OpenLDAP加密传输配置(CA服务器与openldap服务器异机)
阅读视图
- 环境准备
- CA证书服务器搭建
- OpenLDAP服务端与CA集成
- OpenLDAP客户端配置
- 客户端测试验证
- 故障处理
1. 环境准备
- 服务器规划
| 主机 | 系统版本 | IP地址 | 主机名 | 时间同步 | 防火墙 | SElinux |
|---|---|---|---|---|---|---|
| ldap服务端 | Centos 6.9最小化安装 | 192.168.244.17 | mldap01.gdy.com | 必须同步 | 关闭 | 关闭 |
| ldap客户端 | Centos 6.9最小化安装 | 192.168.244.18 | test01.gdy.com | 必须同步 | 关闭 | 关闭 |
| CA证书服务器 | Centos 6.9最小化安装 | 192.168.244.23 | mldap01.gdy.com | 必须同步 | 关闭 | 关闭 |
- 本文环境按照02-openldap服务端安装配置搭建出最基本的环境，用户数据来自02-openldap服务端安装配置中的第十步
2. CA证书服务器搭建
-
安装OpenSSL软件
[root@ca ~]# rpm -qa | grep openssl
openssl-1.0.1e-57.el6.x86_64 -
CA中心生成自身私钥，命令如下。
[root@ca ~]# cd /etc/pki/CA/
[root@ca CA]# (umask 077; openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
.................................................+++
......................+++
e is 65537 (0x10001) -
CA签发自身公钥，命令如下。
[root@ca CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 36500
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Shanghai
Locality Name (eg, city) [Default City]:Shanghai
Organization Name (eg, company) [Default Company Ltd]:GDY
Organizational Unit Name (eg, section) []:Tech
Common Name (eg, your name or your server's hostname) []:ca.gdy.com
Email Address []:ca@gdy.com其中，各个字段含义如下。
- Country Name(2 letter code)：两个字母的国家代号
- State or Province Name(full name)[]：省份
- Locality Name(eg, city)[Default City]：市或地区
- Organization Name(eg, company)[Default Company Ltd]: 公司名称
- Organizational Unit Name(eg, section)[]：部门名称，例如Tech
- Common Name(eg, your name or your server's hostname)[]：通用名称，例如OL服务器的域名或IP地址。
- Email Address []：邮件地址
-
创建数据库文件及证书序列文件，命令如下
[root@ca CA]# ls -lh
total 20K
-rw-r--r-- 1 root root 1.4K Jun 1 17:04 cacert.pem
drwxr-xr-x. 2 root root 4.0K Mar 23 2017 certs
drwxr-xr-x. 2 root root 4.0K Mar 23 2017 crl
drwxr-xr-x. 2 root root 4.0K Mar 23 2017 newcerts
drwx------. 2 root root 4.0K Jun 1 17:01 private
[root@ca CA]# touch serial index.txt
[root@ca CA]# echo "01" > serial目录文件用途如下
- cacert.pem：CA自身证书文件（可根据自己需求进行修改）
- certs：客户端证书存放目录
- crl：CA吊销的客户端证书存放目录
- newcerts：生成新证书存放目录
- index.txt：存放客户端证书信息
- serial：客户端证书编号（编号可自定义），用于识别客户端证书。
- private：存放CA自身私钥的目录
-
通过OpenSSL命令获取根证书信息，命令如下
[root@ca CA]# openssl x509 -noout -text -in /etc/pki/CA/cacert.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 14795263444614255073 (0xcd5355b6d68e11e1)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=CN, ST=Shanghai, L=Shanghai, O=GDY, OU=Tech, CN=ca.gdy.com/emailAddress=ca@gdy.com
Validity
Not Before: Jun 5 07:06:49 2018 GMT
Not After : May 12 07:06:49 2118 GMT
Subject: C=CN, ST=Shanghai, L=Shanghai, O=GDY, OU=Tech, CN=ca.gdy.com/emailAddress=ca@gdy.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:ba:0a:fa:87:16:4b:75:94:d6:98:a5:75:f5:93:
44:60:0c:c4:bc:d6:5e:3e:be:4c:29:41:36:5c:2d:
b8:c8:1e:97:10:38:0a:2d:60:0e:d9:38:5f:f5:7b:
ab:af:b6:35:d5:48:c0:50:c3:1e:17:5b:a8:c6:f8:
