$ cat ~/.ssh/config 
HOST 172.17.0.1
    Port 2222

$ sudo apt-get install software-properties-common
$ sudo apt-add-repository ppa:ansible/ansible
$ sudo apt-get update
$ sudo apt-get install ansible

$ cat /etc/ansible/hosts  | sed -e "/^#/d" -e "/^$/d"
localhost ansible_connection=local

# 第一个参数有个特例，all表示所有
$ ansible localhost  -m ping
localhost | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}
$ ansible all -a "whoami"
localhost | SUCCESS | rc=0 >>
king

$ sudo ansible all -a "whoami" -u root --sudo
localhost | SUCCESS | rc=0 >>
root

# 列出特定name的hosts
$ ansible test --list-hosts
  hosts (2):
    virtualbox
    localhost

$ ssh-keygen 
Generating public/private rsa key pair.
Enter file in which to save the key (/home/king/.ssh/id_rsa): /home/king/.ssh/ansible
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/king/.ssh/ansible.
Your public key has been saved in /home/king/.ssh/ansible.pub.
The key fingerprint is:
SHA256:T1liGGmbLRZI4lKIIdWn3gvWg8h/6F7hi/tgpFsNbPk king@king
The key's randomart image is:
+---[RSA 2048]----+
|o+.oo.....       |
|o .o..o +o       |
|  . .o ..=o .    |
|   o..  =..+     |
| . o*+..S.o      |
|  o+==+. o       |
|  .o+oEo  .      |
|   +o+o.         |
|  .o=+o          |
+----[SHA256]-----+
$ ssh-copy-id -i ~/.ssh/ansible -o "PubkeyAuthentication no" king@192.168.2.131
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/king/.ssh/ansible.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
king@192.168.2.131's password: 
Number of key(s) added: 1
Now try logging into the machine, with:   "ssh -o 'PubkeyAuthentication no' 'king@192.168.2.131'"
and check to make sure that only the key(s) you wanted were added.
# 注意`SSH_AUTH_SOCK`
$ SSH_AUTH_SOCK=0  ssh -i /home/king/.ssh/ansible  king@192.168.2.131

$ SSH_AUTH_SOCK=0 ansible all -a whoami 
localhost | SUCCESS | rc=0 >>
king

192.168.2.131 | SUCCESS | rc=0 >>
king

$ SSH_AUTH_SOCK=0 ansible test -a whoami 
localhost | SUCCESS | rc=0 >>
king

192.168.2.131 | SUCCESS | rc=0 >>
king

$ SSH_AUTH_SOCK=0 ansible test -a whoami 
localhost | SUCCESS | rc=0 >>
king

virtualbox | SUCCESS | rc=0 >>
king

$ ansible test -m command -a whoami
localhost | SUCCESS | rc=0 >>
king

virtualbox | SUCCESS | rc=0 >>
king

$ ansible test -m shell -a whoami
localhost | SUCCESS | rc=0 >>
king

virtualbox | SUCCESS | rc=0 >>
king

$ ansible virtualbox -m file -a 'path=/tmp/x/y/z state=directory owner=king group=fa mode=0755 recurse=yes'
virtualbox | SUCCESS => {
    "changed": true, 
    "gid": 1000, 
    "group": "fa", 
    "mode": "0755", 
    "owner": "king", 
    "path": "/tmp/x/y/z", 
    "size": 4096, 
    "state": "directory", 
    "uid": 1000
}

ansible-doc -s fetch
- name: Fetches a file from remote nodes
  action: fetch
      dest=               # 本地存储拉取文件的目录。例如dest=/data，src=/etc/fstab，
                          # 远程主机名host.exp.com，则保存的路径为/data/host.exp.com/etc/fstab。
      fail_on_missing     # 当设置为yes时，如果拉取的源文件不存在，则此任务失败。默认为no。
      flat                # 改变拉取后的路径存储方式。如果设置为yes，且当dest以"/"结尾时，将直接把源文件
                          # 的basename存储在dest下。显然，应该考虑多个主机拉取时的文件覆盖情况。
      src=                # 远程主机上的源文件。只能是文件，不支持目录。在未来的版本中可能会支持目录递归拉取。
      validate_checksum   # fetch到文件后，检查其md5和源文件是否相同。

