Allied Telesis Lightweight Directory Access Protocol
Mawu Oyamba
Lightweight Directory Access Protocol (LDAP) ndi pulogalamu yamapulogalamu yomwe imagwiritsidwa ntchito kuyang'anira ndi kupeza zinthu zosiyanasiyana za IT monga mapulogalamu, maseva, zida zolumikizirana ndi intaneti, ndi file maseva. Kugwiritsiridwa ntchito kofala kwa LDAP ndikupereka malo apakati otsimikizira, kutanthauza kuti imasunga mayina olowera ndi mawu achinsinsi.
Monga momwe dzinali likusonyezera kuti LDAP ndi mtundu wopepuka wa Directory Access Protocol (DAP), womwe ndi gawo la X.500, muyeso wa mautumiki apakanema. LDAP imagwiritsa ntchito ndandanda kusunga zambiri za bungwe, zambiri za ogwira ntchito, ndi zidziwitso zazinthu.
Maupangiri a pa netiweki amakuwuzani komwe kuli china chake pa netiweki. Pamanetiweki a TCP/IP, domain name system (DNS) ndi kachitidwe kachikwatu komwe amagwiritsidwa ntchito kugwirizanitsa dzina la domain ku adilesi inayake ya netiweki. Komabe, ngati simukudziwa dzina lachidziwitso, LDAP imakulolani kuti mufufuze munthu popanda kudziwa komwe ali.
Mutha kugwiritsa ntchito LDAP kutsimikizira ogwiritsa ntchito omwe akulumikizana ndi netiweki yamkati kudzera pa OpenVPN. Ngakhale zida za AlliedWare Plus zitha kugwiritsa ntchito LDAP ndi RADIUS mosinthana ngati njira yotsimikizira, LDAP ili ndi kuthekera kolumikizana ndi mautumiki owongolera monga Microsoft's Active Directory (AD). AD ndi imodzi mwamagawo apakati a Windows database. Imasunga zidziwitso za ogwiritsa ntchito ndi akaunti, ndipo imapereka chilolezo ndi kutsimikizika kwa makompyuta, ogwiritsa ntchito, ndi magulu, kulimbikitsa mfundo zachitetezo pamakina ogwiritsira ntchito Windows.
Bukuli limapereka chidziwitso chokonzekera OpenVPN Access Server kuti itsimikizire motsutsana ndi Active Directory pogwiritsa ntchito LDAP.
Zogulitsa ndi mapulogalamu omwe akugwira ntchito pa bukhuli
Bukuli likukhudzana ndi zinthu za AlliedWare Plus™ zomwe zimathandizira LDAP, zomwe zikuyenda 5.5.2-1 kapena mtsogolo.
Kuti muwone ngati malonda anu amathandizira LDAP, onani zolemba izi:
- Dongosolo lazogulitsa
- Zolemba za Command Reference
Zolemba izi zikupezeka pa maulalo apamwambawa patsamba lathu webtsamba pa alliedtelesis.com.
Zolemba zotsatirazi zimapereka zambiri zokhudzana ndi zotsimikizika pazogulitsa za AlliedWare Plus:
- Pulogalamu ya OpenVPN Yathaview ndi Configuration Guide
- AAA ndi Port Authentication Feature Overview ndi Configuration Guide
- Zolemba za Command Reference
Zolemba izi zikupezeka pa maulalo pamwambapa kapena pamasamba athu webtsamba pa alliedtelesis.com
LDAP paview
Protocol ya LDAP imalumikizana ndi Active Directory. Ndi njira yolankhulirana ndi Active Directory ndikutumiza mauthenga pakati pa AD ndi madera ena a netiweki yanu.
Kodi kutsimikizira kwa Active Directory LDAP kumagwira ntchito bwanji? Kwenikweni, muyenera kukhazikitsa LDAP kuti itsimikizire zovomerezeka motsutsana ndi Active Directory. Ntchito ya 'BIND' imagwiritsidwa ntchito kuyika chitsimikiziro cha gawo la LDAP pomwe kasitomala wa LDAP amalumikizana ndi seva.
