Computerglitch

An ongoing adventure

CentOS 6.4 LDAP With TLS - Quick & Dirty

This post is an overview of the commands needed to setup a basic working LDAP TLS server using CentOS 6.4. I will also go over the process of creating a POSIX user account and a POSIX group. The archived version of this is for CentOS 6 and can be found here: CentOS 6 LDAP With TLS

Add the following to your iptables configuration to allow access through the firewall, then install the required packages for your LDAP server.

/etc/sysconfig/iptables

1
2
3
4
5
6

-A INPUT -m state --state NEW -m tcp -p tcp --dport 389 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 636 -j ACCEPT

service iptables restart

yum install openldap-clients pam_ldap nss-pam-ldapd pam_krb5 sssd migrationtools openldap-servers openldap openldap-devel

Note: The steps for creating the certificates are crucial for TLS to work properly and have changed since CentOS 6.0

Backup the old /etc/openldap/certs directory and create a new one so we can generate new certificates

1
2
3
4
5

cd /etc/openldap
mv certs{,_bak} && mkdir certs
cd /etc/openldap/certs
echo "01234567890" > password
echo "jksadhfkjsdhfaks" >> noise.txt

Associate the password with the certificates which will be generated in the current directory

1
2

certutil -N -d . -f /etc/openldap/certs/password
certutil -G -d . -z noise.txt -f /etc/openldap/certs/password

Generate a CA certificate for the server

1

certutil -S -n "CA certificate" -s "cn=CAcert" -x -t "CT,," -m 1000 -v 120 -d . -z /etc/openldap/certs/noise.txt -f /etc/openldap/certs/password

If prompted: Anwsers are Y, enter accepting defaults, Y

Next build the server cert

1

certutil -S -n "OpenLDAP Server" -s "cn=ldap0.localdomain" -c "CA certificate" -t "u,u,u" -m 1001 -v 120 -d . -z /etc/openldap/certs/noise.txt -f /etc/openldap/certs/password

This exports the cacert in case you need it

1

pk12util -d . -o cacert.p12 -n "CA certificate"

Export the CA cert for ldap clients

1

certutil -L -d . -n "CA certificate" -a > /etc/openldap/certs/cacert.pem

Make the files in /etc/openldap/certs readable

1

chmod 644 /etc/openldap/certs/*

Edit /etc/sysconfig/ldap, uncomment SLAPD_LDAPS and change from ‘no’ to ‘yes’

1
2

vi /etc/sysconfig/ldap
SLAPD_LDAPS=yes

Setup the base database to use

1

cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

Set permissions to the ldap user account on /var/lib/ldap

1

chown -Rf ldap:ldap /var/lib/ldap

Create the LDAP administrative password, be sure to save the SSHA generated string so we can add it to the bdb.ldif config file in the next step.

1
2
3
4

slappasswd
New password: <password>
Re-enter new password: <password>
{SSHA}2Gv8HLL8SB5pMTbMB3b5AFAE4A5sDPPE

Open the olcDatabase={1}bdb.ldif file and make the modifications shown below to it. /etc/openldap/slapd.d/cn\=config/olcDatabase\={1}bdb.ldif Change all references in this file from my-domain to your domain name, for example:

1
2
3

olcSuffix: dc=my-domain,dc=com
Would be changed to read:
olcSuffix: dc=localdomain,dc=com

To allow users to modify their passwords, etc, you will have to add the following after the last olcDbIndex line in this file, again replace the domain name with yours.

1
2
3
4
5
6
7
8
9

olcAccess: to attrs=userPassword
       by self write
       by anonymous auth
       by dn.base="cn=Manager,dc=localdomain,dc=com" write
       by * none
olcAccess: to *
       by self write
       by dn.base="cn=Manager,dc=localdomain,dc=com" write
       by * read

Add the following to the end of this file to set the root password (replace the SSHA string with the string saved earlier):

1

olcRootPW: {SSHA}2Gv8HLL8SB5pMTbMB3b5AFAE4A5sDPPE

Next modify the monitoring configuration file changing all references to my-domain to your domain.

