Ignore:
Timestamp:
Sep 30, 2008, 7:14:08 AM (17 years ago)
Author:
Paul Smedley
Message:

Update source to 3.0.32

File:
1 edited

Legend:

Unmodified
Added
Removed

  • branches/samba-3.0/docs/htmldocs/Samba3-HOWTO/ch-ldap-tls.html

    r134 r158  
    1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 45. LDAP and Transport Layer Security</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="Appendix.html" title="Part VI. Reference Section"><link rel="prev" href="speed.html" title="Chapter 44. Samba Performance Tuning"><link rel="next" href="ch46.html" title="Chapter 46. Samba Support"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 45. LDAP and Transport Layer Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="speed.html">Prev</a> </td><th width="60%" align="center">Part VI. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="ch46.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ch-ldap-tls"></a>Chapter 45. LDAP and Transport Layer Security</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Gavin</span> <span class="surname">Henry</span></h3><div class="affiliation"><span class="orgname">Suretec Systems Limited, UK<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:ghenry@suretecsystems.com">ghenry@suretecsystems.com</a>&gt;</code></p></div></div></div></div><div><p class="pubdate">July 8, 2005</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-intro-ldap-tls">Introduction</a></span></dt><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-config-ldap-tls">Configuring</a></span></dt><dd><dl><dt><span class="sect2"><a href="ch-ldap-tls.html#s1-config-ldap-tls-certs">Generating the Certificate Authority</a></span></dt><dt><span class="sect2"><a href="ch-ldap-tls.html#s1-config-ldap-tls-server">Generating the Server Certificate</a></span></dt><dt><span class="sect2"><a href="ch-ldap-tls.html#s1-config-ldap-tls-install">Installing the Certificates</a></span></dt></dl></dd><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-test-ldap-tls">Testing</a></span></dt><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-int-ldap-tls">Troubleshooting</a></span></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-intro-ldap-tls"></a>Introduction</h2></div></div></div><p>
    2         <a class="indexterm" name="id469768"></a>
    3 <a class="indexterm" name="id469778"></a>
     1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 46. LDAP and Transport Layer Security</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="Appendix.html" title="Part VI. Reference Section"><link rel="prev" href="speed.html" title="Chapter 45. Samba Performance Tuning"><link rel="next" href="ch47.html" title="Chapter 47. Samba Support"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 46. LDAP and Transport Layer Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="speed.html">Prev</a> </td><th width="60%" align="center">Part VI. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="ch47.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ch-ldap-tls"></a>Chapter 46. LDAP and Transport Layer Security</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Gavin</span> <span class="surname">Henry</span></h3><div class="affiliation"><span class="orgname">Suretec Systems Limited, UK<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:ghenry@suretecsystems.com">ghenry@suretecsystems.com</a>&gt;</code></p></div></div></div></div><div><p class="pubdate">July 8, 2005</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-intro-ldap-tls">Introduction</a></span></dt><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-config-ldap-tls">Configuring</a></span></dt><dd><dl><dt><span class="sect2"><a href="ch-ldap-tls.html#s1-config-ldap-tls-certs">Generating the Certificate Authority</a></span></dt><dt><span class="sect2"><a href="ch-ldap-tls.html#s1-config-ldap-tls-server">Generating the Server Certificate</a></span></dt><dt><span class="sect2"><a href="ch-ldap-tls.html#s1-config-ldap-tls-install">Installing the Certificates</a></span></dt></dl></dd><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-test-ldap-tls">Testing</a></span></dt><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-int-ldap-tls">Troubleshooting</a></span></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-intro-ldap-tls"></a>Introduction</h2></div></div></div><p>
     2        <a class="indexterm" name="id444556"></a>
     3<a class="indexterm" name="id444565"></a>
    44        Up until now, we have discussed the straightforward configuration of <span class="trademark">OpenLDAP</span>&#8482;,
    55        with some advanced features such as ACLs. This does not however, deal with the fact that the network
    … …  
    77        comes in.
    88        </p><p>
    9 <a class="indexterm" name="id469799"></a>
     9<a class="indexterm" name="id444587"></a>
    1010        <span class="trademark">OpenLDAP</span>&#8482; clients and servers are capable of using the Transport Layer Security (TLS)
