Curs 2 - Administrarea LDAPrepository.grid.pub.ro/cs/saisp/cursuri/curs-02.pdfAdministrarea LDAP Servicii avansate pentru ISP 27 februarie 2017 SAISP Curs 2, Administrarea LDAP 1/34

Curs 2Administrarea LDAP

Servicii avansate pentru ISP

27 februarie 2017

SAISP Curs 2, Administrarea LDAP 1/34

Moto

Simplicity is a great virtue but it requires hard work to achieve itand education to appreciate it. And to make matters worse:

complexity sells better.

Edsger Dijkstra


Reminder

OpenLDAP

Securitate ın OpenLDAP

Incheiere

Intrebari


Suport

I “Unix and Linux System Administration”I Chapter 19 – Sharing System Files

I Section 19.3 – LDAP: The Lightweight Directory AccessProtocol

I “Professional Linux System Administration”I Chapter 16 – Directory Services


Outline

Reminder

OpenLDAP


Incheiere

Intrebari


LDAP

I director

I baza de date

I acces citire s, i scriere, frecvent de citire

I DN, RDN, DC, CN, OU

I LDAP URI

I atribute, filtre


LDAP

I director

I baza de date

I acces citire s, i scriere, frecvent de citire

I DN, RDN, DC, CN, OU

I LDAP URI

I atribute, filtre


Utilitare LDAP

I apt-get install ldap-utils

I /etc/ldap/ldap.conf

I ldapsearch, ldapadd, ldapdelete, ldapmodify,

ldappasswd


Utilitate LDAP

I centralizare informat, ii (autentificare, SSO)

I organizare, flexibilitate

I interfat,a unica de acces la date organizate/structurate

I acces rapid pentru citire

I funct, ionare peste ret,ea

I distributable


Outline

Reminder

OpenLDAP


Incheiere

Intrebari


OpenLDAP

I implementare de server LDAP

I ruleaza pe Linux, BSD, Mac OS X, Solaris, WindowsI instalare

I dpkg-reconfigure debconfI dialog, lowI permite configurarea bazei de date

I apt-get install slapd ldap-utilsI sau dpkg-reconfigure -plow slpad (dupa apt-get

install)

I /etc/init.d/slapd start | stop | restart


Tool-uri de interact, iune OpenLDAP

I slap* – tool-uri offlineI serverul trebuie sa fie oprit

I ldap* – tool-uri onlineI validare

I slaptestI slapcat


Configurare de baza OpenLDAP – pre v2.3

I /etc/ldap/slapd.conf

I /etc/default/slapd

I man slapd.conf

I loglevel 256 sau loglevel stats

I index uid eq


Configurare de baza OpenLDAP – post v2.3

I /etc/ldap/slapd.d/


I man slapd-config

I configurare prin fis, iere LDIF


URI-uri OpenLDAP

I ldap:/// – LDAP simplu (portul 389)

I ldaps:/// – LDAP securizat (portul 636)

I ldapi:/// – LDAP local (socket, i Unix), folosit pentruautentificare SASL de tip EXTERNAL

I SLAPD_URI ın /etc/default/slapd


Ierarhia de configurare OpenLDAP – post v2.3

I directivele documentate ın pagina de manual slapd-config

I radacina ın /etc/ldap/slapd.d/

I cn=config – opt, iuni de configurare globale (GLOBALCONFIGURATION OPTIONS ın manual)

I olcDatabase=0config,cn=config – configurarea bazei dedate de configurare

I olcDatabase=1hdb,cn=config – configurarea bazei de dateLDAP

I cn=schema,cn=config – configurarea schemei

I pentru baze de date – GLOBAL DATABASE OPTIONS s, iGENERAL DATABASE OPTIONS ın manual


Configurare baze de date de configurare

I init, ial cu ajutorul formei de autentificare SASL externe(EXTERNAL)

I foloses, te URI-ul ldapi:///I ldapsearch -LLL -Y EXTERNAL -H ldapi:///I ldapadd -Y EXTERNAL -H ldapi:/// -f test.ldif

I configurarea parolei pentru rootdn pentru baza de date deconfigurare (cn=admin,cn=config)

I ldapadd -Y EXTERNAL -H ldapi:/// -f admin.ldif

1 dn: olcDatabase={0}config,cn=config2 changetype: modify

3 add: olcRootPW

4 olcRootPW: {SSHA}rARaJcrMxKH+e1INIhGt5Pjqf7+bS8pm


Configurare parola noua pentru admin baza de date LDAP

1 dn: olcDatabase={1}hdb,cn=config2 changetype: modify

3 replace: olcRootPW

4 olcRootPW: {SSHA}gOoL0jqP2roPeRjDG6ki1BdDqCFxhdWp

I ldapadd -x -D cn=admin,cn=config -w password -f

rootdn-passwd.ldif


Configurare niveluri de logging

1 dn: cn=config

2 changetype: modify

3 replace: olcLogLevel

4 olcLogLevel: stats

I se configureaza o lista de evenimente ce se doresc jurnalizate

I ldapadd -x -D cn=admin,cn=config -w password -f

change-logging.ldif


Schemas


Outline

Reminder

OpenLDAP


Incheiere

Intrebari


Securizare OpenLDAP

I “selective listening”: /etc/default/slapd

I autentificare la server (bind): simple, SASL

I controlul accesului (ACL)

I suport TLS

I SSF (Security Strength Factors)


Controlul accesului ın LDAP

I man slapd.access

I access to * by * readI tot, i utilizatorii pot citi (chiar s, i cei anonimi)

