Hey everyone and welcome back. So in the previous nugget we had talked about LDAP at a high
level overview. Now what we want to do is to dig in and actually begin using some basic
configurations that we have to be aware of for the purposes of the examination.
Now the main daemon that LDAP is going to use here is something called slapd which I always
thought was a really strange name for a daemon but the reality is it stands for the standalone
LDAP daemon. So check this out we want to actually install this so what I will say is
sudo apt install slapd and I'll type in my password I'll say yes hit enter. Now it's going to ask me
for the password for the admin of the LDAP directory so I'm just going to have a password of
let's just maybe say hello okay and I'll confirm it by saying hello and the installation should
continue now. So the next thing I'm going to install is something called LDAP utils so sudo apt install
LDAP hyphen utils hit enter. Okay perfect now remember we talked about how we would have
some type of domain name like ipv0 right now I actually want to configure such a thing so I will
say sudo dpkg reconfigure and I want to reconfigure slapd so if I hit enter it's going to ask me
do I want to omit the LDAP server configuration I will say no so I will say the domain name is
ipv0.com the organization can be ipv0 the admin password I will just say hello and I'll confirm
as hello I'll just choose the mdb back end and I want the database to be removed I will just say
no and move the old database I will just say yes perfect so let me just clear my screen.
Now straight away we're going to have some very basic configurations within our LDAP directory
the way we can read those configurations is we can use a particular command this is a command
called slapcat think about it like using the regular cat command we can read a file but we're
going to read the slapd information okay so slapcat hit enter we can see here since I've
changed my name notice the dc is ipv0.com remember just like we talked about we've got our comdc at
the top and then within ipv0 which was derived from the domain name ipv0.com remember we split that up
put this to the top take this one here put it within notice we also have an additional entry below
here okay so we can see the dn here this is the distinguished name so the distinguished name
will uniquely identify this object and this is going to be the admin of ipv0.com now this cn here
this is the common name again this is more of the alphabet soup that you encounter when dealing with
LDAP dns or use cns sns all this stuff but don't get too worried about that just now the cn here
is just an attribute of this particular object which in this case here just identifies the name
of the admin just simply in this case admin now you're going to see that we have according to the
schema all of these different types of object classes i.e. what type of object is this we can see here
this is an organizational role being that this is the administrator of our LDAP server now when we
actually want to modify the entries within our LDAP server which we see here from the slapcat
command we want to be sending this information in this type of structure now this type of structure
can be quite intimidating because there is a lot of information and the reality is for the purposes
of the examination you don't have to have all of this memorized not even close we just want to
understand the very basics of how this is laid out and the general rules that play here so all of
this stuff here is conforming to the schema we talked about now if we happen to go and go into our
ecidirectory and i go into LDAP if i do an ls we can see here we have this directory called schema
if i go in here and do an ls we can see all of these different files we can say schema files which
will tell us the schema and we can also see the ldif files now the LDAP files these are the LDAP
data interchange format files basically these are the files which happen to be structured in the
correct way with the right values according to the particular schema set out as defined and these
files are what we can use to create a new object within the LDAP database so let's have a look at
say for example core dot schema if i say sudol vim core dot schema and hit enter if you happen to
scroll down throughout this file you're going to see a ton of information so what i will do is i will
forward slash within vim so i can do some searching and i will search for organization now we can see
this part right here i'm going to stop this so look at this right here this is the schema defined
for this particular object class called organization now we see this keyword here saying must this means
that we must supply this attribute when creating an organization in an ldap file so we see the must
is o so we would have to say o equals and then in this case here the name of the organization we
want to be creating notice below we have this option called may this would be an optional
attribute so we could also add in things like the post office box the postal code the telephone
number all of this additional information we want to supply when creating an organization within the
LDAP directory but again this is all optional the only thing we must supply is this o value
denoting the actual organization and if we scroll on down a little bit we can see another one called
organizational unit so this is an o you notice here when we create an organizational unit we must
provide the attribute o you however we can also if we so wish add in all of these additional values
