄偆偙偲偱偡丅乽偁傞儂僗僩柤傪夝寛偟偨偄偗傟偳丄僼傽僀儖撪偵偼僄
儞僩儕偑側偄偺偱丄 LDAP 僒乕僶偵栤偄崌傢偣傛偆偲偡傞丅偟偐偟僒乕僶偺 IP
傪抦傜側偄偺偱僼傽僀儖撪傪扵偟偰傒傞偑丄偦偙偵偼側偄偺偱 LDAP 僒乕僶偵
暦偙偆偲偡傞乧乧乿梫揰偑偮偐傔傑偟偨偹丠偙偺栤戣偼丄儂僗僩柤偺偐傢傝偵
IP 斣崋偱 LDAP 僒乕僶傪嶲徠偡傞 (偮傑傝 /etc/ldap.conf 偺拞偵彂偄偰偍
偔) 偙偲偵傛偭偰丄姰慡偵夞旔偡傞偙偲偑偱偒傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

5.1.2. 僗僉乕儅

偙偺僒乕價僗傗摨條偺僒乕價僗偵巊傢傟傞僗僉乕儅偑 RFC 2307 偵掕媊偝傟偰
偄傑偡丅IP 斣崋偵儂僗僩柤傪妱傝摉偰傞偨傔偺僄儞僩儕偼 ipHost 偲偄偆
objectclass 偵擖傝傑偡丅妱傝摉偰偺儂僗僩柤偺晹暘偼 cn 懏惈偺拞偵擖傟傜
傟丄 IP 晹暘偺曽偼 ipHostNumber 偵擖傝傑偡丅偱偡偐傜丄揟宆揑側 LDIF 偺
僄儞僩儕偼偙偺傛偆偵側傝傑偡丅

dn: cn=somehostname.mydomain.com,ou=Network,o=YourOrg,c=NL             
objectclass: top                                                       
objectclass: ipHost                                                    
cn: somehostname.mydomain.com                                          
ipHostNumber: 10.1.5.13                                                

傕偪傠傫丄傆偮偆 DNS 偵晅悘偡傞惂尷傗婡擻偼偙偺僒乕價僗偵傕摉偰偼傑傝傑
偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

5.2. bind 傪巊偆

崱擔偱偼 bind 傗 tinydns 偵傕懡彮偺壜擻惈偼偁傝傑偡偑丄偙傟傜偺偄偢傟傕
丄挊幰偺堄尒偱偼 (崱偺偲偙傠) 乽傎傫偲偆偺乿夝寛嶔偱偼偁傝傑偣傫丅偟偐
偟側偑傜丄挊幰偑偦傟傜傪巊偭偨宱尡偑側偄偲偄偆偙偲傕尵偭偰偍偐側偔偰偼
側傝傑偣傫丅偦傟傜傪埲壓偵楍嫇偟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

5.2.1. bind 僿偺僷僢僠

David Storey 偑 bind 傊偺僷僢僠偺嶌嬈傪偟偰偄傑偡丅偙偺僷僢僠偼丄僨乕僞
傪捈愙 LDAP 偐傜庢摼偡傞傛偆偵偡傞傕偺偱偡丅偦傟偼 bind 僨乕儌儞忋偵梫
媮偑側偝傟傞偨傃偵 LDAP 偱夝寛偡傞偙偲傪堄枴偟傑偡丅尰帪揰偱偺斵偺寁夋
(僜乕僗偐傜堷梡) 偼丄乽彮側偔偲傕傆偨偮偺儌乕僪乗僉儍僢僔儏儌乕僪偲僟僀
僫儈僢僋儌乕僪乗偱摦偔傛偆偵偡傞偙偲乿偱偡丅僉儍僢僔儏儌乕僪偱偼丄偪傚
偆偳 rbtdb 偺傛偆偵丄僝乕儞傪傑傞偛偲儊儌儕偵儘乕僪偟偰摦嶌偟丄僒乕僶偑
HUP 僔僌僫儖傪庴偗傞偲儘乕僪偟側偍偟傑偡丅僟僀僫儈僢僋儌乕僪偱偼尰忬偲
傛偔帡偰偄偰丄偡傋偰偺梫媮偑 LDAP 傊偺嶲徠偲側傝傑偡丅嵟怴忣曬偼僜乕僗
<ftp://ftp.eyeo.com/bind/> 傪妋擣偟偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

5.2.2. ldap2dns

僂僃僽僒僀僩偐傜傑傞偛偲堷梡偟傑偡丅

乽ldap2dns 偼 DNS 儗僐乕僪傪捈愙 LDAP 僨傿儗僋僩儕偐傜嶌惉偡傞僾儘僌儔
儉偱偡丅偙傟偼丄僙僇儞僟儕僱乕儉僒乕僶傪戞擇偺僾儔僀儅儕僒乕僶偱抲姺偡
傞偨傔偵巊偆偙偲偑偱偒傑偡偟丄偦偺偨傔偵巊偆傋偒偱偡丅 ldap2dns 偼偁傜
備傞斚傢偟偄娗棟嶌嬈傪寉尭偡傞彆偗偵側傝傑偡丅傕偆扨挷側僼傽僀儖曇廤偼
昁梫偁傝傑偣傫丅僝乕儞僼傽僀儖曇廤傕昁梫偁傝傑偣傫丅 ldap2dns 傪僀儞僗
僩乕儖偟偰偟傑偊偽丄娗棟幰偼偨偩 LDAP 僨傿儗僋僩儕偵傾僋僙僗偡傞偩偗偱
傛偄偺偱偡丅朷傓側傜丄娗棟幰偼僝乕儞偛偲偵傾僋僙僗僐儞僩儘乕儖傪偐偗傞
偙偲偑偱偒傑偡丅僂僃僽儀乕僗偺 GUI 傪嶌惉偟偰丄DNS 偵姳徛偡傞偙偲側偔丄
偁傜備傞庬椶偺僝乕儞傗儕僜乕僗儗僐乕僪偺忣曬傪捛壛偡傞偙偲傕偱偒傑偡丅
ldap2dns 偼 tinydns 偵巊梡偝傟傞 data.cdb 偲偄偆僶僀僫儕僼傽僀儖傪彂偒
弌偡傛偆愝寁偝傟偰偄傑偡偑丄named 偵巊梡偝傟傞 .db 僼傽僀儖傪彂偒弌偡傛
偆偵偡傞偙偲傕偱偒傑偡丅乿

偙偺僾儘僕僃僋僩偺儂乕儉儁乕僕偼偙偙 <http://ldap2dns.tiscover.com/> 偱
偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

5.2.3. ispman

ispman 偼 Perl 偱彂偐傟偨 ISP 娗棟僷僢働乕僕偱偡丅偙傟偼 LDAP 僨乕僞儀
乕僗傪愝掕偺僶僢僋僄儞僪偵巊偄傑偡丅偙偺僷僢働乕僕偼旕忢偵懡偔偺偙偲偑
偱偒傞偺偱丄惓妋偵帺暘偺昁梫偲偟偰偄傞傕偺傪妋擣偟偨曽偑傛偄偐傕偟傟傑
偣傫丅傾僪儗僗偼 ispman.org <http://www.ispman.org> 偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

6. 儊乕儖僩儔儞僗僼傽僄乕僕僃儞僩 (MTA)

偙偺復偱偼丄傒偭偮偺堎側傞 MTA, 偮傑傝 Sendmail, Postfix, qmail 偵偮偄
偰弎傋傑偡丅偙傟傜偼 LDAP 偐傜忣曬傪庢傝弌偡傛偆偵愝掕偱偒傞 MTA 偱偡丅
屄恖揑側宱尡偐傜偡傞偲 Postfix 偺曽偑 Sendmail 傛傝傕偢偭偲娙扨偵愝掕偱
偒傑偡偑丄偙傟偵偮偄偰偼彨棃丄 Sendmail 偵偍偗傞 LDAP 僒億乕僩偑偝傜偵
惉弉偺堟偵払偡傞偙偲偱曄傢偭偰偔傞偐傕偟傟傑偣傫丅qmail 偼巊偭偨偙偲偑
偁傝傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

6.1. Sendmail

6.1.1. Sendmail 偵偍偗傞 LDAP 僒億乕僩

Sendmail 偵偼丄僶乕僕儑儞 8.8.x 偁偨傝偐傜 ldapx 偲偄偆儅僢僾僞僀僾傪巊
偆偐偨偪偱 LDAP 偑僒億乕僩偝傟偰偄傑偡丅僶乕僕儑儞 8.10 埲崀偱偼 LDAP
僨乕僞儀乕僗僞僀僾偑 ldap 偲偟偰僒億乕僩偝傟偰偄傑偡丅偟偐偟 LDAP 儅僢
僾偺僒億乕僩偼丄RedHat 偺僷僢働乕僕偺僨僼僅儖僩偺傑傑偺愝掕偱偼柍岠偵側
偭偰偄傞偺偱丄偛拲堄偔偩偝偄丅 Debian 偺僶乕僕儑儞 2.2 埲崀偵偼
Sendmail 偺 LDAP 僒億乕僩偑偁傞偦偆偱偡丅帺暘偱僐儞僷僀儖偡傞昁梫偑偁傞
応崌偼丄 Sendmail 偺僜乕僗偺 sendmail/README 偲偄偆僼傽僀儖傪撉傫偱偔偩
偝偄丅偙偺僼傽僀儖偵偼丄LDAP 僒億乕僩晅偒偱僐儞僷僀儖偡傞曽朄偵偮偄偰偺
桳塿側忣曬偑娷傑傟偰偄傑偡丅

偙傟傜怴媽偺 LDAP 儅僢僾僞僀僾偵偼丄偲傕偵 LDAP 僨乕僞儀乕僗撪偺僄儞僩
儕傪専嶕偡傞擻椡偑偁傝傑偡丅偨偩偟丄傂偲偮拲堄偑偁傝傑偡丅専嶕偺姰椆帪
偵寢壥偑傂偲偮偟偐曉偭偰偙側偄偺偱偡丅寢壥偑暋悢偁傞偲偟偰傕丄嵟弶偺傕
偺偩偗偑巊傢傟傑偡丅偟偐傕丄偦偺寢壥偵曉傝抣偑暋悢偁偭偰傕嵟弶偺抣偩偗
偑曉偝傟傞偺偱偡丅師偺 LDIF 僼傽僀儖偺椺偵拲栚偟偰傒傑偟傚偆丅

dn: cn=mailuser1,ou=mail,dc=company,dc=com                             
objectclass: top                                                       
objectclass: foo                                                       
cn: mailuser1                                                          
mail: mailuser1@company.com                                            
mail: info@company.com                                                 

専嶕傪 cn=mailuser1 偺傛偆側扨弮側専嶕僼傿儖僞偱幚峴偡傞偲丄媮傔傞懏惈
偑 mail 偩偲偟偰傕 mailuser1@company.com 偟偐曉偝傟傑偣傫丅椉曽偺寢壥傪
摼傞偵偼丄偙傟傜偼扨堦抣傪帩偮懏惈偵丄僐儞儅偱嬫愗傜傟偨偐偨偪偱奿擺偝
傟偰偄側偗傟偽側傜側偄偺偱偡丅師偺傛偆側偐偨偪偱偡丅

mail: mailuser1@company.com,info@company.com                           

偙偺榖戣偵娭楢偟偨忣曬傪娷傓揹巕儊乕儖儊僢僙乕僕傪丄 LIH 儂乕儉 <http:/
/devel.linvision.com/doc/lih/alias_issues> 偱尒傞偙偲偑偱偒傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

6.1.2. 僔僗僥儉偺攝抲

LDAP 儅僢僾偑棙梡偱偒傞偲偒偵偼丄傎偲傫偳壗偱傕 LDAP 僨乕僞儀乕僗撪偐傜
扵偟弌偣傑偡丅偦偙偱丄埲壓偺傛偆側峔惉偺愝掕傪娙慺壔偟偨偄偲巚偄傑偡丅

拞婯柾傕偟偔偼戝婯柾偺僱僢僩儚乕僋偑偁傞偙偲偵偟傑偟傚偆丅偨偔偝傫偺僪
儊僀儞偺偨傔偵儊乕儖傪庴怣偟傑偡丅傆偨偮偺儊乕儖儂僗僩偲丄傆偨偮偺僼僅
乕儖僶僢僋儂僗僩偲偄偆攝抲偱偡丅偙傟偩偲捠忢偼丄埲壓偺嶰庬椶偺忣曬傪奿
擺偡傞応強偑丄巐売強偵傑偱側偭偰偟傑偄傑偡丅

