- Timestamp:
- Oct 30, 2009, 9:39:05 AM (16 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.3.x/docs/htmldocs/Samba3-HOWTO/ch-ldap-tls.html
r274 r342 1 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 46. LDAP and Transport Layer Security</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.3.x HOWTO and Reference Guide"><link rel="up" href="Appendix.html" title="Part VI. Reference Section"><link rel="prev" href="speed.html" title="Chapter 45. Samba Performance Tuning"><link rel="next" href="ch47.html" title="Chapter 47. Samba Support"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 46. LDAP and Transport Layer Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="speed.html">Prev</a> </td><th width="60%" align="center">Part VI. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="ch47.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ch-ldap-tls"></a>Chapter 46. LDAP and Transport Layer Security</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Gavin</span> <span class="orgname">Suretec Systems Limited, UK</span> <span class="surname">Henry</span></h3><div class="affiliation"><span class="orgname">Suretec Systems Limited, UK<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:ghenry@suretecsystems.com">ghenry@suretecsystems.com</a>></code></p></div></div></div></div><div><p class="pubdate">July 8, 2005</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-intro-ldap-tls">Introduction</a></span></dt><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-config-ldap-tls">Configuring</a></span></dt><dd><dl><dt><span class="sect2"><a href="ch-ldap-tls.html#s1-config-ldap-tls-certs">Generating the Certificate Authority</a></span></dt><dt><span class="sect2"><a href="ch-ldap-tls.html#s1-config-ldap-tls-server">Generating the Server Certificate</a></span></dt><dt><span class="sect2"><a href="ch-ldap-tls.html#s1-config-ldap-tls-install">Installing the Certificates</a></span></dt></dl></dd><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-test-ldap-tls">Testing</a></span></dt><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-int-ldap-tls">Troubleshooting</a></span></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-intro-ldap-tls"></a>Introduction</h2></div></div></div><p> 2 <a class="indexterm" name="id26914 48"></a>3 <a class="indexterm" name="id26914 58"></a>2 <a class="indexterm" name="id2691453"></a> 3 <a class="indexterm" name="id2691462"></a> 4 4 Up until now, we have discussed the straightforward configuration of <span class="trademark">OpenLDAP</span>™, 5 5 with some advanced features such as ACLs. This does not however, deal with the fact that the network … … 7 7 comes in. 8 8 </p><p> 9 <a class="indexterm" name="id269148 2"></a>9 <a class="indexterm" name="id2691486"></a> 10 10 <span class="trademark">OpenLDAP</span>™ clients and servers are capable of using the Transport Layer Security (TLS) 11 11 framework to provide integrity and confidentiality protections in accordance with <a class="ulink" href="http://rfc.net/rfc2830.html" target="_top">RFC 2830</a>; <span class="emphasis"><em>Lightweight Directory Access Protocol (v3): 12 12 Extension for Transport Layer Security.</em></span> 13 13 </p><p> 14 <a class="indexterm" name="id269151 1"></a>14 <a class="indexterm" name="id2691516"></a> 15 15 TLS uses X.509 certificates. All servers are required to have valid certificates, whereas client certificates 16 16 are optional. We will only be discussing server certificates. 17 17 </p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p> 18 <a class="indexterm" name="id26915 25"></a>19 <a class="indexterm" name="id269153 2"></a>20 <a class="indexterm" name="id26915 38"></a>18 <a class="indexterm" name="id2691530"></a> 19 <a class="indexterm" name="id2691536"></a> 20 <a class="indexterm" name="id2691543"></a> 21 21 The DN of a server certificate must use the CN attribute to name the server, and the CN must carry the 22 22 server's fully qualified domain name (FQDN). Additional alias names and wildcards may be present in the … … 25 25 We will discuss this more in the next sections. 26 26 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-config-ldap-tls"></a>Configuring</h2></div></div></div><p> 27 <a class="indexterm" name="id26915 78"></a>27 <a class="indexterm" name="id2691583"></a> 28 28 Now on to the good bit. 29 29 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="s1-config-ldap-tls-certs"></a>Generating the Certificate Authority</h3></div></div></div><p> 30 <a class="indexterm" name="id269160 1"></a>30 <a class="indexterm" name="id2691606"></a> 31 31 In order to create the relevant certificates, we need to become our own Certificate Authority (CA). 32 <sup>[<a name="id269161 2" href="#ftn.id2691612" class="footnote">8</a>]</sup> This is necessary, so we can sign the server certificate.33 </p><p> 34 <a class="indexterm" name="id269164 2"></a>35 We will be using the <a class="ulink" href="http://www.openssl.org" target="_top">OpenSSL</a> <sup>[<a name="id269165 5" href="#ftn.id2691655" class="footnote">9</a>]</sup> software for this, which is included with every great <span class="trademark">Linux</span>® distribution.36 </p><p> 37 TLS is used for many types of servers, but the instructions<sup>[<a name="id269167 3" href="#ftn.id2691673" class="footnote">10</a>]</sup> presented here, are tailored for <span class="application">OpenLDAP</span>.32 <sup>[<a name="id2691617" href="#ftn.id2691617" class="footnote">8</a>]</sup> This is necessary, so we can sign the server certificate. 33 </p><p> 34 <a class="indexterm" name="id2691646"></a> 35 We will be using the <a class="ulink" href="http://www.openssl.org" target="_top">OpenSSL</a> <sup>[<a name="id2691659" href="#ftn.id2691659" class="footnote">9</a>]</sup> software for this, which is included with every great <span class="trademark">Linux</span>® distribution. 36 </p><p> 37 TLS is used for many types of servers, but the instructions<sup>[<a name="id2691678" href="#ftn.id2691678" class="footnote">10</a>]</sup> presented here, are tailored for <span class="application">OpenLDAP</span>. 