Adeegga Tusaha ee LDAP [4]: ​​OpenLDAP (I)

Saaxiibbo waad salaaman tihiin !. Aynu u dhaadhacno meheradda, oo sidii had iyo goorba aannu kugula talinno, akhri saddexdii maqaal ee hore ee taxanaha ahaa:

• Adeegga Tusaha ee LDAP. Hordhac.
• Adeegga Tusaha ee LDAP [2]: NTP iyo dnsmasq.
• Adeegga Tusaha ee LDAP [3]: Isc-DHCP-Server iyo Bind9.

DNS, DHCP iyo NTP ayaa ah adeegyada ugu yar ee lagama maarmaanka u ah diiwaankayaga fudud ee ku saleysan OpenLDAP hooyo, si sax ah uga shaqeeya Debian 6.0 "Isu ururi", ama Ubuntu 12.04 LTS «Precise Pangolin».

Tusaale network:

Lan: 10.10.10.0/24
Dominio: amigos.cu
Servidor: mildap.amigos.cu
Sistema Operativo Servidor: Debian 6 "Squeeze
Dirección IP del servidor: 10.10.10.15
Cliente 1: debian7.amigos.cu
Cliente 2: raring.amigos.cu
Cliente 3: suse13.amigos.cu
Cliente 4: seven.amigos.cu

Qaybta Koowaad waxaan ku arki doonaa:

• Furan OpenLDAP (dharbaaxada 2.4.23-7.3)
• Hubinta ka dib rakibidda
• Tusmooyinka tixgelinta
• Xeerarka Xakamaynta Helitaanka Xogta
• Jiilka Shahaadooyinka TLS ee Isku-uruujinta

halka Qaybta Labaad aan ku sii wadayno:

• Aqoonsiga isticmaalaha maxalliga ah
• Dadweynaha keydka u keyd
• Maamul keydka macluumaadka adoo isticmaalaya koronto-qabatada
• Soo koobid ilaa hadda ...

Furan OpenLDAP (dharbaaxada 2.4.23-7.3)

OpenLDAP server ayaa lagu rakibay iyadoo la isticmaalayo xirmada dharbaaxay. Waa inaan sidoo kale rakibnaa xirmada ldap-maacuunta, kaasoo ina siiya qaar ka mid ah agabka macaamiisha, iyo sidoo kale OpenLDAP yutiilitiyada u gaarka ah.

: ~ # aptitude rakibi slapd ldap-utils

Intii lagu gudajiray hawsha rakibida, qashin Waxay na weydiin doontaa lambarka sirta ee maamulka ama isticmaalaha «admin«. Tiro ka mid ah ku-tiirsanayaasha ayaa sidoo kale la rakibay; isticmaale ayaa la abuuray furanldap; qaabeynta adeegga bilowga ah ayaa la abuuray iyo sidoo kale tusaha LDAP.

Noocyadii hore ee OpenLDAP, qaabeynta daemon dharbaaxay waxaa lagu dhammeeyay galka feylka /etc/ldap/slapd.conf. Nooca aan isticmaaleyno iyo goor dambe, qaabeynta waxaa lagu sameeyaa isla isla dharbaaxay, iyo ujeedkan a dit «Geedka Macluumaadka Tusaha»Ama Geedka Macluumaadka Tusaha, si gooni gooni ah.

Habka qaabeynta ee loo yaqaan RTC «Qaabeynta waqtiga dhabta ah»Waqtiga dhabta ah qaabeynta, ama habka cn = isku xidhka, wuxuu noo ogolaanayaa inaan si firfircoon u qaabeyno dharbaaxay iyada oo aan loo baahnayn dib u bilaabid adeegga.

Kaydinta macluumaadka qaabeynta waxay ka kooban tahay faylal qoraal ah qaab ahaan LDIF «Qaabka Isdhaafsiga Xogta LDAP»Qaabka LDAP ee Xog isdhaafsiga, oo ku yaal galka /etc/ldap/slapd.d.