$ ansible virtualbox -m fetch -a "src=/tmp/1.pdf dest=/tmp/"
virtualbox | SUCCESS => {
    "changed": true, 
    "checksum": "429b1cd33dcb3e71e9975e424994906f10c6d98d", 
    "dest": "/tmp/virtualbox/tmp/1.pdf", 
    "md5sum": "d7fa85f4857527c3a58290a0be2b679a", 
    "remote_checksum": "429b1cd33dcb3e71e9975e424994906f10c6d98d", 
    "remote_md5sum": null
}
$ ansible virtualbox -m fetch -a "src=/tmp/1.pdf dest=/tmp/ flat=yes"
virtualbox | SUCCESS => {
    "changed": true, 
    "checksum": "429b1cd33dcb3e71e9975e424994906f10c6d98d", 
    "dest": "/tmp/1.pdf", 
    "md5sum": "d7fa85f4857527c3a58290a0be2b679a", 
    "remote_checksum": "429b1cd33dcb3e71e9975e424994906f10c6d98d", 
    "remote_md5sum": null
}

# 安装 yes/safe/full/dist
$ ansible virtualbox -m apt -a "name=dos2unix update_cache=yes" --sudo --ask-sudo-pass
SUDO password: 
virtualbox | SUCCESS => {
    "cache_update_time": 1591944887, 
    "cache_updated": true, 
    "changed": true, 
    "stderr": "", 
    "stdout": "正在读取软件包列表..."
# 移除
$ ansible virtualbox -m apt -a "name=dos2unix state=absent" --sudo --ask-sudo-pass
# 安装 latest/absent/present
$ ansible virtualbox -m apt -a "name=dos2unix state=present" --sudo --ask-sudo-pass

# running,started,stopped,restarted,reloaded
$ ansible virtualbox -m service -a "name=nginx state=stopped " --sudo --ask-sudo-pass
SUDO password: 
virtualbox | SUCCESS => {
    "changed": true, 
    "name": "nginx", 
    "state": "stopped"
}
$ ansible virtualbox -m service -a "name=nginx state=stopped " --sudo --ask-sudo-pass
SUDO password: 
virtualbox | SUCCESS => {
    "changed": false, 
    "name": "nginx", 
    "state": "stopped"
}
$ ansible virtualbox -m service -a "name=nginx state=started " --sudo --ask-sudo-pass
SUDO password: 
virtualbox | SUCCESS => {
    "changed": true, 
    "name": "nginx", 
    "state": "started"
}

$ ansible-playbook a.yaml 

PLAY ***************************************************************************

TASK [setup] *******************************************************************
ok: [virtualbox]

TASK [execute date cmd] ********************************************************
changed: [virtualbox]

TASK [execute shell whoami] ****************************************************
changed: [virtualbox]

TASK [debug] *******************************************************************
ok: [virtualbox] => {
    "date.stdout_lines": [
        "2020年 06月 12日 星期五 15:50:36 CST"
    ]
}

TASK [debug] *******************************************************************
ok: [virtualbox] => {
    "msg": "king"
}

PLAY ***************************************************************************

TASK [setup] *******************************************************************
ok: [virtualbox]

TASK [execute date cmd] ********************************************************
ok: [virtualbox]

TASK [debug] *******************************************************************
ok: [virtualbox] => {
    "msg": {
        "changed": false, 
        "name": "nginx", 
        "state": "started"
    }
}

PLAY RECAP *********************************************************************
virtualbox                 : ok=8    changed=2    unreachable=0    failed=0

$ docker pull kibana:6.5.4
$ docker pull elasticsearch:6.5.4
$ docker run -d -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" \
    --name elastic  elasticsearch:6.5.4
$ docker run -d -e "ELASTICSEARCH_URL=http://192.168.2.139:9200" \
    --name kibana   -p 5601:5601 kibana:6.5.4

$ ./filebeat-7.3.0-linux-x86_64/filebeat -c a.yml  -e -d "*"

$ kubectl apply -f https://download.elastic.co/downloads/eck/1.1.0/all-in-one.yaml

