当我使用
ldapsearch -LLLZZ -H ldap://centos7s.domen.lan -x 我得到了一切：
dn: dc=domen,dc=lan objectClass: domain dc: domen o: domen.lan organization description: The Domen Company dn: ou=users,dc=domen,dc=lan ou: users objectClass: top objectClass: organizationalUnit dn: ou=groups,dc=domen,dc=lan ou: groups objectClass: top objectClass: organizationalUnit dn: uid=ldapuser1,ou=users,dc=domen,dc=lan uid: ldapuser1 cn: ldapuser1 sn: ldapuser1 mail: [email protected] objectClass: person objectClass: organizationalPerson....
但是
ldapsearch -ZZWD cn=manager,dc=domen,dc=lan -b cn=config -h centos7s.domen.lan
我什么也没得到：
Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 3 result: 32 No such object # numResponses: 1
我做错了什么？ 这个search有什么区别？
原来我有：
ldapsearch -LLLY EXTERNAL -H ldapi:/// -b cn=config '(olcAccess=*)' olcAccess olcSuffix
–
SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: olcDatabase={0}config,cn=config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth" manage by * none dn: olcDatabase={1}monitor,cn=config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth" read by dn.base="cn=manager,dc=domen,dc=lan" read by * none
现在，改变之后：
SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: olcDatabase={0}config,cn=config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth" manage by * none dn: olcDatabase={1}monitor,cn=config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth" read by dn.base="cn=manager,dc=domen,dc=lan" read by * none dn: olcDatabase={2}hdb,cn=config olcSuffix: dc=domen,dc=lan olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=manager,dc=do men,dc=lan" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=manager,dc=domen,dc=lan" write by * read
还是和上面的结果一样，第二个ldapsearch什么也没有返回。
这两个search有不同的search基础。 检查您的ACL以获取更多信息。
我所知道的一切都是这样的：
anonymous访问dc=domen,dc=lan子树。 cn=manager,dc=domen,dc=lan不能访问cn=config子树。