 丒 椉曽偺儊乕儖儂僗僩偑 local-host-names 僼傽僀儖 (揱摑偵廬偊偽
    sendmail.cw) 傪昁梫偲偟傑偡丅偙傟偼丄偳偺僪儊僀儞傊偺儊乕儖傪庴怣偡
    傞偐偵偮偄偰婰榐偟偰偍偔傕偺偱偡丅僼僅乕儖僶僢僋儂僗僩偼摨偠忣曬傪
    access 僼傽僀儖偵曐帩偟偰偄傑偡偑丄偙偪傜偼庴怣儊乕儖傪偳偺僪儊僀儞
    傊拞宲偡傋偒偐堦棗偡傞偨傔偵巊偄傑偡丅
   
 丒 儊乕儖儂僗僩偵偼椉曽偲傕 virtusers 僼傽僀儖偑偁傝傑偡丅偙偺僼傽僀儖
    偱暋悢偺傾僪儗僗 (偁傞偄偼僪儊僀儞慡懱) 傪扨撈偺壖憐儐乕僓傗儘乕僇
    儖儐乕僓偵妱傝摉偰傑偡丅
   
 丒 椉儊乕儖儂僗僩偵 aliases 僼傽僀儖偑偁傝傑偡丅偙偺僼傽僀儖偱壖憐儐乕
    僓傪儊乕儖傾僪儗僗傗儘乕僇儖儐乕僓偵妱傝摉偰傑偡 (暋悢傕壜)丅
   
偙偆偟偨忣曬偑傂偲偮偺僨乕僞儀乕僗偵傑偲傔偰奿擺偝傟偰偄傟偽丄奺儂僗僩
偑偦偺僨乕僞儀乕僗偐傜愝掕傪撉傒弌偡偙偲偵傛偭偰丄僱僢僩儚乕僋偺奼挘惈
偲娗棟偟傗偡偝偑岦忋偟傑偡丅慡僨乕僞傪 nfs 偵儅僢僾偝偣偰丄偦傟傪扨撈偺
儂僗僩偵帩偨偣傞傛偆側宍偩偭偰峫偊傜傟傞偱偟傚偆丅偦偺傛偆側応崌傕愙懕
偡傞儂僗僩偵堘偄偼傑偭偨偔惗偠傑偣傫丅儐乕僓偵偲偭偰傕傑偭偨偔摨條偵塮
傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

6.1.3. Sendmail 愝掕僼傽僀儖

偙偺忣曬偑偳偆傗偭偰 LDAP 僨乕僞儀乕僗偐傜昗弨僼傽僀儖偺戙傢傝偵撉傒弌
偝傟傞偐傪棟夝偡傞偵偼丄sendmail.cf 僼傽僀儖偵偮偄偰偺攚宨揑側抦幆偑彮
偟昁梫偱偡丅偙偙偱埖偆忣曬偼丄傆偨偮偺堎側傞曽朄偱奿擺偝傟偰偄傑偡丅
local-host-names 僼傽僀儖偼丄僋儔僗偵撉傒崬傑傟傑偡 (惓妋偵偼僋儔僗 w
偱偡丅偙偺備偊偵愄偼 cw 偲偄偆奼挘巕偑晅偄偰偄傑偟偨)丅堦曽偱 virtusers
僼傽僀儖偼扨弮側儅僢僾傪捠偟偰巊傢傟傑偡丅aliases 僼傽僀儖傕儅僢僾偱偡
偑丄掕媊曽朄偑堎側傝傑偡偟丄撪晹偱巊傢傟傞偺偱丄儖乕儖撪偱嶲徠偝傟傞傢
偗偱偼偁傝傑偣傫丅

忣曬偑 LDAP 僨乕僞儀乕僗偐傜庢傝弌偝傟傞偲偒偵偼昁偢儅僢僾撪偱姰寢偟傑
偡丅local-host-names 僼傽僀儖偵奿擺偝傟傞傋偒忣曬偵偲偭偰偼丄偙偺揰偑傗
傗栤戣偲側傝傑偡丅偙偺僼傽僀儖偺忣曬偼僋儔僗偵巊傢傟傞偐傜偱偡丅挊幰偼
偙傟傑偱偺偲偙傠丄儅僢僾摍偐傜偺忣曬偱僋儔僗傪枮偨偣偨偨傔偟偑偁傝傑偣
傫丅娙扨偵偱偒偦偆側傕偺偱偡偑丄偳偆傕晄壜擻側傛偆偱偡 (娫堘偄偑偁傟偽
丄偳偆偐偍抦傜偣偔偩偝偄)丅偦偺偨傔怴偟偔儅僢僾傪掕媊偟側偔偰偼側傝傑偣
傫偱偟偨丅Sendmail 偺愝掕偱丄 w 僋儔僗撪偺抣傪撉傓偲偒偵 (傎傏) 枅夞丄
偦偺儅僢僾偐傜抣偑専嶕偝傟傞傛偆側儖乕儖傪捛壛偟偨偺偱偡丅

儅僢僾偵偮偄偰偼丄愝掕曄峏偑娙扨偱偡丅捠忢丄儅僢僾偼柤慜偲丄僨乕僞儀乕
僗僞僀僾偲丄奺僨乕僞儀乕僗摿桳偺僆僾僔儑儞 (椺偊偽捠忢巊傢傟傞 newdb 僨
乕僞儀乕僗僞僀僾偱偺僼傽僀儖偺埵抲側偳) 偲偱掕媊偝傟偰偄傑偡丅偦傟偱儅
僢僾偵偮偄偰偼丄掕媊傪曄峏偡傞偩偗偱廫暘偱偡丅傎傜丄傕偆偱偒傑偟偨丅偝
偰丄LDAP 儅僢僾偵偼偝傜偵婔偮偐偺僆僾僔儑儞偑偁傝丄偦偺偆偪偺偄偔偮偐偼
帠慜偵僌儘乕僶儖掕媊偟偰偍偗傑偡丅偦傟傜偺僆僾僔儑儞偼師偺儕僗僩偱愢柧
偝傟偰偄傑偡 (偙偺儕僗僩偼丄戝晹暘 Booker Bense 偺暥彂偵傛傝傑偡)丅

sendmail.cf 偵偍偗傞 LDAP 摿桳偺儅僢僾僆僾僔儑儞

-h
   
    僗儁乕僗嬫愗傝偱 LDAP 僒乕僶偺儂僗僩柤傪掕媊偟傑偡丅偙偺弴斣偱栤偄
    崌傢偣傪峴側偭偰偄偒丄寢壥偑弌偨傜偦偙偱廔椆偟傑偡丅僌儘乕僶儖偵愝
    掕偱偒傑偡丅
   
-b
   
    LDAP 専嶕儀乕僗傪掕媊偟傑偡丅偮傑傝丄偦偺 LDAP 僨傿儗僋僩儕撪偩偗傪
    専嶕偡傞偺偱偡丅僌儘乕僶儖偵愝掕偱偒傑偡丅
   
-k
   
    LDAP 専嶕僼傿儖僞傪掕媊偟傑偡丅偙傟偼乽sprintf乿宍幃偺暥帤楍偱丄儅
    僢僾偑擖椡抣傪偳偺傛偆偵庴偗庢偭偰 LDAP 専嶕傪峔抸偡傞偺偐掕媊偟傑
    偡丅専嶕偡傞抣傪 %s 偱抲姺偟偨丄堦斒揑側 LDAP 専嶕僼傿儖僞偺宍幃傪
    偲傝傑偡丅LDAP 専嶕僼傿儖僞偵偮偄偰偝傜偵妛傃偨偄曽偼丄 RFC 2254
    <http://www.cis.ohio-state.edu/htbin/rfc/rfc2254.html> 傪偛棗偔偩偝
    偄丅偲偙傠偱丄偙偺専嶕僼傿儖僞偲忋婰偺専嶕儀乕僗偲偱偼丄嵟戝偱傕傂
    偲偮偺僄儞僩儕偟偐曉偝側偄傛偆側専嶕傪掕媊偡傋偒偱偡丅 LDAP 儅僢僾
    偼丄庴偗庢偭偨嵟弶偺僄儞僩儕偩偗傪棙梡偡傞偺偱偡丅
   
-v
   
    偳偺 LDAP 懏惈偺抣偑儅僢僾専嶕偱曉偝傟傞偙偲偵側傞偺偐傪掕媊偟傑偡
    丅徻嵶偼屻弎偟傑偡丅
   
LDAP 僆僾僔儑儞偼偡傋偰僟僽儖僋僅乕僩偟丄 Sendmail 僆僾僔儑儞偺捈屻偵抲
偐側偗傟偽側傝傑偣傫丅偛拲堄偔偩偝偄丅椺傪嫇偘傑偡丅

Kldapexamplemap ldap -h"localhost ldap.myorg.com" -b"ou=mail,dc=myorg,dc=com" -k"(&(objectclass=mailstuff)(uid=%s))" -v"mailaddress"

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

6.1.4. 僗僉乕儅

挊幰偼丄偙偺摿暿側愝掕偺偨傔偵丄mail 偲偄偆僒僽僣儕乕傪 LDAP 僨傿儗僋僩
儕撪偱掕媊偟偰偄傑偡丅偙偺壓偵儊乕儖娭楢偺偁傜備傞忣曬傪奿擺偡傞偨傔偱
偡丅儐乕僓娭楢偺儊乕儖忣曬偼 ou=Users 偺僒僽僣儕乕偵擖傟偰偍偔偙偲傕壜
擻偩偭偨偱偟傚偆偑丄偦傟偼傢偞偲旔偗傑偟偨丅奺儐乕僓偲暿偵扨堦偺僒僽僣
儕乕傪巊偆曽偑丄Sendmail 偺偨傔偺忣曬偑偡傋偰堦売強偵奿擺偝傟傞偺偱丄偨
偔偝傫偺儐乕僓偑偄傞偲偒偺専嶕偑懍偔側傞偺偱偡丅側偤側傜丄専嶕偡傞昁梫
偑偁傞偺偼 ou=Users 僒僽僣儕乕慡懱偱偼側偔丄ou=mail 偩偗偩偐傜偱偡丅

偙偺僒僽僣儕乕撪偵擇庬椶偺儗僐乕僪傪嶌傝傑偡丅

 1. virtuser 僼傽僀儖傗 aliases 僼傽僀儖偵桼棃偡傞丄壖憐儐乕僓傂偲傝傂
    偲傝偺妱傝摉偰傪曐帩偡傞僄儞僩儕偱偡丅椉僼傽僀儖偐傜偺妱傝摉偰傪摨
    偠僄儞僩儕偵奿擺偡傞偙偲偵偟傑偟偨丅偙傟偵傛偭偰丄梡偄偰偄傞愝掕傗
    岠壥偑柧妋偵側傞偐傜偱偡丅偙傟偵偼丄inetmailrecipient 偲偄偆
    objectclass 偲丄 mailid, mailacceptinggeneralid, maildrop 偲偄偆傒
    偭偮偺懏惈傪掕媊偟傑偟偨丅
   
    inetmailrecipient
       
        偙偺奒媺偼丄偙偺僄儞僩儕偑丄堦偮傑偨偼暋悢偺幚儊乕儖傾僪儗僗傗
        儊乕儖僪儊僀儞偐傜丄堦恖傑偨偼暋悢恖偺幚儐乕僓傊偺儅僢僺儞僌偱
        偁傞偙偲傪帵偟傑偡丅
       
    mailid
       
        偙偺壖憐儐乕僓偑庴怣偡傞儊乕儖傾僪儗僗傪婰弎偟傑偡丅 
        foo@myorg.com 偺傛偆偵晛捠偺傾僪儗僗偺宍幃偱傕寢峔偱偡偟丄 
        @my2nd.org 偺傛偆偵僪儊僀儞偛偲偱傕戝忎晇偱偡丅偙偺懏惈偼暋悢懚
        嵼偱偒傑偡偑丄奿擺偡傞抣偼偦傟偧傟傂偲偮偢偮偱側偗傟偽側傝傑偣
        傫丅偙傟傜偺 ID 偦傟偧傟偵懳偟偰丄儊乕儖偑 
        mailacceptinggeneralid 偵憲傜傟傑偡丅
       
