Openldap 2.4 for RHEL6 (This is different from earlier versions of OPENLDAP )

This Document was prepared while migrating the MDI Qmail Server to RHEL 6 Platform

Basic Installation

Step 1- Yum install

first we need to install the required packages

yum install openldap-servers

Step 2 - Basic Configuration

As the configuration for LDAP is stored inside the LDAP server itself the configuration has to be done by editing LDIF files under the /etc/openldap/slapd.d/ directory.

Step 3 - Create LDAP Password

Create the ldap password:

slappasswd some_password_text

you’ll get something like this ”{SSHA}4+B3B1p3LlDAApcill87VXFD80jbgX8U” as a result. This is the string we will have to add to the bdb.ldif config file.

vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}bdb.ldif
substitute my-domain.com with yourdomain.com 
:%s/dc=my-domain,dc=com/dc=mdi,dc=ac,dc=in/g

Step 4 -Setup Admin Password and Certificates

We now  set the admin password and specify the location of our encryption certificate and key.

Add these 3 lines at the end of the file bdb.ldif file:

olcRootPW: {SSHA}4+B3B1p3LlDAApcill87VXFD80jbgX8U
olcTLSCertificateFile: /etc/pki/tls/certs/slapdcert.pem
olcTLSCertificateKeyFile: /etc/pki/tls/certs/slapdkey.pem

Step 5- Admin Privileges

Now we have to specify the Admin privileges

vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}monitor.ldif

Again, we have to replace the default domain name with our domain name

:%s/cn=manager,dc=my-domain,dc=com/cn=Manager,dc=mdi,dc=ac,dc=in/g

Step 6 - Further Configuration

Now copy data base configuration file

cp /usr/share/doc/openldap-servers-2.4.19/ DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown -Rf ldap:ldap /var/lib/ldap/

Step 7 - Certificate creation

Now we will need to set up a certificate for TLS. First we need to edit /etc/sysconfig/ldap and change SLAPD_LDAPS from no to yes.

vi /etc/sysconfig/ldap
SLAPD_LDAPS=yes

Now we can create the Self Sign certificate 10 years

openssl req -new -x509 -nodes -out /etc/pki/tls/certs/slapdcert.pem -keyout /etc/pki/tls/certs/slapdkey.pem -days 3650

This will create the two required keys in the /etc/pki/tls/certs/ directory. We need to make them readable for the ldap user.

chown -Rf root:ldap /etc/pki/tls/certs/$cert.pem
chmod -Rf 750 /etc/pki/tls/certs/$key.pem

Step 8 - Importing .schema Files

Copy qmail.schema (ldif) files to /etc/openldap/slapd.d/cn\=config/cn\=schema/

All ldif files are sequential wise so copy with sequence

Edit ldif file according to the sequence number

dn: cn={12}qmail
objectClass: olcSchemaConfig
cn: {12}qmail

Now restart ldap

/etc/init.d/slapd start

(Error : inconsistent duplicate attribute type "mailHost")

Resolution :

Edit file : /etc/openldap/slapd.d/cn=config/cn=schema/cn={*}misc.ldif

Remove this line

olcAttributeTypes: {1}( 2.16.840.1.113730.3.1.18 NAME 'mailHost' DESC 'FQDN of
the SMTP/MTA of this recipient' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE )

and remove “mailHost” entry from olcObjectClasses.

Again restart ldap

Step 8 - Assigning Admin rights

Copy all Acl's to /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}bdb.ldif

olcAccess: to *
           by * write
           by * read
olcAccess: to attrs=userPassword,sambaLMPassword,sambaNTPassword
       by * write
       by * auth
olcAccess: to *
              by dn="uid=admin,ou=mdi.ac.in,dc=mdi,dc=ac,dc=in" write
              by * read
olcAccess: to dn="cn=(.*),ou=(.*),dc=mdi,dc=ac,dc=in" attrs=mailforwardingaddress attrs=deliveryMode
              by self write
              by * read
              by anonymous auth
olcAccess: to * by dn="uid=admin,ou=mail,dc=mdi,dc=ac,dc=in" write
            by * read
olcAccess: to attrs=userPassword
            by dn="uid=dovecot,ou=mail,dc=mdi,dc=ac,dc=in,dc=com" read
            by dn="uid=admin,ou=mail,dc=mdi,dc=ac,dc=in" write
            by anonymous auth

Again restart ldap

Step 9 - LDAP Population of Users

Add all users from existing ldif file from Live server

ldapadd -x -D"cn=Manager,dc=mdi,dc=ac,dc=in" -w secret -f newmdi.ldif

where newmdi.ldif is sample ldif file having users , In our case we have used the imported files from the old server (openldap-2.3.x)

How to take backup of ldap users

ldapsearch -x -D”cn=Managerdc=mdi,dc=ac,dc=in” -w secret -LLL > newmdi.ldif

edit ldap.conf

vim /etc/openldap/ldap.conf

HOST 127.0.0.1
BASE dc=mdi,dc=ac,dc=in

Testing ldap server

1.ldapsearch -x |less

2.ldapsearch -x -D”cn=Manager,dc=mdi,dc=ac,dc=in” -w secret |less

3.Test with change password using ldapmodify

4.Also login on phpldapadmin with admin user and check password will change or not

5.Check on squirrelmail , user's are able to change own password or not