Let's Share

Tuesday, October 14, 2014

Membuat Lokal Repository HTTP di Centos 6.4/RHEL 6.4

Kalo sering pake linux pasti udah pada sering dong pake command yum?

Gak perlu dijelasin dong yah apa itu yum, yang jelas command ini berguna banged buat instalasi paket2 di linux dengan segala dependensi rpm nya yang ngejelimet.

Alasan nulis tutorial ini :
- Catetan Pribadi
- Sharing Knowledge

Keuntungan membuat repository lokal :
- Lebih cepat karna paket2 ada di lokal server/network anda sendiri
- Bisa digunakan apabila server anda tidak terkoneksi ke internet.

Langsung aja begini cara membuat lokal repository yum menggunakan protokol HTTP.

[PREREQUIREMENT/NOTES]
- Dalam tutorial ini status iptables saya adalah mati, untuk matiinnya gunakan command /etc/init.d/iptables stop
- Status selinux saya juga disabled, untuk mengeceknya gunakan command getenforce. Untuk disabled gunakan command setenforce 0. Untuk disabled persistent edit file /etc/selinux/config
- IP Address yang digunakan 192.168.99.103

1) Download ISO Centos 6.4
Anda bisa langsung aja cekidot URL http://kambing.ui.ac.id/iso/centos/6.4/isos/x86_64/CentOS-6.4-x86_64-bin-DVD1.iso

[NOTES] :
Apabila server anda terkoneksi dengan internet bisa langsung menggunakan command dibawah ini.
wget http://kambing.ui.ac.id/iso/centos/6.4/isos/x86_64/CentOS-6.4-x86_64-bin-DVD1.iso

2) Upload ISO ke server yang ingin dijadikan Repository Lokal anda. Pada contoh ini saya upload ke direktory /home/student/iso

[root@ip-local-private iso]# ll /home/student/iso/
total 11737924
-rw-rw-r-- 1 student student 6942410752 Oct 14 21:57 CentOS-6.4-x86_64-bin-DVD1.iso
drwxrwxr-x 14 student student 4096 Oct 13 20:28 vcenter
-rw-rw-r-- 1 student student 2997100544 Oct 13 20:24 win2008-r2-x64.iso
-rw-rw-r-- 1 student student 4283871232 Oct 14 21:05 WindowsServer2012R2.ISO

3) Buat direktori untuk mount ISO yang telah di download.
[root@ip-local-private ~]# mkdir /mnt/iso
[root@ip-local-private iso]# mount -o loop CentOS-6.4-x86_64-bin-DVD1.iso /mnt/iso/

Cek direktori /mnt/iso apakah sudah termounting terutama direktori Packages
[root@ip-local-private ~]# ll -h /mnt/iso/
total 676K
-r--r--r-- 2 root root 14 Mar 6 2013 CentOS_BuildTag
dr-xr-xr-x 3 root root 2.0K Mar 5 2013 EFI
-r--r--r-- 2 root root 212 Mar 3 2013 EULA
-r--r--r-- 2 root root 18K Mar 3 2013 GPL
dr-xr-xr-x 3 root root 2.0K Mar 5 2013 images
dr-xr-xr-x 2 root root 2.0K Mar 5 2013 isolinux
dr-xr-xr-x 2 root root 634K Mar 6 2013 Packages
-r--r--r-- 2 root root 1.4K Mar 3 2013 RELEASE-NOTES-en-US.html
dr-xr-xr-x 2 root root 4.0K Mar 6 2013 repodata
-r--r--r-- 2 root root 1.7K Mar 3 2013 RPM-GPG-KEY-CentOS-6
-r--r--r-- 2 root root 1.7K Mar 3 2013 RPM-GPG-KEY-CentOS-Debug-6
-r--r--r-- 2 root root 1.7K Mar 3 2013 RPM-GPG-KEY-CentOS-Security-6
-r--r--r-- 2 root root 1.7K Mar 3 2013 RPM-GPG-KEY-CentOS-Testing-6
-r--r--r-- 1 root root 3.4K Mar 6 2013 TRANS.TBL

Keliatan diatas terlihat bahwa ISO sukses dimounting dan sudah ada direktori Packages.

4) Install HTTP buat direktory repo lalu create direktori tersebut sebagai repo anda.

