- Timestamp:
- Mar 1, 2010, 3:05:48 PM (15 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.3.x/docs/htmldocs/Samba3-HOWTO/ch-ldap-tls.html
r368 r411 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 46. LDAP and Transport Layer Security</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 5.2"><link rel="home" href="index.html" title="The Official Samba 3.3.x HOWTO and Reference Guide"><link rel="up" href="Appendix.html" title="Part VI. Reference Section"><link rel="prev" href="speed.html" title="Chapter 45. Samba Performance Tuning"><link rel="next" href="ch47.html" title="Chapter 47. Samba Support"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 46. LDAP and Transport Layer Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="speed.html">Prev</a> </td><th width="60%" align="center">Part VI. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="ch47.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 46. LDAP and Transport Layer Security"><div class="titlepage"><div><div><h2 class="title"><a name="ch-ldap-tls"></a>Chapter 46. LDAP and Transport Layer Security</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Gavin</span> <span class="surname">Henry</span></h3><div class="affiliation"><span class="orgname">Suretec Systems Limited, UK<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:ghenry@suretecsystems.com">ghenry@suretecsystems.com</a>></code></p></div></div></div></div><div><p class="pubdate">July 8, 2005</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-intro-ldap-tls">Introduction</a></span></dt><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-config-ldap-tls">Configuring</a></span></dt><dd><dl><dt><span class="sect2"><a href="ch-ldap-tls.html#s1-config-ldap-tls-certs">Generating the Certificate Authority</a></span></dt><dt><span class="sect2"><a href="ch-ldap-tls.html#s1-config-ldap-tls-server">Generating the Server Certificate</a></span></dt><dt><span class="sect2"><a href="ch-ldap-tls.html#s1-config-ldap-tls-install">Installing the Certificates</a></span></dt></dl></dd><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-test-ldap-tls">Testing</a></span></dt><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-int-ldap-tls">Troubleshooting</a></span></dt></dl></div><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-intro-ldap-tls"></a>Introduction</h2></div></div></div><p>2 <a class="indexterm" name="id269 7509"></a>3 <a class="indexterm" name="id269 7519"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 46. LDAP and Transport Layer Security</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.3.x HOWTO and Reference Guide"><link rel="up" href="Appendix.html" title="Part VI. Reference Section"><link rel="prev" href="speed.html" title="Chapter 45. Samba Performance Tuning"><link rel="next" href="ch47.html" title="Chapter 47. Samba Support"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 46. LDAP and Transport Layer Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="speed.html">Prev</a> </td><th width="60%" align="center">Part VI. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="ch47.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ch-ldap-tls"></a>Chapter 46. LDAP and Transport Layer Security</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Gavin</span> <span class="orgname">Suretec Systems Limited, UK</span> <span class="surname">Henry</span></h3><div class="affiliation"><span class="orgname">Suretec Systems Limited, UK<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:ghenry@suretecsystems.com">ghenry@suretecsystems.com</a>></code></p></div></div></div></div><div><p class="pubdate">July 8, 2005</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-intro-ldap-tls">Introduction</a></span></dt><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-config-ldap-tls">Configuring</a></span></dt><dd><dl><dt><span class="sect2"><a href="ch-ldap-tls.html#s1-config-ldap-tls-certs">Generating the Certificate Authority</a></span></dt><dt><span class="sect2"><a href="ch-ldap-tls.html#s1-config-ldap-tls-server">Generating the Server Certificate</a></span></dt><dt><span class="sect2"><a href="ch-ldap-tls.html#s1-config-ldap-tls-install">Installing the Certificates</a></span></dt></dl></dd><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-test-ldap-tls">Testing</a></span></dt><dt><span class="sect1"><a href="ch-ldap-tls.html#s1-int-ldap-tls">Troubleshooting</a></span></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-intro-ldap-tls"></a>Introduction</h2></div></div></div><p> 2 <a class="indexterm" name="id2691424"></a> 3 <a class="indexterm" name="id2691434"></a> 4 4 Up until now, we have discussed the straightforward configuration of <span class="trademark">OpenLDAP</span>™, 5 5 with some advanced features such as ACLs. This does not however, deal with the fact that the network … … 7 7 comes in. 8 8 </p><p> 9 <a class="indexterm" name="id269 7543"></a>9 <a class="indexterm" name="id2691458"></a> 10 10 <span class="trademark">OpenLDAP</span>™ clients and servers are capable of using the Transport Layer Security (TLS) 11 11 framework to provide integrity and confidentiality protections in accordance with <a class="ulink" href="http://rfc.net/rfc2830.html" target="_top">RFC 2830</a>; <span class="emphasis"><em>Lightweight Directory Access Protocol (v3): 12 12 Extension for Transport Layer Security.