Difference between revisions of "OPS535-lab-ldap"
(Added investigation 2 instructions for adding TLS to openldap:x) |
m (→Investigation 2: Modifying OpenLDAP Server Configuration to use TLS - UNDER CONSTRUCTION: - removed construction signs from investigation 2) |
||
| Line 299: | Line 299: | ||
</ol> | </ol> | ||
| − | ==Investigation 2: Modifying OpenLDAP Server Configuration to use TLS | + | ==Investigation 2: Modifying OpenLDAP Server Configuration to use TLS== |
{{Admon/important|Warning|This is a good time to make another backup of VM1.}} | {{Admon/important|Warning|This is a good time to make another backup of VM1.}} | ||
In this investigation we will modify the OpenLDAP server we just created to use TLS to encrypt the data it provides, you should notice that many of these steps are similar to the process of modifying postfix and apache servers to use TLS. Perform these steps on vm1. | In this investigation we will modify the OpenLDAP server we just created to use TLS to encrypt the data it provides, you should notice that many of these steps are similar to the process of modifying postfix and apache servers to use TLS. Perform these steps on vm1. | ||
Revision as of 21:45, 27 September 2020
Contents
- 1 OPS535 Lab 3
- 1.1 Purpose
- 1.2 Pre-Requisites
- 1.3 Investigation 1: OpenLDAP Server Setup and Configuration
- 1.4 Investigation 2: Modifying OpenLDAP Server Configuration to use TLS
- 1.5 Investigation 3: Setup and Configure OpenLdap Client Through SSSD - UNDER CONSTRUCTION
- 1.6 Investigation 4: Update LDAP Configuration
- 1.7 Completing the Lab
- 1.8 Exploration Questions
OPS535 Lab 3
Purpose
The OpenLDAP software package is a Free and Open Source implementation of the Lightweight Directory Access Protocol (LDAP). It is gaining wide acceptance as the directory access method of the Internet and also with corporate intranets. In this lab, you set up and configure an OpenLDAP server to provide directory service for LDAP Clients to authenticate network users. You can use OpenLDAP server to replace NIS to centrally store network user account information for OpenLDAP client to authenticate network users. The basic components of an LDAP server are its Object Classes and Attribute types defined in one or more Schema. To provide the necessary attribute types (ie. Field) for storing Linux (or Unix, aka Posix) user accounts, you need to include the “cosine”, “nis”, and “inetorgperson” schemata in addition to the “core” schema. Notes: OpenLDAP Use TCP port 389 for regular network communication between clients and servers, and use port 636 for encrypted network communication between clients and servers. If you have firewalls between your LDAP server and LDAP clients, you need to open the above TCP ports on the firewall to allow LDAP traffic to get through.
Designate vm1 as your LDAP server and use vm2 and vm3 as LDAP clients
Pre-Requisites
The pre-lab must be complete so that your virtual machines share access to a private network. Lab 1 must be complete so each machine has a well configured firewall. Make sure each machine is fully updated.
Investigation 1: OpenLDAP Server Setup and Configuration
Warning
Make a backup before you start this lab. It is very difficult to recover this service if you make a mistake in configuration.
Make a backup before you start this lab. It is very difficult to recover this service if you make a mistake in configuration.
Perform the following steps on vm1
- Install yum-utils
- Install the symas ldap repo (who now maintain a version of it available for Centos 8:
- yum-config-manager --add-repo=--add-repo=https://repo.symas.com/configs/SOFL/rhel8/sofl.repo
- Install the following packages
- openldap
- symas-openldap-clients
- symas-openldap-servers
- perl
- In older releases a package called 'migrationtools' was available that contained a number of perl scripts used to convert information from other sources (e.g. /etc/passwd) into ldif files. Since it is no longer part of standard repos in Centos 8, download the copy I have provided on blackboard and extract it to /usr/share/migrationtools.
- Check the content of the file directory /etc/openldap/slapd.d/cn=config/ for the top branch of OpenLDAP directory configuration files:
cn=schema cn=schema.ldif olcDatabase={0}config.ldif olcDatabase={1}monitor.ldif olcDatabase={-1}frontend.ldif olcDatabase={2}mdb.ldifExamine the contents of olcDatabase={2}mbd.ldif:
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 d9b49d55 dn: olcDatabase={2}hdb objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {2}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=my-domain,dc=com olcRootDN: cn=Manager,dc=my-domain,dc=com olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub structuralObjectClass: olcMdbConfig entryUUID: 5a8d299a-3f2f-1036-9244-a7abff537081 creatorsName: cn=config createTimestamp: 20161115032843Z entryCSN: 20161115032843.258885Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20161115032843Z - Verify that the directory for storing the OpenLDAP database (/var/lib/ldap) is owned by ldap:ldap. If this is not the case, fix it now.
