Circuito_OpenLDAP

CIRCUITO OPENLDAP
www.thesource.com.br
MarcioGarciaMarcenari
marciogarcia@gmail.com
mgarcia@thesource.com.br
The Source Consultoria, Desenvolvimento e Capacitação
Rua Afonso Celso, 457 – Vila Mariana – São Paulo
PABX: 2171-4300
1 de 23

Índice
OpenLDAP............................................................................................................3
Instalação.............................................................................................................3
Configuração........................................................................................................4
Inicialização..........................................................................................................5
Alteração de senhas..............................................................................................6
Criação das entradas para importação na base LDAP............................................7
Importação das entradas na base LDAP.................................................................8
Consultas na base LDAP – RFC 2254...................................................................11
Modificando as entradas na base LDAP...............................................................13
Deletando as entradas na base LDAP..................................................................14
Backup / Restore da base LDAP..........................................................................15
Índices de pesquisa............................................................................................16
ACL's – Access Control Lists................................................................................16
TLS / SSL - Criptografia......................................................................................18
PABX: 2171-4300
2 de 23

OpenLDAP
• Pré-requisitos:
OpenSSL – Última versão estável: openssl-0.9.7j.tar.gz / openssl-0.9.8b.tar.gz
http://www.openssl.org
BerkeleyDB – Última versão estável: db-4.5.20.tar.gz
http://www.sleepycat.com
Cyrus-SASL – Última versão estável: cyrus-sasl-2.1.22.tar.gz
http://asg.web.cmu.edu/cyrus/
OpenLDAP – Última versão estável: openldap-stable-20070110.tar.gz
http://www.openldap.org
Instalação
• OpenSSL
# wget -c http://www.openssl.org/source/openssl-0.9.7j.tar.gz
# wget -c http://www.openssl.org/source/openssl-0.9.8b.tar.gz
# tar xzvf openssl-0.9.xx.tar.gz
# cd openssl-0.9.xx
# ./config shared --openssldir=/usr/local
# make
# make install
• BerkeleyDB
# wget -c http://downloads.sleepycat.com/db-4.5.20.tar.gz
# tar xzvf db-4.5.20.tar.gz
# cd db-4.5.20/build_unix
# ../dist/configure --prefix=/usr/local
# make
# make install
# ldconfig
PABX: 2171-4300
3 de 23

Obs.: No Slackware o diretório “/usr/local/lib” já existe no arquivo “/etc/ld.so.conf”.
• Cyrus-SASL
# wget -c ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/cyrus-sasl-
2.1.22.tar.gz
# tar xzvf cyrus-sasl-2.1.22.tar.gz
# cd cyrus-sasl-2.1.22
# ./configure
# make
# make install
# cd /usr/lib
# mv sasl2 sasl2.original
# ln -s /usr/local/lib/sasl2
• OpenLDAP
# wget -c ftp://ftp.openldap.org/pub/OpenLDAP/openldap-
stable/openldap-stable-20070110.tgz
# tar xzvf openldap-stable-20070110.tgz
# cd openldap-2.3.32
# ./configure --with-tls
# make depend
# make
# make install
Configuração
• OpenLDAP
# cd /usr/local/etc/openldap
# vi slapd.conf
# Opcoes Globais
include /usr/local/etc/openldap/schema/core.schema
include /usr/local/etc/openldap/schema/cosine.schema
include /usr/local/etc/openldap/schema/nis.schema
include /usr/local/etc/openldap/schema/inetorgperson.schema
pidfile /usr/local/var/run/slapd.pid
argsfile /usr/local/var/run/slapd.args
PABX: 2171-4300
4 de 23

