Chapter 1. Securing Red Hat Directory Server

Procedure

1. Create a private key and a certificate signing request (CSR). Skip this step if you want to create them using an external utility.

   • If your host is reachable only by one name, enter:

     # dsctl <instance_name> tls generate-server-cert-csr -s "CN=server.example.com,O=example_organization"

     Copy to Clipboard Toggle word wrap

   • If your host is reachable by multiple names:

     # dsctl <instance_name> tls generate-server-cert-csr -s "CN=server.example.com,O=example_organization" server.example.com server.example.net

     Copy to Clipboard Toggle word wrap

     If you specify the host names as the last parameter, the command adds the Subject Alternative Name (SAN) extension with the DNS:server.example.com, DNS:server.example.net entries to the CSR.

   The string specified in the -s subject parameter must be a valid subject name according to RFC 1485. The CN field in the subject is required, and you must set it to one of the fully-qualified domain names (FQDN) of the server. The command stores the CSR in the /etc/dirsrv/slapd-<instance_name>/Server-Cert.csr file.

2. Submit the CSR to the certificate authority (CA) to get a certificate issued. For further details, see your CA’s documentation.

3. Import the server certificate issued by the CA to the NSS database:

   • If you created the private key using the dsctl tls generate-server-cert-csr command, enter:

     # dsconf <instance_name> security certificate add --file /root/instance_name.crt --name "server-cert" --primary-cert

     Copy to Clipboard Toggle word wrap

     Remember the name of the certificate you set in the --name _certificate_nickname parameter. You require it in a later step.

   • If you created the private key using an external utility, import the server certificate and the private key:

     # dsctl <instance_name> tls import-server-key-cert /root/server.crt /root/server.key

     Copy to Clipboard Toggle word wrap

     Note that the command requires you to specify the path to the server certificate first and then the path to the private key. This method always sets the nickname of the certificate to Server-Cert.

4. Import the CA certificate to the NSS database:

   # dsconf <instance_name> security ca-certificate add --file /root/ca.crt --name "Example CA"

   Copy to Clipboard Toggle word wrap

5. Set the trust flags of the CA certificate:

   # dsconf <instance_name> security ca-certificate set-trust-flags "Example CA" --flags "CT,,"

   Copy to Clipboard Toggle word wrap

   This configures Directory Server to trust the CA for TLS encryption and certificate-based authentication.

6. Enable TLS and set the LDAPS port:

   # dsconf <instance_name> config replace nsslapd-securePort=636 nsslapd-security=on

   Copy to Clipboard Toggle word wrap

7. Open the LDAPS port in the firewalld service:

   # firewall-cmd --permanent --add-port=636/tcp
   # firewall-cmd --reload

   Copy to Clipboard Toggle word wrap

8. Enable the RSA cipher family, set the NSS database security device, and the server certificate name:

   # dsconf <instance_name> security rsa set --tls-allow-rsa-certificates on --nss-token "internal (software)" --nss-cert-name Server-Cert

   Copy to Clipboard Toggle word wrap

   By default, the name of the security device in the NSS database is internal (software).

9. Optional: Disable the plain text LDAP port:

   # dsconf <instance_name> security disable_plain_port

   Copy to Clipboard Toggle word wrap

10. Restart the instance

    # dsctl <instance_name> restart

    Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to Server Security Certificate Management Certificate Signing Request, and click Create Certificate Signing Request.

2. Set a name for certificate signing request (CSR), common name (CN), and organization (O):

   

   View larger image

   

   If your host is reachable by multiple names, set the alternative names in the Subject Alternative Names filed.

3. Click Create Certificate Signing Request.

4. View the CSR text and copy it:

   1. Click Node options icon for the CSR you want to view and select View CSR.
   2. Copy the CSR content.
5. Submit the CSR file to the certificate authority (CA) to get a certificate issued. For further details, see your CA’s documentation.
6. When you get the certificate from your CA, navigate to Server Security Certificate Management TLS Certificates, and click Add Server Certificate.

7. Set a unique nickname for the server certificate, upload the issued certificate, and click Add Certificate.

   Remember the certificate nickname, because a later step requires it.

