7.openldap使用ssl加密認證

作者:yaoyao

1.服務器端部署

1.自建CA中心

1.CA中心生成自身私鑰

#cd /etc/pki/CA
#(umask 077; openssl genrsa -out private/cakey.pem 2048)

2.CA簽發自身公鑰

#openssl  req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
輸出一下內容,按照提示輸入
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BeiJing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:liuyao.com
Organizational Unit Name (eg, section) []:Devops
Common Name (eg, your name or your server's hostname) []:ldap.liuyao.com
Email Address []:[e-mail]

3.創建index.txt和serial文件

index.txt文件用於存放客戶端證書信息,serial文件用於存放客戶端證書編號，可以自定義,用於識別客戶端證書
#touch serial index.txt
#echo "01" > serial 

4.使用openssl命令獲取證書信息

#openssl x509 -noout -text -in /etc/pki/CA/cacert.pem 

2.LDAP與CA集成

1. 獲取LDAP證書

#mkdir /etc/openldap/ssl
#cd /etc/openldap/ssl
服務器端生成密鑰
#(umask 077; openssl genrsa -out ldapkey.pem 1024)
服務端向CA申請證書簽署請求,相關信息必須和CA所填證書一致才可以正常簽發
openssl req -new -key ldapkey.pem -out ldap.csr -days 3650

2. CA檢測用戶請求，通過后生成證書

# openssl ca -in ldap.csr -out ldapcert.pem -days 3650
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Jul 31 11:01:24 2017 GMT
            Not After : Jul  8 11:01:24 2027 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = Beijing
            organizationName          = liuyao
            organizationalUnitName    = devops
            commonName                = ldap.liuyao.com
            emailAddress              = [e-mail]
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                5B:9E:1A:5C:FD:B:51:BC:89:F0:33:3E:D4:E:1B:27:78:1D:95:F5:7F
            X509v3 Authority Key Identifier: 
                keyid:76:49:FA:96:6C:F5:B7:B4:95:FC:89:F0:33:3E:5:9:9A:74:29:DB:06

Certificate is to be certified until Jul  8 11:01:24 2027 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

3.部署

1.修改證書權

#cd /etc/openldap/ssl/
#cp /etc/pki/CA/cacert.pem .

2.修改配置文件

#vim /etc/sysconfig/ldap
SLAPD_LDAPS=yes

#vim slapd.conf
TLSCACertificateFile /etc/openldap/ssl/cacert.pem
TLSCertificateFile /etc/openldap/ssl/ldapcert.pem
TLSCertificateKeyFile  /etc/openldap/ssl/ldapkey.pem
TlsVerifyClient never

3.測試並生成相關數據

#slaptest -u
#rm -rf /etc/openldap/slapd.d/*
#slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/

5. 啟動服務

#chown ldap.ldap */* -R
#/etc/init.d/slapd restart
可以使用netstat -tnlp 命令查看。加密端口為636

4.測試

1. 測試服務端證書的合法性

#openssl verify -CAfile /etc/pki/CA/cacert.pem /etc/openldap/ssl/ldapcert.pem 
/etc/openldap/ssl/ldapcert.pem: OK

2. 測試當前套接字是否能通過CA的驗證

openssl s_client -connect ldap.liuyao.com:636 -showcerts -state -CAfile /etc/openldap/ssl/cacert.pem

2.客戶端部署

1. 將證書cp到客戶端

scp root@我不告訴你ip:/etc/pki/CA/cacert.pem /etc/openldap/cacerts

2. 配置ldap加密

#authconfig-tui
配置域名地址和tls。這個地方應該有個圖。但是我沒有

3.修改相關文件

#vim /etc/pam_ldap.conf
ssl on
#vim /etc/nslcd.conf 
ssl on

4.啟動服務

#/etc/init.d/nslcd restart
#chkconfig nslcd on

5.測試

#ldapwhoami -v -x -Z

# ldapwhoami -D "uid=liuyao,ou=devops,dc=liuyao,dc=com" -W -H ldaps://ldap.liuyao.com -v 
    ldap_initialize( ldaps://ldap.liuyao.com:636/??base )
    Enter LDAP Password: 
    dn:uid=liuyao,ou=devops,dc=liuyao,dc=com                                                                      Result: Success (0)