Si aad fikrad uga hesho ururka galka dharbaaxid.d, aan orodno:

: ~ # ls -lR /etc/ldap/slapd.d/
/etc/ldap/slapd.d/: wadar ahaan 8 drwxr-x --- 3 openldap openldap 4096 Feb 16 11:08 cn = config -rw ------- 1 openldap openldap 407 Feb 16 11:08 cn = config.ldif /etc/ldap/slapd.d/cn=config: wadar ahaan 28 -rw ------- 1 openldap openldap 383 Feb 16 11:08 cn = module {0} .ldif drwxr-x --- 2 openldap openldap 4096 Feb 16 11:08 cn = schema -rw ------- 1 openldap openldap 325 Feb 16 11:08 cn = schema.ldif -rw ------- 1 openldap openldap 343 Feb 16 11:08 olcBackend = {0} hdb.ldif -rw ------- 1 openldap openldap 472 Feb 16 11:08 olcDatabase = {0} config.ldif -rw ------- 1 openldap openldap 586 Feb 16 11:08 olcDatabase = {- 1} frontend.ldif -rw ------- 1 openldap openldap 1012 Feb 16 11:08 olcDatabase = {1} hdb.ldif /etc/ldap/slapd.d/cn = config / cn = schema: wadarta 40 -rw ------- 1 openldap openldap 15474 Feb 16 11:08 cn = {0} core.ldif -rw ------- 1 openldap openldap 11308 Feb 16 11:08 cn = {1} cosine.ldif -rw ------- 1 openldap openldap 6438 Feb 16 11:08 cn = {2} nis.ldif -rw ------- 1 openldap openldap 2802 Feb 16 11:08 cn = {3} inetorgperson.ldif

Haddii aan yara eegno wax soo saarkii hore, waxaan aragnaa in Backend loo isticmaalay Iskujuujinta waa nooca keydka macluumaadka hdb, taas oo ah nooc ka mid ah bdb "Berkeley Database", iyo inay si buuxda u kala sarrayso oo ay taageerayso in loo beddelo geedo-hoosaadyo. Si aad wax badan uga barato waxa suurtogalka ah Dib u celin kaas oo taageera OpenLDAP, booqo http://es.wikipedia.org/wiki/OpenLDAP.

Waxaan sidoo kale aragnaa in saddex keyd oo kala duwan loo adeegsaday, taas oo ah, mid u heellan qaabeynta, mid kalena loo frontend, iyo kan ugu dambeeya oo ah keydka macluumaadka hdb per se.

Dhinaca kale, dharbaaxay waxaa lagu rakibay si toos ah qalabka Core, Dawo, Nis e Qofka ka shaqeeya.

Hubinta ka dib rakibidda

Terminal-ka waxaan si deggan ugu fulinaa oo u aqrinnaa wax soo saarka. Waan hubin doonaa, gaar ahaan amarka labaad, qaabeynta laga soo saaray liistada galka dharbaaxid.d.

: ~ # ldapsearch -Q -LLL -Y EXTERNAL -H ldapi: /// -b cn = config | inbadan: ~ # ldapsearch -Q -LLL -Y EXTERNAL -H ldapi: /// -b cn = config dn
dn: cn = config dn: cn = module {0}, cn = config dn: cn = schema, cn = config dn: cn = {0} core, cn = schema, cn = config dn: cn = {1} cosine , cn = schema, cn = config dn: cn = {2} nis, cn = schema, cn = config dn: cn = {3} inetorgperson, cn = schema, cn = config dn: olcBackend = {0} hdb, cn = config dn: olcDatabase = {- 1} hore, cn = config dn: olcDatabase = {0} config, cn = config dn: olcDatabase = {1} hdb, cn = config

Sharaxa wax soo saar kasta:

• cn = isku xidhka: Xuduudaha adduunka.
• cn = moduleka {0}, cn = qaabeynta: Module si xamaasad leh u raran.
• cn = schema, cn = isku xidhka: Waxay ka kooban tahay adag-koodh heerka nidaamyada nidaamka.
• cn = {0} xudun, cn = schema, cn = isku xidhka: adag-koodh oo ka mid ah kernel schematic.
• cn = {1} cosine, cn = schema, cn = isku xidhka: Qorshaha Kooshin.
• cn = {2} nis, cn = schema, cn = isku xidhka: Qorshaha Nis
• cn = {3} inetorgperson, cn = schema, cn = config: Qorshaha Qofka ka shaqeeya.
• olcBackend = {0} hdb, cn = isku xidhka: Backend nooca keydinta xogta hdb.
• olcDatabase = {- 1} frontend, cn = config: frontend ee keydka macluumaadka iyo cabbiraadaha asalka u ah keydadka kale.
• olcDatabase = {0} config, cn = config: Kaydinta xogta qaabeynta ee dharbaaxay (cn = isku xidhka).
• olcDatabase = {1} hdb, cn = config: Tusaalahayaga keydka macluumaadka (dc = saaxiibo, dc = cu)

: ~ # ldapsearch -x -LLL -H ldap: /// -b dc = tusaale, dc = com dn
dn: dc = saaxiibo, dc = cu dn: cn = admin, dc = saaxiibo, dc = cu

• dc = saaxiibo, dc = cu: Geedka Macluumaadka Tusaha DIT Base
• cn = admin, dc = saaxiibo, dc = cu: Maamulaha (rootDN) ee DIT ayaa lagu dhawaaqay inta lagu jiro rakibidda.

