Skip to content

Latest commit

 

History

History
392 lines (292 loc) · 9.96 KB

20171012_openldap.md

File metadata and controls

392 lines (292 loc) · 9.96 KB

Install OpenLDAP with StartTLS Enabled and Integrate with phpLDAPadmin

Document Objective

  • Configure routing table with the client network topology
  • Install and configure OpenLDAP, with phpLDAPadmin
  • Enable SSL for phpLDAPadmin
  • Enable StartTLS

Reference Document

Steps of OpenLDAP

Install OpenLDAP

sudo apt-get install slapd ldap-utils
sudo apt-get install phpldapadmin
sudo apt-get install apache2-utils

Configure OpenLDAP

Reconfigure slapd
sudo dpkg-reconfigure slapd

And answer

  • Omit OpenLDAP server configuration? No
  • DNS domain name? Example: devops.org
  • Organization name? Example: any
  • Administrator password?
  • Database backend? HDB
  • Remove the database when slapd is purged? No
  • Move old database? Yes
  • Allow LDAPv2 protocol? No

Note: if admin passwordis changed, the configuration /etc/gitlab/gitlab.rb of Gitlab later setup, integrated with LDAP will need to change as well.

Configure phpLDAPadmin

Edit /etc/phpldapadmin/config.php

$servers->setValue('server','name','LDAP @ DevOps');
$servers->setValue('server','host','172.29.167.177');
$servers->setValue('server','base',array('dc=devops,dc=org'));
$servers->setValue('login','auth_type','session');
$servers->setValue('login','bind_id','cn=admin,dc=devops,dc=org');
$servers->setValue('server','tls',false);

Then restart

systemctl restart slapd
systemctl restart apache2

From here, you should be able to access at http://172.29.167.177/phpldapadmin and login as cn=admin,dc=devops,dc=org with password

Steps of StartTLS

Carefully follow the instruction step by step at DigitalOcean: Encrypt OpenLDAP using StartTLS. I just document how I followed anyway and I use vi instead of nano

Setting the Hostname and FQDN

sudo hostnamectl set-hostname ldap

In my case, I use cm02 as ldap host

Edit /etc/hosts

cat /etc/hosts
# 127.0.0.1	cm02.devops.org	cm02
127.0.0.1	localhost

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

172.29.167.171	cm01
172.29.167.177	cm02.devops.org cm02
172.29.167.178	cm03
172.29.167.179	cm04
172.29.167.180	cm05
172.29.167.181	cm06

Test

The hostname or hostname -f should give positive response, like cm02 and cm02.devops.org respectively

Install

sudo apt-get install gnutls-bin ssl-cert

Create the Certificate Templates

sudo mkdir /etc/ssl/templates

Create the CA Template

sudo nano /etc/ssl/templates/ca_server.conf

with the content of

cn = LDAP Server CA
ca
cert_signing_key

Create the LDAP Service Template

sudo nano /etc/ssl/templates/ldap_server.conf

with the content of

organization = "Example Inc"
cn = cm02.devops.org
tls_www_server
encryption_key
signing_key
expiration_days = 3652

where cm02.devops.org is the host with OpenLDAP installed

Create CA Key and Certificate

sudo certtool -p --outfile /etc/ssl/private/ca_server.key
sudo certtool -s --load-privkey /etc/ssl/private/ca_server.key --template /etc/ssl/templates/ca_server.conf --outfile /etc/ssl/certs/ca_server.pem

Create LDAP Service Key and Certificate

sudo certtool -p --sec-param high --outfile /etc/ssl/private/ldap_server.key
sudo certtool -c --load-privkey /etc/ssl/private/ldap_server.key --load-ca-certificate /etc/ssl/certs/ca_server.pem --load-ca-privkey /etc/ssl/private/ca_server.key --template /etc/ssl/templates/ldap_server.conf --outfile /etc/ssl/certs/ldap_server.pem

Give OpenLDAP Access to the LDAP Server Key

sudo usermod -aG ssl-cert openldap
sudo chown :ssl-cert /etc/ssl/private/ldap_server.key
sudo chmod 640 /etc/ssl/private/ldap_server.key

Configure OpenLDAP to Use the Certificate and Keys

cd ~
nano addcerts.ldif
dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/ca_server.pem
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/ldap_server.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/ldap_server.key

Load the file into slapd

sudo ldapmodify -H ldapi:// -Y EXTERNAL -f addcerts.ldif

Restart slapd

sudo service slapd force-reload

Setting up the Client Machines

On the OpenLDAP server
sudo cp /etc/ssl/certs/ca_server.pem /etc/ldap/ca_certs.pem
sudo vi /etc/ldap/ldap.conf

sudo systemctl restart slapd.service

Then specify

TLS_CACERT /etc/ldap/ca_certs.pem
TLS_REQCERT allow

TLS_REQCERT allow has to be set in /etc/ldap/ldap.conf or phpLDAPadmin won't let you login. (this is missed in DigitalOcean's doc).