8. Navigate to Server Security Certificate Management Trusted Certificate Authorities, and click Add CA Certificate.
9. Set a unique nickname for the CA certificate, upload the CA certificate file, and click Add Certificate.

10. Optional: If you did not enable TLS encryption during the Directory Server instance installation, enable it:

    1. Navigate to Server Security Settings, and enable the security switch.
    2. On the pop-up window, click Enable Security.
    3. Click Save Configuration on the Security Setting page.

11. Configure the Server Certificate Name on the Security Configuration page:

    1. Navigate to Server Security Security Configuration.
    2. Select the server certificate nickname in the Server Certificate Name drop-down list, and click Save Configuration.
    3. Optional: If you do not see the certificate nickname in the drop-down list, refresh the Security Settings page and perform the previous step again.
12. Optional: If you want to use an LDAPS port other than 636, navigate to the Server Server Settings, set the LDAPS port, and click Save.

13. Open the LDAPS port in the firewalld service:

    # firewall-cmd --permanent --add-port=636/tcp
    # firewall-cmd --reload

    Copy to Clipboard Toggle word wrap

14. Optional: Navigate to Server Security Security Configuration, check Require Secure Connections checkbox, and click Save Configuration.

    Directory Server disables the plain text LDAP port.

15. Click Actions in the top right corner, and select Restart Instance.

Procedure

1. Use the following command to change the NSS database password:

   # certutil -d /etc/dirsrv/slapd-<instance_name>/ -W
   
   Enter Password or Pin for "NSS Certificate DB":
   Enter a password which will be used to encrypt your keys.
   The password should be at least 8 characters long,
   and should contain at least one non-alphabetic character.
   
   Enter new password:
   Re-enter password:
   Password changed successfully.

   Copy to Clipboard Toggle word wrap

2. If you use a password file to start Directory Server automatically without prompting for the NSS database password, replace the old password with the new one in the /etc/dirsrv/slapd-<instance_name>/pin.txt:

   • If you use the NSS software cryptography module, which is the default:

     Internal (Software) Token:password

     Copy to Clipboard Toggle word wrap

   • If you use a Hardware Security Module (HSM):

     name_of_the_token:password

     Copy to Clipboard Toggle word wrap

Procedure

1. Create the /etc/dirsrv/slapd-<instance_name>/pin.txt file with the following content:

   • If you use the NSS software cryptography module, which is the default:

     Internal (Software) Token:password

     Copy to Clipboard Toggle word wrap

   • If you use a Hardware Security Module (HSM):

     name_of_the_token:password

     Copy to Clipboard Toggle word wrap

2. Set the file permissions:

   # chown dirsrv:root /etc/dirsrv/slapd-<instance_name>/pin.txt
   # chmod 400 /etc/dirsrv/slapd-<instance_name>/pin.txt

   Copy to Clipboard Toggle word wrap

Procedure

1. If you do not have a local copy of the CA certificate used by Directory Server:

   1. List the certificates in the server’s network security services (NSS) database:

      # certutil -d /etc/dirsrv/slapd-<instance_name>/ -L
      
      Certificate Nickname                       Trust Attributes
                                                 SSL,S/MIME,JAR/XPI
      
      Example CA                                 C,,
      Server-Cert                                u,u,u

      Copy to Clipboard Toggle word wrap

   2. Use the nickname of the CA certificate in the NSS database to export the CA certificate:

      # certutil -d /etc/dirsrv/slapd-<instance_name>/ -L -n "Example CA" -a > /tmp/ds-ca.crt

      Copy to Clipboard Toggle word wrap

2. Copy the CA certificate to the /etc/pki/ca-trust/source/anchors/ directory:

   # cp /tmp/ds-ca.crt /etc/pki/ca-trust/source/anchors/

   Copy to Clipboard Toggle word wrap

3. Rebuild the CA trust database:

   # update-ca-trust

   Copy to Clipboard Toggle word wrap

Procedure

1. Optional: Display the TLS protocols that are currently enabled in Directory Server:

   # dsconf <instance_name> security get | egrep -i "sslVersionMin|sslVersionMax"
   sslversionmin: TLS1.2
   sslversionmax: TLS1.3

   Copy to Clipboard Toggle word wrap

2. Set the minimum TLS protocol. For example, to set it to TLS 1.3, enter:

   # dsconf <instance_name> security set --tls-protocol-min="TLS1.3"

   Copy to Clipboard Toggle word wrap

   Note that you cannot set the parameter to a value lower than TLS 1.2, which is the minimum of all RHEL system-wide crypto policy profiles.