Nota: Horgalaha dherer dc = saaxiibo, dc = cu, ayaa qaatay qashin inta lagu guda jiro rakibaadda ka FQDN server mildap.amigos.cu.

Tusmooyinka tixgelinta

Tixgelinta galka waxaa loo sameeyay si loo hagaajiyo waxqabadka raadinta dit, oo leh shuruudaha miiraha. Tusayaasha aan tixgelin doonno waa kuwa ugu yar ee lagula taliyay iyadoo loo eegayo astaamaha lagu caddeeyay qorshayaasha caadiga ah

Si firfircoon wax looga beddelo tusmooyinka keydka macluumaadka, waxaan u abuureynaa faylka qoraalka qaab ahaan LDIF, hadhowna waxaan ku darnaa diiwaanka. Waxaan abuuraynaa faylka olcDbIndex.ldif oo waxaan uga tagnay waxyaabaha soo socda:

: ~ # nano olcDbIndex.ldif
dn: olcDatabase = {1} hdb, cn = config changetype: wax ka beddel ku dar: olcDbIndex olcDbIndex: uidNumber eq - add: olcDbIndex olcDbIndex: gidNumber eq - add: olcDbIndex olcDbIndex: memberUid ec, ecDd : loginShell eq, olcDbIndex: login - add: olcDbIndex olcDbIndex: uid pres, sub, eq - add: olcDbIndex olcDbIndex: cn pres, sub, eq - add: olcDbIndex olcDbIndex: sn pres, sub, eq - , ou pres, eq, sub - add: olcDbIndex olcDbIndex: displayName pres, sub, eq - add: olcDbIndex olcDbIndex: default sub - add: olcDbIndex olcDbIndex: mail eq, subinitial - add: olcDbIndex olcDbex:

Waxaan ku darnaa tusmooyinka keydka macluumaadka waxaanna hubineynaa wax ka beddelka:

: ~ # ldapmodify -Y EXTERNAL -H ldapi: /// -f ./olcDbIndex.ldif

: ~ # ldapsearch -Q -LLL -Y EXTERNAL -H ldapi: /// -b \ cn = config '(olcDatabase = {1} hdb)' olcDbIndex

dn: olcDatabase = {1} hdb, cn = config olcDbIndex: objectClass eq olcDbIndex: uidNumber, gidNumber eq olcDbIndex: memberUid eq, pres, sub olcDbIndex: loginShell eq olcDbIndex: subg, eq pres, eid pres, olcDbIndex: sn pres, sub, eq olcDbIndex: givenName, ou pres, eq, sub olcDbIndex: displayName pres, sub, eq olcDbIndex: default sub olcDbIndex: mail eq, subinitial olcDbIndex: dc eq

Xeerarka Xakamaynta Helitaanka Xogta

Shuruucda loo dejiyay si ay isticmaaleyaashu u akhriyi karaan, wax uga beddeli karaan, u dari karaan una tirtiri karaan xogta ku jirta diiwaanka Diiwaanka waxaa loo yaqaan 'Access Control', halka aan u wici doonno Liisaska Xakamaynta Helitaanka ama «Liiska Xakamaynta Helitaanka ACL»Ku aaddan siyaasadaha dejinaya xeerarka.

In la ogaado taas ACL-yada waxaa lagu dhawaaqay si iska caadi ah intii lagu jiray hawsha rakibida ee dharbaaxay, waxaan fulin:

: ~ # ldapsearch -Q -LLL -Y EXTERNAL -H ldapi: /// -b \
cn = config '(olcDatabase = {1} hdb)' olcAccess

: ~ # ldapsearch -Q -LLL -Y EXTERNAL -H ldapi: /// -b \
cn = config '(olcDatabase = {- 1} hore)' olcAccess

: ~ # ldapsearch -Q -LLL -Y EXTERNAL -H ldapi: /// -b \
cn = config '(olcDatabase = {0} config)' olcAccess

: ~ # ldapsearch -Q -LLL -Y EXTERNAL -H ldapi: /// -b \
cn = config '(olcAccess = *)' olcAccess olcSuffix

Mid kasta oo ka mid ah amarrada kor ku xusan ayaa na tusi doona ACL-yada in ilaa hada aan ku cadeynay Diiwaankeena. Gaar ahaan, amarka ugu dambeeya wuxuu muujinayaa dhammaantood, halka saddexda hore ay na siinayaan xeerarka xakamaynta marin u helka dhammaan saddexda. dit ku lug leh dharbaaxay.