$ curl -k -u king -XGET "https://127.0.0.1:9200/_count?pretty  " -H 'Content-Type: application/json' -d'
{
  "query": {
    "match_all": {}
  }
}'
Enter host password for user 'king':
{
  "count" : 42,
  "_shards" : {
    "total" : 3,
    "successful" : 3,
    "skipped" : 0,
    "failed" : 0
  }
}
$ curl -k -u king:pwd -XPUT "https://127.0.0.1:9200/idx  " -H 'Content-Type: application/json'
{"acknowledged":true,"shards_acknowledged":true,"index":"idx"}
$ curl -k -u king:pwd -XGET "https://127.0.0.1:9200/_count?pretty  " -H 'Content-Type: application/json' -d'
{
  "query": {
    "match_all": {}
  }
}'
{
  "count" : 42,
  "_shards" : {
    "total" : 3,
    "successful" : 3,
    "skipped" : 0,
    "failed" : 0
  }
}

$ curl -XGET "http://192.168.2.139:9200/_count?pretty  " -H 'Content-Type: application/json' -d'
{
  "query": {
    "match_all": {}
  }
}'

GET _count?pretty  
{
  "query": {
    "match_all": {}
  }
}

Relational DB -> Databases -> Tables -> Rows -> Columns
Elasticsearch -> Indices -> Types -> Documents -> Fields

PUT /megacorp/employee/1
{
  "first_name": "John",
  "last_name": "Smith",
  "age": 25,
  "about": "I love to go rock climbing",
  "interests": [
    "sports",
    "music"
  ]
}

GET /megacorp/employee/1
GET /megacorp/employee/_search?q=last_name:Smith
GET /megacorp/employee/_search
{
  "query": {
    "match": {
      "last_name": "Smith"
    }
  }
}

PUT /blogs
{
  "settings" : {
    "number_of_shards" : 3, # 主要分片数
    "number_of_replicas" : 1 # 每个主要分片的副本数量
  }
}

GET /_cluster/health
# resp
{
  "cluster_name" : "docker-cluster",
  "status" : "yellow", <----
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  ...
}

PUT /blogs/_settings
{
  "number_of_replicas" : 2
}

$ docker run -d --name jaeger \
  -e COLLECTOR_ZIPKIN_HTTP_PORT=9411 \
  -p 5775:5775/udp \
  -p 6831:6831/udp \
  -p 6832:6832/udp \
  -p 5778:5778 \
  -p 16686:16686 \
  -p 14268:14268 \
  -p 14250:14250 \
  -p 9411:9411 \
  jaegertracing/all-in-one:1.17

$ protoc -I ./ helloworld.proto --go_out=plugins=grpc:./

$ python -m grpc_tools.protoc --python_out ./ \
    --grpc_python_out ./ -I. ./helloworld.proto

$ docker exec -it my-sentry /bin/bash
# 最好先修改源
$ apt update
$ apt-get install libsasl2-dev python-dev libldap2-dev libssl-dev 
# for debug
$ apt-get vim procps -y
# 安装sentry插件
pip install https://github.com/Banno/getsentry-ldap-auth/archive/2.8.1.zip

/usr/local/lib/python2.7/site-packages/sentry_ldap_auth$ find . -type f
./backend.py
./__init__.py

$ docker logs -f my-sentry

$ ldapsearch -x -H ldap://localhost  -w 123456 -D cn=admin,ou=tech,ou=lixin,dc=example,dc=org \
   -b "ou=lixin,dc=example,dc=org"
# admin_group, lixin, example.org
dn: cn=admin_group,ou=lixin,dc=example,dc=org
objectClass: groupOfNames
objectClass: top
cn: admin_group
member: cn=king1,ou=tech,ou=lixin,dc=example,dc=org

# owner_group, lixin, example.org
dn: cn=owner_group,ou=lixin,dc=example,dc=org
objectClass: groupOfNames
objectClass: top
cn: owner_group
member: cn=admin,ou=tech,ou=lixin,dc=example,dc=org

# admin, tech, lixin, example.org
dn: cn=admin,ou=tech,ou=lixin,dc=example,dc=org
objectClass: top
objectClass: organizationalRole
objectClass: simpleSecurityObject
cn: admin
userPassword:: e1NTSEF9ekRETXFGME4ydVNHUWZzRmxZSVlKVmVoS3BWbENxaGk=

# king1, tech, lixin, example.org
dn: cn=king1,ou=tech,ou=lixin,dc=example,dc=org
objectClass: top
objectClass: organizationalRole
objectClass: simpleSecurityObject
cn: king1

# king2, tech, lixin, example.org
dn: cn=king2,ou=tech,ou=lixin,dc=example,dc=org
objectClass: top
objectClass: organizationalRole
objectClass: simpleSecurityObject
cn: king2