allow bind_v2
loglevel 256
# TLS / SSL
# Opcoes do banco de dados
database bdb
suffix "c=BR"
rootdn "cn=Master,c=BR"
rootpw {SSHA}+7vJt6RStpyegSCslgAaym6P8AhacpF3
directory /usr/local/var/openldap-data
# ACL's
# Indices de pesquisa
index objectClass eq
• loglevel – Níveis de log
1 (0x1 trace) trace function calls
2 (0x2 packet) debug packet handling
4 (0x4 args) heavy trace debugging (function args)
8 (0x8 conns) connection management
6 (0x10 BER) print out packets sent and received
32 (0x20 filter) search filter processing
64 (0x40 config) configuration file processing
128 (0x80 ACL) access control list processing
256 (0x100 stats) stats log connections/operations/results
512 (0x200 stats2) stats log entries sent
1024 (0x400 shell) print communication with shell backends
2048 (0x800 parse) entry parsing
4096 (0x1000 cache) caching (unused)
8192 (0x2000 index) data indexing (unused)
16384 (0x4000 sync) LDAPSync replication
32768 (0x8000 none) only messages that get logged whatever log level is
set
Inicialização
• Iniciando o OpenLDAP no modo normal
# /usr/local/libexec/slapd
# ps wax | grep slapd
5140 ? Ssl 0:00 /usr/local/libexec/slapd
PABX: 2171-4300
5 de 23

# netstat -at | grep LISTEN
tcp 0 0 *:ldap *:* LISTEN
# netstat -nat | grep LISTEN
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN
• Iniciando o OpenLDAP no modo debug
# /usr/local/libexec/slapd -d2
• Parando o OpenLDAP
# killall -INT slapd
Alteração de senhas
• Algoritmos disponíveis
{CRYPT}
{MD5}
{SMD5}
{SHA}
{SSHA}
• Com exibição de prompt para alteração de senhas
# slappasswd -h {SSHA}
New password: ******
Re-enter new password: ******
{SSHA}W+KMvIvrVZewWB2vyptuw8HCJY0vFmoR
• Sem exibição de prompt para alteração de senhas
# slappasswd -h {SSHA} -s 123456
{SSHA}mN2aztkb3/h6RgMNq3YmZL2R3SDxvU3e
PABX: 2171-4300
6 de 23

Criação das entradas para importação na base LDAP
• Country BR: “c=BR”
# vi br.ldif
dn: c=BR
objectClass: country
c: BR
• Organização TheSource: “o=TheSource”
# vi thesource.ldif
dn: o=TheSource, c=BR
objectClass: organization
o: TheSource
• Departamento TI: “ou=TI”
# vi ti.ldif
dn: ou=TI, o=TheSource, c=BR
objectClass: organizationalUnit
ou: TI
• Departamento RH: “ou=RH”
# vi rh.ldif
dn: ou=RH, o=TheSource, c=BR
objectClass: organizationalUnit
ou: RH
• Usuário mgarcia: “uid=mgarcia”
# vi mgarcia.ldif
dn: uid=mgarcia, ou=TI, o=TheSource, c=BR
objectClass: inetOrgPerson
uid: mgarcia
cn: Marcio Garcia
mail: mgarcia@thesource.com.br
sn: Garcia
userPassword: {SSHA}sOEFhMFdlam1lMm5rdmp3WVBMTVVSY0hzTWs=
PABX: 2171-4300
7 de 23

• Usuário ralf: “uid=ralf”
# vi ralf.ldif
dn: uid=ralf, ou=TI, o=TheSource, c=BR
uid: ralf
cn: Ralf Braga
mail: ralf@thesource.com.br
sn: Braga
• Usuário recursoshumanos: “uid=recursoshumanos”
# vi recursoshumanos.ldif
dn: uid=recursoshumanos, ou=RH, o=TheSource, c=BR
uid: recursoshumanos
cn: Recursos Humanos The Source
mail: rh@thesource.com.br
sn: Recursos Humanos
Importação das entradas na base LDAP
• Entrada: br.ldif
# ldapadd -x -W -v -D 'cn=Master,c=BR' -f br.ldif
ldap_initialize( <DEFAULT> )
Enter LDAP Password: ******
add objectClass:
country
add c:
BR
adding new entry "c=BR"
modify complete
• Entrada: thesource.ldif
# ldapadd -x -W -v -D 'cn=Master,c=BR' -f thesource.ldif
PABX: 2171-4300
8 de 23

