Samba e OpenLDAP: creare un controller di dominio con Debian Lenny: differenze tra le versioni

Samba e OpenLDAP: creare un controller di dominio con Debian Lenny (visualizza wikitesto)

Versione delle 11:05, 28 gen 2010

2 452 byte aggiunti , 28 gen 2010

→‎Generazione dei certificati SSL

Ferdybassi

Burocrati, Amministratori

4 069

contributi

@@ Riga 116: / Riga 116: @@
 </pre>
 ==Generazione dei certificati SSL==
+Iniziamo generando i certificati SSL per OpenLDAP. Per prima cosa creiamo la nostra certification authority:
+<pre>
+# mkdir -p /etc/ldap/ssl
+# cd /etc/ldap/ssl
+# mkdir certs
+# mkdir private
+# chmod 700 private
+# echo '01' > serial
+# touch index.txt
+</pre>
+Poi modifichiamo il file <code>/etc/ldap/ssl/CA.conf</code>:
+<pre>
+[ ca ]
+default_ca  = local_ca
+[ local_ca  ]
+dir = /etc/ldap/ssl
+certificate = /etc/ldap/ssl/cacert.pem
+database = /etc/ldap/ssl/index.txt
+new_certs_dir = /etc/ldap/ssl/certs
+private_key = /etc/ldap/ssl/private/cakey.pem
+serial = /etc/ldap/ssl/serial
+default_crl_days = 3650
+default_days = 3650
+default_md = md5
+default_bits = 1024
+encrypt_key = yes
+policy = local_ca_policy
+x509_extensions = local_ca_extensions
+unique_subject = no
+[ local_ca_policy ]
+commonName = supplied
+stateOrProvinceName = supplied
+countryName = supplied
+emailAddress = supplied
+organizationName = supplied
+organizationalUnitName = supplied
+[ local_ca_extensions ]
+subjectAltName = DNS:nome_server.dominio.local
+basicConstraints = CA:false
+nsCertType = server
+[ req ]
+default_bits = 2048
+default_keyfile = /etc/ldap/ssl/private/cakey.pem
+default_md = md5
+prompt = no
+distinguished_name = dominio
+x509_extensions = x509_cert
+[ dominio ]
+countryName = IT
+stateOrProvinceName = Lodi
+localityName = Lodi
+emailAddress = admin@dominio.local
+organizationName = Dominio
+organizationalUnitName = Lab
+commonName = nome_server.dominio.local
+[ x509_cert ]
+nsCertType = server
+basicConstraints = CA:true
+</pre>
+e il file <code>/etc/ldap/ssl/LocalServer.conf</code>
+<pre>
+[ req ]
+prompt = no
+distinguished_name = dominio
+[ dominio ]
+countryName = IT
+stateOrProvinceName = Lodi
+localityName = Lodi
+emailAddress = admin@dominio.local
+organizationName = Dominio
+organizationalUnitName  = Lab
+commonName = nome_server.dominio.local
+</pre>
+Possiamo ora generare i nostri certificati:
+<pre>
+# cd /etc/ldap/ssl/
+# export OPENSSL_CONF=/etc/ldap/ssl/CA.conf
+# openssl req -x509 -newkey rsa:1024 -out cacert.pem -outform PEM -days 3650 -passout pass:PASSWORD_ROBUSTA
+# export OPENSSL_CONF=/etc/ldap/ssl/LocalServer.conf
+# openssl req -newkey rsa:1024 -keyout tempkey.pem -keyform PEM -out tempreq.pem -outform PEM -passout pass:PASSWORD_ROBUSTA
+# openssl rsa < tempkey.pem > serverkey.pem -passin pass:PASSWORD_ROBUSTA
+# chmod 400 serverkey.pem
+# export OPENSSL_CONF=/etc/ldap/ssl/CA.conf
+# openssl ca -in tempreq.pem -out servercrt.pem -passin pass:PASSWORD_ROBUSTA
+</pre>
 ==Installazione di OpenLDAP==