OpenLDAP生产架构及管理实战指南

OpenLDAP概述

什么是OpenLDAP

OpenLDAP是一个开源的轻量级目录访问协议(LDAP)实现，提供企业级目录服务：

OpenLDAP特性:
  协议支持: LDAP v2/v3, LDAPS, LDAPI
  数据库后端: LMDB, BDB, HDB, MDB
  复制机制: SyncRepl, Delta-SyncRepl, Multi-Master
  安全认证: TLS/SSL, SASL, Kerberos
  访问控制: 细粒度ACL权限控制
  可扩展性: 支持自定义Schema和Overlay

OpenLDAP核心组件

# OpenLDAP主要组件
核心组件:
  slapd: LDAP服务器守护进程
  slurpd: 复制守护进程(已弃用)
  slapcat: 数据导出工具
  slapadd: 数据导入工具
  ldapsearch: 搜索客户端工具
  ldapmodify: 数据修改工具
  ldapadd: 数据添加工具
  ldapdelete: 数据删除工具

生产环境架构设计

硬件资源规划

服务器配置建议

生产环境服务器规格:
  主服务器:
    CPU: 8核+ (推荐16核)
    内存: 16GB+ (推荐32GB)
    存储: SSD 500GB+ (数据库和日志)
    网络: 千兆网卡
    操作系统: CentOS 7/8, Ubuntu 18.04+

  从服务器:
    CPU: 4核+ (推荐8核)
    内存: 8GB+ (推荐16GB)
    存储: SSD 200GB+
    网络: 千兆网卡
    冗余: 至少2台从服务器

  负载均衡器:
    CPU: 4核
    内存: 8GB
    存储: SSD 100GB
    网络: 双网卡(主备)

网络架构设计

多层网络架构

# 网络分层设计
网络架构:
  DMZ区域:
    - 负载均衡器: 172.16.1.0/24
    - Web管理界面: 172.16.1.0/24

  内网区域:
    - LDAP服务器: 192.168.10.0/24
    - 数据库存储: 192.168.11.0/24

  管理网络:
    - 监控系统: 192.168.100.0/24
    - 备份网络: 192.168.101.0/24

防火墙规则:
  - 客户端 -> LB: 389, 636
  - LB -> LDAP: 389, 636
  - LDAP集群内部: 389, 636, 22
  - 管理网络: 22, 443, 161

OpenLDAP安装部署

基础环境准备

系统初始化脚本

#!/bin/bash
# OpenLDAP环境初始化脚本

# 设置主机名和hosts
hostnamelist="
192.168.10.11 ldap-master.company.com ldap-master
192.168.10.12 ldap-slave1.company.com ldap-slave1
192.168.10.13 ldap-slave2.company.com ldap-slave2
192.168.10.10 ldap-vip.company.com ldap-vip
"

echo "$hostnamelist" >> /etc/hosts

# 关闭SELinux和防火墙
setenforce 0
sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config
systemctl stop firewalld
systemctl disable firewalld

# 时间同步
yum install -y chrony
systemctl enable chronyd
systemctl start chronyd

# 安装必要软件包
yum update -y
yum install -y epel-release
yum install -y openldap openldap-servers openldap-clients
yum install -y openssl openssl-devel

OpenLDAP主服务器配置

主服务器安装配置

#!/bin/bash
# OpenLDAP主服务器配置脚本

# 生成管理员密码哈希
ADMIN_PASSWD=$(slappasswd -s "YourAdminPassword123!")

# 创建基础配置目录
mkdir -p /etc/openldap/slapd.d
chown -R ldap:ldap /etc/openldap/slapd.d

# 初始化配置数据库
rm -rf /etc/openldap/slapd.d/*
slapadd -n 0 -F /etc/openldap/slapd.d -l /etc/openldap/schema/core.ldif

# 创建基础DIT配置
cat > /tmp/base-config.ldif << EOF
dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/openldap/slapd.args
olcPidFile: /var/run/openldap/slapd.pid
olcTLSCACertificateFile: /etc/openldap/certs/ca-cert.pem
olcTLSCertificateFile: /etc/openldap/certs/server-cert.pem
olcTLSCertificateKeyFile: /etc/openldap/certs/server-key.pem

dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema

dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulepath: /usr/lib64/openldap
olcModuleload: back_mdb.la
olcModuleload: syncprov.la

dn: olcDatabase=config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: config
olcAccess: to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break
olcRootPW: $ADMIN_PASSWD

dn: olcDatabase=mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: mdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=company,dc=com
olcRootDN: cn=admin,dc=company,dc=com
olcRootPW: $ADMIN_PASSWD
olcDbIndex: objectClass eq
olcDbIndex: cn eq,sub
olcDbIndex: uid eq,sub
olcDbIndex: mail eq,sub
olcDbIndex: memberUid eq
olcDbMaxSize: 1073741824
olcAccess: to attrs=userPassword by self write by anonymous auth by * none
olcAccess: to * by dn.exact="cn=admin,dc=company,dc=com" write by * read
EOF

