Installing and configuring Open LDAP on CentOS 6.3

Last Updated : Oct 03, 2016 |
Prolog information
Metadata
Keywords:
  1. Log in as root user and install the following three packages:
    • openldap-servers: This package contains the main LDAP server.
    • openldap-clients: This package contains all required LDAP client utilities.
    • openldap: This packages contains the LDAP support libraries.
    1. To install, run the following command: yum install -y openldap openldap-clients openldap-servers.
  2. Edit the ldap.conf file and enter the IP address or domain name of your server.
    STEP RESULT: vi /etc/openldap/ldap.conf
    URI ldap://10.133.132.210
    BASE dc=avaya,dc=com
  3. Copy the parameter file to the LDAP database directory.
    ADDITIONAL INFORMATION: cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
    LDAP needs the parameter file to start a new database.
  4. Copy the sample slapd file from /usr/share/openldap-servers to /etc/openldap.
    STEP RESULT: cp /usr/share/openldap-servers/slapd.conf.obsolete /etc/openldap/slapd.conf
  5. Setup a new root password and run the password utility to run generate a secure password and copy the password as you need to enter the password in slapd.conf.
    STEP RESULT: Slappasswd
    New password:openldap
    Re-enter new password:openldap
    {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  6. Update the slapd.conf file to reflect your environment: database section where the domain and password are updated.
    ADDITIONAL INFORMATION: vi /etc/openldap/slapd.conf
    :%s/dc=my-domain/dc=avaya/g           #This regex will replace all the instances of my-domain with your domain name.
    #Enter the below key with password value which is generated in previous steps
    rootpw {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 
    The password is the output of the slappasswd utility.
  7. Create a root.ldif file and enter the following details.
    STEP RESULT: vi /root/root.ldif
    #root
    dn: dc=avaya,dc=com
    dc: avaya
    objectClass: dcObject
    objectClass: organizationalUnit
    ou: avaya.com
  8. Remove everything in slapd.d directory and tell the slapd for root.ldif file
    STEP RESULT: rm -rf /etc/openldap/slapd.d/*
    slapadd -n 2 -l /root/root.ldif
  9. Verify The Configuration files. Use slaptest command to verify the configuration file.
    STEP RESULT: slaptest -u
    config file testing succeeded    slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
    config file testing succeeded
  10. Set the appropriate permissions.
    STEP RESULT: chown -R ldap:ldap /var/lib/ldap
    chown -R ldap:ldap /etc/openldap/slapd.d
  11. Make sure the service is on on the runlevel 3.
    STEP RESULT: chkconfig --level 235 slapd on
  12. To start the ldap server, enter the following command from a terminal window.
    STEP RESULT: service slapd start
  13. Restart the service again after setting up.
    STEP RESULT: rm -rf /etc/openldap/slapd.d/*
    slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
    chown -R ldap:ldap /etc/openldap/slapd.d
    service slapd restart
  14. Test that you can connect to the LDAP server.
    STEP RESULT: ldapsearch -h localhost -D "cn=Manager,dc=avaya,dc=com" -w <openldap_root_password> -b "dc=avaya,dc=com" -s sub "objectclass=*"
    <openldap_root_password> is the Open LDAP root password which was configured in Step 5.
  15. Create sample LDIF file to create LDAP directory structure.
    STEP RESULT: vi ldap_init.ldif
    dn: dc=avaya,dc=com
    dc: avaya
    objectClass: dcObject
    objectClass: organizationalUnit
    ou: avaya.com
     
    dn: ou=dev,dc=avaya,dc=com
    objectClass: top
    objectClass: OrganizationalUnit
    ou: dev
     
    dn: ou=people,ou=dev,dc=avaya,dc=com
    objectClass: top
    objectClass: OrganizationalUnit
    ou: people
  16. Load initial data into the directory. You can do this using an LDIF file and then run the ldapadd command.
    STEP RESULT: ldapadd -x -D "cn=Manager,dc=avaya,dc=com" -W -f ldap_init.ldif
  17. Test that you can connect to the LDAP server.
    STEP RESULT: ldapsearch -h localhost -D "cn=Manager,dc=avaya,dc=com" -w <openldap_root_password> -b "dc=avaya,dc=com" -s sub "objectclass=*"
    <openldap_root_password> is the Open LDAP root password which was configured in Step 5.
  18. Create an SSL certificate for LDAPs.
    STEP RESULT: cd /etc/pki/tls/certs
    rm slapd.pem
    make slapd.pem
    chmod 640 slapd.pem
    chown :ldap slapd.pem
    mkdir /etc/openldap/cacerts/
    ln -s /etc/pki/tls/certs/slapd.pem /etc/openldap/cacerts/slapd.pem
  19. Start the LDAP servers.
    STEP RESULT: vi /etc/sysconfig/ldap
    SLAPD_LDAPS=yes
  20. Add or update the following lines to the global section of the /etc/openldap/slapd.conf file.
    STEP RESULT: vi /etc/openldap/slapd.conf
    TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
    TLSCertificateFile /etc/pki/tls/certs/slapd.pem 
    TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem
  21. Add the following lines to the configuration file for the LDAP server, /etc/openldap/ldap.conf.
    STEP RESULT: vi /etc/openldap/ldap.conf
    TLS_CACERTDIR /etc/openldap/cacerts    
  22. Restart the service again after setting up.
    STEP RESULT: rm -rf /etc/openldap/slapd.d/*
    slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
    chown -R ldap:ldap /etc/openldap/slapd.d
    service slapd restart
Related links
Open LDAP configuration