</em></span> 13 13 </p><p> 14 <a class="indexterm" name="id269 7572"></a>14 <a class="indexterm" name="id2691487"></a> 15 15 TLS uses X.509 certificates. All servers are required to have valid certificates, whereas client certificates 16 16 are optional. We will only be discussing server certificates. 17 </p><div class="tip" title="Tip"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p>18 <a class="indexterm" name="id269 7587"></a>19 <a class="indexterm" name="id269 7593"></a>20 <a class="indexterm" name="id269 7600"></a>17 </p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p> 18 <a class="indexterm" name="id2691501"></a> 19 <a class="indexterm" name="id2691508"></a> 20 <a class="indexterm" name="id2691514"></a> 21 21 The DN of a server certificate must use the CN attribute to name the server, and the CN must carry the 22 22 server's fully qualified domain name (FQDN). Additional alias names and wildcards may be present in the … … 24 24 </p></div><p> 25 25 We will discuss this more in the next sections. 26 </p></div><div class="sect1" title="Configuring"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-config-ldap-tls"></a>Configuring</h2></div></div></div><p>27 <a class="indexterm" name="id269 7640"></a>26 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-config-ldap-tls"></a>Configuring</h2></div></div></div><p> 27 <a class="indexterm" name="id2691554"></a> 28 28 Now on to the good bit. 29 </p><div class="sect2" title="Generating the Certificate Authority"><div class="titlepage"><div><div><h3 class="title"><a name="s1-config-ldap-tls-certs"></a>Generating the Certificate Authority</h3></div></div></div><p>30 <a class="indexterm" name="id269 7662"></a>29 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="s1-config-ldap-tls-certs"></a>Generating the Certificate Authority</h3></div></div></div><p> 30 <a class="indexterm" name="id2691577"></a> 31 31 In order to create the relevant certificates, we need to become our own Certificate Authority (CA). 32 <sup>[<a name="id269 7673" href="#ftn.id2697673" class="footnote">8</a>]</sup> This is necessary, so we can sign the server certificate.33 </p><p> 34 <a class="indexterm" name="id269 7703"></a>35 We will be using the <a class="ulink" href="http://www.openssl.org" target="_top">OpenSSL</a> <sup>[<a name="id269 7716" href="#ftn.id2697716" class="footnote">9</a>]</sup> software for this, which is included with every great <span class="trademark">Linux</span>® distribution.36 </p><p> 37 TLS is used for many types of servers, but the instructions<sup>[<a name="id269 7734" href="#ftn.id2697734" class="footnote">10</a>]</sup> presented here, are tailored for <span class="application">OpenLDAP</span>.38 </p><div class="note" title="Note"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>32 <sup>[<a name="id2691588" href="#ftn.id2691588" class="footnote">8</a>]</sup> This is necessary, so we can sign the server certificate. 33 </p><p> 34 <a class="indexterm" name="id2691618"></a> 35 We will be using the <a class="ulink" href="http://www.openssl.org" target="_top">OpenSSL</a> <sup>[<a name="id2691631" href="#ftn.id2691631" class="footnote">9</a>]</sup> software for this, which is included with every great <span class="trademark">Linux</span>® distribution. 36 </p><p> 37 TLS is used for many types of servers, but the instructions<sup>[<a name="id2691649" href="#ftn.id2691649" class="footnote">10</a>]</sup> presented here, are tailored for <span class="application">OpenLDAP</span>. 38 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 39 39 The <span class="emphasis"><em>Common Name (CN)</em></span>, in the following example, <span class="emphasis"><em>MUST</em></span> be 40 40 the fully qualified domain name (FQDN) of your ldap server. 41 41 </p></div><p> 42 42 First we need to generate the CA: 43 </p><pre class="screen" width="90">43 </p><pre class="screen"> 44 44 <code class="computeroutput"> 45 45 <code class="prompt">root# </code> mkdir myCA … … 47 47 </pre><p> 48 48 Move into that directory: 49 </p><pre class="screen" width="90">49 </p><pre class="screen"> 50 50 <code class="computeroutput"> 51 51 <code class="prompt">root# </code> cd myCA 52 52 </code> 53 53 </pre><p> 54 Now generate the CA:<sup>[<a name="id269 7811" href="#ftn.id2697811" class="footnote">11</a>]</sup>55 </p><pre class="screen" width="90">54 Now generate the CA:<sup>[<a name="id2691725" href="#ftn.id2691725" class="footnote">11</a>]</sup> 55 </p><pre class="screen"> 56 56 <code class="computeroutput"> 57 57 <code class="prompt">root# </code> /usr/share/ssl/misc/CA.pl -newca … … 84 84 </p><p> 85 85 There are some things to note here. 86 </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>86 </p><div class="orderedlist"><ol type="1"><li><p> 87 87 You <span class="emphasis"><em>MUST</em></span> remember the password, as we will need 88 88 it to sign the server certificate.. 