Embedded Files
In an effort to enhance security in our LDAP infrastructure, we're now requiring TLS encryption between our clients and the backend hosts. This change requires a few configuration edits to implement on each client.
The files that require edits include:
/etc/ldap.conf
/etc/ldap/ldap.conf
Note: the key parts are:
For both files
comment out the URI to ldap://vip-ldap01.eng.ucsd.edu
Ensure the URI includes ldap 11/12/13
for /etc/ldap.conf
add "ssl start_tls"
add "tls_cacert /etc/ssl/certs/cacert-oec.pem"
for /etc/ldap/ldap.conf
Change TLS_REQCERT to "allow"
/etc/ldap.conf
--------------------
base dc=eng,dc=ucsd,dc=edu
URI ldap://ldap11.eng.ucsd.edu ldap://ldap12.eng.ucsd.edu ldap://ldap13.eng.ucsd.edu
#URI ldap://vip-ldap01.eng.ucsd.edu
ldap_version 3
pam_password md5
ssl start_tls
tls_cacert /etc/ssl/certs/cacert-oec.pem
===================================================================
/etc/ldap/ldap.conf
-----------------------
BASE dc=eng,dc=ucsd,dc=edu
URI ldap://ldap11.eng.ucsd.edu ldap://ldap12.eng.ucsd.edu ldap://ldap13.eng.ucsd.edu
#URI ldap://vip-ldap01.eng.ucsd.edu
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
# TLS certificates (needed for GnuTLS)
TLS_CACERT /etc/ssl/certs/cacert-oec.pem
TLS_REQCERT allow
Cert file:
Please make sure you have the /etc/ssl/certs/cacert-oec.pem file in place.
Once these changes are in place, you can restart the LDAP server process by rebooting, or by typing:
#systemctl restart nscd
Auto Mounting:
Many systems use autofs in order to mount home directories and perhaps other remote file systems. If your system falls under this category, you will need to also edit the /etc/auto.home file and make the following changes:
Old code:
department=$(ldapsearch -LLL -x uid=$user dn | sed -e 's/.*ou=//; s/,.*//')
New code:
department=$(ldapsearch -LLL -ZZ -x uid=$user dn | sed -e 's/.*ou=//; s/,.*//')
(Note the addition of the -ZZ parameter)
The -ZZ directive tells the ldapsearch to use encryption for its connection.
You can download the cacert-oec.pem file here: cacert-oec.pem
Page updated
Report abuse