Skip to content

Commit 3c91048

Browse files
williamdeswilliamdes
committed
Implement TLS support
1 parent ba3e21e commit 3c91048

File tree

6 files changed

+108
-5
lines changed

6 files changed

+108
-5
lines changed

‎docker/docker-compose.test.yml‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ services:
77
restart: on-failure:5
88
mem_limit: 256M
99
mem_reservation: 100M
10+
#volumes:
11+
# - ./tests/data/db.sqlite:/data/db.sqlite
1012
healthcheck:
1113
test: 'ldapwhoami -D "cn=$${LDAP_READONLY_USER_USERNAME}" -w "$${LDAP_READONLY_USER_PASSWORD}"'
1214
start_period: 5s
@@ -16,7 +18,7 @@ services:
1618
environment:
1719
# 256 to enable debug
1820
# See: https://www.openldap.org/doc/admin24/slapdconf2.html
19-
LDAP_LOG_LEVEL: 0
21+
LDAP_LOG_LEVEL: 1
2022
LDAP_OPENLDAP_GID: 0
2123
LDAP_OPENLDAP_UID: 0
2224
LDAP_BASE_DN: "dc=example,dc=org"
@@ -26,6 +28,20 @@ services:
2628
LDAP_MONITOR_PASSWORD: "{SSHA}1h+K1VIdptHytwoqDd+z+ozORIKmGvG3"
2729
LDAP_READONLY_USER_USERNAME: monitor
2830
LDAP_READONLY_USER_PASSWORD: monitor
31+
# SSL setting
32+
LDAP_TLS_CA_CRT_FILENAME: "/data/ca.pem"
33+
LDAP_TLS_CRT_FILENAME: "/data/server-cert.pem"
34+
LDAP_TLS_KEY_FILENAME: "/data/server-key.pem"
35+
#LDAP_TLS_CA_CRT_FILENAME: "ca.cer"
36+
LDAP_TLS_CIPHER_SUITE: "HIGH:MEDIUM:-SSLv2"
37+
# never | allow | try | demand
38+
LDAP_TLS_VERIFY_CLIENT: "try"
39+
# Add ldaps:/// to SSL listen
40+
LDAP_LISTEN_URLS: "ldap:/// ldapi:/// ldaps:///"
41+
volumes:
42+
- ./tests/data/ca.pem:/data/ca.pem:ro
43+
- ./tests/data/server-cert.pem:/data/server-cert.pem:ro
44+
- ./tests/data/server-key.pem:/data/server-key.pem:ro
2945

3046
sut:
3147
depends_on:
@@ -34,4 +50,8 @@ services:
3450
build: .
3551
volumes:
3652
- ./tests/:/tests:ro
53+
- ./tests/data/ca.pem:/data/ca.pem:ro
3754
entrypoint: /tests/run.sh
55+
environment:
56+
LDAPTLS_CACERT: /data/ca.pem
57+
LDAPTLS_REQCERT: hard

‎docker/docker-entrypoint.sh‎

Lines changed: 42 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,28 @@ sed -i "s|{{ LDAP_CONFIG_PASSWORD }}|${LDAP_CONFIG_PASSWORD}|" /etc/openldap/sla
2323
sed -i "s|{{ LDAP_ADMIN_PASSWORD }}|${LDAP_ADMIN_PASSWORD}|" /etc/openldap/slapd.conf
2424
sed -i "s|{{ LDAP_MONITOR_PASSWORD }}|${LDAP_MONITOR_PASSWORD}|" /etc/openldap/slapd.conf
2525

26+
if [ "${LDAP_TLS_CA_CRT_FILENAME:-}" != "" ]; then
27+
sed -i "s|#TLSCACertificateFile {{ LDAP_TLS_CA_CRT_FILENAME }}|TLSCACertificateFile ${LDAP_TLS_CA_CRT_FILENAME}|" /etc/openldap/slapd.conf
28+
fi
29+
30+
if [ "${LDAP_TLS_CRT_FILENAME:-}" != "" ]; then
31+
sed -i "s|#TLSCertificateFile {{ LDAP_TLS_CRT_FILENAME }}|TLSCertificateFile ${LDAP_TLS_CRT_FILENAME}|" /etc/openldap/slapd.conf
32+
fi
33+
34+
if [ "${LDAP_TLS_KEY_FILENAME:-}" != "" ]; then
35+
sed -i "s|#TLSCertificateKeyFile {{ LDAP_TLS_KEY_FILENAME }}|TLSCertificateKeyFile ${LDAP_TLS_KEY_FILENAME}|" /etc/openldap/slapd.conf
36+
fi
37+
38+
if [ "${LDAP_TLS_VERIFY_CLIENT:-}" != "" ]; then
39+
sed -i "s|#TLSVerifyClient never|TLSVerifyClient ${LDAP_TLS_VERIFY_CLIENT}|" /etc/openldap/slapd.conf
40+
fi
41+
42+
if [ "${LDAP_TLS_CIPHER_SUITE:-}" != "" ]; then
43+
sed -i "s|TLSCipherSuite DEFAULT|TLSCipherSuite ${LDAP_TLS_CIPHER_SUITE}|" /etc/openldap/slapd.conf
44+
fi
45+
2646
echo 'Checking if replacement worked'
27-
set -x
47+
2848
grep -q -F "ldap_bind_dn: cn=admin,${LDAP_BASE_DN}" /etc/saslauthd.conf
2949
grep -q -F "ldap_search_base: ${LDAP_AUTH_BASE_DN}" /etc/saslauthd.conf
3050
grep -q -F "ldap_bind_pw: ${LDAP_ADMIN_PASSWORD}" /etc/saslauthd.conf
@@ -33,8 +53,27 @@ grep -q -F "suffix \"${LDAP_BASE_DN}\"" /etc/openldap/slapd.conf
3353
grep -q -F "${LDAP_CONFIG_PASSWORD}" /etc/openldap/slapd.conf
3454
grep -q -F "${LDAP_ADMIN_PASSWORD}" /etc/openldap/slapd.conf
3555
grep -q -F "${LDAP_MONITOR_PASSWORD}" /etc/openldap/slapd.conf
36-
set +x
56+
57+
58+
if [ "${LDAP_TLS_CA_CRT_FILENAME:-}" != "" ]; then
59+
grep -q -F "TLSCACertificateFile ${LDAP_TLS_CA_CRT_FILENAME}" /etc/openldap/slapd.conf
60+
fi
61+
62+
if [ "${LDAP_TLS_CRT_FILENAME:-}" != "" ]; then
63+
grep -q -F "TLSCertificateFile ${LDAP_TLS_CRT_FILENAME}" /etc/openldap/slapd.conf
64+
fi
65+
66+
if [ "${LDAP_TLS_KEY_FILENAME:-}" != "" ]; then
67+
grep -q -F "TLSCertificateKeyFile ${LDAP_TLS_KEY_FILENAME}" /etc/openldap/slapd.conf
68+
fi
69+
70+
if [ "${LDAP_TLS_VERIFY_CLIENT:-}" != "" ]; then
71+
grep -q -F "TLSVerifyClient ${LDAP_TLS_VERIFY_CLIENT}" /etc/openldap/slapd.conf
72+
fi
73+
74+
if [ "${LDAP_TLS_CIPHER_SUITE:-}" != "" ]; then
75+
grep -q -F "TLSCipherSuite ${LDAP_TLS_CIPHER_SUITE}" /etc/openldap/slapd.conf
76+
fi
3777