- Verify that the core schema file (/etc/openldap/slapd.d/cn=config/cn=schema) is also owned by ldap:ldap.
- Start the ldap service (slapd), and ensure that it will automatically start when your machine boots. Check the status of the service and ensure that it started without error before continuing.
- Use the ldap add command to add the cosine, nis, and inetorgperson schemata to your server in that order. Use the authentication type EXTERNAL, and ldapi:/// as the host.
- List the schema directory again. This time you should see the core schema, along with the three schemata you just added.
- Run an ldapsearch to check that the service is running and will respond to queries:
[root@rns ~]# ldapsearch -x -b '' -s base '(objectClass=*)' namingContexts # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectClass=*) # requesting: namingContexts # # dn: namingContexts: dc=my-domain,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1
- Next, you will need a password for the ldap administrator (RootDN), so that they can run commands to modify the database. Use the slappasswd command to create one, and record the output.
- Insert your new password into the following ldif file, and apply it to your database with the ldapmodify command.
Warning
Do not store your ldif files (or any other files) in the ldap configuration directory. Every file in that directory is automatically read as configuration for ldap.# customize domain name dn: olcDatabase={2}mdb,cn=config changetype: modify replace: olcSuffix olcSuffix: dc=ops535,dc=com dn: olcDatabase={2}mdb,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=Manager,dc=ops535,dc=com dn: olcDatabase={2}mdb,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}1Di4Suea6ojE2bFxJhLDScjQyQ97GSefMake note of the field that this file will modify.
As before, use the authentication type EXTERNAL, and ldapi:/// as the host.
When you run the command you should get output similar to the following:SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={2}mdb,cn=config" modifying entry "olcDatabase={2}mdb,cn=config" modifying entry "olcDatabase={2}mdb,cn=config" - Examine the contents of your /etc/openldap/slapd.d/cn=config/olcDatabase={2}mdb.ldif file again. Your ldif file should have changed three fields. Try to identify them.
- Create an LDIF file for the base context ops535.com entry to be added to the OpenLDAP
directory. Name the file as base.ldif.
dn: dc=ops535,dc=com dc: ops535 description: root LDAP entry for ops535 objectClass: dcObject objectClass: organizationalUnit ou: rootobject
- Create an LDIF file for the People container to be added to the OpenLDAP directory. Name the
file as people.ldif
dn: ou=People, dc=ops535, dc=com ou: People description: All people in ops535 objectClass: organizationalUnit
- Apply those two ldif files to your database.
This time you will need to use simple authentication, identify yourself with a distinguished name (use the ldap administrator whose password you just set), and get prompted for a password. -
Before we start adding users, we need to provide the migration tools some information about our domain.
Before you change anything, make a backup of the /usr/share/migrationstools/migrate_common.ph to the /root directory.
Modify the following parameters in the original file to the values shown below:
$DEFAULT_MAIL_DOMAIN = "ops535.com"; $DEFAULT_BASE = "dc=ops535,dc=com"; $EXTENDED_SCHEMA = 1;
- Create two new users (ldapuser1 and ldapuser2) on your machine, and set their passwords.
