164 lines
4.5 KiB
Bash
Executable File
164 lines
4.5 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Funktion zum Konfigurieren des 389 Directory Servers
|
|
configure_389_ds() {
|
|
local domain="$1"
|
|
local admin_password="$2"
|
|
local ldap_password="$3"
|
|
local fqdn="$(hostname --fqdn)"
|
|
|
|
cat <<EOL | sudo tee /tmp/ds_setup.inf
|
|
[General]
|
|
FullMachineName = $fqdn
|
|
SuiteSpotUserID = nobody
|
|
SuiteSpotGroup = nobody
|
|
AdminDomain = $domain
|
|
|
|
[slapd]
|
|
ServerPort = 389
|
|
ServerIdentifier = ldap
|
|
Suffix = dc=$(echo $domain | sed 's/\./,dc=/g')
|
|
RootDN = cn=Directory Manager
|
|
RootDNPwd = $admin_password
|
|
EOL
|
|
|
|
sudo dscreate from-file /tmp/ds_setup.inf
|
|
sudo rm /tmp/ds_setup.inf
|
|
}
|
|
|
|
# Funktion zum Konfigurieren von LDAPS mit vorhandenen Zertifikaten und Schlüsseln
|
|
configure_ldaps() {
|
|
local cert_path="/etc/ssl/certs"
|
|
local key_path="/etc/ssl/private"
|
|
local fqdn="$(hostname --fqdn)"
|
|
local cert_name="CERT_${fqdn//./_}.cer"
|
|
local key_name="KEY_${fqdn//./_}.pem"
|
|
|
|
# Annahme: Die Zertifikats- und Schlüsseldateien sind bereits vorhanden
|
|
# und müssen nur in die richtigen Pfade verschoben/verlinkt werden
|
|
sudo cp /path/to/existing_certificates/"$cert_name" "$cert_path/$cert_name"
|
|
sudo cp /path/to/existing_certificates/"$key_name" "$key_path/$key_name"
|
|
|
|
sudo dsconf -D "cn=Directory Manager" ldap:/// config replace nsslapd-security=on
|
|
sudo dsconf -D "cn=Directory Manager" ldap:/// config replace nsslapd-ldaps-port=636
|
|
sudo dsconf -D "cn=Directory Manager" ldap:/// tls set --cacertdir="$cert_path" --server-cert="$cert_name" --server-key="$key_name"
|
|
sudo systemctl restart dirsrv@ldap
|
|
}
|
|
|
|
# Funktion zum Konfigurieren von BIND mit DLZ
|
|
configure_bind_dlz() {
|
|
local domain="$1"
|
|
local fqdn="$(hostname --fqdn)"
|
|
|
|
cat <<EOL | sudo tee /etc/named/dlz-ldap.conf
|
|
uri ldaps://127.0.0.1:636
|
|
base "cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')"
|
|
auth_method sasl
|
|
sasl_mech EXTERNAL
|
|
EOL
|
|
|
|
cat <<EOL | sudo tee /etc/named.conf
|
|
options {
|
|
listen-on port 53 { any; };
|
|
directory "/var/named";
|
|
dump-file "/var/named/data/cache_dump.db";
|
|
statistics-file "/var/named/data/named_stats.txt";
|
|
memstatistics-file "/var/named/data/named_mem_stats.txt";
|
|
allow-query { any; };
|
|
recursion yes;
|
|
};
|
|
|
|
include "/etc/named/dlz-ldap.conf";
|
|
|
|
dlz "ldap zone" {
|
|
database "ldap ldaps://127.0.0.1:636/dc=$(echo $domain | sed 's/\./,dc=/g')?relativeDomainName?sub?(objectClass=dnsZone)";
|
|
};
|
|
EOL
|
|
|
|
sudo systemctl restart named
|
|
sudo systemctl enable named
|
|
}
|
|
|
|
# Funktion zum Hinzufügen der DNS-Zonen in LDAP
|
|
add_dns_zones() {
|
|
local domain="$1"
|
|
local ldap_password="$2"
|
|
local fqdn="$(hostname --fqdn)"
|
|
local ip_address="$(hostname -I | awk '{print $1}')"
|
|
|
|
cat <<EOL | ldapadd -H ldaps://127.0.0.1:636 -x -D "cn=Directory Manager" -w "$ldap_password"
|
|
dn: dc=$(echo $domain | sed 's/\./,dc=/g')
|
|
objectClass: top
|
|
objectClass: domain
|
|
dc: $(echo $domain | cut -d'.' -f1)
|
|
|
|
dn: cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')
|
|
objectClass: top
|
|
objectClass: nsContainer
|
|
cn: dns
|
|
|
|
dn: ou=bind,dc=$(echo $domain | sed 's/\./,dc=/g')
|
|
objectClass: top
|
|
objectClass: organizationalUnit
|
|
ou: bind
|
|
|
|
dn: relativeDomainName=@,zoneName=$domain,cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')
|
|
objectClass: top
|
|
objectClass: dNSZone
|
|
relativeDomainName: @
|
|
zoneName: $domain
|
|
dNSClass: IN
|
|
dNSTTL: 3600
|
|
nSRecord: ns.$domain.
|
|
|
|
dn: relativeDomainName=ns,zoneName=$domain,cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')
|
|
objectClass: top
|
|
objectClass: dNSZone
|
|
relativeDomainName: ns
|
|
zoneName: $domain
|
|
dNSClass: IN
|
|
dNSTTL: 3600
|
|
aRecord: $ip_address
|
|
|
|
dn: relativeDomainName=$fqdn,zoneName=$domain,cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')
|
|
objectClass: top
|
|
objectClass: dNSZone
|
|
relativeDomainName: $fqdn
|
|
zoneName: $domain
|
|
dNSClass: IN
|
|
dNSTTL: 3600
|
|
aRecord: $ip_address
|
|
EOL
|
|
}
|
|
|
|
# Funktion zum Aktualisieren der /etc/hosts-Datei
|
|
update_hosts_file() {
|
|
local domain="$1"
|
|
local fqdn="$(hostname --fqdn)"
|
|
local ip_address="$(hostname -I | awk '{print $1}')"
|
|
|
|
sudo sed -i "/$fqdn/d" /etc/hosts
|
|
echo "$ip_address $fqdn $domain" | sudo tee -a /etc/hosts > /dev/null
|
|
}
|
|
|
|
# Funktion zum Einlesen von Benutzereingaben
|
|
read_input() {
|
|
read -p "$1: " value
|
|
echo "$value"
|
|
}
|
|
|
|
# Hauptfunktion zum Ausführen des Skripts
|
|
main() {
|
|
local domain="$(hostname --domain)"
|
|
local admin_password="$(read_input "Admin password")"
|
|
local ldap_password="$(read_input "LDAP password")"
|
|
|
|
configure_389_ds "$domain" "$admin_password" "$ldap_password"
|
|
configure_ldaps
|
|
configure_bind_dlz "$domain"
|
|
add_dns_zones "$domain" "$ldap_password"
|
|
update_hosts_file "$domain"
|
|
}
|
|
|
|
# Hauptprogramm starten
|
|
main |