$ docker run -d --privileged -p 10004:80 --name php \
  --env PHPLDAPADMIN_HTTPS=false --env PHPLDAPADMIN_LDAP_HOSTS=172.17.0.1  \
  --detach osixia/phpldapadmin

$ docker run -p 389:389 --name ldap \
  --network bridge --hostname openldap-host \
  --env LDAP_ORGANISATION="example" --env LDAP_DOMAIN="example.org" \
  --env LDAP_ADMIN_PASSWORD="pwd" --detach osixia/openldap

$ docker run --hostname ldap.example.org \
  --volume /path/to/certificates:/container/service/slapd/assets/certs \
  --env LDAP_TLS_CRT_FILENAME=my-ldap.crt \
  --env LDAP_TLS_KEY_FILENAME=my-ldap.key \
  --env LDAP_TLS_CA_CRT_FILENAME=the-ca.crt \
  --detach osixia/openldap

$ docker ps
CONTAINER ID  IMAGE               COMMAND               CREATED        STATUS        PORTS                          NAMES
bfa797f2e0c7  osixia/phpldapadmin "/container/tool/run" 15 minutes ago Up 15 minutes 443/tcp, 0.0.0.0:10004->80/tcp php
e0c9ca20a8f1  osixia/openldap     "/container/tool/run" 15 minutes ago Up 15 minutes 0.0.0.0:389->389/tcp, 636/tcp  ldap
$ docker exec -it --privileged ldap /bin/bash
$ ldapsearch -x -H ldap://localhost -D "cn=admin,dc=example,dc=org" -w pwd -b "dc=example,dc=org"
# extended LDIF
#
# LDAPv3
# base <dc=example,dc=org> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# example.org
dn: dc=example,dc=org
objectClass: top
objectClass: dcObject
objectClass: organization
o: example
dc: example

# admin, example.org
dn: cn=admin,dc=example,dc=org
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator
userPassword:: e1NTSEF9cVNPeHRiYTFoQ0RtMlJPcWRwOW0vaTVULzRidzE2NHI=

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntries: 2

# 从cn=config下过滤特定objectClass所有条目的dn
$ ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b cn=config \
    -s sub "(objectClass=olcDatabaseConfig)" dn
dn: olcDatabase={-1}frontend,cn=config
dn: olcDatabase={0}config,cn=config
dn: olcDatabase={1}mdb,cn=config

$ ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b "olcDatabase={1}mdb,cn=config" \
   -s sub "(objectClass=olcDatabaseConfig)"  olcSuffix
dn: olcDatabase={1}mdb,cn=config
olcSuffix: dc=example,dc=org

$ ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b "cn=config" dn 2>/dev/null | head -n 5
dn: cn=config
dn: cn=module{0},cn=config
dn: cn=module{1},cn=config

$ cat > base.ldif  << EOF
> dn: ou=lixin,dc=example,dc=org
objectClass: organizationalUnit
ou: lixin
# 空行
dn: ou=tech,ou=lixin,dc=example,dc=org
objectClass: organizationalUnit
ou: tech
description: 产品部
# 空行
dn: cn=king1,ou=tech,ou=lixin,dc=example,dc=org
objectClass: top
objectClass: organizationalRole
objectClass: simpleSecurityObject
cn: king1
userPassword: 1
# 空行
dn: cn=king2,ou=tech,ou=lixin,dc=example,dc=org
objectClass: top
objectClass: organizationalRole
objectClass: simpleSecurityObject
cn: king2
userPassword: 1
> EOF
#
$ ldapadd -x -H ldap://localhost  -w pwd -D cn=admin,dc=example,dc=org -f base.ldif 
adding new entry "ou=lixin,dc=example,dc=org"
adding new entry "ou=tech,ou=lixin,dc=example,dc=org"
adding new entry "cn=king1,ou=tech,ou=lixin,dc=example,dc=org"
adding new entry "cn=king2,ou=tech,ou=lixin,dc=example,dc=org"

$ ldapsearch -x -H ldap://localhost  -w pwd -D cn=admin,dc=example,dc=org \
    -b "ou=lixin,dc=example,dc=org" dn
# lixin, example.org
dn: ou=lixin,dc=example,dc=org

