Modify / append the TLS-settings:

#--- SSL/TLS setting ---#
TLSCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP
TLS_CACERT /etc/ssl/certs/ca_cert.pem
TLS_CERT /etc/ssl/certs/station7_cert.pem
TLS_KEY /etc/ssl/private/station7_key.pem
TLS_REQCERT demand

Modify / append the TLS-settings:

#--- SSL/TLS setting ---#
TLSCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP
TLSCertificateFile /etc/ssl/certs/station7_cert.pem
TLSCertificateKeyFile /etc/ssl/private/station7_key.pem
TLSCACertificateFile /etc/ssl/certs/ca_cert.pem
TLSVerifyClient never

Open /etc/init.d/ldap and search for the line SLAPD_URLS

SLAPD_URLS="ldap:///"

Add „ldaps“

# 2007-06-28, chhaas:
# SLAPD_URLS="ldap:///"
# 2007-06-28, chhaas:
SLAPD_URLS="ldap:/// ldaps:///"

After all the above modifications to the OpenLDAP-configuration, restart the ldap daemon and watch carefully the output in /var/log/messages !

Use a portscanner like „nmap“:

station7:/ # nmap localhost | grep ldap
389/tcp  open  ldap
636/tcp  open  ldapssl

→ ldaps is running at port 636

openssl s_client -connect localhost:636 -showcerts -state -CAfile /etc/ssl/certs/ca_cert.pem
station7:/ # openssl s_client -connect localhost:636 -showcerts -state -CAfile /etc/ssl/certs/ca_cert.pem   
CONNECTED(00000004)
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:SSLv3 read server hello A
depth=1 /C=DE/ST=BW/L=Stuttgart/O=Example Inc./OU=IuK/CN=station7.example.com/emailAddress=hostmaster@example.com
verify return:1
depth=0 /C=DE/ST=BW/L=Stuttgart/O=Example Inc./OU=IuK/CN=station7.example.com/emailAddress=hostmaster@example.com
verify return:1
SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server done A
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write change cipher spec A
SSL_connect:SSLv3 write finished A
SSL_connect:SSLv3 flush data
SSL_connect:SSLv3 read finished A
---
Certificate chain
 0 s:/C=DE/ST=BW/L=Stuttgart/O=Example Inc./OU=IuK/CN=station7.example.com/emailAddress=hostmaster@example.com
   i:/C=DE/ST=BW/L=Stuttgart/O=Example Inc./OU=IuK/CN=station7.example.com/emailAddress=hostmaster@example.com
-----BEGIN CERTIFICATE-----
[... snipped out ...]
-----END CERTIFICATE-----
---
Server certificate
subject=/C=DE/ST=BW/L=Stuttgart/O=Example Inc./OU=IuK/CN=station7.example.com/emailAddress=hostmaster@example.com
issuer=/C=DE/ST=BW/L=Stuttgart/O=UExample Inc./OU=IuK/CN=station7.example.com/emailAddress=hostmaster@example.com
---
No client certificate CA names sent
---
SSL handshake has read 1193 bytes and written 340 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 1024 bit
SSL-Session:
    Protocol  : TLSv1
    Cipher    : AES256-SHA
    Session-ID: 98D61CE93C7A72E40E977BD5BD1CCC3E83D72AF2EDB8D82B24BA27E51903C161
    Session-ID-ctx:
    Master-Key: D42BCC6BC82A0C2DC163CE07B190C1F145D238B8764A10201B63918D9CADD49447611030C96E68EAA109EE1B8AEBEF05
    Key-Arg   : None
    Start Time: 1184081560
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

The command will hang after the final return code output. This is normal. „Control-c“ will end the command.
The line „No client certificate CA names sent“ is indicative of a server side SSL set up. If client authentication had been configured, the OpenSSL command and output would resemble this:

OpenSSL Output Using Client Authentication 

ldaps is a SSL-encrypted LDAP-connection. Try ZZ here to force TLS:

station7:/etc/init.d # ldapsearch -H ldaps://station7.example.com -x -ZZ
ldap_start_tls: Operations error (1)
      additional info: TLS already started

This tells you, that the connection is already encrypted. Now execute the command without the „ZZ“:

station7:/etc/init.d # ldapsearch -H ldaps://station7.example.com -x

If it executes successfully the ldaps is working!
More information can be found at: http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html
and: http://www.openldap.org/faq/data/cache/185.html


← index