75:55:c7:0b:fb:7e:68:fc:a6:77:f9:7a:9a:d0:8f:
5a:c6:ca:c7:a7:b5:34:d4:ca:13:d6:3c:b6:aa:86:
7e:8f:17:24:f7:ce:b0:5f:11:3b:8a:6a:40:50:cc:
5c:b5:cc:b3:e2:17:be:f6:ab:f6:ae:6a:2f:58:88:
5f:12:65:58:cb:17:5e:00:51:ec:31:64:a7:d6:02:
63:b3:63:cc:00:87:49:67:a2:60:a0:82:ed:a8:08:
c5:77:c1:0a:04:42:9d:f2:c5:31:e7:b4:ee:67:f7:
28:05:27:a0:b3:06:b0:89:b5:8d:3c:14:79:6c:30:
ca:d3:90:8f:e5:72:61:13:c3:4d:bc:5a:80:9f:85:
3a:20:4c:9b:0d:bb:c0:bd:d5:98:65:0b:0e:29:e2:
45:ed:c2:e8:1c:74:e7:94:9b:07:49:28:06:13:44:
98:b5:a9:e3:46:59:99:77:e8:12:a8:91:38:bc:9f:
ef:48:b2:8f:58:8d:7c:a3:ba:fb:4f:e3:7b:8c:65:
20:6b
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
FA:19:3B:1E:FA:2A:FE:CD:F7:CA:A3:D4:31:08:52:AF:72:08:ED:1D
X509v3 Authority Key Identifier:
keyid:FA:19:3B:1E:FA:2A:FE:CD:F7:CA:A3:D4:31:08:52:AF:72:08:ED:1D X509v3 Basic Constraints:
CA:TRUE
Signature Algorithm: sha1WithRSAEncryption
38:9c:52:b7:a2:d8:03:60:ec:78:2a:4b:9b:b8:02:10:44:09:
39:d3:e9:d0:b2:9a:bc:d5:2d:1d:a1:92:12:d7:06:c7:2c:c7:
27:95:a5:8d:f1:db:e5:7b:09:d4:0e:a1:70:d9:d9:59:7b:54:
5a:a0:19:b8:d4:ec:36:23:cf:8f:c1:a3:c3:a6:99:a6:3e:dc:
1c:cc:8a:53:20:07:a6:f7:5d:c2:9d:7f:e2:ef:07:eb:f3:ca:
c2:9b:6d:47:f1:34:70:e7:56:44:db:2d:8a:46:26:21:ce:99:
62:21:b2:05:51:86:8c:ba:25:9e:3b:81:e8:0f:68:73:21:75:
d7:64:c2:ed:4a:3b:4a:9d:74:da:ca:3a:4f:df:1f:c1:a5:88:
6e:08:a8:2f:9b:f8:75:00:0d:53:6b:be:24:97:f8:03:6a:69:
87:56:ec:57:ae:85:a4:9c:71:fa:dd:f8:e6:d9:8c:69:d8:ab:
66:6e:da:c8:5d:2f:a7:34:b5:17:65:79:3e:02:d9:81:64:6e:
37:9d:e6:26:59:18:73:83:f6:06:c4:a0:ff:7e:90:e2:a3:5f:
a7:01:41:c0:e6:bc:c8:ce:b6:19:0a:78:19:f6:16:9d:45:9b:
e3:46:9c:6f:ca:d5:29:61:4b:38:95:e9:65:b5:62:8d:78:c4:
83:8b:f8:10 自建CA完成
3. OpenLDAP服务端与CA集成
-
在openldap服务器上生成密钥
[root@mldap01 ~]# mkdir -pv /etc/openldap/ssl
mkdir: created directory `/etc/openldap/ssl'
[root@mldap01 ~]# cd /etc/openldap/ssl
[root@mldap01 ssl]# (umask 077; openssl genrsa -out ldapkey.pem 1024)
Generating RSA private key, 1024 bit long modulus
............................++++++
...++++++
e is 65537 (0x10001)
[root@mldap01 ssl]# ls -lh
total 4.0K
-rw------- 1 root root 887 Jun 5 15:26 ldapkey.pem -
OpenLDAP服务端向CA申请证书签署请求，命令如下
[root@mldap01 ssl]# openssl req -new -key ldapkey.pem -out ldap.csr -days 36500
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Shanghai
Locality Name (eg, city) [Default City]:Shanghai
Organization Name (eg, company) [Default Company Ltd]:GDY
Organizational Unit Name (eg, section) []:Tech
Common Name (eg, your name or your server's hostname) []:mldap01.gdy.com
Email Address []:mldap@gdy.com Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []: -
CA服务器核实并签发证书
如果CA服务器与openldap服务器不在同一台，需要将上述步骤生成的ldap.csr文件上传到CA服务器签署
先在openldap服务器上将ldap.csr文件上传到CA服务器签署
[root@mldap01 ssl]# scp ldap.csr root@ca:/root/
The authenticity of host 'ca (192.168.244.23)' can't be established.
