2 - Raspberry PI Community Projects

and so on). The answer to the “common name” question must be the fully-qualified hostname
for the LDAP server; in our case, ldap.falcot.com.
This command creates a certificate in the newcert.pem file; the corresponding private key is
stored in newkey.pem.
Now these keys have to be installed in their standard location:
# mv newkey.pem /etc/ssl/private/ldap-key.pem
# chmod 0600 /etc/ssl/private/ldap-key.pem
# mv newcert.pem /etc/ssl/certs/ldap-cert.pem
The slapd daemon also needs to be told to use these keys for encryption; this involves adding
the following directives to the /etc/ldap/slapd.conf file:
# TLS support
TLSCipherSuite HIGH
TLSCertificateFile /etc/ssl/certs/ldap-cert.pem
TLSCertificateKeyFile /etc/ssl/private/ldap-key.pem
Example 11.32
Configuring slapd for encryption
The last step for enabling encryption involves changing the SLAPD_SERVICES variable in the
/etc/default/slapd file. We'll play it safe and disable unsecured LDAP altogether.
# Default location of the slapd.conf file
SLAPD_CONF=
# System account to run the slapd server under. If empty the server
# will run as root.
SLAPD_USER=
# System group to run the slapd server under. If empty the server will
# run in the primary group of its user.
SLAPD_GROUP=
# Path to the pid file of the slapd server. If not set the init.d script
# will try to figure it out from $SLAPD_CONF (/etc/ldap/slapd.conf)
SLAPD_PIDFILE=
# Configure if the slurpd daemon should be started. Possible values:
# - yes: Always start slurpd
# - no: Never start slurpd
# - auto: Start slurpd if a replica option is found in slapd.conf
# (default)
Chapter 11 — Network Services: Postfix, Apache, NFS, Samba, Squid, LDAP
293