Ha ha! Further success on the Linux -> Active Directory integration front. I got SSL working for the underlying ldap bind user. What’s this mean? Protection of the directory information over the wire as it travels from the domain controller to the client host where it will be used.
So what’s the necessary setup bits? There are three options that need to be added to the ldap.conf that I originally came up with. They are:
ssl yes tls_cacertfile /etc/ssl/certs/ca_bundle.crt tls_checkpeer no uri ldaps://austin.utexas.edu/ (this is a modification from the previous config)
The tls_cacertfile defines the location of the file that contains the certificate authority information used to create the SSL certificate on the Active Directory domain controllers. You need this to verify the authenticity of the dc’s. The file should be .pem formatted and must be converted from the file you retrieve from the internal certificate authority at UT.
Once you’ve downloaded the file, you get it in the DER format which needs to be converted using something like the following.
openssl x509 -in downloadedcert.cer -inform DER -out rootca.pem -outform PEM
Next, you copy the contents of the rootca.pem to the tls_cacertfile file.
Once you’ve configured the ldap.conf with the updated options, you should now be accessing LDAP over SSL. You’ll have to verify this by running something like wireshark and watching the tcp traffic going across the wire. It’ll look something like the stream in the image above.
If you see errors in /var/log/messages that look like the following, then you’ve got something wrong in your configuration still.
Jun 3 14:09:49 fedex getent: nss_ldap: failed to bind to LDAP server ldaps://austin.utexas.edu/: Can't contact LDAP server Jun 3 14:09:49 fedex getent: nss_ldap: reconnecting to LDAP server (sleeping 4 seconds)... Jun 3 14:09:53 fedex getent: nss_ldap: failed to bind to LDAP server ldaps://austin.utexas.edu/: Can't contact LDAP server Jun 3 14:09:53 fedex getent: nss_ldap: reconnecting to LDAP server (sleeping 8 seconds)... Jun 3 14:10:01 fedex getent: nss_ldap: failed to bind to LDAP server ldaps://austin.utexas.edu/: Can't contact LDAP server Jun 3 14:10:01 fedex getent: nss_ldap: reconnecting to LDAP server (sleeping 16 seconds)...
Now that we have SSL tackled, time to get group lookups working. I’ll leave that for another posting.
You must be logged in to post a comment.