# tech, lixin, example.org
dn: ou=tech,ou=lixin,dc=example,dc=org

# king1, tech, lixin, example.org
dn: cn=king1,ou=tech,ou=lixin,dc=example,dc=org

# king2, tech, lixin, example.org
dn: cn=king2,ou=tech,ou=lixin,dc=example,dc=org

# search result
search: 2
result: 0 Success

# numResponses: 5
# numEntries: 4

$ cat > c << EOF
> dn: cn=king2,ou=tech,ou=lixin,dc=example,dc=org
changetype: modify
add: description
description: 你懂的
> EOF
#
$ ldapmodify -x -H ldap://localhost  -w pwd -D cn=admin,dc=example,dc=org -f c
modifying entry "cn=king2,ou=tech,ou=lixin,dc=example,dc=org"
#
$ cat > c << EOF
> dn: cn=king2,ou=tech,ou=lixin,dc=example,dc=org
changetype: modify
delete: description
description: 你懂的
-
add: street
street: iii
> EOF""
$ ldapmodify -x -H ldap://localhost  -w pwd -D cn=admin,dc=example,dc=org -f c
modifying entry "cn=king2,ou=tech,ou=lixin,dc=example,dc=org"

$ ldapsearch -x -H ldap://localhost  -w pwd -D cn=admin,dc=example,dc=org \
    -b "cn=king2,ou=tech,ou=lixin,dc=example,dc=org" street | \
    sed -e "/^$/d" -e "/^#/d"
dn: cn=king2,ou=tech,ou=lixin,dc=example,dc=org
street: iii
street: jjj
street: kkk
# 删除stree=jjj的条目, 修改street=kkk的条目修改为lll
$ cat > c << EOF
> dn: cn=king2,ou=tech,ou=lixin,dc=example,dc=org
changetype: modify
delete: street
street: jjj
-
delete: street
street: kkk
-
add: street
street: lll
> EOF
#
$ ldapsearch -x -H ldap://localhost  -w pwd -D cn=admin,dc=example,dc=org \
    -b "cn=king2,ou=tech,ou=lixin,dc=example,dc=org" street | \
    sed -e "/^$/d" -e "/^#/d"
dn: cn=king2,ou=tech,ou=lixin,dc=example,dc=org
street: iii
street: lll

$ cat > base.ldif << EOF
> dn: cn=admin,ou=tech,ou=lixin,dc=example,dc=org
objectClass: top
objectClass: organizationalRole
objectClass: simpleSecurityObject
cn: admin
userPassword: 1
> EOF
#
$ ldapadd -x -H ldap://localhost  -w pwd -D cn=admin,dc=example,dc=org -f base.ldif
adding new entry "cn=admin,ou=tech,ou=lixin,dc=example,dc=org"
#
$ ldapdelete -H ldap://localhost -D cn=admin,dc=example,dc=org -w 1 \
    cn=king1,ou=tech,ou=lixin,dc=example,dc=org
#
$ ldapsearch -x -H ldap://localhost  -w pwd -D cn=admin,dc=example,dc=org \
    -b "ou=lixin,dc=example,dc=org" dn
# lixin, example.org
dn: ou=lixin,dc=example,dc=org

# tech, lixin, example.org
dn: ou=tech,ou=lixin,dc=example,dc=org

# admin, tech, lixin, example.org
dn: cn=admin,ou=tech,ou=lixin,dc=example,dc=org

# king2, tech, lixin, example.org
dn: cn=king2,ou=tech,ou=lixin,dc=example,dc=org

# search result
search: 2
result: 0 Success

# 从`ou=lixin,dc=example,dc=org`开始查找
# 匹配属性cn等于`king2`的条目
$ ldapsearch -x -H ldap://localhost -w pwd -D cn=admin,dc=example,dc=org \
    -b "ou=lixin,dc=example,dc=org" \
    cn=king2 | sed -e "/^$/d" -e "/^#/d"
dn: cn=king2,ou=tech,ou=lixin,dc=example,dc=org
objectClass: top
objectClass: organizationalRole
objectClass: simpleSecurityObject
cn: king2
userPassword:: e1NTSEF9RzFqOGszdG82aHRWamRvQmYvRUlqbmo1dHNpb0NQcTE=
street: iii
description:: 5L2g5oeC55qE
# 接上, 只显示dn属性
$ ldapsearch -x -H ldap://localhost -w pwd -D cn=admin,dc=example,dc=org \
    -b "ou=lixin,dc=example,dc=org" \
    cn=king2 dn | sed -e "/^$/d" -e "/^#/d"
dn: cn=king2,ou=tech,ou=lixin,dc=example,dc=org