3. Not recommended: Set the highest supported TLS protocol:

   # dsconf <instance_name> security set --tls-protocol-max="TLS1.3"

   Copy to Clipboard Toggle word wrap

   If you set --tls-protocol-max to a value lower than in --tls-protocol-min, then Directory Server sets the maximum protocol to the same value as the minimum.

   To always use the strongest supported encryption protocol as the maximum supported TLS version, do not set --tls-protocol-max.

4. Restart the instance:

   # dsctl <instance_name> restart

   Copy to Clipboard Toggle word wrap

Verification

1. Display the supported TLS protocols:

   # dsconf <instance_name> security get | egrep -i "sslVersionMin|sslVersionMax"
   sslversionmin: TLS1.3
   sslversionmax: TLS1.3

   Copy to Clipboard Toggle word wrap

2. Use the openssl utility to establish a secure client connection using a specific TLS protocol:

   # echo | openssl s_client -connect server.example.com:636 -tls1_3
   ...
   New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
   ...

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to Server Security.
2. Set the minimum TLS protocol in the Minimum TLS Version field.
3. Not recommended: Set the highest supported TLS protocol in the Maximum TLS Version field.
4. Click Save Settings.
5. Click Actions in the top right corner, and select Restart Instance.

Procedure

1. Set the nsslapd-require-secure-binds configuration parameter to on:

   # dsconf <instance_name> config replace nsslapd-require-secure-binds=on

   Copy to Clipboard Toggle word wrap

2. Optional: If you want to use LDAPS, disable the plain text LDAP port:

   # dsconf <instance_name> security disable_plain_port
   
   Disabling plaintext ldap port - you must have ldaps configured:
   Type 'Yes I am sure' to continue: Yes I am sure

   Copy to Clipboard Toggle word wrap

3. Restart the instance:

   # dsctl <instance_name> restart

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to Server Security Security Configuration, select the Require Secure Connections option, and click Save Configuration.
2. Optional: If you want to use LDAPS, navigate to Server Server Settings General Settings, and set LDAP Port to 0 to disable the plain text LDAP port. Click Save.
3. Click Actions in the top right corner, and select Restart Instance.

Procedure

1. Display the list of enabled ciphers:

   # dsconf <instance_name> security ciphers list --enabled

   Copy to Clipboard Toggle word wrap

2. If you need to enable weak ciphers, enter:

   # dsconf <instance_name> security set --allow-insecure-ciphers on

   Copy to Clipboard Toggle word wrap

3. Update the nsSSL3Ciphers parameter. For example, to enable only the TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 and TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ciphers, enter:

   # dsconf <instance_name> security ciphers set -- "-all,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,+TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"

   Copy to Clipboard Toggle word wrap

   Use -- to avoid that the shell interprets the - character in -all as an option to the command. Do not use a \ character to escape -all because it can create an error and this results in a different cipher selection.

4. Restart the instance:

   # dsctl <instance_name> restart

   Copy to Clipboard Toggle word wrap

Procedure

1. If you need to enable weak ciphers:

   1. Navigate to Server Security Security Configuration.
   2. Select Allow Weak Ciphers.
   3. Click Save Settings.
2. Navigate to Server Security Cipher Preferences.

3. Update the cipher settings. For example, to enable only the TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 and TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ciphers:

   1. Select No Ciphers in the Cipher Suite field.
   2. Enter TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 in the Allow Specific Ciphers field.
4. Click Save Settings.
5. Click Actions Restart Instance.

Procedure

1. Use the following command to change the trust flags of a CA certificate:

   # dsconf <instance_name> security ca-certificate set-trust-flags "Example CA" --flags "trust_flags"

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to Server Security Certificate Management Trusted Certificate Authorities.
2. Click the Options menu (⋮) next to the CA certificate, and select Edit Trust Flags.

3. Select the trust flags.

   

   View larger image

   
4. Click Save Flags

Verification

1. Navigate to Server Security Certificate Management Trusted Certificate Authorities.
2. Click > next to the CA certificate to display the trust flags.

