9.配置KeepAlived高可用
9.1.安装keepalived。
[root@ldap-master (18:51:24)~]# yum -y install keepalived[root@ldap-slave (18:51:25)~]# yum -y install keepalived
9.2.证书设置
由于我们要设置一个vip地址（250），为了让访问ldap的服务感知不到ldap的切换，我们要把访问ldap服务的程序中ldap的地址改为这个vip地址，所以在客户端申请证书时，就会出现问题（因为我们之前的证书是147和150的证书）。所以，我们需要把ldap的证书认证模式改为never模式，实现即使证书不能认证，还会使用https加密通信。但是为了让客户端使证书有效，我们需要使用vip地址（250）的证书。
9.2.1备份之前的证书
ldap-master：
[root@ldap-master (18:55:51)~]# cd /etc/openldap/certs/[root@ldap-master (19:04:21)/etc/openldap/certs]# [root@ldap-master (19:04:21)/etc/openldap/certs]# lscacert.pem key3.db openldapcert147.crt password cert8.db openldap147.csr openldapkey147.pem secmod.db [root@ldap-master (19:04:22)/etc/openldap/certs]# mkdir cert147[root@ldap-master (19:04:33)/etc/openldap/certs]# lscacert.pem cert8.db openldap147.csr openldapkey147.pem secmod.db cert147 key3.db openldapcert147.crt password [root@ldap-master (19:04:34)/etc/openldap/certs]# mv openldap* cert147/[root@ldap-master (19:05:13)/etc/openldap/certs]# lscacert.pem cert147 cert8.db key3.db password secmod.db
9.2.2重新生成新的证书
ldap-master
[root@ldap-master (19:05:14)/etc/openldap/certs]# (umask 077;openssl genrsa -out openldapkey250.pem 2048)Generating RSA private key, 2048 bit long modulus ....+++ ....+++ e is 65537 (0x10001) [root@ldap-master (19:09:49)/etc/openldap/certs]# openssl req -new -key openldapkey250.pem -out openldap250.csr -days 3650 -subj "/C=CN/ST=BeiJing/L=BeiJing/O=test.net.cn/OU=internet/CN=192.168.2.250"[root@ldap-master (19:10:08)/etc/openldap/certs]# scp openldap250.csr root@192.168.2.148:/rootroot@192.168.2.148's password: openldap250.csr 100% 1021 830.6KB/s 00:00
CA服务器
[root@CA (18:59:01)~]# cd /etc/pki/CA[root@CA (19:11:28)/etc/pki/CA]# openssl ca -in /root/openldap250.csr -out /etc/pki/CA/certs/openldapcert250.crt -days 3650Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 4 (0x4) Validity Not Before: Dec 14 11:11:52 2019 GMT Not After : Dec 11 11:11:52 2029 GMT Subject: countryName = CN stateOrProvinceName = BeiJing organizationName = test.net.cn organizationalUnitName = internet commonName = 192.168.2.250 X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 1E:54:A8:73:58:01:6D:70:B4:15:A1:2B:00:D9:32:EC:F3:44:42:5B X509v3 Authority Key Identifier: keyid:B5:68:D1:D2:61:0B:13:E1:4B:6D:C2:2A:AE:31:39:97:72:F5:80:B9 Certificate is to be certified until Dec 11 11:11:52 2029 GMT (3650 days) Sign the certificate? [y/n]:y1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [root@CA (19:11:56)/etc/pki/CA]# [root@CA (19:11:56)/etc/pki/CA]# scp certs/openldapcert250.crt root@192.168.2.147:/rootroot@192.168.2.147's password: openldapcert250.crt 100% 4528 2.6MB/s 00:00
ldap-master
[root@ldap-master (19:11:00)/etc/openldap/certs]# cp /root/openldapopenldapadmin.crt openldapcert130.crt openldapcert147.crt openldapcert250.crt [root@ldap-master (19:11:00)/etc/openldap/certs]# cp /root/openldapcert250.crt ./[root@ldap-master (19:14:11)/etc/openldap/certs]# lscacert.pem cert8.db openldap250.csr openldapkey250.pem secmod.db cert147 key3.db openldapcert250.crt password [root@ldap-master (19:14:16)/etc/openldap/certs]# chown -R ldap.ldap /etc/openldap/certs[root@ldap-master (19:14:35)/etc/openldap/certs]# chmod -R 0400 /etc/openldap/certs/openldap*[root@ldap-master (19:14:42)/etc/openldap/certs]#
生成证书后，重新编辑slapd.ldif，修改证书文件的名称
olcTLSCertificateFile: /etc/openldap/certs/openldapcert250.crt olcTLSCertificateKeyFile: /etc/openldap/certs/openldapkey250.pem
重新生成配置文件
[root@ldap-master (19:24:30)/etc/openldap]# sh config_init.sh _#################### 100.00% eta none elapsed none fast! Closing DB...
