TKLPatch for OpenLDAP [UPDATED 20-09-2010]

Hi everyone. LDAP for me is like DNS, one of those complex topics I prefer to be far away. Anyway, I do cross with ldap servers on my job, so I think this TKLPatch will be usefull. On to details:

Features:

What it does:

apt-get update

HOSTNAME=ldap
echo "$HOSTNAME" > /etc/hostname
sed -i "s|127.0.1.1 \(.*\)|127.0.1.1 $HOSTNAME|" /etc/hosts
hostname ldap

install slapd ldap-utils ldapscripts apache2 apache2-mpm-prefork apache2-utils apache2.2-bin apache2.2-common libapache2-mod-php5 libapr1 libaprutil1 libaprutil1-dbd-sqlite3 libaprutil1-ldap php5-common php5-ldap ssl-cert apparmor-profiles apparmor gnutls-bin webmin-ldap-server libnet-ldap-perl

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif

    echo "cn = Turnkeylinux Appliances" > /etc/ssl/ca.info
echo "ca" >> /etc/ssl/ca.info
echo "cert_signing_key" >> /etc/ssl/ca.info
echo "organization = Turnkeylinux Appliances" > /etc/ssl/ldap.info
echo "cn = ldap" >> /etc/ssl/ldap.info
echo "tls_www_server" >> /etc/ssl/ldap.info
echo "encryption_key" >> /etc/ssl/ldap.info
echo "signing_key" >> /etc/ssl/ldap.info

    certtool --generate-privkey > /etc/ssl/private/cakey.pem
certtool --generate-self-signed --load-privkey /etc/ssl/private/cakey.pem --template /etc/ssl/ca.info --outfile /etc/ssl/certs/cacert.pem
certtool --generate-privkey > /etc/ssl/private/ldap_slapd_key.pem
certtool --generate-certificate --load-privkey /etc/ssl/private/ldap_slapd_key.pem --load-ca-certificate /etc/ssl/certs/cacert.pem --load-ca-privkey /etc/ssl/private/cakey.pem --template /etc/ssl/ldap.info --outfile /etc/ssl/certs/ldap_slapd_cert.pem

ldapmodify -Y EXTERNAL -H ldapi:/// -f /src/tls-ssl.ldif
sed -i 's|SLAPD_SERVICES="ldap:/// ldapi:///"|SLAPD_SERVICES="ldap:/// ldapi:/// ldaps:///"|' /etc/default/slapd
adduser openldap ssl-cert
service slapd restart

sh -c "echo -n 'turnkey' > /etc/ldapscripts/ldapscripts.passwd"
sudo chmod 400 /etc/ldapscripts/ldapscripts.passwd

wget http://launchpad.net/~ubuntu-security-proposed/+archive/ppa/+build/1744905/+files/phpldapadmin_1.2.0.5-1ubuntu1.10.04.1_all.deb --no-check-certificate
dpkg -i phpldapadmin_1.2.0.5-1ubuntu1.10.04.1_all.deb

a2enmod ssl
a2dissite default
a2ensite phpldapadmin
a2ensite phpldapadmin-ssl
service apache2 stop
service slapd stop

cleanup_apt

ldap-setup script

20/09/2010 - Added 

echo "Configuring Webmin Module"
# Set pass in webmin module
sed -i -r "s/pass=.*/pass=$PASSWD/" /etc/webmin/ldap-server/config

#!/bin/bash -e
# ldapsetinitialdn: Ask for domain name to create LDAP dn initial entries
# and configure the Turnkeylinux OpenLDAP appliance
# Created by Adrian Moya 2010
echo
echo "Turnkeylinux LDAP Appliance"
echo "Please input the domain for your LDAP directory"
echo "Example: example.com (for dc=example, dc=com)"
ANSWER="n"
while [ $ANSWER != "y" ]; do
  dn=""
  echo
  read -p "Domain: " DOMAIN
  read -p "Organization name: " ORGNAME
  stty -echo
  read -p "Password for admin: " PASSWD; echo
  stty echo
  FIRST="true"
  for i in $(echo $DOMAIN | tr "." "\n")
  do
    dn=$dn"dc=$i,"
    if [ "$FIRST" = "true" ]; then
      dc=$i
      FIRST="false"
    fi
  done
  dn=`echo $dn|sed s/.$//`
  REPLICATION=""
  while [[ $REPLICATION != "y" && $REPLICATION != "n" ]]; do
    read -p "Do you want to configure replication (y/n): " REPLICATION
  done
  if [ $REPLICATION = "y" ]; then
    HOSTNAME=""
    while [[ $HOSTNAME = "" ]]; do
      read -p "Hostname for this server: " HOSTNAME
    done
    ROLE=""
    while [[ $ROLE != "p" && $ROLE != "c" ]]; do
      read -p "Will this server act as a provider or consumer? (p/c): " ROLE
    done
    ROLETEXT="Provider"
    if [ $ROLE = "c" ]; then
      read -p "Provider's server Hostname: " PROVIDERHOSTNAME
      read -p "Provider's server IP: " PROVIDERIP
      ROLETEXT="Consumer"
    fi
  fi
  echo
  echo "Information summary:"
  echo
  echo "Domain set to: $DOMAIN ($dn)"
  echo "Organization name: $ORGNAME"
  echo "Replication: $REPLICATION"
  if [ $REPLICATION = "y" ]; then
    echo "Role: $ROLETEXT"
    echo "Hostname: $HOSTNAME"
    if [ $ROLE = "c" ]; then
      echo "Provider's Hostname: $PROVIDERHOSTNAME"
      echo "Provider's IP: $PROVIDERIP"
    fi
  fi
  echo
  read -p "Is this information correct: (y/n)" ANSWER
done

