Chapter 46. LDAP and Transport Layer Security
Prev | Part VI. Reference Section | Next

## Chapter 46. LDAP and Transport Layer Security

### Gavin Henry

Suretec Systems Limited, UK

`<ghenry@suretecsystems.com>`

July 8, 2005

## Introduction

Up until now, we have discussed the straightforward configuration of OpenLDAP™, with some advanced features such as ACLs. This does not however, deal with the fact that the network transmissions are still in plain text. This is where Transport Layer Security (TLS) comes in.

OpenLDAP™ clients and servers are capable of using the Transport Layer Security (TLS) framework to provide integrity and confidentiality protections in accordance with RFC 2830; Lightweight Directory Access Protocol (v3): Extension for Transport Layer Security.

TLS uses X.509 certificates. All servers are required to have valid certificates, whereas client certificates are optional. We will only be discussing server certificates.

### Tip

The DN of a server certificate must use the CN attribute to name the server, and the CN must carry the server's fully qualified domain name (FQDN). Additional alias names and wildcards may be present in the `subjectAltName` certificate extension. More details on server certificate names are in RFC2830.

We will discuss this more in the next sections.

## Configuring

Now on to the good bit.

### Generating the Certificate Authority

In order to create the relevant certificates, we need to become our own Certificate Authority (CA). [8] This is necessary, so we can sign the server certificate.

We will be using the OpenSSL [9] software for this, which is included with every great Linux® distribution.

TLS is used for many types of servers, but the instructions[10] presented here, are tailored for OpenLDAP.

### Note

The Common Name (CN), in the following example, MUST be the fully qualified domain name (FQDN) of your ldap server.

First we need to generate the CA:

    root#  mkdir myCA

Move into that directory:

    root#  cd myCA

Now generate the CA:[11]

    root#  /usr/share/ssl/misc/CA.pl -newca
    CA certificate filename (or enter to create)

    Making CA certificate ...
    Generating a 1024 bit RSA private key
    .......................++++++
    .............................++++++
    writing new private key to './demoCA/private/cakey.pem'
    Enter PEM pass phrase:
    Verifying - Enter PEM pass phrase:
    -----
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) [AU]:AU
    State or Province Name (full name) [Some-State]:NSW
    Locality Name (eg, city) []:Sydney
    Organization Name (eg, company) [Internet Widgits Pty Ltd]:Abmas
    Organizational Unit Name (eg, section) []:IT
    Common Name (eg, YOUR name) []:ldap.abmas.biz
    Email Address []:support@abmas.biz

There are some things to note here.

1. You MUST remember the password, as we will need it to sign the server certificate..

2. The Common Name (CN), MUST be the fully qualified domain name (FQDN) of your ldap server.

### Generating the Server Certificate

Now we need to generate the server certificate:

    root#  openssl req -new -nodes -keyout newreq.pem -out newreq.pem
    Generating a 1024 bit RSA private key
    .............++++++
    ........................................................++++++
    writing new private key to 'newreq.pem'
    -----
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) [AU]:AU
    State or Province Name (full name) [Some-State]:NSW
    Locality Name (eg, city) []:Sydney
    Organization Name (eg, company) [Internet Widgits Pty Ltd]:Abmas
    Organizational Unit Name (eg, section) []:IT
    Common Name (eg, YOUR name) []:ldap.abmas.biz
    Email Address []:support@abmas.biz

    Please enter the following 'extra' attributes
    to be sent with your certificate request
    A challenge password []:
    An optional company name []:

Again, there are some things to note here.

1. You should NOT enter a password.

2. The Common Name (CN), MUST be the fully qualified domain name (FQDN) of your ldap server.

Now we sign the certificate with the new CA:

    root#  /usr/share/ssl/misc/CA.pl -sign
    Using configuration from /etc/ssl/openssl.cnf
    Enter pass phrase for ./demoCA/private/cakey.pem:
    Check that the request matches the signature
    Signature ok
    Certificate Details:
    Serial Number: 1 (0x1)
    Validity
    	Not Before: Mar  6 18:22:26 2005 EDT
    	Not After : Mar  6 18:22:26 2006 EDT
    Subject:
    	countryName               = AU
    	stateOrProvinceName       = NSW
    	localityName              = Sydney
    	organizationName          = Abmas
    	organizationalUnitName    = IT
    	commonName                = ldap.abmas.biz
    	emailAddress              = support@abmas.biz
    X509v3 extensions:
    	X509v3 Basic Constraints:
    	    CA:FALSE
    	Netscape Comment:
    	    OpenSSL Generated Certificate
    	X509v3 Subject Key Identifier:
    	    F7:84:87:25:C4:E8:46:6D:0F:47:27:91:F0:16:E0:86:6A:EE:A3:CE
    	X509v3 Authority Key Identifier:
    	    keyid:27:44:63:3A:CB:09:DC:B1:FF:32:CC:93:23:A4:F1:B4:D5:F0:7E:CC
    	    DirName:/C=AU/ST=NSW/L=Sydney/O=Abmas/OU=IT/
    						CN=ldap.abmas.biz/emailAddress=support@abmas.biz
    	    serial:00