        偙偙偵偼丄崱傑偱 virtusers 僼傽僀儖偺嵍懁偵偁偭偨僨乕僞傪擖傟傞
        偙偲偵側傞傢偗偱偡丅
       
    mailacceptinggeneralid
       
        壖憐儐乕僓傪掕媊偟傑偡丅幚偼丄偙傟偑 virtusers 僼傽僀儖偲
        aliases 僼傽僀儖偲偺宷偓栚偱偡丅偙偺懏惈偑奺僄儞僩儕偵傂偲偮偢
        偮懚嵼偟偰偄側偔偰偼側傝傑偣傫偑丄偦傟傛傝懡偔偰傕偄偗傑偣傫丅
        偟偐傕抣傪傂偲偮偟偐擖傟傜傟傑偣傫丅抣偵偼儘乕僇儖儐乕僓柤偐壖
        憐儐乕僓傪擖傟傞偙偲偑偱偒傑偡丅屻幰偺応崌偼 maildrop 懏惈偑懚
        嵼偟側偔偰偼側傝傑偣傫丅慜幰偵偼昁梫偁傝傑偣傫丅
       
        偙偙偵偼丄偙傟傑偱 virtusers 僼傽僀儖偵偁偭偨忣曬偲 aliases 僼
        傽僀儖偺嵍懁偵偁偭偨忣曬傪擖傟傞偙偲偵側傞傢偗偱偡丅
       
    maildrop
       
        庴怣偟偨儊乕儖偺攝怣愭偲側傞傾僪儗僗傗儐乕僓傪掕媊偟傑偡丅偙偺
        懏惈偼傂偲偮偟偐懚嵼偱偒傑偣傫偑丄僐儞儅嬫愗傝偺儕僗僩傪擖傟傜
        傟傑偡丅 mailacceptinggeneralid 偺抣偑壖憐儐乕僓側傜丄偙偺懏惈
        偼昁恵偱偡丅幚嵼偡傞儐乕僓側傜徣棯偱偒傑偡丅
       
        偮傑傝丄偙偙偵偼 aliases 僼傽僀儖偺塃懁偺晹暘傪擖傟傞偲偄偆偙偲
        偱偡丅
       
    堦斒揑偵丄mailid 偲 mailacceptinggeneralid 偲偑堦弿偵側偭偰
    virtusers 僼傽僀儖偺婡擻傪採嫙偡傞偲尵偊傑偡丅偦偟偰 
    mailacceptinggeneralid 偲 maildrop 偲偑 aliases 僼傽僀儖偺婡擻傪採
    嫙偡傞偺偱偡丅
   
 2. 捠忢 sendmail.cw 僼傽僀儖傗 access 僼傽僀儖偵偁傞僪儊僀儞柤傪曐帩偡
    傞僄儞僩儕偱偡 (暋悢偮偔傟傑偡)丅偙偺僄儞僩儕偺偨傔偵 
    inetmaildomain 偲偄偆 objectclass 偲 maildomain, sendmailislokalkey
    , sendmailaccesskey 偲偄偆懏惈傪掕媊偟傑偟偨丅
   
    inetmaildomain
       
        僔僗僥儉偵懏偡傞儊乕儖僪儊僀儞偺堦棗偱偁傝丄偐偮丄儘乕僇儖偵攝
        憲偡傋偒偐懠儂僗僩偵揮憲偡傋偒偐偺堦棗偱偁傞僄儞僩儕傪昞偡奒媺
        偱偡丅
       
    maildomain
       
        儊乕儖僪儊僀儞傪掕媊偟傑偡丅傂偲偮偺僄儞僩儕偵暋悢懚嵼偱偒傑偡
        丅抣偼乽@乿儅乕僋側偟偺僪儊僀儞偵側傝傑偡丅
       
        偙偺懏惈偼丄local-host-names 僼傽僀儖撪偺僪儊僀儞偺僄儞僩儕偛偲
        偵丄傂偲偮偢偮懚嵼偟偰偄傞傋偒偱偡丅
       
    sendmailislocalkey
       
        僪儊僀儞偑儘乕僇儖偐偳偆偐傪尒暘偗傞偨傔偵 Sendmail 偺儖乕儖偺
        拞偱巊偆丄僔儞僾儖側崌尵梩 (僉乕) 傪掕媊偟傑偡丅 Sendmail 儖乕
        儖偺拞偱巊偆暥帤楍偲惓妋偵堦抳偟偰偄側偔偰偼側傜側偄偲偄偆偙偲
        傪彍偗偽丄杮摉偵壗偱傕峔偄傑偣傫丅挊幰偼偲傝偁偊偢 <LDAPLOCAL>
        傪巊偭偰偄傑偡丅昁恵懏惈偱丄奺僄儞僩儕偵暋悢偼懚嵼偱偒傑偣傫丅
       
    sendmailaccesskey
       
        Sendmail 偺儖乕儖偱巊傢傟傞僉乕偺偆偪丄壗傪巊偆偐掕媊偟傑偡丅偙
        偺僉乕偱丄偦偺僪儊僀儞偱峴偆傋偒摦嶌傪寛掕偟傑偡丅 RELAY, OK, 
        REJECT, DISCARD 偲僄儔乕昞帵傪巊偊傑偡丅(徻偟偔偼 Sendmail 偺僜
        乕僗撪偺 cf/README 僼傽僀儖傪嶲徠偟偰偔偩偝偄丅)
       
        Note: 偛拲堄偔偩偝偄丅崱夞偼摿暿側愝掕偲偟偰丄access 僼傽僀儖偱
        偼僪儊僀儞傑傞偛偲偺僄儞僩儕偟偐巊傢側偄偙偲偵偟傑偟偨丅偙傟偼
        偮傑傝丄maildomain 懏惈傪 access 僼傽僀儖偺忣曬偵傕 
        local-host-names 偺忣曬偵傕巊偄夞偣傞偺偼崱夞偺傛偆側応崌偩偗偩
        偲偄偆偙偲偱偡丅傾僋僙僗儕僗僩傪傕偭偲嵶偐偔惂屼偟偨偄側傜偽丄
        堦弿偺 maildomain 懏惈偵偟偰偟傑傢偢偵丄偦傟偧傟暿偺僄儞僩儕傪
        巊偆傋偒偱偡丅
       
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

6.1.5. 偝傜側傞忣曬偺偨傔偵

桳梡偲巚傢傟傞忣曬尮傪偄偔偮偐徯夘偟傑偡丅

 丒 Booker Bense 偑偙偆偄偆暥彂 <http://www.stanford.edu/~bbense/ldap/
    Inst.html> 傪彂偄偰偔傟傑偟偨丅Sendmail 8.9.3 偱偺 LDAP 偺巊梡朄偵
    娭偡傞傕偺偱偡丅 Sendmail 偲 LDAP 偺巊偄曽傪妛廗偡傞嵺偺弌敪抧揰偵
    偼岦偄偰偄側偄丄偲杮恖偼尵偭偰偄傑偡偑丄挊幰偵偲偭偰偼丄偨偄傊傫彆
    偗偵側傝傑偟偨丅
   
 丒 LDAP 偲 Sendmail 偵娭偡傞怴拝婰帠 <http://ldapman.org/articles/
    index.html> 偑 sendmail.net <http://www.sendmail.net> 忋偱岞奐偝傟
    偰偄傑偡丅嶌幰偼 Michael Donnelly 偱丄偦傕偦傕 ldapmap.org <http://
    /www.ldapmap.org> 偲偄偆丄偙傟傑偨嫽枴怺偄堦斒揑側 LDAP 娭楢忣曬枮
    嵹偺僒僀僩偐傜巒傑傝傑偟偨丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

6.2. Postfix

6.2.1. 僒億乕僩

Postfix 偱偼丄杮懱偵嵟弶偐傜 LDAP 僒億乕僩偑擖偭偰偄傑偡丅僆僾僔儑儞偺
懡偔傪愝掕偡傞儅僢僾偺偨偔偝傫偺庬椶偺側偐偵丄LDAP 傕偁傞偺偱偡丅奺
LDAP 儅僢僾偵偮偒丄僆僾僔儑儞偑擇丄嶰偁傝傑偡丅 (Section 6.2.2 傪嶲徠偟
偰偔偩偝偄丅)

Postfix 偵 LDAP 僨乕僞儀乕僗撪偺僨乕僞傪専嶕偝偣傞偨傔偺庤弴偼丄嬌傔偰
傢偐傝傗偡偔側偭偰偄傑偡丅嵟傕堦斒揑側巊偄曽 (偲挊幰偑巚偆傕偺) 偼丄壖
憐儐乕僓傪 LDAP 僨乕僞儀乕僗偐傜嶲徠偝偣傞偙偲偱偡丅偙傟傪慜弎偺
nss_ldap 偲偲傕偵巊偊偽丄偡傋偰偺揹巕儊乕儖棙梡幰偺忣曬傪 LDAP 僨乕僞儀
乕僗偵擖傟偰偍偗傑偡丅偟偐偟丄愝掕偱偒傞崁栚偼懠偵傕偁傝傑偡丅椺偊偽
Postfix 偑儊乕儖傪揮憲偱偒傞僪儊僀儞傗丄媡偵 Postfix 偑揮憲梫媮傪庴偗晅
偗傞僪儊僀儞丄傑偨僶僢僋傾僢僾僒乕僶偲偟偰摦嶌偡傋偒僪儊僀儞偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

6.2.2. 愝掕

愝掕僆僾僔儑儞偵娭偡傞愢柧偼偡傋偰丄僶乕僕儑儞 20001217 偵偍偗傞
Postfix docs 偺 LDAP_README 偐傜堷梡偟偰偄傑偡丅

server_host
   
    LDAP 僒乕僶傪摦偐偟偰偄傞儂僗僩偺柤慜偱偡丅愝掕椺傪嫇偘傑偡丅
   
    ldapsource_server_host = ldap.your.com                      
   
    慜弎偟偨慡偰偺儔僀僽儔儕偱丄暋悢偺僒乕僶傪僗儁乕僗偱嬫愗偭偰巜掕偡
    傞偙偲傕偱偒傑偡丅嵟弶偺傕偺偑幐攕偡傞偲丄儔僀僽儔儕偼偦傟傜傪弴偵
    帋峴偟傑偡丅乽ldap.your.com:1444乿偲偄偆傛偆偵彂偄偰丄奺僒乕僶偵偦
    傟偧傟堎側傞億乕僩傪搉偡偙偲傕偱偒傑偡丅
   
server_port (389)
   
    LDAP 僒乕僶偑梫媮傪庴偗晅偗傞億乕僩偱偡丅椺偊偽偙偆側傝傑偡丅
   
    ldapsource_server_port = 778                                
   
search_base (婛掕抣側偟乗愝掕偑昁梫偱偡)
   
    専嶕偡傞嵟忋埵僨傿儗僋僩儕偱偡丅椺偊偽偙偆偱偡丅
   
    ldapsource_search_base = dc=your, dc=com                    
   
timeout (10 昩)
   
    専嶕寢壥傪偁偒傜傔傞傑偱偺昩悢偱偡丅椺偊偽偙偆巜掕偟傑偡丅
   
    ldapsource_timeout = 5                                      
   
query_filter (mailacceptinggeneralid=%s)
   
    僨傿儗僋僩儕専嶕偵巊偆丄RFC2254 幃僼傿儖僞偱偡丅 Postfix 偑夝寛偟傛
    偆偲偡傞傾僪儗僗偺偲偙傠偵丄戙傢傝偵 %s 傪擖傟傑偡丅椺偼師偺偲偍傝
    丅
   
    ldapsource_query_filter = (&(mail=%s)(paid_up=true))        
   
domain (婛掕抣側偟乗愝掕偑昁梫偱偡)
   