/etc/openldap/slapd.d/cn\=config/olcDatabase\={2}monitor.ldif

Test the configuration, start the LDAP server and set it to start at boot.

1
2
3
4
5
6

slaptest -u
config file testing succeeded

service slapd start

chkconfig slapd on

Now we can configure the LDAP client. Do this on the LDAP server first to make sure everything is working properly.

First create the cacerts directory for the client certificates and copy the ldap certificate we created earlier into this directory

1
2

mkdir /etc/openldap/cacerts
cp /etc/openldap/certs/cacert.pem  /etc/openldap/cacerts/

Next use authconfig-tui to configure the client configuration files

1
2
3
4
5
6
7

authconfig-tui
[*] Use LDAP
[*] Use LDAP Authentication
<Next>
[*] Use TLS
Server: ldap://ldapserver.localdomain/
Base DN: dc=localdomain,dc=com

Check if our LDAP server is working and responding to search requests.

1

ldapsearch -x -b "dc=localdomain,dc=com"

You should get a search: 2 somewhere in the output.

Test to make sure encrypted searches are also working.

1

ldapsearch -x -b "dc=localdomain,dc=com" -ZZ

You should get a search: 3 somewhere in the output.

Now we must configure the base domain, and import the information into our LDAP server.

Create the file base.ldif with the following contents:

1
2
3
4
5
6
7
8
9
10
11
12
13
14

dn: dc=localdomain,dc=com
dc: localdomain
objectClass: top
objectClass: domain

dn: ou=People,dc=localdomain,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit

dn: ou=Group,dc=localdomain,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit

Now import the base.ldif file into LDAP.

1
2
3
4
5
6
7

ldapadd -x -W -D "cn=Manager,dc=localdomain,dc=com" -f base.ldif
Enter LDAP Password: <password>
adding new entry "dc=localdomain,dc=com"

adding new entry "ou=People,dc=localdomain,dc=com"

adding new entry "ou=Group,dc=localdomain,dc=com"

Next create a POSIX user that can use our central LDAP server. Create a temporary password for the new user and set the users group. Create the file posix_user.ldif substituting for your environment:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

dn: uid=mnichols,ou=People,dc=localdomain,dc=com
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: Matt Nichols
uid: mnichols
uidNumber: 3000
gidNumber: 3000
homeDirectory: /staff/mnichols
loginShell: /bin/bash
gecos: Matt Nichols,Teacher,Room 16,626-135-0011,409-111-1372
userPassword: {crypt}x
shadowLastChange: 0
shadowMax: 0
shadowWarning: 0

Add the user information to our LDAP server.

1
2
3

ldapadd -x -W -D "cn=Manager,dc=localdomain,dc=com" -f posix_user.ldif
Enter LDAP Password: <password>
adding new entry "uid=mnichols,ou=People,dc=localdomain,dc=com"

Set the new users temporary password.

1

ldappasswd -s newpassword -D "cn=Manager,dc=localdomain,dc=com" -W -x uid=mnichols,ou=People,dc=localdomain,dc=com

Next set the users group up. Create the file posix_group.ldif substituting for your environment:

1
2
3
4
5
6

dn: cn=mnichols,ou=Group,dc=localdomain,dc=com
objectClass: top
objectClass: posixGroup
cn: mnichols
userPassword: {crypt}x
gidNumber: 3000

Add the information to our LDAP server:

1
2
3

ldapadd -x -W -D "cn=Manager,dc=localdomain,dc=com" -f posix_group.ldif
Enter LDAP Password: <password>
adding new entry "cn=mnichols,ou=Group,dc=localdomain,dc=com"

You should now have a fully functioning LDAP server with TLS encryption.

Comments