# 导入配置
slapadd -n 0 -F /etc/openldap/slapd.d -l /tmp/base-config.ldif

# 设置权限
chown -R ldap:ldap /etc/openldap/slapd.d
chown -R ldap:ldap /var/lib/ldap

# 启动服务
systemctl enable slapd
systemctl start slapd

echo "OpenLDAP主服务器配置完成"

证书配置

TLS/SSL证书生成

#!/bin/bash
# 生成OpenLDAP SSL证书

CERT_DIR="/etc/openldap/certs"
mkdir -p $CERT_DIR
cd $CERT_DIR

# 生成CA私钥
openssl genrsa -out ca-key.pem 4096

# 生成CA证书
openssl req -new -x509 -days 3650 -key ca-key.pem -out ca-cert.pem \
  -subj "/C=CN/ST=Beijing/L=Beijing/O=Company/OU=IT/CN=Company CA"

# 生成服务器私钥
openssl genrsa -out server-key.pem 4096

# 生成服务器证书请求
openssl req -new -key server-key.pem -out server-cert.csr \
  -subj "/C=CN/ST=Beijing/L=Beijing/O=Company/OU=IT/CN=ldap.company.com"

# 生成服务器证书
openssl x509 -req -days 365 -in server-cert.csr \
  -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial \
  -out server-cert.pem

# 设置权限
chown -R ldap:ldap $CERT_DIR
chmod 600 $CERT_DIR/*.pem

echo "SSL证书生成完成"

高可用集群配置

主从复制配置

SyncRepl配置

#!/bin/bash
# 配置SyncRepl主从复制

# 在主服务器上启用SyncProv模块
cat > /tmp/syncprov-master.ldif << EOF
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulepath: /usr/lib64/openldap
olcModuleload: syncprov.la

dn: olcOverlay=syncprov,olcDatabase={1}mdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
olcSpCheckpoint: 100 10
olcSpSessionlog: 1000
EOF

ldapadd -Y EXTERNAL -H ldapi:/// -f /tmp/syncprov-master.ldif

# 在从服务器上配置SyncRepl
cat > /tmp/syncrepl-slave.ldif << EOF
dn: olcDatabase={1}mdb,cn=config
changetype: modify
add: olcSyncRepl
olcSyncRepl: rid=001
  provider=ldap://ldap-master.company.com:389
  bindmethod=simple
  binddn="cn=admin,dc=company,dc=com"
  credentials="YourAdminPassword123!"
  searchbase="dc=company,dc=com"
  scope=sub
  schemachecking=on
  type=refreshAndPersist
  retry="30 5 300 3"
  interval=00:00:05:00
EOF

# 在从服务器执行
ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/syncrepl-slave.ldif

负载均衡配置

HAProxy配置

# /etc/haproxy/haproxy.cfg
global
    log         127.0.0.1:514 local0
    chroot      /var/lib/haproxy
    stats socket /var/lib/haproxy/stats
    user        haproxy
    group       haproxy
    daemon

defaults
    mode        tcp
    log         global
    option      tcplog
    option      dontlognull
    option      redispatch
    retries     3
    timeout connect  5000ms
    timeout client   50000ms
    timeout server   50000ms

# LDAP统计页面
listen stats
    bind *:8080
    stats enable
    stats uri /stats
    stats realm HAProxy\ Statistics
    stats auth admin:password

# LDAP服务负载均衡
frontend ldap_frontend
    bind *:389
    bind *:636 ssl crt /etc/ssl/certs/ldap.pem
    default_backend ldap_servers

backend ldap_servers
    balance roundrobin
    option tcp-check
    tcp-check connect port 389
    server ldap-master 192.168.10.11:389 check weight 100
    server ldap-slave1 192.168.10.12:389 check weight 50
    server ldap-slave2 192.168.10.13:389 check weight 50

