轉-配置openldap使用SSL連線

轉-配置openldap使用SSL連線

寫的很不錯,轉一下,

[@more@]假設openldap伺服器已經配置好，可以正常工作。下面的步驟只是讓openldap使用ssl連線。
這篇文件參考了，那裡有更詳盡的介紹。
注：此配置在fc5下面透過。rhe系列會有不一樣的地方。

0 在開始之前，
0.1 建議備份/etc/openldap/slapd.conf, /etc/openldap/ldap.conf
0.2 安裝軟體包openssl, openssl-perl.後者是用來建立CA認證的一個perl指令碼包。

1 建立證照(certificate)
這一步分為3個步驟，首先把CA建立起來，然後讓此CA簽發一個server的證照和一個client的證照。
需要特別注意的是建立證照時，輸入Common Name的時候一定要輸入目標機器的fully qualified name

1.1 建立CA
這裡關係到兩個目錄，/etc/pki/tls/misc是工作目錄,/etc/pki/CA是存放所有CA相關檔案的目錄。
完成此步驟後，會在/etc/pki/CA目錄下生成一系列檔案，其中最重要的是
/etc/pki/CA/cakey.pem CA的私鑰檔案
/etc/pki/CA/cacert.pem CA的證照檔案

tips：如果指令碼檢測到/etc/pki/CA下面有檔案存在，那麼script會安靜的退出，不會建立任何東西。
把/etc/pki/CA下的檔案全部刪除，script就可以正常工作了

> cd /etc/pki/tls/misc
> ./CA.pl -newca

..........忽略部分資訊........
writing new private key to '../../CA/private/cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:
State or Province Name (full name) [Berkshire]:
Locality Name (eg, city) [Newbury]:
Organization Name (eg, company) [My Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []: !!!!full qualified name!!!
Email Address []: <>

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for ../../CA/private/cakey.pem:
Check that the request matches the signature
Signature ok
..........忽略部分資訊........

1.2 建立server的證照
下面我們要建立ldap server的證照。分為兩步，第一步是生成一個建立證照的請求，第二步是讓CA為此請求籤發證照

> ./CA.pl -newreq-nodes
Generating a 1024 bit RSA private key
............++++++
.......++++++
writing new private key to 'newkey.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:
State or Province Name (full name) [Berkshire]:
Locality Name (eg, city) [Newbury]:
Organization Name (eg, company) [My Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []: !!!!full qualified name!!!
Email Address []:<>

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Request is in newreq.pem, private key is in newkey.pem

> ./CA.pl -sign
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for ../../CA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
.....省略部分內容......

Certificate is to be certified until Apr 16 22:37:14 2008 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Signed certificate is in newcert.pem

執行完兩個步驟後，你會發現當前目錄下建立了3個檔案:
newreq.pem 建立證照請求檔案，沒什麼用了
newcert.pem CA簽發的證照
newkey.pem 證照對應的私鑰

首先我們重新命名證照檔案和私鑰檔案
mv newcert.pem server.cert
mv newkey.pem server.key

然後給他們設定合適的許可權,特別是私鑰檔案，一定要只有owner能讀。否則ssl安全體系形同虛設！
chmod 644 server.cert
chmod 600 server.key (Nobody can read it except owner!!)

最後一步是把這兩個檔案和CA的證照檔案複製到openldap存放證照的目錄下，一般在/etc/openldap/cacerts
如果CA和ldap server不在同一個機器上，那麼用scp複製即可。這裡假設他們在同一臺機器上

mv server.cert /etc/openldap/cacerts
mv serve.key /etc/openldap/cacerts
cp ../../CA/cacert.pem /etc/openldap/cacerts

1.3 建立client的證照
建立client的證照和上面建立server的證照類似。不過要注意的是
1）在輸入Common Name的時候一定要輸入clien的fully qualified name！！
2）證照檔案和私鑰檔案可以命名為client.cert, client.key，它們和cacert.pem也複製到client端的/etc/openldap/cacerts

2 配置server
> service ldap stop # 首先停掉openldap server.

