LDAP Linux LDAP TLS: различия между версиями

Материал из noname.com.ua
Перейти к навигацииПерейти к поиску
Строка 335: Строка 335:
 
<PRE>
  
<PRE>
 
ldapmodify -Y EXTERNAL -H ldapi:/// <3201_install_tls_certs.ldif
  
ldapmodify -Y EXTERNAL -H ldapi:/// <3201_install_tls_certs.ldif
−
</PRE>
  
−  
−
==3==
  
−
<PRE>
  
−
</PRE>
  
−  
−
<PRE>
  
−
</PRE>
  
−
==3==
  
−
<PRE>
  
−
</PRE>
  
−  
−
<PRE>
  
−
</PRE>
  
−  
−
==3==
  
−
==3==
  
−
==3==
  
−
==3==
  
−
==3==
  
−
==3==
  
−
==3==
  
−
==3==
  
−
==3==
  
−  
−  
−  
−  
−  
−  
−  
−  
−  
−
<PRE>
  
−
\ldapmodify -Y EXTERNAL -H ldapi:/// < 01_certs.ldif
  
−
</PRE>
  
−
<PRE>
  
−
SASL/EXTERNAL authentication started
  
−
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
  
−
SASL SSF: 0
  
−
modifying entry "cn=config"
  
−
</PRE>
  
−
<PRE>
  
−
\ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config -s base
  
−
</PRE>
  
−
Вывод:
  
−
<PRE>
  
−
# config
  
−
dn: cn=config
  
−
objectClass: olcGlobal
  
−
cn: config
  
−
olcArgsFile: /var/run/slapd/slapd.args
  
−
olcLogLevel: none
  
−
olcPidFile: /var/run/slapd/slapd.pid
  
−
olcToolThreads: 1
  
−
olcTLSVerifyClient: never
  
−
olcTLSCertificateFile: /etc/ldap/ssl/ldap-srv.example.com.crt
  
−
olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap-srv.example.com.key
  
−
olcTLSCACertificateFile: /etc/ssl/certs/rootca.crt
  
−
</PRE>
  
−  
−  
−  
−  
−  
−
<PRE>
  
−
root@node-3:/etc/ldap# netstat -ntpl | grep slap
  
−
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 2875/slapd
  
−
tcp6 0 0 :::389 :::* LISTEN 2875/slapd
  
−
</PRE>
  
−
<PRE>
  
−
# /etc/init.d/slapd restart
  
−
* Stopping OpenLDAP slapd [ OK ]
  
−
* Starting OpenLDAP slapd [ OK ]
  
−
</PRE>
  
−
<PRE>
  
−
# netstat -ntpl | grep slap
  
−
tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 6294/slapd
  
−
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 6294/slapd
  
−
tcp6 0 0 :::636 :::* LISTEN 6294/slapd
  
−
tcp6 0 0 :::389 :::* LISTEN 6294/slapd
  
−
</PRE>
  
−  
−  
−  
−
==Проверка==
  
−
<PRE>
  
−
gnutls-cli -p 636 ldap1 -d 1 --print-cert --x509cafile /etc/ssl/certs/rootca.crt
  
−
</PRE>
  
−
<PRE>
  
−
Processed 1 CA certificate(s).
  
−
Resolving 'ldap1'...
  
−
Connecting to '10.20.0.3:636'...
  
−
- Certificate type: X.509
  
−
- Got a certificate list of 2 certificates.
  
−
- Certificate[0] info:
  
−
- subject `C=UA,ST=Kharkov,O=MirantisInc,OU=ServicesDepartment,CN=ldap1,EMAIL=mmaxur@mirantis.com', issuer `C=UA,ST=Kharkov,L=Kharkov,O=MirantisInc,OU=ServicesDepartment,CN=ca-server,EMAIL=mmaxur@mirantis.com', RSA key 4096 bits, signed using RSA-SHA256, activated `2016-05-26 10:25:31 UTC', expires `2026-05-24 10:25:31 UTC', SHA-1 fingerprint `c07f85c03b773984ed3c4df7530b4d2366f4dad6'
  
−  
−
-----BEGIN CERTIFICATE-----
  
−
MIIGKjCCBBKgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZwxCzAJBgNVBAYTAlVB
  