ldap-slave证书设置
直接使用slapd-master的证书就可以
传输之前先备份
先备份原来的证书
ldap-slave
[root@ldap-slave (18:56:14)~]# cd /etc/openldap/certs/[root@ldap-slave (19:07:20)/etc/openldap/certs]# lscacert.pem key3.db openldapcert150.crt password cert8.db openldap150.csr openldapkey150.pem secmod.db [root@ldap-slave (19:07:21)/etc/openldap/certs]# mkdir certs150[root@ldap-slave (19:07:31)/etc/openldap/certs]# mv openldap* certs150/[root@ldap-slave (19:07:39)/etc/openldap/certs]# lscacert.pem cert8.db certs150 key3.db password secmod.db [root@ldap-slave (19:07:42)/etc/openldap/certs]#
ldap-master
[root@ldap-master (19:18:55)/etc/openldap/certs]# scp openldap* root@192.168.2.150:/etc/openldap/certs/root@192.168.2.150's password: openldap250.csr 100% 1021 925.5KB/s 00:00 openldapcert250.crt 100% 4528 3.1MB/s 00:00 openldapkey250.pem 100% 1675 736.4KB/s 00:00
ldap-slave
这时就可以使用ldap-master申请的证书了。
[root@ldap-slave (19:07:42)/etc/openldap/certs]# lscacert.pem certs150 openldap250.csr openldapkey250.pem secmod.db cert8.db key3.db openldapcert250.crt password [root@ldap-slave (19:21:28)/etc/openldap/certs]# chown -R ldap.ldap /etc/openldap/certs
然后同样需要修改一下slapd.ldif文件中证书的名称
[root@ldap-slave (19:21:54)/etc/openldap/certs]# grep 250 ../slapd.ldif olcTLSCertificateFile: /etc/openldap/certs/openldapcert250.crt olcTLSCertificateKeyFile: /etc/openldap/certs/openldapkey250.pem
也需要重新生成配置文件
[root@ldap-slave (19:26:25)/etc/openldap]# sh config_init.sh _#################### 100.00% eta none elapsed none fast! Closing DB... [root@ldap-slave (19:26:27)/etc/openldap]#
测试证书
这时会显示证书有问题
测试ldap-slave。
此时两个ldap节点的证书都已经设置好了，接下来我们就需要设置keepalived了。
9.3设置keepalived。
ldap-master
备份原来的keepalived.conf，并生成新的keepalived.conf配置文件。
[root@ldap-master (20:03:30)/etc/keepalived]# mv keepalived.conf{,.bak}[root@ldap-master (20:08:47)/etc/keepalived]# cat keepalived.conf! Configuration File for keepalived global_defs { notification_email { acassen@firewall.loc failover@firewall.loc sysadmin@firewall.loc } #notification_email_from Alexandre.Cassen@firewall.loc #smtp_server 192.168.200.1 #smtp_connect_timeout 30 router_id ldapA vrrp_skip_check_adv_addr #vrrp_strict vrrp_garp_interval 0 vrrp_gna_interval 0} vrrp_script check_ldap_server_status { script "/etc/keepalived/check-ldap-server.sh" interval 3 weight -5} vrrp_instance VI_1 { state MASTER interface eth0 virtual_router_id 51 priority 100 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 192.168.2.250 } notify_master "/etc/keepalived/to_master.sh" notify_backup "/etc/keepalived/to_master.sh" notify_stop "/etc/keepalived/to_stop.sh" track_script { check_ldap_server_status } } 里面的脚本 [root@ldap-master (20:13:02)/etc/keepalived]# cat check-ldap-server.sh #!/bin/bashldapPid=$(ps -ef |grep slapd|grep -v grep|awk '{print $2}' |grep -v PID)if [ "$ldapPid" == "" ]; then systemctl stop keepalived echo "slapd stop" exit 1else exit 0fi[root@ldap-master (20:15:03)/etc/keepalived]# cat to_master.sh #!/bin/bashsystemctl start slapd [root@ldap-master (20:15:10)/etc/keepalived]# cat to_stop.sh #!