[root@ip-local-private ~]# yum install httpd -y

- Matikan IPTABLES <Dianjurkan apabila anda belum paham benar iptables linux>
[root@ip-local-private ~]# /etc/init.d/iptables stop

- Buat direktori repo didalam /var/www/html
[root@ip-local-private ~]# mkdir /var/www/html/repo

- Copy file dari /mnt/iso/Packages ke /var/www/html/repo
[root@ip-local-private ~]# cp /mnt/iso/Packages/* /var/www/html/repo/

- Install Packages Createrepo
[root@ip-local-private ~]# cd /var/www/html/repo/
[root@ip-local-private repo]# rpm -ivh createrepo-0.9.9-17.el6.noarch.rpm
[root@ip-local-private repo]# cd

- Build direktori /var/www/html/repo sebagai repository baru anda dengan command createrepo
[root@ip-local-private ~]# createrepo -v /var/www/html/repo/

- Buat persistent service httpd anda lalu start/restart service httpd.
[root@ip-local-private ~]# chkconfig httpd on
[root@ip-local-private ~]# /etc/init.d/httpd start

5) Pointing Repository
Setelah semua proses diatas, selesai anda harus melakukan pointing repository anda ke server yang telah dijadikan repository lokal ini. Hal ini dilakukan agar command yum yang digunakan akan mencari paket2 yang ada dari server yang telah anda build menjadi repository lokal ini.

a) Hapus/Backup semua file yang ada di /etc/yum.repos.d/
- Untuk hapus gunakan command
[root@ip-local-private ~]# rm /etc/yum.repos.d/*

- Untuk backup gunakan command mv sebagai contoh.
[root@ip-local-private ~]# mv /etc/yum.repos.d/epel.repo /etc/yum.repos.d/epel.repo.bak

b) Buat pointing file repo
[root@ip-local-private ~]# vim /etc/yum.repos.d/lokal.repo

#Lalu tulis dengan parameter dibawah ini

[lokal]
name=lokal
baseurl=http://192.168.99.103/repo/
enabled=1
gpgcheck=0

#Save Lalu Quit

c) Clean repo lalu listing repo
[root@ip-local-private ~]# yum clean all
[root@ip-local-private yum.repos.d]# yum repolist
Loaded plugins: product-id, refresh-packagekit, security, subscription-manager, versionlock
This system is not registered to Red Hat Subscription Management. You can use subscription- manager to register.
lokal | 2.9 kB 00:00
repo id repo name status
lokal lokal 3958
repolist: 3958

Selesai.
Gimana gampang kan?

Se

Sunday, October 12, 2014

Instalasi Zabbix Monitoring Server Versi 2.4.1 di Centos 6.4

Notes ini dibuat gak cuma buat sekedar di share, tapi biar inget juga kalo next time disuruh install beginian lagi hehe.

Silahkan di cekidot yah, langkah2 instalasinya adalah sebagai berikut :

Pre-Requirement :

Sebelum melakukan instalasi source packagesnya, zabbix membutuhkan paket2 yang harus di install agar bisa berjalan.

- Install Database MySQL Server dan Zabbix database

1) yum install mysql-server -y

2) /etc/init.d/mysqld start

3) chkconfig mysqld on

4) mysql_secure_installation (Optional untuk mengamankan db anda)

Setelah selesai buat database zabbix di dalam mysql menggunakan command dibawah ini :

# mysql -uroot -p<passwordrootdbanda>

mysql> create database zabbix character set utf8 collate utf8_bin;

mysql> grant all privileges on zabbix.* to zabbix@localhost identified by 'zabbix';

mysql> exit

- Buat User Zabbix dan Group Zabbix sebagai root
# groupadd zabbix
# useradd -g zabbix zabbix

- Copy bin file "zabbix_server" dan "zabbix_agentd" ke /etc/init.d/
# cd /root/zabbix-2.4.1/misc/init.d/fedora/core5
# cp zabbix* /etc/init.d/

Note :
* Direktori fedora custom, liat distronya kalo debian gunakan binary file yang ada di direktori debian dst.