very very similar to what we saw before and again if we move on down to the person class we can see
must we've got to provide the sn and the cn the sn is the surname of the person so that could be
my govern in my case and the cn would be my common name which is john so if you want to create a person
you would have to provide these values in order to work but again we do have the option within the
payload to add in a user password or a telephone number or a description if we so choose now again
there are tons of these object classes LDAP can be very very complex we don't have to worry about
all of that just now just understand that we're looking at the schema and what we want to do is
to take this type of information that we can see here and build a little template say for example
if we wanted to add an organizational unit we would know the type of things that we could supply
and the type of things we must supply within our LDAP file that we will send to the server okay now
one thing i just want to point out is that historically all of this information would be
called in using include statements in a file within the etsy directory called slapd.conf
that is how these schemas are ultimately read in now in more modern implementations you tend to
find that we're not going to have just one file instead we're going to have within our etsy LDAP
directory we will have a slapd.d directory and within this directory like we see so often with
linux we have multiple files which ultimately call in this type of information that we're seeing right
here so just be aware of that difference but for now what i will do is we'll just escape out if i go
back and i do an ls if i go into my root user account and i go into the slapd directory we can
see we have cnconfig if we go into cnconfig and do an ls this is the more modern way in which your
LDAP configurations are going to be managed via all of the information within here so we're not
just using that global and singular slapd.conf configuration file anymore now what i want to
show you is if i just go back a few directories and i'll change back to ipv0 clear the screen
what i want to do is i want to start my slapd service also sudo service slapd start this is
going to start the server and if i arrow up and do status to check the status as we can see this
is active and running so let's try to add to the LDAP database then so what i'll do is i will create
a little file and i'll just call that whatever i so wish let's just say my LDAP.LDAP okay so i'll
just say the dn which will be the distinguished name and what i will do is i will create an
organization just called let's maybe say myorg so dn equals and i will specify that the o is equal to
myorg comma and then the dc can you remember what this is it's going to be ipv0 and then a comma and
then the outer container will be com and again all i'm doing here is following the schema that i saw
within those schema files and using it as a template so now what i'll say is the object class
this is going to be an organization remember we can add a description as an optional attribute
i'll just say this is a test org and one thing that we must add if you recall by looking at the
schema for an organization is you must have this o value now the o value is just going to be quite
simply myorg okay so if i save this file and i escape i can now cut it here we have here
this is going to be the little file which i can use to send these new configurations over to my
LDAP server okay so now what i want to do is i want to add something to the LDAP directory so the
command i can use here is LDAP add and i'm going to say dash x and in fact before i do that let me
just quickly refresh and show you the slapcat output that is all we have right now one thing i
want you to note is that within the next command i'm going to have to show i'm going to have to
specify the distinguished name of the LDAP administrator so that we can actually authenticate
this request and here is the distinguished name right here for that administrator so i'm going to
say sudo LDAP add and i'm going to say dash x this is for simple authentication and then i'm going to
do dash d for the distinguished name and the distinguished name for the administrator as we
can see here is cn equals admin dc equals ipv0 and dc equals com now what i want to do is to say dash
capital w which means that when i send off this request i'm going to have to or rather i'm going
to be prompted for my password which i'll then have to enter next i will say dash f to specify the
file that i want to send for this configuration which in my case is called my ldap.ldap so if i
happen to hit enter i'll actually have to spell my command correctly i don't know why i misspelled
that that should be 2d's of course silly me try a game i have to enter the ldap password i believe
that was hello i had for the administrator account and it appears i have an invalid format let me just
check my ldap file i'll say sudo nano my ldap and i can see it straight away here i've got dn equals
that should be a colon silly me apologies about that let's save this with the changes and i'll try
the command again i will say hello and hit enter and as we can see here we're adding a new entry to
the ldap directory so if i now say sudo slapcat notice here at the very bottom we actually have
a new entry here now if i wanted to delete this entry what i could say is sudo ldap delete that
would be the command here and what i want to do here is to specify the distinguished name of the
object i want to delete now let me just delete this one which i just created so this is the dn here