/bin/bashsystemctl stop slapd [root@ldap-master (20:15:14)/etc/keepalived]# 添加可执行权限 [root@ldap-master (20:15:14)/etc/keepalived]# lscheck-ldap-server.sh keepalived.conf keepalived.conf.bak to_master.sh to_stop.sh [root@ldap-master (20:16:05)/etc/keepalived]# chmod +x to_* check-ldap-server.sh [root@ldap-master (20:16:30)/etc/keepalived]# lltotal 20-rwxr-xr-x 1 root root 193 Dec 14 20:12 check-ldap-server.sh -rw-r--r-- 1 root root 954 Dec 14 20:08 keepalived.conf -rw-r--r-- 1 root root 3598 Aug 13 04:37 keepalived.conf.bak -rwxr-xr-x 1 root root 34 Dec 14 20:12 to_master.sh -rwxr-xr-x 1 root root 33 Dec 14 20:13 to_stop.sh [root@ldap-master (20:16:31)/etc/keepalived]# 将脚本文件复制到ldap-slave中 [root@ldap-master (20:16:31)/etc/keepalived]# scp check-ldap-server.sh to_* root@192.168.2.150:/etc/keepalived/root@192.168.2.150's password: check-ldap-server.sh 100% 193 163.7KB/s 00:00 to_master.sh 100% 34 21.3KB/s 00:00 to_stop.sh 100% 33 24.4KB/s 00:00 [root@ldap-master (20:17:31)/etc/keepalived]#
ldap-slave
[root@ldap-slave (20:10:40)/etc/keepalived]# cat keepalived.conf! Configuration File for keepalived global_defs { notification_email { acassen@firewall.loc failover@firewall.loc sysadmin@firewall.loc } #notification_email_from Alexandre.Cassen@firewall.loc #smtp_server 192.168.200.1 #smtp_connect_timeout 30 router_id ldapB vrrp_skip_check_adv_addr #vrrp_strict vrrp_garp_interval 0 vrrp_gna_interval 0} vrrp_script check_ldap_server_status { script "/etc/keepalived/check-ldap-server.sh" interval 3 weight -5} vrrp_instance VI_1 { state BACKUP interface eth0 virtual_router_id 51 priority 98 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 192.168.2.250 } notify_master "/etc/keepalived/to_master.sh" notify_backup "/etc/keepalived/to_master.sh" notify_stop "/etc/keepalived/to_stop.sh" track_script { check_ldap_server_status } } [root@ldap-slave (20:18:47)/etc/keepalived]# lscheck-ldap-server.sh keepalived.conf keepalived.conf.bak to_master.sh to_stop.sh [root@ldap-slave (20:18:49)/etc/keepalived]#
启动keepalived
[root@ldap-master (20:18:41)/etc/keepalived]# systemctl start keepalived[root@ldap-master (20:20:53)/etc/keepalived]# ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:0c:29:e8:05:aa brd ff:ff:ff:ff:ff:ff inet 192.168.2.147/24 brd 192.168.2.255 scope global dynamic eth0 valid_lft 1610sec preferred_lft 1610sec inet 192.168.2.250/32 scope global eth0 valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fee8:5aa/64 scope link valid_lft forever preferred_lft forever
设置为开机自启动。
[root@ldap-master (20:20:56)/etc/keepalived]# systemctl enable keepalivedCreated symlink from /etc/systemd/system/multi-user.target.wants/keepalived.service to /usr/lib/systemd/system/keepalived.service. [root@ldap-slave (20:46:03)/etc/keepalived]# systemctl enable keepalivedCreated symlink from /etc/systemd/system/multi-user.target.wants/keepalived.service to /usr/lib/systemd/system/keepalived.service.
