Domänenverwaltung mit 389-ds

root@server:~# apt install 389-ds

Installiert Cockpit direkt mit

root@server:~# dscreate interactive
Install Directory Server (interactive mode)
===========================================
SELinux is disabled, will not relabel ports or files.

SELinux labels will not be applied, continue? [yes]: 

Enter system's hostname [md.domain.tld]: ldap.domain.tld

Enter the instance name [ldap]: ldap 

Enter port number [389]: 

Create self-signed certificate database [yes]: no

Enter Directory Manager DN [cn=Directory Manager]: 

Enter the Directory Manager password: 
Confirm the Directory Manager Password: 

Choose whether mdb or bdb is used. [mdb]: 

Enter the lmdb database size [20Gb]: 2Gb

Enter the database suffix (or enter "none" to skip) [dc=ldap,dc=domain,dc=tld]: dc=domain,dc=tld

Create sample entries in the suffix [no]: yes

Do you want to start the instance after the installation? [yes]: 

Are you ready to install? [no]: yes

Server Cert ED25519

./easyrsa --subject-alt-name="DNS:ldap.domain.tld,DNS:..." build-server-full ldap.domain.tld nopass

private/ldap. issued/ldap. ca.crt nach /etc/dirsrv/slapd-ldap/certs

root@md:/etc/dirsrv/slapd-ldap# chown -R dirsrv:dirsrv /etc/dirsrv/slapd-ldap/certs
root@md:/etc/dirsrv/slapd-ldap# chmod 600 dirsrv:dirsrv /etc/dirsrv/slapd-ldap/certs

# sollte leer sein
root@md:/etc/dirsrv/slapd-ldap# certutil -L -d sql:$PWD

Certificate Nickname                                         Trust Attributes
                                                            SSL,S/MIME,JAR/XPI

CA

Wie immer dran denken hier muss evtl. die komplette chained CA genutzt werden wenn man intermediate CAs nutzt.

root@md:/etc/dirsrv/slapd-ldap# dsconf ldap security ca-certificate add --file certs/ca.crt --name 'SuperCorp-ED25519-CA'
Successfully added CA certificate (SuperCorp-ED25519-CA)
root@md:/etc/dirsrv/slapd-ldap# certutil -L -d sql:.

Certificate Nickname                                         Trust Attributes
                                                            SSL,S/MIME,JAR/XPI

SuperCorp-ED25519-CA                                               CT,, 

Server Cert

müssen zwingend in PKCS#12 vorliegen und Server-Cert heissen

https://doc.opensuse.org/documentation/leap/archive/15.3/security/single-html/book-security/index.html#sec-security-ldap-server-ca

👷👷👷 --- bis hier wird noch gebaut --- 👷👷👷

Cockpit