Setting up openldap for ldaps with cn=config

Question

I'm trying to enable SSL connections on an OpenLDAP 2.4.23 server, but all the instructions I find only discuss the old slapd.conf configuration. Can anyone point to some instructions for setting it up under cn=config?

Solution 1

Here's whats working so far, though I could still use a guide to tuning the security settings under cn=config:

Follow the instructions here to create the certificate, added the tls attributes to cn=config (last two were set by default)

olcTLSCertificateFile /certs/ldapscert.pem
olcTLSCertificateKeyFile /certs/keys/ldapskey.pem
olcTLSCipherSuite TLSV1+RSA:!NULL
olcTLSCRLCheck none
olcTLSVerifyClient never

start server using /usr/local/libexec/slapd -F slapd.d -h ldaps:///

This lets me connect from Apache Directory Studio using ldaps, but isn't working for linux logins.

Solution 2

If, like me, you found this answer but were looking for the dynamic config (cn=config) option, use the following ldif.

dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /path/to/host.key
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /path/to/host.crt
-
replace: olcTLSCACertificatePath
olcTLSCACertificatePath: /etc/ssl/cert

To add the ldif use:

sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f nameOfLdif.ldif

Comments

[Brad Mace]

Had to generate a certificate with alt-subject-names for both ldap servers and the meta-server name and distribute the certs to all the other linux servers to get linux logins working securely.

[Digital Human]

When I use what @Andrew Meyer suggested in my HA setup I get the following error: ldap_modify: Other (e.g., implementation specific) error (80)

[fei0x]

I get that too, in other places they say it may be permission issues on the cert files. they need to be readable by the openldap user.. often they add him to the ssl-cert group and make sure the group can read the files... but that hasn't worked for me yet.

[Andrew Meyer]

I saw some issues implementing this in an HA setup when using syncrepl. since the child nodes sync their config, it is locally read only. My work around was to manually edit the necessary files and regenerate the CRC checksums. I wouldn't recommend that in production though