SUSE Linux源码安装OpenLDAP(二)

 

一、创建证书

      在OpenLDAP服务中开启SSL/TLS连接需要一个服务器证书。有两种方法创建和安装服务器证书。

1.1、自签名证书

      第一种创建服务器证书的方式是利用openssl创建一个自签名的服务器证书：命令，openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout server.pem -days 365如图：

      OpenLDAP只工作在非加密的keys下，-nodes参数阻止加密私钥，Common Name请输入服务器完整主机名。

      下一步就是在OpenLDAP中配置server.pem。私钥包含在证书里面，将会被发送到所有的OpenLDAP客户端。服务器配置如图：

      切换到/opt/OpenLDAP/libexec下使用./slapd  -h "ldap:/// ldaps:///" -d -1命令启动服务器，使用openssl s_client -connect localhost:636 -showcerts命令查看证书：

      完成，结果中的error实际上不是错误，创建自签名的证书只需要修改slapd.conf。另一种创建证书的方式是常见CA发行的证书，强烈建议使用CA发行证书代替自签名证书。

1.2、CA发行的证书

      1.2.1、创建CA

            执行CA.pl -newca创建一个CA：/opt/openssl/ssl/misc/CA.pl –newca

      注意图中红色让部分，密码和Common Name，以上命令会创建demoCA/cacert.pem和demoCA/private/cakey.pem。(CA cert和CA private key)。

      1.2.2、创建一个服务器证书的签署请求(server certificate signing request:CSR)

            执行命令：openssl req -newkey rsa:1024 -nodes -keyout newreq.pem -out newreq.pem

      结果会生成一个newreq.pem的文件。

      1.2.3、让CA签署CSR

            执行：/opt/openssl/ssl/misc/CA.pl –sign

      这将使用private key和newreq.pem生成newcert.pem。

      1.2.4、配置slapd.conf

      1.2.5、创建客户端证书

            客户端证书和服务器端证书基本一样，注意Common就行。

1.3、nginx+php访问OpenLDAP

      nginx配置：将生成的客户端的client.pem改名为client.key配置如下：

      配置完成重启nginx。

      新建php文件：testopenldap.php

testopenldap.php<?php $ds = ldap_connect("ldaps://sugon.com",636); $r = ldap_bind($ds,"cn=Manager,dc=sugon,dc=com","secret"); if($ds && $r){ echo "连接成功"; } ?>

 

      结果如图：

 

1.4、完成的slapd.conf

slapd.conf# # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /opt/OpenLDAP/etc/openldap/schema/core.schema include /opt/OpenLDAP/etc/openldap/schema/cosine.schema include /opt/OpenLDAP/etc/openldap/schema/inetorgperson.schema include /opt/OpenLDAP/etc/openldap/schema/collective.schema include /opt/OpenLDAP/etc/openldap/schema/corba.schema include /opt/OpenLDAP/etc/openldap/schema/duaconf.schema include /opt/OpenLDAP/etc/openldap/schema/dyngroup.schema include /opt/OpenLDAP/etc/openldap/schema/java.schema include /opt/OpenLDAP/etc/openldap/schema/misc.schema include /opt/OpenLDAP/etc/openldap/schema/nis.schema include /opt/OpenLDAP/etc/openldap/schema/openldap.schema include /opt/OpenLDAP/etc/openldap/schema/pmi.schema include /opt/OpenLDAP/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org allow bind_v2 password-hash {MD5} pidfile /opt/OpenLDAP/var/run/slapd.pid argsfile /opt/OpenLDAP/var/run/slapd.args # Load dynamic backend modules: # modulepath /opt/OpenLDAP/libexec/openldap # moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! #access to attr=userPassword # by self write # by anonymous auth access to * by dn="cn=Manager,dc=sugon,dc=com" write by users read by anonymous read TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /opt/OpenLDAP/cacert/demoCA/cacert.pem TLSCertificateFile /opt/OpenLDAP/cacert/newcert.pem TLSCertificateKeyFile /opt/OpenLDAP/cacert/newreq.pem TLSVerifyClient never ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=sugon,dc=com" rootdn "cn=Manager,dc=sugon,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {MD5}Xr4ilOzQ4PCOq3aQ0qbuaQ== # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /opt/OpenLDAP/var/openldap-data # Indices to maintain index objectClass eq