LDAP server

LDAP server

Installation

Packages

apt-get install slapd ldap-utils

# For SSL - TLS access
apt-get install gnutls-bin

You'll have to choose a LDAP admin password. Choose a strong password!!

Set domain

Edit configuration file:

vim /etc/ldap/ldap.conf

Uncomment and adjust:

BASE dc=dev,dc=daxiongmao,dc=eu
URI ldap://dev.daxiongmao.eu

Launch LDAP configuration

Launch configuration:

dpkg-reconfigure slapd

• Select NO to the first question = it will create a new database
• Current LDAP server: "dev.daxiongmao.eu". This must match your (DC=...,DC=....,DC=....)
• Name of your organization: daxiongmao.eu
• Root LDAP server: put your root or the same value as before.
• Put your administrator password - the same as earlier
• Select HDB (Berkley database)
• Do NOT remove database on package removal
• Move old database
• Do NOT allow LDAP v2

Open firewall

Add the following rules to your firewall

# LDAP
$IPTABLES -A INPUT -p tcp -m state --state NEW --dport 389 -j ACCEPT # LDAP
$IPTABLES -A INPUT -p tcp -m state --state NEW --dport 636 -j ACCEPT # LDAP over SSL

Maintenance operations

Export database

The whole database may be exported as ldif file using this command:

slapcat

Get current configuration:

slapcat –b cn=config

Test

Install a LDAP client and test to access the server. It should be OK ! ^-^

See the following page to get more information: LDAP client

Installation # Encryption – SSL

By default OpenLDAP communication is not encrypted. Therefore, if some user have clear password anyone can used them.

Generate server certificates

See SSL server documentation to generate a certificate for the current server.

-- Hints --

• Do not encrypt your private key
• You cannot generate 2 certificates with the same server name.

If you already have a server certificate for the current FQDN, please use it!

Make files accessible for OpenLDAP

You have to copy your server private key + server certificate and CA certificate.

mkdir /etc/ldap/ssl
cd /etc/ldap/ssl
cp /srv/ssl/private/ldapServer.nopass.key ldapServer.key
cp /srv/ssl/certs/ldapServer.cert.pem ldapServer.pem
cp /srv/ssl/cacerts.pem .
chown -R root:openldap /etc/ldap/ssl

... Symlink might work but you can have some rights issues. It's just simpler - in my case - to copy the data.

Register certificates

SLAPD service

Since OpenLDAP 2.4 there is no more "slapd.conf" file.

All the configuration is now dynamic and set in database.

Create the .ldif file

vim /etc/ldap/slapd.d/tls.ldif

Add the following params:

dn: cn=config
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ldap/ssl/cacerts.pem
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ldap/ssl/ldapServer.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ldap/ssl/ldapServer.key

Adjust rights

chown openldap:openldap /etc/ldap/slapd.d/tls.ldif

Apply the configuration

ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/tls.ldif

Allow TLS protocol

vim /etc/default/slapd

Add the "ldaps" protocol (line 24):

SLAPD_SERVICES="ldap:/// ldapi:/// ldaps:///"

# For more security you can now restrict the LDAP to localhost
SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///"

Restart the service

/etc/init.d/slapd restart

OpenLDAP configuration

Edit the LDAP configuration

vim /etc/ldap/ldap.conf

Adjust the TLS certificate path

TLS_CACERT      /etc/ldap/ssl/cacerts.pem

You have to use the same as before in the "slapd" configuration.

Restart service

service slapd restart

Now you can connect to the server on port 686 and test your LDAP server over TLS!

Bonus

Now you can edit your firewall and close the port 389

Populate LDAP registry

Use your favorite LDAP client (see LDAP client) to populate the LDAP registry.

Create Organizational Units

I advised you to create the following OU=

Organization	Description
OU=people	for users
OU=groups	IT | company | project groups
OU=locations	specific area
OU=applications	for applications' virtual users

Create Groups

In the "OU=groups" create:

Group	Description
CN=users	domain users
CN=administrators	for system administrators
CN=services	System and services accounts

Create locations

Under 'locations' create a location for each office | home | place that you'll have in your registry.

In the "OU=location" create:

Location	Description
l=France	French users
l=Sweden	Swedish users

Create Users

• Inside ou=people create a new UID for each user + make that user a member of OU=groups,CN=users

• Inside ou=applications create a new UID for each application or service that will use the LDAP + make that a member of OU=groups,CN=services

Apache 2

See Apache 2 documentation to get more info: Apache 2 - LDAP access