- Install Fronted Requirement

1) yum install httpd php gd php-bcmath php-ctype php-xml php-xmlreader php-xmlwriter php-session php-sockets php-mbstring php-gettext libxml2 php-gd php-mysql -y

2) yum install zlib-devel mysql-devel glibc-devel curl-devel gcc automake mysql libidn-devel openssl-devel net-snmp-devel rpm-devel OpenIPMI-devel -y

- Install Zabbix Source & Web Frontend

Instalasi zabbix ada dua cara bisa dari packages(menggunakan repo zabbix) bisa dari sourcenya.

Pada contoh ini saya akan share menggunakan source zabbix version 2.4.1 yang bisa di download di http://www.zabbix.com/download.php lalu download zabbix source versi 2.4.1

Setelah di download, upload ke server yg ingin di install zabbix. Lanjutkan langkah dibawah ini :

1) Install Tabel Zabbix ke dalam database
Extract zabbix sourcenya lalu masuk ke direktori template MySQL.
[root@zabbix ~]# tar -xvzf zabbix-2.4.1.tar.gz
[root@zabbix ~]# cd zabbix-2.4.1/database/mysql

Insert tabel template zabbix ke database zabbix yang telah dibuat.

[root@zabbix ~]# mysql -uroot -p<passworddbanda> zabbix < schema.sql

[root@zabbix ~]# mysql -uroot -p<passworddbanda> zabbix < images.sql

[root@zabbix ~]# mysql -uroot -p<passworddbanda> zabbix < data.sql

2) Instalasi Paket2 Zabbix

[root@zabbix ~]# cd zabbix-2.4.1

[root@zabbix zabbix-2.4.1]# ./configure --enable-server --enable-agent --with-mysql --enable-ipv6 --with-net-snmp --with-libcurl--with-png-dir --with-jpeg-dir --with-freetype-dir

[root@zabbix zabbix-2.4.1]# make install

3) Edit Config File

[root@zabbix ~]# vim /usr/local/etc/zabbix_server.conf

edit bagian2 dibawah ini :

DBName=zabbix

DBUser=zabbix

DBPassword=zabbix

4) Jalankan daemon dan pastikan daemon berjalan dengan command ps -ef | grep zabbix

[root@zabbix etc]# zabbix_server

[root@zabbix etc]# zabbix_agentd

5) Install Zabbix Web Interface

[root@zabbix ~]# cd zabbix-2.4.1

[root@zabbix zabbix-2.4.1]# cp -r frontends/php/ /var/www/html/

[root@zabbix zabbix-2.4.1]# mv /var/www/html/php/ /var/www/html/zabbix

[NOTES] :

Untuk zabbix versi 2.4.1 ini anda harus melakukan tuning di php.ini agar instalasi frontend dapat dilakukan. Langkahnya adalah dibawah ini :

[root@zabbix ~]# vim /etc/php.ini

Lalu edit parameter dibawah ini :

post_max_size = 16M

max_execution_time = 300

max_input_time = 300

date.timezone = Asia/Jakarta

Lalu jangan lupa jalankan service httpd-nya :

[root@zabbix zabbix-2.4.1]# /etc/init.d/httpd start

Setelah itu finishing instalasi zabbix frontend dengan mengakses URL http://<server_ip>/zabbix

Installasi frontend

Step 1

Setelah mengakses URL anda akan melihat screen dari frontend installation wizard.

Step 2

Pastikan pre-requisites dibawah ini terpenuhi (Syarat dibawah inilah yg menjadi alasan kenapa kita melakukan tuning php di /etc/php.ini pada langkah sebelumnya).

Step 3

Menghubungkan zabbix ke database, masukan parameter sesuai dengan proses instalasi database pada langkah sebelumnya.

Step 4

Masukan zabbix server details (opsi dibawah adalah default dan optional)

Step 5

Review a summary of settings.

Step 6

Download configuration file dan tempatkan pada direktori /var/www/html/zabbix/conf.

Step 7

Finish.

Step 8

Zabbix frontend sudah selesai di install, default user name adalah Admin, password zabbix.

Gimana gampang kan?

Selamat mencoba yah ^^

Wednesday, October 8, 2014

HTTP Load Balancer menggunakan HAPROXY di CENTOS 6.4/RHEL 6.4

Kira2 skenarionya seperti dibawah.

Note :

- Pastikan masing2 server terhubung ke internet yah.

- Percobaan dibawah ini dengan keadaan iptables dan selinux dalam keadaan off.