89 </p></li><li class="listitem"><p>89 </p></li><li><p> 90 90 The <span class="emphasis"><em>Common Name (CN)</em></span>, <span class="emphasis"><em>MUST</em></span> be the 91 91 fully qualified domain name (FQDN) of your ldap server. 92 </p></li></ol></div></div><div class="sect2" title="Generating the Server Certificate"><div class="titlepage"><div><div><h3 class="title"><a name="s1-config-ldap-tls-server"></a>Generating the Server Certificate</h3></div></div></div><p>92 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="s1-config-ldap-tls-server"></a>Generating the Server Certificate</h3></div></div></div><p> 93 93 Now we need to generate the server certificate: 94 </p><pre class="screen" width="90">94 </p><pre class="screen"> 95 95 <code class="computeroutput"> 96 96 <code class="prompt">root# </code> openssl req -new -nodes -keyout newreq.pem -out newreq.pem … … 123 123 </p><p> 124 124 Again, there are some things to note here. 125 </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>125 </p><div class="orderedlist"><ol type="1"><li><p> 126 126 You should <span class="emphasis"><em>NOT</em></span> enter a password. 127 </p></li><li class="listitem"><p>127 </p></li><li><p> 128 128 The <span class="emphasis"><em>Common Name (CN)</em></span>, <span class="emphasis"><em>MUST</em></span> be 129 129 the fully qualified domain name (FQDN) of your ldap server. 130 130 </p></li></ol></div><p> 131 131 Now we sign the certificate with the new CA: 132 </p><pre class="screen" width="90">132 </p><pre class="screen"> 133 133 <code class="computeroutput"> 134 134 <code class="prompt">root# </code> /usr/share/ssl/misc/CA.pl -sign … … 175 175 </p><p> 176 176 That completes the server certificate generation. 177 </p></div><div class="sect2" title="Installing the Certificates"><div class="titlepage"><div><div><h3 class="title"><a name="s1-config-ldap-tls-install"></a>Installing the Certificates</h3></div></div></div><p>177 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="s1-config-ldap-tls-install"></a>Installing the Certificates</h3></div></div></div><p> 178 178 Now we need to copy the certificates to the right configuration directories, 179 179 rename them at the same time (for convenience), change the ownership and 180 180 finally the permissions: 181 </p><pre class="screen" width="90">181 </p><pre class="screen"> 182 182 <code class="computeroutput"> 183 183 <code class="prompt">root# </code> cp demoCA/cacert.pem /etc/openldap/ … … 192 192 Now we just need to add these locations to <code class="filename">slapd.conf</code>, 193 193 anywhere before the <code class="option">database</code> declaration as shown here: 194 </p><pre class="screen" width="90">194 </p><pre class="screen"> 195 195 <code class="computeroutput"> 196 196 TLSCertificateFile /etc/openldap/servercrt.pem … … 202 202 Here is the declaration and <code class="filename">ldap.conf</code>: 203 203 <code class="filename">ldap.conf</code> 204 </p><pre class="screen" width="90">204 </p><pre class="screen"> 205 205 <code class="computeroutput"> 206 206 TLS_CACERT /etc/openldap/cacert.pem … … 209 209 </p><p> 210 210 That's all there is to it. Now on to <a class="xref" href="ch-ldap-tls.html#s1-test-ldap-tls" title="Testing">the section called “Testing”</a> 211 </p></div></div><div class="sect1" title="Testing"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-test-ldap-tls"></a>Testing</h2></div></div></div><p>212 <a class="indexterm" name="id269 8219"></a>211 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-test-ldap-tls"></a>Testing</h2></div></div></div><p> 212 <a class="indexterm" name="id2692133"></a> 213 213 This is the easy part. Restart the server: 214 </p><pre class="screen" width="90">214 </p><pre class="screen"> 215 215 <code class="computeroutput"> 216 216 <code class="prompt">root# </code> /etc/init.d/ldap restart … … 221 221 </pre><p> 222 222 Then, using <code class="literal">ldapsearch</code>, test an anonymous search with the 223 <code class="option">-ZZ</code><sup>[<a name="id269 8261" href="#ftn.id2698261" class="footnote">12</a>]</sup> option:224 </p><pre class="screen" width="90">223 <code class="option">-ZZ</code><sup>[<a name="id2692176" href="#ftn.id2692176" class="footnote">12</a>]</sup> option: 224 </p><pre class="screen"> 225 225 <code class="computeroutput"> 226 226 <code class="prompt">root# </code> ldapsearch -x -b "dc=ldap,dc=abmas,dc=biz" \ … … 229 229 </pre><p> 230 230 Your results should be the same as before you restarted the server, for example: 231 </p><pre