LDAP Linux LDAP TLS
Материал из noname.com.ua
LDAP Шифрование
ТУТ я просто дублирую статью со своими комментариями.
1
0010_prepere_CA.sh
mkdir /root/CA chmod u=rwx,g=,o= /root/CA pushd /root/CA umask 066 mkdir certs crl newcerts private. chmod 700 private touch index.txt echo 1000 > serial # Create key pass = r00tme openssl genrsa -aes256 -out private/rootca.key 4096 chmod 400 private/rootca.key chattr +i private/rootca.key popd
2
0011_rootCa_crt.sh
openssl req \ -sha256 \ -new \ -x509 \ -days 3650 \ -extensions v3_ca \ -key private/rootca.key \ -out certs/rootca.crt \ -subj /C=UA/ST=Kharkov/L=Kharkov/O=MirantisInc/OU=ServicesDepartment/CN=ca-server/emailAddress=mmaxur@mirantis.com chmod 444 certs/rootca.crt chattr +i certs/rootca.crt openssl x509 -in certs/rootca.crt -noout -text popd
3
0012_private_key_for_ldap1.sh
pushd /root/CA openssl genrsa \ -out private/ldap1.key 4096 chmod 400 private/ldap1.key popd
3
0013_create_cert_request_for_ldap1.sh
pushd /root/CA openssl req \ -sha256 -new \ -key private/ldap1.key \ -out certs/ldap1.csr \ -subj /C=UA/ST=Kharkov/L=Kharkov/O=MirantisInc/OU=ServicesDepartment/CN=ldap1/emailAddress=mmaxur@mirantis.com popd
3
0014_create_and_sign_cert_for_ldap1.sh
pushd /root/CA openssl ca \ -extensions usr_cert \ -notext \ -md sha256 \ -keyfile private/rootca.key \ -cert certs/rootca.crt \ -in certs/ldap1.csr \ -out certs/ldap1.crt chmod 444 certs/ldap1.crt popd
3
0015_move_certs_to_ldap_config_dir.sh
pushd /root/CA
mkdir /etc/ldap/ssl
chown openldap:openldap /etc/ldap/ssl
chmod 0500 /etc/ldap/ssl
cp certs/ldap1.crt private/ldap1.key /etc/ldap/ssl
chown openldap:openldap /etc/ldap/ssl/{ldap1.crt,ldap1.key}
chmod 0400 /etc/ldap/ssl/{ldap1.crt,ldap1.key}
cp certs/rootca.crt /etc/ssl/certs/
chmod 0644 /etc/ssl/certs/rootca.crt
popd
3
0016_check_cert.sh
openssl verify -verbose -CAfile /etc/ssl/certs/rootca.crt /etc/ldap/ssl/ldap1.crt
3
0201_install_tls_certs.ldif
dn: cn=config add: olcTLSVerifyClient olcTLSVerifyClient: never - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ldap/ssl/ldap1.crt - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap1.key - add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/certs/rootca.crt
0202_configure_ldap_to_use_tls.sh
ldapmodify -Y EXTERNAL -H ldapi:/// <0201_install_tls_certs.ldif
3
0203_check_config.sh
ldapsearch -QLLLY EXTERNAL -H ldapi:/// -b cn=config -s base | grep -i tls
3
0204_check_tls_connection.sh
gnutls-cli \ -p 636 ldap1 \ -d 1 \ --print-cert \ --x509cafile /etc/ssl/certs/rootca.crt
3
1012_private_key_for_ldap2.sh
pushd /root/CA openssl genrsa \ -out private/ldap2.key 4096 chmod 400 private/ldap2.key popd
3
1013_create_cert_request_for_ldap2.sh
