Configure OpenLDAP with SSL/TLS

To improve the security of the communication with the ldap servers, it’s very interesting to configure the protocol SSL/TLS to encrypt all the data across the network. This configuration requires a valid X.509 certificate signed by a CA (certified authority) or signed yourself. In the configuration show in this post I’ll use a self-signed certificate and this will be configured in the ldap server and finally configure an ldap client to the ldap server across SSL/TLS:

ssl-tls

Configuring ldap server

- Creating a self signed certificate with openssl utility:

1
2
3
4
5
# mkdir /etc/ldap/ssl
# openssl genrsa -out /etc/ldap/ssl/private.key 2048
# openssl req -new -x509 -key /etc/ldap/ssl/private.key -out /etc/ldap/ssl/cert.pem -days 432
# chown openldap
# chown -R openldap:openldap /etc/ldap/ssl/

- Edit the slapd.conf file to add the new certificate and the key created:

1
2
3
4
5
6
# vi /etc/ldap/slapd.conf
 
TLSCACertificateFile /etc/ldap/ssl/cert.pem
TLSCertificateFile /etc/ldap/ssl/cert.pem
TLSCertificateKeyFile /etc/ldap/ssl/private.key
TLSCipherSuite SECURE256:!AES-128-CBC

- TLSCipherSuite directive defines the list of ciphers from which slapd will negotiate in the connection. To show the list ciphers available in your system type the next command (it’s necessary to be installed gnutls-bin package):

1
# gnutls-cli -l

- Edit /etc/default/slapd:

- Restarting slapd:

1
# service slapd restart

Configuring the client

- Edit /etc/ldap/ldap.conf

1
2
3
4
5
6
BASE dc=opentodo,dc=net
URI ldaps://172.16.0.100
TLS_CACERT /etc/ldap/cert.pem
#the server don't check the certificate
#necessary for self signed certificates
TLS_REQCERT never

- Sources:

http://www.zytrax.com/books/ldap/ch15/

Nhận xét

Đăng nhận xét

Bài đăng phổ biến từ blog này

CLEANING UP THE ZABBIX DATABASE

My Zabbix database size increased a lot in the last few months and since my disk was running out space, I decided to clean up the old events from the database. Looking at the database tables, the biggest one was  history_uint , which holds the items history data – over 400 millions of records and over 30 Gb of disk space before the clean up. Since deleting the old records from this table directly would be a very slow process, I decided to create a new table and insert the latest records from the  history_uint  table and then just replace the old table with a new one. Since this is not an offical procedure, use it at your own risk. Environment: Zabbix v2.2 MySql 5.1 – InnoDB with  innodb_file_per_table=ON Step 1 – Stop the Zabbix server Step 2 – Open your favourite MySQL client and create a new table CREATE TABLE  history_uint_new  LIKE  history_uint; Step 3 – Insert the latest records from the  history_uint  table to the...
Đọc thêm

[Resolved] Amazon EC2 Redhat 7 using 6GB for the root space

Hình ảnh
I create new server with 10GB of HDD, but when i check on the command line, the root space only show 6GB. I'm using t2.micto and Redhat 7.0, disk type: XFS. - xvda1: boot partition - xvda2: root partition Fix Step: We have instance A with the volume VA. 1) Stop the current instace A 2) Snapshot the current volume VA of the instance A 3) Start the instance A 4) Create new volume with 25GB by using the snapshot of volume VA then we have new volume VB 5) Attach the new volume VB to the instance A as default (/dev/sdf) 6) From the ssh console, i use the lsblk command to list the disk. # lsblk 7) Using the xfs_repair to repair the /dev/xvdf2 ( yum install xfsprogs) # xfs_repair /dev/xvdf2 8) Continue as the image below 9) Remove the /dev/xvdf2, remember the start of this disk then we will create the new one with the same. 10) Using XFS command to repair the /dev/xvdf2 again. # xfs_repair /dev/xvdf2 11) Use the lsblk co...
Đọc thêm

Connect to a different port with SQL Server Management Studio

Hình ảnh
Microsoft's SQL Server Management Studio will connect by default to port 1433 and there's nowhere in the connect dialog to specify a different port from the default. To connect using a different port specify the servername, a comma, and then the port number as shown in this post. Connect using a different port using a comma The connection dialog in the SQL Server Management Studio client is shown in the screenshot below. Normally you would just type the server name into field but to specify a different port use a comma then the port number. The example screenshot above shows " 192.168.50.166\SQLSERVER2012 " as the instance name and "port" where the port would be. 192.168.50.166\SQLSERVER2012,1343 Then specify the login credentials, click the connect button, and assuming everything is correct it should then connect to the SQL Server. Setup specific port for SQL Server: Link: http://msdn.microsoft.com/en-us/library/ms177440.aspx
Đọc thêm