class="screen" width="90">231 </p><pre class="screen"> 232 232 <code class="computeroutput"> 233 233 <code class="prompt">root# </code> ldapsearch -x -b "dc=ldap,dc=abmas,dc=biz" \ … … 265 265 </pre><p> 266 266 If you have any problems, please read <a class="xref" href="ch-ldap-tls.html#s1-int-ldap-tls" title="Troubleshooting">the section called “Troubleshooting”</a> 267 </p></div><div class="sect1" title="Troubleshooting"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-int-ldap-tls"></a>Troubleshooting</h2></div></div></div><p>268 <a class="indexterm" name="id269 8359"></a>267 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="s1-int-ldap-tls"></a>Troubleshooting</h2></div></div></div><p> 268 <a class="indexterm" name="id2692274"></a> 269 269 The most common error when configuring TLS, as I have already mentioned numerous times, is that the 270 270 <span class="emphasis"><em>Common Name (CN)</em></span> you entered in <a class="xref" href="ch-ldap-tls.html#s1-config-ldap-tls-server" title="Generating the Server Certificate">the section called “Generating the Server Certificate”</a> is … … 276 276 </p><p> 277 277 For anything else, it's best to read through your ldap logfile or join the <span class="application">OpenLDAP</span> mailing list. 278 </p></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id269 7673" href="#id2697673" class="para">8</a>] </sup>We could however, get our generated server certificate signed by proper CAs, like <a class="ulink" href="http://www.thawte.com/" target="_top">Thawte</a> and <a class="ulink" href="http://www.verisign.com/" target="_top">VeriSign</a>, which278 </p></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id2691588" href="#id2691588" class="para">8</a>] </sup>We could however, get our generated server certificate signed by proper CAs, like <a class="ulink" href="http://www.thawte.com/" target="_top">Thawte</a> and <a class="ulink" href="http://www.verisign.com/" target="_top">VeriSign</a>, which 279 279 you pay for, or the free ones, via <a class="ulink" href="http://www.cacert.org/" target="_top">CAcert</a> 280 </p></div><div class="footnote"><p><sup>[<a name="ftn.id269 7716" href="#id2697716" class="para">9</a>] </sup>The downside to280 </p></div><div class="footnote"><p><sup>[<a name="ftn.id2691631" href="#id2691631" class="para">9</a>] </sup>The downside to 281 281 making our own CA, is that the certificate is not automatically recognized by clients, like the commercial 282 ones are.</p></div><div class="footnote"><p><sup>[<a name="ftn.id269 7734" href="#id2697734" class="para">10</a>] </sup>For information straight from the282 ones are.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2691649" href="#id2691649" class="para">10</a>] </sup>For information straight from the 283 283 horse's mouth, please visit <a class="ulink" href="http://www.openssl.org/docs/HOWTO/" target="_top">http://www.openssl.org/docs/HOWTO/</a>; the main OpenSSL 284 site.</p></div><div class="footnote"><p><sup>[<a name="ftn.id269 7811" href="#id2697811" class="para">11</a>] </sup>Your <code class="filename">CA.pl</code> or <code class="filename">CA.sh</code> might not be284 site.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2691725" href="#id2691725" class="para">11</a>] </sup>Your <code class="filename">CA.pl</code> or <code class="filename">CA.sh</code> might not be 285 285 in the same location as mine is, you can find it by using the <code class="literal">locate</code> command, i.e., 286 286 <code class="literal">locate CA.pl</code>. If the command complains about the database being too old, run 287 <code class="literal">updatedb</code> as <span class="emphasis"><em>root</em></span> to update it.</p></div><div class="footnote"><p><sup>[<a name="ftn.id269 8261" href="#id2698261" class="para">12</a>] </sup>See <code class="literal">man ldapsearch</code></p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="speed.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="Appendix.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="ch47.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 45. Samba Performance Tuning </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 47. Samba Support</td></tr></table></div></body></html>287 <code class="literal">updatedb</code> as <span class="emphasis"><em>root</em></span> to update it.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2692176" href="#id2692176" class="para">12</a>] </sup>See <code class="literal">man ldapsearch</code></p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="speed.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="Appendix.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="ch47.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 45. Samba Performance Tuning </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 47. Samba Support</td></tr></table></div></body></html>
Note:
See TracChangeset
for help on using the changeset viewer.
