Securing and Optimizing Linux: RedHat Edition -A Hands on Guide | ||
---|---|---|
Prev | Chapter 26. Linux OpenLDAP Server | Next |
Move into the new OpenLDAP directory and type the following commands on your terminal:
It is important to note that you can configure three different kinds of backend databases with LDAP.
A high-performance, disk-based database called LDBM
A database interface to arbitrary UNIX commands or shell scripts calledd SHELL
A simple password file database named PASSWD
The default installation of OpenLDAP assumes an LDBM backend database, so if you want to configure another type of backend database, you must specify it during the configuration and compile time. For a SHELL backend database you must add the --enable-shell option and for a PASSWD backend database used as replacement for NIS service you must add the --enable-passwd option in your configuration lines.
CC="egcs" \ CFLAGS="-O9 -funroll-loops -ffast-math -malign-double -mcpu=pentiumpro -march=pentiumpro -fomit-frame-pointer -fno-exceptions -D_REENTRANT" \ ./configure \ --prefix=/usr \ --libexecdir=/usr/sbin \ --localstatedir=/var/run \ --sysconfdir=/etc \ --enable-dns \ --enable-shared \ --with-gnu-ld \ --disable-debug |
Enable dns support.
Build shared libraries.
Assume the C compiler uses GNU ld.
: The compile options above assume that you want to set up an LDBM backend database. For the other type of backend database, you must add the required option in your configuration lines above.
Now, we must compile and install OpenLDAP in the server:
[root@deep openldap-1.2.10]# make depend [root@deep openldap-1.2.10]# make [root@deep openldap-1.2.10]# cd tests/ [root@deep tests]# make [root@deep tests]# cd .. [root@deep openldap-1.2.10]# make install |
The make depend command will build and make the necessary dependencies for different files,
make compiles all source files into executable binaries,
make install installs the binaries and any supporting files into the appropriate locations.
The make command under /test subdirectory will do some important tests to verify the functionality of your LDAP server before the installation. If some tests fails, you'll need to fixes the problems before continuing the installation.
[root@deep openldap-1.2.10]# install -d -m 700 /var/ldap [root@deep openldap-1.2.10]# echo localhost > /etc/openldap/ldapserver [root@deep openldap-1.2.10]# strip /usr/lib/liblber.so.1.0.0 [root@deep openldap-1.2.10]# strip /usr/lib/libldap.so.1.0.0 [root@deep openldap-1.2.10]# strip /usr/lib/libldap.a [root@deep openldap-1.2.10]# strip /usr/lib/liblber.a [root@deep openldap-1.2.10]# strip /usr/sbin/in.xfingerd [root@deep openldap-1.2.10]# strip /usr/sbin/go500 [root@deep openldap-1.2.10]# strip /usr/sbin/go500gw [root@deep openldap-1.2.10]# strip /usr/sbin/mail500 [root@deep openldap-1.2.10]# strip /usr/sbin/rp500 [root@deep openldap-1.2.10]# strip /usr/sbin/rcpt500 [root@deep openldap-1.2.10]# strip /usr/sbin/fax500 [root@deep openldap-1.2.10]# strip /usr/sbin/slapd [root@deep openldap-1.2.10]# strip /usr/sbin/slurpd [root@deep openldap-1.2.10]# strip /usr/sbin/ldif [root@deep openldap-1.2.10]# strip /usr/sbin/ldif2ldbm [root@deep openldap-1.2.10]# strip /usr/sbin/ldif2index [root@deep openldap-1.2.10]# strip /usr/sbin/ldif2id2entry [root@deep openldap-1.2.10]# strip /usr/sbin/ldif2id2children [root@deep openldap-1.2.10]# strip /usr/sbin/ldbmcat [root@deep openldap-1.2.10]# strip /usr/sbin/ldbmtest [root@deep openldap-1.2.10]# strip /usr/sbin/centipede [root@deep openldap-1.2.10]# strip /usr/bin/ud [root@deep openldap-1.2.10]# strip /usr/bin/ldapadd [root@deep openldap-1.2.10]# strip /usr/bin/ldapsearch [root@deep openldap-1.2.10]# strip /usr/bin/ldapmodify [root@deep openldap-1.2.10]# strip /usr/bin/ldapmodrdn [root@deep openldap-1.2.10]# strip /usr/bin/ldappasswd [root@deep openldap-1.2.10]# strip /usr/bin/ldapdelete |
The install command above will create a new directory named ldap under /var directory and will set its mode to be readable, writable, and executable only by the super-user root, 700 for security reasons.
The strip command will discard all symbols from the object files. This means that our binary files will be smaller in size. This will improve the performance hit to the program since there will be fewer lines to be read by the system when it executes the binary.
Please don't forget to cleanup later:
[root@deep] /# cd /var/tmp [root@deep ]/tmp# rm -rf openldap-version/ openldap-version.tgz |