So yes, we're now going to go through and take a look at our demonstration,
and don't you just take a look, follow through as well!
That way you can be certain of learning.
So we're going to configure our secure LDAP connections
by making sure we add the PKI files into locations
accessible to our OpenLDAP server.
We can modify our LDAP configuration,
allowing it to point through to our PKI files.
And then we can use StartTLS from the command line.
So come on, let's go through and do this.
Now we're going to need a little bit of root privilege
here so it's easier just to go through and raise our
privileges so we get a root shell.
We can then go through and copy from /etc/ssl.
Moving into that directory, we've got the cert subdirectory.
This is publicly accessible.
Inside of this directory, we can look for a couple of files.
We've got the myca file and the ubuntu file.
These are the certificates issued to the CA and to the Ubuntu host.
They both have the extension .crt,
so we can then glob them together using our brace brackets.
We want to copy those across to the /etc/ldap directory.
Now, those files are publicly accessible,
so we could leave them in the search directory if you want,
but it kind of makes sense putting everything that the OpenLDAP
server needs inside of the ldap directory.
The other file, though, isn't publicly accessible,
so we need to make sure that we keep it secure when
we put it into the ldap file.
So this is then going to take a look in the /etc/ssl.
And then from here,
we can go into the private subdirectory and pull out the ubuntu.key.
Again, we want to copy across into our ldap directory,
but now we want to go through and change the group ownership,
and we want to change it to the openldap group for our /etc/ldap directory,
and then of course, the ubuntu.key file.
Having done that, we can run our chmod ‑v so we can see our permissions changing,
and the permissions that we're going to set are 640,
so it's read and writable by the user and readable by the group openldap.
We can go through and use Escape and dot to bring up our last argument,
and we can see there that we change then from 600 to 640,
but we've got the correct group ownership,
so we're not breaking down our security too much.
Now having put the files into the correct location,
we can go through and modify our configuration.
So let's go through and look at that tls.ldif file.
Let's create a new .ldif file.
And inside of this, I'm going to paste in information that we want.
It's the same as we saw within the slide.
We're modifying our cn=config and adding three attributes.
With this then written, we can go through and save.
And then, of course, we've got to run our ldapmodify command.
Now I'm already then set as the root user, so this is going to work well for me.
We can go through and say quiet my output using external authentication,
and then we can go through and specify our host,
and this time it's going to be our socket,
so ldapi,
and moving forward through to our localhost and
reading in then that file tls.ldif.
So that's good.
We've modified our configuration, so everything should be in place.
We can now go through and run our ldapwhoami.
We can specify our simple authentication.
I don't need to specify a username, so we can be anonymous.
That will work for us.
The ‑ZZ was going to enforce STARTTLS, but if I just do a single ‑Z,
we request STARTTLS, but we're going to have to use a different hostname.
So ‑H, and then ldap, and we can specify to go through to the hostname of Ubuntu.
Remember,
the name that we use to access it must match the
name being used in the certificate.
So again, this is then giving us no problems,
but look what happens if I go through and don't specify the hostname.
Then we can see that we're getting a connection
error because we're enforcing TLS,
but then our certificate doesn't match to the
hostname that we're using to access it.
Now, having set up our LDAP server, and now we've got secure access,
we can go through and take a look at how we can authenticate through to the LDAP directory.