Nthawi zambiri, kutsimikizika kophweka kumeneku kumatanthauza kuti dzina ndi mawu achinsinsi zimagwiritsidwa ntchito popanga pempho lomangirira ku seva kuti litsimikizidwe.
Kulumikizana kwa paketi ya LDAP yoyambira pogwiritsa ntchito Telnet
Mukamagwiritsa ntchito Telnet kulowa mu chipangizo cha AlliedWare Plus, njira yotsimikizika ya LDAP ndi motere:
- Telnet imayambitsa pempho lolumikizana ndikutumiza dzina lolowera ndi mawu achinsinsi ku chipangizocho.
- Pambuyo polandira pempholi, chipangizocho (chochita ngati kasitomala wa LDAP), chimakhazikitsa mgwirizano wa TCP ndi seva ya LDAP.
Kuti mupeze ufulu wofufuza, chipangizochi chimagwiritsa ntchito dzina lodziwika la administrator (DN) ndi mawu achinsinsi kutumiza pempho lomanga la administrator ku seva ya LDAP. - Seva ya LDAP imayendetsa pempho. Ngati ntchito yomangayo yapambana, seva ya LDAP imatumiza chivomerezo ku chipangizocho.
- Chipangizochi chimatumiza wosuta kusaka kwa DN ndi dzina lolowera ku seva ya LDAP.
- Pambuyo polandira pempho, seva ya LDAP imasaka wogwiritsa ntchito DN ndi maziko a DN, kufufuza, ndi zosefera. Ngati machesi apezeka, seva ya LDAP imatumiza yankho kuti lidziwitse chida chakusaka kopambana. Pakhoza kukhala munthu m'modzi kapena angapo a DN omwe apezeka.
- Chipangizochi chimagwiritsa ntchito DN yomwe wapeza ndikulowetsa mawu achinsinsi a wogwiritsa ntchito ngati magawo kuti atumize wogwiritsa ntchito DN kumanga pempho ku seva ya LDAP, yomwe imayang'ana ngati mawu achinsinsi a ogwiritsa ntchito ndi olondola.
- Seva ya LDAP imayendetsa pempho, ndikutumiza yankho kuti lidziwitse chipangizocho za zotsatira za ntchito yomanga. Ngati ntchito yomangirira ikulephera, chipangizocho chimagwiritsa ntchito DN wina wopezeka ngati chizindikiro kuti atumize wogwiritsa ntchito DN kumanga pempho ku seva ya LDAP. Izi zimapitilira mpaka DN itamangidwa bwino kapena ma DN onse akulephera kumangidwa. Ngati ma DN onse ogwiritsa ntchito alephera kumangidwa, chipangizocho chimadziwitsa wogwiritsa ntchito za kulephera kulowa ndikukana pempho la wogwiritsa ntchito.
- Chipangizo ndi seva zimapanga kusinthana kovomerezeka.
- Pambuyo pa chilolezo chopambana, chipangizochi chimadziwitsa wogwiritsa ntchito kulowa bwino.
Zoletsa zaposachedwa za AlliedWare Plus
- Trustpoint imodzi yokha ndiyomwe imathandizidwa ndi LDAP yotetezeka.
- Kusaka kwamagulu kobwerezabwereza sikunachitike. Komabe, ndi Active Directory, ndizotheka kukhazikitsa OID yeniyeni ngati gawo lazosefera zomwe zingawaphunzitse kuti afufuze.
OID imakhala gawo la membalaOf cheke:
| MemberOf:1.2.840.113556.1.4.1941:= Gulu DN> |
M'malo mwachizolowezi:
| memberOf = Gulu DN> |
Pali ma exampkuchepera kwa izi m'gawo losakasaka lomwe lili pansipa, onani "Kusaka makonda" pa
Onani mndandanda wolowera ku chipangizo cha AlliedWare Plus
Musanakonze LDAP, lowani ku a AlliedWare Chida chowonjezera chogwiritsa ntchito SSH/Telnet, ndipo onani masinthidwe otsatirawa ndi olondola.
Onani kuti:
- Seva ya LDAP ikugwira ntchito.
- Mukutha kufikira chipangizocho, ndipo chipangizocho chikhoza kufika pa seva ya LDAP.
