Install OpenLDAP server on CentOS 7

OpenLDAP is an open-source implementation of Lightweight Directory Access Protocol (LDAP), an open protocol for accessing and maintaining distributed directory information services over an IP network.
In this tutorial, I will explain step by step how to install and et deploy openldap 2.4+ on CentOS 7. OpenLDAP 2.4+ uses the ldif format to make changes to the ldap directory as opposed to making changes directly to the slapd.conf file. This allows for changes to be made on the fly among other things.

1. Installing OpenLDAP#

I will use universityx.edu as an example for my domain.
First, we install OpenLDAP services:

yum install -y openldap openldap-clients openldap-servers

We prepare the LDAP database:

cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

Then, we generate the database files:

slaptest -u

And change LDAP database ownership:

chown ldap:ldap /var/lib/ldap/*

We will need a certificate to secure ldap connection for later, so let us generate an X509 certificate valid for 1 year:

openssl req -new -x509 -nodes -out /etc/openldap/certs/unixcert.pem \
-keyout /etc/openldap/certs/unixpriv.pem -days 365

The output will look something like this, and you will be asked to provide information about country, organization name, email...

Generating a 2048 bit RSA private key
.....+++
..............+++
writing new private key to '/etc/openldap/certs/priv.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]: US
State or Province Name (full name) []: California
Locality Name (eg, city) [Default City]: LA
Organization Name (eg, company) [Default Company Ltd]: UniversityX
Organizational Unit Name (eg, section) []: ITC
Common Name (eg, your name or your server's hostname) []: ldap.univesityx.edu
Email Address []: ldapadmin@universityx.edu

Secure the content of the /etc/openldap/certs directory:

cd /etc/openldap/certs
chown ldap:ldap *
chmod 600 unixpriv.pem

Activate the slapd service at boot:

systemctl enable slapd

Start the slapd service:

systemctl start slapd

If you see no errors up till now, you're good to go.

2. Configuring OpenLDAP#

According to your organization's need, you might need to add different schemas, or even create your own. The most used ones are cosine, nis, and inetOrgPerson.

ldapadd -Q -Y EXTERNAL -H ldapi:/// -w <yourpassword> -f /etc/openldap/schema/cosine.ldif
ldapadd -Q -Y EXTERNAL -H ldapi:/// -w <yourpassword> -f /etc/openldap/schema/nis.ldif
ldapadd -Q -Y EXTERNAL -H ldapi:/// -w <yourpassword> -f /etc/openldap/schema/inetorgperson.ldif

Now we create a directory where we store ldif files for ldap configuration:

mkdir /tmp/ldapwork

Then create the /tmp/ldapwork/initialconfig.ldif to initiate openldap. We'll need a master password for management, let's start with that:

slappasswd -s <yourpassword>
{SSHA}45-sd+DFSVymtWWuIFbbcsdvqsfv464Ddf

Copy the password hash (not this one!). And edit the file /tmp/ldapwork/initialconfig.ldif with your favorite editor:

vi /tmp/ldapwork/initialconfig.ldif

And paste the following lines (modify according to your settings):

dn: olcDatabase={2}mdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=universityx,dc=edu

dn: olcDatabase={2}mdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=manager,dc=universityx,dc=edu

dn: olcDatabase={2}mdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: <yourpasswordhash> # previously generated (see above)

dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/unixcert.pem   # path to certificate

dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/unixpriv.pem   # path to private key

dn: cn=config
changetype: modify
replace: olcLogLevel
olcLogLevel: 129 (add replication if relevant)

dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=universityx,dc=edu" read by * none

Send the new configuration to the slapd server:

ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/ldapwork/initialconfig.ldif

3. Firewall configuration#

Add a new rule to the firewall allowing ldap service (port 389 tcp)

firewall-cmd --permanent --add-service=ldap
firewall-cmd --reload

4. Log configuration#

Edit the file /etc/rsyslog.conf and add the following lines:

# Log ldap stuff
local4.*                                                /var/log/slapd/slapd.log

Restart the rsyslog service:

service rsyslog restart

Done ! You can start populating your database.