1，ldap server 192.168.98.129

      client  192.168.98.128

客户端加入到ldap 域，使用ldap账户登录，见 《ldap客户端加入域和ssl加密查询》

2，配置CA 认证中心

129上

首先清理掉默认的CA目录，然后重新生成

[root@localhost misc]# cd /etc/pki/ 
[root@localhost pki]# ls 
CA nssdb rpm-gpg server.crt server.csr server.key tls 
[root@localhost pki]# rm -rf CA

重新生成

[root@localhost ssl]# cd /etc/pki/tls/misc/

[root@localhost misc]# ./CA -newca 
CA certificate filename (or enter to create) 

Making CA certificate ... 
Generating a 1024 bit RSA private key 
.........++++++ 
................++++++ 
writing new private key to '../../CA/private/./cakey.pem' 
Enter PEM pass phrase: 
Verifying - Enter PEM pass phrase: 
----- 
You are about to be asked to enter information that will be incorporated 
into your certificate request. 
What you are about to enter is what is called a Distinguished Name or a DN. 
There are quite a few fields but you can leave some blank 
For some fields there will be a default value, 
If you enter '.', the field will be left blank. 
----- 
Country Name (2 letter code) [GB]: 
State or Province Name (full name) [Berkshire]: 
Locality Name (eg, city) [Newbury]: 
Organization Name (eg, company) [My Company Ltd]: 
Organizational Unit Name (eg, section) []: 
Common Name (eg, your name or your server's hostname) []:pincer  
Email Address []:root@pincer.com 

Please enter the following 'extra' attributes 
to be sent with your certificate request 
A challenge password []: 
An optional company name []:abc 
Using configuration from /etc/pki/tls/openssl.cnf 
Enter pass phrase for ../../CA/private/./cakey.pem: 
Check that the request matches the signature 
Signature ok 
Certificate Details: 
Serial Number: 0 (0x0) 
Validity 
Not Before: Feb 15 07:11:29 2015 GMT 
Not After : Feb 14 07:11:29 2018 GMT 
Subject: 
countryName = GB 
stateOrProvinceName = Berkshire 
organizationName = My Company Ltd 
commonName = pincer 
emailAddress = root@pincer.com 
X509v3 extensions: 
X509v3 Basic Constraints: 
CA:FALSE 
Netscape Comment: 
OpenSSL Generated Certificate 
X509v3 Subject Key Identifier: 
BA:B6:03:66:2F:8E:9A:AB:79:B2:82:24:CC:EA:15:8C:7D:69:77:2B 
X509v3 Authority Key Identifier: 
keyid:BA:B6:03:66:2F:8E:9A:AB:79:B2:82:24:CC:EA:15:8C:7D:69:77:2B 

Certificate is to be certified until Feb 14 07:11:29 2018 GMT (1095 days) 

Write out database with 1 new entries 
Data Base Updated 
[root@localhost misc]#

上面生成了CA 证书，在/etc/pki/CA下有一个cacert.pem文件，这个证书是要放到ldap 的证书目录中使用的

下面生成的是每个机器的请求文件和证书，线上使用中，每个ldap server 都要执行一次，然后传到ldap server（主要是因为下面的commonName = pincer ）

[root@localhost misc]# openssl req -newkey rsa:1024 -nodes -keyout slapd-key.pem -out slapd-req.pem 
Generating a 1024 bit RSA private key 
...++++++ 
...++++++ 
writing new private key to 'slapd-key.pem' 
----- 
You are about to be asked to enter information that will be incorporated 
into your certificate request. 
What you are about to enter is what is called a Distinguished Name or a DN. 
There are quite a few fields but you can leave some blank 
For some fields there will be a default value, 
If you enter '.', the field will be left blank. 
----- 
Country Name (2 letter code) [GB]: 
State or Province Name (full name) [Berkshire]: 
Locality Name (eg, city) [Newbury]: 
Organization Name (eg, company) [My Company Ltd]: 
Organizational Unit Name (eg, section) []: 
Common Name (eg, your name or your server's hostname) []:pincer 
Email Address []:root@pincer.com 