    僪儊僀儞柤丄僼傽僀儖傊偺僷僗丄偍傛傃帿彂偺堦棗偱偡丅巜掕偝傟偰偄傞
    偲丄偙偺拞偵偁傞僪儊僀儞偱柤慜偑廔傢傞儂僗僩偟偐専嶕偟傑偣傫丅偙傟
    偵傛偭偰 LDAP 僒乕僶傊偺栤偄崌傢偣晧壸傪寑揑偵寉尭偱偒傑偡丅
   
    ldapsource_domain = postfix.org,                            
    hash:/etc/postfix/searchdomains                             
   
result_attribute (maildrop)
   
    専嶕偵傛偭偰曉偝傟傞僨傿儗僋僩儕僄儞僩儕偐傜儊乕儖傾僪儗僗夝寛偺偨
    傔偵撉傒崬傓懏惈偱偡 (暋悢傕壜)丅
   
    ldapsource_result_attribute = mailbox,maildrop              
   
special_result_attribute (婛掕抣側偟)
   
    僄儞僩儕偺偆偪丄DN 傗 URL 傪娷傫偱偄傞懏惈偱偡 (暋悢傕壜)丅巜掕偝傟
    偰偄傞偲丄偦偺抣傪巊偭偰嵞婣揑偵弴師専嶕偟偰偄偒傑偡丅
   
    ldapsource_special_result_attribute = member                
   
scope (sub)
   
    LDAP 専嶕僗僐乕僾乗 sub, base, one 偺偄偢傟偐乗偱偡丅偦傟偧傟
    LDAP_SCOPE_SUBTREE, LDAP_SCOPE_BASE, LDAP_SCOPE_ONELEVEL 偵曄姺偝傟
    傑偡丅
   
bind (yes)
   
    LDAP 僒乕僶偵僶僀儞僪偡傞偐偳偆偐偺巜掕偱偡丅 LDAP 偺嵟嬤偺幚憰偱偼
    僶僀儞僪傪昁梫偲偣偢丄帪娫傪愡栺偱偒傑偡丅愝掕椺偼師偺偲偍傝丅
   
    ldapsource_bind = no                                        
   
    僶僀儞僪偡傞昁梫偑偁傞側傜丄儘乕僇儖儅僔儞偺億乕僩傪 LDAP 僒乕僶傊
    偺 SSL 僩儞僱儖偵偟偰丄偦偙偵愙懕偝偣偨曽偑傛偄偐傕偟傟傑偣傫丅
    LDAP 僒乕僶偑 SSL 傪僒億乕僩偟偰偄側偗傟偽丄僒乕僶懁偺僔僗僥儉偵傕
    僩儞僱儖傪愝抲偟傑偡 (儔僢僷偱傕僾儘僋僔偱傕丄屇傃曽偼偍岲傒偱)丅偙
    傟偱丄僷僗儚乕僪偑僱僢僩儚乕僋傪娵尒偊偺傑傑捠夁偟側偔側傝傑偡丅
   
bind_dn ("")
   
    僶僀儞僪偡傞昁梫偑偁傞偲偒丄偙偺幆暿柤偱僶僀儞僪偟傑偡丅椺偊偽偙偆
    偱偡丅
   
    ldapsource_bind_dn = uid=postfix, dc=your, dc=com           
   
bind_pw ("")
   
    忋偺幆暿柤偺僷僗儚乕僪偱偡丅偙傟傪巊偆昁梫偺偁傞偲偒偼偒偭偲丄
    main.cf 傪 Postfix 儐乕僓偐傜偟偐尒偊側偄傛偆偵偟偨偄偲巚偆偼偢偱偡
    丅愝掕椺偼偙偆側傝傑偡丅
   
    ldapsource_bind_pw = postfixpw                              
   
cache (no)
   
    LDAP 愙懕偵僋儔僀傾儞僩僒僀僪僉儍僢僔儏傪巊偆偐偳偆偐偱偡丅
    ldap_enable_cache(3) 傪嶲徠偟偰偔偩偝偄丅偙傟偼僨僼僅儖僩偱偼僆僼偵
    側偭偰偄傑偡丅
   
cache_expiry (30 昩)
   
    僋儔僀傾儞僩僒僀僪僉儍僢僔儏偑桳岠側偲偒丄偙偙偱巜掕偟偨昩悢偺屻偱
    丄寢壥偺僉儍僢僔儏傪攋婞偟傑偡丅
   
cache_size (32768 僶僀僩)
   
    僋儔僀傾儞僩懁偺僉儍僢僔儏偑桳岠側傜丄偦偺僶僀僩悢偱偡丅
   
dereference (0)
   
    偳偆偄偆偲偒偵 LDAP 僄僀儕傾僗傪扝傞偐偺巜掕偱偡丅 (Postfix 偺僄僀
    儕傾僗偲偼娭學偁傝傑偣傫偺偱拲堄偟偰偔偩偝偄丅) OpenLDAP 偲 UM LDAP
    偺幚憰偱桳岠側抣偼埲壓偺捠傝偱偡丅
   
    0 堦愗偟側偄                                    
    1 専嶕帪                                        
    2 専嶕偺偨傔偵儀乕僗僆僽僕僃僋僩偺埵抲傪扵偡偲偒
    3 忢偵偡傞                                      
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

6.2.3. 愝掕椺

僶乕僠儍儖僪儊僀儞 (foo.virtualdomain.com 偲偟傑偡) 傪巊偄偨偄偲偒丄偦
偟偰偦偺僪儊僀儞偺儊乕儖傾僪儗僗傪 LDAP 偵奿擺偟偨偄偲偒偵偼丄 main.cf
偵埲壓偺傛偆偵彂偔昁梫偑偁傝傑偡丅

virtual_maps = ldap:ldapvirtual                                        
ldapvirtual_search_base = ou=mail,o=YourOrg,c=nl                       
ldapvirtual_query_filter = (mailacceptinggeneralid=%s)                 
ldapvirtual_domain = foo.virtualdomain.com                             
ldapvirtual_result_attribute = maildrop                                
ldapvirtual_bind = no                                                  
ldapvirtual_scope = one                                                

偙偺愝掕偱偼丄Postfix 偑乽foo.virtualdomain.com乿僪儊僀儞偺儐乕僓傊偺儊
乕儖傪庴怣偡傞偲丄 mailacceptinggeneralid 偲偄偆懏惈偑乽
user@foo.virtualdomain.com乿偵崌抳偡傞僄儞僩儕傪扵偟傑偡丅偦偺傛偆側僄
儞僩儕偑偁傟偽丄maildrop 懏惈偺抣偑偡傋偰曉偭偰偒傑偡丅偦偙偵儊乕儖偑攝
憲偝傟傞偺偱偡丅傕偟乽user@foo.virtualdomain.com乿偑側偗傟偽丄僪儊僀儞
慡懱傪傂偭偔傞傔偨儐乕僓偵崌抳偡傞傛偆偵丄乽@foo.virtualdomain.com乿偲
偄偆暿偺栤偄崌傢偣傪偟傑偡丅偙傟傕側偄偲偒偼丄儊僢僙乕僕偑夞憲 (僶僂儞
僗) 偝傟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

6.3. qmail

qmail 帺懱偵偼傑偭偨偔 LDAP 僒億乕僩偑偁傝傑偣傫丅偟偐偟側偑傜 Andre
Oppermann 偺 LDAP 僒億乕僩偺僷僢僠偑偁傝傑偡丅偙傟偺僷僢働乕僕偼丄暥彂
傕娷傔偰斵偺僒僀僩 <http://www.nrg4u.com> 偵偁傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

7. 傾僪儗僗僽僢僋

Linux 僒乕僶忋偺 LDAP 僨乕僞儀乕僗偺旕忢偵曋棙側摿挜偲偟偰丄慻怐偵撪晹
僱僢僩儚乕僋偑偁傟偽奜晹偺楢棈愭傪偡傋偰堦売強偵廤傔偰偍偗傞偲偄偆偺偑
偁傝傑偡丅偦傟傪僌儖乕僾丄偁傞偄偼晹偵暘妱偡傞偙偲傕偱偒傑偡丅傕偼傗廬
嬈堳傂偲傝傂偲傝偵暿乆偺傾僪儗僗僽僢僋傪搉偡昁梫偼側偄偺偱偡丅偙傟偼丄
LDAP 傪巊傢側偗傟偽 Microsoft Exchange Server 傗 Lotus Domino, 傑偨
Active Directory [5] 偱傕偱偒傞偙偲偱偡 (栿拲丗Exchange 摍乆偺僨傿儗僋
僩儕僒乕價僗傕幚偼 LDAP 傪巊偭偰偄傞偲巚傢傟傑偡)丅 

Microsoft 偺乽傾僪儗僗挔乿偲偦傟偵埶懚偡傞僾儘僌儔儉丄偮傑傝 Microsoft
Outlook 傗 Microsoft Outlook Express, 傑偨 Microsoft Outlook 2000 偲偄
偭偨傕偺傪巊偆傇傫偵偼丄LDAP 偺婎杮愝掕傪曄偊傞昁梫偼偁傝傑偣傫丅偲偼偄
偊丄庤傪壛偊傞昁梫偺偁傞傕偺偑傆偨偮偁傝傑偡丅

戞堦偵丄傾僪儗僗傗娭楢僨乕僞傪婰榐偡傞偨傔偺僨傿儗僋僩儕僣儕乕傪嶌惉偟
側偔偰偼側傝傑偣傫丅Section 12 偵丄偳傫側僄儞僩儕偑偙偺僣儕乕偵巊傢傟傞
偺偐偑彂偄偰偁傝傑偡丅

戞擇偵丄儘乕僇儖僱僢僩儚乕僋忋偺偁傜備傞儂僗僩偑偙偺僣儕乕偺撉傒崬傒尃
尷傪妋幚偵帩偭偰偄傞傛偆偵偟側偔偰偼側傝傑偣傫丅偙傟偼 Section 11 偱埖
傢傟傞偙偲偵側傝傑偡丅

Microsoft 偺揹巕儊乕儖偺僾儘僌儔儉偼偡傋偰 LDAP 僨傿儗僋僩儕僒乕價僗傪
巊偊傑偡丅恖暔傪専嶕偟偨偄側傜乽傾僪儗僗挔乿傪巊偭偰偔偩偝偄丅揹巕儊乕
儖偺怴婯儊僢僙乕僕傪彂偔偲偒偼柤慜偵揔摉側揹巕儊乕儖傾僪儗僗偑帺摦偱晅
壛偝傟傑偡丅偙傟偼 cn, sn, givenname 偦偟偰 mail 偺僼傿乕儖僪傪専嶕偟偰
峴側偄傑偡丅Microsoft 偺揹巕儊乕儖僾儘僌儔儉偱 LDAP 僒乕僶傪帺暘偺傾僪
儗僗僽僢僋偲偟偰巊偭偨傝揹巕儊乕儖傾僪儗僗偺専嶕梡偵愝掕偟偨偄偲偒偵偼
丄埲壓偺偙偲傪偡傞昁梫偑偁傝傑偡丅

 1. 岲傒偺揹巕儊乕儖僾儘僌儔儉傪婲摦偟偰傾僪儗僗挔傪奐偄偰偔偩偝偄丅偙
    傟偼丄偦偺僾儘僌儔儉偐傜乽僣乕儖仺傾僪儗僗挔乿傪慖戰偡傟偽偱偒傑偡
    丅偁傞偄偼僗僞乕僩儊僯儏乕偐傜乽僗僞乕僩仺僾儘僌儔儉仺傾僋僙僒儕仺
    傾僪儗僗挔乿傪慖傫偱偔偩偝偄丅
   
