Bailamos: Samba-4

Samba 4 - Linux Integration

Moved to a permanent page

See you over there.

LDAP server certificates

openSUSE 12.1 YaST LDAP Server dialogue

These are the settings to be used when creating your own self signed certificates as follows.

First we need to generate the CA:

root#  mkdir myCA

Move into that directory:

root#  cd myCA

Now generate the CA:

root#  /usr/share/ssl/misc/CA.pl -newca

CA certificate filename (or enter to create)

  

Making CA certificate ...

Generating a 1024 bit RSA private key

.......................++++++

.............................++++++

writing new private key to './demoCA/private/cakey.pem'

Enter PEM pass phrase:

Verifying - Enter PEM pass phrase:

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]:AU

State or Province Name (full name) [Some-State]:NSW

Locality Name (eg, city) []:Sydney

Organization Name (eg, company) [Internet Widgits Pty Ltd]:Abmas

Organizational Unit Name (eg, section) []:IT

Common Name (eg, YOUR name) []:ldap.abmas.biz

Email Address []:support@abmas.biz

There are some things to note here.

You MUST remember the password, as we will need it to sign the server certificate..

The Common Name (CN), MUST be the fully qualified domain name (FQDN) of your ldap server.

Generating the Server Certificate

Now we need to generate the server certificate:

root#  openssl req -new -nodes -keyout newreq.pem -out newreq.pem

Generating a 1024 bit RSA private key

.............++++++

........................................................++++++

writing new private key to 'newreq.pem'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]:AU

State or Province Name (full name) [Some-State]:NSW

Locality Name (eg, city) []:Sydney

Organization Name (eg, company) [Internet Widgits Pty Ltd]:Abmas

Organizational Unit Name (eg, section) []:IT

Common Name (eg, YOUR name) []:ldap.abmas.biz

Email Address []:support@abmas.biz

  

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

Again, there are some things to note here.

You should NOT enter a password.

The Common Name (CN), MUST be the fully qualified domain name (FQDN) of your ldap server.

Now we sign the certificate with the new CA:

root#  /usr/share/ssl/misc/CA.pl -sign

Using configuration from /etc/ssl/openssl.cnf

Enter pass phrase for ./demoCA/private/cakey.pem:

Check that the request matches the signature

Signature ok

Certificate Details:

Serial Number: 1 (0x1)

Validity

Not Before: Mar  6 18:22:26 2005 EDT

Not After : Mar  6 18:22:26 2006 EDT

Subject:

countryName               = AU

stateOrProvinceName       = NSW

localityName              = Sydney

organizationName          = Abmas

organizationalUnitName    = IT

commonName                = ldap.abmas.biz

emailAddress              = support@abmas.biz

X509v3 extensions:

X509v3 Basic Constraints:

   CA:FALSE

Netscape Comment:

   OpenSSL Generated Certificate

X509v3 Subject Key Identifier:

   F7:84:87:25:C4:E8:46:6D:0F:47:27:91:F0:16:E0:86:6A:EE:A3:CE

X509v3 Authority Key Identifier:

   keyid:27:44:63:3A:CB:09:DC:B1:FF:32:CC:93:23:A4:F1:B4:D5:F0:7E:CC

   DirName:/C=AU/ST=NSW/L=Sydney/O=Abmas/OU=IT/

CN=ldap.abmas.biz/emailAddress=support@abmas.biz

   serial:00

Certificate is to be certified until Mar  6 18:22:26 2006 EDT (365 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

Signed certificate is in newcert.pem

That completes the server certificate generation.

Installing the Certificates

Now we need to copy the certificates to the right configuration directories, rename them at the same time (for convenience), change the ownership and finally the permissions:

root#  cp demoCA/cacert.pem /etc/openldap/

root#  cp newcert.pem /etc/openldap/servercrt.pem

root#  cp newreq.pem /etc/openldap/serverkey.pem

root#  chown ldap.ldap /etc/openldap/*.pem

root#  chmod 640 /etc/openldap/cacert.pem;

root#  chmod 600 /etc/openldap/serverkey.pem

Now we just need to add these locations to the openSUSE Yast window:

TLSCertificateFile /etc/openldap/servercrt.pem

TLSCertificateKeyFile /etc/openldap/serverkey.pem

TLSCACertificateFile /etc/openldap/cacert.pem

Here is the declaration and ldap.conf: ldap.conf

TLS_CACERT /etc/openldap/cacert.pem

Everything Linux at LCB

Fed up with Windows?

TRY US!

steve.lcb@gmail.com