    Certificate is to be certified until Mar  6 18:22:26 2006 EDT (365 days)
    Sign the certificate? [y/n]:y

    1 out of 1 certificate requests certified, commit? [y/n]y
    Write out database with 1 new entries
    Data Base Updated
    Signed certificate is in newcert.pem

That completes the server certificate generation.

### Installing the Certificates

Now we need to copy the certificates to the right configuration directories, rename them at the same time (for convenience), change the ownership and finally the permissions:

    root#  cp demoCA/cacert.pem /etc/openldap/
    root#  cp newcert.pem /etc/openldap/servercrt.pem
    root#  cp newreq.pem /etc/openldap/serverkey.pem
    root#  chown ldap.ldap /etc/openldap/*.pem
    root#  chmod 640 /etc/openldap/cacert.pem;
    root#  chmod 600 /etc/openldap/serverkey.pem

Now we just need to add these locations to `slapd.conf`, anywhere before the `database` declaration as shown here:

    TLSCertificateFile /etc/openldap/servercrt.pem
    TLSCertificateKeyFile /etc/openldap/serverkey.pem
    TLSCACertificateFile /etc/openldap/cacert.pem

Here is the declaration and `ldap.conf`: `ldap.conf`

    TLS_CACERT /etc/openldap/cacert.pem

That's all there is to it. Now on to the section called “Testing”

## Testing

This is the easy part. Restart the server:

    root#  /etc/init.d/ldap restart
    Stopping slapd:                                            [  OK  ]
    Checking configuration files for slapd: config file testing succeeded
    Starting slapd:                                            [  OK  ]

Then, using `ldapsearch`, test an anonymous search with the `-ZZ`[12] option:

    root#  ldapsearch -x -b "dc=ldap,dc=abmas,dc=biz" \
            -H 'ldap://ldap.abmas.biz:389' -ZZ

Your results should be the same as before you restarted the server, for example:

    root#  ldapsearch -x -b "dc=ldap,dc=abmas,dc=biz" \
        -H 'ldap://ldap.abmas.biz:389' -ZZ

    # extended LDIF
    #
    # LDAPv3
    # base <> with scope sub
    # filter: (objectclass=*)
    # requesting: ALL
    #

    # abmas.biz
    dn: dc=ldap,dc=abmas,dc=biz
    objectClass: dcObject
    objectClass: organization
    o: Abmas
    dc: abmas

    # Manager, ldap.abmas.biz
    dn: cn=Manager,dc=ldap,dc=abmas,dc=biz
    objectClass: organizationalRole
    cn: Manager

    # ABMAS, abmas.biz
    dn: sambaDomainName=ABMAS,dc=ldap,dc=abmas,dc=biz
    sambaDomainName: ABMAS
    sambaSID: S-1-5-21-238355452-1056757430-1592208922
    sambaAlgorithmicRidBase: 1000
    objectClass: sambaDomain
    sambaNextUserRid: 67109862
    sambaNextGroupRid: 67109863

If you have any problems, please read the section called “Troubleshooting”

## Troubleshooting

The most common error when configuring TLS, as I have already mentioned numerous times, is that the Common Name (CN) you entered in the section called “Generating the Server Certificate” is NOT the Fully Qualified Domain Name (FQDN) of your ldap server.

Other errors could be that you have a typo somewhere in your `ldapsearch` command, or that your have the wrong permissions on the `servercrt.pem` and `cacert.pem` files. They should be set with `chmod 640`, as per the section called “Installing the Certificates”.

For anything else, it's best to read through your ldap logfile or join the OpenLDAP mailing list.

[8] We could however, get our generated server certificate signed by proper CAs, like Thawte and VeriSign, which you pay for, or the free ones, via CAcert

[9] The downside to making our own CA, is that the certificate is not automatically recognized by clients, like the commercial ones are.

[10] For information straight from the horse's mouth, please visit http://www.openssl.org/docs/HOWTO/; the main OpenSSL site.

[11] Your `CA.pl` or `CA.sh` might not be in the same location as mine is, you can find it by using the `locate` command, i.e., `locate CA.pl`. If the command complains about the database being too old, run `updatedb` as root to update it.

[12] See `man ldapsearch`

Prev | Up | Next
Chapter 45. Samba Performance Tuning | Home | Chapter 47. Samba Support