- Untuk yang menggunakan redhat, repository bisa jg diarahkan menggunakan repo centos agar bisa menginstall haproxy

Topologinya kira2 seperti di bawah ini.

Summary Topologi :

LB-Haproxy = Load Balancer (misal IP Address 192.168.99.20)
Web1 = Webserver1 (misal IP Address 192.168.99.21)
Web2 = Webserver2 (misal IP Address 192.168.99.22)
User = Terserah yang penting dalam range area network 192.168.99.0/24

1. Instalasi di LB-Haproxy ( IP Address - 192.168.99.20 ) :

- yum install haproxy
- vim /etc/haproxy/haproxy.cfg
tambahin konfigurasi ini di paling bawah.

#[HTTP Site Configuration]
listen     http_web 192.168.99.20:80
    mode http
balance roundrobin
    option httpchk
    option forwardfor
    server web1 192.168.99.21:80 weight 1 maxconn 512 check
    server web2 192.168.99.22:80 weight 1 maxconn 512 check

- /etc/init.d/haproxy start
- chkconfig haproxy on

Note :
- Yang listen http_web 192.168.99.20:80 itu IP server LB kamu.
- server web1 192.168.99.21:80 weight 1 maxconn 512 check dan server web1 192.168.99.22:80 weight 1 maxconn 512 check IP webserver kamu.
- Di server LB ini jangan kamu install httpd karna nanti konflik sebab dia listen port 80 juga.

2. Instalasi Web1 (IP Address - 192.168.99.21) :

- yum install httpd
- vim /var/www/html/index.html
tambahin file ini :
<!DOCTYPE html>
<html>
<body>

<h1>This is WEB1</h1>

</body>
</html>

- /etc/init.d/httpd start
- chkconfig httpd on

3. Instalasi Web2 (IP Address - 192.168.99.22) :
- yum install httpd
- vim /var/www/html/index.html
tambahin file ini :
<!DOCTYPE html>
<html>
<body>

<h1>This is WEB2</h1>

</body>
</html>

- /etc/init.d/httpd start
- chkconfig httpd on

CARA NGETES :
Buka web browser, trus masukin IPAddress LB nya. Kalo dari contoh aku pake ip 192.168.99.20.
Outputnya pasti antara 2 :

This is web1

atau

This is web2

Tutorial HTTP Load Balancer dengan NGINX/EngineX di Centos 6.4

Udah lama gak nulis lagi, banyak kerjaan haha.

Langsung aja kali ini bakal ngeshare gimana caranya ngebuat Load Balancer HTTP menggunakan EngineX/Nginx Web Server di Centos.

Kira2 topologinya seperti ini, terdiri dari 3 server yaitu :

- Server EngineX/Nginx ( IP Address 192.168.99.23 )

- Web1 ( IP Address 192.168.99.21 )

- Web2 ( IP Address 192.168.99.22 )

Note :

- Pastikan masing2 server terhubung ke internet yah.

- Percobaan dibawah ini dengan keadaan iptables dan selinux dalam keadaan off.

1. Install Paket Nginx di server 192.168.99.23

vim /etc/yum.repos.d/nginx.repo
tambahkan wording dibawah ini

[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=0
enabled=1

Lalu jalankan command yum install nginx sebagai root.

Edit file /etc/nginx/conf.d/default.conf

Lalu tambahkan konfigurasi seperti dibawah ini :

upstream web {

server 192.168.99.21;

server 192.168.99.22;

}

server {

listen 80; # Listen on the external interface

server_name 192.168.99.23;

location / {

proxy_pass http://web;

}

Jalankan command /etc/init.d/nginx start dan chkconfig nginx on

2. Install Paket Apache di server 192.168.99.21 dan 192.168.99.22

Instalasi Web1 (webserver1 - 192.168.99.21) :

- yum install httpd
- vim /var/www/html/index.html

Tambahin file ini :

<!DOCTYPE html>
<html>
<body>

<h1>This is WEB1</h1>

</body>
</html>

- /etc/init.d/httpd start
- chkconfig httpd on

Instalasi Web2 (webserver2 - 192.168.99.22) :

- yum install httpd
- vim /var/www/html/index.html
tambahin file ini :
<!DOCTYPE html>
<html>
<body>

<h1>This is WEB2</h1>

</body>
</html>

- /etc/init.d/httpd start
- chkconfig httpd on

3. Cara Ngetes

Buka web browser, trus masukin IPAddress LB nya. Kalo dari contoh di sini menggunakan ip 192.168.99.23.