Test (-Z means upgrade the connection to use starttls)

ldapwhoami -H ldap:// -x -ZZ

Then the expected successful output is anonymous or failed like

ldap_start_tls: Connect error (-11)
    additional info: (unknown error code)

If you have phpLDAPadmin installed, you'd need to edit /etc/phpldapadmin/config.php and change to

$servers->setValue('server','tls',true);

$servers->setValue('server','tls',true); has to be set in /etc/phpldapadmin/config.php (this is missed in DigitalOcean's doc)

Reference > how-to-install-and-configure-openldap-and-phpldapadmin-on-an-ubuntu (over SSL)

Then restart systemctl apache2 restart. You'd be able to login https://cm02.devops.org/phpldapadmin with StartTLS enabled

Configuring Remote Clients

Install apt-get install ldap-utils if not.

Log into the remote client as common user. Copy the CA cert from OpenLDAP server and append to ldap client ca_certs.pem file

scp root@cm02:/etc/ssl/certs/ca_server.pem ~/
cat ~/ca_server.pem | sudo tee -a /etc/ldap/ca_certs.pem

where cm02 is OpenLDAP server

Adjust the Client Configuration

sudo nano /etc/ldap/ldap.conf

with

TLS_CACERT /etc/ldap/ca_certs.pem

Test and you should see anonymous

ubuntu@cm01:~$ ldapwhoami -H ldap://cm02.devops.org -x -ZZ
anonymous
Force Connections to Use TLS (Optional)

On OpenLDAP server, type

sudo ldapsearch -H ldapi:// -Y EXTERNAL -b "cn=config" -LLL -Q "(olcSuffix=*)" dn olcSuffix

The response should look like

dn: olcDatabase={1}hdb,cn=config
olcSuffix: dc=devops,dc=org

Create the LDIF

nano ~/forcetls.ldif

with

dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcSecurity
olcSecurity: tls=1

Then load

sudo ldapmodify -H ldapi:// -Y EXTERNAL -f forcetls.ldif

and restart sudo service slapd force-reload

Test

ubuntu@cm02:~$ ldapsearch -H ldap:// -x -b "dc=devops,dc=org" -LLL -Z dn
dn: dc=devops,dc=org

dn: cn=admin,dc=devops,dc=org

dn: cn=jeff yang,dc=devops,dc=org

ubuntu@cm02:~$

if without -Z, the above command won't work

Error Messages

1. TLS_REQCERT allow has to be set in /etc/ldap/ldap.conf or phpLDAPadmin won't let you login. (this is missed in DigitalOcean's doc). The error message might be

Array
(
    [class] => N/A
    [function] => debug_dump
    [file] => /usr/share/phpldapadmin/lib/functions.php
    [line] => 700
    [debug] => Array
        (
            [Incoming MSG] => Array
                (
                    [title] => Could not start TLS. (DevOps LDAP @ Any)
                    [body] => Error: Could not start TLS. Please check your LDAP server configuration.
                    [type] => error
                )
            [existing] => Array
                (
                    [0] => Array
                        (
                            [title] => Could not start TLS. (DevOps LDAP @ Any)
                            [body] => Error: Could not start TLS. Please check your LDAP server configuration.
                            [type] => error
                        )
                    [1] => Array
                        (
                            [title] => Authenticate to server
                            [body] => Successfully logged into server.
                            [type] => info
                        )
                )
        )
)

2. $servers->setValue('server','tls',true); has to be set in /etc/phpldapadmin/config.php (this is missed in DigitalOcean's doc). The error message could be

Unable to connect to LDAP server DevOps LDAP @ Any
Error: Confidentiality required (13) for user
error	Failed to Authenticate to server
Invalid Username or Password.

Hints

certtool samples of verifying key files
sudo apt install gnutls-bin

certtool --certificate-info --infile /etc/ssl/certs/ca_server.pem
certtool --certificate-info --infile /etc/ssl/certs/ldap_server.pem
Re-sign keys

Reference > https://linux.die.net/man/1/certtool

To create a certificate request (needed when the certificate is issued by another party), run:

$ certtool --generate-request --load-privkey key.pem \
   --outfile request.pem

To generate a certificate using the previous request, use the command:

$ certtool --generate-certificate --load-request request.pem \
   --outfile cert.pem --load-ca-certificate ca-cert.pem \
   --load-ca-privkey ca-key.pem