> vi /etc/openldap/slapd.conf
加入下面4行
TLSCACertificateFile /etc/openldap/cacerts/cacert.pem # 配置CA證照的路徑
TLSCertificateFile /etc/openldap/cacerts/server.cert # 配置server證照的路徑
TLSCertificateKeyFile /etc/openldap/cacerts/server.key # 配置server私鑰的路徑

TLSVerifyClient never
# 設定是否驗證client的身份，其值可以是never/allow/try/demand
# 配置什麼值取決於你的安全策略。僅僅就配置來說，
# 如果不需要認證client端的身份，那麼client只需要有CA的證照就可以了
# 如果需要認證client端的身份，那麼client 還 必須要有它自己的證照
# 我們首先介紹"never"的情況下client的配置，然後介紹"demand"的情況下client的配置

ssl start_tls
# 如果client端使用TLS協議連線，那麼加上這一行。否則TLS連線會失敗
# 加上這一行後，both SSL and TLS can be supported by this ldap server.

3 配置client

3.1 首先我們假設ldap server不需要驗證client的身份
也就是在/etc/openldap/slapd.con裡，TLSVerifyClient 設定為never。

>vi /etc/openldap/ldap.conf
需要加入或修改下面的內容

URI ldaps://ldapserver.foo.com # 一定要和server的證照裡輸入的full qualified name一樣

TLS_CACERT /etc/openldap/cacerts/cacert.pem # CA的證照
TLS_REQCERT demand # client總是要求認證server端

> service ldap restart
> ldapsearch -x
如果有正確的輸入，就表示配置成功了。

3.2 如果ldap server需要驗證client的身份
也就是在/etc/openldap/slapd.conf裡，TLSVerifyClient設定為demand。這種情況下，client需要有自己的證照和私鑰。
配置clieng的證照和私鑰只能在使用者home目錄下的ldaprc檔案裡。

> vi ~/ldaprc
加入下面的內容

TLS_REQCERT demand
TLS_CERT /etc/openldap/cacerts/client.cert
TLS_KEY /etc/openldap/cacerts/client.key

注意此使用者對/etc/openldap/cacerts/client.key要有可讀的許可權！！

> service ldap restart
> ldapsearch -x
如果有正確的輸入，就表示配置成功了。

4 除錯方法

4.1 在除錯模式啟動slapd
> slapd -d127 -h "ldap:/// ldaps:///"
-d127是指定除錯級別。slapd會在當前console啟動，所有的連線資訊都會在螢幕上列印出來。

4.2 用openssl client連線ssl 伺服器

4.2.1 對於不需要client驗證的情況
> openssl s_client -connect ldapserver.foo.com:636 -showcerts -state -CAfile /etc/openldap/cacerts/cacert.pem
file /etc/openldap/cacerts/cacert.pem
CONNECTED(00000003)
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:SSLv3 read server hello A
depth=1 /C=CN/ST=shanghai/O=dean/OU=mobile/CN=fedora.dean.com/emailAddress=ss@ss.com
verify return:1
depth=0 /C=CN/ST=Shanga/L=shanghai/O=dean/OU=home/CN=fedora.dean.com/emailAddress=sdf@ss.com
verify return:1
SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server done A
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write change cipher spec A

.......省略了部分內容.......

Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : AES256-SHA
Session-ID: 03FDE102050C7828C39E03D7A3F526E6E9D256115A0ADF7793538B616C5548ED
Session-ID-ctx:
Master-Key: 07A62B4E5060BF4542E49DC33C2C6D6F10FF266F48856A780187C759A3007CF2F18ECAB49DBA8915394D52179AC8FE9B
Key-Arg : None
Krb5 Principal: None
Start Time: 1198247985
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
用"CTRL-C" 退出

4.2.2 對於需要clien驗證的情況
> openssl s_client -connect ldapserver.foo.com:636 -showcerts -state
-CAfile /etc/openldap/cacerts/cacert.pem
-cert /etc/openldap/cacerts/client.cert
-key /etc/openldap/cacerts/client.key