我正在编写一个脚本来自动安装 slapd 和 phpldapadmin。
剧本：
#!/bin/bash
# make sure to run script as sudo
# LDAP
# update first
apt-get -q -y update
# install maven
apt-get install -y maven
# Install php dependencies
apt-get -y install php php-cgi libapache2-mod-php php-common php-pear php-mbstring
a2enconf php7.0-cgi
service apache2 restart
# Pre-seed the slapd passwords
export DEBIAN_FRONTEND='non-interactive'
echo -e "slapd slapd/root_password password KappaRoss" |debconf-set-selections
echo -e "slapd slapd/root_password_again password KappaRoss" |debconf-set-selections
echo -e "slapd slapd/internal/adminpw password test" |debconf-set-selections
echo -e "slapd slapd/internal/generated_adminpw password test" |debconf-set-selections
echo -e "slapd slapd/password2 password test" |debconf-set-selections
echo -e "slapd slapd/password1 password test" |debconf-set-selections
echo -e "slapd slapd/domain string acu.local" |debconf-set-selections
echo -e "slapd shared/organization string IT410" |debconf-set-selections
echo -e "slapd slapd/backend string HDB" |debconf-set-selections
echo -e "slapd slapd/purge_database boolean true" |debconf-set-selections
echo -e "slapd slapd/move_old_database boolean true" |debconf-set-selections
echo -e "slapd slapd/allow_ldap_v2 boolean false" |debconf-set-selections
echo -e "slapd slapd/no_configuration boolean false" |debconf-set-selections
# Grab slapd and ldap-utils (pre-seeded)
apt-get install -y slapd ldap-utils phpldapadmin
# Must reconfigure slapd for it to work properly
sudo dpkg-reconfigure slapd
# Gotta replace the ldap.conf file, it comments out stuff we need set by default - first open it for writing
chmod 777 /etc/ldap/ldap.conf
cat <<'EOF' > /etc/ldap/ldap.conf
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
BASE dc=acu,dc=local
URI ldap://104.219.54.109 ldap://104.219.54.109:666
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
# TLS certificates (needed for GnuTLS)
TLS_CACERT /etc/ssl/certs/ca-certificates.crt
EOF
# Be safe again
chmod 744 /etc/ldap/ldap.conf
# Now change all values in /etc/phpldapadmin/config.php to their actual values from example, or .com or localhost (I use sed)
# Line 286
sed -i "s@$servers->setValue('server','name','My LDAP Server');.*@$servers->setValue('server','name','Nathans_LDAP');@" /etc/phpldapadmin/config.php
# Line 293
sed -i "s@$servers->setValue('server','host','127.0.0.1');.*@$servers->setValue('server','host','104.219.54.109');@" /etc/phpldapadmin/config.php
# Line 300
sed -i "s@$servers->setValue('server','base',array('dc=example,dc=com'));.*@$servers->setValue('server','base',array('dc=acu,dc=local'));@" /etc/phpldapadmin/config.php
# Line 326
sed -i "s@$servers->setValue('login','bind_id','cn=admin,dc=example,dc=com');.*@$servers->setValue('login','bind_id','cn=admin,dc=acu,dc=local');@" /etc/phpldapadmin/config.php
# Prevent error when creating users
sed -i "s@$default = $this->getServer()->getValue('appearance','password_hash');.*@$default = $this->getServer()->getValue('appearance','password_hash_custom');@g" /usr/share/phpldapadmin/lib/TemplateRender.php
service apache2 restart
echo ------------------------#
echo 'PHPldapadmin installed.'
echo ------------------------#
echo ""
echo ------------------------------------------------------------#
echo 'Can now access phpldapadmin at http://your-ip/phpldapadmin.'
echo ------------------------------------------------------------#
echo ""
echo ------------------------------------------------------------------------#
echo 'Username should be acu.local, password is the adminpw set during setup.'
echo ------------------------------------------------------------------------# S
# Logging
echo -e 'Maven installed -done by' $USER 'at time\n' $DATE '\n' >> /var/log/installs/log.txt
echo -e 'slapd and ldap-utils configured and installed -done by' $USER 'at time\n' $DATE '\n' >> /var/log/installs/log.txt
echo -e 'phpldapadmin install configured -done by' $USER 'at time\n' $DATE '\n' >> /var/log/installs/log.txt
echo -e 'LDAP installed completed by' $USER 'at time\n' $DATE '\n' >> /var/log/installs/log.txt
一切运行良好，除了我认为用于预播种“dpkg-reconfigure slapd”部分的 debconf 设置选择并未完全应用。具体来说，当我尝试使用预先设置的管理员密码登录 phpldapadmin 时，它失败了。我必须在终端中再次运行“dpkg-reconfigure slapd”（这次手动）并设置另一个管理员密码，然后我可以正确登录 phpldapadmin 并且一切正常。感谢任何帮助，我需要这个应用程序在我的期末考试中完全自动化，而且我真的很接近。
答案1
我的 debconf preseed 看起来有点不同，但它是为了stretch：
cat > /root/debconf-slapd.conf << 'EOF'
slapd slapd/password1 password admin
slapd slapd/internal/adminpw password admin
slapd slapd/internal/generated_adminpw password admin
slapd slapd/password2 password admin
slapd slapd/unsafe_selfwrite_acl note
slapd slapd/purge_database boolean false
slapd slapd/domain string phys.ethz.ch
slapd slapd/ppolicy_schema_needs_update select abort installation
slapd slapd/invalid_config boolean true
slapd slapd/move_old_database boolean false
slapd slapd/backend select MDB
slapd shared/organization string ETH Zurich
slapd slapd/dump_database_destdir string /var/backups/slapd-VERSION
slapd slapd/no_configuration boolean false
slapd slapd/dump_database select when needed
slapd slapd/password_mismatch note
EOF
export DEBIAN_FRONTEND=noninteractive
cat /root/debconf-slapd.conf | debconf-set-selections
apt install ldap-utils slapd -y
之后我用来ldapmodify立即更新密码。这是通过将哈希值存储在 ldap 中来完成的，因此脚本中不会显示纯文本密码：
cat > /root/admin_pw_config_dit.ldif << 'EOF'
dn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: {CRYPT}<sha-512_hash_here>
EOF
cat > /root/admin_pw_normal_dit.ldif << 'EOF'
dn: cn=admin,dc=phys,dc=ethz,dc=ch
changetype: modify
replace: userPassword
userPassword: {CRYPT}<sha-512_hash_here>
ldapmodify -H ldapi:/// -x -D cn=admin,dc=phys,dc=ethz,dc=ch -w admin -f /root/admin_pw_normal_dit.ldif
ldapmodify -H ldapi:/// -f /root/admin_pw_config_dit.ldif
# verify
ldapsearch -H ldapi:/// -x -D cn=admin,dc=phys,dc=ethz,dc=ch -W -b dc=phys,dc=ethz,dc=ch cn=admin | grep 'userPassword'
替换<sha-512_hash_here>为您的密码的哈希值。
您可以使用以下脚本生成此类哈希值：https://github.com/rda0/mkpw
或者，也可以使用slappasswd -h <hashing-algorithm> -s <new_password>