Importing those users into your ldap database will take several steps:- Extract the passwd entries of ldapuser1 and ldapuser2 from /etc/passwd to a file called
"ldapusers.entry"
grep -w ldapuser1 /etc/passwd > /root/ldapusers.entry grep -w ldapuser2 /etc/passwd >> /root/ldapusers.entry
- Use the migrate_passwd.pl file to convert the user information you extracted earlier into an ldif file:
/usr/share/migrationtools/migrate_passwd.pl ldapusers.entry /root/ldapusers.ldif
This should generate an ldif file similar to the following:
dn: uid=ldapuser1,ou=People,dc=ops535,dc=com uid: ldapuser1 cn: ldapuser1 sn: ldapuser1 mail: ldapuser1@ops535.com objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt} $6$PBqQXRo/ugCCjBe0.ZgvmJl8U2tVjpdR8X9bh4OZ1cl3mv4xf0Hv1HSDavkxusO8R3lI uuJ7skrfqpTQpbZ6hbd3e3BGB. shadowLastChange: 17120 shadowMin: 0 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 5001 gidNumber: 5001 homeDirectory: /home/ldapuser1 dn: uid=ldapuser2,ou=People,dc=ops535,dc=com uid: ldapuser2 cn: ldapuser2 sn: ldapuser2 mail: ldapuser2@ops535.com objectClass: person objectClass: organizationalPersonobjectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt} $6$VNkVk1TQ$Rgz4GnQlqPBcHhIinUqxFGnqHZmnHHrFyCQ1ZsekoRjHnaKvb84YtjfFRPL /xcbryrQRL5eNZeP01A3AdC2lv1 shadowLastChange: 17120 shadowMin: 0 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 5002 gidNumber: 5002 homeDirectory: /home/ldapuser2
- Extract the passwd entries of ldapuser1 and ldapuser2 from /etc/passwd to a file called
"ldapusers.entry"
- Use ldapadd to enter this new information into the database. As before use simple authentication, the distinguished name of the ldap administrator, and get prompted for a password.
- Use ldapsearch to confirm that the new users have been added to the database.
You should get output similar to the following:# extended LDIF # # LDAPv3 # base <dc=ops535,dc=com> with scope subtree # filter: (objectClass=*) # requesting: ALL # # ops535.com dn: dc=ops535,dc=com objectClass: top objectClass: dcObject objectClass: organization o: ops535 com dc: ops535 # Manager, ops535.com dn: cn=Manager,dc=ops535,dc=com objectClass: organizationalRole cn: Manager description: Directory Manager # People, ops535.com dn: ou=People,dc=ops535,dc=com objectClass: organizationalUnit ou: People # ldapuser1, People, ops535.com dn: uid=ldapuser1,ou=People,dc=ops535,dc=com uid: ldapuser1 cn: ldapuser1 sn: ldapuser1 mail: ldapuser1@ops535.com objectClass: personobjectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e2NyeXB0fSQ2JFBCcVFYUm8vJHVnQ0NqQmUwLlpndm1KbDhVMnRWanBkUjhYOWJ oNE9aMWNsM212NHhmMEh2MUhTRGF2a3h1c084UjNsSXV1Sjdza3JmcXBUUXBiWjZoYmQzZTNCR0Iu shadowLastChange: 17120 shadowMin: 0 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 5001 gidNumber: 5001 homeDirectory: /home/ldapuser1 # ldapuser2, People, ops535.com dn: uid=ldapuser2,ou=People,dc=ops535,dc=com uid: ldapuser2 cn: ldapuser2 sn: ldapuser2 mail: ldapuser2@ops535.com objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e2NyeXB0fSQ2JFZOa1ZrMVRRJFJnejRHblFscVBCY0hoSWluVXF4RkducUhabW5 ISHJGeUNRMVpzZWtvUmpIbmFLdmI4NFl0amZGUlBML3hjYnJ5clFSTDVlTlplUDAxQTNBZEMybHYx shadowLastChange: 17120 shadowMin: 0 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 5002 gidNumber: 5002 homeDirectory: /home/ldapuser2 # search result search: 2 result: 0 Success # numResponses: 10 # numEntries: 5
- Create an ldif file called group.ldif that will add an organizational unit with the distinguished name ou=Group, dc=ops535, dc=com. It will act as an organizer for group information.
- Use the /etc/group file and migrate_group.pl to create an ldif file that will add the group entries for ldapuser1 and ldapuser2 to your database.
- Add the group entries for ldapuser1 and ldapuser2 to your database. Use ldapsearch to confirm that they have been added.
- Modify your firewall to allow incoming ldap traffic from your internal zone. Make sure that this change persists past reboot.
Investigation 2: Modifying OpenLDAP Server Configuration to use TLS
Warning
This is a good time to make another backup of VM1.
This is a good time to make another backup of VM1.
In this investigation we will modify the OpenLDAP server we just created to use TLS to encrypt the data it provides, you should notice that many of these steps are similar to the process of modifying postfix and apache servers to use TLS. Perform these steps on vm1.