Outputnya pasti antara 2 :
This is web1
atau
This is web2

Thursday, May 22, 2014

Membuat DNS Server (MASTER RECORD-BIND / RHEL 6.4 / CENTOS 6.4)

Preparation RHCE

Sekali lagi biar gak lupa. hehe

1) yum install bind bind-utils

2) Edit /etc/named.conf lalu ganti bagian yg di bold, menjadi seperti dibawah ini :

options {
listen-on port 53 { any; };
listen-on-v6 port 53 { any; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion yes;

dnssec-enable yes;
dnssec-validation no;
dnssec-lookaside auto;

/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";

managed-keys-directory "/var/named/dynamic";
};

3) masih di /etc/named.conf tambahin ini

zone "example.com" IN {
type master;
file "example.com.zone";
allow-update { none; };
};

4) lalu buat file example.com.zone di /var/named

# vim /var/named/example.com.zone

[root@rhce1 ~]# cat /var/named/example.com.zone
$TTL 86400
@ IN SOA ns1.example.com. root.example.com. (
2013042201 ;Serial
3600 ;Refresh
1800 ;Retry
604800 ;Expire
86400 ;Minimum TTL
)
; Specify our two nameservers
IN NS ns1.example.com.
IN MX 10 mail.example.com.
; Resolve nameserver hostnames to IP, replace with your two droplet IP addresses.
ns1 IN A 192.168.122.22
rhce1 IN A 192.168.122.22
rhce2 IN A 192.168.123.22
rhce3 IN A 192.168.124.22
;IN MX 10 mail.example.com.

; Define hostname -> IP pairs which you wish to resolve
@ IN A 192.168.122.22
www IN A 192.168.122.22

5) Start service

# /etc/init.d/named start

6) Verivikasi dengan command host -al example.com, dimana example.com itu optional tergantung domain yg sebelumnya dibuat

NOTE : Sebelum verifikasi, jangan lupa /etc/resolve.conf nya ditembak ke arah IP Address dimana file konfigurasi dns master ini disetting. Misal kalo di case ini, pake ip 192.168.122.22

#vim /etc/resolve.conf

nameserver 192.168.122.22

lalu gunakan command dibawah ini untuk vervikasi

[root@rhce1 ~]# host -al example.com

Trying "example.com"

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36348

;; flags: qr aa ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:

;example.com. IN AXFR

;; ANSWER SECTION:

example.com. 86400 IN SOA ns1.example.com. root.example.com. 2013042201 3600 1800 604800 86400

example.com. 86400 IN NS ns1.example.com.

example.com. 86400 IN NS rhce1.example.com.

example.com. 86400 IN NS rhce2.example.com.

example.com. 86400 IN NS rhce3.example.com.

example.com. 86400 IN MX 10 mail.example.com.

example.com. 86400 IN A 192.168.122.22

ns1.example.com. 86400 IN A 192.168.122.22

rhce1.example.com. 86400 IN A 192.168.122.22

rhce2.example.com. 86400 IN A 192.168.123.22

rhce3.example.com. 86400 IN A 192.168.124.22

www.example.com. 86400 IN A 192.168.122.22

example.com. 86400 IN SOA ns1.example.com. root.example.com. 2013042201 3600 1800 604800 86400

Received 305 bytes from 192.168.122.22#53 in 1 ms

Done. ^^

Friday, May 16, 2014

MEMBUAT LDAP SERVER DENGAN OPEN-LDAP ( CENTOS 6.4 / RHEL 6.4 )

Biar gak lupa di tulis di blog hehe..