Please enter the following 'extra' attributes 
to be sent with your certificate request 
A challenge password []: 
An optional company name []:abc 
[root@localhost misc]# 
[root@localhost misc]# 
[root@localhost misc]# ls 
CA CA.pl c_hash c_info c_issuer c_name slapd-key.pem slapd-req.pem 


[root@localhost misc]# openssl ca -out slapd-cert.pem -infiles slapd-req.pem 
Using configuration from /etc/pki/tls/openssl.cnf 
Enter pass phrase for ../../CA/private/cakey.pem: 
Check that the request matches the signature 
Signature ok 
Certificate Details: 
Serial Number: 1 (0x1) 
Validity 
Not Before: Feb 15 07:13:21 2015 GMT 
Not After : Feb 15 07:13:21 2016 GMT 
Subject: 
countryName = GB 
stateOrProvinceName = Berkshire 
organizationName = My Company Ltd 
commonName = pincer  ###这里要注意，这里的写主机名，则连接的时候，ldapsearch -h也要写主机名，所以，为了线上使用，需要填写ldap server的ip地址
emailAddress = root@pincer.com 
X509v3 extensions: 
X509v3 Basic Constraints: 
CA:FALSE 
Netscape Comment: 
OpenSSL Generated Certificate 
X509v3 Subject Key Identifier: 
DC:50:25:5D:64:DB:DC:50:5C:F5:30:03:76:6A:9F:38:EE:A3:38:C5 
X509v3 Authority Key Identifier: 
keyid:BA:B6:03:66:2F:8E:9A:AB:79:B2:82:24:CC:EA:15:8C:7D:69:77:2B 

Certificate is to be certified until Feb 15 07:13:21 2016 GMT (365 days) 
Sign the certificate? [y/n]:y 


1 out of 1 certificate requests certified, commit? [y/n]y 
Write out database with 1 new entries 
Data Base Updated 
[root@localhost misc]#

3个步骤，就将ca中心的证书和ldap的证书都搞定了

3，下面将证书复制到ldap 目录中使用

修改ldap配置文件

[root@localhost pki]# vim /etc/openldap/slapd.conf

TLSCACertificateFile /etc/openldap/ssl/cacert.pem

TLSCertificateFile /etc/openldap/ssl/slapd-cert.pem

TLSCertificateKeyFile /etc/openldap/ssl/slapd-key.pem

将证书复制到/etc/openldap/ssl/ 中，修改slapd-key.pem 文件权限为600

[root@localhost pki]# cp CA/cacert.pem tls/misc/slapd-* /etc/openldap/ssl/

[root@localhost pki]# chmod 600 /etc/openldap/ssl/slapd-key.pem

重启ldap 会监听一个636 端口，即为加密认证

4，修改客户端配置认证

注意： 如果有其他客户端，则将/etc/openldap/ssl下的目录全部复制到ldap client上，然后修改/etc/openlda/ldap.conf 就好了

[root@localhost pki]# vim /etc/openldap/ldap.conf

URI ldaps://pincer/           （1）这里的pincer要跟生成证书的comm写的一样， 我们这里写的是pincer，所以这里也要写pincer

BASE dc=my-domain,dc=com

#TLS_CACERTDIR /etc/openldap/cacerts

TLS_CACERTDIR /etc/openldap/ssl

TLS_CACERT /etc/openldap/ssl/cacert.pem

TLS_REQCERT hard

上面的必须要加

配置/etc/ldap.conf

  （2）#下面的顺序一定要这样

ssl start_tls

ssl on

上面的（1）和(2) 不对，  ldapsearch 不受影响，但是getent 和系统验证登录就会失败（卡主）

测试:

可以看到下面ldaps://pincer  访问的ip的pincer，这是因为上面（[root@localhost misc]# openssl ca -out slapd-cert.pem -infiles slapd-req.pem ）生成的时候写的pincer，所以这个访问这个ldap server的时候就必须要跟天蝎的pincer对应， 如果想访问ip，生成的时候就得使用ip地址

[root@localhost pki]# ldapsearch -x -b 'dc=my-domain,dc=com' -H ldaps://pincer -D 'cn=Manager,dc=my-domain,dc=com' -w 123456|less 
# extended LDIF 
# 
# LDAPv3 
# base <dc=my-domain,dc=com> with scope subtree 
# filter: (objectclass=*) 
# requesting: ALL 
# 

# my-domain.com 
dn: dc=my-domain,dc=com 
dc: my-domain 
objectClass: top 
objectClass: dcObject 
objectClass: organization 
o: my-domain 

# Manager, my-domain.com 
dn: cn=Manager,dc=my-domain,dc=com 
objectClass: organizationalRole 
cn: Manager 

# People, my-domain.com 
dn: ou=People,dc=my-domain,dc=com 
ou: People 
description:: QWxsIHBlb3BsZSBpbiBvcmdhbml6YXRpb24g 
objectClass: organizationalUnit 

# Group, my-domain.com 
dn: ou=Group,dc=my-domain,dc=com 
ou: Group 
description: All people in organization 
objectClass: organizationalUnit 

# root, People, my-domain.com 
dn: uid=root,ou=People,dc=my-domain,dc=com 
uid: root 
cn: root 
objectClass: account 
objectClass: posixAccount 
objectClass: top 
objectClass: shadowAccount 
userPassword:: e2NyeXB0fSQxJC5weE5FaUo3JG9jeER0cGFuTlBIU1o1WVI5Z2FGNi4= 
shadowLastChange: 16354 
shadowMin: 0 
shadowMax: 99999 
shadowWarning: 7 
loginShell: /bin/bash 
uidNumber: 0 
gidNumber: 0 
homeDirectory: /root

为ldap用户登录时创建家目录

将下面一条在ldap client上追加 就可以了

echo 'session    required     pam_mkhomedir.so skel=/etc/skel umask=0022' >> /etc/pam.d/system-auth

------下面是线上实例，由于有多个ldap server都需要加密，所以要单独为每个ldap生成一个证书（主要是方便客户端通过ip访问）

#!/usr/bin/expect

proc Usage_Exit {myself} {

    puts ""

    puts "### USAGE: $myself slave_ip pass_phrase"

    puts ""

    exit

}

if { [llength $argv] < 2 } {

    Usage_Exit $argv0

}

set IP [lindex $argv 0]

set PASSWORD [lindex $argv 1]

set timeout 8

spawn openssl req -newkey rsa:1024 -nodes -keyout slapd-key.pem -out slapd-req.pem

expect {

        "Country Name (2 letter code) " { send "\r";exp_continue}

        "State or Province Name (full name) " { send "\r";exp_continue}

        "Locality Name (eg, city) " { send "\r";exp_continue}

        "Organization Name (eg, company) " { send "\r";exp_continue}

        "Organizational Unit Name (eg, section) " { send "\r";exp_continue}

        "Common Name (eg, YOUR name) " { send "$IP\r";exp_continue}

        "Email Address " { send "\r";exp_continue}

        "A challenge password " { send "\r";exp_continue}

        "An optional company name " { send "\r"; exp_continue}

        timeout { puts "$IP time out" ;exit 1 }

}

spawn openssl ca -out slapd-cert.pem -infiles slapd-req.pem

expect {

        "Enter pass phrase for ./demoCA/private/cakey.pem" { send "$PASSWORD\r";exp_continue}

        "y/n]" { send "y\r";exp_continue}

        timeout { puts "$IP time out" ;exit 1 }

}