add objectClass:
organization
add o:
TheSource
adding new entry "o=TheSource, c=BR"
modify complete
• Entrada: ti.ldif
# ldapadd -x -W -v -D 'cn=Master,c=BR' -f ti.ldif
add objectClass:
organizationalUnit
add ou:
TI
adding new entry "ou=TI, o=TheSource, c=BR"
modify complete
• Entrada: rh.ldif
# ldapadd -x -W -v -D 'cn=Master,c=BR' -f rh.ldif
add objectClass:
organizationalUnit
add ou:
RH
adding new entry "ou=RH, o=TheSource, c=BR"
modify complete
• Entrada: mgarcia.ldif
# ldapadd -x -W -v -D 'cn=Master,c=BR' -f mgarcia.ldif
add objectClass:
inetOrgPerson
add uid:
PABX: 2171-4300
9 de 23

mgarcia
add cn:
Marcio Garcia
add mail:
add sn:
Garcia
add userPassword:
{SSHA}sOEFhMFdlam1lMm5rdmp3WVBMTVVSY0hzTWs=
adding new entry "uid=mgarcia, ou=TI, o=TheSource, c=BR"
modify complete
• Entrada: ralf.ldif
# ldapadd -x -W -v -D 'cn=Master,c=BR' -f ralf.ldif
add objectClass:
inetOrgPerson
add uid:
ralf
add cn:
Ralf Braga
add mail:
ralf@thesource.com.br
add sn:
Braga
add userPassword:
adding new entry "uid=ralf, ou=TI, o=TheSource, c=BR"
modify complete
• Entrada: recursoshumanos.ldif
# ldapadd -x -W -v -D 'cn=Master,c=BR' -f recursoshumanos.ldif
add objectClass:
inetOrgPerson
add uid:
recursoshumanos
add cn:
Recursos Humanos The Source
add mail:
PABX: 2171-4300
10 de 23

rh@thesource.com.br
add sn:
Recursos Humanos
add userPassword:
adding new entry "uid=recursoshumanos, ou=RH, o=TheSource, c=BR"
modify complete
• Opções do “ldapadd”
-x Utiliza autenticação simples ao invés de SASL
-W Autenticação através de prompt
-w Autenticação através de linha de comando
-v Verbose, utilizado para printar o status do ldapadd
-D Especifica o usuário que ira fazer um bind na base
-f Especifica o arquivo que será importado
Consultas na base LDAP – RFC 2254
• Consultando a base LDAP
# ldapsearch -x -b c=BR
• Consultando a base LDAP, sem comentários e descrições
# ldapsearch -x -b c=BR -LLL
• Consultando a base LDAP, filtrando pelo usuário “mgarcia”
# ldapsearch -x -b c=BR '(uid=mgarcia)'
# ldapsearch -x -b c=BR -u uid=mgarcia
• Consultando a base LDAP, filtrando pelo nome “Ralf Braga”
# ldapsearch -x -b c=BR '(cn=Ralf Braga)'
# ldapsearch -x -b c=BR -u 'cn=Ralf Braga'
• Consultando a base LDAP, filtrando pelo nome “Marcio Garcia” e/ou
“Ralf Braga”
# ldapsearch -x -b c=BR -LLL '(&(|(cn=Marcio Garcia)(cn=Ralf Braga))
(objectClass=inetOrgPerson))'
PABX: 2171-4300
11 de 23

# ldapsearch -x -b c=BR -LLL '(&(|(cn=Marcio Garcia)(cn=Ralf Braga)))'
• Consultando a base LDAP, com exceção do nome “Marcio Garcia”
# ldapsearch -x -b c=BR -LLL '(!(cn=Marcio Garcia))
(objectClass=inetOrgPerson)'
# ldapsearch -x -b c=BR -LLL '(!(cn=Marcio Garcia))'
• Consultando a base LDAP, com exceção do nome “Marcio Garcia”,
filtrando o resultado pelo atributo “mail”
# ldapsearch -x -b c=BR -LLL '(!(cn=Marcio Garcia))' mail
• Operadores boleanos que podem ser utilizados na pesquisa
& and
| or
! not
• Filtros de pesquisa
= igual
=~ direfente
>= maior ou igual
<= menor ou igual
• Exibe os atributos com todos os detalhes, inclusive os invisíveis
# ldapsearch -x -b c=BR +
• Exibe todos os objectClass por “OID”
# ldapsearch -x -b "" -s base "(objectClass=*)" +
• Consulta todos os esquemas disponíveis no servidor LDAP
# ldapsearch -x -W -D cn=Master,c=BR -s base -b "cn=SubSchema"
"(objectClass=*)" +
Obs.: É a mesma coisa que dar um cat nos esquemas do diretório:
/usr/local/etc/openldap/schema
O comando acima exibe alguns parâmetros adicionais.
PABX: 2171-4300
12 de 23

