Zabbix 认证方式配置为LDAP,倘若LDAP挂掉后该怎么办

青衣

　　Zabbix 认证方式有三种，分别是Internal、LDAP和HTTP。这里对认证方式不做过多解释。
　　

　　假如我们将认证方式配置为LDAP，但是认证使用的账号被误删除，并且密码已经记不清了，或者LDAP
　　系统挂掉，此时使用Zabbix初安装时的Admin/zabbix 账号密码组合是不能登陆的。这时我们该怎么办
　　呢？
　　

　　思路有两个:
　　1. 更改认证类型为Internal，然后使用Admin登陆，如果忘记密码，也可以重置Admin密码
　　2. 更新LDAP认证主机和Bind DN
　　

　　其实这些配置信息都是存储在数据库中的，我们可以通过数据库修改这些信息。
　　下面我们看一下数据库表信息:

[root@zabbix ~]# mysql -u root -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 83
Server version: 5.1.72-log Source distribution
Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> use zabbix;
Database changed
mysql> show tables;
+-----------------------+
| Tables_in_zabbix    |
+-----------------------+
| acknowledges      |
| actions         |
| alerts        |
| applications      |
| auditlog        |
| auditlog_details    |
| autoreg_host      |
| conditions      |
| config        |
| dchecks         |
| dhosts        |
| drules        |
| dservices       |
| escalations       |
| events        |
| expressions       |
| functions       |
| globalmacro       |
| globalvars      |
| graph_discovery     |
| graph_theme       |
| graphs        |
| graphs_items      |
| groups        |
| help_items      |
| history         |
| history_log       |
| history_str       |
| history_str_sync    |
| history_sync      |
| history_text      |
| history_uint      |
| history_uint_sync   |
| host_inventory    |
| hostmacro       |
| hosts         |
| hosts_groups      |
| hosts_templates     |
| housekeeper       |
| httpstep        |
| httpstepitem      |
| httptest        |
| httptestitem      |
| icon_map        |
| icon_mapping      |
| ids           |
| p_w_picpaths        |
| interface       |
| item_discovery    |
| items         |
| items_applications  |
| maintenances      |
| maintenances_groups   |
| maintenances_hosts  |
| maintenances_windows  |
| mappings        |
| media         |
| media_type      |
| node_cksum      |
| nodes         |
| opcommand       |
| opcommand_grp     |
| opcommand_hst     |
| opconditions      |
| operations      |
| opgroup         |
| opmessage       |
| opmessage_grp     |
| opmessage_usr     |
| optemplate      |
| profiles        |
| proxy_autoreg_host  |
| proxy_dhistory    |
| proxy_history     |
| regexps         |
| rights        |
| screens         |
| screens_items     |
| scripts         |
| service_alarms    |
| services        |
| services_links    |
| services_times    |
| sessions        |
| slides        |
| slideshows      |
| sysmap_element_url  |
| sysmap_url      |
| sysmaps         |
| sysmaps_elements    |
| sysmaps_link_triggers |
| sysmaps_links     |
| timeperiods       |
| trends        |
| trends_uint       |
| trigger_depends     |
| trigger_discovery   |
| triggers        |
| user_history      |
| users         |
| users_groups      |
| usrgrp        |
| valuemaps       |
+-----------------------+
103 rows in set (0.00 sec)

　　

　　用户和认证的信息涉及到四个表，分别是表config、users、users_groups、usrgrp。
　　

　　config表结构:

mysql> desc config;
+-------------------------+---------------------+------+-----+-----------------+-------+
| Field           | Type        | Null | Key | Default     | Extra |
+-------------------------+---------------------+------+-----+-----------------+-------+
| configid        | bigint(20) unsigned | NO   | PRI | NULL      |     |
| alert_history       | int(11)       | NO   |   | 0         |     |
| event_history       | int(11)       | NO   |   | 0         |     |
| refresh_unsupported   | int(11)       | NO   |   | 0         |     |
| work_period       | varchar(100)    | NO   |   | 1-5,00:00-24:00 |     |
| alert_usrgrpid      | bigint(20) unsigned | YES  | MUL | NULL      |     |
| event_ack_enable    | int(11)       | NO   |   | 1         |     |
| event_expire      | int(11)       | NO   |   | 7         |     |
| event_show_max      | int(11)       | NO   |   | 100       |     |
| default_theme       | varchar(128)    | NO   |   | originalblue  |     |
| authentication_type   | int(11)       | NO   |   | 0         |     |
| ldap_host         | varchar(255)    | NO   |   |         |     |
| ldap_port         | int(11)       | NO   |   | 389       |     |
| ldap_base_dn      | varchar(255)    | NO   |   |         |     |
| ldap_bind_dn      | varchar(255)    | NO   |   |         |     |
| ldap_bind_password    | varchar(128)    | NO   |   |         |     |
| ldap_search_attribute   | varchar(128)    | NO   |   |         |     |
| dropdown_first_entry  | int(11)       | NO   |   | 1         |     |
| dropdown_first_remember | int(11)       | NO   |   | 1         |     |
| discovery_groupid     | bigint(20) unsigned | NO   | MUL | NULL      |     |
| max_in_table      | int(11)       | NO   |   | 50        |     |
| search_limit      | int(11)       | NO   |   | 1000      |     |
| severity_color_0    | varchar(6)      | NO   |   | DBDBDB      |     |
| severity_color_1    | varchar(6)      | NO   |   | D6F6FF      |     |
| severity_color_2    | varchar(6)      | NO   |   | FFF6A5      |     |
| severity_color_3    | varchar(6)      | NO   |   | FFB689      |     |
| severity_color_4    | varchar(6)      | NO   |   | FF9999      |     |
| severity_color_5    | varchar(6)      | NO   |   | FF3838      |     |
| severity_name_0     | varchar(32)     | NO   |   | Not classified  |     |
| severity_name_1     | varchar(32)     | NO   |   | Information   |     |
| severity_name_2     | varchar(32)     | NO   |   | Warning     |     |
| severity_name_3     | varchar(32)     | NO   |   | Average     |     |
| severity_name_4     | varchar(32)     | NO   |   | High      |     |
| severity_name_5     | varchar(32)     | NO   |   | Disaster    |     |
| ok_period         | int(11)       | NO   |   | 1800      |     |
| blink_period      | int(11)       | NO   |   | 1800      |     |
| problem_unack_color   | varchar(6)      | NO   |   | DC0000      |     |
| problem_ack_color     | varchar(6)      | NO   |   | DC0000      |     |
| ok_unack_color      | varchar(6)      | NO   |   | 00AA00      |     |
| ok_ack_color      | varchar(6)      | NO   |   | 00AA00      |     |
| problem_unack_style   | int(11)       | NO   |   | 1         |     |
| problem_ack_style     | int(11)       | NO   |   | 1         |     |
| ok_unack_style      | int(11)       | NO   |   | 1         |     |
| ok_ack_style      | int(11)       | NO   |   | 1         |     |
| snmptrap_logging    | int(11)       | NO   |   | 1         |     |
| server_check_interval   | int(11)       | NO   |   | 10        |     |
+-------------------------+---------------------+------+-----+-----------------+-------+
46 rows in set (0.03 sec)

