ldap.felinn.org [PCT 105]

Installation

À partir d'une installation fraîche de FusionDirectory sur Debian Buster 10.

TLS

Tuto TLS

Generate SSL/TLS certificates

In this guide, we are going to use self signed certificates. You can as well use commercial SSL/TLS certificates from your trusted CA.

To configure OpeLDAP server with SSL/TLS certificate, you need a CA certificate, server certificate and server certificate key file.

Create a directory to store the certificates. mkdir -p /etc/ssl/openldap/{private,certs,newcerts}

Once you have created the directories above, open the /usr/lib/ssl/openssl.cnf configuration file and set the directory for storing SSL/TLS certificates and keys under the [ CA_default ] section.

vim /usr/lib/ssl/openssl.cnf

... [ CA_default ]

#dir = ./demoCA # Where everything is kept

dir = /etc/ssl/openldap

certs = $dir/certs # Where the issued certs are kept

crl_dir = $dir/crl # Where the issued crl are kept

database = $dir/index.txt # database index file.

...

You also need some files for tracking the signed certificates.

echo "1001" > /etc/ssl/openldap/serial

touch /etc/ssl/openldap/index.txt

Create a CA Key file by running the command below. When prompted, enter the passphrase.

openssl genrsa -aes256 -out /etc/ssl/openldap/private/cakey.pem 2048

To remove the passphrase from the CA key;

openssl rsa -in /etc/ssl/openldap/private/cakey.pem -out /etc/ssl/openldap/private/cakey.pem

Create the CA certificate. Be sure to set the common to match your server FQDN.

openssl req -new -x509 -days 3650 -key /etc/ssl/openldap/private/cakey.pem -out /etc/ssl/openldap/certs/cacert.pem

Next generate LDAP server key;

openssl genrsa -aes256 -out /etc/ssl/openldap/private/ldapserver-key.key 2048

Remove assigned key passphrase.

openssl rsa -in /etc/ssl/openldap/private/ldapserver-key.key -out /etc/ssl/openldap/private/ldapserver-key.key

Generate the certificate signing request (CSR). Be sure to configure the same details as you did when generating the CA certificate file above.

openssl req -new -key /etc/ssl/openldap/private/ldapserver-key.key -out /etc/ssl/openldap/certs/ldapserver-cert.csr

Generate the LDAP server certificate and sign it with CA key and certificate generated above.

openssl ca -keyfile /etc/ssl/openldap/private/cakey.pem -cert /etc/ssl/openldap/certs/cacert.pem -in /etc/ssl/openldap/certs/ldapserver-cert.csr -out /etc/ssl/openldap/certs/ldapserver-cert.crt

To verify the LDAP server againt the CA;

openssl verify -CAfile /etc/ssl/openldap/certs/cacert.pem /etc/ssl/openldap/certs/ldapserver-cert.crt

/etc/ssl/openldap/certs/ldapserver-cert.crt: OK

Now, we have the CA certificate file, the server certificate and the server key file under the following respective directories.

/etc/ssl/openldap/certs/cacert.pem

/etc/ssl/openldap/certs/ldapserver-cert.crt

/etc/ssl/openldap/private/ldapserver-key.key

Next, set the ownership of the OpenLDAP certificates directory to openldap user.

chown -R openldap: /etc/ssl/openldap/

Update OpenLDAP Server TLS Certificates

Next, you need to update the OpenLDAP Server TLS certificates. Therefore, create the an LDIF file to define the TLS attributes as shown below;

vim ldap-tls.ldif

dn: cn=config

changetype: modify

add: olcTLSCACertificateFile

olcTLSCACertificateFile: /etc/ssl/openldap/certs/cacert.pem

replace: olcTLSCertificateFile

olcTLSCertificateFile: /etc/ssl/openldap/certs/ldapserver-cert.crt

replace: olcTLSCertificateKeyFile

olcTLSCertificateKeyFile: /etc/ssl/openldap/private/ldapserver-key.key

Replace the locations of your certificates and key files accordingly.

To modify these entries on the LDAP database, use ldapmodify command as shown below;

ldapmodify -Y EXTERNAL -H ldapi:/// -f ldap-tls.ldif

SASL/EXTERNAL authentication started

SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

SASL SSF: 0

modifying entry "cn=config"

To verify that the files are in place;

slapcat -b "cn=config" | grep -E "olcTLS"

olcTLSCACertificateFile: /etc/ssl/openldap/certs/cacert.pem

olcTLSCertificateFile: /etc/ssl/openldap/certs/ldapserver-cert.crt

olcTLSCertificateKeyFile: /etc/ssl/openldap/private/ldapserver-key.key

To check the validity of the LDAP configuration, run the command below;

slaptest -u

config file testing succeeded

Next, open the /etc/ldap/ldap.conf configuration file and change the location of the CA certificate.

vim /etc/ldap/ldap.conf

...

#TLS certificates (needed for GnuTLS)

#TLS_CACERT /etc/ssl/certs/ca-certificates.crt

TLS_CACERT /etc/ssl/openldap/certs/cacert.pem

Restart OpenLDAP daemon.

systemctl restart slapd

Verify TLS connectivity for LDAP

To verify OpenLDAP TLS connectivity, run the command below. If connection is fine, you should get the output, anonymous.

Contrairement à ce qu'on pourrait croire au premier abord, openldap n'utilise pas (plus?) ldaps mais StartTLS pour chiffrer les communications.

ldapwhoami -H ldap://ldap.felinn.org -x -ZZ

anonymous

ldapwhoami -H ldapi:/// -x -ZZ

anonymous

dn: cn=module,cn=config
cn: module
objectClass: olcModuleList
olcModuleLoad: memberof
olcModulePath: /usr/lib/ldap

dn: olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf

dn: cn=module{1},cn=config
add: olcmoduleload
olcmoduleload: refint

dn: olcOverlay={1}refint,olcDatabase={1}hdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: {1}refint
olcRefintAttribute: memberof member manager owner

ldapadd -Q -Y EXTERNAL -H ldapi:/// -f memberof_config.ldif
ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f refint1.ldif
ldapadd -Q -Y EXTERNAL -H ldapi:/// -f refint2.ldif

dn: olcDatabase={1}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to attrs=userPassword
    by self write
    by dn="cn=dovecot,ou=dsa,dc=felinn,dc=org" read
    by anonymous auth
    by * none
olcAccess: {1}to attrs=shadowLastChange by self write by * read
olcAccess: {2}to * by * read

ldapmodify -Y EXTERNAL -H ldapi:/// -f olcDatabase_change.ldif

service slapd restart

ldapsearch -H ldap://192.168.10.113 -D 'cn=dovecot,ou=dsa,dc=felinn,dc=org' -W -LLL '(&(objectClass=posixAccount)(uid=<uid>))' 'userPassword'