−
MRAwDgYDVQQIDAdLaGFya292MRAwDgYDVQQHDAdLaGFya292MRQwEgYDVQQKDAtN
  
−
aXJhbnRpc0luYzEbMBkGA1UECwwSU2VydmljZXNEZXBhcnRtZW50MRIwEAYDVQQD
  
−
DAljYS1zZXJ2ZXIxIjAgBgkqhkiG9w0BCQEWE21tYXh1ckBtaXJhbnRpcy5jb20w
  
−
HhcNMTYwNTI2MTAyNTMxWhcNMjYwNTI0MTAyNTMxWjCBhjELMAkGA1UEBhMCVUEx
  
−
EDAOBgNVBAgMB0toYXJrb3YxFDASBgNVBAoMC01pcmFudGlzSW5jMRswGQYDVQQL
  
−
DBJTZXJ2aWNlc0RlcGFydG1lbnQxDjAMBgNVBAMMBWxkYXAxMSIwIAYJKoZIhvcN
  
−
AQkBFhNtbWF4dXJAbWlyYW50aXMuY29tMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
  
−
MIICCgKCAgEA17ksfFHcbpLGQyJfvu4gfDhcmFQr4Le6UiLfefKugtaB4dX5c6Fd
  
−
4h2EHWCtkrZAZiXvRnNavSxaU+VNLraFjpIILUbzbg/2uYYIPofy9RQzdqDJhnKj
  
−
1avVPPH19YIfTWHP07Y/flH3Ac/QR2uiSFitJrjLU8LsjEXwLRYhewPukWrj5Uqa
  
−
oaCIUr91V0NMX6qKlJA/Ri9j3yI/P9UsvNjANDSiqI4EqKZkxsN+ck4eZAcjFUYR
  
−
vomu0LO7mPxHUekzJhN3Gl6Yt4meyH5fP3HnHOYk93hKL78hewZ2riEv7Nwwg+zy
  
−
Hb0RG9Mfx0Yz6it/fwT3obycWXhBab2FgLW5K1yYiqLo1oVfl80MO5ZNsNK4WMcy
  
−
qQx60i2qLT48+uC6LgUOzhFWjTlTMsEOgj35EJn3rsjUUJpdtA6SiXJpE6lVFoRu
  
−
ACt+Iwqu7Dq9QuJKeYcGmWsatMPkpeWz93pV1TT2rtdABJgeiIKDtJWu8Oh2Y/NV
  
−
vwqAghprjO84Vlxqq9xkXX8YvRRN8bwLSWlyCj2QDcRhLjDTeGqk0qUuV+nNfOBh
  
−
bJ6MX3IhOhu55VjzFdGcOd/cZzg+yGugPFsT2WXDp1sxROGf3MLhBbymG2egh98k
  
−
qFzTAM2DXGB8ZkfxEuaRW3rNA3Fjg2kElKP+6GaUYtEj4MTbuoppBBsCAwEAAaOB
  
−
iTCBhjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAsBglghkgBhvhCAQ0EHxYdT3Bl
  
