Openldap server and client configration in rhel6 with tls

lets see the openldap server setup configuration on rhel 6

In my setup
my server name is:- node5.example.com
ipaddress is :- 192.168.0.100/24
domain name is:- example.com
openldap-server version is:- openldap-servers-2.4.23-20
my server os is:- RedHat Enterprise Linux 6.2

Step 1: first we need to install the required packages:

#yum install openldap-servers openldap-clients

here the openldap-server for configure the ldapserver and openldap-clients for configure the client..

Step2: As the configuration for LDAP is stored inside the LDAP server itself the configuration is in this /etc/openldap/slapd.d/ directory.

First of all we need set the password for administrator(we called it Manager) by using this command.

#slappasswd
password: mypasswd

retype-password: mypasswd

you’ll get something like this ”{SSHA}r2or9f2vYlvieCu0LP6wTnSdYfrddsuV” as a result. This is the string we will have to add into config file. So we need to copy it.

Now time to open configuration file..

# vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif

here we need to change domain name..

substitute “my-domain.com” with “example.com”
replace the domain by using “sed” other wise we can replace the domain in file manualy.

We can use this command to chabge this

:%s/dc=my-domain,dc=com/dc=example,dc=com/g

We now set the administrator(Manager) password..

and if you want make that encrypt then we need to add those line's over there

add these 3 lines at the end of the file “bdb.ldif” file:

olcRootPW: {SSHA}r2or9f2vYlvieCu0LP6wTnSdYfrddsuV
olcTLSCertificateFile: /etc/pki/tls/certs/example.pem
olcTLSCertificateKeyFile: /etc/pki/tls/certs/examplekey.pem

Step 4: Now we have to specify the monitoring privileges
if you want to monitoring then we need to specify those lines in this file..

#vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}monitor.ldif

again, we have to replace the default domain name with our domain name

now can replace the default domain name manualy or by using “sed”

:%s/cn=manager,dc=my-domain,dc=com/cn=Manager,dc=example,dc=com/g

Step 5: Now its time for the Database Cache

#updatedb

othere wise automatic calculation of cache we need to copy that file in this location

#cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

now set the permission for ldap user also.

#chown -Rf ldap:ldap /var/lib/ldap/

Step 6: Now we will need to set up a certificate for TLS. First we need to edit /etc/sysconfig/ldap and change SLAPD_LDAPS= options in this manner

#vim /etc/sysconfig/ldap
SLAPD_LDAPS=yes -----(default is no)

Now we need to create certificate.

There is lots of options for gen rate the certificate we can use any method.

I am going with this command.

#openssl req -new -x509 -nodes -out /etc/pki/tls/certs/example.pem -keyout /etc/pki/tls/certs/examplekey.pem -days 365

fill the required information of command

This will create the two required keys in the /etc/pki/tls/certs/ directory. We need to make them readable for the ldap user.

# chown -Rf root:ldap /etc/pki/tls/certs/example.pem
# chmod -Rf root:ldap /etc/pki/tls/certs/examplekey.pem
check the read permission for ldap user........

Step 7: Time to test our configuration

Now time to check the ldap configuration

# slaptest -u

“config file testing succeeded” answer should we come..

Step 8: Start the ldap server

#service sladp start

lets check if our ldap server really works:

#ldapsearch -x -b ”dc=example,dc=com”

if you get a search: 2 then your on track!

Step 9: Configure the base domain
you can create this file manualy other wise download from this link

http://www.4shared.com/file/TtQTedYv/base.html

#vim /root/base.ldif

dn: dc=example,dc=com

dc: example

objectClass: top

objectClass: domain