View source for Configuring TLS or SSL security for openLDAP server

[[Main Page|Home]] > [[CentOS]] > [[CentOS 6.x]] > [[LDAP servers]] > [[OpenLDAP]] > [[Configuring TLS or SSL security for openLDAP server|TLS or SSL Security]]

=Create certificates=

Create CA and server certificates for openldap server.  All certificate generation related steps can be done using [[easy-rsa]] scripts which are supplied with openVPN



=Configuring openldap server to use generated certificates=

To configure openldap server to use generated certificates add following lines to '<tt>slapd.conf</tt>' file before pidfile configuration:
<pre>
#This forces TLS mode to be used by all clients.
security  tls=1

#SSF stands for security strengh factor. By having ssf=1 default ssf for any operation would be set to 1.
#By making update_ssf=112 any update would require security strength factors of up to 112 and by making
#simple_bind=64 simple_bind would require security of atleast 64
#No security has ssf=0; Integrity protection impies ssf=1; DES and other weak cyphers have ssf=56; 
#Triple DES and other strong have ssf=112; RC4, Bluefish and other strong cyphers have ssf=128. Hence
#ssf is roughly equivalent to encryption key length in bits.
security    ssf=1 update_ssf=112 simple_bind=64


TLSVerifyClient  allow
TLSCACertificateFile /etc/pki/CA/newcerts/ca.virtual-labs.ac.in.cert.pem
TLSCertificateFile /etc/pki/tls/ldap.virtual-labs.ac.in-cert.pem
TLSCertificateKeyFile /etc/pki/tls/ldap.virtual-labs.ac.in-key.pem
</pre>

The server can be run using command:
<pre>
slapd -h 'ldap:/// ldaps:///' -u ldap -f /etc/openldap/slapd.conf
</pre>
which indicates that server should support both ldap:// and ldaps:// and also that it should be run using user ldap. Finally configuration file to be used is /etc/openldap/slapd.conf. It would be good to do '<tt>chown -R ldap:ldap /var/lid/ldap</tt>' before doing this so that user ldap has sufficient access rights. Also ensure that user ldap has permission to read the used certificates and keys, if they are moved elsewhere after generation. Finally, check whether slapd is running or not using '<tt>ps aux | grep slapd</tt>' and debug by running with '<tt>-d 1</tt>' option, if required.

'''For the setup to work the hostname of the ldap server must be set to '<tt>ldap.virtual-labs.ac.in</tt>' as mentioned in cn in certificate. For name to work either /etc/hosts or DNS server should convert from name to correct IP address of the ldap server. Verify using '<tt>hostname</tt>' command that the name setup is correct. The same should also be entered in '<tt>/etc/openldap/ldap.conf</tt>' file as ldap server. Also verify that name to IP conversion is working by using <tt>ping</tt>'''



=Testing generated certificates=

To test generated certificates save following as a shell script:
<pre>
#!/bin/sh
OPENSSL_TEST="openssl s_client -connect 10.3.1.21:636 -showcerts -state -CAfile"

function testCA {
        ${OPENSSL_TEST} /etc/pki/CA/newcerts/ca.virtual-labs.ac.in.cert.pem
}

function testCerts {
        ${OPENSSL_TEST} /etc/pki/CA/newcerts/ca.virtual-labs.ac.in.cert.pem \
        -cert           /etc/pki/tls/ldap.virtual-labs.ac.in-cert.pem \
        -key            /etc/pki/tls/ldap.virtual-labs.ac.in-key.pem
}
# Test 'Certificate of Issuing Authority'
testCA
# Test 'Server Certificate' and 'Server Key Certificate'
testCerts
</pre>
Remember to replace '10.3.1.21' in above script and even the certificate file-names and path correctly.

Then run using '<tt>./&lt;script_filename.sh&gt;</tt>'. The ideal output should end with lines:
<pre>
    Verify return code: 0 (ok)
---
</pre>



=Debugging connection issues=

Sometimes ldap server is not able to listen on port 636 as portreserve or other application is blocking it. To debug try following approaches:
*Try to connect to server using telnet such as '<tt>telnet 10.3.1.21 636</tt>' and verify that connection works.
*:If connection fails then try to stop portreserve using '<tt>service portreserve stop</tt>'
*You can also try to force openldap to listen on 636 for ldaps using '<tt>slapd -h 'ldap:/// ldaps://0.0.0.0:636/' -u ldap -f /etc/openldap/slapd.conf</tt>'
*:If the above command fails then try to debug using '<tt>-d 1</tt>'



=Configuring SSL ldap client=

To configure SSL ldap client modify '<tt>/etc/openldap/ldap.conf</tt>' file so that it has:
<pre>
BASE	dc=sbarjatiya,dc=com
URI    ldaps://ldap.virtual-labs.ac.in/
#TLS_CACERTDIR	/etc/openldap/certs
TLS_CACERT /etc/pki/CA/newcerts/ca.virtual-labs.ac.in.cert.pem
</pre>
Note that '<tt>TLC_CACERTDIR</tt>' should be commented for setup to work.


==Downloading certificate on client from server==
If a server is not deployed by the same admin than the server certificate can be downloaded and put in cacert directory using following steps:

#Run
#:<pre>
#::openssl s_client -connect {HOSTNAME}:{PORT} -showcerts
#:</pre>
# cd /etc/openldap/cacerts
# Save area between BEGIN_CERTIFICATE and END_CERTIFICATE from openssl output (including these two lines) in cacert.pem file
# Restart appropriate service and check again.  If necessary reboot system.

Learned from www.linuxquestions.org/questions/linux-enterprise-47/rhel-6-ldap-now-requires-tls-843917/



==Verifying client configuration==

If simple anonymous bind is enabled try using:
<pre>
ldapwhoami -x
</pre>
If /etc/openldap/ldap.conf specified URI as ldaps:// then this would result into TLS secured connection

If SSL is required then use:
<pre>
ldapwhoami -x -ZZ
</pre>
If /etc/openldap/ldap.conf specified URI as ldaps:// then this command may give TLS_already started error

For SSL with authentication use:
<pre>
ldapwhoami -x -ZZ -D 'cn=Saurabh Barjatiya,ou=people,dc=sbarjatiya,dc=com' -W
</pre>
OR
<pre>
ldapwhoami -x -D 'cn=Saurabh Barjatiya,ou=people,dc=sbarjatiya,dc=com' -W -H 'ldaps://ldap.virtual-labs.ac.in/'
</pre>
Thus, both -ZZ or -H 'ldaps://' can be used to indicate SSL based authentication.





[[Main Page|Home]] > [[CentOS]] > [[CentOS 6.x]] > [[LDAP servers]] > [[OpenLDAP]] > [[Configuring TLS or SSL security for openLDAP server|TLS or SSL Security]]