Configuring OpenLDAP with SSL for Secure Directory Access on Ubuntu 22.04

Photo by Bernard Hermant on Unsplash

LDAP (Lightweight Directory Access Protocol) standardizes accessing and managing directory information services over a network. This step-by-step walkthrough guides users through the OpenLDAP installation and configuration process with SSL on Ubuntu 22.04. Securing LDAP communication using SSL (Secure Sockets Layer) is crucial to ensure data confidentiality and integrity, especially for systems handling sensitive information.

Installation Process

These steps ensure a secure and functional OpenLDAP installation on your Ubuntu system.

1. To install the OpenLDAP server and client command-line utilities execute the following command in the terminal:

sudo apt update 
sudo apt install slapd ldap-utils

Note: During installation, you will be prompted to enter an administrator password.

2. Check the status of the server:

sudo systemctl status slapd.service

Note: If the service is not running, start it with the following command.

sudo systemctl start slapd.service

3. Reconfigure the LDAP server:

sudo dpkg-reconfigure slapd

Note: Answer a series of questions according to your use case.

4. Allow the ldap (389) & ldaps (636) ports on the firewall:

sudo ufw allow 389 
sudo ufw allow 636
sudo ufw reload

Generation of Self-Signed Certificate

These steps will result in the creation of a self-signed certificate for your server. Ensure you securely manage and store the private key and certificate files for use in your SSL/TLS configuration.

1. Obtain a root shell (Optional)

If you are not already in a root shell, you can use the following command:

sudo -i

2. Navigate to or Create the Certificate Directory

cd /server-certs

or

mkdir /server-certs

3. Generate the private key using OpenSSL

openssl genrsa -aes128 -out server_key_name.key 2048

Note: You will be promoted to enter passphrase

4. Remove the Passphrase

openssl rsa -in server_key_name.key -out server_key_name.key 

5. Generate the Certificate

openssl req -new -days 3650 -key server_key_name.key -out server_cert_name.csr

6. Sign the Certificate using the Generated Key

openssl x509 -in server_cert_name.csr -out server_signed_cert_name.crt -req -signkey server_key_name.key -days 3650

Configure the Server to use this certificate

These steps help secure the OpenLDAP server using the generated self-signed certificate. Adjust paths and names as needed for your specific setup.

1. Copy the private key, signed certificate, and ca-certificate to the sasl2 folder

cp server_key.key /etc/ldap/sasl2
cp server_signed_cert.crt /etc/ldap/sasl2
cp /etc/ssl/ca-certificates.crt /etc/ldap/sasl2

2. Change the ownership of the sasl2 folder

chown -R openldap:openldap /etc/ldap/sasl2

3. Configure SSL on the server

a. Create LDIF file

touch SSL_LDAP.ldif

b. Add the following content to the file

cat << EOF > SSL_LDAP.ldif
# SSL Configuration for LDAP
dn: cn=config
changetype: modify

# Add the CA certificate file
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ldap/sasl2/ca-certificates.crt

# Replace the certificate file
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ldap/sasl2/server_signed_cert.crt

# Replace the private key file
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ldap/sasl2/server_key.key
EOF

c. Apply the changes

ldapmodify -Y EXTERNAL -H ldapi:/// -f SSL_LDAP.ldif

4. Enable ldaps by adding ldaps:/// in the slapd configuration file

nano /etc/default/slapd

Result: SLAPD_SERVICES=”ldap:/// ldapi:/// ldaps:///”

5. Edit client configuration file

a. Open the file

nano /etc/ldap/ldap.config

b. Comment out old configurations

#TLS_CACERT     /etc/ssl/certs/ca-certificates.crt

c. Add these lines

TLS_CACERT      /etc/ldap/sasl2/ca-certificates.crt
TLS_REQCERT     allow

6. Mapping a Domain to an IP Address: Updating /etc/hosts for Local Resolution (Optional)

cat << EOF > /etc/hosts
127.0.0.1  server.example.com
EOF

7. To ensure a secure connection with the server, use the ldapsearch tool to perform a verification.

ldapsearch -x -b dc=example,dc=com -H ldaps://server.example.com

Conclusion

In this tutorial, we’ve walked through the essential steps to configure OpenLDAP with SSL, enhancing the security of LDAP communication. Securing LDAP communication is paramount in maintaining the integrity and confidentiality of sensitive directory information.

Enabling SSL ensures that data transmitted between LDAP clients and the server is encrypted, mitigating the risk of unauthorized access and eavesdropping. By following these steps, you not only safeguard the privacy of your LDAP communications but also adhere to best practices in information security.

References

• OpenLDAP
• Configuring OpenLDAP with SSL/TLS Support