OpenLDAP 2.4 Configuration

Hello everybody, today we are going to create an OpenLDAP server for central authentication. I won't give you introduction to LDAP service, but show just a basic configuration. In the end you will have a working server without any objects and with one access rule.

I'm going to install openldap server on CentOS 6.3 as a binary package, not from the source. The current version of the openldap-servers package up to the day I'm writing this is 2.4.23.

# yum install openldap-servers

Since version 2.3 openldap has a new configuration engine and use LDIF files for configuring the server and the directory database. The new dynamic runtime configuration engine with LDIF files is a little bit tricky while you get used to it.

First you need a username and password for the slapd configuration database, later you can use it to add another database or module, or you can use it to extend the default schema. Next you need another admin user for configuration of the actual LDAP tree database. These two accounts are configured in different files.

For the configuration database you should add these two lines in /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{0\}config.ldif

olcRootDN: cn=root,cn=config

olcRootPW: {SSHA}rtCwogFExs+w4sE2Mp1RtNnio2SWgijY

The olcRootDN contains the administrator distinguish name (the first common name could be admin or manager, whatever you like, but the second one should be config ex. cn=admin,cn=config) and olcRootPW attribute contains the password. The password is not in plain text, but it is a hash (SHA) and to the hash is added a salt, known only by the slapd server. This is the most secured option and if even someone reads the file it is almost impossible to get the original password. You can generate a password hash with slappasswd utility. Copy the output to the olcRootPW attribute.

# slappasswd

Notice: You can insert your password directly in a plain text in the configuration file, without using the slappasswd program. This is not recommended from security point. The password should look like this:

olcRootPW: {CLEARTEXT}MyPassword

Every LDAP tree has an admin account for adding objects to the tree and changing object's attributes. This is the first object you should create, when you configuring the directory tree. Openldap comes with preinstalled database and its file in CentOS is in /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif

The olcRootDN attribute is already populated by default. You can keep the common name, but you should change the domain component to reflect your organization structure. Use again the slappasswd for generating password hash and add the olcRootPW attribute with the output of slappasswd command.

olcRootDN: cn=admin,dc=mycompany,dc=com

olcRootPW: {SSHA}rtCwogFExs+w4sE2Mp1RtNnio2SWgijY

Note: Do not copy paste directly the olcRootPW attribute from here!

In the etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif you should change the olcSuffix attribute too, so it represents your organization structure. The default configuration of the directory tree doesn`t include any access rules. I`ll give a rule I think is mandatory for every directory, but it's up to you to add more rules, that suits your organization needs:

olcAccess: to * by self write by anonymous auth by users read

The order of the rules is very important, because slapd stops at the first rule that matches the entry and/or attribute. The corresponding access directive is the one slapd will use to evaluate access. If there is no match access is deny. More information and details about configuring ACLs can be found in the OpenLDAP Administartion Guide.

Before starting the slapd daemon you can check for errors with slaptest command. On CentOS the files inside /var/lib/ldap are owned by root, so you should change that:

# chown ldap.ldap /var/lib/ldap/*

And finally start the daemon with :

# /etc/init.d/slapd start

If everything is ok check if the daemon listens with the command:

#netstat -patune | grep slapd

By default slapd messages are not logged and if you want to know what happens to the daemon you should add the following line to /etc/rsyslog.conf

#Log file for slap daemon

local4.* /var/log/slapd.log

One more thing to do to get slapd log files – inside /etc/openldap/slapd.d/cn\=config.ldif add the following line.

olcLogLevel: 0x20 0x40 0x80 0x100

These log levels give information about search filter pocessing (0x20), configuration file processing (0x40), access control list processing (0x80) and stats log connections/operations/results (0x100). You can add even more, all log levels are well documented in manual pages of slapd-config. Restart both rsyslog and slapd for changes to take effect.

# /etc/init.d/rsync restart

# /etc/init.d/slapd restart

More information can be found inside OpenLDAP Administration guide http://www.openldap.org/doc/, full reference of configuration attributes can be found inside manual pages of slapd-config.

I highly recommend the book Mastering OpenLDAP: Configuring, Securing and Integrating Directory Services for more configuration options and information about LDAP protocol and OpenLDAP server. The only downside is, that it is written for the old configuration syntax with slapd.conf and configuration examples must be rebuild to suit the new one.    

 

Apache: Redirect HTTP requests to HTTPS

Today I want to discuss a problem about a redirecting HTTP web page to HTTPS secure location. My scenario is a web server which by default is working only on HTTPS, to be able to redirect an HTTP request to HTTPS one. In the end, when you contact the web server either with HTTP or HTTPS protocol, you connect only through HTTPS protocol for secure communication. I use apache web server.  
There are two possible solutions - one with mod_rewrite, which according to apache wiki is not the recommended method (ApacheWiki mod_rewrite) and the other one, which I`m after, is using the "Redirect" directive (ApacheWiki RedirectSSL). I don`t use .htaccess files in my scenario, so the solution should be in tweaking the httpd.conf.
In this case, I`ll use CentOS 6 server with apache 2.2, installed from the binary package that comes with the distribution. The SSL configuration files can be found under the directory /etc/httpd/conf.d/ssl.conf, and the default configuration file httpd.conf is inside /etc/httpd/conf directory. I assume you have already created, or buy a SSL certificate and you can contact your server at address https://www.mydomain.com.
So first you should create a new VirtualHost configuration, which should listen and accept requests through HTTP, port 80. I choose to add this definition at the end of my httpd.conf, instead of creating a new file. That`s because it will be only couple of lines and it`s idea is only to redirect traffic to secured location. I used the example provided in apache wiki:

NameVirtualHost *:80
<VirtualHost *:80>
   ServerName www.example.com
   Redirect permanent / https://www.example.com/
</VirtualHost>
After you inserted it in the end of the httpd.conf and save it, check for errors the configuration with:

# apachectl configtest

Now you have added the VirtualHost configuration, but if you restart apache you will see that nothing happens, even I found that my server doesn`t listen on port 80:

# netstat -patune | grep "80"

So I should instruct apache to listen at port 80 with Listen directive, but what will happen to the SSL configuration, there is a "Listen 443" line inside /etc/httpd/conf.d/ssl.conf. Actually the server continues to listen to port 443, because of the default ssl VirtualHost configuration. In addition I add the SSLRequireSSL and SSLOptions directives to my website root (as suggested here) in /etc/httpd/conf/httpd.conf:

.....
Listen 80
.....
<Directory "/var/www/html/">
.....
SSLRequireSSL
SSLOptions +StrictRequire
.....
</Directory>
.....

More info about these directives can be found here.
Check again for errors after the changes and if "Syntax OK" restart the apache:

 # apachectl configtest
 # service apache restart

One more thing not to forget is to check your firewall and open port 80, in CentOS the easiest way is with the command:

 # system-config-firewall-tui

Note: In order the command to work you should install the package with the same name.

Welcome to my blog

Hello everybody and thank you for visiting my blog. I`m a big Linux and open source fan, that`s why I`ve created this blog to write about problems I have encountered during my work of implementation and administration of different open source services and servers. I hope my solutions will be helpful in your activities or work and I encourage you to ask questions and create discussions on a topics you find interesting. My interest are in general in the information security field and in all my posts I`ll try to find the easiest and most secure solution of a problem. Feel free to criticize me if you think that this is not accomplished or can be accomplished better. I want to apologies in advance, about my not so good English, I`m not a native speaker, so be more forgiving when you read my blog. I hope you will enjoy it!