{"id":19566,"date":"2017-05-20T06:54:59","date_gmt":"2017-05-19T22:54:59","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/05\/20\/ldap-over-tls-%e5%a4%b1%e6%95%97\/"},"modified":"2021-03-18T17:25:02","modified_gmt":"2021-03-18T09:25:02","slug":"ldap-over-tls-%e5%a4%b1%e6%95%97","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/05\/20\/ldap-over-tls-%e5%a4%b1%e6%95%97\/","title":{"rendered":"LDAP over TLS – \u5931\u6557"},"content":{"rendered":"

\u70ba\u4e86\u5b89\u5168\u7684\u56e0\u7d20\uff0cLDAP \u53ef\u4ee5\u8d70 TLS\/SSL \u52a0\u5bc6\u5354\u5b9a\u3002
\u53c3\u8003\u7db2\u9801\uff1a
Linux \uff0e \u7121\u9650: \u5728 CentOS7\/RHEL7 \u4e0a\u5b89\u88dd\u8a2d\u5b9a LDAP Server(\u4e00)<\/a> <\/p>\n

1. \u5b89\u88dd openssl \u5957\u4ef6
# yum install openssl<\/span> <\/p>\n

2. \u4fee\u6539 \/etc\/pki\/tls\/openssl.cnf<\/span>
# cp \/etc\/pki\/tls\/openssl.cnf \/etc\/pki\/tls\/openssl.cnf.$(date +%F)<\/span>
[ req_distinguished_name ]<\/span>
countryName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = Country Name (2 letter code)<\/span>
countryName_default\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = TW<\/span>
countryName_min\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = 2<\/span>
countryName_max\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = 2<\/span> <\/p>\n

stateOrProvinceName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = State or Province Name (full name)<\/span>
stateOrProvinceName_default\u00a0\u00a0\u00a0\u00a0 = Yilan<\/span> <\/p>\n

localityName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = Locality Name (eg, city)<\/span>
localityName_default\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = TouCheng<\/span> <\/p>\n

0.organizationName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = Organization Name (eg, company)<\/span>
0.organizationName_default\u00a0\u00a0\u00a0\u00a0\u00a0 = Elementary School<\/span> <\/p>\n

organizationalUnitName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = Organizational Unit Name (eg, section)<\/span>
organizationalUnitName_default\u00a0 = LDAP Server[@more@]<\/span>
3. \u88fd\u4f5c\u91d1\u9470
# openssl req -new -x509 -nodes -out \/etc\/openldap\/certs\/cert.pem -keyout \/etc\/openldap\/certs\/priv.pem -days 3650<\/span>
Generating a 2048 bit RSA private key<\/span>
………+++<\/span>
……………+++<\/span>
writing new private key to ‘\/etc\/openldap\/certs\/priv.pem’<\/span>
—–<\/span>
You are about to be asked to enter information that will be incorporated<\/span>
into your certificate request.<\/span>
What you are about to enter is what is called a Distinguished Name or a DN.<\/span>
There are quite a few fields but you can leave some blank<\/span>
For some fields there will be a default value,<\/span>
If you enter ‘.’, the field will be left blank.<\/span>
—–<\/span>
Country Name (2 letter code) [TW]:<\/span>
State or Province Name (full name) [Yilan]:<\/span>
Locality Name (eg, city) [TouCheng]:<\/span>
Organization Name (eg, company) [Elementary School]:<\/span>
Organizational Unit Name (eg, section) [LDAP Server]:<\/span>
Common Name (eg, your name or your server’s hostname) []:<\/span>
Email Address []:<\/span> <\/p>\n

4. \u6539\u8b8a\u76ee\u9304\u64c1\u6709\u8005\u53ca\u7fa4\u7d44\u548c\u6a94\u6848\u6b0a\u9650
# chown -R ldap:ldap \/etc\/openldap\/certs<\/span>
# chmod 600 \/etc\/openldap\/certs\/priv.pem<\/span>
# ls -l \/etc\/openldap\/certs\/*<\/span>
-rw-r–r– 1 ldap ldap 65536 Mar\u00a0 8 17:46 \/etc\/openldap\/certs\/cert8.db<\/span>
-rw-r–r– 1 ldap ldap\u00a0 1391 Mar 10 14:14 \/etc\/openldap\/certs\/cert.pem<\/span>
-rw-r–r– 1 ldap ldap 16384 Mar\u00a0 8 17:46 \/etc\/openldap\/certs\/key3.db<\/span>
-r–r—– 1 ldap ldap\u00a0\u00a0\u00a0 45 Dec\u00a0 7 10:22 \/etc\/openldap\/certs\/password<\/span>
-rw——- 1 ldap ldap\u00a0 1704 Mar 10 14:14 \/etc\/openldap\/certs\/priv.pem<\/span>
-rw-r–r– 1 ldap ldap 16384 Dec\u00a0 7 10:22 \/etc\/openldap\/certs\/secmod.db<\/span> <\/p>\n

5. \u5efa\u7acb tlsc.ldif
# cat tlsc.ldif<\/span>
dn: cn=config<\/span>
changetype: modify<\/span>
replace: olcTLSCertificateFile<\/span>
olcTLSCertificateFile: \/etc\/openldap\/certs\/cert.pem<\/span> <\/p>\n

dn: cn=config<\/span>
changetype: modify<\/span>
replace: olcTLSCertificateKeyFile<\/span>
olcTLSCertificateKeyFile: \/etc\/openldap\/certs\/priv.pem<\/span> <\/p>\n

6. \u532f\u5165
# \/bin\/ldapmodify -Y EXTERNAL -H ldapi:\/\/\/ -f tlsc.ldif<\/span>
SASL\/EXTERNAL authentication started<\/span>
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth<\/span>
SASL SSF: 0<\/span>
modifying entry “cn=config”<\/span> <\/p>\n

modifying entry “cn=config”<\/span><\/p>\n

7. \u91cd\u65b0\u555f\u52d5 LDAP Server
# systemctl restart slapd.service<\/span><\/p>\n

\u4f3c\u4e4e\u6c92\u6709\u6210\u529f\uff0c\u5617\u8a66\u5176\u5b83\u65b9\u6cd5\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"

\u70ba\u4e86\u5b89\u5168\u7684\u56e0\u7d20\uff0cLDAP \u53ef\u4ee5\u8d70 TLS\/SSL \u52a0\u5bc6\u5354\u5b9a\u3002 \u53c3\u8003\u7db2\u9801\uff1a Linux \uff0e \u7121\u9650: \u5728 Cent … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008LDAP over TLS – \u5931\u6557\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117,115],"tags":[],"class_list":["post-19566","post","type-post","status-publish","format-standard","hentry","category-c-78462","category-c-78460"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["688272"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19566"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19566"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19566\/revisions"}],"predecessor-version":[{"id":21074,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19566\/revisions\/21074"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19566"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19566"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19566"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}