 2. 乽僣乕儖仺傾僇僂儞僩乿傪僋儕僢僋偟偰僀儞僞乕僱僢僩傾僇僂儞僩偺僂傿
    儞僪僂傪奐偒傑偡丅
   
 3. 乽捛壛乿(栿拲丗偝傜偵乽僨傿儗僋僩儕僒乕價僗乿傪慖傇傜偟偄偱偡) 傪僋
    儕僢僋偟偰偔偩偝偄丅偡傞偲僀儞僞乕僱僢僩愙懕僂傿僓乕僪偺僂傿儞僪僂
    偑弌偰偒傑偡偐傜丄帺暘偺 LDAP 僒乕僶偺 IP 傾僪儗僗偐儂僗僩柤傪擖椡
    偟偰乽師傊乿傪僋儕僢僋偟傑偡丅
   
 4. 師偺僂傿儞僪僂偱偼丄乽偼偄乿偲摎偊偰丄帺暘偑偙偺僨傿儗僋僩儕傪巊偭
    偰傾僪儗僗傪僠僃僢僋偟偨偄偺偩偲偄偆偙偲傪妋掕偟偰偔偩偝偄丅傕偟偔
    偼丄偦偆偟偨偔側偄側傜乽偄偄偊乿偲摎偊偰偔偩偝偄丅偱偼乽師傊乿偲乽
    姰椆乿傪僋儕僢僋偟偰偔偩偝偄丅
   
 5. 偡傞偲僀儞僞乕僱僢僩傾僇僂儞僩僂傿儞僪僂偵栠傝傑偡丅怴偟偔捛壛偝傟
    偨傾僇僂儞僩傪慖戰偟偰乽僾儘僷僥傿乿傪僋儕僢僋偟偰偔偩偝偄丅
   
 6. 僾儘僷僥傿僂傿儞僪僂偺乽徻嵶愝掕乿僞僽傪僋儕僢僋偟偰偔偩偝偄丅
   
 7. 乽専嶕儀乕僗乿偺僼傿乕儖僪偵丄傾僪儗僗偑婰榐偝傟傞僒僽僣儕乕偺嵟忋
    埵偺僄儞僩儕傪擖椡偟傑偡丅椺偲偟偰偼 ou=Addressbook,dc=yourorg,dc=
    com 偲偄偆傛偆偵側傝傑偡丅 (栿拲丗Windows 傾僪儗僗挔偱妋擣偟偨偲偙
    傠偱偼丄偙偙偵壗傕擖椡偟側偄偲 c=JP 傪巜掕偟偨偙偲偵側傝傑偡 (US 斉
    偱 c=US 偲側傞偐偼枹妋擣)丅専嶕儀乕僗傪杮摉偵嬻偵偟偨偄応崌偵偼
    NULL 偲擖椡偡傞昁梫偑偁傝傑偡丅)
   
 8. 乽OK乿傪墴偟偰僂傿儞僪僂傪暵偠丄乽暵偠傞乿傪僋儕僢僋偟偰僀儞僞乕僱
    僢僩傾僇僂儞僩僂傿儞僪僂傕暵偠傑偡丅偡傞偲傾僪儗僗僽僢僋偺儊僀儞僂
    傿儞僪僂偵栠偭偰偔傞偼偢偱偡丅
   
偙傟偱丄乽To:乿偺僼傿乕儖僪偵柤慜傪擖傟偰偍偔偲丄 (栿拲丗憲怣帪傕偟偔偼
柤慜妋擣帪偵) 揹巕儊乕儖傾僪儗僗偑 LDAP 僨傿儗僋僩儕偐傜扵偟弌偝傟偰丄
帺摦揑偵寛掕偝傟傑偡丅岓曗偑尒晅偐傜側偐偭偨傜僂傿儞僪僂偑尰傢傟傑偡偺
偱丄懪偪娫堘偄偑偁傟偽捈偟偰丄怴婯偵専嶕傪偡傞偙偲偑偱偒傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

8. Netscape 儘乕儈儞僌傾僋僙僗

偙傟偐傜彂偔偮傕傝偱偡丅

偙偺榖戣偵娭偡傞桪椙婰帠偑偙偙 <http://www.linuxworld.com/linuxworld/
lw-1999-09/lw-09-ldap-netscape.html> 偵偁傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

9. LDAP 偵傛傞僨僕僞儖徹柧彂偺敪峴

偙偺復偺徟揰偼丄僨僕僞儖徹柧彂傪 LDAP 僒乕僶撪偵敪峴偡傞曽朄偵偁傝傑偡
丅 Certification Authority (擣徹嬊) 傪塣塩偡傞側傜僨僕僞儖徹柧彂傪敪峴
偡傞昁梫偑偁傝傑偡丅LDAP 傊偺敪峴偼丄偙偺忣曬傪僱僢僩儚乕僋撪偱棙梡偱偒
傞傛偆偵偡傞僔儞僾儖側曽朄偺傂偲偮偱偡丅傑偨丄徹柧彂懳墳僜僼僩僂僃傾偺
懡偔傕丄朷傑偟偄儗億僕僩儕偲偟偰丄儐乕僓徹柧彂偵 LDAP 傪梡偄偰偄傑偡丅

偙偺曽朄偱偼儐乕僓徹柧彂傪懠偺儐乕僓忣曬偲堦弿偵偟偰偍偗傞偺偱丄僨乕僞
偺柍懯側暋惢偑昁梫側偔側傝傑偡丅

徹柧彂傪庢傝埖偆偵偼埫崋僣乕儖僉僢僩偑昁梫偱偡丅偙偙偱巊梡偡傞偺偼
OpenSSL 偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

9.1. LDAP 僒乕僶偺愝掕

偙偙偱巊梡偡傞 LDAP 僒乕僶偼 OpenLDAP 2.0.x 偱偡丅

LDAP 僒乕僶偼丄徹柧彂傪婰榐偡傞偨傔偺懏惈傪帩偰傞 objectclass 傪僒億乕
僩偟偰偄側偔偰偼側傝傑偣傫丅 LDAP 僒乕僶撪偵偼摿偵丄擣徹嬊徹柧彂丄徹柧
彂攋婞儕僗僩丄擣壜攋婞儕僗僩丄偦偟偰僄儞僪儐乕僓偺徹柧彂傪婰榐偟偰偍偔
昁梫偑偁傝傑偡丅

certificationAuthority 偲偄偆 objectclass 偼 authorityRevocationList
(偮傑傝擣壜攋婞儕僗僩), certificateRevocationList (徹柧彂攋婞儕僗僩),
cACertificate (擣徹嬊徹柧彂) 偲偄偆懏惈傪幚憰偟傑偡丅

inetOrgPerson 偲偄偆 objectclass 偼 usercertificate (儐乕僓徹柧彂) 偲偄
偆 (僶僀僫儕偺) 懏惈傪僒億乕僩偟傑偡丅

傑偨丄strongAuthenticationUser 偲偄偆崿崌 objectclass 傪巊偭偰丄旕
inetOrgPerson 僄儞僩儕偵徹柧彂傪晅偗傞偙偲傕偱偒傑偡丅

壓婰偺僗僉乕儅傪帺暘偺 slapd.conf 僼傽僀儖偵娷傔偰丄昁梫側僗僉乕儅傪
OpenLDAP 偵僀儞僋儖乕僪偟偰偔偩偝偄丅

                                                                       
include        /usr/local/etc/openldap/schema/core.schema              
include        /usr/local/etc/openldap/schema/cosine.schema            
include        /usr/local/etc/openldap/schema/inetorgperson.schema     

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

9.2. 徹柧彂偺敪峴

徹柧彂偼 ASN.1 偺 DER (Distinguished Encoding Rules) 傪巊偭偰僄儞僐乕僪
偝傟傑偡丅偦偺偨傔 LDAP 僒乕僶撪偵偼僶僀僫儕僨乕僞偱 (BER 僄儞僐乕僪偱)
敪峴偝傟側偔偰偼側傝傑偣傫丅

PEM 徹柧彂偼丄偙偺傛偆偵 OpenSSL 傪巊偭偰 DER 彂幃偵曄姺偱偒傑偡丅

openssl x509 -outform DER -in incert.pem  -out outcert.der             

偦偆偡傞偲丄OpenLDAP 偵傛偭偰採嫙偝傟傞 ldif 偲偄偆儐乕僥傿儕僥傿傪巊偭
偰 LDIF 僼傽僀儖傪嶌惉偱偒傑偡丅偙偆偱偡丅

ldif -b "usercertificate;binary" < outcert.der > cert.ldif             

偙偺僐儅儞僪偼 BASE64 偱僄儞僐乕僪偝傟偨 usercertificate 懏惈傪嶌惉偟傑
偡丅偙偺傛偆偵徹柧彂傪 LDIF 僄儞僩儕偵捛壛偱偒傑偡偺偱丄偦傟偐傜
ldapmodify 傪巊偭偰 (栿拲丗僒乕僶忋偺) 僄儞僩儕偵徹柧彂傪捛壛偱偒傑偡丅

ldapmodify -x -W -D "cn=Manager,dc=yourorg,dc=com" -f cert.ldif        

偙偺 cert.ldif 偼丄師偺傛偆側傕偺傪娷傫偱偄傑偡丅

dn: cn=user,ou=people,dc=yourorg,dc=com                                       
changetype: modify                                                            
add: usercertificate                                                          
usercertificate;binary:: MIIC2TCCAkKgAwIBAgIBADANBgkqhkiG9w0BAQQFADBGMQswCQYD 
 VQQGEwJJVDENMAsGA1UEChMESU5GTjESMBAGA1UECxMJQXV0aG9yaXR5MRQwEgYDVQQDEwtJTkZO 
 IENBICgyKTAeFw05OTA2MjMxMTE2MDdaFw0wMzA4MDExMTE2MDdaMEYxCzAJBgNVBAYTAklUMQ0w 
 CwYDVQQKEwRJTkZOMRIwEAYDVQQLEwlBdXRob3JpdHkxFDASBgNVBAMTC0lORk4gQ0EgKDIpMIGf 
 MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrHdRKJsobcjXz/OsGjyq8v73DbggG3JCGrQZ9f1Vm 
 9RrIWJPwggczqgxwWL6JLPKglxbUjAtUxiZm3fw2kX7FGMUq5JaN/Pk2PT4ExA7bYLnbLGZ9jKJs 
 Dh4bNOKrGRIxRO9Ff+YwmH8EQdoVpSRFbBpNnoDIkHLc4DtzB+B4wwIDAQABo4HWMIHTMAwGA1Ud 
 EwQFMAMBAf8wHQYDVR0OBBYEFK3QjOXGc4j9LqYEYTn9WvSRAcusMG4GA1UdIwRnMGWAFK3QjOXG 
 c4j9LqYEYTn9WvSRAcusoUqkSDBGMQswCQYDVQQGEwJJVDENMAsGA1UEChMESU5GTjESMBAGA1UE 
 CxMJQXV0aG9yaXR5MRQwEgYDVQQDEwtJTkZOIENBICgyKYIBADALBgNVHQ8EBAMCAQYwEQYJYIZI 
 AYb4QgEBBAQDAgAHMAkGA1UdEQQCMAAwCQYDVR0SBAIwADANBgkqhkiG9w0BAQQFAAOBgQCDs5b1 
 jmbIYVq2epd5iDjQ109SJ/V7b6DFw2NIl8CWeDPOOjL1E5M8dnlmCDeTR2TlBxqUZaBBJZPqzFdv 
 xpxqsHC0HfkCXAnUe5MaefFNAH9WbxoB/A2pkXtT6WGWed+QsL5wyKJaO4oD9UD5T+x12aGsHcsD 
 Cy3EVEaGEOl+/A==                                                             

傑偨丄LDIF 僼傽僀儖撪偱徹柧彂傪偙偺傛偆偵巜掕偡傞偙偲傕壜擻偱偡丅

userCertificate;binary:< file:///path/to/cert.der                      

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

9.3. LDAP 懳墳僋儔僀傾儞僩

僒乕僶偵徹柧彂傪婰榐偟偰偐傜丄偦傟傪偳偆傗偭偰庢傝弌偡偺偐晄巚媍偵巚偆
偐傕偟傟傑偣傫丅

懠偺僋儔僀傾儞僩偲摨條丄Netscape 偼 LDAP 僒乕僶偐傜帺摦揑偵徹柧彂傪庢傝
弌偡婡擻傪僒億乕僩偟偰偄傑偡丅乽僙僉儏儕僥傿仺儐乕僓徹柧彂仺僨傿儗僋僩
儕傪専嶕乿偲偡傞偙偲偱丄 LDAP 僨傿儗僋僩儕撪偺徹柧彂傪専嶕偟偰丄偦傟傪
Netscape 徹柧彂僨乕僞儀乕僗偵帺摦偱僀儞僗僩乕儖偡傞偙偲偑偱偒傞偺偱偡丅

