LDAP with TLS

LDAP + SSL = port 636
LDAP + TLS = port 389 (no change)

Server:
(1) Create a cert for LDAP server
Note that the field of cn inside MUST match hostname

(2) Remove the DES3 password on private key
openssl rsa -in private.des3 -out slapd.pem

(3) add an empty line in the end of slapd.pem
echo >> slapd.pem

(4) append server's cert in the end of slapd.pem
cat newcert.pem >> slapd.pem

(5) cp slapd.pem /etc/openldap/cacerts/
chown root.ldap /etc/openldap/cacerts/slapd.pem
chmod 644 /etc/openldap/cacerts/slapd.pem

(6) cp cacert.pem /etc/openldap/cacerts/

(7) Modify slapd.conf
TLSCACertificateFile /etc/openldap/cacerts/cacert.pem
TLSCertificateFile /etc/openldap/cacerts/slapd.pem
TLSCertificateKeyFile /etc/openldap/cacerts/slapd.pem

(8) service ldap restart

(9) netstat -ntlp
Then, we can see both port 636 and 389 are being listen

Client:
(1) vi /etc/openldap/ldap.conf
TLS_REQCERT never

(2) search
TLS: ldapsearch -x -ZZ -b "dc=osa,dc=com" -h linux.kirka.idv.tw
SSL: ldapsearch -x -b "dc=osa,dc=com" -H ldaps://linux.kirika.idv.tw
No encrypt: ldapsearch -x -b "dc=osa,dc=com" -h linux.kirika.idv.tw

Linux:
Call authconfig, check "use TLS" in LDAP options
This will change /etc/ldap.conf
We can also change from TLS to SSL by changing
ssl start_tls
to
ssl on

Home Directory Solution for LDAP Linux Users

LDAP server: 10.0.1.11
User directory: 10.0.1.11:/rhome
LDAP user: kevin

Solution 1: use nfs to mount to another machine

Server:
(1) vi /etc/exports
/home 10.0.1.0/24 (rw)

(2) service nfs restart


Client:
(1) use root's account
mount 10.0.1.11:/rhome /home

(2) use ldap user kevin to login



Solution 2: use autofs with LDAP server

Server:
(1) vi /etc/exports
/home 10.0.1.0/24 (rw)

(2) service nfs restart

(3) Add LDAP Data
homeDirectory: /home/rhome/kevin
nisMapEntry: -w,hard,intr 10.0.1.11:/rhome/kevin
nisMapName: auto.misc
objectClass: nisObject

Client:
(1) vi /etc/auto.master
/home/rhome ldap:10.0.1.11:dc=osa,dc=com --timeout=60

This will automatically make a virtual directory which name
is the same as cn, namely, /home/rhome/kevin

(2) service autofs restart

(3) use kevin to login


ps. To add the nisObject with the /etc/passwd migration results,
we may need to change the schema /etc/openldap/schema/nis.schema:

objectclass ( 1.3.6.1.1.1.2.10 NAME 'nisObject'
DESC 'An entry in a NIS map'
SUP top AUXILIARY
MUST ( cn $ nisMapEntry $ nisMapName )
MAY description )

The 3rd line changed from "SUP top STRUCTURAL" to "SUP top AUXILIARY".

LDAP Replica

Master LDAP Server:
/etc/openldap/slapd.conf

access to attrs=userpassword
by self write
by * auth

access to *
by * read

suffix "dc=example,dc=com"
rootdn "cn=root,dc=example,dc=com"
rootpw 12345

# Replicas of this database
replogfile /var/lib/ldap/openldap-master-replog

replica host=slave.example.com:389
suffix="dc=example,dc=com"
binddn="cn=admin,dc=example,dc=com"
credentials=54321
bindmethod=simple


Slave LDAP Server:
suffix "dc=example,dc=com"
rootdn "cn=admin,dc=example,dc=com"
rootpw 54321

updatedn "cn=admin,dc=example,dc=com"
updateref ldap://master.example.com/

LDAP Partition

Parent LDAP server: ldap://tp.example.com:389/

dn: dc=example, dc=com
dc: example
objectclass: dcObject
objectclass: organizationalUnit
ou: example com

dn: ou=tp, dc=example, dc=com
objectclass: organizationalUnit
ou: tp

dn: ou=people, ou=tp, dc=example, dc=com
objectclass: organizationalUnit
ou: people

dn: ou=group, ou=tp, dc=example, dc=com
objectclass: organizationalUnit
ou: group

dn: cn=kevin, ou=group, ou=tp, dc=example, dc=com
....

dn: ou=ks, dc=example, dc=com
objectClass: referral
objectClass: extensibleobject
ou: ks
ref: ldap://ks.example.com/ou=ks,dc=example,dc=com


Child LDAP server: ldap://ks.example.com:389/

/etc/openldap/slapd.conf
referral ldap://tp.example.com:389/

dn: ou=ks, dc=example, dc=com
objectclass: organizationalUnit
ou: ks

dn: ou=people, ou=ks, dc=example, dc=com
objectclass: organizationalUnit
ou: people

dn: ou=group, ou=ks, dc=example, dc=com
objectclass: organizationalUnit
ou: group

dn: cn=david, ou=group, ou=ks, dc=example, dc=com

Query by ldapsearch:
Must add parameter -C to search for referrals

From parent (tp.example.com):
ldapsearch -x -C -b "dc=example,dc=com" "cn=david"