Mawduuca ah ACL-yada iyo si aanan u sameyn maqaal aad u dheer, waxaan kugula talineynaa inaad aqriso boggaga gacanta nin dharbaaxay.

Si loo damaanad qaado marin u helka isticmaalayaasha iyo maamulayaasha si loo cusbooneysiiyo gelintooda loginShell y Geckos, waxaan ku dari doonaa ACL soo socda:

## Waxaan abuureynaa faylka olcAccess.ldif oo waxaan uga tagnay waxyaabaha soo socda: ~ # nano olcAccess.ldif
dn: olcDatabase = {1} hdb, cn = config changetype: modify add: olcAccess olcAccess: {1} to attrs = loginShell, gecos by dn = "cn = admin, dc = saaxiibo, dc = cu" ku qor is qor * aqri

## Waxaan ku darnaa ACL
: ~ # ldapmodify -Y EXTERNAL -H ldapi: /// -f ./olcAccess.ldif

# Waan hubinnaa isbeddelada
ldapsearch -Q -LLL -Y QARAN -H ldapi: /// -b \
cn = config '(olcAccess = *)' olcAccess olcSuffix

Jiilka Shahaadooyinka TLS ku cadaadi

Si loo helo xaqiijin sugan oo leh serverka OpenLDAP, waa inaan ku sameynaa kal-fadhi qarsoodi ah oo aan ku guuleysan karno adoo adeegsanaya TLS «Amniga Lakabka Gaadiidka» o Hayso Lakabka Gaadiidka.

OpenLDAP serverka iyo macaamiishiisu way awoodaan inay isticmaalaan qaabeynta TLS si ay u bixiso ilaalin la xiriirta daacadnimada iyo sirta, iyo sidoo kale inay taageerto xaqiijinta LDAP ee sugnaanta iyadoo la adeegsanayo habka SASL «Xaqiijinta fudud iyo Lakabka Amniga« Dibedda

Adeegyada casriga ah ee OpenLDAP ayaa doorbidaya adeegsiga */ StartTLS /* o Ku bilaw lakab gaadiid sugan oo ahXULASHADA: ///, taas oo duugowday. Su'aalo kasta, booqo * Start TLS v. ldaps: // * en http://www.openldap.org/faq/data/cache/605.html

Kaliya ka tag feylka sida loogu rakibay asal ahaan / iwm / default / slapd leh bayaanka SLAPD_SERVICES = »ldap: /// ldapi: ///», iyada oo ujeedadu tahay in la adeegsado kanaal sir ah oo u dhexeeya macmiilka iyo serverka, iyo codsiyada kaabayaasha ah laftooda si ay u maareeyaan OpenLDAP ee gudaha lagu rakibay.

Habka halkan lagu sharaxay, oo ku saleysan xirmooyinka gnutls-bin y ssl-cert waxay ku habboon tahay Debian 6 "Cadaadi" iyo sidoo kale Ubuntu Server 12.04. Wixii Debian 7 "Wheezy" hab kale oo ku saleysan OpenSSL.

Jiilka shahaadooyinka ee 'Squeeze' waxaa loo fuliyaa sida soo socota:

1.- Waxaan rakibnaa xirmooyinka lagama maarmaanka ah
: ~ # aptitude rakibi gnutls-bin ssl-cert

2. - Waxaan u abuureynaa Furaha Aasaasiga ah ee Maamulka Shahaadada
: ~ # sh -c "certtool --generate-privkey> /etc/ssl/private/cakey.pem"

3. - Waxaan abuurnay shax si loo qeexo CA (Maamulka Shahaadada)
: ~ # nano /etc/ssl/ca.info cn = Saaxiibada Cuban ca cert_signing_key

4.- Waxaan u abuureynaa Shahaadada is-saxeexsan ee CA ama Is-Saxeexa macaamiisha
: ~ # certtool --generate-self-saxiixay \ -load-privkey /etc/ssl/private/cakey.pem \ --template /etc/ssl/ca.info \ --outfile / etc / ssl / certs / cacert.pem

5.- Waxaan u soo saaraynaa Fure Gaar ah oo loogu talagalay Server-ka
: ~ # certtool --generate-privkey \ -bits 1024 \ --outfile /etc/ssl/private/mildap-key.pem

Nota: Beddel "khafiif ah"Magaca feylka kor ku xusan adoo adeegsanaya adeegahaaga. Magacaabista Shahaadada iyo Furaha, labadaba adeegaha iyo adeegga adeegsanaya, waxay naga caawineysaa inaan wax iska caddayno.