# Modify and Load previously overlayed backend and frontend examples.
# Also config scriptutils

echo "Loading info for $ORGNAME"
# Backend
sed -i "s/dc=example,dc=com/$dn/" /src/backend.example.com.ldif
sed -i "s/olcRootPW: turnkey/olcRootPW: $PASSWD/" /src/backend.example.com.ldif

# Frontend
sed -i "s/dc=example,dc=com/$dn/" /src/frontend.example.com.ldif
sed -i "s/Example Organization/$ORGNAME/" /src/frontend.example.com.ldif
sed -i "s/dc: Example/dc: $dc/" /src/frontend.example.com.ldif
sed -i "s/userPassword: turnkey/userPassword: $PASSWD/" /src/frontend.example.com.ldif

# Replication
sed -i "s/dc=example,dc=com/$dn/" /src/provider_sync.ldif
sed -i "s/dc=example,dc=com/$dn/" /src/consumer_sync.ldif
sed -i "s|ldap://ldap01.example.com|ldap://$PROVIDERHOSTNAME|" /src/consumer_sync.ldif
sed -i "s/credentials=turnkey/credentials=$PASSWD/" /src/consumer_sync.ldif

# Add backend and frontend
ldapadd -Y EXTERNAL -H ldapi:/// -f /src/backend.example.com.ldif
ldapadd -x -D cn=admin,$dn -w $PASSWD -f /src/frontend.example.com.ldif