Modificando as entradas na base LDAP
• Consultando o nome “Marcio Garcia”
# ldapsearch -x -b c=BR -LLL '(cn=Marcio Garcia)'
dn: uid=mgarcia,ou=TI,o=TheSource,c=BR
uid: mgarcia
cn: Marcio Garcia
sn: Garcia
• Modificando o sobrenome do usuário “Marcio Garcia” de “Garcia” para
“Garcia Marcenari” e adicionando o atributo: “mobile: 9999-9999”
# vi mgarcia.ldif
uid: mgarcia
cn: Marcio Garcia
sn: Garcia Marcenari
mobile: 9999-9999
# ldapmodify -x -W -v -D 'cn=Master,c=BR' -f mgarcia.ldif
replace objectClass:
inetOrgPerson
replace uid:
mgarcia
replace cn:
Marcio Garcia
replace mail:
replace sn:
Garcia Marcenari
replace userPassword:
replace mobile:
9999-9999
modifying entry "uid=mgarcia, ou=TI, o=TheSource, c=BR"
PABX: 2171-4300
13 de 23

modify complete
• Após a modificação
# ldapsearch -x -b c=BR -LLL '(cn=Marcio Garcia)'
uid: mgarcia
cn: Marcio Garcia
mobile: 9999-9999
Deletando as entradas na base LDAP
• Consultando o usuário “recursoshumanos”
# ldapsearch -x -b c=BR -LLL '(uid=recursoshumanos)'
dn: uid=recursoshumanos,ou=RH,o=TheSource,c=BR
uid: recursoshumanos
cn: Recursos Humanos The Source
mail: rh@thesource.com.br
sn: Recursos Humanos
• Deletando o usuário “recursoshumanos” da base LDAP
# ldapdelete -x -W -v -D 'cn=Master,c=BR'
uid=recursoshumanos,ou=RH,o=TheSource,c=BR
deleting entry "uid=recursoshumanos,ou=RH,o=TheSource,c=BR"
Obs.: A opção “-r” deleta uma entrada recursivamente.
PABX: 2171-4300
14 de 23

Backup / Restore da base LDAP
• Backup off-line
# slapcat > /root/bkp_base_ldap_slapcat.ldif
• Restore off-line
# slapadd -v -l /root/bkp_base_ldap_slapcat.ldif
• Backup on-line
# ldapsearch -x -b c=BR -LLL -W -v -D 'cn=Master,c=BR' >
/root/bkp_online.ldif
filter: (objectclass=*)
requesting: All userApplication attributes
• Restore on-line – Apague toda a base LDAP antes de fazer um restore
# killall -9 slapd
# cd /usr/local/var/openlda-data
# rm -rf *
# cd /root
# ldapadd -x -W -v -D 'cn=Master,c=BR' -f /root/bkp_online.ldif
add objectClass:
country
add c:
BR
adding new entry "c=BR"
...
...
...
...
add sn:
Braga
add userPassword:
adding new entry "uid=ralf,ou=TI,o=TheSource,c=BR"
PABX: 2171-4300
15 de 23

modify complete
Índices de pesquisa
• Os índices ficam localizados no final do arquivo de configuração do
servidor LDAP
# vi /usr/local/etc/openldap/slapd.conf
# Indices de pesquisa
index objectClass eq
index mail,cn,sn pres,eq,sub
index uid eq,sub
• Opções
eq Indexa baseado no que está definido no atributo
aprox Indexa a informação por uma aproximação
pres Indexa se tem ou não determinado atributo em tal parte da
base
sub Indexa partes de atributos declarados
• Criando as tabelas de índices
# ls /usr/local/var/openldap-data
# rm /usr/local/var/openldap-data/alock
# slapindex -v
# ls /usr/local/var/openldap-data
ACL's – Access Control Lists
• As ACL's ficam localizadas após as configurações do banco de dados
do arquivo de configuração do servidor LDAP
# ACL's
• Consultando o usuário “mgarcia” sem a utilização de ACL's
PABX: 2171-4300
16 de 23

