Red Hat Enterprise Linux 5 Administration Unleashed

Enabling LDAP 275LISTING 12.8Default Indexing Settings# Indices to maintain for this databaseindex objectClassindex ou,cn,mail,surname,givennameindex uidNumber,gidNumber,loginShellindex uid,memberUidindex nisMapName,nisMapEntryeq,preseq,pres,subeq,preseq,pres,subeq,pres,sub12Each time indexing options are modified, the indexes have to be regenerated as the rootuser on the server with the slapindex utility, and the daemon has to be stopped with theservice slapd stop command before running slapindex.Enabling TLS Encryption for LDAPBy default, all data sent between the OpenLDAP server and its clients are sent unencryptedin plain text that can be read by anyone who intercepts the packets on thenetwork. If the server is internal only, this might not be a concern for you. A TLS, orTransport Layer Security, certificate can be used to enable authentication using SASL (SimpleAuthentication and Security Layer) EXTERNAL.First, create an SSL certificate for the server. It can be one from a certificate authority (CA)such as VeriSign or it can be a self-signing certificate created with a program such asOpenSSL. Refer to openssl.org for details on the latter.The cn attribute of the server must be the FQDN of the server, and the DN of the servercertificate must be exactly the same as the cn attribute of the OpenLDAP server. Aliasnames and wildcards can be specified using the subjectAltName certificate extension. Theclients can also have a certificate to authenticate with SASL EXTERNAL.TIPA dummy certificate, /etc/pki/tls/certs/slapd.pem, is included with theopenldap-servers package and can be used for testing purposes.To enable TLS encryption so data, including the password used to administer the directoryfrom a remote system, is encrypted between the server and the client, uncommentthe following lines in /etc/openldap/slapd.conf:TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crtTLSCertificateFile /etc/pki/tls/certs/slapd.pemTLSCertificateKeyFile /etc/pki/tls/certs/slapd.pemIf unchanged, after restarting the service with service ldap restart, the dummy certificateinstalled for testing is used. Otherwise, copy your certificates to the /etc/pki/tls/certs/ directory and change the values of the options to appropriate filenames.The client must be configured to trust the server certificate. Refer to “Connecting to theLDAP Server” for details.