偙偺懠偵丄徹柧彂傊偺僒億乕僩偺椙偄僋儔僀傾儞僩偵偼 web2ldap (
www.web2ldap.de <http://www.web2ldap.de/>) 偑偁傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

10. SSL/TLS 偲丄SSL/TLS 偺 LDAP 梡儔僢僷

10.1. SSL 偺娙扨側愢柧

Secure Socket Layer (SSL) 偼僷乕僥傿娫偺僙僉儏傾側揮憲宱楬傪採嫙偡傞傾
僾儕働乕僔儑儞儗僀儎僾儘僩僐儖偱偡丅 HTTP, LDAP, SMTP 摍乆偺傾僾儕働乕
僔儑儞儗儀儖偺僾儘僩僐儖偲 TCP/IP 偲偺娫傪偲傝傕偮傕偺偱丄岞奐尞埫崋僔
僗僥儉 (庬乆偺埫崋壔曽朄偑棙梡壜擻) 偲 X.509 徹柧曽幃偵婎偯偄偰偄傑偡丅

SSL 偼傕偲傕偲 Netscape 偺僾儘僩僐儖偱偟偨偑丄彊乆偵昗弨揑側傕偺偲側傝
丄崱偱偼 TLS (Transmission Layer Security) 偲屇偽傟傞傕偺偵側傝傑偟偨丅
堦斒揑偵 SSL/TLS 偲偟偰尵媦偝傟傑偡丅

SSL/TLS 僾儘僩僐儖偼埲壓偺婡擻傪採嫙偟傑偡丅

 丒 僨乕僞偺埫崋壔乗僋儔僀傾儞僩乛僒乕僶娫偺僙僢僔儑儞偑埫崋壔偝傟傑偡
    丅
   
 丒 僒乕僶擣徹乗僋儔僀傾儞僩懁偐傜丄僒乕僶偑杮暔偐偳偆偐傪専徹偡傞偙偲
    偑偱偒傑偡丅
   
 丒 儊僢僙乕僕姰慡惈乗僨乕僞偼揮憲拞偵庤傪壛偊傜傟傑偣傫丅偙傟偼乽man
    in the middle乿峌寕[6]傪杊巭偟傑偡丅 
   
 丒 僋儔僀傾儞僩擣徹乗僒乕僶偼僋儔僀傾儞僩偑杮暔偐偳偆偐専徹偱偒傑偡丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

10.2. OpenLDAP 偺 SSL/TLS 僒億乕僩

LDAP V3 偺僣乕儖僉僢僩偱偁傞 OpenLDAP 2.0.x 偐傜偼丄僒乕僶偵傛偭偰 SSL/
TLS 僒億乕僩偑旛偊傜傟偰偄傑偡丅偨偩偟 SSL/TLS 傪捛壛偡傞偨傔偵偼丄
OpenLDAP 2.0.x 偑 OpenSSL 偺儔僀僽儔儕傪巊偭偰僐儞僷僀儖偝傟傞昁梫偑偁
傝傑偡丅傑偨丄2.0.x 偵偼 Start-TLS 偺僒億乕僩傕偁傝傑偡丅

    Note: Start-TLS 偼丄僋儔僀傾儞僩偑梫媮偟偨偲偒偩偗 TLS 傪桳岠偵偡傞
    偙偲偑偱偒傞傛偆偵偟傑偡丅偙偺曽朄偩偲丄扨撈偺 LDAP 億乕僩傪僙僉儏
    傾側愙懕偲偦偆偱側偄愙懕偺椉曽偵巊偆偙偲偑壜擻偱偡丅
   
OpenLDAP 1.2.x 偼偦傟偲偼堎側傝 LDAP V2 僾儘僩僐儖偵傛傞幚憰偱偁傝丄SSL
/TLS 傪旛偊偰偄傑偣傫丅

OpenLDAP 2.0.x 忋偺 SSL/TLS 偵娭偟偰偼 OpenLDAP 偺僂僃僽僒僀僩偵壙抣偁
傞忣曬偑偁傝傑偡偺偱丄偙偙偱偼 SSL/TLS 偵懳墳偟偰偄側偄 LDAP 僷乕僥傿傪
SSL 僩儞僱儖傪巊偭偰僙僉儏傾偵偡傞曽朄偵徟揰傪崌傢偣傞偙偲偵偟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

10.3. stunnel 傪巊偭偰 LDAP V2 僒乕僶偵 SSL/TLS 傪採嫙偡傞曽朄

OpenLDAP 1.2.x 傪巊偭偰偄傞側傜偽丄僒乕僶偵 SSL 婡擻傪捛壛偡傞偨傔偵偼
斈梡 SSL 儔僢僷偑昁梫偵側傝傑偡丅stunnel (www.stunnel.org <http://
www.stunnel.org>) 偼埨掕偟偰偄偰丄偙偺栚揑偵揔偟偰偄傑偡丅

stunnel 偺僀儞僗僩乕儖偼偲偰傕娙扨偱偡偑丄偼偠傔偵 OpenSSL (
www.OpenSSL.org <http://www.OpenSSL.org>) 傪僀儞僗僩乕儖偟偰丄昁梫側儔
僀僽儔儕偲僣乕儖傪梡堄偟側偔偰偼側傝傑偣傫丅

OpenSSL 偲偼 SSL 僾儘僩僐儖偺僆乕僾儞僜乕僗偵傛傞幚憰偱偁傝丄 SSL 偺儔
僀僽儔儕偲埫崋僣乕儖堦幃傪旛偊偰偄傑偡丅

OpenSSL 傪僀儞僗僩乕儖偡傞偵偼師偺僐儅儞僪傪擖椡偟側偔偰偼側傝傑偣傫丅

$ ./config                                                             
$ make                                                                 
$ make test                                                            
# make install                                                         

傆偮偆偼丄偡傋偰 /usr/local/ssl 撪偵僀儞僗僩乕儖偝傟傞偙偲偵側傝傑偡丅

OpenSSL 偑惓偟偔僀儞僗僩乕儖偝傟偰偄傟偽丄stunnel 傪僐儞僷僀儖偟偰僀儞
僗僩乕儖偡傞偨傔偵擖椡偑昁梫側偺偼丄師偺僐儅儞僪偩偗偱偡丅

$ ./configure                                                          
$ make                                                                 
# make install                                                         

stunnel 偼 SSL 偵僒乕僶徹柧彂傪巊偄傑偡丅偙傟偼帺屓彁柤偺徹柧彂 (self
signed certificate) 偱傕傛偄偺偱偡偑丄偝傜偵椙偄偺偼帺暘偺擣徹嬊
(Certification Authotrity) 偵傛偭偰彁柤偝傟偨徹柧彂偱偡 (SSL 僋儔僀傾儞
僩傕偦偺 CA 傪怣梡偟偰偄側偔偰偼側傝傑偣傫偑)丅

偦偺傛偆側徹柧彂偺丄堦斒揑偵梡偄傜傟傞曐娗応強偼偙偙偱偡丅

/usr/local/ssl/certs/stunnel.pem                                       

傕偟擣徹嬊偺桳柍傪婥偵偟側偄偺偱偁傟偽丄 OpenSSL 僙僢僩偵傛偭偰採嫙偝傟
傞僣乕儖傪巊偭偰丄帺屓彁柤偺徹柧彂傪嶌惉偱偒傑偡丅

stunnel 偺僨傿儗僋僩儕撪偺 stunnel.cnf 偲偄偆愝掕僼傽僀儖傪巊偆偨傔丄偦
偺僨傿儗僋僩儕偱丄師偺僐儅儞僪傪擖椡偟偰偔偩偝偄丅

$ openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem 
$ openssl gendh 512 >> stunnel.pem                                                                 

偙傟偵傛偭偰丄帺屓彁柤偵傛傞堦擭娫桳岠側徹柧彂偑 stunnel.pem 僼傽僀儖偺
拞偵嶌惉偝傟傑偡丅

stunnel 偑僀儞僗僩乕儖偝傟偨傜丄傑偢嵟弶偵師偺傛偆偵偟偰 LDAP 僒乕僶傪
389 斣偺億乕僩 (僨僼僅儖僩偺 LDAP 億乕僩) 忋偵婲摦偟偰偔偩偝偄丅

# /usr/local/libexec/slapd                                             

偦傟偐傜師偺傛偆偵 636 斣偺 (LDAPS 僋儔僀傾儞僩偵傛偭偰巊梡偝傟傞) 億乕
僩偵 stunnel 偱僩儞僱儖偟偰偔偩偝偄丅

# /usr/local/sbin/stunnel -r ldap -d 636 -p /usr/local/ssl/certs/stunnel.pem

僨僶僢僌偺偨傔偵師偺彂幃偱僼僅傾僌儔僂儞僪偵 stunnel 傪婲摦偡傞偙偲傕偱
偒傑偡丅

# /usr/local/sbin/stunnel -r ldap -d 636 -D 7 -f -p /usr/local/ssl/certs/stunnel.pem

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

10.4. stunnel 傪巊偭偰 LDAP 僋儔僀傾儞僩偵 SSL 傪採嫙偡傞曽朄

懡偔偺 LDAP 僋儔僀傾儞僩偼 SSL 懳墳偱偼偁傝傑偣傫丅偟偐偟 stunnel 傪僋
儔僀傾儞僩儌乕僪偱巊偆偙偲偱丄偙傟傜偺僋儔僀傾儞僩偵 SSL 傪採嫙偡傞偙偲
偑壜擻偱偡丅

偙傟偼旕忢偵娙扨偱偡丅僋儔僀傾儞僩儂僗僩忋偱 stunnel 傪師偺傛偆偵婲摦偟
偰丄LDAPS 億乕僩偵懳偡傞梫媮傪幚嵺偺 LDAP 僒乕僶偵揮憲偡傞傛偆偵偟偰偔
偩偝偄丅

# stunnel -c -d 636 -r ldapserver.yourorg.com:636                      

偙偺偲偒 LDAP 僋儔僀傾儞僩偼 localhost:636 傪 LDAPS 僒乕僶偲偟偰巊偆傛
偆愝掕偝傟側偔偰偼側傝傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

10.5. stunnel 傪巊偭偰 slurpd 儗僾儕働乕僔儑儞偵 SSL 傪採嫙偡傞曽朄

尰帪揰偱 slurpd (slapd 儗僾儕働乕僔儑儞僨乕儌儞) 偼 SSL 婡擻傪帩偭偰偄
側偄偲偼偄偊丄stunnel 傪僋儔僀傾儞僩儌乕僪偱巊偭偰丄偙偺栶妱傪偝偣傞偙
偲偑偱偒傑偡丅

師偺傛偆偵儅僗僞僒乕僶忋偱僋儔僀傾儞僩儌乕僪偺 stunnel 傪巊偄丄儘乕僇儖
億乕僩傪儕儌乕僩億乕僩偵揮憲偟偰偔偩偝偄丅

# stunnel -c -d 9636 -r ldapreplica.yourorg.com:636                    

偦偟偰儅僗僞 LDAP 僒乕僶偺 slapd.conf 偵師偺婰弎傪擖傟偰偔偩偝偄丅

replica host=localhost:9636                                            

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

11. 僙僉儏儕僥傿娭楢

(栿拲丗尨暥偑偁傝傑偣傫)

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

12. LDAP 僗僉乕儅

偙傟傑偱嫇偘偨婡擻偵昁梫側僨乕僞偺嫃応強傪側傫偲偐偡傞偺偼僗僉乕儅偺栤
戣偱偡丅偳傫側娐嫬偱傕丄尩弆偵埖偆傋偒傕偺偲傒側偟偰偐偟偙傑傞傋偒偱偼
偁傝傑偣傫丅偙偙偵偁傞椺偼栚揑偵偐側偆偼偢偱偡偑丄帺暘偺摿掕偺昁梫偵崌
傢偣側偔偰偼側傜側偄偙偲傕懡暘偁傞偲巚偄傑偡丅