# ldapsearch -x -b c=BR -LLL '(uid=mgarcia)'
uid: mgarcia
cn: Marcio Garcia
userPassword:: e1NTSEF9c09FRmhtNXJkbXAzV1ZCTVRWVlNZMGh6VFdzPQ==
mobile: 7724-8637
Obs.: A atributo “userPassword” pode ser visualizado por qualquer um.
• Restringindo consultas ao atributos “mail” e “userPassword”através de
ACL's, porém o atributo “userPassword” pode ser alterado pelo
usuário que fizer um bind na base LDAP
# ACL's
access to attrs=mail
by dn="cn=Master,c=BR" write
by * auth
access to attrs=userPassword
by self write
by * auth
access to *
by * read
# killall -9 slapd
• Consultando o usuário “mgarcia” com a utilização de ACL's
# ldapsearch -x -b c=BR -LLL '(uid=mgarcia)'
uid: mgarcia
cn: Marcio Garcia
mobile: 7724-8637
• Identificadores
PABX: 2171-4300
17 de 23

* Todos, incluindo usuários anônimos e autenticados
anonymous Usuários anônimos
users Usuários autenticados
self Pelo próprio usuário
dn.regex=<regex> Usuários de acordo com a expressão regular
dn.subtree De um determinado ponto para baixo
dn.base Especificando um “dn”. Pode ser qualquer usuário
• Níveis de acesso
none Sem acesso
auth =x Apenas autenticação
compare =cx Capacidade para realizar comparações
search =scx Pode aplicar filtros de buscas
read =rscx Pode ler resultados de buscas
write =wrscx Pode modificar e renomear entradas
TLS / SSL - Criptografia
• Configurar e descomentar a opção “unique_subject = no” no arquivo
de configuraçao “/etc/ssl/openssl.cnf”
# vi /etc/ssl/openssl.cnf
...
...
...
unique_subject = no
...
...
...
• Criando o certificado
# cd /tmp
# mkdir certs
# cd certs
# /etc/ssl/misc/CA.sh -newca
CA certificate filename (or enter to create)
Making CA certificate ...
Generating a 1024 bit RSA private key
............................++++++
...++++++
PABX: 2171-4300
18 de 23

writing new private key to './demoCA/private/./cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:BR
State or Province Name (full name) [Some-State]:SP
Locality Name (eg, city) []:Sao Paulo
Organization Name (eg, company) [Internet Widgits Pty Ltd]:The Source
Organizational Unit Name (eg, section) []:TI
Common Name (eg, YOUR name) []:mgarcia.thesource.com.br
Email Address []:mgarcia@thesource.com.br
• Criando a requisição de certificado e a chave privada para o servidor
# cd /tmp/certs
# openssl req -new -nodes -keyout newreq.pem -out newreq.pem
Generating a 1024 bit RSA private key
.........................................++++++
.........++++++
writing new private key to 'newreq.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:BR
State or Province Name (full name) [Some-State]:SP
Locality Name (eg, city) []:Sao Paulo
Organization Name (eg, company) [Internet Widgits Pty Ltd]:The Source
Organizational Unit Name (eg, section) []:TI
Common Name (eg, YOUR name) []:mgarcia.thesource.com.br
Email Address []:mgarcia@thesource.com.br
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
PABX: 2171-4300
19 de 23