- Zachipangizo:
● SSH kapena Telnet ndiwoyatsa
● Seva ya LDAP ndiyoyatsidwa
● Seva ya LDAP ndi gawo la mndandanda wa ma seva a gulu la AAA LDAP
● Gulu la seva la LDAP lawonjezedwa ku zosankha zovomerezeka za AAA
● Gulu la seva la LDAP lawonjezedwa ku mizere ya vty yotsimikizira zosankha - Kwa seva ya LDAP:
● makhalidwe otsatirawa akonzedwa
| Chikhalidwe cha LDAP | Mtundu | Kufotokozera |
| msRADIUSServiceType | nambala | Kuti mulowe ku chipangizo cha AlliedWare Plus, wogwiritsa ntchito ayenera kukhala ndi chimodzi mwazinthu izi: ■ 6 (Administrative): wogwiritsa ntchito amajambulidwa ku mwayi waukulu wogwiritsa ntchito, 15, ■ 7 (NAS Prompt): wogwiritsa ntchito amajambulidwa ku mwayi wochepa wogwiritsa ntchito, 1. Ngati chikhalidwechi sichinakonzedwe kapena kukonzedwa ndi makhalidwe osiyanasiyana, wogwiritsa ntchito saloledwa kulowa. |
Kufikira pa intaneti kudzera pa OpenVPN
Kuti mulole wosuta kulumikiza netiweki yamkati kudzera pa OpenVPN, fufuzani kuti:
- Seva ya LDAP ikugwira ntchito.
- Wogwiritsa ntchito amatha kufikira chipangizocho, ndipo chipangizocho chimatha kufikira seva ya LDAP.
- Zachipangizo:
● Seva ya LDAP ndiyoyatsidwa
● Seva ya LDAP ndi gawo la mndandanda wa ma seva a gulu la AAA LDAP
● Gulu la seva la LDAP lawonjezedwa ku zosankha zotsimikizira za OpenVPN AAA
● Tunnel ya OpenVPN yakonzedwa ndikuyatsidwa - Kwa seva ya LDAP:
● mawonekedwe otsatirawa amakonzedwa ndikuperekedwa kwa kasitomala wa OpenVPN:
| Chikhalidwe cha LDAP | Mtundu | Kufotokozera |
| msRADIUSFramedIPAddress | Nambala | Adilesi ya IP yosasunthika ya kasitomala. Izi ndi 4-byte integer. Za example "-1062731519" ndi "192.168.1.1". |
| msRADIUSFramedRoute | Chingwe | Njira zokhazikika za IP zamakasitomala (amalola zolemba zingapo). Chingwechi chikuyembekezeka kukhala ngati mawonekedwe a RADIUS "Njira Yokhazikika" yofotokozedwa mu RFC2865, (monga "10.1.1.0 255.255.255.0 192.168.1.1 1") |
| ms-RADIUS-FramedIpv6Prefix | Chingwe | Kukhazikika kwa IPv6 kwa kasitomala. Chingwechi chikuyembekezeka kukhala ngati "IPv6Address/PrefixLength", (monga "2001:1::/64"). |
| ms-RADIUS-FramedIpv6Route | Chingwe | Njira zosasunthika za IPv6 za kasitomala (zimalola zolemba zingapo). Chingwechi chikuyembekezeka kukhala ngati mawonekedwe a RADIUS "Framed-IPv6-Route" yofotokozedwa mu RFC3162, (monga "3001:1::/64 2001:1::1 1"). |
Kukonza LDAP
Gawoli likufotokoza momwe mungasinthire LDAP, ndi ena mwa malamulo omwe alipo a AlliedWare Plus:
Kusintha kwa seva ya LDAP
Gawo 1: Pangani seva ya LDAP yokhala ndi dzina AD_server
awplus#configure terminal
awplus(config)# ldap-server AD_server
Gawo 2: Konzani adilesi ya IP pa seva ya LDAP
awplus(config-ldap-server)# host 192.0.2.1
Gawo 3: Khazikitsani maziko a DN kuti mugwiritse ntchito posaka
awplus(config-ldap-server)# base-dn dc=foo,dc=bar
Gawo 4: Khazikitsani dzina lodziwika lomwe mungamangirire nalo ku seva ndi zidziwitso zomwe mungamangirire nazo
awplus(config-ldap-server)# bind authentication root-dn cn=Administrator, cn=Ogwiritsa,dc=foo,dc=bar password P@ssw0rd
Kusintha kwa AAA
Gawo 1: Pangani gulu la seva la LDAP lotchedwa ldapServerGroup
awplus(config)# aaa gulu seva ldap ldapServerGroup
Kapenanso, mutha kugwiritsa ntchito gulu losakhazikika la 'ldap' lomwe lili ndi ma seva onse a LDAP.