−
blNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFFpPbsihmyodcQkK
  
−
ii7/IArfCH8sMB8GA1UdIwQYMBaAFP5rBQIiPdv/ZXeLeTPV2KJ1JR8iMA0GCSqG
  
−
SIb3DQEBCwUAA4ICAQCdfkpuE69mGfQwLe2kHEA45TPjogOalPp8H73dqLDxE80T
  
−
s1W5XyJBZQccpVFoXS25M9fDeWjuvMTwdIP6q6DDArC1lVs0zdAOhTt6POpI7Cvu
  
−
zrBM/wa6YUVZtXSM4Qtw4tE3Nx71s9Tp2jVra75RvjQrUnISwPfop3zapzCpTqEQ
  
−
zvrl5Vsfd0AMmN1RKoFdYQr6LX7nInf029a8IBOCXzv6Ufd3NwxxelKkO2U49XYo
  
−
tFycxyDzo/B//cS8b8a7fu3yysP8W5b3oNgE6Tth1vR3zLy4uiwpIi6ptYBUlkG+
  
−
gqIXzqI+2MIyYWaA3UXIfRhi7j3CENGIA1TAAPSvfFnolYiFSXiY28b6P2nyl8WC
  
−
xCySbdZtGh+fvxeP+cNl1VMDEmU94XDIgA7Nl5yacPLY4GwKnjAkfyp4uL9dYvJV
  
−
1wKgzYohF1Elm6YiPa2Wv1fuMNkT9iZ0DMyLV4ixxkKkuuCXCLKXmg4REQPsnE6V
  
−
Eu/tQ6mfUugO6+d1ZkI/iAc0cjNtjrOKhS/Fsb49UWThjM+pyOFVO0hMybKYBwZL
  
−
1JDiwSM1uYts3TUxLBNb4SXeYoqZRFoFJiP14yjw9j0nuU1Au7ginFf0IYYq2VHI
  
−
M7woolzYH+/vlOK+5aQrgcsanCy/7s4prux4IRTx5SGzqW+idA2UW26+5WyKbg==
  
−
-----END CERTIFICATE-----
  
−  
−
- Certificate[1] info:
  
−
- subject `C=UA,ST=Kharkov,L=Kharkov,O=MirantisInc,OU=ServicesDepartment,CN=ca-server,EMAIL=mmaxur@mirantis.com', issuer `C=UA,ST=Kharkov,L=Kharkov,O=MirantisInc,OU=ServicesDepartment,CN=ca-server,EMAIL=mmaxur@mirantis.com', RSA key 4096 bits, signed using RSA-SHA256, activated `2016-05-26 10:16:07 UTC', expires `2026-05-24 10:16:07 UTC', SHA-1 fingerprint `0f74fdaf2195ae2b1f599e3963e3b18970cb81a3'
  