奺僄儞僩儕偺堄枴偲擖傟傞傋偒忣曬傪夝柧偡傞偨傔偵偲偰傕嬯楯偟偰偒偨 (偒
偭偲偼偭偒傝彂偄偰偁傞偺偱偟傚偆偑丄偳偙偵彂偄偰偁傞偐偑暘偐傜側偄) 偺
偱丄挊幰傕帋峴嶖岆偱傗偭偰傒傑偡丅偟偐偟拲堄偡傋偒偙偲偵丄奺梡搑偺僗僉
乕儅傪摨帪偵栤戣側偔棙梡偱偒傞偲偄偆傢偗偱偼偁傝傑偣傫丅 Microsoft 偺傾
僪儗僗挔偵偼丄昞帵偝傟偰偄傞偺偵 LDAP 偱巊梡偟側偄僼傿乕儖僪偑偁傞傛偆
偱偡丅乽栶怑乿乽僯僢僋僱乕儉乿乽巗嬫挰懞乿乽搒摴晎導乿乽(帺戭偺) 梄曋斣
崋乿乽(帺戭偺) 崙/抧堟乿乽(帺戭偺) Web 儁乕僕乿偺僄儞僩儕偵偼丄壗偺忣曬
傕昁梫側偄傛偆偵巚偊傑偡 (栿拲丗擔杮岅斉偱偺摦嶌偼枹妋擣)丅乽屄恖忣曬乿
乽NetMeeting乿乽僨僕僞儖 ID乿偵偮偄偰偼丄傑偩偳偺傛偆偵 LDAP 僨乕僞儀乕
僗偵擖傟傜傟傞偺偐夝柧偡傞偨傔偺搘椡傪偟偰偄傑偣傫丅偳傫側忣曬傕娊寎偟
傑偡丅 Netscape 偺傾僪儗僗挔偵傕摨條偺栤戣偑偁傝傑偡丅儗僐乕僪偑 LDAP
僨傿儗僋僩儕偐傜儘乕僇儖偺傾僪儗僗挔偵僐僺乕偝傟傞偲偒偵丄婔偮偐偺僼傿
乕儖僪偑徚偊偰偟傑偆偺偱偡丅偙傟偼戝栤戣偲偼尵偊側偔偲傕丄慻怐慡懱偱巊
偆傾僪儗僗僽僢僋偲偄偆惈幙忋丄儐乕僓偼儘乕僇儖偵僐僺乕偡傞婥傪側偔偡偼
偢偱偡丅偟偐傕丄 Netscape 偺傾僪儗僗挔偵偼丄懠偵傕彮偟偍偐偟側揰偑偁傝
傑偡丅晛捠偺傾僪儗僗儗僐乕僪偱偼丄乽僯僢僋僱乕儉乿偑奿擺偝傟傞懏惈偼 
xmozillanickname 偱偡丅偲偙傠偑専嶕帪偼扨側傞 nickname 側偺偱偡丅僱僢僋
僱乕儉偺僄儞僩儕偑僗僉乕儅偵擇搙弌偰偔傞偺偵偼丄偙偆偄偆棟桼偑偁傞偺偱
偡丅

偙偺僗僉乕儅偼 Microsoft Outlook 2000 偲 Netscape 4.73 偱摦嶌偑妋擣偝傟
偰偄傑偡偑丄愢柧丄婡擻丄僄儞僩儕偺昁梫惈偵娭偟偰娫堘偄偑偁傟偽丄偳偆偐
偍抦傜偣偔偩偝偄両 (栿拲丗擔杮岅偺僼傿乕儖僪昞帵偼 Windows 98 偺傾僪儗
僗挔偲 Windows 斉 Netscape 6.1 偐傜悇應偟偨傕偺偱偡丅擔杮岅斉偱偺摦嶌偼
傎偲傫偳枹妋擣偱偡丅偨偩丄擔杮岅斉 Windows Me + Outlook 2000 偱傾僪儗僗
挔傪帋尡偟偨斖埻偱偼惓偟偄傛偆偱偟偨丅)

偙偺僗僉乕儅傪昞尰偟偨僼傽僀儖偼 Section 13.1 偵偁傝傑偡丅(栿拲丗栿幰偼
丄偙偺僼傽僀儖傪偳偆巊偆偺偐暘偐傝傑偣傫偱偟偨丅彂幃偑屆偄偺偐傕丠)

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

Table 1. LDAP 偺懏惈偲 objectclass 乗娙扨側愢柧

劇劅劅劅劅劅劍劅劅劅劅劅劅劅劅劅劅劍劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劍劅劅劅劅劅劅劅劅劍劅劅劅劅劅劅劉
劆婡擻      劆Objectclass         劆懏惈                          劆愢柧            劆婛掕抣傗椺  劆
劌劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆儐乕僓傾僇劆top                 劆                              劆僨僼僅儖僩      劆            劆
劆僂儞僩    劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆ou                            劆儐僯僢僩柤      劆Users       劆
劆          劆                    劆                              劆(Organizational 劆            劆
劆          劆                    劆                              劆Unit)           劆            劆
劆          劌劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆person              劆                              劆偙偺 objectclass劆            劆
劆          劆                    劆                              劆偺強桳幰偼恖娫偱劆            劆
劆          劆                    劆                              劆偡              劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆uid                           劆Unix 儘僌僀儞柤 劆foo         劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆cn                            劆巵柤 (Common    劆Foo Bar     劆
劆          劆                    劆                              劆Name)           劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆sn                            劆惄 (Surname)    劆Bar         劆
劆          劌劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆account             劆                              劆偙偺 objectclass劆            劆
劆          劆                    劆                              劆偺強桳幰偵偼傾僇劆            劆
劆          劆                    劆                              劆僂儞僩偑偁傝傑偡劆            劆
劆          劌劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆posixaccount        劆                              劆偙偺 objectclass劆            劆
劆          劆                    劆                              劆偺強桳幰偵偼    劆            劆
劆          劆                    劆                              劆Unix 傾僇僂儞僩 劆            劆
劆          劆                    劆                              劆偑偁傝傑偡      劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆uidNumber                     劆儐乕僓 ID (uid) 劆513         劆
劆          劆                    劆                              劆斣崋            劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆gidNumber                     劆僌儖乕僾 ID     劆100         劆
劆          劆                    劆                              劆(gid) 斣崋      劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆homedirectory                 劆儂乕儉僨傿儗僋僩劆/home/users/劆
劆          劆                    劆                              劆儕              劆foo         劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆userpassword                  劆Unix 僷僗儚乕僪 劆S3cr3t      劆
劆          劌劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆sambaaccount        劆                              劆偙偺 objectclass劆            劆
劆          劆                    劆                              劆偺強桳幰偵偼    劆            劆
劆          劆                    劆                              劆Samba 傾僇僂儞僩劆            劆
劆          劆                    劆                              劆偑偁傝傑偡      劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆ntuid                         劆晄柧            劆uid         劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆rid                           劆晄柧            劆uidnumber   劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆lmpassword                    劆Lanman 偺僷僗儚 劆枹巊梡      劆
劆          劆                    劆                              劆乕僪偺僴僢僔儏抣劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆ntpasswd                      劆NT 偺僷僗儚乕僪 劆枹巊梡      劆
劆          劆                    劆                              劆偺僴僢僔儏抣    劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆loginshell                    劆儐乕僓偺僔僃儖  劆/bin/pleurop劆
劌劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆儅僔儞傾僇劆top                 劆                              劆僨僼僅儖僩      劆            劆
劆僂儞僩    劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆ou                            劆儐僯僢僩柤      劆Machines    劆
劆          劆                    劆                              劆(Organizational 劆            劆
劆          劆                    劆                              劆Unit)           劆            劆
劆          劌劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆posixaccount        劆                              劆偙偺 objectclass劆            劆
劆          劆                    劆                              劆偺強桳幰偵偼    劆            劆
劆          劆                    劆                              劆Unix 傾僇僂儞僩 劆            劆
劆          劆                    劆                              劆偑偁傝傑偡      劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆uid                           劆儘僌僀儞柤      劆speed$      劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆uidnumber                     劆Unix 偺儐乕僓 ID劆514         劆
劆          劆                    劆                              劆(uid) 斣崋      劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆gidnumber                     劆僌儖乕僾 ID     劆100         劆
劆          劆                    劆                              劆(gid) 斣崋      劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆homedirectory                 劆儂乕儉僨傿儗僋僩劆枹巊梡      劆
劆          劆                    劆                              劆儕              劆            劆
劌劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆Microsoft 劆top                 劆                              劆僨僼僅儖僩      劆            劆
劆傾僪儗僗挔劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆ou                            劆儐僯僢僩柤      劆Addressbook 劆
劆          劆                    劆                              劆(Organizational 劆            劆
劆          劆                    劆                              劆Unit)           劆            劆
劆          劌劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆microsoftaddressbook劆                              劆偙偺 objectclass劆            劆
劆          劆                    劆                              劆偺強桳幰偵偼    劆            劆
劆          劆                    劆                              劆Microsoft 傾僪儗劆            劆
劆          劆                    劆                              劆僗挔偺僾儘僷僥傿劆            劆
劆          劆                    劆                              劆偑偁傝傑偡      劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆cn                            劆昞帵柤 (Common  劆            劆
劆          劆                    劆                              劆Name)           劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆c                             劆嬑柋愭偺崙/抧堟 劆            劆
劆          劆                    劆                              劆(Country)       劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆department                    劆嬑柋愭偺晹彁柤  劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆facsimiletelephonenumber      劆嬑柋愭偺僼傽僢僋劆            劆
劆          劆                    劆                              劆僗              劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆givenname                     劆柤              劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆homephone                     劆帺戭偺揹榖斣崋  劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆homepostaladdress             劆帺戭偺斣抧      劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆info                          劆儊儌            劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆initials                      劆僀僯僔儍儖      劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆l                             劆嬑柋愭偺巗嬫挰懞劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆mail                          劆揹巕儊乕儖傾僪儗劆            劆
劆          劆                    劆                              劆僗              劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆mobile                        劆帺戭偺実懷揹榖  劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆organizationname              劆夛幮柤          劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆otherfacsimiletelephonenumber 劆帺戭偺僼傽僢僋僗劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆otherpager                    劆嬑柋愭偺億働僢僩劆乽pager乿傕 劆
劆          劆                    劆                              劆儀儖            劆丠          劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆physicaldeliveryofficename    劆嬑柋愭偺僆僼傿僗劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆postaladdress                 劆嬑柋愭偺斣抧    劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆postalcode                    劆嬑柋愭偺梄曋斣崋劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆sn                            劆惄 (Surname)    劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆st                            劆嬑柋愭偺搒摴晎導劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆telephonenumber               劆嬑柋愭偺揹榖斣崋劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆title                         劆栶怑            劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆url                           劆嬑柋愭偺 Web 儁 劆            劆
劆          劆                    劆                              劆乕僕            劆            劆
劌劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆Netscape  劆top                 劆                              劆僨僼僅儖僩      劆            劆
劆傾僪儗僗挔劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆ou                            劆儐僯僢僩柤      劆Addressbook 劆
劆          劆                    劆                              劆(Organizational 劆            劆
劆          劆                    劆                              劆Unit)           劆            劆
劆          劌劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆netscapeaddressbook 劆                              劆偙偺 objectclass劆            劆
劆          劆                    劆                              劆偺強桳幰偵偼    劆            劆
劆          劆                    劆                              劆Netscape 偺僾儘 劆            劆
劆          劆                    劆                              劆僷僥傿偑偁傝傑偡劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆cn                            劆昞帵 (Common    劆            劆
劆          劆                    劆                              劆Name)           劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆cellphone                     劆実懷揹榖        劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆countryname                   劆崙              劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆description                   劆愢柧            劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆facsimiletelephonenumber      劆Fax             劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆givenname                     劆柤              劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆homephone                     劆帺戭偺揹榖斣崋  劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆homeurl                       劆帺戭偺 Web 儁乕 劆            劆
劆          劆                    劆                              劆僕              劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆locality                      劆帺戭偺巗嬫挰懞  劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆mail                          劆揹巕儊乕儖      劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆nickname                      劆僯僢僋僱乕儉    劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆o                             劆慻怐            劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆ou                            劆晹彁            劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆pagerphone                    劆億働僢僩儀儖    劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆postalcode                    劆帺戭偺梄曋斣崋  劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆sn                            劆惄 (Surname)    劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆st                            劆搒摴晎導        劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆streetaddress                 劆帺戭偺斣抧      劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆telephonenumber               劆嬑柋愭偺揹榖斣崋劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆title                         劆栶怑            劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆xmozillaanyphone              劆嬑柋愭偺揹榖斣崋劆            劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆xmozillanickname              劆僯僢僋僱乕儉    劆乽nickname乿劆
劆          劆                    劆                              劆                劆偲摨偠偱偡  劆
劆          劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆          劆                    劆xmozillausehtmlmail           劆儊僢僙乕僕傪庴怣劆TRUE        劆
劆          劆                    劆                              劆偡傞偲偒偺桪愭彂劆            劆
劆          劆                    劆                              劆幃偑 HTML       劆            劆
劌劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆Netscape  劆top                 劆                              劆僨僼僅儖僩      劆            劆
劆儘乕儈儞僌劆                    劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劅劅劑劅劅劅劅劅劅劎
劆傾僋僙僗  劆                    劆ou                            劆儐僯僢僩柤      劆Roaming     劆
劆          劆                    劆                              劆(Organizational 劆            劆
劆          劆                    劆                              劆Unit)           劆            劆
劋劅劅劅劅劅劏劅劅劅劅劅劅劅劅劅劅劏劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劏劅劅劅劅劅劅劅劅劏劅劅劅劅劅劅劊
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