ldap-slave
[root@ldap-slave (20:18:49)/etc/keepalived]# systemctl start keepalived[root@ldap-slave (20:25:14)/etc/keepalived]# ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:0c:29:77:ca:56 brd ff:ff:ff:ff:ff:ff inet 192.168.2.150/24 brd 192.168.2.255 scope global dynamic eth0 valid_lft 1462sec preferred_lft 1462sec inet6 fe80::20c:29ff:fe77:ca56/64 scope link valid_lft forever preferred_lft forever
测试
ldap-master主机停止slapd服务，可以看见250地址消失了。
[root@ldap-master (20:21:31)/etc/keepalived]# systemctl stop slapd[root@ldap-master (20:25:55)/etc/keepalived]# ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:0c:29:e8:05:aa brd ff:ff:ff:ff:ff:ff inet 192.168.2.147/24 brd 192.168.2.255 scope global dynamic eth0 valid_lft 1308sec preferred_lft 1308sec inet6 fe80::20c:29ff:fee8:5aa/64 scope link valid_lft forever preferred_lft forever [root@ldap-master (20:25:58)/etc/keepalived]# 此时keepalived已经自己停止了 [root@ldap-master (20:25:58)/etc/keepalived]# systemctl status keepalived● keepalived.service - LVS and VRRP High Availability Monitor Loaded: loaded (/usr/lib/systemd/system/keepalived.service; enabled; vendor preset: disabled) Active: inactive (dead) since Sat 2019-12-14 20:25:57 CST; 3min 5s ago Main PID: 8342 (code=exited, status=0/SUCCESS) CGroup: /system.slice/keepalived.service Dec 14 20:21:00 ldap-master.test.net.cn Keepalived_vrrp[8344]: VRRP_Instance(VI_1) Sending... Dec 14 20:21:00 ldap-master.test.net.cn Keepalived_vrrp[8344]: Sending gratuitous ARP on e... Dec 14 20:21:00 ldap-master.test.net.cn Keepalived_vrrp[8344]: Sending gratuitous ARP on e... Dec 14 20:21:00 ldap-master.test.net.cn Keepalived_vrrp[8344]: Sending gratuitous ARP on e... Dec 14 20:21:00 ldap-master.test.net.cn Keepalived_vrrp[8344]: Sending gratuitous ARP on e... Dec 14 20:25:56 ldap-master.test.net.cn Keepalived[8342]: Stopping Dec 14 20:25:56 ldap-master.test.net.cn systemd[1]: Stopping LVS and VRRP High Availabil..... Dec 14 20:25:56 ldap-master.test.net.cn Keepalived_vrrp[8344]: VRRP_Instance(VI_1) sent 0 ... Dec 14 20:25:56 ldap-master.test.net.cn Keepalived_vrrp[8344]: VRRP_Instance(VI_1) removin... Dec 14 20:25:57 ldap-master.test.net.cn systemd[1]: Stopped LVS and VRRP High Availabili...r. Hint: Some lines were ellipsized, use -l to show in full. [root@ldap-master (20:29:03)/etc/keepalived]#
同时查看ldap-slave主机
可以发现250地址漂移到ldap-slave主机上了。
[root@ldap-slave (20:26:01)/etc/keepalived]# ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:0c:29:77:ca:56 brd ff:ff:ff:ff:ff:ff inet 192.168.2.150/24 brd 192.168.2.255 scope global dynamic eth0 valid_lft 1341sec preferred_lft 1341sec inet 192.168.2.250/32 scope global eth0 valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe77:ca56/64 scope link valid_lft forever preferred_lft forever