pushd /root/CA openssl req \ -sha256 -new \ -key private/ldap2.key \ -out certs/ldap2.csr \ -subj /C=UA/ST=Kharkov/L=Kharkov/O=MirantisInc/OU=ServicesDepartment/CN=ldap2/emailAddress=mmaxur@mirantis.com popd
3
1014_create_and_sign_cert_for_ldap2.sh
pushd /root/CA openssl ca \ -extensions usr_cert \ -notext \ -md sha256 \ -keyfile private/rootca.key \ -cert certs/rootca.crt \ -in certs/ldap2.csr \ -out certs/ldap2.crt chmod 444 certs/ldap2.crt popd
3
2012_private_key_for_ldap.sh
pushd /root/CA openssl genrsa \ -out private/ldap.key 4096 chmod 400 private/ldap.key popd
3
2013_create_cert_request_for_ldap.sh
pushd /root/CA openssl req \ -sha256 -new \ -key private/ldap.key \ -out certs/ldap.csr \ -subj /C=UA/ST=Kharkov/L=Kharkov/O=MirantisInc/OU=ServicesDepartment/CN=ldap/emailAddress=mmaxur@mirantis.com popd
3
2014_create_and_sign_cert_for_ldap.sh
pushd /root/CA openssl ca \ -extensions usr_cert \ -notext \ -md sha256 \ -keyfile private/rootca.key \ -cert certs/rootca.crt \ -in certs/ldap.csr \ -out certs/ldap.crt chmod 444 certs/ldap.crt popd
3
3201_install_tls_certs.ldif
dn: cn=config replace: olcTLSVerifyClient olcTLSVerifyClient: never - replace: olcTLSCertificateFile olcTLSCertificateFile: /etc/ldap/ssl/ldap.crt - replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap.key - replace: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/certs/rootca.crt
3
3
3
3
3
3
3
3
3
3
3
3
\ldapmodify -Y EXTERNAL -H ldapi:/// < 01_certs.ldif
SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config"
\ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config -s base
Вывод:
# config dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: none olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 olcTLSVerifyClient: never olcTLSCertificateFile: /etc/ldap/ssl/ldap-srv.example.com.crt olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap-srv.example.com.key olcTLSCACertificateFile: /etc/ssl/certs/rootca.crt
root@node-3:/etc/ldap# netstat -ntpl | grep slap tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 2875/slapd tcp6 0 0 :::389 :::* LISTEN 2875/slapd
# /etc/init.d/slapd restart * Stopping OpenLDAP slapd [ OK ] * Starting OpenLDAP slapd [ OK ]
# netstat -ntpl | grep slap tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 6294/slapd tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 6294/slapd tcp6 0 0 :::636 :::* LISTEN 6294/slapd tcp6 0 0 :::389 :::* LISTEN 6294/slapd
Проверка
gnutls-cli -p 636 ldap1 -d 1 --print-cert --x509cafile /etc/ssl/certs/rootca.crt