Gawo 2: Onjezani seva ya LDAP AD_server ku gulu
awplus(config-ldap-group)# seva AD_server
Gawo 3: Pangani njira yolowera ku AAA pogwiritsa ntchito gulu la seva la LDAP kuti mutsimikizire kulowa kwa ogwiritsa ntchito
awplus(config)# aaa kutsimikizika lolowera ldapLogin gulu ldapServerGroup
Kapena gwiritsani ntchito gulu losakhazikika m'malo mwake:
awplus(config)# aaa kutsimikizira kulowa ldapLogin gulu ldap
Kusintha kwa SSH/Telnet
Gawo 1: Yambitsani SSH
awplus(config)# service ssh
Onetsetsani kuti seva ya SSH yakonzedwa bwino kuti ogwiritsa ntchito alowe.
awplus(config)# ssh seva imalola ogwiritsa ntchitoA
Gawo 2: Tsimikizirani mizere ya VTY ndi njira yotsimikizira ya AAA ldapLogin
awplus(config)# mzere vty 0 3
awplus(config-line)# kutsimikizira kulowa ldapLogin
Kusintha kwa OpenVPN
Gawo 1: Yambitsani kutsimikizika kwa LDAP kwa ngalande za OpenVPN padziko lonse lapansi
Apanso, mutha kugwiritsa ntchito gulu losakhazikika la LDAP kapena gulu lofotokozera la LDAP.
awplus(config)# aaa kutsimikizika kwa openvpn gulu lokhazikika ldap
Kukonzekera kwa Mode Mode - LDAPS pogwiritsa ntchito TLS encryption
LDAP imapereka njira yotetezeka yotchedwa LDAPS, yomwe imagwiritsa ntchito protocol ya TLS kubisa kulumikizana konse pakati pa kasitomala ndi seva. Kuti mugwiritse ntchito LDAP, muyenera kukonza malo otetezedwa pa seva (doko lokhazikika ndi 636).
LDAPS ikangokonzedwa kumbali ya seva, mudzafunika kopi ya satifiketi ya CA yogwiritsidwa ntchito ndi seva. Choyamba satifiketi iyi iyenera kutumizidwa ku chipangizocho ngati malo otetezedwa. Kuti mumve zambiri pa PKI ndi trustpoints pa AlliedWare Plus, onani PKI Feature Overview ndi Configuration Guide.
Khwerero 1: Pangani PKI trustpoint yatsopano yotchedwa AD_trustpoint
awplus(config)# crypto pki trustpoint AD_trustpoint
Khwerero 2: Fotokozani kuti trustpoint iyi idzagwiritsa ntchito satifiketi yakunja yomwe ili kukopera ndi
adayikidwa mu terminal
awplus(ca-trustpoint)# malo olembetsa
Khwerero 3: Bwererani kumachitidwe amwayi a EXEC
awplus(ca-trustpoint)# end
Khwerero 4: Lowetsani satifiketi yakunja ku trustpoint
awplus# crypto pki kutsimikizika AD_trustpoint
Dongosololi lipangitsa kuti satifiketi iyikidwe mu terminal, mumtundu wa PEM. Koperani ndi kumata satifiketi.
| Matani satifiketi ya PEM file ku terminal. Lembani "abort" kuti muletse. |
Yang'anani zala zala ndi zopereka, ndipo ngati zonse zikuwoneka zolondola, vomerezani satifiketi.