# LDAPS服务负载均衡
frontend ldaps_frontend
    bind *:636 ssl crt /etc/ssl/certs/ldap.pem
    default_backend ldaps_servers

backend ldaps_servers
    balance roundrobin
    option ssl-hello-chk
    server ldap-master 192.168.10.11:636 check weight 100 ssl verify none
    server ldap-slave1 192.168.10.12:636 check weight 50 ssl verify none
    server ldap-slave2 192.168.10.13:636 check weight 50 ssl verify none

目录信息树(DIT)设计

基础DIT结构

组织架构设计

# 根条目
dn: dc=company,dc=com
objectClass: dcObject
objectClass: organization
dc: company
o: Company Ltd

# 用户组织单元
dn: ou=people,dc=company,dc=com
objectClass: organizationalUnit
ou: people
description: All users

# 组织架构
dn: ou=groups,dc=company,dc=com
objectClass: organizationalUnit
ou: groups
description: All groups

# 服务账户
dn: ou=services,dc=company,dc=com
objectClass: organizationalUnit
ou: services
description: Service accounts

# 系统策略
dn: ou=policies,dc=company,dc=com
objectClass: organizationalUnit
ou: policies
description: System policies

# 部门架构
dn: ou=departments,dc=company,dc=com
objectClass: organizationalUnit
ou: departments
description: Department structure

dn: ou=IT,ou=departments,dc=company,dc=com
objectClass: organizationalUnit
ou: IT
description: IT Department

dn: ou=HR,ou=departments,dc=company,dc=com
objectClass: organizationalUnit
ou: HR
description: Human Resources

dn: ou=Finance,ou=departments,dc=company,dc=com
objectClass: organizationalUnit
ou: Finance
description: Finance Department

用户和组管理

用户条目模板

# 用户条目示例
dn: uid=john.doe,ou=people,dc=company,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: john.doe
cn: John Doe
sn: Doe
givenName: John
displayName: John Doe
mail: john.doe@company.com
employeeNumber: 10001
departmentNumber: IT
title: Senior Engineer
description: Senior Software Engineer
uidNumber: 10001
gidNumber: 10001
homeDirectory: /home/john.doe
loginShell: /bin/bash
shadowLastChange: 19000
shadowMax: 99999
shadowWarning: 7
userPassword: {SSHA}hashedpassword

# 组条目示例
dn: cn=developers,ou=groups,dc=company,dc=com
objectClass: groupOfUniqueNames
objectClass: posixGroup
cn: developers
description: Development Team
gidNumber: 20001
uniqueMember: uid=john.doe,ou=people,dc=company,dc=com
uniqueMember: uid=jane.smith,ou=people,dc=company,dc=com

安全配置管理

访问控制列表(ACL)

细粒度权限控制

# 配置详细的ACL规则
cat > /tmp/acl-config.ldif << EOF
dn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: to attrs=userPassword
  by self write
  by dn.exact="cn=admin,dc=company,dc=com" write
  by dn.regex="uid=.*,ou=services,dc=company,dc=com" read
  by anonymous auth
  by * none
olcAccess: to attrs=shadowLastChange,shadowMax,shadowWarning,shadowInactive,shadowExpire
  by self write
  by dn.exact="cn=admin,dc=company,dc=com" write
  by * read
olcAccess: to dn.subtree="ou=people,dc=company,dc=com"
  by dn.exact="cn=admin,dc=company,dc=com" write
  by dn.regex="uid=.*,ou=services,dc=company,dc=com" read
  by self read
  by * auth
olcAccess: to dn.subtree="ou=groups,dc=company,dc=com"
  by dn.exact="cn=admin,dc=company,dc=com" write
  by dn.regex="uid=.*,ou=services,dc=company,dc=com" read
  by * read
olcAccess: to *
  by dn.exact="cn=admin,dc=company,dc=com" write
  by * read
EOF

ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/acl-config.ldif

SASL认证配置

Kerberos集成

#!/bin/bash
# 配置SASL Kerberos认证

# 安装SASL组件
yum install -y cyrus-sasl cyrus-sasl-gssapi cyrus-sasl-ldap

# 配置SASL
cat > /etc/sasl2/slapd.conf << EOF
pwcheck_method: saslauthd
saslauthd_path: /var/run/saslauthd/mux
mech_list: GSSAPI PLAIN LOGIN
keytab: /etc/openldap/ldap.keytab
EOF