1) Step pertama install OPEN-LDAP-nya dengan command dibawah ini, dengan catetan udah konek ke repository lokal atau publik yah gan hehe :

[root@ldap1 ~]# yum install openldap openldap-servers openldap-clients -y

2) Copy contoh file dari konfigurasi ldapnya bernama slapd.conf ke /etc/openldap/

[root@ldap1 ~]# cp /usr/share/openldap-servers/slapd.conf.obsolete /etc/openldap/slapd.conf

3) Generate password untuk rootdn yg dipake oleh si /etc/openldap/slapd.conf

[root@ldap1 ~]# slappasswd
New password:
Re-enter new password:
{SSHA}GtG8bcLGeN/rf1iStKFK2pu0C2EZf/RX

4) Copy password yg sudah di generate lalu edit file /etc/openldap/slapd.conf
note : edit yg di highlited merah

[root@ldap1 ~]# vim /etc/openldap/slapd.conf
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include         /etc/openldap/schema/corba.schema
include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/duaconf.schema
include         /etc/openldap/schema/dyngroup.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/java.schema
include         /etc/openldap/schema/misc.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/openldap.schema
include         /etc/openldap/schema/ppolicy.schema
include         /etc/openldap/schema/collective.schema

# Allow LDAPv2 client connections. This is NOT the default.
allow bind_v2

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral       ldap://root.openldap.org

pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args

# Load dynamic backend modules
# - modulepath is architecture dependent value (32/64-bit system)
# - back_sql.la overlay requires openldap-server-sql package
# - dyngroup.la and dynlist.la cannot be used at the same time

# modulepath /usr/lib/openldap
# modulepath /usr/lib64/openldap

# moduleload accesslog.la
# moduleload auditlog.la
# moduleload back_sql.la
# moduleload chain.la
# moduleload collect.la
# moduleload constraint.la
# moduleload dds.la
# moduleload deref.la
# moduleload dyngroup.la
# moduleload dynlist.la
# moduleload memberof.la
# moduleload pbind.la
# moduleload pcache.la
# moduleload ppolicy.la
# moduleload refint.la
# moduleload retcode.la
# moduleload rwm.la
# moduleload seqmod.la
# moduleload smbk5pwd.la
# moduleload sssvlv.la
# moduleload syncprov.la
# moduleload translucent.la
# moduleload unique.la
# moduleload valsort.la

# The next three lines allow use of TLS for encrypting connections using a
# dummy test certificate which you can generate by running
# /usr/libexec/openldap/generate-server-cert.sh. Your client software may balk
# at self-signed certificates, however.
#TLSCACertificatePath /etc/openldap/certs
#TLSCertificateFile "\"OpenLDAP Server\""
#TLSCertificateKeyFile /etc/openldap/certs/password

# Sample security restrictions
#       Require integrity protection (prevent hijacking)
#       Require 112-bit (3DES or better) encryption for updates
#       Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#       Root DSE: allow anyone to read it
#       Subschema (sub)entry DSE: allow anyone to read it
#       Other DSEs:
#               Allow self write access
#               Allow authenticated users read access
#               Allow anonymous users to authenticate
#       Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#       by self write
#       by users read
#       by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

# enable on-the-fly configuration (cn=config)
database config
access to *
        by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
        by * none

# enable server status monitoring (cn=monitor)
database monitor
access to *
        by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
        by dn.exact="cn=Manager,dc=example,dc=com" read
        by * none

#######################################################################
# database definitions
#######################################################################

database        bdb
suffix          "dc=example,dc=com"
checkpoint      1024 15
rootdn          "cn=Manager,dc=example,dc=com"
rootpw          {SSHA}GtG8bcLGeN/rf1iStKFK2pu0C2EZf/RX
loglevel        256
sizelimit       unlimited
# Cleartext passwords, especially for the rootdn, should
# be avoided. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw                secret
# rootpw                {crypt}ijFYNcSNctBYg

# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory       /var/lib/ldap

# Indices to maintain for this database
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub

# Replicas of this database
#replogfile /var/lib/ldap/openldap-master-replog
#replica host=ldap-1.example.com:389 starttls=critical
#     bindmethod=sasl saslmech=GSSAPI
#     authcId=host/ldap-master.example.com@EXAMPLE.COM

5) Remove existing konfig LDAP sebelumnya (bila ada), lalu di re-inisialisasi :

[root@ldap1 ~]# rm -rf /var/lib/ldap/*
[root@ldap1 ~]# rm -rf /etc/openldap/slapd.d/*

6) Copy sample DB_CONFIG file ke /var/lib/ldap/
[root@ldap1 ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

7) Set permission di /var/lib/ldap/ dan /etc/openldap/slapd.d/ ownernya jadi milik user 'ldap'

