If we're just using our LDAP server as a very simple setup,
maybe it's a very basic testing,
then it might be okay to leave it on pure LDAP; however,
we wouldn't want to leave it in this way for too long, so
we're going to take a look at configuring TLS.
If we gain our administrative privileges, and we've already
created our certificate authority and the public key and
private key pair for our Ubuntu system,
so we can go through and copy the certificates
across into the etc/ldap directory.
We don't need to worry about security for those.
We could leave them where they are,
but it kind of makes sense organizing them around LDAP if
the LDAP server is going to use them.
We also need to copy across the private key.
We need to be a little bit more concerned about security here,
but we can see that it was in a private directory before.
We can put it just in our LDAP directory,
but to ensure security,
we can change the group ownership to the openldap group and set that
for our ubuntu.key and then making sure that it's readable and
writable by the user owner who will be root and readable then by the
group owner who is now openldap.
This way our security is maintained through the file system.
Now that then sets up our infrastructure as far as our PKI is concerned,
our public key infrastructure,
but we also need to then modify the LDAP server configuration.
So we can create our ldif file for that.
Remember everything is modified through these lightweight
directory interchange format files.
Within this we're modifying a single object and that's the cn=config,
and we're adding attributes.
So rather than having each entry being a clear separate line,
as there are multiple attributes being added to the one object,
they just have a dash between each attribute.
So we're adding the TLSCACertificateFile,
the TLSCertificateFile, and the CertificateKeyFile.
Make sure that they're pointing through to the correct
name and location for your files.
With the file saved we can then go through and use ldapmodify.
We don't need to specify the user account,
we are running as root, and we're using our external authentication,
going through to our ldapi interface and reading in the tls.ldif.
With that done we are ready to go.
We don't need to listen independently on port 636,
which is normally going to be our LDAPS port,
we can listen only on port 389, our LDAP port,
but enforce StartTLS.
So if I go through now running ldapwhoamI,
we can run with our anonymous account by not putting any account details,
but we're using ‑Z.
‑Z with a single Z is specifying to use StartTLS.
With two Zs we're enforcing the client, saying that we have to use TLS.
We're going through on our ldap port, but we will be raised to TLS,
so encrypted connections, and we have to use the correct hostname,
ubuntu, otherwise, we're going to get a hostname certificate mismatch.
So in this way we can see that we can set up a secure communication
channel for LDAP without needing a separate LDAPS port.
The only downside is having to remember to force TLS from our client,
but we'll see later how we can enforce it from a server perspective.
Now as always the best way to see this and to learn
this is to practice yourself,
so we're going to be moving out to our command line for our demonstration, and I encourage you to join me.