# 启用SASL映射
cat > /tmp/sasl-mapping.ldif << EOF
dn: cn=config
changetype: modify
add: olcAuthzRegexp
olcAuthzRegexp: uid=([^,]*),cn=GSSAPI,cn=auth
  uid=$1,ou=people,dc=company,dc=com
EOF

ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/sasl-mapping.ldif

# 启动saslauthd
systemctl enable saslauthd
systemctl start saslauthd

性能优化配置

数据库调优

LMDB优化配置

# 配置LMDB性能参数
cat > /tmp/mdb-tuning.ldif << EOF
dn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcDbMaxSize
olcDbMaxSize: 10737418240
-
replace: olcDbMaxReaders
olcDbMaxReaders: 126
-
add: olcDbEnvFlags
olcDbEnvFlags: writemap
olcDbEnvFlags: nometasync
-
replace: olcDbIndex
olcDbIndex: objectClass eq
olcDbIndex: uid eq,pres,sub
olcDbIndex: cn eq,pres,sub
olcDbIndex: sn eq,pres,sub
olcDbIndex: mail eq,pres,sub
olcDbIndex: givenName eq,pres,sub
olcDbIndex: memberUid eq
olcDbIndex: uniqueMember eq
olcDbIndex: uidNumber eq
olcDbIndex: gidNumber eq
olcDbIndex: ou eq,pres,sub
olcDbIndex: employeeNumber eq
EOF

ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/mdb-tuning.ldif

系统级优化

操作系统调优

#!/bin/bash
# 系统性能优化脚本

# 调整文件描述符限制
cat >> /etc/security/limits.conf << EOF
ldap soft nofile 65536
ldap hard nofile 65536
ldap soft nproc 4096
ldap hard nproc 4096
EOF

# 调整内核参数
cat >> /etc/sysctl.conf << EOF
# 网络优化
net.core.rmem_default = 262144
net.core.rmem_max = 16777216
net.core.wmem_default = 262144
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 65536 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

# 内存优化
vm.swappiness = 10
vm.dirty_ratio = 15
vm.dirty_background_ratio = 5

# 文件系统优化
fs.file-max = 1048576
EOF

sysctl -p

# 重启slapd服务应用更改
systemctl restart slapd

备份和恢复策略

自动化备份脚本

完整备份方案

#!/bin/bash
# OpenLDAP自动化备份脚本

BACKUP_DIR="/backup/ldap"
DATE=$(date +%Y%m%d_%H%M%S)
RETENTION_DAYS=30

# 创建备份目录
mkdir -p $BACKUP_DIR/{full,config,logs}

# 备份主数据库
echo "开始备份主数据库..."
slapcat -n 1 -l $BACKUP_DIR/full/data_$DATE.ldif

# 备份配置数据库
echo "开始备份配置数据库..."
slapcat -n 0 -l $BACKUP_DIR/config/config_$DATE.ldif

# 备份Schema文件
echo "备份Schema文件..."
cp -r /etc/openldap/schema $BACKUP_DIR/config/schema_$DATE

# 备份证书文件
echo "备份证书文件..."
tar -czf $BACKUP_DIR/config/certs_$DATE.tar.gz /etc/openldap/certs/

# 备份日志文件
echo "备份日志文件..."
cp /var/log/slapd.log $BACKUP_DIR/logs/slapd_$DATE.log

# 压缩备份文件
echo "压缩备份文件..."
tar -czf $BACKUP_DIR/ldap_backup_$DATE.tar.gz \
  $BACKUP_DIR/full/data_$DATE.ldif \
  $BACKUP_DIR/config/config_$DATE.ldif \
  $BACKUP_DIR/config/schema_$DATE \
  $BACKUP_DIR/config/certs_$DATE.tar.gz \
  $BACKUP_DIR/logs/slapd_$DATE.log

# 清理临时文件
rm -f $BACKUP_DIR/full/data_$DATE.ldif
rm -f $BACKUP_DIR/config/config_$DATE.ldif
rm -rf $BACKUP_DIR/config/schema_$DATE
rm -f $BACKUP_DIR/config/certs_$DATE.tar.gz
rm -f $BACKUP_DIR/logs/slapd_$DATE.log

# 删除过期备份
find $BACKUP_DIR -name "ldap_backup_*.tar.gz" -mtime +$RETENTION_DAYS -delete

echo "备份完成: $BACKUP_DIR/ldap_backup_$DATE.tar.gz"