6. - Waxaan u abuureynaa feylka /etc/ssl/mildap.info oo leh waxyaabaha soo socda:
: ~ # nano /etc/ssl/mildap.info organization = Saaxiibada Cuba cn = mildap.amigos.cu tls_www_server encryption_key saxiixa_key dhicitaanka_days = 3650

Nota: Mawduuca kor ku xusan waxaan caddeyneynaa in shahaadadu shaqeyneyso muddo 10 sano ah. Halbeegga waa in lagu hagaajiyaa sida ugu habboon.

7.- Waxaan abuuraynaa Shahaadada Server
: ~ # certtool --generate-shahaadada \ -load-privkey /etc/ssl/private/mildap-key.pem \ --load-ca-certificate /etc/ssl/certs/cacert.pem \ --load- ca-privkey /etc/ssl/private/cakey.pem \ --template /etc/ssl/mildap.info \ --outfile /etc/ssl/certs/mildap-cert.pem

Ilaa iyo hada waxaan soo saarnay feylasha lama huraanka ah, kaliya waa inaan ku darno Tusaha goobta uu ku yaalo Shahaadada Is-Saxeexa cacert.pem; tii Shahaadada Server-ka mildap-cert.pem; iyo Furaha Gaarka ah ee Server-ka mildap-key.pem. Waa inaan sidoo kale hagaajino rukhsadaha iyo milkiilaha faylasha la soo saaray.

: ~ # nano /etc/ssl/certinfo.ldif
dn: cn = config add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/certs/mildap-cert.pem - add: milcT -key.pem

8.- Kudar: ~ # ldapmodify -Y DAMBE -H ldapi: /// -f /etc/ssl/certinfo.ldif

9.- Waxaan hagaajinaa milkiilaha iyo rukhsadaha
: ~ # adduser openldap ssl-cert: ~ # chgrp ssl-cert /etc/ssl/private/mildap-key.pem: ~ # chmod g + r /etc/ssl/private/mildap-key.pem: ~ # chmod ama /etc/ssl/private/mildap-key.pem

Shahaadada cacert.pem Waa midda ay tahay inaan nuqul ka qaadno macmiil kasta. Si shahaadadan loogu isticmaalo server-ka laftiisa, waa inaan ku sheegno faylka /etc/ldap/ldap.conf. Si tan loo sameeyo, waxaan wax ka beddeleynaa feylka oo waxaan uga tagnaa waxyaabaha soo socda:

: ~ # nano /etc/ldap/ldap.conf
BASE dc = saaxiibo, dc = cu URI ldap: //mildap.amigos.cu TLS_CACERT /etc/ssl/certs/cacert.pem

Ugu dambeyntii iyo sidoo kale jeeg ahaan, waxaan dib u bilaabi doonnaa adeegga dharbaaxay waxaanan hubinaa wax soo saarka syslog ka imaado serverka, si aad u ogaato in adeega si sax ah dib loogu bilaabay iyadoo la isticmaalayo shahaada cusub ee lagu dhawaaqay.

: ~ # adeegga slapd dib u bilaw
: ~ # dabada / var / log / syslog

Haddii adeeggu uusan dib u bilaabin si sax ah ama aan u aragno qalad culus oo ku jira syslog, yaanan niyad jabin. Waxaan isku dayi karnaa inaan hagaajino dhaawaca ama dib u bilowno. Haddii aan go'aansanno inaan ka bilowno xoqida rakibidda ah dharbaaxay, looma baahna in la qaabeeyo adeegeena.

Si aan u tirtirno wax kasta oo aan illaa iyo hadda qabanay hal sabab ama mid kale, waa inaan ka saarnaa xirmada dharbaaxay, ka dibna tirtir faylka / var / lib / ldap. Sidoo kale waa inaan uga tagnaa feylka nooca asalka ah /etc/ldap/ldap.conf.

Waa dhif iyo naadir in wax waliba si sax ah ugu shaqeeyaan isku dayga koowaad. 🙂

Xusuusnow in qeybta soo socota aan arki doono:

• Aqoonsiga isticmaalaha maxalliga ah
• Dadweynaha keydka u keyd
• Maamul keydka macluumaadka adoo isticmaalaya koronto-qabatada
• Soo koobid ilaa hadda ...

Dhowaan waan idin arki doonaa saaxiibo !.