[root@ldap1 ~]# chown -Rf ldap. /etc/openldap/slapd.d/
[root@ldap1 ~]# chown -Rf ldap. /var/lib/ldap/
[root@ldap1 ~]# chmod 700 /var/lib/ldap/
[root@ldap1 ~]# chmod 700 /etc/openldap/slapd.d/

8) Cek & ricek apakah ada error di file konfigurasi /etc/openldap/slapd.conf :
[root@ldap1 ~]# slaptest -u
config file testing succeeded

9) Convert file konfigurasi kedalam dinamik konfigurasi pada direktori /etc/openldap/slapd.d/
[root@ldap1 ~]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
config file testing succeeded

10) Start slapd daemon untuk nyalain open-ldapnya :

[root@ldap1 ~]# /etc/init.d/slapd start

11) Confirm dengan menggunakan command dibawah ini :

[root@ldap1 ~]# service slapd status
slapd (pid 1301) is running...[root@ldap1 ~]# netstat -ntlup | grep slapd
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 1301/slapd
tcp 0 0 :::389 :::* LISTEN 1301/slapd

[root@ldap1 ~]# ps -ef | grep slapd
ldap 1301 1 0 08:21 ? 00:00:00 /usr/sbin/slapd -h ldap:/// ldapi:/// -u ldap
root 1318 1208 0 08:23 pts/1 00:00:00 grep slapd

12) Apabila menggunakan iptables gunakan command dibawah ini :
[root@ldap1 ~]# netstat -ntlup | grep slapd
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 1402/slapd
tcp 0 0 :::389 :::* LISTEN 1402/slapd

[root@ldap1 ~]# iptables -I INPUT -p udp -s 192.168.124.0/24 --dport 389 -j ACCEPT
[root@ldap1 ~]# iptables -I INPUT -p tcp -s 192.168.124.0/24 --dport 389 -j ACCEPT
[root@ldap1 ~]# iptables -I INPUT -p udp -s 192.168.124.0/24 --dport 636 -j ACCEPT
[root@ldap1 ~]# iptables -I INPUT -p tcp -s 192.168.124.0/24 --dport 636 -j ACCEPT
[root@ldap1 ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]

13) Create base DIT (Directory Information Tree) file menggunakan file dibawah ini :
[root@ldap1 ~]# vim dit.ldif

#Lalu isi dengan dibawah ini :

# Creates a base for DIT
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectclass: organization
o: Example Organization
dc: Example
description: Example Inc DIT

# Creates a Users OU (Organizational Unit)
dn: ou=Users,dc=example,dc=com
objectClass: organizationalUnit
ou: Users

# Creates a Groups OU
dn: ou=Groups,dc=example,dc=com
objectClass: organizationalUnit
ou: Groups

dn: ou=Admins,dc=example,dc=com
objectClass: organizationalUnit
ou: Admins

# Create a user student1 with some basic info
dn: uid=student1,ou=Users,dc=example,dc=com
uid: student1
cn: student1
sn: 1
objectClass: top
objectClass: posixAccount
objectClass: inetOrgPerson
loginShell: /bin/bash
homeDirectory: /home/student1
uidNumber: 15000

gidNumber: 10000

userPassword: {SSHA}CQG5KHc6b1ii+qopaVCsNa14v9+r14r5

mail: student1@example.com

gecos: Student1 User

# Create a user student2 with some basic info
dn: uid=student2,ou=Users,dc=example,dc=com
uid: student2
cn: student2
sn: 2
objectClass: top
objectClass: posixAccount
objectClass: inetOrgPerson
loginShell: /bin/bash
homeDirectory: /home/student2
uidNumber: 15001
gidNumber: 10000
userPassword: {SSHA}CQG5KHc6b1ii+qopaVCsNa14v9+r14r5
mail: student2@example.com
gecos: Student2 User

# Creates a ldapusers group under Groups OU
dn: cn=ldapusers,ou=Groups,dc=example,dc=com
objectClass: posixGroup
objectClass: top
cn: ldapusers
userPassword: {crypt}x
gidNumber: 10000
memberuid: uid=student1
memberuid: uid=student2

14 ) Ubah file /etc/openldap/ldap.conf menjadi seperti dibawah ini :
[root@ldap1 ~]# vim /etc/openldap/ldap.conf
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
#BASE   dc=example,dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never

