当我使用
ldapsearch -LLLZZ -H ldap://centos7s.domen.lan -x
我把一切都说出来：
dn: dc=domen,dc=lan
objectClass: domain
dc: domen
o: domen.lan organization
description: The Domen Company
dn: ou=users,dc=domen,dc=lan
ou: users
objectClass: top
objectClass: organizationalUnit
dn: ou=groups,dc=domen,dc=lan
ou: groups
objectClass: top
objectClass: organizationalUnit
dn: uid=ldapuser1,ou=users,dc=domen,dc=lan
uid: ldapuser1
cn: ldapuser1
sn: ldapuser1
mail: [email protected]
objectClass: person
objectClass: organizationalPerson....
但
ldapsearch -ZZWD cn=manager,dc=domen,dc=lan -b cn=config -h centos7s.domen.lan
我什么也没得到：
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <cn=config> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# search result
search: 3
result: 32 No such object
# numResponses: 1
我做错了什么？这个搜索有什么区别？
原文中有：
ldapsearch -LLLY EXTERNAL -H ldapi:/// -b cn=config '(olcAccess=*)' olcAccess olcSuffix
-
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
dn: olcDatabase={0}config,cn=config
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external
,cn=auth" manage by * none
dn: olcDatabase={1}monitor,cn=config
olcAccess: {0}to * by
dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external
,cn=auth" read by dn.base="cn=manager,dc=domen,dc=lan" read by * none
现在，改变之后：
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
dn: olcDatabase={0}config,cn=config
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external
,cn=auth" manage by * none
dn: olcDatabase={1}monitor,cn=config
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external
,cn=auth" read by dn.base="cn=manager,dc=domen,dc=lan" read by * none
dn: olcDatabase={2}hdb,cn=config
olcSuffix: dc=domen,dc=lan
olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=manager,dc=do
men,dc=lan" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=manager,dc=domen,dc=lan" write by * read
仍然与上面的结果相同，第二个ldapsearch 不返回任何内容。
答案1
这两个搜索有不同的搜索基础。请检查您的 ACL 以获取更多信息。
我唯一可以确定的是：
anonymous可以访问dc=domen,dc=lan子树。cn=manager,dc=domen,dc=lan无权访问cn=config子树。