# cn等于admin 或者 street等于iii
$ ldapsearch -x -H ldap://localhost  -w pwd -D cn=admin,dc=example,dc=org \
    -b "ou=lixin,dc=example,dc=org" \
    "(|(cn=admin)(street=iii))" dn | sed -e "/^$/d" -e "/^#/d"
dn: cn=admin,ou=tech,ou=lixin,dc=example,dc=org
dn: cn=king2,ou=tech,ou=lixin,dc=example,dc=org

# dn中包含ou等于tech的条目
$ ldapsearch -x -H ldap://localhost  -w pwd -D cn=admin,dc=example,dc=org \
    -b "ou=lixin,dc=example,dc=org" "ou:dn:=tech" dn | sed -e "/^$/d" -e "/^#/d"
dn: ou=tech,ou=lixin,dc=example,dc=org
dn: cn=admin,ou=tech,ou=lixin,dc=example,dc=org
dn: cn=king2,ou=tech,ou=lixin,dc=example,dc=org
# dn中包含cn等于admin的条目
$ ldapsearch -x -H ldap://localhost  -w pwd -D cn=admin,dc=example,dc=org \
    -b "ou=lixin,dc=example,dc=org" "cn:dn:=admin" dn | sed -e "/^$/d" -e "/^#/d"
dn: cn=admin,ou=tech,ou=lixin,dc=example,dc=org

# default sn EQUALITY comparison behaviour
# is caseIgnoreMatch (2.5.13.2)
sn=smith

# override EQUALITY match with case sensitive match
sn:caseExactMatch:=Smith
# functionally same as above using OID
sn:2.5.13.5:=Smith

# if a wildcard appears in seach the SUBSTR 
# MatchingRule applies

# default sn SUBSTR comparison behavior
# is caseIgnoreSubstringMatch
sn=*s* # finds Smith or smith

# override SUBSTR match with case sensitive match
sn:caseExactSubstringMatch:=*S* # only finds Smith
# functionally same as above using OID
sn:2.5.13.7:=*S*

$ ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b "olcDatabase={1}mdb,cn=config" \
    -s sub "(objectClass=olcDatabaseConfig)"  olcAccess
dn: olcDatabase={1}mdb,cn=config
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by dn="cn=a
 dmin,dc=example,dc=org" write by anonymous auth by * none
olcAccess: {1}to * by self read by dn="cn=admin,dc=example,dc=org" write by * 
 none
# 查询lixin部门
$ ldapsearch -x -H ldap://localhost -D "cn=admin,ou=tech,ou=lixin,dc=example,dc=org" \
    -w 1 -b "ou=lixin,dc=example,dc=org" dn
search: 2
result: 32 No such object
# 查询自己
$ ldapsearch -x -H ldap://localhost -D "cn=admin,ou=tech,ou=lixin,dc=example,dc=org" \
    -w 1 -b "cn=admin,ou=tech,ou=lixin,dc=example,dc=org" dn
# admin, tech, lixin, example.org
dn: cn=admin,ou=tech,ou=lixin,dc=example,dc=org

search: 2
result: 0 Success

$ cat > perm << EOF
> dn: olcDatabase={1}mdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to dn.subtree="ou=lixin,dc=example,dc=org"
    by dn.exact="cn=admin,ou=tech,ou=lixin,dc=example,dc=org" read
    by anonymous auth
    by * none
> EOF
$ ldapmodify -H ldapi:// -Y EXTERNAL -f perm
#
$ ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b "olcDatabase={1}mdb,cn=config" \
   -s sub "(objectClass=olcDatabaseConfig)"  olcAccess
dn: olcDatabase={1}mdb,cn=config
olcAccess: {0}to dn.subtree="ou=lixin,dc=example,dc=org"   by dn.exact="cn=adm
 in,ou=tech,ou=lixin,dc=example,dc=org" read   by anonymous auth   by * none
olcAccess: {1}to attrs=userPassword,shadowLastChange by self write by dn="cn=a
 dmin,dc=example,dc=org" write by anonymous auth by * none
olcAccess: {2}to * by self read by dn="cn=admin,dc=example,dc=org" write by * 
 none

$ ldapsearch -x -H ldap://localhost -D "cn=admin,ou=tech,ou=lixin,dc=example,dc=org" \
    -w 1 -b "ou=lixin,dc=example,dc=org" dn
# lixin, example.org
dn: ou=lixin,dc=example,dc=org