−  
−
-----BEGIN CERTIFICATE-----
  
−
MIIGGjCCBAKgAwIBAgIJAN1rpxx3AA9AMA0GCSqGSIb3DQEBCwUAMIGcMQswCQYD
  
−
VQQGEwJVQTEQMA4GA1UECAwHS2hhcmtvdjEQMA4GA1UEBwwHS2hhcmtvdjEUMBIG
  
−
A1UECgwLTWlyYW50aXNJbmMxGzAZBgNVBAsMElNlcnZpY2VzRGVwYXJ0bWVudDES
  
−
MBAGA1UEAwwJY2Etc2VydmVyMSIwIAYJKoZIhvcNAQkBFhNtbWF4dXJAbWlyYW50
  
−
aXMuY29tMB4XDTE2MDUyNjEwMTYwN1oXDTI2MDUyNDEwMTYwN1owgZwxCzAJBgNV
  
−
BAYTAlVBMRAwDgYDVQQIDAdLaGFya292MRAwDgYDVQQHDAdLaGFya292MRQwEgYD
  
−
VQQKDAtNaXJhbnRpc0luYzEbMBkGA1UECwwSU2VydmljZXNEZXBhcnRtZW50MRIw
  
−
EAYDVQQDDAljYS1zZXJ2ZXIxIjAgBgkqhkiG9w0BCQEWE21tYXh1ckBtaXJhbnRp
  
−
cy5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCuZEMVa87WGQJl
  
−
1foQGNt4Qh/CWcggjjIqn8IYSPPtqn3YAxvUnubA+DQxkH7PNYR6G9PdNgQon2mV
  
−
xvwVFL6YouDkPtEO101B3vM28U3vEEOSLUcign+2XqzKf7lqyXzMK7/wk+iubAfH
  
−
hVhXosC+TSwH+eywO1lo2vbOZkf93ZiURDEZfixcMLuYMM8xdOeWeWtnQIA7D8QF
  
−
E5wADWXaYpMlmZzHmmtx76l5BGZL75pG0YkAexllu5idlqADhN77xGM69ZSV/pYJ
  
−
apMRhy4z0e17UzEbGWgv6OnUNhwGhOCgyIRk7PTKyjU+mxh3qdoNaqNt7Jj60EB7
  
−
dvzHeosrizcYaFwaqbBxVRMKJOcNYh7ZYlyrdexa9Wau3xf0NFvyBZ8rvsBv9Ax+
  
−
xuRCq2uVGc3rQHZzkwocquAgACY+1GpxFtpNUBhvmi25TUbm8OkAq7lYpf2sptJH
  
−
ReZf4EdHhWuHLI93X5Pm6cb0uE+85kuJPNGMprcwvWM5QiT1N56LAVKiApZTSqo8
  
−
bcuJZs+nXI4IrYRXjCn75E0LLRpVLXc7+vfKHgHClL9/bhOxcOdwyXejnDQVzWe4
  
−
5JvwzLtL3/4KDiTLjG4foJztosxn92cAJAp30cdUalf7QkEFqp5RCvRY2vFVosM5
  
−
0Vu3bicGcyucHyxigxWP44qpaJe9WwIDAQABo10wWzAdBgNVHQ4EFgQU/msFAiI9
  
−
2/9ld4t5M9XYonUlHyIwHwYDVR0jBBgwFoAU/msFAiI92/9ld4t5M9XYonUlHyIw
  
−
DAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQELBQADggIBAHMZ
  
−
609hm52CYxouUnvH+timAgiqbVv8QCb6IzgM5uRNejlxTzj63RBFvxC6n2UPqBpj
  
−
yGtYuwpO249e+sD01ZS0r4B69a3yBePH6Ay4leqfStuqc9dcyamK7lQk8PAsF4wv
  
−
yrywNpgGbecDReHJPrOmc5nQw3AlhwcwceHHS7mqaS+SWj1md97saD8uqHK0O5vu
  
−
PFlJUKiztQqR2PMPWiKw+Pjri+RAXHj4TCxjPt5Z0wSR+xP/YE1MymvegPUrZ7/7
  
−
rFWuqfHDVLh7IA16q+h1xU+FMnVdiPigEJ+Omn6dDfqHD9BBcKOUFYOJiXtG4TDc
  
−
tX401kpG1Qm00kS3XtveQgGPF1OWNLyyDr1dDy8/B+77W1yli/VbzK6H4jwrVGy7
  
−
EAEzpfbwRJnSIIUczG8//1G6a5yrpcjohKhWY1uBrv56LJdq16OVN3aK5nacMKmQ
  
−
p+YpPu/ZT5LVUOzt8I32Q8i1Tn9YZma7vEftvGCZKVcgqlVIpb3P7/7dyRXoMuFD
  
−
bErDIDxScMvg82Vg2JF4NzaOp+CXRAYuXbel5anoFOt7FFfnO2w0/aLQpAT+jpze
  
−
qcL37IGyCGxOloej7NkdQsX9eJJNIdy5oLjniJ8/d402A0zziPdfrqa0c3FpGukZ
  
−
syWlWH0RCerDgVmq+i6l5zGbtx/tKPpLYcJkAetJ
  
−
-----END CERTIFICATE-----
  
−  
−
- The hostname in the certificate matches 'ldap1'.
  
−
- Peer's certificate is trusted
  
−
- Version: TLS1.2
  
−
- Key Exchange: RSA
  
−
- Cipher: AES-128-CBC
  
−
- MAC: SHA1
  
−
- Compression: NULL
  
−
- Handshake was completed
  
−  
−
- Simple Client Mode:
  
 
</PRE>
  
</PRE>

Версия 13:16, 30 мая 2016

LDAP Шифрование

ТУТ я просто дублирую статью со своими комментариями.


1

0010_prepere_CA.sh

mkdir /root/CA

chmod u=rwx,g=,o= /root/CA
pushd /root/CA
umask 066


mkdir certs crl newcerts private.
chmod 700 private
touch index.txt
echo 1000 > serial


# Create key pass = r00tme
openssl genrsa -aes256 -out private/rootca.key 4096
chmod 400 private/rootca.key
chattr +i private/rootca.key

popd

2

0011_rootCa_crt.sh

openssl req \
-sha256 \
-new \
-x509 \
-days 3650 \
-extensions v3_ca \
-key private/rootca.key \
-out certs/rootca.crt \
-subj /C=UA/ST=Kharkov/L=Kharkov/O=MirantisInc/OU=ServicesDepartment/CN=ca-server/emailAddress=mmaxur@mirantis.com

chmod 444 certs/rootca.crt
chattr +i certs/rootca.crt

openssl x509 -in certs/rootca.crt -noout -text

popd

3

0012_private_key_for_ldap1.sh

pushd /root/CA
openssl genrsa \
-out private/ldap1.key 4096

chmod 400 private/ldap1.key

popd

3

0013_create_cert_request_for_ldap1.sh

pushd /root/CA

openssl req \
-sha256 -new \
-key private/ldap1.key \
-out certs/ldap1.csr \
-subj /C=UA/ST=Kharkov/L=Kharkov/O=MirantisInc/OU=ServicesDepartment/CN=ldap1/emailAddress=mmaxur@mirantis.com