    1111        framework to provide integrity and confidentiality protections in accordance with <a class="ulink" href="http://rfc.net/rfc2830.html" target="_top">RFC 2830</a>; <span class="emphasis"><em>Lightweight Directory Access Protocol (v3):
    1212        Extension for Transport Layer Security.</em></span>
    1313        </p><p>
    14 <a class="indexterm" name="id469826"></a>
     14<a class="indexterm" name="id444614"></a>
    1515        TLS uses X.509 certificates. All servers are required to have valid certificates, whereas client certificates
    1616        are optional. We will only be discussing server certificates.
    1717        </p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p>
    18 <a class="indexterm" name="id469839"></a>
    19 <a class="indexterm" name="id469846"></a>
    20 <a class="indexterm" name="id469852"></a>
     18<a class="indexterm" name="id444627"></a>
     19<a class="indexterm" name="id444633"></a>
     20<a class="indexterm" name="id444640"></a>
    2121        The DN of a server certificate must use the CN attribute to name the server, and the CN must carry the
    2222        server's fully qualified domain name (FQDN). Additional alias names and wildcards may be present in the
    … …  
    2525        We will discuss this more in the next sections.
    2626        </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-config-ldap-tls"></a>Configuring</h2></div></div></div><p>
    27         <a class="indexterm" name="id469888"></a>
     27        <a class="indexterm" name="id444676"></a>
    2828        Now on to the good bit.
    2929        </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="s1-config-ldap-tls-certs"></a>Generating the Certificate Authority</h3></div></div></div><p>
    30 <a class="indexterm" name="id469911"></a>
     30<a class="indexterm" name="id444699"></a>
    3131        In order to create the relevant certificates, we need to become our own Certificate Authority (CA).
    32         <sup>[<a name="id469921" href="#ftn.id469921" class="footnote">8</a>]</sup> This is necessary, so we can sign the server certificate.
    33         </p><p>
    34 <a class="indexterm" name="id469948"></a>
    35         We will be using the <a class="ulink" href="http://www.openssl.org" target="_top">OpenSSL</a> <sup>[<a name="id469961" href="#ftn.id469961" class="footnote">9</a>]</sup> software for this, which is included with every great <span class="trademark">Linux</span>® distribution.
    36         </p><p>
    37         TLS is used for many types of servers, but the instructions<sup>[<a name="id469977" href="#ftn.id469977" class="footnote">10</a>]</sup> presented here, are tailored for <span class="application">OpenLDAP</span>.
     32        <sup>[<a name="id444709" href="#ftn.id444709" class="footnote">8</a>]</sup> This is necessary, so we can sign the server certificate.
     33        </p><p>
     34<a class="indexterm" name="id444736"></a>
     35        We will be using the <a class="ulink" href="http://www.openssl.org" target="_top">OpenSSL</a> <sup>[<a name="id444748" href="#ftn.id444748" class="footnote">9</a>]</sup> software for this, which is included with every great <span class="trademark">Linux</span>® distribution.
     36        </p><p>
     37        TLS is used for many types of servers, but the instructions<sup>[<a name="id444764" href="#ftn.id444764" class="footnote">10</a>]</sup> presented here, are tailored for <span class="application">OpenLDAP</span>.
    3838        </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
    3939        The <span class="emphasis"><em>Common Name (CN)</em></span>, in the following example, <span class="emphasis"><em>MUST</em></span> be
    … …  
    5252</code>
    5353</pre><p>
    54         Now generate the CA:<sup>[<a name="id470049" href="#ftn.id470049" class="footnote">11</a>]</sup>
     54        Now generate the CA:<sup>[<a name="id444836" href="#ftn.id444836" class="footnote">11</a>]</sup>
    5555</p><pre class="screen">
    5656<code class="computeroutput">
    … …  
    210210        That's all there is to it. Now on to <a class="xref" href="ch-ldap-tls.html#s1-test-ldap-tls" title="Testing">the section called &#8220;Testing&#8221;</a>
    211211        </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-test-ldap-tls"></a>Testing</h2></div></div></div><p>
    212 <a class="indexterm" name="id470412"></a>
     212<a class="indexterm" name="id445200"></a>
    213213This is the easy part. Restart the server:
    214214</p><pre class="screen">
    … …  
    221221</pre><p>
    222222        Then, using <code class="literal">ldapsearch</code>, test an anonymous search with the
    223         <code class="option">-ZZ</code><sup>[<a name="id470452" href="#ftn.id470452" class="footnote">12</a>]</sup> option:
     223        <code class="option">-ZZ</code><sup>[<a name="id445239" href="#ftn.id445239" class="footnote">12</a>]</sup> option:
    224224</p><pre class="screen">
    225225<code class="computeroutput">
    … …  
    266266        If you have any problems, please read <a class="xref" href="ch-ldap-tls.html#s1-int-ldap-tls" title="Troubleshooting">the section called &#8220;Troubleshooting&#8221;</a>
    267267</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-int-ldap-tls"></a>Troubleshooting</h2></div></div></div><p>
    268 <a class="indexterm" name="id470533"></a>
     268<a class="indexterm" name="id445320"></a>
    269269The most common error when configuring TLS, as I have already mentioned numerous times, is that the
    270270<span class="emphasis"><em>Common Name (CN)</em></span> you entered in <a class="xref" href="ch-ldap-tls.html#s1-config-ldap-tls-server" title="Generating the Server Certificate">the section called &#8220;Generating the Server Certificate&#8221;</a> is
    … …  
    276276</p><p>
    277277For anything else, it's best to read through your ldap logfile or join the <span class="application">OpenLDAP</span> mailing list.
    278 </p></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id469921" href="#id469921" class="para">8</a>] </sup>We could however, get our generated server certificate signed by proper CAs, like <a class="ulink" href="http://www.thawte.com/" target="_top">Thawte</a> and <a class="ulink" href="http://www.verisign.com/" target="_top">VeriSign</a>, which
     278</p></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id444709" href="#id444709" class="para">8</a>] </sup>We could however, get our generated server certificate signed by proper CAs, like <a class="ulink" href="http://www.thawte.com/" target="_top">Thawte</a> and <a class="ulink" href="http://www.verisign.com/" target="_top">VeriSign</a>, which
    279279        you pay for, or the free ones, via <a class="ulink" href="http://www.cacert.org/" target="_top">CAcert</a>
    280         </p></div><div class="footnote"><p><sup>[<a name="ftn.id469961" href="#id469961" class="para">9</a>] </sup>The downside to
     280        </p></div><div class="footnote"><p><sup>[<a name="ftn.id444748" href="#id444748" class="para">9</a>] </sup>The downside to
    281281        making our own CA, is that the certificate is not automatically recognized by clients, like the commercial
    282         ones are.</p></div><div class="footnote"><p><sup>[<a name="ftn.id469977" href="#id469977" class="para">10</a>] </sup>For information straight from the
     282        ones are.</p></div><div class="footnote"><p><sup>[<a name="ftn.id444764" href="#id444764" class="para">10</a>] </sup>For information straight from the
    283283        horse's mouth, please visit <a class="ulink" href="http://www.openssl.org/docs/HOWTO/" target="_top">http://www.openssl.org/docs/HOWTO/</a>; the main OpenSSL
    284         site.</p></div><div class="footnote"><p><sup>[<a name="ftn.id470049" href="#id470049" class="para">11</a>] </sup>Your <code class="filename">CA.pl</code> or <code class="filename">CA.sh</code> might not be
     284        site.</p></div><div class="footnote"><p><sup>[<a name="ftn.id444836" href="#id444836" class="para">11</a>] </sup>Your <code class="filename">CA.pl</code> or <code class="filename">CA.sh</code> might not be
    285285        in the same location as mine is, you can find it by using the <code class="literal">locate</code> command, i.e.,
    286286        <code class="literal">locate CA.pl</code>.  If the command complains about the database being too old, run
    287         <code class="literal">updatedb</code> as <span class="emphasis"><em>root</em></span> to update it.</p></div><div class="footnote"><p><sup>[<a name="ftn.id470452" href="#id470452" class="para">12</a>] </sup>See <code class="literal">man ldapsearch</code></p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="speed.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="Appendix.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="ch46.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 44. Samba Performance Tuning </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 46. Samba Support</td></tr></table></div></body></html>
     287        <code class="literal">updatedb</code> as <span class="emphasis"><em>root</em></span> to update it.</p></div><div class="footnote"><p><sup>[<a name="ftn.id445239" href="#id445239" class="para">12</a>] </sup>See <code class="literal">man ldapsearch</code></p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="speed.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="Appendix.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="ch47.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 45. Samba Performance Tuning </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 47. Samba Support</td></tr></table></div></body></html>
Note: See TracChangeset for help on using the changeset viewer.