Self Service Password AD域密码自助重置服务配置指引

Self Service Password AD域密码自助重置服务配置指引

1、安装Self Service Password

一、到官网获取安装包或安装方法

https://ltb-project.org/start

二、dev为开发者版本，stable为最新稳定版，建议使用stable版本，稳定最重要。

三、选择RPM包安装

四、安装官方指引，配置yum源并安装

#配置yum源
[root@localhost ~]# vim /etc/yum.repos.d/ltb-project.repo
[ltb-project-noarch]
name=LTB project packages (noarch)
baseurl=https://ltb-project.org/rpm/$releasever/noarch
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-LTB-project
#导入GPG私钥
[root@localhost ~]# rpm --import https://ltb-project.org/wiki/lib/RPM-GPG-KEY-LTB-project
#安装self-service-password
[root@localhost ~]# yum install -y self-service-password

2、配置self-service-password

一、修改/usr/share/self-service-password/conf/config.inc.php的配置(具体参数配置，可到官网查看配置文档)

[root@localhost ~]# vim /usr/share/self-service-password/conf/config.inc.php
<?php
#==============================================================================
# LTB Self Service Password
#
# Copyright (C) 2009 Clement OUDOT
# Copyright (C) 2009 LTB-project.org
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# GPL License: http://www.gnu.org/licenses/gpl.txt
#
#==============================================================================

#==============================================================================
# All the default values are kept here, you should not modify it but use
# config.inc.local.php file instead to override the settings from here.
#==============================================================================

#==============================================================================
# Configuration
#==============================================================================

# Debug mode
# true: log and display any errors or warnings (use this in configuration/testing)
# false: log only errors and do not display them (use this in production)
$debug = true;  //打开调试模式，便于调试

# LDAP

$ldap_url = "ldaps://xxxxxxxxxx:636";  //配置LDAPS 636端口加密
$ldap_starttls = false;
$ldap_binddn = "cn=xxxx,cn=xxx,dc=xxx,dc=xxx,dc=xxx";  //链接LDAP服务器的帐号的DN，该帐号要有修改AD域用户帐号权限
$ldap_bindpw = "xxxxxx";  //链接LDAP服务器帐号的密码
$ldap_base = "dc=xxx,dc=xxx,dc=xxx"; // 检索OU范围
$ldap_login_attribute = "cn";  //检索AD域用户cn属性的用户名
$ldap_fullname_attribute = "cn"; 
$ldap_filter = "(&(objectClass=user)(sAMAccountName={login})(!(userAccountControl:1.2.840.113556.1.4.803:=2)))";

# Active Directory mode
# true: use unicodePwd as password field
# false: LDAPv3 standard behavior
$ad_mode = true;  //启用Active Directory模式
# Force account unlock when password is changed
$ad_options['force_unlock'] = true;  //强制解锁：当密码更改将解锁锁定账户
# Force user change password at next login
$ad_options['force_pwd_change'] = false;  //强制用户在下次登陆时更改密码
# Allow user with expired password to change password
$ad_options['change_expired_password'] = true;  //容许用户更改密码，若是密码过时

# Samba mode
# true: update sambaNTpassword and sambaPwdLastSet attributes too
# false: just update the password
$samba_mode = false;
# Set password min/max age in Samba attributes
#$samba_options['min_age'] = 5;
#$samba_options['max_age'] = 45;

# Shadow options - require shadowAccount objectClass
# Update shadowLastChange
$shadow_options['update_shadowLastChange'] = false;
$shadow_options['update_shadowExpire'] = false;

# Default to -1, never expire
$shadow_options['shadow_expire_days'] = -1;

# Hash mechanism for password:
# SSHA, SSHA256, SSHA384, SSHA512
# SHA, SHA256, SHA384, SHA512
# SMD5
# MD5
# CRYPT
# clear (the default)
# auto (will check the hash of current password)
# This option is not used with ad_mode = true
$hash = "clear";

# Prefix to use for salt with CRYPT
$hash_options['crypt_salt_prefix'] = "$6$";
$hash_options['crypt_salt_length'] = "6";

# Local password policy
# This is applied before directory password policy
# Minimal length
$pwd_min_length = 6;  //定义最短密码位数
# Maximal length
$pwd_max_length = 14;  //定义最长密码位数
# Minimal lower characters
$pwd_min_lower = 0;  //定义密码应包含多少位小写字母
# Minimal upper characters
$pwd_min_upper = 0;  //定义密码应包含多少位大写字母
# Minimal digit characters
$pwd_min_digit = 0;  //定义密码应包含多少位数字
# Minimal special characters
$pwd_min_special = 0; //定义密码应包含多少位特殊字符
# Definition of special characters
$pwd_special_chars = "^a-zA-Z0-9";   //定义密码正则表达式
# Forbidden characters 
#$pwd_forbidden_chars = "@%";  //定义密码禁止的特殊字符
# Don't reuse the same password as currently
$pwd_no_reuse = true;  //是否禁止使用重复密码
# Check that password is different than login
$pwd_diff_login = true;  //检查密码是否与登陆密码不一样
# Complexity: number of different class of character required
$pwd_complexity = 3;   //定义密码应包含多少种组合
# use pwnedpasswords api v2 to securely check if the password has been on a leak
$use_pwnedpasswords = false; 
# Show policy constraints message:
# always
# never
# onerror
$pwd_show_policy = "always";  //是否显示密码更改策略
# Position of password policy constraints message:
# above - the form
# below - the form
$pwd_show_policy_pos = "above";  //定义密码更改策略显示位置