RSA key fingerprint is 1a:8a:57:12:ee:68:91:a4:bd:c5:48:f1:03:a9:5f:9c.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'ca,192.168.244.23' (RSA) to the list of known hosts.
root@ca's password:
ldap.csr 100% 696 0.7KB/s 00:00 [root@ca ~]# openssl ca -in ldap.csr -out ldapcert.pem -days 36500
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jun 5 10:00:26 2018 GMT
Not After : May 12 10:00:26 2118 GMT
Subject:
countryName = CN
stateOrProvinceName = Shanghai
organizationName = GDY
organizationalUnitName = Tech
commonName = mldap01.gdy.com
emailAddress = mldap@gdy.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
26:1C:25:DA:AD:A0:E3:72:43:CD:AC:7F:77:9E:37:BD:1B:EF:1A:FE
X509v3 Authority Key Identifier:
keyid:CB:DE:C2:81:45:FE:B3:10:02:95:DA:49:16:F6:FA:03:13:F6:3E:2E Certificate is to be certified until May 12 10:00:26 2118 GMT (36500 days)
Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated 然后将生成的ldapcert.pem文件和ca公钥文件发送至Openldap服务器/etc/openldap/ssl目录下
[root@ca ~]# scp ldapcert.pem /etc/pki/CA/cacert.pem root@192.168.244.17:/etc/openldap/ssl/
The authenticity of host '192.168.244.17 (192.168.244.17)' can't be established.
RSA key fingerprint is 1a:8a:57:12:ee:68:91:a4:bd:c5:48:f1:03:a9:5f:9c.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.244.17' (RSA) to the list of known hosts.
root@192.168.244.17's password:
ldapcert.pem 100% 3828 3.7KB/s 00:00
cacert.pem 100% 1391 1.4KB/s 00:00 -
OpenLDAP TLS/SASL部署
修改证书权限
[root@mldap01 ssl]# chown ldap.ldap -R /etc/openldap
[root@mldap01 ssl]# chmod -R 0400 /etc/openldap/ssl/* 修改OpenLDAP配置文件，添加证书文件
[root@mldap01 ~]# vim /etc/openldap/slapd.conf
#TLSCACertificatePath /etc/openldap/certs
#TLSCertificateFile "\"OpenLDAP Server\""
#TLSCertificateKeyFile /etc/openldap/certs/password
TLSCACertificateFile /etc/openldap/ssl/cacert.pem
TLSCertificateFile /etc/openldap/ssl/ldapcert.pem
TLSCertificateKeyFile /etc/openldap/ssl/ldapkey.pem
TlsVerifyClient neverTLSVerifyClient 设置是否验证客户端身份。Value可以取下面几个值
- never: 服务器响应用户请求时，不需要验证客户端的身份，只需要提供CA公有证书即可。
- allow：服务器响应用户请求时，服务要求验证客户端的身份，如果客户端没有证书或者证书无效，会话依然进行。
- try：客户端提供证书，如果证书有误，则终止连接。若无证书，会话继续进行。
- demand：服务器端需要对客户端证书进行验证，客户端需要向CA申请证书。
开启OpenSSL功能，命令如下
[root@mldap01 ~]# vim /etc/sysconfig/ldap
# Options of slapd (see man slapd)
#SLAPD_OPTIONS= # At least one of SLAPD_LDAP, SLAPD_LDAPI and SLAPD_LDAPS must be set to 'yes'!
#
# Run slapd with -h "... ldap:/// ..."
# yes/no, default: yes
SLAPD_LDAP=yes # Run slapd with -h "... ldapi:/// ..."
# yes/no, default: yes
SLAPD_LDAPI=yes # Run slapd with -h "... ldaps:/// ..."