#TLS_CACERTDIR /etc/openldap/certs
ssl             start_tls
TLS_REQCERT     allow
BASE            dc=example,dc=com
URI             ldap://ldap.example.com #optional tergantung domain name anda
HOST            192.168.124.251 #optional tergantung ip address anda

15) Execute file dit.ldif dengan command dibawah ini :
[root@ldap1 ~]# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f dit.ldif -H ldaps://ldap1.example.com

LDAP Password: {masukan password yg tadi dibuat dgn command slappasswd}
adding new entry "dc=example,dc=com"

adding new entry "ou=Users,dc=example,dc=com"

adding new entry "ou=Groups,dc=example,dc=com"

adding new entry "uid=student1,ou=Users,dc=example,dc=com"

adding new entry "uid=student2,ou=Users,dc=example,dc=com"

adding new entry "cn=ldapusers,ou=Groups,dc=example,dc=com"

16 ) Verivikasi data yg dimasukan dari file dit.ldif tadi sudah ada di dalem ldap databasenya dengan command dibawah ini :
[root@ldap1 ~]# ldapsearch -x -b "dc=example,dc=com" -H ldap://ldap.example.com
# extended LDIF
#
# LDAPv3
# base <dc=example,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# example.com
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: Example Organization
dc: Example
description: Example Inc DIT

# Users, example.com
dn: ou=Users,dc=example,dc=com
objectClass: organizationalUnit
ou: Users

# Groups, example.com
dn: ou=Groups,dc=example,dc=com
objectClass: organizationalUnit
ou: Groups

# student1, Users, example.com
dn: uid=student1,ou=Users,dc=example,dc=com
uid: student1
cn: student1
sn: 1
objectClass: top
objectClass: posixAccount
objectClass: inetOrgPerson
loginShell: /bin/bash
homeDirectory: /home/student1
uidNumber: 14583100
gidNumber: 14564100
userPassword:: e1NTSEF9Q1FHNUtIYzZiMWlpK3FvcGFWQ3NOYTE0djkrcjE0cjU=
mail: student1@example.com
gecos: Student1 User

# student2, Users, example.com
dn: uid=student2,ou=Users,dc=example,dc=com
uid: student2
cn: student2
sn: 2
objectClass: top
objectClass: posixAccount
objectClass: inetOrgPerson
loginShell: /bin/bash
homeDirectory: /home/student2
uidNumber: 14583101
gidNumber: 14564100
userPassword:: e1NTSEF9Q1FHNUtIYzZiMWlpK3FvcGFWQ3NOYTE0djkrcjE0cjU=
mail: student2@example.com
gecos: Student2 User

# ldapusers, Groups, example.com
dn: cn=ldapusers,ou=Groups,dc=example,dc=com
objectClass: posixGroup
objectClass: top
cn: ldapusers
userPassword:: e2NyeXB0fXg=
gidNumber: 14564100
memberUid: uid=student1
memberUid: uid=student2

# search result
search: 2
result: 0 Success

# numResponses: 8
# numEntries:7

17) Membuat PHP-LDAP-ADMIN

Note: PHP-LDAP-ADMIN memudahkan kita dalam administrasi ldap database, menggunakan aplikasi ini kita gak perlu repot2 bikin pake dit.ldif seperti dilangkah ke 13.

*) Install phpldapadmin nya

[root@ldap1 ~]# yum install -y phpldapadmin

*) Edit file konfigurasi httpd nya dengan menambahkan wording ini dibaris paling bawah :

[root@ldap1 ~]# vim /etc/httpd/conf/http.conf

# Web-based tool for managing LDAP servers

Alias /phpldapadmin /usr/share/phpldapadmin/htdocs

Alias /ldapadmin /usr/share/phpldapadmin/htdocs

<Directory /usr/share/phpldapadmin/htdocs>

Order Deny,Allow

Deny from all

Allow from all

</Directory>

*) Restart httpd server

[root@ldap1 ~]# /etc/init.d/httpd restart

*) Buka ldap php adminnya dari web browser :

http://ldap_server_ip/ldapadmin

18) Agar bisa login dengan DN dari phpldapadmin, ubah parameter di /etc/phpldapadmin/config.php :

$servers->setValue('login','attr','uid');

menjadi

$servers->setValue('login','attr','dn');

lalu restart lagi httpd nya :

[root@ldap1 ~]# /etc/init.d/httpd restart

Selamat mencoba ^^