• Assinando o certificado
# cd /tmp/certs
# /etc/ssl/misc/CA.sh -sign
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jul 13 20:39:26 2006 GMT
Not After : Jul 13 20:39:26 2007 GMT
Subject:
countryName = BR
stateOrProvinceName = SP
localityName = Sao Paulo
organizationName = The Source
organizationalUnitName = TI
commonName = mgarcia.thesource.com.br
emailAddress = mgarcia@thesource.com.br
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
2D:30:C7:A0:63:20:53:BC:51:89:EA:48:EB:03:FA:04:19:5C:5E:8A
X509v3 Authority Key Identifier:
keyid:09:0C:CD:9D:D7:F3:48:3B:D2:64:9F:59:6C:7A:D9:C1:B5:48:13:8B
DirName:/C=BR/ST=SP/L=Sao Paulo/O=The
Source/OU=TI/CN=mgarcia.thesource.com.br/emailAddress=mgarcia@theso
urce.com.br
serial:90:0F:AD:CB:A3:F5:FD:53
Certificate is to be certified until Jul 13 20:39:26 2007 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: md5WithRSAEncryption
Issuer: C=BR, ST=SP, L=Sao Paulo, O=The Source, OU=TI,
CN=mgarcia.thesource.com.br/emailAddress=mgarcia@thesource.com.br
Validity
PABX: 2171-4300
20 de 23

Not Before: Jul 13 20:39:26 2006 GMT
Not After : Jul 13 20:39:26 2007 GMT
Subject: C=BR, ST=SP, L=Sao Paulo, O=The Source, OU=TI,
CN=mgarcia.thesource.com.br/emailAddress=mgarcia@thesource.com.br
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:b5:8d:44:70:43:7f:c7:e2:06:79:cf:5c:e3:fd:
f9:ba:8a:7f:29:28:a0:9a:6a:6d:2e:19:07:36:38:
a4:fa:b1:5b:eb:86:ec:c3:66:4b:21:e6:24:76:58:
8c:dd:c3:dc:65:5d:d6:69:ee:78:72:bd:4d:ee:eb:
28:18:66:52:40:15:92:63:c7:c6:3c:09:ad:c7:83:
08:2e:41:12:2d:13:04:f2:e4:50:36:a4:cb:f9:5e:
d6:68:1a:54:25:52:eb:c6:ae:75:a3:94:db:39:82:
f0:e6:fa:d0:7c:65:c6:5a:f7:b2:dd:ad:e2:78:49:
9a:43:04:1f:32:3b:9f:3a:b7
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
2D:30:C7:A0:63:20:53:BC:51:89:EA:48:EB:03:FA:04:19:5C:5E:8A
X509v3 Authority Key Identifier:
keyid:09:0C:CD:9D:D7:F3:48:3B:D2:64:9F:59:6C:7A:D9:C1:B5:48:13:8B
DirName:/C=BR/ST=SP/L=Sao Paulo/O=The
Source/OU=TI/CN=mgarcia.thesource.com.br/emailAddress=mgarcia@theso
urce.com.br
serial:90:0F:AD:CB:A3:F5:FD:53
Signature Algorithm: md5WithRSAEncryption
44:37:da:26:34:0f:1c:5a:04:5d:28:fa:81:45:7e:d2:39:cf:
4a:13:78:3f:4c:9e:16:2a:37:2a:1c:e0:c9:b4:ea:eb:06:c9:
96:24:6a:95:1b:98:40:bc:6d:83:2b:7a:c1:f4:86:ac:e6:97:
9a:45:27:f6:30:39:e7:7e:b6:b4:03:93:ec:15:a3:42:db:ca:
6a:03:56:57:08:eb:66:f1:35:b3:89:f7:f3:c8:8b:6d:8e:9a:
1b:2c:7a:55:3a:54:8a:74:0b:2e:c1:17:86:ab:92:24:fa:67:
fb:e3:d9:3d:ba:13:84:f2:8c:e3:48:e1:a6:8c:ca:c8:b5:ec:
33:38
-----BEGIN CERTIFICATE-----
MIID4jCCA0ugAwIBAgIBATANBgkqhkiG9w0BAQQFADCBnDELMAkGA1UEBhMC
QlIxCzAJBgNVBAgTAlNQMRIwEAYDVQQHEwlTYW8gUGF1bG8xEzARBgNVBAoT
ClRoZSBTb3VyY2UxCzAJBgNVBAsTAlRJMSEwHwYDVQQDExhtZ2FyY2lhLnRoZX
NvdXJjZS5jb20uYnIxJzAlBgkqhkiG9w0BCQEWGG1nYXJjaWFAdGhlc291cmNlLm
NvbS5icjAeFw0wNjA3MTMyMDM5MjZaFw0wNzA3MTMyMDM5MjZaMIGcMQsw
CQYDVQQGEwJCUjELMAkGA1UECBMCU1AxEjAQBgNVBAcTCVNhbyBQYXVsbzE
TMBEGA1UEChMKVGhlIFNvdXJjZTELMAkGA1UECxMCVEkxITAfBgNVBAMTGG1n
YXJjaWEudGhlc291cmNlLmNvbS5icjEnMCUGCSqGSIb3DQEJARYYbWdhcmNpYU
B0aGVzb3VyY2UuY29tLmJyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ
C1jURwQ3/H4gZ5z1zj/fm6in8pKKCaam0uGQc2OKT6sVvrhuzDZksh5iR2WIzd
PABX: 2171-4300
21 de 23