# tech, lixin, example.org
dn: ou=tech,ou=lixin,dc=example,dc=org

# hr, tech, lixin, example.org
dn: cn=hr,ou=tech,ou=lixin,dc=example,dc=org

# admin, tech, lixin, example.org
dn: cn=admin,ou=tech,ou=lixin,dc=example,dc=org

# king1, tech, lixin, example.org
dn: cn=king1,ou=tech,ou=lixin,dc=example,dc=org

# king2, tech, lixin, example.org
dn: cn=king2,ou=tech,ou=lixin,dc=example,dc=org

search: 2
result: 0 Success
# 查分配的权限之外的dn就找不到了
$ ldapsearch -x -H ldap://localhost -D "cn=admin,ou=tech,ou=lixin,dc=example,dc=org" \
    -w 1 -b "dc=example,dc=org" dn
search: 2
result: 32 No such object

filter=(objectClass=person)
# 配合使用
dn.one="ou=people,o=suffix" filter=(objectClass=person)

# admin, tech, lixin, example.org
dn: cn=admin,ou=tech,ou=lixin,dc=example,dc=org
userPassword:: MQ==

# 内建规则, 所有用户可以自己修改密码
olcAccess: {0}to attrs=userPassword,shadowLastChange 
  by self write 
  by dn="cn=admin,dc=example,dc=org" write 
  by anonymous auth 
  by * none
# 本地新增,移动到第二位
olcAccess: {1}to dn.subtree="ou=lixin,dc=example,dc=org"   by dn.exact="cn=adm
 in,ou=tech,ou=lixin,dc=example,dc=org" read   by anonymous auth   by * none
# 超级管理员
olcAccess: {2}to * by self read by dn="cn=admin,dc=example,dc=org" write by * 
 none

$ slappasswd -h {SSHA}
New password: 
Re-enter new password: 
{SSHA}zDDMqF0N2uSGQfsFlYIYJVehKpVlCqhi
#
$ cat > pwd << EOF
> dn: cn=admin,ou=tech,ou=lixin,dc=example,dc=org
changetype: modify
replace: userPassword
userPassword: {SSHA}zDDMqF0N2uSGQfsFlYIYJVehKpVlCqhi
> EOF
# 
$ ldapmodify -x -H ldap://localhost  -w pwd \
   -D "cn=admin,ou=tech,ou=lixin,dc=example,dc=org" -f pwd
modifying entry "cn=admin,ou=tech,ou=lixin,dc=example,dc=org"
#
$ ldapsearch -x -H ldap://localhost -D "cn=admin,ou=tech,ou=lixin,dc=example,dc=org" \
  -w pwd -b "ou=lixin,dc=example,dc=org" userPassword
ldap_bind: Invalid credentials (49)
#
$ ldapsearch -x -H ldap://localhost -D "cn=admin,ou=tech,ou=lixin,dc=example,dc=org" \
   -w 123456 -b "ou=lixin,dc=example,dc=org" userPassword
# admin, tech, lixin, example.org
dn: cn=admin,ou=tech,ou=lixin,dc=example,dc=org
userPassword:: e1NTSEF9ekRETXFGME4ydVNHUWZzRmxZSVlKVmVoS3BWbENxaGk=
#
$ echo e1NTSEF9ekRETXFGME4ydVNHUWZzRmxZSVlKVmVoS3BWbENxaGk= | base64 -d
{SSHA}zDDMqF0N2uSGQfsFlYIYJVehKpVlCqhi

$ cat > a << EOF
> dn: cn=module,cn=config
cn: module
objectClass: olcModuleList
olcModulePath: /usr/lib64/openldap
# 空行
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: memberof.la
> EOF
#
$ ldapadd -Q -Y EXTERNAL -H ldapi:/// -f a
adding new entry "cn=module,cn=config"

modifying entry "cn=module{0},cn=config"
#
$ cat > a << EOF
> dn: olcOverlay=memberof,olcDatabase={1}mdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member     
olcMemberOfMemberOfAD: memberOf
> EOF
# 
$ ldapadd -Q -Y EXTERNAL -H ldapi:/// -f a
adding new entry "olcOverlay=memberof,olcDatabase={1}mdb,cn=config"