# 验证备份完整性
if [ -f "$BACKUP_DIR/ldap_backup_$DATE.tar.gz" ]; then
    echo "备份文件验证成功"
    # 发送备份成功通知
    echo "OpenLDAP备份成功 - $(hostname) - $DATE" | \
      mail -s "LDAP Backup Success" admin@company.com
else
    echo "备份文件验证失败"
    echo "OpenLDAP备份失败 - $(hostname) - $DATE" | \
      mail -s "LDAP Backup Failed" admin@company.com
    exit 1
fi

灾难恢复程序

数据恢复脚本

#!/bin/bash
# OpenLDAP数据恢复脚本

BACKUP_FILE="$1"
RECOVERY_DIR="/tmp/ldap_recovery"

if [ -z "$BACKUP_FILE" ]; then
    echo "用法: $0 <backup_file.tar.gz>"
    exit 1
fi

echo "开始LDAP数据恢复..."

# 停止slapd服务
systemctl stop slapd

# 创建恢复目录
mkdir -p $RECOVERY_DIR
cd $RECOVERY_DIR

# 解压备份文件
tar -xzf $BACKUP_FILE

# 备份当前数据
mv /var/lib/ldap /var/lib/ldap.bak.$(date +%Y%m%d_%H%M%S)
mv /etc/openldap/slapd.d /etc/openldap/slapd.d.bak.$(date +%Y%m%d_%H%M%S)

# 重新初始化数据目录
mkdir -p /var/lib/ldap
mkdir -p /etc/openldap/slapd.d

# 恢复配置数据库
slapadd -n 0 -F /etc/openldap/slapd.d -l config_*.ldif

# 恢复主数据库
slapadd -n 1 -F /etc/openldap/slapd.d -l data_*.ldif

# 恢复证书文件
tar -xzf certs_*.tar.gz -C /

# 设置权限
chown -R ldap:ldap /var/lib/ldap
chown -R ldap:ldap /etc/openldap/slapd.d
chmod 600 /etc/openldap/certs/*.pem

# 启动服务
systemctl start slapd

# 验证恢复结果
if systemctl is-active slapd; then
    echo "LDAP服务恢复成功"
    ldapsearch -x -b "dc=company,dc=com" "(objectClass=organization)"
else
    echo "LDAP服务恢复失败"
    exit 1
fi

# 清理临时文件
rm -rf $RECOVERY_DIR

echo "数据恢复完成"

监控和告警

Zabbix监控配置

LDAP监控模板

#!/bin/bash
# Zabbix LDAP监控脚本

# 检查LDAP服务状态
check_ldap_service() {
    systemctl is-active slapd >/dev/null 2>&1
    echo $?
}

# 检查LDAP端口连通性
check_ldap_port() {
    local port=$1
    nc -z localhost $port >/dev/null 2>&1
    echo $?
}

# 检查LDAP响应时间
check_ldap_response_time() {
    local start_time=$(date +%s.%N)
    ldapsearch -x -H ldap://localhost -b "dc=company,dc=com" \
      -s base "(objectClass=*)" >/dev/null 2>&1
    local end_time=$(date +%s.%N)
    echo "scale=3; $end_time - $start_time" | bc
}

# 检查LDAP连接数
check_ldap_connections() {
    netstat -an | grep ":389" | grep ESTABLISHED | wc -l
}

# 检查数据库大小
check_db_size() {
    du -sb /var/lib/ldap | awk '{print $1}'
}

# 检查复制状态
check_replication_status() {
    ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=config" \
      "(olcDatabase={1}mdb)" olcSyncRepl 2>/dev/null | \
      grep "olcSyncRepl" | wc -l
}

# 根据参数执行相应检查
case "$1" in
    service)
        check_ldap_service
        ;;
    port389)
        check_ldap_port 389
        ;;
    port636)
        check_ldap_port 636
        ;;
    response_time)
        check_ldap_response_time
        ;;
    connections)
        check_ldap_connections
        ;;
    db_size)
        check_db_size
        ;;
    replication)
        check_replication_status
        ;;
    *)
        echo "用法: $0 {service|port389|port636|response_time|connections|db_size|replication}"
        exit 1
        ;;
esac

