Oracle Linux/OpenLDAP - Revision history

R00t: /* TLS Configuration */

2020-08-22T05:42:26Z

‎TLS Configuration

R00t: /* Implement certs and key */

2020-08-20T21:19:39Z

‎Implement certs and key

R00t: /* TLS Configuration */

2020-08-20T14:09:51Z

‎TLS Configuration

R00t at 14:08, 20 August 2020

2020-08-20T14:08:05Z

R00t: /* Update HTTPD */

2020-08-17T17:56:51Z

‎Update HTTPD

R00t at 06:31, 29 July 2020

2020-07-29T06:31:51Z

R00t: /* Installation */

2020-07-29T06:25:57Z

‎Installation

R00t: /* Setup LDAP Admin password */

2020-07-29T06:19:22Z

‎Setup LDAP Admin password

R00t: /* Installation */

2020-07-29T06:18:48Z

‎Installation

R00t at 06:02, 29 July 2020

2020-07-29T06:02:07Z

@@ Line 129: / Line 129: @@
 TLS or SSL is required for sssd, so if you want to use openldap authentication for ssh this is pretty much a requirement.<br>
 In the example below, i've included a CA certificate because I created my own CA, you may not have to.<br>
 ==Position certs and key==
 Create the directories and move the certs and keys into them.

@@ Line 150: / Line 150: @@
 olcTLSCACertificateFile: /etc/openldap/cacerts/ca_server.crt
-~$ sudo ldapmodify -Y EXTERNAL -H ldapi:// -f /home/fgiuliani/addcerts.ldif
+~$ sudo ldapmodify -Y EXTERNAL -H ldapi:// -f /home/r00t/addcerts.ldif
 ~$ sudo slapcat -b "cn=config" | egrep "olcTLSC"</nowiki>
 ==Update for CA==
 Update ldap.conf for CA Cert. <code>TLS_REQCERT never</code> can be used to eliminate cert verification for self-signed cert. Security implications are obvious.

@@ Line 129: / Line 129: @@
 TLS or SSL is required for sssd, so if you want to use openldap authentication for ssh this is pretty much a requirement.<br>
 In the example below, i've included a CA certificate because I created my own CA, you may not have to.<br>
 Create the directories and move the certs and keys into them.
   <nowiki>~$ sudo mkdir /etc/openssl/private /etc/openssl/cacerts
@@ Line 135: / Line 136: @@
 ~$ sudo mv ~/ldap_server.key /etc/openldap/private/
 ~$ sudo chown -R ldap:ldap /etc/openldap/certs /etc/openldap/cacerts /etc/openldap/private/ </nowiki>
 Import the certs and keys, then verify.
   <nowiki>~$ vi addcerts.ldif
@@ Line 150: / Line 152: @@
 ~$ sudo ldapmodify -Y EXTERNAL -H ldapi:// -f /home/fgiuliani/addcerts.ldif
 ~$ sudo slapcat -b "cn=config" | egrep "olcTLSC"</nowiki>
 Update ldap.conf for CA Cert. <code>TLS_REQCERT never</code> can be used to eliminate cert verification for self-signed cert. Security implications are obvious.
   <nowiki>~$ sudo vi /etc/openldap/ldap.conf
@@ Line 156: / Line 159: @@
 TLS_CACERT	/etc/openldap/certs/ca_server.crt
 TLS_REQCERT	never</nowiki>
 Restart <code>slapd</code> service
   <nowiki>sudo systemctl restart slapd.service</nowiki>
 Open firewall
   <nowiki>~$ sudo firewall-cmd --permanent --add-service=ldaps</nowiki>