$ ldapsearch -x -H ldap://localhost -D "cn=admin,ou=tech,ou=lixin,dc=example,dc=org" \
    -w 123456 -b "cn=admin,ou=tech,ou=lixin,dc=example,dc=org" memberof
# admin, tech, lixin, example.org
dn: cn=admin,ou=tech,ou=lixin,dc=example,dc=org
memberOf: cn=ou,ou=lixin,dc=example,dc=org
memberOf: cn=ou2,ou=lixin,dc=example,dc=or

$ pip install flask_simpleldap

$ sudo apt-get install libsasl2-dev python-dev libldap2-dev libssl-dev

$ sudo yum install python-devel openldap-devel

$ sudo aptitude install libsasl2-dev
The following NEW packages will be installed:
  libsasl2-dev{b} 
0 packages upgraded, 1 newly installed, 0 to remove and 5 not upgraded.
Need to get 254 kB of archives. After unpacking 831 kB will be used.
The following packages have unmet dependencies:
 libsasl2-dev : Depends: libsasl2-2 (= 2.1.26.dfsg1-14build1) but 2.1.26.dfsg1-14ubuntu0.1 is installed.
The following actions will resolve these dependencies:

     Keep the following packages at their current version:
1)     libsasl2-dev [Not Installed]                       



Accept this solution? [Y/n/q/?] n
The following actions will resolve these dependencies:

     Downgrade the following packages:                                                   
1)     libsasl2-2 [2.1.26.dfsg1-14ubuntu0.1 (now) -> 2.1.26.dfsg1-14build1 (xenial)]     
2)     libsasl2-2:i386 [2.1.26.dfsg1-14ubuntu0.1 (now) -> 2.1.26.dfsg1-14build1 (xenial)]



Accept this solution? [Y/n/q/?] y
The following packages will be DOWNGRADED:
  libsasl2-2 libsasl2-2:i386 
The following NEW packages will be installed:
  libsasl2-dev 
0 packages upgraded, 1 newly installed, 2 downgraded, 0 to remove and 5 not upgraded.
Need to get 354 kB of archives. After unpacking 831 kB will be used.
Do you want to continue? [Y/n/?] y
Get: 1 http://mirrors.aliyun.com/ubuntu xenial/main i386 libsasl2-2 i386 2.1.26.dfsg1-14build1 [51.8 kB]
Get: 2 http://mirrors.aliyun.com/ubuntu xenial/main amd64 libsasl2-2 amd64 2.1.26.dfsg1-14build1 [48.7 kB]
Get: 3 http://mirrors.aliyun.com/ubuntu xenial/main amd64 libsasl2-dev amd64 2.1.26.dfsg1-14build1 [254 kB]
Fetched 354 kB in 0s (384 kB/s)       
dpkg: warning: downgrading libsasl2-2:i386 from 2.1.26.dfsg1-14ubuntu0.1 to 2.1.26.dfsg1-14build1
(Reading database ... 530388 files and directories currently installed.)
Preparing to unpack .../libsasl2-2_2.1.26.dfsg1-14build1_i386.deb ...
De-configuring libsasl2-2:amd64 (2.1.26.dfsg1-14ubuntu0.1) ...
Unpacking libsasl2-2:i386 (2.1.26.dfsg1-14build1) over (2.1.26.dfsg1-14ubuntu0.1) ...
dpkg: warning: downgrading libsasl2-2:amd64 from 2.1.26.dfsg1-14ubuntu0.1 to 2.1.26.dfsg1-14build1
Preparing to unpack .../libsasl2-2_2.1.26.dfsg1-14build1_amd64.deb ...
Unpacking libsasl2-2:amd64 (2.1.26.dfsg1-14build1) over (2.1.26.dfsg1-14ubuntu0.1) ...
Selecting previously unselected package libsasl2-dev.
Preparing to unpack .../libsasl2-dev_2.1.26.dfsg1-14build1_amd64.deb ...
Unpacking libsasl2-dev (2.1.26.dfsg1-14build1) ...
Processing triggers for libc-bin (2.23-0ubuntu11) ...
Processing triggers for man-db (2.7.5-1) ...
Setting up libsasl2-2:amd64 (2.1.26.dfsg1-14build1) ...
Setting up libsasl2-2:i386 (2.1.26.dfsg1-14build1) ...
Setting up libsasl2-dev (2.1.26.dfsg1-14build1) ...
Processing triggers for libc-bin (2.23-0ubuntu11) ...