popd

3

0014_create_and_sign_cert_for_ldap1.sh

pushd /root/CA

openssl ca \
-extensions usr_cert \
-notext \
-md sha256 \
-keyfile private/rootca.key \
-cert certs/rootca.crt \
-in certs/ldap1.csr \
-out certs/ldap1.crt

chmod 444 certs/ldap1.crt

popd

3

0015_move_certs_to_ldap_config_dir.sh

pushd /root/CA

mkdir /etc/ldap/ssl
chown openldap:openldap /etc/ldap/ssl
chmod 0500 /etc/ldap/ssl
cp certs/ldap1.crt private/ldap1.key /etc/ldap/ssl


chown openldap:openldap /etc/ldap/ssl/{ldap1.crt,ldap1.key}
chmod 0400 /etc/ldap/ssl/{ldap1.crt,ldap1.key}

cp certs/rootca.crt /etc/ssl/certs/

chmod 0644 /etc/ssl/certs/rootca.crt

popd

3

0016_check_cert.sh

openssl verify -verbose -CAfile /etc/ssl/certs/rootca.crt  /etc/ldap/ssl/ldap1.crt

3

0201_install_tls_certs.ldif

dn: cn=config
add: olcTLSVerifyClient
olcTLSVerifyClient: never
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ldap/ssl/ldap1.crt
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap1.key
-
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/rootca.crt



0202_configure_ldap_to_use_tls.sh

ldapmodify -Y EXTERNAL -H ldapi:/// <0201_install_tls_certs.ldif

3

0203_check_config.sh

ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b cn=config -s base | grep -i tls

3

0204_check_tls_connection.sh

gnutls-cli \
-p 636 ldap1 \
-d 1 \
--print-cert \
--x509cafile  /etc/ssl/certs/rootca.crt

3

1012_private_key_for_ldap2.sh

pushd /root/CA
openssl genrsa \
-out private/ldap2.key 4096


chmod 400 private/ldap2.key


popd

3

1013_create_cert_request_for_ldap2.sh

pushd /root/CA


openssl req \
-sha256 -new \
-key private/ldap2.key \
-out certs/ldap2.csr \
-subj /C=UA/ST=Kharkov/L=Kharkov/O=MirantisInc/OU=ServicesDepartment/CN=ldap2/emailAddress=mmaxur@mirantis.com

popd

3

1014_create_and_sign_cert_for_ldap2.sh

pushd /root/CA

openssl ca \
-extensions usr_cert \
-notext \
-md sha256 \
-keyfile private/rootca.key \
-cert certs/rootca.crt \
-in certs/ldap2.csr \
-out certs/ldap2.crt

chmod 444 certs/ldap2.crt

popd

3

2012_private_key_for_ldap.sh

pushd /root/CA
openssl genrsa \
-out private/ldap.key 4096

chmod 400 private/ldap.key

popd

3

2013_create_cert_request_for_ldap.sh

pushd /root/CA


openssl req \
-sha256 -new \
-key private/ldap.key \
-out certs/ldap.csr \
-subj /C=UA/ST=Kharkov/L=Kharkov/O=MirantisInc/OU=ServicesDepartment/CN=ldap/emailAddress=mmaxur@mirantis.com


popd

3

2014_create_and_sign_cert_for_ldap.sh

pushd /root/CA

openssl ca \
-extensions usr_cert \
-notext \
-md sha256 \
-keyfile private/rootca.key \
-cert certs/rootca.crt \
-in certs/ldap.csr \
-out certs/ldap.crt

chmod 444 certs/ldap.crt

popd

3

3201_install_tls_certs.ldif

dn: cn=config
replace: olcTLSVerifyClient
olcTLSVerifyClient: never
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ldap/ssl/ldap.crt
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap.key
-
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/rootca.crt

3202_configure_ldap_to_u~s_one_name_on_cluster.sh

ldapmodify -Y EXTERNAL -H ldapi:/// <3201_install_tls_certs.ldif
Источник — https://noname.com.ua/mediawiki/index.php?title=LDAP_Linux_LDAP_TLS&oldid=7755