← Older revision		Revision as of 14:08, 20 August 2020
Line 125:		Line 125:
	==Connect==		==Connect==
	http://<ip address/hostname>/phpldapadmin		http://<ip address/hostname>/phpldapadmin
		+
		+	=TLS Configuration=
		+	TLS or SSL is required for sssd, so if you want to use openldap authentication for ssh this is pretty much a requirement.<br>
		+	In the example below, i've included a CA certificate because I created my own CA, you may not have to.<br>
		+	Create the directories and move the certs and keys into them.
		+	<nowiki>~$ sudo mkdir /etc/openssl/private /etc/openssl/cacerts
		+	~$ sudo mv ~/ca_server.crt /etc/openldap/cacerts
		+	~$ sudo mv ~/ldap_server.crt /etc/openldap/certs/
		+	~$ sudo mv ~/ldap_server.key /etc/openldap/private/
		+	~$ sudo chown -R ldap:ldap /etc/openldap/certs /etc/openldap/cacerts /etc/openldap/private/ </nowiki>
		+	Import the certs and keys, then verify.
		+	<nowiki>~$ vi addcerts.ldif
		+	dn: cn=config
		+	changetype: modify
		+	replace: olcTLSCertificateFile
		+	olcTLSCertificateFile: /etc/openldap/certs/ldap_server.crt
		+	-
		+	replace: olcTLSCertificateKeyFile
		+	olcTLSCertificateKeyFile: /etc/openldap/private/ldap_server.key
		+	-
		+	add: olcTLSCACertificateFile
		+	olcTLSCACertificateFile: /etc/openldap/cacerts/ca_server.crt
		+
		+	~$ sudo ldapmodify -Y EXTERNAL -H ldapi:// -f /home/fgiuliani/addcerts.ldif
		+	~$ sudo slapcat -b "cn=config" \| egrep "olcTLSC"</nowiki>
		+	Update ldap.conf for CA Cert. <code>TLS_REQCERT never</code> can be used to eliminate cert verification for self-signed cert. Security implications are obvious.
		+	<nowiki>~$ sudo vi /etc/openldap/ldap.conf
		+	...
		+	TLS_CACERTDIR /etc/openldap/certs
		+	TLS_CACERT /etc/openldap/certs/ca_server.crt
		+	TLS_REQCERT never</nowiki>
		+	Restart <code>slapd</code> service
		+	<nowiki>sudo systemctl restart slapd.service</nowiki>
		+	Open firewall
		+	<nowiki>~$ sudo firewall-cmd --permanent --add-service=ldaps</nowiki>

@@ Line 104: / Line 104: @@
 Alias /ldapadmin /usr/share/phpldapadmin/htdocs
-usr/share/phpldapadmin/htdocs>
+<Directory /usr/share/phpldapadmin/htdocs>
-  <IfModule mod_authz_core.c>
+   <IfModule mod_authz_core.c>
-    # Apache 2.4
+     # Apache 2.4     Require all granted
-    # Require local
+   </IfModule>
-     Require all granted
+   <IfModule !mod_authz_core.c>
-  IfModule>
+     # Apache 2.2
-  <IfModule !mod_authz_core.c>
+     Order Deny,Allow
-    # Apache 2.2
+     Deny from all
-    Order Deny,Allow
+     Allow from 127.0.0.1
-    Deny from all
+     Allow from ::1
-    Allow from 127.0.0.1
+   </IfModule>
-    Allow from ::1
-  </IfModule>
 </Directory></nowiki>
 restart

← Older revision		Revision as of 06:31, 29 July 2020
Line 124:		Line 124:
	<nowiki>~$ sudo firewall-cmd --permanent --add-service=http		<nowiki>~$ sudo firewall-cmd --permanent --add-service=http
	~$ sudo firewall-cmd --reload</nowiki>		~$ sudo firewall-cmd --reload</nowiki>
		+
		+	==Connect==
		+	http://<ip address/hostname>/phpldapadmin

@@ Line 82: / Line 82: @@
 ==Installation==
   <nowiki>~$ sudo yum install -y epel-release
-sudo yum install -y phpldapadmin</nowiki>
+~$ sudo yum install -y phpldapadmin</nowiki>
 ==Edit Configuration==
   <nowiki>~$ sudo vim /etc/phpldapadmin/config.php

@@ Line 15: / Line 15: @@
 ==Setup LDAP Admin password==
 Create a SHA hash of the desired password for the ldap admin and add it to the ldap config.  The parameter may not exist in the config file, you may need to add it.
-  <nowiki>~$ slappasswd -h {SSHA} -s ldappassword
+  <nowiki>~$ slappasswd -h {SSHA} -s ldappassword</nowiki>
 ==Configure LDAP Server==
 create db.ldif and update:

@@ Line 5: / Line 5: @@
 =Installation=
   <nowiki>~$ sudo yum install -y openldap-clients openldap-servers
-~$ systemctl start slapd
+~$ sudo systemctl start slapd
-~$ systemctl enable slapd</nowiki>
+~$ sudo systemctl enable slapd</nowiki>
 =Configuration=