日志分析和告警

日志监控脚本

#!/usr/bin/env python3
# OpenLDAP日志分析脚本

import re
import time
import smtplib
from email.mime.text import MimeText
from collections import defaultdict
import argparse

class LDAPLogAnalyzer:
    def __init__(self, log_file="/var/log/slapd.log"):
        self.log_file = log_file
        self.error_patterns = {
            'connection_failed': r'connection_read\(\d+\): unable to get TLS client DN',
            'bind_failed': r'BIND dn=".*" method=\d+ mech=\w+ ssf=\d+',
            'search_error': r'SEARCH RESULT tag=\d+ err=\d+',
            'memory_error': r'out of memory',
            'db_error': r'database.*error',
            'replication_error': r'syncrepl.*error'
        }

    def analyze_logs(self, hours=1):
        """分析最近N小时的日志"""

        current_time = time.time()
        cutoff_time = current_time - (hours * 3600)

        error_counts = defaultdict(int)
        critical_errors = []

        try:
            with open(self.log_file, 'r') as f:
                for line in f:
                    # 解析时间戳
                    timestamp_match = re.search(r'(\w+\s+\d+\s+\d+:\d+:\d+)', line)
                    if timestamp_match:
                        timestamp_str = timestamp_match.group(1)
                        # 简化时间解析，实际应用中需要更准确的时间处理

                    # 检查错误模式
                    for error_type, pattern in self.error_patterns.items():
                        if re.search(pattern, line, re.IGNORECASE):
                            error_counts[error_type] += 1

                            # 记录严重错误
                            if error_type in ['memory_error', 'db_error']:
                                critical_errors.append(line.strip())

        except FileNotFoundError:
            print(f"日志文件 {self.log_file} 不存在")
            return None

        return {
            'error_counts': dict(error_counts),
            'critical_errors': critical_errors,
            'analysis_time': time.strftime('%Y-%m-%d %H:%M:%S')
        }

    def send_alert(self, analysis_result):
        """发送告警邮件"""

        if not analysis_result['error_counts'] and not analysis_result['critical_errors']:
            return

        # 构建邮件内容
        subject = f"OpenLDAP 告警 - {analysis_result['analysis_time']}"

        body = f"""
OpenLDAP 日志分析报告
分析时间: {analysis_result['analysis_time']}

错误统计:
"""
        for error_type, count in analysis_result['error_counts'].items():
            body += f"  {error_type}: {count} 次\n"

        if analysis_result['critical_errors']:
            body += f"\n严重错误:\n"
            for error in analysis_result['critical_errors'][:5]:  # 只显示前5个
                body += f"  {error}\n"

        # 发送邮件
        try:
            msg = MimeText(body)
            msg['Subject'] = subject
            msg['From'] = 'ldap-monitor@company.com'
            msg['To'] = 'admin@company.com'

            smtp = smtplib.SMTP('localhost')
            smtp.send_message(msg)
            smtp.quit()

            print("告警邮件发送成功")
        except Exception as e:
            print(f"邮件发送失败: {e}")

def main():
    parser = argparse.ArgumentParser(description='OpenLDAP日志分析工具')
    parser.add_argument('--log-file', default='/var/log/slapd.log',
                      help='日志文件路径')
    parser.add_argument('--hours', type=int, default=1,
                      help='分析最近N小时的日志')
    parser.add_argument('--send-alert', action='store_true',
                      help='发送告警邮件')

    args = parser.parse_args()

    analyzer = LDAPLogAnalyzer(args.log_file)
    result = analyzer.analyze_logs(args.hours)

    if result:
        print(f"分析时间: {result['analysis_time']}")
        print(f"错误统计: {result['error_counts']}")
        print(f"严重错误数: {len(result['critical_errors'])}")

        if args.send_alert:
            analyzer.send_alert(result)
    else:
        print("日志分析失败")

if __name__ == "__main__":
    main()

总结

OpenLDAP作为企业级目录服务的重要组件，需要careful的架构设计和运维管理。通过本指南的实施，可以构建出高可用、安全、高性能的LDAP服务。

关键要点

架构设计：
- 采用主从复制保证高可用性
- 使用负载均衡器分散请求压力
- 合理设计DIT结构便于管理
安全管理：
- 实施TLS/SSL加密传输
- 配置细粒度ACL权限控制
- 集成SASL和Kerberos认证
性能优化：
- 优化数据库配置参数
- 建立合理的索引策略
- 调整系统级性能参数
运维管理：
- 建立完善的备份恢复机制
- 实施全面的监控告警
- 制定标准的操作程序
持续改进：
- 定期评估性能指标
- 及时应用安全补丁
- 根据业务需求调整架构

掌握这些实践经验，将帮助您构建和维护稳定可靠的企业级LDAP目录服务。

本文为OpenLDAP生产环境部署指南，建议结合实际环境需求进行调整和优化。如有技术问题，欢迎交流讨论。