3878
echo 'Starting...'
3979
horust --unsuccessful-exit-finished-failed
40-
ldap_bind_pw: {{ LDAP_ADMIN_PASSWORD }}

‎docker/horust/services/ldap.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
command = "slapd -h 'ldap:/// ldapi:///' -d${LDAP_LOG_LEVEL} -u${LDAP_OPENLDAP_UID} -g${LDAP_OPENLDAP_GID}"
1+
command = "slapd -h \"${LDAP_LISTEN_URLS:-ldap:/// ldapi:///}\" -d${LDAP_LOG_LEVEL} -u${LDAP_OPENLDAP_UID} -g${LDAP_OPENLDAP_GID}"
22
start-delay = "2s"
33
stdout = "STDOUT"
44
stderr = "STDERR"

‎docker/slapd.conf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,12 @@ sasl-secprops noanonymous,noactive,noplain
3737
#sasl-auxprops ldapdb
3838
password-hash {SSHA} {CRYPT}
3939

40+
#TLSCipherSuite DEFAULT
41+
#TLSVerifyClient never
42+
#TLSCACertificateFile {{ LDAP_TLS_CA_CRT_FILENAME }}
43+
#TLSCertificateFile {{ LDAP_TLS_CRT_FILENAME }}
44+
#TLSCertificateKeyFile {{ LDAP_TLS_KEY_FILENAME }}
45+
4046
#######################################################################
4147
# config database definitions
4248
#######################################################################

‎docker/tests/README.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Testing the image
2+
3+
## Run the tests
4+
5+
```sh
6+
make test
7+
```
8+
9+
### Re-Build the test certificate
10+
11+
Source: [MariaDB docs](https://mariadb.com/docs/security/data-in-transit-encryption/create-self-signed-certificates-keys-openssl/)
12+
13+
```sh
14+
openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
15+
-subj "/C=FR/OU=Testing/O=Datacenters Network" \
16+
-keyout ca.key -out ca.pem
17+
18+
openssl req -new -newkey rsa:4096 -nodes \
19+
-subj "/emailAddress=williamdes+sudo-bot-test-cert@wdes.fr/C=FR/OU=Testing/O=Datacenters Network/CN=openldap" \
20+
-keyout server-key.pem -out server-req.pem
21+
22+
openssl x509 -req -days 365 -set_serial 01 \
23+
-in server-req.pem \
24+
-out server-cert.pem \
25+
-CA ca.pem \
26+
-CAkey ca.key
27+
28+
# Cleanup
29+
rm server-req.pem
30+
# Could be needed
31+
# chmod 777 server-cert.pem server-key.pem ca.pem
32+
# Verify
33+
openssl verify -verbose -x509_strict -CAfile ca.pem server-cert.pem
34+
```

‎docker/tests/run.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,10 @@ echo -e "\tUsing simple auth"
8484
ldapwhoami -H ldap://openldap -D "mail=edwin@warz.eu,o=warz.eu,ou=people,dc=example,dc=org" -w 'oHHGf7YyJSihb6ifSwNWZPtEGzijjp8'
8585

8686
echo 'Login as email 5'
87+
echo -e "\tUsing secure STARTTLS auth"
88+
ldapwhoami -ZZ -H ldap://openldap -D "mail=elana@caldin.eu,o=caldin.eu,ou=people,dc=example,dc=org" -w 'bandedetsylish'
89+
echo -e "\tUsing secure SSL auth"
90+
ldapwhoami -H ldaps://openldap -D "mail=elana@caldin.eu,o=caldin.eu,ou=people,dc=example,dc=org" -w 'bandedetsylish'
8791
echo -e "\tUsing simple auth"
8892
ldapwhoami -H ldap://openldap -D "mail=elana@caldin.eu,o=caldin.eu,ou=people,dc=example,dc=org" -w 'bandedetsylish'
8993
echo -e "\tUsing SASL auth"

0 commit comments

Comments
 (0)