　　

　　其中，认证类型由 authentication_type，字段决定，值可以为0,1和2。0 代表Internal,1代表
　　LDAP，2代表HTTP.
　　

　　这样更改认证类型就容易了：
　　将认证类型更改为Internal:

mysql> update config set authentication_type=0;
Query OK, 1 row affected (0.00 sec)
Rows matched: 1  Changed: 1  Warnings: 0
mysql> flush privileges;
Query OK, 0 rows affected (0.00 sec)

　　

　　修改Admin密码:

#查询Admin用户的ID:
mysql> select * from users;
+--------+-------------+-------------+---------------+----------------------------------+-----+-----------+------------+-------+---------+------+---------+----------------+----------------+---------------+---------------+
| userid | alias     | name    | surname     | passwd               | url | autologin | autologout | lang  | refresh | type | theme   | attempt_failed | attempt_ip   | attempt_clock | rows_per_page |
+--------+-------------+-------------+---------------+----------------------------------+-----+-----------+------------+-------+---------+------+---------+----------------+----------------+---------------+---------------+
|    1 | Admin     | Zabbix    | Administrator | 5fce1b3e34b520afeffb37ce08c7cd66 |   |     1 |      0 | zh_CN |    30 |  3 | default |        4 | 192.168.100.34 |  1383812925 |      50 |
#更新Admin密码
mysql> update users set passwd='zabbix' where userid=1;
Query OK, 1 row affected (0.00 sec)
Rows matched: 1  Changed: 1  Warnings: 0
mysql> flush privileges;
Query OK, 0 rows affected (0.00 sec)

　　

　　更改用户权限组:

　　

#查询权限组ID
mysql> select * from usrgrp;
+----------+---------------------------+------------+--------------+------------+
| usrgrpid | name            | gui_access | users_status | debug_mode |
+----------+---------------------------+------------+--------------+------------+
|    7 | Zabbix administrators   |      0 |      0 |      0 |
|    8 | Guests          |      0 |      0 |      0 |
|    9 | Disabled          |      0 |      1 |      0 |
|     11 | Enabled debug mode    |      0 |      0 |      1 |
|     12 | No access to the frontend |      2 |      0 |      0 |
|     13 | Hou             |      0 |      0 |      0 |
|     14 | Mu            |      0 |      0 |      0 |
+----------+---------------------------+------------+--------------+------------+
7 rows in set (0.00 sec)

#查询用户和权限组对应关系
mysql> select * from users_groups ;
+----+----------+--------+
| id | usrgrpid | userid |
+----+----------+--------+
|  4 |    7 |    1 |
|  2 |    8 |    2 |
|  5 |    7 |    3 |
|  6 |    7 |    4 |
|  7 |    7 |    5 |
| 12 |     14 |    6 |
| 11 |     13 |    8 |
+----+----------+--------+
7 rows in set (0.00 sec)
#修改用户所在权限组
mysql>  update users_group set usrgrpid='1' where userid=3;
ERROR 1146 (42S02): Table 'zabbix.users_group' doesn't exist
mysql>  update users_groups set usrgrpid='1' where userid=3;
Query OK, 1 row affected (0.00 sec)
Rows matched: 1  Changed: 1  Warnings: 0
mysql> flush privileges;
Query OK, 0 rows affected (0.01 sec)

　　

　　更改LDAP主机或者BIND DN:

mysql> update config set ldap_host='xxx.xxx.xxx.xxx' ldap_base_dn='cn=ldap_search,ou=example,dc=com' ldap_bind_password='passwd';

　　

　　

　　有了上面这些操作，不论是用户误删除且密码忘记，还是LDAP挂掉，都可以随心所欲的更改认证了。