I access to *

by self write

by anonymous auth

by * read

I utilizatorul curent ıs, i poate actualiza informat, iaI utilizatorul anonim se poate autentifica peste intrarile existenteI utilizatorii obis,nuit, i care au facut bind pot citi cont, inutulI util pentru gestiunea parolelorI prima intrare gasita este cea selectata (vezi anonymous)


Controlul accesului ın LDAP (2)

I access to attrs=userPassword,shadowLastChange

by dn="cn=admin,dc=swarm,dc=cs,dc=pub,dc=ro" write

by anonymous auth

by self write

by * none

I gestiunea parolelorI utilizatorul privilegiat are drepturi completeI utilizatorul anonim se poate autentificaI utilizatorul curent poate sa ıs, i schimbe parolaI utilizatorii obis,nuit, i care au facut bind nu au acces

I forma generica: access to <what> by <who><access>


Controlul accesului ın LDAP – LDIF

1 dn: olcDatabase={1}hdb,cn=config2 changetype: modify

3 replace: olcAccess

4 olcAccess: {0}to attrs=userPassword,shadowLastChange by

anonymous auth by dn="cn=admin,dc=test,dc=ro" write by * none

5 olcAccess: {1}to * by self read by

dn="cn=admin,dc=garm,dc=cs,dc=pub,dc=ro" write by * none


Suport SSL/TLS ın OpenLDAP

I TLS(v1)/SSL(v3)I ın doua moduri

I automat: pe portul 636 (LDAPS), URI de forma ldaps://I prin definit, ie: pe portul standard 389 (LDAP), clientul

pornes, te TLS (StartTLS)


Directive TLS

I TLSCACertificateFile – certificatele CA-urilor de ıncredere

I TLSCertificateFile – certificatul serverului

I TLSCertificateKeyFile – cheia privata a serveruluiI serverul trebuie sa aiba acces la cheia privata

I din cauza permisiunilor pe /etc/ssl/private/, utilizatorulopenldap trebuie adaugat la grupul ssl-cert


Configurare TLS ın OpenLDAP

1 dn: cn=config

2 changetype: modify

3 add: olcTLSCACertificateFile

4 olcTLSCACertificateFile:

/etc/ssl/certs/ssl-cert-snakeoil.pem

5 -

6 add: olcTLSCertificateFile

7 olcTLSCertificateFile: /etc/ssl/certs/ssl-cert-snakeoil.pem

8 -

9 add: olcTLSCertificateKeyFile

10 olcTLSCertificateKeyFile:

/etc/ssl/private/ssl-cert-snakeoil.key

11 -

12 add: olcTLSVerifyClient

13 olcTLSVerifyClient: never


Configurare client pentru folosire TLS

I /etc/ldap/ldap.conf sau /.ldaprc

I TLS_REQCERT none ın cazul ın care nu se s, tie care este CA-ul

I TLS_CACERT /path/to/cert pentru a indica CA-ul

I TLS_CACERTDIR /path/to/cert/dir/ pentru a indicadirectorul cu certificate de CA

I ldapsearch -x -LLL -Z ...


Configurare TLS-only

I /etc/default/slapdI SLAPD_SERVICES="ldapi:/// ldaps:///"

I ın /etc/ldap/ldap.conf – BASE ldaps://...

I sau ldapsearch -x -LLL -H ldaps://...


Replicare LDAP

I tolerant, a la defecte s, i fiabilitate

I init, ial slurpd: push mode

I syncrepl

I delta syncrepl

I diverse arhitecturi de replicare (multi-master/master-slave)

I diverse protocoale ın alte solut, ii de director (e.g. 389DS)


Outline

Reminder

OpenLDAP


Incheiere

Intrebari


Cuvinte cheie

I OpenLDAP

I slapd

I /etc/ldap/slapd.d/


I man slapd-config

I ldapi:///

I cn=config

I cn=admin,cn=config

I -Y EXTERNAL

I root DN

I schema

I SASL

I SSF

I ACL

I oclAccess

I TLS/SSL

I TLS_REQCERT

I TLS_CACERT

I replicare

I syncrepl


Resurse utile

I http://www.debian-administration.org/article/OpenLDAP_

installation_on_Debian

I http://en.wikipedia.org/wiki/LDAP

I http://www.openldap.org/doc/admin24/index.html

I http://www.openldap.org/doc/admin24/sasl.html

I http://www.openldap.org/doc/admin24/access-control.html

I http://www.openldap.org/doc/admin24/tls.html

I http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html

I http://www.zytrax.com/books/ldap/

I http://www.zytrax.com/books/ldap/ch5/step2.html#step2

I http://www.zytrax.com/books/ldap/ch15/


http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian

http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian

http://en.wikipedia.org/wiki/LDAP

http://www.openldap.org/doc/admin24/index.html

http://www.openldap.org/doc/admin24/sasl.html

http://www.openldap.org/doc/admin24/access-control.html

http://www.openldap.org/doc/admin24/tls.html

http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html

http://www.zytrax.com/books/ldap/

http://www.zytrax.com/books/ldap/ch5/step2.html#step2

http://www.zytrax.com/books/ldap/ch15/

Outline

Reminder

OpenLDAP


Incheiere

Intrebari


Documents

Curs 2 - Administrarea LDAPrepository.grid.pub.ro/cs/saisp/cursuri/curs-02.pdfAdministrarea LDAP Servicii avansate pentru ISP 27 februarie 2017 SAISP Curs 2, Administrarea LDAP 1/34