# If replication is enabled, make configurations
if [ $REPLICATION = "y" ]; then
  echo "$HOSTNAME" > /etc/hostname
  sed -i "s|127.0.1.1 \(.*\)|127.0.1.1 $HOSTNAME|" /etc/hosts
  if [ $ROLE = "p" ]; then
    certtool --generate-privkey > /etc/ssl/private/${HOSTNAME}_slapd_key.pem
    echo "organization = Turnkeylinux Appliances" > /etc/ssl/${HOSTNAME}.info
    echo "cn = $HOSTNAME" >> /etc/ssl/${HOSTNAME}.info
    echo "tls_www_server" >> /etc/ssl/${HOSTNAME}.info
    echo "encryption_key" >> /etc/ssl/${HOSTNAME}.info
    echo "signing_key" >> /etc/ssl/${HOSTNAME}.info
    certtool --generate-privkey > /etc/ssl/private/${HOSTNAME}_slapd_key.pem
    certtool --generate-certificate --load-privkey /etc/ssl/private/${HOSTNAME}_slapd_key.pem --load-ca-certificate /etc/ssl/certs/cacert.pem --load-ca-privkey /etc/ssl/private/cakey.pem --template /etc/ssl/${HOSTNAME}.info --outfile /etc/ssl/certs/${HOSTNAME}_slapd_cert.pem
    sed -i "s/}//" /etc/apparmor.d/usr.sbin.slapd
    echo "  # accesslog database location" >> /etc/apparmor.d/usr.sbin.slapd
    echo "  /var/lib/ldap/accesslog/ r," >> /etc/apparmor.d/usr.sbin.slapd
    echo "  /var/lib/ldap/accesslog/** rwk," >> /etc/apparmor.d/usr.sbin.slapd
    echo "}" >> /etc/apparmor.d/usr.sbin.slapd
    sudo -u openldap mkdir /var/lib/ldap/accesslog
    sudo -u openldap cp /var/lib/ldap/DB_CONFIG /var/lib/ldap/accesslog/
    service apparmor reload
    ldapadd -Y EXTERNAL -H ldapi:/// -f /src/provider_sync.ldif
  else
    echo "$PROVIDERIP $PROVIDERHOSTNAME" >> /etc/hosts
    echo
    echo "Please answer yes and provide root password for $PROVIDERHOSTNAME"
    echo
    ssh-copy-id -i /etc/ssh/ssh_host_rsa_key.pub $PROVIDERHOSTNAME
    ssh root@$PROVIDERHOSTNAME "mkdir -p /etc/ssl/${HOSTNAME}"
    ssh root@$PROVIDERHOSTNAME "certtool --generate-privkey > /etc/ssl/${HOSTNAME}/${HOSTNAME}_slapd_key.pem"
    ssh root@$PROVIDERHOSTNAME "echo organization = ${ORGNAME} > /etc/ssl/${HOSTNAME}.info"
    ssh root@$PROVIDERHOSTNAME "echo cn = ${HOSTNAME} >> /etc/ssl/${HOSTNAME}.info"
    ssh root@$PROVIDERHOSTNAME "echo tls_www_client >> /etc/ssl/${HOSTNAME}.info"
    ssh root@$PROVIDERHOSTNAME "echo encryption_key >> /etc/ssl/${HOSTNAME}.info"
    ssh root@$PROVIDERHOSTNAME "echo signing_key >> /etc/ssl/${HOSTNAME}.info"
    ssh root@$PROVIDERHOSTNAME "certtool --generate-certificate --load-privkey /etc/ssl/${HOSTNAME}/${HOSTNAME}_slapd_key.pem --load-ca-certificate /etc/ssl/certs/cacert.pem --load-ca-privkey /etc/ssl/private/cakey.pem --template /etc/ssl/${HOSTNAME}.info --outfile /etc/ssl/${HOSTNAME}/${HOSTNAME}_slapd_cert.pem"
    ssh root@$PROVIDERHOSTNAME "cp /etc/ssl/certs/cacert.pem /etc/ssl/${HOSTNAME}/"
    scp root@$PROVIDERHOSTNAME:/etc/ssl/${HOSTNAME}/\{cacert.pem,${HOSTNAME}_slapd_cert.pem\} /etc/ssl/certs
    scp root@$PROVIDERHOSTNAME:/etc/ssl/${HOSTNAME}/${HOSTNAME}_slapd_key.pem /etc/ssl/private
    ldapadd -c -Y EXTERNAL -H ldapi:/// -f /src/consumer_sync.ldif
    echo "TLS_REQCERT allow" >> /etc/ldap/ldap.conf
    echo "TLS_CERT /etc/ssl/certs/${HOSTNAME}_slapd_cert.pem" >> /etc/ldap/ldap.conf
    echo "TLS_KEY /etc/ssl/private/${HOSTNAME}_slapd_key.pem" >> /etc/ldap/ldap.conf
    echo "TLS_CACERT /etc/ssl/certs/cacert.pem" >> /etc/ldap/ldap.conf
  fi
  sed -i "s/ldap_slapd_cert.pem/${HOSTNAME}_slapd_cert.pem/" /src/tls-ssl-replication.ldif
  sed -i "s/ldap_slapd_key.pem/${HOSTNAME}_slapd_key.pem/" /src/tls-ssl-replication.ldif
  ldapmodify -Y EXTERNAL -H ldapi:/// -f /src/tls-ssl-replication.ldif
  service slapd restart
fi

echo "Configuring ldapscripts"
# ldapscripts
sed -i "s/dc=example,dc=com/$dn/" /etc/ldapscripts/ldapscripts.conf
echo -n $PASSWD > /etc/ldapscripts/ldapscripts.passwd

    echo "Configuring Webmin Module"

echo "Configuring phpldapadmin" # phpldapadmin sed -i "s/dc=example,dc=com/$dn/" /usr/share/phpldapadmin/config/config.php # Restart Apache service apache2 restart echo "Done!"

Other updates:

Known issues:

Examples on replication settings:

(tklpatch)root@ldap ~# ldaptklsetup 
Turnkeylinux LDAP Appliance
Please input the domain for your LDAP directory
Example: example.com (for dc=example, dc=com)

Domain: turnkeylinux.com
Organization name: Turnkeylinux appliances
Password for admin:
Do you want to configure replication (y/n): y
Hostname for this server: ldapmaster
Will this server act as a provider or consumer? (p/c): p

Information summary:

Domain set to: turnkeylinux.com (dc=turnkeylinux,dc=com)
Organization name: Turnkeylinux appliances
Replication: y
Role: Provider
Hostname: ldapmaster

Is this information correct: (y/n)y

(tklpatch)root@ldap ~# ldaptklsetup 
Turnkeylinux LDAP Appliance
Please input the domain for your LDAP directory
Example: example.com (for dc=example, dc=com)

Domain: turnkeylinux.com
Organization name: Turnkeylinux Appliances
Password for admin:
Do you want to configure replication (y/n): y
Hostname for this server: ldap01
Will this server act as a provider or consumer? (p/c): c
Provider's server Hostname: ldap00
Provider's server IP: 192.168.3.7

Information summary:

Domain set to: turnkeylinux.com (dc=turnkeylinux,dc=com)
Organization name: Turnkeylinux Appliances
Replication: y
Role: Consumer
Hostname: ldap01
Provider's Hostname: ldap00

Is this information correct: (y/n)y