| Satifiketi yatsimikizika bwino. Kulandila satifiketi iyi? (y/n): ndi |
Gawo 5: Mukalandira satifiketi, bwererani ku terminal yosinthira
awplus#configure terminal
Gawo 6: Lowetsani momwe mungasinthire dzina la seva ya LDAP AD_server
awplus(config)# ldap-server AD_server
Gawo 7: Khazikitsani dzina la seva la LDAP
Kuti mukhale Otetezeka, muyenera kugwiritsa ntchito FQDN monga dzina la alendo, ndipo izi ziyenera kufanana ndi dzina lomwe lili pa satifiketi ya CA yomwe mudaitanitsa kale. Seva ya LDAP idzayang'ana mayina kuti mayinawa agwirizane, gawo la TLS lisanayambike.
awplus(config-ldap-server)# host example-FQDN.com
Gawo 8: Yambitsani LDAPS ndi TLS
awplus(config-ldap-server)# mode otetezeka
Gawo 9: Onjezani trustpoint ya seva ya LDAP yopangidwa pamwambapa
awplus(config-ldap-server)# trustpoint AD_trustpoint
Gawo 10: Mukasankha, tchulani ma ciphers oti mugwiritse ntchito pa TLS
awplus(config-ldap-server)# cipher otetezedwa DHE-DSS-AES256-GCM-SHA384
AES128-GCM-SHA256
Kukonzekera kwa kugwirizana kwa seva
Gawo 1: Kukonzekera kwanthawi
Mukalumikizana ndi seva yachikwatu komanso podikirira kuti kusaka kumalize, nthawi yodikirira kwambiri ndi masekondi 50.
awplus(config-ldap-server)# kutha kwa nthawi 50
Gawo 2: Zayesanso
Mukalumikiza ku maseva omwe akugwira ntchito, yesani 5 kuyesanso kuchuluka. awplus(config-ldap-server)# retransmit 5
Gawo 3: Nthawi yakufa
Chipangizocho sichidzatumiza zopempha zilizonse kwa seva kwa mphindi 5 ngati zalephera kuyankha pempho lapitalo.
awplus(config-ldap-server)# nthawi yomaliza 5
Sakani masinthidwe
Gawo 1: Zokonda pagulu la DN
Kuti kutsimikizika kwa ogwiritsa ntchito kukhale kopambana, wogwiritsa ntchitoyo ayenera kukhala m'gulu la Odziwika
Dzina (DN) chingwe: cn=Users,dc=test. Mwachikhazikitso chidzatsimikizira izi poyang'ana khalidwe lapadera la gululo, kuti muwone ngati lili ndi chingwe cha DN.
awplus(config-ldap-server)# group-dn cn=Ogwiritsa,dc=test
Gawo 2: Zokonda pagulu la Active Directory
Kwa Active Directory, m'malo mwake mudzafuna kuyang'ana mkati mwa membala wa gululo, lomwe lingathe kukhazikitsidwa ndi gulu la CLI. awplus(config-ldap-server)# membala wagulu
Ndi njira ziwirizo zokonzedwa, kusaka kungayese umembala wa wosuta wa gulu cn=Users,dc=test poyang'ana mawonekedwe a membala wa DN ya wosuta. Izi ndizothandiza ngati seva ya LDAP ikupereka chidziwitso kugulu lamakasitomala, koma chipangizocho chiyenera kuvomereza gulu la ogwiritsa ntchito.
Gawo 3: Lowani zokonda zolowera
Dzina lolowera lidzakhala la dzina la 'username'. Kuti kutsimikizika kwa ogwiritsa ntchito kukhale kopambana, bukhu liyenera kukhala ndi dzina lolowera =, mwachitsanzo, username=jdoe.
awplus(config-ldap-server)# dzina lolowera gulu
Gawo 4: Sakani zokonda zosefera
Mukapezanso zambiri za ogwiritsa ntchito, owerenga akuyenera kukhala nawo, mwachitsanzoample, 'testAccount' kuti kutsimikizika kwa ogwiritsa ntchito kukhale kopambana. Zosefera zosakira ndizosintha mwamakonda kwambiri, ndipo zitha kugwiritsidwa ntchito kuwunika chilichonse. Kuphatikiza apo, ogwiritsa ntchito boolean atha kugwiritsidwa ntchito kupititsa patsogolo kusaka.
awplus(config-ldap-server)# search-filter objectclass=testAccount
Exampzochepa:
- Izi zitha kutsimikizira kuti osuta objectclass ndi testAccount OR organisationRole
awplus(config-ldap-server)# search-sefa
(objectclass=testAccount)(objectclass=organizationalRole) - Izi zingayang'ane aliyense yemwe ali wosuta OSATI kompyuta
awplus(config-ldap-server)# sefa &(objectclass=user)(!(objectClass=computer)
Momwe mungafufuzire zisa pa Active Directory
Taganizirani chitsanzo chotsatirachiampLe:
- Popanda kusaka kosaka - pogwiritsa ntchito zosefera zomwe zili pansipa, aliyense wa ogwiritsa mkati mwa guluA azitha kulowa bwino, koma user3 mkati mwa guluB adzalephera.
awplus(config-ldap-server)# search-sefa memberOf=CN=groupA,OU=exampleOrg,DC=example,DC=mayeso - Powonjezera OID 1.2.840.113556.1.4.1941 mu membalaOf fufuzani muzosefera, Active Directory idzayang'ana mobwerezabwereza magulu onse mkati mwa guluA kwa wogwiritsa ntchito. Tsopano ogwiritsa ntchito aliwonse m'magulu aliwonse omwe ali gawo la guluA adzawunikidwa, kotero kuti wosuta3 wathu mu guluB lokhalamo atha kulowa.
awplus(config-ldap-server)# membala wosefaWa:1.2.840.113556.1.4.1941:=CN=groupA,OU=exampleOrg,DC=example,DC=mayeso
Kuwunika kwa LDAP
Gawo lotsatirali likupereka zina zakaleample zotuluka kuchokera ku command show ldap seva gulu.
Zotsatira zikuwonetsa kuti pali ma seva awiri a LDAP: Server_A ndi Server_B.
Kwa Server_A, lamulo lawonetsero likunena kuti:
- Seva_A ili ndi moyo
- Seva_A ndi seva ya LDAP
- Server_A ndi gawo la Gulu la seva Management
Kwa Server_B, lamulo lawonetsero likunena kuti: - Seva_B sinagwiritsidwe ntchito kapena dziko silidziwika.
- Seva_B ndi seva ya LDAP
- Seva_B si gawo la gulu lililonse la seva
Palinso gulu lachiwiri la seva 'RandD' lomwe lilibe ma seva a LDAP.
Ma seva ena awiriwo sanasonyezedwe muakale athuampzotuluka zake ndi:
- Yakufa - seva imadziwika kuti yafa ndipo sidzagwiritsidwa ntchito nthawi yomwalira.
- Zolakwika - Seva siyikuyankha.
Kuthandizira kuthetsa vutoli
Monga LDAP imakonzedwa pansi pa kagawo kakang'ono ka AAA, kukonza komwe kulipo kwa kutsimikizika kwa AAA kutulutsa chidziwitso chothandiza cha LDAP.
awplus# debug aaa kutsimikizika
Kuti mudziwe zambiri za LDAP kasitomala debugging, ndi zosankha zosiyanasiyana zolakwika, gwiritsani ntchito lamulo:
awplus# debug ldap kasitomala
Zindikirani kuti kuyatsa kusokoneza kwamakasitomala onse a LDAP kungakhudze magwiridwe antchito ndi mauthenga ambiri a chipika.
Likulu la North America | | 19800 North Creek Parkway | Zotsatira 100 | Botani | WA 98011 | USA |T: +1 800 424 4284 | F: + 1 425 481 3895
Likulu la Asia-Pacific | | 11 Tai Seng Ulalo | Singapore | 534182 | T: +65 6383 3832 | F: + 65 6383 3830
EMEA & CSA Operations | | Incheonweg 7 | 1437 EK Rozenburg | Netherlands | T: +31 20 7950020 | F: +31 20 7950021
Zolemba / Zothandizira
 |
Allied Telesis Lightweight Directory Access Protocol [pdf] Buku Logwiritsa Ntchito Wopepuka Kalozera Wofikira Protocol, Directory, Access Protocol |