- Install the openssl package
- Run the following commands to create a self-signed TLS certificate for your server (make sure you replace the values with ones from your machine):
openssl genrsa -des3 -out ca.key 4096 openssl req -new -x509 -days 365 -key ca.key -out ca.cert.pem openssl genrsa -out vm1.pcallagh.ops.key 4096 openssl req -new -key vm1.pcallagh.ops.key -out vm1.pcallagh.ops.csr openssl x509 -req -in vm1.pcallagh.ops.csr -CA ca.cert.pem -CAkey ca.key -out vm1.pcallagh.ops.crt -CAcreateserial -days 365 -sha256
- Copy the certificate, the private key, and the certificte authority file to an appropriate directory (make sure it is owned by the ldap account):
cp ldap.pcallagh.ops.crt ldap.pcallagh.ops.key ca.cert.pem /etc/openldap/certs/
- Write an ldif file to add the following values to dn: cn=config (again making sure to put in values from your own machine):
olcTLSCertificateFile: /etc/openldap/certs/vm1.pcallagh.ops.crt olcTLSCertificateKeyFile: /etc/openldap/certs/vm1.pcallagh.ops.key olcTLSCACertificateFile: /etc/openldap/certs/ca.cert.pem
- You can use slapcat to ensure they are set correctly:
slapcat -b "cn=config" | egrep "Certificate(Key)?File"
- Update /etc/openldap/ldap.conf to locate your CACERT, and to indicate that ldaps is now allowed:
- Set the URI parameter to ldaps://vm1.<yourdomain>.ops. It is suggested you also include ldapi:/// so local connections are allowed.
- Set TLSCACERT to the absolute path of your certificate authority file (e.g. /etc/openldap/certs/ca.cert.pem).
- Set TLSCACERTDIR to the directory your certificate authority file is in (e.g. /etc/openldap/certs).
- Update your firewall to permanently allow ldaps instead of ldap.
Investigation 3: Setup and Configure OpenLdap Client Through SSSD - UNDER CONSTRUCTION
Perform the following steps on vm2:
- Install the following packages
- openldap
- openldap-clients
- nss_ldap
- nss-pam-ldapd
- Prior to making any changes to how your machines handle login information, use the authconfig --savebackup command to save your current configuration into /root/ldap/backup.
- Use the authconfig command to configure your vm to use vm1 as the ldap server. Note that you will to enable ldap authentication, identify the ldap server, and the base distinguished name in a single command.
- Check the name service switch configuration file /etc/nsswitch.conf to confirm that LDAP is enabled.
- Test your OpenLDAP client with the ldapsearch command.
ldapsearch -x 'uid=ldapuser1'
You should get something similar to the following (but may not be exactly the same):
# extended LDIF # # LDAPv3 # base <dc=ops535,dc=com> (default) with scope subtree # filter: uid=ldapuser1 # requesting: ALL # # ldapuser1, People, ops535.com dn: uid=ldapuser1,ou=People,dc=ops535,dc=com uid: ldapuser1 cn: ldapuser1 sn: ldapuser1 mail: ldapuser1@ops535.com objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e2NyeXB0fSQ2JFBCcVFYUm8vJHVnQ0NqQmUwLlpndm1KbDhVMnRWanBkUjhYOWJ oNE9aMWNsM212NHhmMEh2MUhTRGF2a3h1c084UjNsSXV1Sjdza3JmcXBUUXBiWjZoYmQzZTNCR0Iu shadowLastChange: 17120 shadowMin: 0 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 5001 gidNumber: 5001 homeDirectory: /home/ldapuser1 # search resultsearch: 2 result: 0 Success # numResponses: 2 # numEntries: 1
- Logout of the client machine, then log back in using the ldapuser1 account.
- Repeat steps 1 through 6 on vm3.
Investigation 4: Update LDAP Configuration
- Add the following user accounts to your LDAP server:
user name: your seneca id – password: pick your own
rchan – password: ops535
seneca – password: ops535 - Run the ldapsearch command for each user, and confirm that their information is correct
- Consult the man page on ldappasswd to find out how to change an LDAP user's password. Change seneca's password to seneca.
- Consult the man page on ldapdelete to find out how to remove an LDAP user. Delete ldapuser2.
Completing the Lab
You should now have a server providing centralized management of your user information. A service like this will make it much easier to manage and maintain users in your network. When combined with a service like NFS, this centralizes user management and make it much easier to scale your network up.
Follow the instructions on blackboard to submit the lab.
Exploration Questions
- What changes would you make in NFS to provide remote access to home directories?