w9xlXdZp7nhyvU3u6ygYZlJAFZJjx8Y8Ca3HgwguQRItEwTy5FA2pMv5XtZoGlQl
UuvGrnWjlNs5gvDm+tB8ZcZa97LdreJ4SZpDBB8yO586twIDAQABo4IBMDCCAS
wwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZW
QgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFC0wx6BjIFO8UYnqSOsD+gQZXF6K
MIHRBgNVHSMEgckwgcaAFAkMzZ3X80g70mSfWWx62cG1SBOLoYGipIGfMIGc
MQswCQYDVQQGEwJCUjELMAkGA1UECBMCU1AxEjAQBgNVBAcTCVNhbyBQYX
VsbzETMBEGA1UEChMKVGhlIFNvdXJjZTELMAkGA1UECxMCVEkxITAfBgNVBAM
TGG1nYXJjaWEudGhlc291cmNlLmNvbS5icjEnMCUGCSqGSIb3DQEJARYYbWdhc
mNpYUB0aGVzb3VyY2UuY29tLmJyggkAkA+ty6P1/VMwDQYJKoZIhvcNAQEEBQ
ADgYEARDfaJjQPHFoEXSj6gUV+0jnPShN4P0yeFio3KhzgybTq6wbJliRqlRuYQLxt
gyt6wfSGrOaXmkUn9jA55362tAOT7BWjQtvKagNWVwjrZvE1s4n388iLbY6aGyx
6VTpUinQLLsEXhquSJPpn++PZPboThPKM40jhpozKyLXsMzg=
-----END CERTIFICATE-----
Signed certificate is in newcert.pem
• Copiando os certificados para o diretório do OpenLDAP
# cd /tmp/certs
# mkdir /usr/local/etc/openldap/certs
# cp demoCA/cacert.pem /usr/local/etc/openldap/certs/
# cp newcert.pem /usr/local/etc/openldap/certs/servercrt.pem
# cp newreq.pem /usr/local/etc/openldap/certs/serverkey.pem
# chmod 600 /usr/local/etc/openldap/certs/serverkey.pem
• Configurando o servidor OpenLDAP
# cd /usr/local/etc/openldap/
# vi slapd.conf
# TLS / SSL
TLSCACertificateFile /usr/local/etc/openldap/certs/cacert.pem
TLSCertificateFile /usr/local/etc/openldap/certs/servercrt.pem
TLSCertificateKeyFile /usr/local/etc/openldap/certs/serverkey.pem
• Configurando o cliente LDAP
# cd /usr/local/etc/openldap/
# vi ldap.conf
TLS_CACERT /usr/local/etc/openldap/certs/cacert.pem
• Carregando o OpenLDAP com suporte e TLS / SSL
# killall -9 slapd
# /usr/local/libexec/slapd -h 'ldap:/// ldaps:///'
PABX: 2171-4300
22 de 23

• Consultando a base LDAP utilizando TLS / SSL
# ldapsearch -x -b c=BR -LLL -ZZ
• Parâmetros do ldapsearch
-Z Exibe os erros, mas continua a pesquisa
-ZZ Exibe os erros, mas não continua a pesquisa
Obrigado!
MarcioGarciaMarcenari
marciogarcia@gmail.com
PABX: 2171-4300
23 de 23

Circuito_OpenLDAP

Recomendados

Recomendados

Mais conteúdo relacionado

Destaque

Destaque (9)

Semelhante a Circuito_OpenLDAP

Semelhante a Circuito_OpenLDAP (20)

Circuito_OpenLDAP