    Note: Netscape 偲 Microsoft 偱偼丄傾僪儗僗挔偺僄儞僩儕偺巊偄曽偑彮
    乆堎側傝傑偡丅Netscape 偼梄曋偺埗愭 (廧強) 傪 streetaddress 僄儞僩
    儕偵 base64 僄儞僐乕僪偱奿擺偟丄Microsoft 偼 postaladdress 僄儞僩儕
    傪巊偄傑偡丅偟偐偟側偑傜丄streetaddress 僄儞僩儕偑偁傞偲 Microsoft
    偼 postaladdress 偺戙傢傝偵偦偪傜傪巊偄傑偡丅偲偙傠偑 Microsoft 偺
    streetaddress 偺抣偼 base 64 僄儞僐乕僪側偟偺暯暥 (僾儗乕儞僥僉僗
    僩) 偱偡丅偱偡偐傜丄摨帪偵偼巊偊傑偣傫丅
   
Linux Center <http://ldap.hklc.com/> 偱偼丄 LDAP 僗僉乕儅慡斒偵娭偡傞忣
曬傪偝傜偵摼傜傟傑偡丅 Microsoft 傾僪儗僗挔偺僾儘僷僥傿傪夝愢偟偨暥彂偼
Microsoft Developers Network <http://msdn.microsoft.com/library/psdk/
adsi/gluser_4437.htm> 偵偁傝傑偟偨丅

拲堄偟偰偔偩偝偄丅Microsoft 偺儁乕僕偵偁傞愢柧偼傾僪儗僗挔偺昞帵撪梕偵
偍偗傞僼傿乕儖僪偲崌抳偟傑偣傫丅傑偨丄傾僪儗僗挔偺僼傿乕儖僪偡傋偰偑忣
曬傪帩偭偰偄傞傢偗偱偼偁傝傑偣傫偑丄嫇偘傜傟偰偄傞懏惈偱偆傑偔摦嶌偟側
偄側傜丄杮摉偼偳偺懏惈偑偆傑偔摦嶌偡傞偺偐丄偲偄偆偙偲傑偱偼暘偐傝傑偣
傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

13. 僼傽僀儖偺椺

僼傽僀儖偺椺偱偡丅偙傟傪巊偭偰丄偙偺暥彂偱愢柧偝傟偰偄傞偲偍傝偺峔惉傪
峔抸偱偒傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

13.1. 僗僉乕儅僼傽僀儖

# Unix 娭楢偍傛傃僨僼僅儖僩偺 objectclass (廋惓偁傝)                   
                                                                       
attribute       userpassword                            ces            
attribute       telephonenumber                         tel            
attribute       facsimiletelephonenumber        fax     tel            
attribute       pagertelephonenumberpager               tel            
attribute       homephone                               tel            
attribute       mobiletelephonenumber           mobile  tel            
attribute       member                                  dn             
attribute       owner                                   dn             
attribute       dn                                      dn             
                                                                       
objectclass top                                                        
        requires                                                       
                objectClass                                            
                                                                       
objectclass organization                                               
        requires                                                       
                objectClass,                                           
                o                                                      
        allows                                                         
                description                                            
                                                                       
objectclass organizationalUnit                                         
        requires                                                       
                objectClass,                                           
                ou                                                     
        allows                                                         
                description                                            
                                                                       
objectclass person                                                     
        requires                                                       
                objectClass,                                           
                cn                                                     
        allows                                                         
                description                                            
                                                                       
objectclass account                                                    
        requires                                                       
                objectClass,                                           
                uid                                                    
        allows                                                         
                description,                                           
                host,                                                  
                o,                                                     
                ou                                                     
                                                                       
# Samba 娭楢偺 objectclass (僆儕僕僫儖)                                
                                                                       
objectclass sambaaccount                                               
        requires                                                       
                objectclass,                                           
                uid,                                                   
                uidnumber,                                             
                ntuid,                                                 
                rid                                                    
        allows                                                         
                gidnumber,                                             
                grouprid,                                              
                nickname,                                              
                userpassword,                                          
                ou,                                                    
                description,                                           
                lmpassword,                                            
                ntpassword,                                            
                pwdlastset,                                            
                smbhome,                                               
                homedrive,                                             
                script,                                                
                profile,                                               
                workstations,                                          
                acctflags,                                             
                pwdcanchange,                                          
                pwdmustchange                                          
                                                                       
objectclass sambagroup                                                 
        requires                                                       
                cn,                                                    
                rid                                                    
        allows                                                         
                ntuid,                                                 
                member,                                                
                description                                            
                                                                       
objectclass sambaconfig                                                
        requires                                                       
                id                                                     
        allows                                                         
                nextrid                                                
                                                                       
objectclass sambabuiltin                                               
        requires                                                       
                cn,                                                    
                sid                                                    
        allows                                                         
                ntuid,                                                 
                rid,                                                   
                member,                                                
                description                                            
                                                                       
# Sendmail 娭楢偺 objectclass (怴婯 / 廋惓偁傝)                        
                                                                       
objectclass inetmailrecipient                                          
        requires                                                       
                objectclass                                            
        allows                                                         
                mailid,                                                
                mailacceptinggeneralid,                                
                maildrop                                               
                                                                       
objectclass inetmaildomain                                             
        requires                                                       
                objectclass,                                           
                sendmailislocalkey                                     
        allows                                                         
                maildomain,                                            
                sendmailaccesskey                                      
                                                                       
# 傾僪儗僗僽僢僋娭楢偺 objectclass                                     
                                                                       
objectclass netscapeaddressbook                                        
        requires                                                       
                objectclass,                                           
                cn                                                     
        allows                                                         
                cellphone,                                             
                countryname,                                           
                description,                                           
                facsimiletelephonenumber,                              
                givenname,                                             
                homephone,                                             
                homeurl,                                               
                locality,                                              
                mail,                                                  
                nickname,                                              
                o,                                                     
                ou,                                                    
                pagerphone,                                            
                postalcode,                                            
                sn,                                                    
                st,                                                    
                streetaddress,                                         
                telephonenumber,                                       
                title,                                                 
                xmozillanickname,                                      
                xmozillausehtmlmail,                                   
                xmozillaanyphone                                       
                                                                       
objectclass microsoftaddressbook                                       
        requires                                                       
                objectclass,                                           
                cn                                                     
        allows                                                         
                c,                                                     
                department,                                            
                facsimiletelephonenumber,                              
                givenname,                                             
                homephone,                                             
                homepostaladdress,                                     
                info,                                                  
                initials,                                              
                l,                                                     
                mail,                                                  
                mobile,                                                
                organizationname,                                      
                otherfacsimiletelephonenumber,                         
                otherpager,                                            
                physicaldeliveryofficename,                            
                postaladdress,                                         
                postalcode,                                            
                sn,                                                    
                st,                                                    
                telephonenumber,                                       
                title,                                                 
                url                                                    

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

13.2. 儀乕僗 LDIF 偺椺

dn: dc=yourorg,dc=com                                                             
objectClass: top                                                                  
objectClass: organization                                                         
o: YourOrg                                                                        
description: This is our organizations base dn. Everything is stored beneath this 
                                                                                  
dn: ou=Users,dc=yourorg,dc=com                                                    
objectClass: top                                                                  
objectClass: organizationalunit                                                   
ou: Users                                                                         
description: This is the tree were user accounts are stored                       
                                                                                  
dn: ou=Machines,dc=yourorg,dc=com                                                 
objectClass: top                                                                  
objectClass: organizationalunit                                                   
ou: Machines                                                                      
description: This is the tree were machine accounts are stored                    
                                                                                  
dn: ou=Roaming,dc=yourorg,dc=com                                                  
objectClass: top                                                                  
objectClass: organizationalunit                                                   
ou: Roaming                                                                       
description: This is the tree were netscape roaming profiles are stored           
                                                                                  
dn: ou=Addressbook,dc=yourorg,dc=com                                              
objectClass: top                                                                  
objectClass: organizationalunit                                                   
ou: Addressbook                                                                   
description: This is the tree were addressbook entries are stored                 

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒

14. 擔杮岅栿偵偮偄偰

師偺曽乆偵傛偭偰峑惓偝傟傑偟偨丅東栿幰偐傜姶幱怽偟忋偘傑偡丅尨暥偵側偄
娫堘偄偼偡傋偰東栿幰偺椡検晄懌偵傛傞傕偺偱偁傝丄尨暥傛傝桪傟偨揰偼偡傋
偰峑惓幰偺曽乆偺偍偐偘偱偡丅

 丒 杧揷椣塸條
   
 丒 栰杮峗堦條
   
 丒 堫抧柅條
   
 丒 konkiti 條
   
 丒 憗愳恗條
   
 丒 拞栰晲梇條
   
    Note: 峑惓幰偺曽乆傊丗婰擖楻傟傗昞婰偺晄搒崌摍偑偛偞偄傑偟偨傜怽偟
    栿偁傝傑偣傫丅栿幰傑偱偛堦曬偔偩偝偄丅
   
偍婥晅偒偺揰偼栿幰偐 JF 僾儘僕僃僋僩傑偱偛楢棈偔偩偝偄丅

Notes

[1] LDAP 僨乕僞儀乕僗偺暋惢傪僒乕僶娫偱峴側偆巇慻傒                    
                                                                       
[2] NIS 偱妱傝摉偰偰偄傞応崌偼堎側傝傑偡丅                             
                                                                       
[3] 傂偲偮偺僄儞僩儕偑暋悢偺 objectclass 偵懏偡傞偙偲偑偱偒傑偡丅      
                                                                       
[4] 僂儔媄偲偟偰丄Netscape Communicator 偺徹柧僨乕僞儀乕僗傪巊偆偙偲傕 
    偱偒傑偡丅                                                         
                                                                       
[5] 栿拲丗尨暥偱偼 Netscape Active Directory 偲偁傝傑偡偑丄乽Netscape乿
    偼乽Microsoft乿偺娫堘偄偲巚傢傟傑偡丅                              
                                                                       
[6] 栿拲丗憲怣幰偵側傝偡傑偟偨戞嶰幰偑僨乕僞傪夵鈧偡傞側偳丅乽拞娫夘擖 
    乿偲傕栿偡偦偆偱偡丅                                               