which will uniquely identify this object so i'll paste this in and then i will say dash x for
simple authentication and once again dash d and the same information for my authentication for
the admin admin ipv0 and do dash w to prompt me for my password enter the ldap password i'll say
hello hit enter and now if i say sudo slapcat suddenly that entry has been deleted so for
the different objects that we want to create or delete or modify we just keep following the type
of schema that we saw within those files so what i could do is arrow up and i will re-add the my
orc so it's now back in now one thing to note here is that i am adding and deleting files on my own
server now i could be on a completely different machine sending queries remotely to my ldap server
just by specifying the server domain name or the server ip address within the command so what i
could actually do here is i could see my ip address 192.1680.44 and within my ldap delete command
i could actually say dash h and then give the ip address of the server if i just type in my ip
address right here and hit enter type in my ldap password of hello notice if i do my sudo slapcat
we should have successfully deleted the my orc entry which we have so notice that we don't have
to be working on the server itself we can send the commands remotely to the server so long as we
can actually authenticate with the server improve we are say for example the administrator here who
has the rights to do something like an ldap delete of the ldap directory now one thing we want to know
is again if i happen to let me just add this org back in again say hello we do know we have the sudo
slapcat command which is going to show us all the information within the directory if we want to be a
little bit more targeted if the directory happens to be very large we can actually say sudo ldap
search do dash x and then we can do dash b and then specify the search term we want to look for
so i could actually be pretty generic and just say give me everything within dc ipv0 dc com
and hit enter and we will get all the information within ipv0.com but again by providing the full
distinguished name for a particular object we could drill in say for example i could say o
equals my orc and comma here this will be more specific yet again if i hit enter notice here
from the outputs of this command the output is much less it's just relating to this particular
object right here so we have a whole bunch of commands that we can use with respect to ldap
we can have commands to search ldap, deletes objects to add objects even modify objects and
we can also change and set particular passwords using the ldap password command so let me quickly
show you what i will do is i will create one more file i will say my user dot ldap in fact i should
say sudo nano and i'm just going to follow the schema for this particular object i will say the
uid is equal to john mcg and the organization john mcg will be in will be my orc that will be in
the dc of ipv0 and com i will say object class is inet's orc person the cn this is going to be
john which is the common name the surname is going to be my govern the uid will just be john mcg
okay so let me save this i'll escape out i'll use my ldap add command this time i'll point it to the
my user ldap file hit enter i will say hello and we can see here we're adding a new entry to our
directory so i can say again sudo slackat at the very bottom we have this object right here notice
we actually don't have a password for this particular user i could control this by using the
command i just said ldap pass wd do dash x for simple authentication and again cn is going to be the
admin of ipv0.com i'm going to say dash capital s so that the system prompts me to type in a new
password that is the password for the account here that i'm going to be changing the password for
and i also want to say dash w to prompt me for the admin password of the ldap server so that we
can authenticate this request of a change and now what i will do is provide the distinguished name
of the object i want to target so uid is equal john mcg o is equal to my orc dc is equal to ipv0
and dc equal to com so if i hit enter it's going to ask me for the new password this is the new
password for the john mcg account so i'll just have the password as john one and i'll type it in the
game john one and now i have to enter the admin ldap password to authorize this request so that's
going to be hello and to enter and now if i do my sudo slackat once again notice here with this
object we now have a user password which has been held in cryptographically hashed form again notice
we can actually control this by using the ldap password command which we see right here so there
really is a lot of moving parts within ldap it can be very confusing with so much of this lettering
dns cns sns uids or use but honestly we do not have to drown in all the available knowledge
within ldap there just are some core components that we want to understand which we have outlined
within this skill understand we have particular commands such as ldap password ldap delete
ldap add if we want to add files we will use our ldap configuration file and that is going to have
to conform to a particular schema set out for a particular object with some attributes being
mandatory that we must specify and some attributes which are optional which we may specify okay so
that is us for the basics of ldap configuration i hope this has been informative for you and i'd
like to thank you for viewing