Openldap 2.4 for RHEL6 (This is different from earlier versions of OPENLDAP )

Basic Installation

Step 1:

first we need to install the required packages

yum install openldap-servers migrationtools

Step2:: Configurations

As the configuration for LDAP is stored inside the LDAP server itself the configuration has to be done by editing LDIF files under the /etc/openldap/slapd.d/ directory.

Step 3: Create the ldap password:

#slappasswd some_password_text

you’ll get something like this ”{SSHA}4+B3B1p3LlDAApcill87VXFD80jbgX8U” as a result. This is the string we will have to add to the bdb.ldif config file.

vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}bdb.ldif
substitute my-domain.com with yourdomain.com 
:%s/dc=my-domain,dc=com/dc=mdi,dc=ac,dc=in/g

Step 4: Setup Admin Pass

We now  set the admin password and specify the location of our encryption certificate and key.

Add these 3 lines at the end of the file bdb.ldif file:

olcRootPW: {SSHA}4+B3B1p3LlDAApcill87VXFD80jbgX8U
olcTLSCertificateFile: /etc/pki/tls/certs/slapdcert.pem
olcTLSCertificateKeyFile: /etc/pki/tls/certs/slapdkey.pem

Step 5: Admin Privileges

Now we have to specify the Admin privileges

#vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}monitor.ldif

Again, we have to replace the default domain name with our domain name

:%s/cn=manager,dc=my-domain,dc=com/cn=Manager,dc=mdi,dc=ac,dc=in/g

Step 5: Further Configuration

Now copy data base configuration file

#cp /usr/share/doc/openldap-servers-2.4.19/ DB_CONFIG.example /var/lib/ldap/DB_CONFIG

1. chown -Rf ldap:ldap /var/lib/ldap/

Step 6: Now we will need to set up a certificate for TLS. First we need to edit /etc/sysconfig/ldap and change SLAPD_LDAPS from no to yes.

1. vi /etc/sysconfig/ldap

SLAPD_LDAPS=yes

Now we can create the certificate

1. openssl req -new -x509 -nodes -out /etc/pki/tls/certs/slapdcert.pem -keyout /etc/pki/tls/certs/slapdkey.pem -days 3650

This will create the two required keys in the /etc/pki/tls/certs/ directory. We need to make them readable for the ldap user.

1. chown -Rf root:ldap /etc/pki/tls/certs/$cert.pem

1. chmod -Rf 750 /etc/pki/tls/certs/$key.pem

Copy schema (ldif) files to /etc/openldap/slapd.d/cn\=config/cn\=schema/

• All ldif files are sequential wise so copy with sequence

Edit ldif file according to the sequence number

dn: cn={12}qmail

objectClass: olcSchemaConfig

cn: {12}qmail

Now restart ldap

1. /etc/init.d/slapd start

(Error : inconsistent duplicate attribute type "mailHost") Resolution :

Edit file : /etc/openldap/slapd.d/cn=config/cn=schema/cn={*}misc.ldif

Remove this line

olcAttributeTypes: {1}( 2.16.840.1.113730.3.1.18 NAME 'mailHost' DESC 'FQDN of

 the SMTP/MTA of this recipient' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE )

and remove “mailHost” entry from olcObjectClasses.

Again restart ldap

Step7:

Copy all Acl's to /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}bdb.ldif

olcAccess: to *

           by * write

           by * read

olcAccess: to attrs=userPassword,sambaLMPassword,sambaNTPassword

       by * write

       by * auth

olcAccess: to *

               by dn="uid=admin,ou=mdi.ac.in,dc=mdi,dc=ac,dc=in" write

               by * read

olcAccess: to dn="cn=(.*),ou=(.*),dc=mdi,dc=ac,dc=in" attrs=mailforwardingaddress attrs=deliveryMode

               by self write

               by * read

               by anonymous auth

olcAccess: to * by dn="uid=admin,ou=mail,dc=mdi,dc=ac,dc=in" write

            by * read

olcAccess: to attrs=userPassword

            by dn="uid=dovecot,ou=mail,dc=mdi,dc=ac,dc=in,dc=com" read

            by dn="uid=admin,ou=mail,dc=mdi,dc=ac,dc=in" write

            by anonymous auth

Again restart ldap

Step8: Add all users from existing ldif file from Live server

ldapadd -x -D"cn=Manager,dc=mdi,dc=ac,dc=in" -w secret -f newmdi.ldif

How to take backup of ldapusers :

ldapsearch -x -D”cn=Managerdc=mdi,dc=ac,dc=in” -w secret -LLL > newmdi.ldif

edit ldap.conf

vim /etc/openldap/ldap.conf

HOST 127.0.0.1

BASE dc=mdi,dc=ac,dc=in

Test ldap server :

1.ldapsearch -x |less

2.ldapsearch -x -D”cn=Manager,dc=mdi,dc=ac,dc=in” -w secret |less

3.Test with change password using ldapmodify

4.Also login on phpldapadmin with admin user and check password will change or not

5.Check on squirrelmail , user's are able to change own password or not