# yes/no, default: no
SLAPD_LDAPS=yes删除并重新生成默认数据配置库
[root@mldap01 ~]# rm -rf /etc/openldap/slapd.d/*
[root@mldap01 ~]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/
config file testing succeeded
[root@mldap01 ~]# chown ldap.ldap -R /etc/openldap/
[root@mldap01 ~]# /etc/init.d/slapd restart
Stopping slapd: [ OK ]
Starting slapd: [ OK ] -
通过CA证书公钥验证OpenLDAP服务端证书的合法性，命令如下
[root@mldap01 ~]# openssl verify -CAfile /etc/pki/CA/cacert.pem /etc/openldap/ssl/ldapcert.pem
/etc/openldap/ssl/ldapcert.pem: OK -
确认当前套接字是否通过CA的验证，命令如下
[root@mldap01 ssl]# openssl s_client -connect mldap01.gdy.com:636 -showcerts -state -CAfile /etc/openldap/ssl/cacert.pem
CONNECTED(00000003)
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:SSLv3 read server hello A
depth=1 C = CN, ST = Shanghai, L = Shanghai, O = GDY, OU = Tech, CN = ca.gdy.com, emailAddress = ca@gdy.com
verify return:1
depth=0 C = CN, ST = Shanghai, O = GDY, OU = Tech, CN = mldap01.gdy.com, emailAddress = mldap@gdy.com
verify return:1
SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server key exchange A
SSL_connect:SSLv3 read server done A
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write change cipher spec A
SSL_connect:SSLv3 write finished A
SSL_connect:SSLv3 flush data
SSL_connect:SSLv3 read finished A
---
Certificate chain
0 s:/C=CN/ST=Shanghai/O=GDY/OU=Tech/CN=mldap01.gdy.com/emailAddress=mldap@gdy.com
i:/C=CN/ST=Shanghai/L=Shanghai/O=GDY/OU=Tech/CN=ca.gdy.com/emailAddress=ca@gdy.com
-----BEGIN CERTIFICATE-----
MIIDajCCAlKgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBgDELMAkGA1UEBhMCQ04x
4. OpenLDAP客户端配置
-
将CA公钥证书发送至客户端
[root@mldap01 ssl]# scp cacert.pem root@192.168.244.18:/etc/openldap/ssl/ -
配置
/etc/openldap/ldap.conf[root@test01 ~]# grep -Ev "^$|^#" /etc/openldap/ldap.conf
TLS_CACERTDIR /etc/openldap/ssl
TLS_CACERT /etc/openldap/ssl/cacert.pem
TLS_REQCERT never
BASE dc=gdy,dc=com
URI ldaps://mldap01.gdy.comTLS_REQCERT [never allow try demand | hard] # 设置是否在TLS会话中检查server证书。
- Never：不检查任何证书。
- Allow：检查server证书，没有证书或证书错误，都允许连接。
- Try：检查server证书，没有证书（允许连接），证书错误（终止连接）。
- demand | hard：检查server证书，没有证书或证书错误都将立即终止连接。
-
配置
/etc/nslcd.conf[root@test01 ~]# grep -Ev "^$|^#" /etc/nslcd.conf
uid nslcd
gid ldap
uri ldaps://mldap01.gdy.com
base dc=gdy,dc=com
ssl on
tls_cacertdir /etc/openldap/ssl
tls_cacertfile /etc/openldap/ssl/cacert.pem
tls_reqcert never -
配置
/etc/pam_ldap.conf[root@test01 ~]# grep -Ev "^$|^#" /etc/pam_ldap.conf
host 127.0.0.1
base dc=gdy,dc=com
uri ldaps://mldap01.gdy.com
ssl on
tls_cacertdir /etc/openldap/ssl
tls_cacertfile /etc/openldap/ssl/cacert.pem
tls_reqcert never
bind_policy soft
5. 客户端测试验证
-
通过客户端匿名测试SSL连接是否正常，命令如下
[root@test01 ~]# ldapwhoami -v -x -Z
ldap_initialize( <DEFAULT> )
ldap_start_tls: Operations error (1)
additional info: TLS already started
anonymous
Result: Success (0) -
LDAP用户验证密码, 命令如下
[root@test01 ~]# ldapwhoami -D "uid=user1,ou=people,dc=gdy,dc=com" -W -H ldaps://mldap01.gdy.com -v
ldap_initialize( ldaps://mldap01.gdy.com:636/??base )
Enter LDAP Password:
dn:uid=user1,ou=people,dc=gdy,dc=com
Result: Success (0) -
在客户端搜索OpenLDAP域信息, 命令如下
[root@test01 ~]# ldapsearch -x -b 'dc=gdy,dc=com' -H ldaps://mldap01.gdy.com
# extended LDIF
#
# LDAPv3
# base <dc=gdy,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
# # gdy.com
dn: dc=gdy,dc=com
dc: gdy
objectClass: top
objectClass: domain # people, gdy.com
... 省略
故障处理
-
openssl s_client连接时报错如下
[root@mldap01 ~]# openssl s_client -connect mldap01.gdy.com:636 -showcerts -state -CAfile /etc/openldap/ssl/cacert.pem
CONNECTED(00000003)
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
139640374728520:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:184:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 247 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---没有解决：openldap和ca服务器不在同一台时没有这个问题, 下次我ca和ldap服务器使用同一个名字试试