Processed 1 CA certificate(s). Resolving 'ldap1'... Connecting to '10.20.0.3:636'... - Certificate type: X.509 - Got a certificate list of 2 certificates. - Certificate[0] info: - subject `C=UA,ST=Kharkov,O=MirantisInc,OU=ServicesDepartment,CN=ldap1,EMAIL=mmaxur@mirantis.com', issuer `C=UA,ST=Kharkov,L=Kharkov,O=MirantisInc,OU=ServicesDepartment,CN=ca-server,EMAIL=mmaxur@mirantis.com', RSA key 4096 bits, signed using RSA-SHA256, activated `2016-05-26 10:25:31 UTC', expires `2026-05-24 10:25:31 UTC', SHA-1 fingerprint `c07f85c03b773984ed3c4df7530b4d2366f4dad6' -----BEGIN CERTIFICATE----- MIIGKjCCBBKgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZwxCzAJBgNVBAYTAlVB MRAwDgYDVQQIDAdLaGFya292MRAwDgYDVQQHDAdLaGFya292MRQwEgYDVQQKDAtN aXJhbnRpc0luYzEbMBkGA1UECwwSU2VydmljZXNEZXBhcnRtZW50MRIwEAYDVQQD DAljYS1zZXJ2ZXIxIjAgBgkqhkiG9w0BCQEWE21tYXh1ckBtaXJhbnRpcy5jb20w HhcNMTYwNTI2MTAyNTMxWhcNMjYwNTI0MTAyNTMxWjCBhjELMAkGA1UEBhMCVUEx EDAOBgNVBAgMB0toYXJrb3YxFDASBgNVBAoMC01pcmFudGlzSW5jMRswGQYDVQQL DBJTZXJ2aWNlc0RlcGFydG1lbnQxDjAMBgNVBAMMBWxkYXAxMSIwIAYJKoZIhvcN AQkBFhNtbWF4dXJAbWlyYW50aXMuY29tMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A MIICCgKCAgEA17ksfFHcbpLGQyJfvu4gfDhcmFQr4Le6UiLfefKugtaB4dX5c6Fd 4h2EHWCtkrZAZiXvRnNavSxaU+VNLraFjpIILUbzbg/2uYYIPofy9RQzdqDJhnKj 1avVPPH19YIfTWHP07Y/flH3Ac/QR2uiSFitJrjLU8LsjEXwLRYhewPukWrj5Uqa oaCIUr91V0NMX6qKlJA/Ri9j3yI/P9UsvNjANDSiqI4EqKZkxsN+ck4eZAcjFUYR vomu0LO7mPxHUekzJhN3Gl6Yt4meyH5fP3HnHOYk93hKL78hewZ2riEv7Nwwg+zy Hb0RG9Mfx0Yz6it/fwT3obycWXhBab2FgLW5K1yYiqLo1oVfl80MO5ZNsNK4WMcy qQx60i2qLT48+uC6LgUOzhFWjTlTMsEOgj35EJn3rsjUUJpdtA6SiXJpE6lVFoRu ACt+Iwqu7Dq9QuJKeYcGmWsatMPkpeWz93pV1TT2rtdABJgeiIKDtJWu8Oh2Y/NV vwqAghprjO84Vlxqq9xkXX8YvRRN8bwLSWlyCj2QDcRhLjDTeGqk0qUuV+nNfOBh bJ6MX3IhOhu55VjzFdGcOd/cZzg+yGugPFsT2WXDp1sxROGf3MLhBbymG2egh98k qFzTAM2DXGB8ZkfxEuaRW3rNA3Fjg2kElKP+6GaUYtEj4MTbuoppBBsCAwEAAaOB iTCBhjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAsBglghkgBhvhCAQ0EHxYdT3Bl blNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFFpPbsihmyodcQkK ii7/IArfCH8sMB8GA1UdIwQYMBaAFP5rBQIiPdv/ZXeLeTPV2KJ1JR8iMA0GCSqG SIb3DQEBCwUAA4ICAQCdfkpuE69mGfQwLe2kHEA45TPjogOalPp8H73dqLDxE80T s1W5XyJBZQccpVFoXS25M9fDeWjuvMTwdIP6q6DDArC1lVs0zdAOhTt6POpI7Cvu zrBM/wa6YUVZtXSM4Qtw4tE3Nx71s9Tp2jVra75RvjQrUnISwPfop3zapzCpTqEQ zvrl5Vsfd0AMmN1RKoFdYQr6LX7nInf029a8IBOCXzv6Ufd3NwxxelKkO2U49XYo tFycxyDzo/B//cS8b8a7fu3yysP8W5b3oNgE6Tth1vR3zLy4uiwpIi6ptYBUlkG+ gqIXzqI+2MIyYWaA3UXIfRhi7j3CENGIA1TAAPSvfFnolYiFSXiY28b6P2nyl8WC xCySbdZtGh+fvxeP+cNl1VMDEmU94XDIgA7Nl5yacPLY4GwKnjAkfyp4uL9dYvJV 1wKgzYohF1Elm6YiPa2Wv1fuMNkT9iZ0DMyLV4ixxkKkuuCXCLKXmg4REQPsnE6V Eu/tQ6mfUugO6+d1ZkI/iAc0cjNtjrOKhS/Fsb49UWThjM+pyOFVO0hMybKYBwZL 1JDiwSM1uYts3TUxLBNb4SXeYoqZRFoFJiP14yjw9j0nuU1Au7ginFf0IYYq2VHI M7woolzYH+/vlOK+5aQrgcsanCy/7s4prux4IRTx5SGzqW+idA2UW26+5WyKbg== -----END CERTIFICATE----- - Certificate[1] info: - subject `C=UA,ST=Kharkov,L=Kharkov,O=MirantisInc,OU=ServicesDepartment,CN=ca-server,EMAIL=mmaxur@mirantis.com', issuer `C=UA,ST=Kharkov,L=Kharkov,O=MirantisInc,OU=ServicesDepartment,CN=ca-server,EMAIL=mmaxur@mirantis.com', RSA key 4096 bits, signed using RSA-SHA256, activated `2016-05-26 10:16:07 UTC', expires `2026-05-24 10:16:07 UTC', SHA-1 fingerprint `0f74fdaf2195ae2b1f599e3963e3b18970cb81a3' -----BEGIN CERTIFICATE----- MIIGGjCCBAKgAwIBAgIJAN1rpxx3AA9AMA0GCSqGSIb3DQEBCwUAMIGcMQswCQYD VQQGEwJVQTEQMA4GA1UECAwHS2hhcmtvdjEQMA4GA1UEBwwHS2hhcmtvdjEUMBIG A1UECgwLTWlyYW50aXNJbmMxGzAZBgNVBAsMElNlcnZpY2VzRGVwYXJ0bWVudDES MBAGA1UEAwwJY2Etc2VydmVyMSIwIAYJKoZIhvcNAQkBFhNtbWF4dXJAbWlyYW50 aXMuY29tMB4XDTE2MDUyNjEwMTYwN1oXDTI2MDUyNDEwMTYwN1owgZwxCzAJBgNV BAYTAlVBMRAwDgYDVQQIDAdLaGFya292MRAwDgYDVQQHDAdLaGFya292MRQwEgYD VQQKDAtNaXJhbnRpc0luYzEbMBkGA1UECwwSU2VydmljZXNEZXBhcnRtZW50MRIw EAYDVQQDDAljYS1zZXJ2ZXIxIjAgBgkqhkiG9w0BCQEWE21tYXh1ckBtaXJhbnRp cy5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCuZEMVa87WGQJl 1foQGNt4Qh/CWcggjjIqn8IYSPPtqn3YAxvUnubA+DQxkH7PNYR6G9PdNgQon2mV xvwVFL6YouDkPtEO101B3vM28U3vEEOSLUcign+2XqzKf7lqyXzMK7/wk+iubAfH hVhXosC+TSwH+eywO1lo2vbOZkf93ZiURDEZfixcMLuYMM8xdOeWeWtnQIA7D8QF E5wADWXaYpMlmZzHmmtx76l5BGZL75pG0YkAexllu5idlqADhN77xGM69ZSV/pYJ apMRhy4z0e17UzEbGWgv6OnUNhwGhOCgyIRk7PTKyjU+mxh3qdoNaqNt7Jj60EB7 dvzHeosrizcYaFwaqbBxVRMKJOcNYh7ZYlyrdexa9Wau3xf0NFvyBZ8rvsBv9Ax+ xuRCq2uVGc3rQHZzkwocquAgACY+1GpxFtpNUBhvmi25TUbm8OkAq7lYpf2sptJH ReZf4EdHhWuHLI93X5Pm6cb0uE+85kuJPNGMprcwvWM5QiT1N56LAVKiApZTSqo8 bcuJZs+nXI4IrYRXjCn75E0LLRpVLXc7+vfKHgHClL9/bhOxcOdwyXejnDQVzWe4 5JvwzLtL3/4KDiTLjG4foJztosxn92cAJAp30cdUalf7QkEFqp5RCvRY2vFVosM5 0Vu3bicGcyucHyxigxWP44qpaJe9WwIDAQABo10wWzAdBgNVHQ4EFgQU/msFAiI9 2/9ld4t5M9XYonUlHyIwHwYDVR0jBBgwFoAU/msFAiI92/9ld4t5M9XYonUlHyIw DAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQELBQADggIBAHMZ 609hm52CYxouUnvH+timAgiqbVv8QCb6IzgM5uRNejlxTzj63RBFvxC6n2UPqBpj yGtYuwpO249e+sD01ZS0r4B69a3yBePH6Ay4leqfStuqc9dcyamK7lQk8PAsF4wv yrywNpgGbecDReHJPrOmc5nQw3AlhwcwceHHS7mqaS+SWj1md97saD8uqHK0O5vu PFlJUKiztQqR2PMPWiKw+Pjri+RAXHj4TCxjPt5Z0wSR+xP/YE1MymvegPUrZ7/7 rFWuqfHDVLh7IA16q+h1xU+FMnVdiPigEJ+Omn6dDfqHD9BBcKOUFYOJiXtG4TDc tX401kpG1Qm00kS3XtveQgGPF1OWNLyyDr1dDy8/B+77W1yli/VbzK6H4jwrVGy7 EAEzpfbwRJnSIIUczG8//1G6a5yrpcjohKhWY1uBrv56LJdq16OVN3aK5nacMKmQ p+YpPu/ZT5LVUOzt8I32Q8i1Tn9YZma7vEftvGCZKVcgqlVIpb3P7/7dyRXoMuFD bErDIDxScMvg82Vg2JF4NzaOp+CXRAYuXbel5anoFOt7FFfnO2w0/aLQpAT+jpze qcL37IGyCGxOloej7NkdQsX9eJJNIdy5oLjniJ8/d402A0zziPdfrqa0c3FpGukZ syWlWH0RCerDgVmq+i6l5zGbtx/tKPpLYcJkAetJ -----END CERTIFICATE----- - The hostname in the certificate matches 'ldap1'. - Peer's certificate is trusted - Version: TLS1.2 - Key Exchange: RSA - Cipher: AES-128-CBC - MAC: SHA1 - Compression: NULL - Handshake was completed - Simple Client Mode:
