传输安全-LDAP协议安全加固
信息安全相关 - 建设篇
第一章 传输安全-LDAP协议安全加固
- 信息安全相关 - 建设篇
- 下章内容
- 传输安全-LDAP协议安全加固
-
- 前言
- 前提条件
- JumpServer堡垒机使用LDAPS协议
-
- 检查config配置
- 配置LDAPS
- JumpServer验证LDAPS的传输是否加密
- php-fpm使用LDAPS协议
-
- 宝塔面板下配置php-fpm
- php-fpm验证LDAPS
- NextCloud文档云使用LDAPS协议
-
- 配置openldap
- 宝塔面板检查SSL证书
- 配置LDAPS
- NextCloud验证LDAPS的传输是否加密
- 参考来源
下章内容
第二章 安全审计-Linux用户命令全审计
传输安全-LDAP协议安全加固
前言
诸如堡垒机、跳板机、OA系统、ERP软件、准入系统、运维或审计的等等各种业务系统，都会涉及到使用LDAP协议跟Active Directory目录服务或者RADIUS用户数据库等认证源做用户数据的对接，但传输过程中往往容易被中间人窃取，因为LDAP协议始终是明文传输，即为了加固传输安全，需要将LDAP协议加固到LDAPS协议。
- 业务系统：支持LDAP协议和LDAPS协议的所有系统
前提条件
使用LDAPS协议需要SSL证书，此例使用自建的CA颁发的SSL证书实现LDAPS传输，以JumpServer、Linux的php-fpm服务、NextCloud等举例说明LDAPS协议如何实现，其他业务系统操作的原理大体一致。
1. JumpServer已跟内网域控对接LDAP，并且成功获取到LDAP用户数据
2. NextCloud已跟内网域控对接LDAP，并且成功获取到LDAP用户数据
JumpServer堡垒机使用LDAPS协议
检查config配置
# 检查jumpserver的config配置文件是否启用了https
[root@jumpserver ~]# grep -A 5 HTTPS /opt/jumpserver/config/config.txt
## HTTPS 配置, 参考 https://docs.jumpserver.org/zh/master/admin-guide/proxy/ 配置
USE_LB=1 # 启用HTTPS
HTTPS_PORT=443 # 指定监听的https端口
SERVER_NAME=jumpserver.xxx.com # 授权访问的https域名
SSL_CERTIFICATE=jumpserver.pem # pem证书文件
SSL_CERTIFICATE_KEY=jumpserver.key # key私钥文件
# 检查jumpserver的web服务器ssl证书是否有效
[root@jumpserver ~]# openssl x509 -in /opt/jumpserver/config/nginx/cert/jumpserver.pem -text -noout
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
...
Signature Algorithm: sha256WithRSAEncryption
Issuer: DC=com, DC=xxx, CN=自建CA
Validity
Not Before: xxx 0 00:00:00 202x GMT
Not After : xxx 0 05:00:00 202x GMT
Subject: C=CN, ST=xxx, L=xxx, O=xxx Technology Co., Ltd., OU=xxx Department, CN=*.xxx.com
Subject Public Key Info:
...
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:*.xxx.com
...
...
配置LDAPS
LDAP的地址栏更换成ldaps://domain.com:636的形式即可完成
JumpServer验证LDAPS的传输是否加密
JumpServer使用验证连接性，并在Linux后台使用tcpdump抓636端口的包验证LDAPS
[root@jumpserver ~]# tcpdump -i any port 636
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
22:31:44.102260 IP 192.168.250.9.41388 > ad.xxx.com.ldaps: Flags [S], seq 3945830231, win 29200, options [mss 1460,sackOK,TS val 558954956 ecr 0,nop,wscale 7], length 0
22:31:44.102307 IP 192.168.250.9.41388 > ad.xxx.com.ldaps: Flags [S], seq 3945830231, win 29200, options [mss 1460,sackOK,TS val 558954956 ecr 0,nop,wscale 7], length 0
22:31:44.102327 IP jumpserver.xxx.com.41388 > ad.xxx.com.ldaps: Flags [S], seq 3945830231, win 29200, options [mss 1460,sackOK,TS val 558954956 ecr 0,nop,wscale 7], length 0
22:31:44.102645 IP ad.xxx.com.ldaps > jumpserver.xxx.com.41388: Flags [S.], seq 2213454242, ack 3945830232, win 8192, options [mss 1460,nop,wscale 8,sackOK,TS val 559796977 ecr 558954956], length 0
22:31:44.102666 IP ad.xxx.com.ldaps > 192.168.250.9.41388: Flags [S.], seq 2213454242, ack 3945830232, win 8192, options [mss 1460,nop,wscale 8,sackOK,TS val 559796977 ecr 558954956], length 0
22:31:44.102671 IP ad.xxx.com.ldaps > 192.168.250.9.41388: Flags [S.], seq 2213454242, ack 3945830232, win 8192, options [mss 1460,nop,wscale 8,sackOK,TS val 559796977 ecr 558954956], length 0
22:31:44.102716 IP 192.168.250.9.41388 > ad.xxx.com.ldaps: Flags [.], ack 1, win 229, options [nop,nop,TS val 558954956 ecr 559796977], length 0
22:31:44.102725 IP 192.168.250.9.41388 > ad.xxx.com.ldaps: Flags [.], ack 1, win 229, options [nop,nop,TS val 558954956 ecr 559796977], length 0
22:31:44.102734 IP jumpserver.xxx.com.41388 > ad.xxx.com.ldaps: Flags [.], ack 1, win 229, options [nop,nop,TS val 558954956 ecr 559796977], length 0
22:31:44.104027 IP 192.168.250.9.41388 > ad.xxx.com.ldaps: Flags [P.], seq 1:518, ack 1, win 229, options [nop,nop,TS val 558954957 ecr 559796977], length 517
跟踪seq 3945830231，可以发现JumpServer的源IP 192.168.250.9（Docker里边的IP会被代理成jumpserver.xxx.com）以TCP随机端口向AD域控的ldaps端口发起协议，并且成功建立TCP三次握手
php-fpm使用LDAPS协议
php使用ldaps连接和修改密码
# php启用ldaps
ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE,"/etc/pki/ca-trust/extracted/openssl/Custom-CA.cer"); # php调用ldap模块的ssl时引用的ca证书路径
ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7); # 启用debug日志调试
putenv('LDAPTLS_REQCERT=never'); # 不对ldaps客户端做响应
ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3); # 启用LDAPv3版本，支持域名形式的url
ldap_set_option($ds, LDAP_OPT_REFERRALS, 0); #
宝塔面板下配置php-fpm
[root@nginx ~]# vim /www/server/php/74/etc/php.ini
...
[curl]
; A default value for the CURLOPT_CAINFO option. This is required to be an
; absolute path.
curl.cainfo = /etc/pki/ca-trust/extracted/openssl/Custom-CA.cer # php使用curl的ca证书信息
[openssl]
; The location of a Certificate Authority (CA) file on the local filesystem
; to use when verifying the identity of SSL/TLS peers. Most users should
; not specify a value for this directive as PHP will attempt to use the
; OS-managed cert stores in its absence. If specified, this value may still
; be overridden on a per-stream basis via the "cafile" SSL stream context
; option.
openssl.cafile=/etc/pki/ca-trust/extracted/openssl/Custom-CA.cer # php的openssl模块使用的ca文件路径
; If openssl.cafile is not specified or if the CA file is not found, the
; directory pointed to by openssl.capath is searched for a suitable
; certificate. This value must be a correctly hashed certificate directory.
; Most users should not specify a value for this directive as PHP will
; attempt to use the OS-managed cert stores in its absence. If specified,
; this value may still be overridden on a per-stream basis via the "capath"
; SSL stream context option.
openssl.capath=/etc/pki/ca-trust/extracted/openssl # php的openssl模块使用的ca目录路径
php-fpm验证LDAPS
(略)
NextCloud文档云使用LDAPS协议
配置openldap
添加TLS_REQCERT allow选项
[root@nextcloud ~]# vim /etc/openldap/ldap.conf
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
#BASE dc=example,dc=com
#URI ldap://ldap.example.com ldap://ldap-master.example.com:666
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
TLS_CACERTDIR /etc/openldap/certs
TLS_REQCERT allow ####################### 增加这一项即可
# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON on
宝塔后台重启Nginx和PHP服务
宝塔面板检查SSL证书
配置LDAPS
NextCloud验证LDAPS的传输是否加密
NextCloud使用验证连接性，并在Linux后台使用tcpdump抓636端口的包验证LDAPS
[root@nextcloud ~]# tcpdump -i any port 636
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
20:01:25.469282 IP NextCloud.xxx.com.41896 > ad.xxx.com.ldaps: Flags [S], seq 4037221096, win 29200, options [mss 1460,sackOK,TS val 73287137 ecr 0,nop,wscale 7], length 0
20:01:25.469589 IP ad.xxx.com.ldaps > NextCloud.xxx.com.41896: Flags [S.], seq 1111988770, ack 4037221097, win 8192, options [mss 1460,nop,wscale 8,sackOK,TS val 578588842 ecr 73287137], length 0
20:01:25.469653 IP NextCloud.xxx.com.41896 > ad.xxx.com.ldaps: Flags [.], ack 1, win 229, options [nop,nop,TS val 73287137 ecr 578588842], length 0
20:01:25.470057 IP NextCloud.xxx.com.41896 > ad.xxx.com.ldaps: Flags [P.], seq 1:290, ack 1, win 229, options [nop,nop,TS val 73287138 ecr 578588842], length 289
20:01:25.472242 IP ad.xxx.com.ldaps > NextCloud.xxx.com.41896: Flags [.], seq 1:1449, ack 290, win 2081, options [nop,nop,TS val 578588845 ecr 73287138], length 1448
20:01:25.472438 IP NextCloud.xxx.com.41896 > ad.xxx.com.ldaps: Flags [.], ack 1449, win 251, options [nop,nop,TS val 73287140 ecr 578588845], length 0
20:01:25.472627 IP ad.xxx.com.ldaps > NextCloud.xxx.com.41896: Flags [P.], seq 1449:2085, ack 290, win 2081, options [nop,nop,TS val 578588845 ecr 73287138], length 636
跟踪seq 4037221096，可以发现NextCloud的源IP NextCloud.xxx.com 以TCP随机端口向AD域控的ldaps端口发起协议，并且成功建立TCP三次握手
参考来源
- php使用ldaps连接和修改密码