Hi,
I want to set up a openLDAP server as user management. For this I am using FreeBSD Documentation LDAP. Unforunatly I need some more help.
I have now:
1. installed openLDAP from ports
2. added openldap to rc.conf
3. Made some basic configuration in slapd.conf and ldap.conf
4. generated certs after the configuration.
Now I am not sure what I should do next. In the How-to I am reading something about adding the user information but I am very unsure about this. Hope somebody takes some time to help me.
Here the configs:
Regards
I want to set up a openLDAP server as user management. For this I am using FreeBSD Documentation LDAP. Unforunatly I need some more help.
I have now:
1. installed openLDAP from ports
2. added openldap to rc.conf
3. Made some basic configuration in slapd.conf and ldap.conf
4. generated certs after the configuration.
Now I am not sure what I should do next. In the How-to I am reading something about adding the user information but I am very unsure about this. Hope somebody takes some time to help me.
Here the configs:
Code:
cat /etc/rc.conf
# Enable network daemons for user convenience.
# Please make all changes to this file, not to /etc/defaults/rc.conf.
# This file now contains just the overrides from /etc/defaults/rc.conf.
#ipv6_enable="YES"
# general settings
keyrate="fast"
keymap="german.iso"
# network settings
hostname="freebsd.fritz.box"
ifconfig_re0="inet 192.168.178.4 netmask 255.255.255.0"
defaultrouter="192.168.178.1"
# nfs server
rpcbind_enable="YES"
nfs_server_enable="YES"
mountd_flags="-r"
# sshd
sshd_enable="YES"
# zfs fs
zfs_enable="YES"
# samba
samba_enable="YES"
# openldap
slapd_enable="YES"
Code:
cat slapd.conf
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /usr/local/etc/openldap/schema/core.schema
# Define global ACLs to disable default read access.
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
# Load dynamic backend modules:
modulepath /usr/local/libexec/openldap
moduleload back_bdb
# moduleload back_hdb
# moduleload back_ldap
# Sample security restrictions
# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64
security ssf=128
TLSCertificateFile /home/admin/certificates/cert.crt
TLSCertificateKeyFile /home/admin/certificates/cert.key
TLSCACertificateFile /home/admin/certificates/cacert.crt
# Sample access control policy:
# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:
# Allow self write access
# Allow authenticated users read access
# Allow anonymous users to authenticate
# Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
# by self write
# by users read
# by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!
#######################################################################
# BDB database definitions
#######################################################################
database bdb
suffix "dc=fritz,dc=box"
rootdn "cn=manager,dc=fritz,dc=box"
# Cleartext passwords, especially for the rootdn, should
# be avoid. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw secret
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /var/db/openldap-data
# Indices to maintain
index objectClass eq
Code:
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
base dc=fritz,dc=box
URI ldap://freebsd.fritz.box/
ssl start_tls
tls_cacert /home/admin/certificates/cacert.crt
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
[/QUOTE]
[quote]ls -l /home/admin/certificates
total 6
-r--r--r-- 1 root users 989 Jan 9 20:04 cacert.crt
-rw-r--r-- 1 root users 720 Jan 9 20:04 cert.crt
-rw-r--r-- 1 root users 891 Jan 9 20:03 cert.keyRegards
