#!/bin/bash #### install 389-ds if ! type -p dbscan >/dev/null ; then if [[ -f /etc/redhat-release ]]; then ! yum module list 389-ds | grep -q '389-ds.*\[e]' && \ yum module enable -y 389-ds yum install -y 389-ds-base elif [[ -f /etc/SUSE-brand ]]; then zypper in -y 389-ds else echo "unknown distribution" exit 1 fi fi #### reset if [[ $1 = -reset ]]; then rm -f /etc/openldap/ldap-cacert.crt sed -i '/^BASE/d;/^URI/d;/^TLS_CACERT/d' /etc/openldap/ldap.conf DS=$(dsctl -l) [[ "$DS" ]] && dsctl $DS remove --do-it echo "directory server reset completed" exit fi #### preset values H1=host1.example.com H2=host2.example.com DSINSTANCE=ldaptest DBBASE='dc=example,dc=com' DSPASSWORD=password #### check the ip addresses and /etc/hosts [[ $1 ]] || exec echo 'missing ip for host1' [[ $2 ]] || exec echo 'missing ip for host2' [[ $1 = $2 ]] && exec echo 'the two ip must be different' ping -c 1 $1 >/dev/null || exec echo 'cannot ping host with ip: $1' ping -c 1 $2 >/dev/null || exec echo 'cannot ping host with ip: $2' ! grep -q "^${1//./\\.}[[:blank:]]" /etc/hosts && echo -e "$1\t$H1 ${H1%%.*}" >>/etc/hosts ! grep -q "^${1//./\\.}[[:blank:]]$H1 ${H1%%.*}" /etc/hosts && \ sed -i "/^${1//./\\.}[[:blank:]]/s@.*@$1\t$H1 ${H1%%.*}@" /etc/hosts ! grep -q "^${2//./\\.}[[:blank:]]" /etc/hosts && echo -e "$2\t$H2 ${H2%%.*}" >>/etc/hosts ! grep -q "^${2//./\\.}[[:blank:]]$H2 ${H2%%.*}" /etc/hosts && \ sed -i "/^${2//./\\.}[[:blank:]]/s@.*@$2\t$H2 ${H2%%.*}@" /etc/hosts DEV=$(ip route list scope global | awk -v v=dev '$1=="default"{for(a=2;a$TMP sed -i "/;full_machine_name/s@.*@full_machine_name = $LOCALSUPPLIER@" $TMP sed -i "/;instance_name/s@.*@instance_name = $DSINSTANCE@" $TMP sed -i "/;sample_entries/s@.*@sample_entries = yes@" $TMP sed -i "/;suffix/s@.*@suffix = $DBBASE@" $TMP #set a default password for testing sed -i "/;root_password/s@.*@root_password = $DSPASSWORD@" $TMP dscreate from-file $TMP rm $TMP if systemctl is-active -q firewalld ; then ! firewall-cmd -q --query-service ldap && firewall-cmd --add-service=ldap && firewall-cmd --runtime-to-permanent ! firewall-cmd -q --query-service ldaps && firewall-cmd --add-service=ldaps && firewall-cmd --runtime-to-permanent fi dsconf $DSINSTANCE config replace nsslapd-require-secure-binds=on dsconf $DSINSTANCE config replace nsslapd-force-sasl-external=on dsctl $DSINSTANCE restart fi #### copy the CA certificate in /etc/openldap/ldap-cacert.crt #### only on host2: syncronize Self-Signed-CA with host1, regenerate Server-Cert if [[ ! -f /etc/openldap/ldap-cacert.crt ]]; then if ((SID==2)); then echo " INFO: importing Self-Signed-CA from $REMOTESUPPLIER" rsync -avWHP --delete $REMOTESUPPLIER:/etc/dirsrv/ssca /etc/dirsrv cp /etc/dirsrv/ssca/ca.crt /etc/dirsrv/slapd-$DSINSTANCE/ca.crt certutil -F -n Server-Cert -d /etc/dirsrv/slapd-$DSINSTANCE -f /etc/dirsrv/slapd-$DSINSTANCE/pwdfile.txt certutil -D -d /etc/dirsrv/slapd-$DSINSTANCE -n Self-Signed-CA dsctl $DSINSTANCE tls generate-server-cert-csr -s "CN=$LOCALSUPPLIER" -8 $LOCALSUPPLIER certutil -C -d /etc/dirsrv/ssca -f /etc/dirsrv/ssca/pwdfile.txt -v 24 -a -i /etc/dirsrv/slapd-$DSINSTANCE/Server-Cert.csr -o /etc/dirsrv/slapd-$DSINSTANCE/Server-Cert.crt -c Self-Signed-CA openssl rehash /etc/dirsrv/slapd-$DSINSTANCE certutil -A -n Self-Signed-CA -t CT,, -a -i /etc/dirsrv/slapd-$DSINSTANCE/ca.crt -d /etc/dirsrv/slapd-$DSINSTANCE -f /etc/dirsrv/slapd-$DSINSTANCE/pwdfile.txt certutil -A -n Server-Cert -t ,, -a -i /etc/dirsrv/slapd-$DSINSTANCE/Server-Cert.crt -d /etc/dirsrv/slapd-$DSINSTANCE -f /etc/dirsrv/slapd-$DSINSTANCE/pwdfile.txt dsctl $DSINSTANCE restart fi cp /etc/dirsrv/ssca/ca.crt /etc/openldap/ldap-cacert.crt fi #### configure /etc/openldap/ldap.conf ! grep -qi '^base' /etc/openldap/ldap.conf && \ echo "BASE $DBBASE" >>/etc/openldap/ldap.conf ! grep -qi '^uri' /etc/openldap/ldap.conf && \ echo "URI ldap://$LOCALSUPPLIER" >>/etc/openldap/ldap.conf ! grep -qi '^TLS_CACERT' /etc/openldap/ldap.conf && \ echo "TLS_CACERT /etc/openldap/ldap-cacert.crt" >>/etc/openldap/ldap.conf #### on host1: create group1 and user1 #### on host2: create a temporary replication manager account if ((SID==1)); then LIST=$(dsidm -b $DBBASE $DSINSTANCE posixgroup list) ! echo "$LIST" | grep -qFx group1 && \ dsidm -b $DBBASE $DSINSTANCE posixgroup create --cn group1 --gidNumber 1000 LIST=$(dsidm -b $DBBASE $DSINSTANCE user list) ! echo "$LIST" | grep -qFx user1 && \ dsidm -b $DBBASE $DSINSTANCE user create \ --uid user1 \ --uidNumber 1000 \ --cn "User1" \ --displayName "User1 Test" \ --gidNumber 1000 \ --homeDirectory /home/user1 elif ((SID==2)); then LIST=$(dsidm -b $DBBASE $DSINSTANCE user list) if ! echo "$LIST" | grep -qFx $REMOTESUPPLIER ; then ! ldapsearch -Y EXTERNAL -Q -H ldapi://%2fvar%2frun%2fslapd-$DSINSTANCE.socket -b cn=config -LLL dn | grep -qF "cn=replication manager,cn=config" && \ dsconf $DSINSTANCE replication create-manager --passwd tmp1234 ! dsconf $DSINSTANCE replication list | grep -qFx $DBBASE && \ dsconf $DSINSTANCE replication enable --suffix="$DBBASE" --role="supplier" --replica-id="$SID" --bind-dn="cn=replication manager,cn=config" dsctl $DSINSTANCE restart fi fi