{"id":19567,"date":"2017-05-20T06:57:17","date_gmt":"2017-05-19T22:57:17","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/05\/20\/ldap-over-tls\/"},"modified":"2021-03-18T17:25:02","modified_gmt":"2021-03-18T09:25:02","slug":"ldap-over-tls","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/05\/20\/ldap-over-tls\/","title":{"rendered":"LDAP over TLS"},"content":{"rendered":"

\u53c3\u8003\u7db2\u9801\uff1a
CentOS 7 : Create SSL Certificates : Server World<\/a>
CentOS 7 : OpenLDAP : LDAP over TLS : Server World<\/a><\/p>\n

1. \u5207\u63db\u76ee\u9304
# cd \/etc\/pki\/tls\/certs<\/span>
2. \u5efa\u7acb server.key
# make server.key<\/span>
umask 77 ; <\/span>
\/usr\/bin\/openssl genrsa -aes128 2048 > server.key<\/span>
Generating RSA private key, 2048 bit long modulus<\/span>
…………….+++<\/span>
…………………………………………………………+++<\/span>
e is 65537 (0x10001)<\/span>
Enter pass phrase:<\/span>
Verifying – Enter pass phrase:[@more@]<\/span>
3. \u53bb\u9664\u5bc6\u78bc\u5f9e server.key
# openssl rsa -in server.key -out server.key<\/span>
Enter pass phrase for server.key:<\/span>
writing RSA key<\/span><\/p>\n

4. \u5efa\u7acb server.csr<\/span>
# make server.csr<\/span>
umask 77 ; <\/span>
\/usr\/bin\/openssl req -utf8 -new -key server.key -out server.csr<\/span>
You are about to be asked to enter information that will be incorporated<\/span>
into your certificate request.<\/span>
What you are about to enter is what is called a Distinguished Name or a DN.<\/span>
There are quite a few fields but you can leave some blank<\/span>
For some fields there will be a default value,<\/span>
If you enter ‘.’, the field will be left blank.<\/span>
—–<\/span>
Country Name (2 letter code) [TW]:<\/span>
State or Province Name (full name) [Yilan]:<\/span>
Locality Name (eg, city) [TouCheng]:<\/span>
Organization Name (eg, company) [Elementary School]:<\/span>
Organizational Unit Name (eg, section) [LDAP Server]:<\/span>
Common Name (eg, your name or your server’s hostname) []:xxxx.tces.ilc.edu.tw<\/span>
Email Address []:<\/span><\/p>\n

Please enter the following ‘extra’ attributes<\/span>
to be sent with your certificate request<\/span>
A challenge password []:<\/span>
An optional company name []:<\/span><\/p>\n

5. \u5efa\u7acb\u99ae\u8b49
# openssl x509 -in server.csr -out server.crt -req -signkey server.key -days 3650<\/span>
Signature ok<\/span>
subject=\/C=TW\/ST=Yilan\/L=TouCheng\/O=Elementary School\/OU=LDAP Server\/CN=xxxx.tces.ilc.edu.tw<\/span>
Getting Private key<\/span><\/p>\n

6. \u8907\u88fd\u6a94\u6848\u5230 \/etc\/openldap\/certs<\/span> \u76ee\u9304
# cp \/etc\/pki\/tls\/certs\/server.key \/etc\/pki\/tls\/certs\/server.crt \/etc\/pki\/tls\/certs\/ca-bundle.crt \/etc\/openldap\/certs<\/span><\/p>\n

7. \u66f4\u6539\u6a94\u6848\u64c1\u6709\u8005\u53ca\u7fa4\u7d44
# chown ldap:ldap \/etc\/openldap\/certs\/server.* \/etc\/openldap\/certs\/ca-bundle.crt<\/span><\/p>\n

8. \u5efa\u7acb mod_ssl.ldif<\/span>
# cat mod_ssl.ldif<\/span>
dn: cn=config<\/span>
changetype: modify<\/span>
add: olcTLSCACertificateFile<\/span>
olcTLSCACertificateFile: \/etc\/openldap\/certs\/ca-bundle.crt<\/span>
–<\/span>
replace: olcTLSCertificateFile<\/span>
olcTLSCertificateFile: \/etc\/openldap\/certs\/server.crt<\/span>
–<\/span>
replace: olcTLSCertificateKeyFile<\/span>
olcTLSCertificateKeyFile: \/etc\/openldap\/certs\/server.key<\/span><\/p>\n

9. \u532f\u5165
#\u00a0 ldapmodify -Y EXTERNAL -H ldapi:\/\/\/ -f mod_ssl.ldif<\/span>
SASL\/EXTERNAL authentication started<\/span>
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth<\/span>
SASL SSF: 0<\/span>
modifying entry “cn=config”<\/span><\/p>\n

10. \u4fee\u6539 \/etc\/sysconfig\/slapd<\/span> \u52a0\u5165 ldaps:\/\/\/<\/span>
# cp<\/span> \/etc\/sysconfig\/slapd <\/span>\/etc\/sysconfig\/slapd.$(date +%F)<\/span>
# sed -i ‘\/SLAPD_URLS\/s@ldapi:\/\/\/ ldap:\/\/\/@ldapi:\/\/\/ ldap:\/\/\/ ldaps:\/\/\/@’ \/etc\/sysconfig\/slapd<\/span><\/p>\n

11. \u91cd\u65b0\u555f\u52d5 LDAP Server
# systemctl restart slapd.service<\/span><\/p>\n

12. \u6aa2\u67e5\u662f\u5426\u6709\u6b63\u5e38\u57f7\u884c
# netstat -antulp | egrep ‘389|636’<\/span>
tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 0.0.0.0:636\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0:*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LISTEN\u00a0\u00a0\u00a0\u00a0\u00a0 1933\/slapd<\/span>
tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 0.0.0.0:389\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0:*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LISTEN\u00a0\u00a0\u00a0\u00a0\u00a0 1933\/slapd<\/span>
tcp6\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 :::636\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :::*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LISTEN\u00a0\u00a0\u00a0\u00a0\u00a0 1933\/slapd<\/span>
tcp6\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 :::389\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :::*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LISTEN\u00a0\u00a0\u00a0\u00a0\u00a0 1933\/slapd<\/span><\/p>\n

13. \u9632\u706b\u7246\u8a2d\u5b9a
# firewall-cmd –permanent –add-service=ldap<\/span>
# firewall-cmd –permanent –add-service=ldaps<\/span>
# firewall-cmd –reload<\/span>
\u6216
# iptables -A INPUT -p tcp -s 192.168.1.0\/24 –syn -m state –state NEW –dport 389 -j ACCEPT<\/span>
# iptables -A INPUT -p tcp -s 192.168.1.0\/24 –syn -m state –state NEW –dport 636 -j ACCEPT<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u53c3\u8003\u7db2\u9801\uff1aCentOS 7 : Create SSL Certificates : Server WorldC … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008LDAP over TLS\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117,115],"tags":[],"class_list":["post-19567","post","type-post","status-publish","format-standard","hentry","category-c-78462","category-c-78460"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["688343"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19567"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19567"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19567\/revisions"}],"predecessor-version":[{"id":21075,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19567\/revisions\/21075"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19567"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19567"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19567"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}