# Who changes the password?
# Also applicable for question/answer save
# user: the user itself
# manager: the above binddn
$who_change_password = "xxxxxxx";  //定义使用什么帐户来修改密码

## Standard change
# Use standard change form?
$use_change = true;  //启用密码更改功能

## SSH Key Change
# Allow changing of sshPublicKey?
$change_sshkey = false;

# What attribute should be changed by the changesshkey action?
$change_sshkey_attribute = "sshPublicKey";

# Who changes the sshPublicKey attribute?
# Also applicable for question/answer save
# user: the user itself
# manager: the above binddn
$who_change_sshkey = "xxxxxxx"; //定义使用什么帐户来修改sshPublicKey属性

# Notify users anytime their sshPublicKey is changed
## Requires mail configuration below
$notify_on_sshkey_change = false;

## Questions/answers
# Use questions/answers?
# true (default)
# false
$use_questions = false;  //启用问题答案修改密码功能

# Answer attribute should be hidden to users!
$answer_objectClass = "extensibleObject";
$answer_attribute = "info";

# Crypt answers inside the directory
$crypt_answers = true;

# Extra questions (built-in questions are in lang/$lang.inc.php)
#$messages['questions']['ice'] = "What is your favorite ice cream flavor?";

## Token
# Use tokens?
# true (default)
# false
$use_tokens = true;  //启用邮件修改密码功能
# Crypt tokens?
# true (default)
# false
$crypt_tokens = true;
# Token lifetime in seconds
$token_lifetime = "3600";

## Mail
# LDAP mail attribute
$mail_attribute = "mail"; //对比LDAP的mail属性
# Get mail address directly from LDAP (only first mail entry)
# and hide mail input field
# default = false
$mail_address_use_ldap = false;
# Who the email should come from
$mail_from = "xxxxxx@xxxx.com";  //发件人
$mail_from_name = "Self Service Password";
$mail_signature = "";
# Notify users anytime their password is changed
$notify_on_change = true;  //当用户的密码被更改时通知他们
# PHPMailer configuration (see https://github.com/PHPMailer/PHPMailer)
$mail_sendmailpath = '/usr/sbin/sendmail'; 
$mail_protocol = 'smtp';  //smtp协议
$mail_smtp_debug = 0;
$mail_debug_format = 'error_log';
$mail_smtp_host = 'xxxxxxxxx';  //发送服务器
$mail_smtp_auth = true;
$mail_smtp_user = 'xxxx@xxx.com';  //发件邮箱帐号
$mail_smtp_pass = 'xxxxx';  //发件邮箱密码
$mail_smtp_port = 25;
$mail_smtp_timeout = 30;
$mail_smtp_keepalive = false;
$mail_smtp_secure = 'tls';
$mail_smtp_autotls = true;
$mail_contenttype = 'text/plain';
$mail_wordwrap = 0;
$mail_charset = 'utf-8';
$mail_priority = 3;
$mail_newline = PHP_EOL;

# Encryption, decryption keyphrase, required if $crypt_tokens = true
# Please change it to anything long, random and complicated, you do not have to remember it
# Changing it will also invalidate all previous tokens and SMS codes
$keyphrase = "xxxx"; 修改keyphrase，任意字符串，与默认配置内容不一致便可

3、安装和配置openldap

一、安装openldap

[root@localhost ~]# yum install -y openldap

二、从域内的CA服务器内申请CA证书，格式：DER编码二进制 X.509 或 Base64 编码 X.509(操做 略)

三、将证书从.cer 转成.pem 格式,并导入openldap

[root@localhost ~]# openssl x509 -inform der -in xxx.cer -out xxx.pem
[root@localhost ~]# cat xxx.pem >>/etc/openldap/certs/xxx.pem

四、修改ldap.conf配置

[root@localhost ~]# vim /etc/openldap/ldap.conf
#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE   dc=example,dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never

TLS_CACERTDIR   /etc/openldap/certs
TLS_CACERT /etc/openldap/certs/xxxx.pem //配置openldap中证书的路径
# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON    on

4、最后测试

一、重启httpd服务，并设置开机自启

[root@localhost ~]# systemctl restart httpd
[root@localhost ~]# systemctl enable httpd

二、验证

5、通常问题

一、没法链接LDAP
①检查配置的LDAP帐号是否有权限、帐号密码是否正确；②AD域636端口是否打开；③证书是否有效，颁发者是否被信任；④openldap配置是否正确

二、提示修改为功后，AD域用户密码并无修改

①、检查是否配置ldaps 636而非 ldap 389；②检查配置文件 $who_change_password 和$who_change_sshkey 这两个参数；

三、找不到错误日志

①日志功能是否打开；②错误日志通常在httpd或apache日志的错误日志下，取决于你用那个软件来提供web服务；