38 38 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 39 39 The <span class="emphasis"><em>Common Name (CN)</em></span>, in the following example, <span class="emphasis"><em>MUST</em></span> be … … 52 52 </code> 53 53 </pre><p> 54 Now generate the CA:<sup>[<a name="id26917 49" href="#ftn.id2691749" class="footnote">11</a>]</sup>54 Now generate the CA:<sup>[<a name="id2691754" href="#ftn.id2691754" class="footnote">11</a>]</sup> 55 55 </p><pre class="screen"> 56 56 <code class="computeroutput"> … … 210 210 That's all there is to it. Now on to <a class="xref" href="ch-ldap-tls.html#s1-test-ldap-tls" title="Testing">the section called “Testing”</a> 211 211 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-test-ldap-tls"></a>Testing</h2></div></div></div><p> 212 <a class="indexterm" name="id26921 57"></a>212 <a class="indexterm" name="id2692162"></a> 213 213 This is the easy part. Restart the server: 214 214 </p><pre class="screen"> … … 221 221 </pre><p> 222 222 Then, using <code class="literal">ldapsearch</code>, test an anonymous search with the 223 <code class="option">-ZZ</code><sup>[<a name="id269220 0" href="#ftn.id2692200" class="footnote">12</a>]</sup> option:223 <code class="option">-ZZ</code><sup>[<a name="id2692204" href="#ftn.id2692204" class="footnote">12</a>]</sup> option: 224 224 </p><pre class="screen"> 225 225 <code class="computeroutput"> … … 266 266 If you have any problems, please read <a class="xref" href="ch-ldap-tls.html#s1-int-ldap-tls" title="Troubleshooting">the section called “Troubleshooting”</a> 267 267 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-int-ldap-tls"></a>Troubleshooting</h2></div></div></div><p> 268 <a class="indexterm" name="id2692 298"></a>268 <a class="indexterm" name="id2692302"></a> 269 269 The most common error when configuring TLS, as I have already mentioned numerous times, is that the 270 270 <span class="emphasis"><em>Common Name (CN)</em></span> you entered in <a class="xref" href="ch-ldap-tls.html#s1-config-ldap-tls-server" title="Generating the Server Certificate">the section called “Generating the Server Certificate”</a> is … … 276 276 </p><p> 277 277 For anything else, it's best to read through your ldap logfile or join the <span class="application">OpenLDAP</span> mailing list. 278 </p></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id269161 2" href="#id2691612" class="para">8</a>] </sup>We could however, get our generated server certificate signed by proper CAs, like <a class="ulink" href="http://www.thawte.com/" target="_top">Thawte</a> and <a class="ulink" href="http://www.verisign.com/" target="_top">VeriSign</a>, which278 </p></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id2691617" href="#id2691617" class="para">8</a>] </sup>We could however, get our generated server certificate signed by proper CAs, like <a class="ulink" href="http://www.thawte.com/" target="_top">Thawte</a> and <a class="ulink" href="http://www.verisign.com/" target="_top">VeriSign</a>, which 279 279 you pay for, or the free ones, via <a class="ulink" href="http://www.cacert.org/" target="_top">CAcert</a> 280 </p></div><div class="footnote"><p><sup>[<a name="ftn.id269165 5" href="#id2691655" class="para">9</a>] </sup>The downside to280 </p></div><div class="footnote"><p><sup>[<a name="ftn.id2691659" href="#id2691659" class="para">9</a>] </sup>The downside to 281 281 making our own CA, is that the certificate is not automatically recognized by clients, like the commercial 282 ones are.</p></div><div class="footnote"><p><sup>[<a name="ftn.id269167 3" href="#id2691673" class="para">10</a>] </sup>For information straight from the282 ones are.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2691678" href="#id2691678" class="para">10</a>] </sup>For information straight from the 283 283 horse's mouth, please visit <a class="ulink" href="http://www.openssl.org/docs/HOWTO/" target="_top">http://www.openssl.org/docs/HOWTO/</a>; the main OpenSSL 284 site.</p></div><div class="footnote"><p><sup>[<a name="ftn.id26917 49" href="#id2691749" class="para">11</a>] </sup>Your <code class="filename">CA.pl</code> or <code class="filename">CA.sh</code> might not be284 site.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2691754" href="#id2691754" class="para">11</a>] </sup>Your <code class="filename">CA.pl</code> or <code class="filename">CA.sh</code> might not be 285 285 in the same location as mine is, you can find it by using the <code class="literal">locate</code> command, i.e., 286 286 <code class="literal">locate CA.pl</code>. If the command complains about the database being too old, run 287 <code class="literal">updatedb</code> as <span class="emphasis"><em>root</em></span> to update it.</p></div><div class="footnote"><p><sup>[<a name="ftn.id269220 0" href="#id2692200" class="para">12</a>] </sup>See <code class="literal">man ldapsearch</code></p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="speed.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="Appendix.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="ch47.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 45. Samba Performance Tuning </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 47. Samba Support</td></tr></table></div></body></html>287 <code class="literal">updatedb</code> as <span class="emphasis"><em>root</em></span> to update it.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2692204" href="#id2692204" class="para">12</a>] </sup>See <code class="literal">man ldapsearch</code></p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="speed.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="Appendix.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="ch47.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 45. Samba Performance Tuning </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 47. Samba Support</td></tr></table></div></body></html>
Note:
See TracChangeset
for help on using the changeset viewer.