恢复主节点的keepalived
[root@ldap-master (20:29:03)/etc/keepalived]# systemctl start slapd[root@ldap-master (20:30:55)/etc/keepalived]# systemctl start keepalived[root@ldap-master (20:31:03)/etc/keepalived]# systemctl status keepalived● keepalived.service - LVS and VRRP High Availability Monitor Loaded: loaded (/usr/lib/systemd/system/keepalived.service; enabled; vendor preset: disabled) Active: active (running) since Sat 2019-12-14 20:31:03 CST; 21s ago Process: 9341 ExecStart=/usr/sbin/keepalived $KEEPALIVED_OPTIONS (code=exited, status=0/SUCCESS) Main PID: 9342 (keepalived) CGroup: /system.slice/keepalived.service ├─9342 /usr/sbin/keepalived -D ├─9343 /usr/sbin/keepalived -D └─9344 /usr/sbin/keepalived -D Dec 14 20:31:04 ldap-master.test.net.cn Keepalived_vrrp[9344]: Sending gratuitous ARP on e... Dec 14 20:31:04 ldap-master.test.net.cn Keepalived_vrrp[9344]: Sending gratuitous ARP on e... Dec 14 20:31:04 ldap-master.test.net.cn Keepalived_vrrp[9344]: Sending gratuitous ARP on e... Dec 14 20:31:04 ldap-master.test.net.cn Keepalived_vrrp[9344]: Opening script file /etc/ke... Dec 14 20:31:09 ldap-master.test.net.cn Keepalived_vrrp[9344]: Sending gratuitous ARP on e... Dec 14 20:31:09 ldap-master.test.net.cn Keepalived_vrrp[9344]: VRRP_Instance(VI_1) Sending... Dec 14 20:31:09 ldap-master.test.net.cn Keepalived_vrrp[9344]: Sending gratuitous ARP on e... Dec 14 20:31:09 ldap-master.test.net.cn Keepalived_vrrp[9344]: Sending gratuitous ARP on e... Dec 14 20:31:09 ldap-master.test.net.cn Keepalived_vrrp[9344]: Sending gratuitous ARP on e... Dec 14 20:31:09 ldap-master.test.net.cn Keepalived_vrrp[9344]: Sending gratuitous ARP on e... Hint: Some lines were ellipsized, use -l to show in full. 可以看见250地址漂移回来了 [root@ldap-master (20:31:24)/etc/keepalived]# ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:0c:29:e8:05:aa brd ff:ff:ff:ff:ff:ff inet 192.168.2.147/24 brd 192.168.2.255 scope global dynamic eth0 valid_lft 1662sec preferred_lft 1662sec inet 192.168.2.250/32 scope global eth0 valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fee8:5aa/64 scope link valid_lft forever preferred_lft forever ldap-slave节点上的250地址也消失了 [root@ldap-slave (20:27:42)/etc/keepalived]# ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:0c:29:77:ca:56 brd ff:ff:ff:ff:ff:ff inet 192.168.2.150/24 brd 192.168.2.255 scope global dynamic eth0 valid_lft 1748sec preferred_lft 1748sec inet6 fe80::20c:29ff:fe77:ca56/64 scope link valid_lft forever preferred_lft forever
使用客户端测试
连接测试
连接250时并没有弹出证书提醒。
注意
如果节点出现问题，先启动slapd服务，再启动keepalived服务。
六.创建openLDAP的组织架构。
根据每个公司的组织架构去创建对应的openldap组织架构；
这里我们使用测试的组织架构