From child (ks.example.com):
ldapsearch -x -C -b "dc=example,dc=com" "cn=kevin"

LDAP vs. Linux Account

/usr/share/openldap/migration/

Change passwd to ldif:
migrate_passwd.pl

Change group to ldif:
migrate_group.pl

Modify migrate_passwd.pl:
if ($DEFAULT_MAIL_HOST) {
print $HANDLE "mailRoutingAddress: $user\@$DEFAULT_MAIL_HOST\n";
print $HANDLE "mailHost: $DEFAULT_MAIL_HOST\n";
print $HANDLE "mailLocalAddress: $user\@$DEFAULT_MAIL_DOMAIN\n";
print $HANDLE "objectClass: inetLocalMailRecipient\n";
}


Modify migrate_common.ph:
$DEFAULT_MAIL_DOMAIN = "kirika.idv.tw";
$DEFAULT_BASE = "ou=linux,dc=osa,dc=com"
$DEFAULT_MAIL_HOST = "linux.kirika.idv.tw"
$EXTENDED SCHEMA = 1;

LDAP - osa_top.ldif

dn: dc=osa, dc=com
dc: osa
objectClass: dcObject
objectClass: organizationalUnit
ou: osa com

dn: ou=linux, dc=osa, dc=com
objectclass: organizationalUnit
ou: linux

dn: ou=people, ou=linux, dc=osa, dc=com
objectclass: organizationalUnit
ou: people

dn: ou=group, ou=linux, dc=osa, dc=com
objectclass: organizationalUnit
ou: group

LDAP - top.ldif

dn: dc=example, dc=com
objectclass: top

dn: ou=tp, dc=example, dc=com
objectclass: organizationalUnit
ou: tp

dn: ou=ks, dc=example, dc=com
objectclass: organizationalUnit
ou: ks

dn: ou=people, ou=tp, dc=example, dc=com
objectclass: organizationalUnit
ou: people

dn: ou=group, ou=tp, dc=example, dc=com
objectclass: organizationalUnit
ou: group

dn: ou=people, ou=ks, dc=example, dc=com
objectclass: organizationalUnit
ou: people

dn: ou=group, ou=ks, dc=example, dc=com
objectclass: organizationalUnit
ou: group

LDAP vs. Outlook Express - kevin.ldif

dn: uid=kevin,ou=People,ou=tp,dc=example,dc=com
uid: kevin
mailRoutingAddress: kevin@tp.example.com
mailHost: tp.example.com
mailLocalAddress: kevin@example.com
objectClass: inetLocalMailRecipient
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: kerberosSecurityObject
objectClass: shadowAccount
objectClass: country
objectClass: officePerson
userPassword: 12345
shadowLastChange: 13495
shadowMax: 99999
shadowWarning: 7
krbName: kevin@EXAMPLE.COM
loginShell: /bin/bash
uidNumber: 500
gidNumber: 500
homeDirectory: /home/kevin
sn: 王
givenName: 大明
mail: jacky_chen@example.com
cn: kevin
st: 台北
c: 台灣
organizationName: Example
organizationalUnitName: 業務部
URL: http://edu.uuu.com.tw
facsimileTelephoneNumber: 886-2-1234-5678
pager: 886-2-8765-4321
title: 講師
telephoneNumber: 886-2-1234-4321
l: 中正
postalAddress: 復興北路99號
postalCode: 105
physicalDeliveryOfficeName: 19F
IPPhone: 1.2.3.4
comment: 員工
conferenceInformation: 1.2.3.4

LDAP vs. Outlook Express - userdefine.schema

attributetype (1.3.6.1.4.1.4203.666.100.123
NAME 'IPPhone'
SUP telephoneNumber )

attributetype (1.3.6.1.4.1.4203.666.100.124
NAME 'URL'
SUP name )

attributetype (1.3.6.1.4.1.4203.666.100.125
NAME 'comment'
SUP name )

attributetype (1.3.6.1.4.1.4203.666.100.126
NAME 'conferenceInformation'
SUP name )

objectclass (1.3.6.1.4.1.4203.666.100.1
NAME 'officePerson'
SUP inetOrgPerson
DESC 'Office employee or computer user'
MAY ( IPPhone $
URL $
comment $
conferenceInformation ) )

OpenLDAP 指令

ldapsearch -x -b "dc=osa,dc=com" "(cn=Janny)"

ldapadd -x -W -D "cn=root,dc=osa,dc=com" -f my.ldif

ldapmodify -x -W -D "cn=root,dc=osa,dc=com" -f my.ldif

ldapdelete -x -W -D "cn=root,dc=osa,dc=com" "cn=janny,ou=linux,dc=osa,dc=com"

ps. To delete the whole database
service ldap stop
rm -f /var/lib/ldap/*

ps2. We can set some default values for these commands
vi /etc/openldap/ldap.conf

BASE dc=osa,dc=com
#URI ldap://ldap.example.com ldap://ldap-master.example.com:666
URI ldap://linux.kirika.idv.tw
HOST linux.kirika.idv.tw

#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
TLS_CACERTDIR /etc/openldap/cacerts
TLS_REQCERT never

Then, we don't need to give -b and -h in the commands.