Procedure

1. Create a private key and a certificate signing request (CSR). Skip this step if you want to create them using an external utility.

   • If your host is reachable only by one name, enter:

     # dsctl <instance_name> tls generate-server-cert-csr -s "CN=server.example.com,O=example_organization"

     Copy to Clipboard Toggle word wrap

   • If your host is reachable by multiple names:

     # dsctl <instance_name> tls generate-server-cert-csr -s "CN=server.example.com,O=example_organization" server.example.com server.example.net

     Copy to Clipboard Toggle word wrap

     If you specify the host names as the last parameter, the command adds the Subject Alternative Name (SAN) extension with the DNS:server.example.com, DNS:server.example.net entries to the CSR.

   The string specified in the -s subject parameter must be a valid subject name according to RFC 1485. The CN field in the subject is required, and you must set it to one of the fully-qualified domain names (FQDN) of the server. The command stores the CSR in the /etc/dirsrv/slapd-<instance_name>/Server-Cert.csr file.

2. Submit the CSR to the certificate authority (CA) to get a certificate issued. For further details, see your CA’s documentation.
3. Store both the CA certificate and the server certificate in the /root/ directory.

4. Import the server certificate issued by the CA to the NSS database, using one of the following options:

   • If you created the private key using the dsctl tls generate-server-cert-csr command, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com security certificate add --file /root/instance_name.crt --name "server-cert" --primary-cert

     Copy to Clipboard Toggle word wrap

     Remember the name of the certificate you set in the --name _certificate_nickname parameter. You require it in a later step.

   • If you created the private key using an external utility, import the server certificate and the private key:

     # dsctl <instance_name> tls import-server-key-cert /root/server.crt /root/server.key

     Copy to Clipboard Toggle word wrap

     Note that the command requires you to specify the path to the server certificate first and then the path to the private key. This method always sets the nickname of the certificate to Server-Cert.

5. Import the CA certificate to the NSS database:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security ca-certificate add --file /root/ca.crt --name "Example CA"

   Copy to Clipboard Toggle word wrap

6. Set the trust flags of the CA certificate:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security ca-certificate set-trust-flags "Example CA" --flags "CT,,"

   Copy to Clipboard Toggle word wrap

   This configures Directory Server to trust the CA for TLS encryption and certificate-based authentication.

7. Stop the instance:

   # dsctl <instance_name> stop

   Copy to Clipboard Toggle word wrap

8. Edit the /etc/dirsrv/slapd-<instance_name>/dse.ldif file, and remove the following entries including their attributes:

   • cn=AES,cn=encrypted attribute keys,cn=database_name,cn=ldbm database,cn=plugins,cn=config
   • cn=3DES,cn=encrypted attribute keys,cn=database_name,cn=ldbm database,cn=plugins,cn=config
   Important

   Remove the entries for all databases. If any entry that contains the nsSymmetricKey attribute is left in the /etc/dirsrv/slapd-<instance_name>/dse.ldif file, Directory Server will fail to start.

9. Start the instance:

   # dsctl <instance_name> start

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a /etc/dirsrv/slapd-<instance_name>/certmap.conf file to map information from the certificate to Directory Server users:

   certmap default         default
   default:DNComps         dc
   default:FilterComps     mail,cn
   default:VerifyCert      on
   
   certmap example         cn=Example CA
   example:DNComps

   Copy to Clipboard Toggle word wrap

   With this configuration, for certificates issued by cn=Example CA, Directory Server does not generate a base DN from the subject of the certificate because the DNComps parameter is set empty for this issuer. Additionally, the settings for the FilterComps and VerifyCert are inherited from the default entry.

   Certificates that have a different issuer DN than cn=Example CA will use the settings from the default entry and generate the base DN based on the cn attributes in the subject of the certificate. This enables Directory Server to start the search under a specific DN, without searching the whole directory.

   For all certificates, Directory Server generates the search filter using the mail and the cn attribute from the certificate’s subject. However, if the mail attribute does not exist in the subject, Directory Server will automatically use the value of the certificate’s e attribute in the subject.

2. Enable certificate-based authentication. For example, to configure certificate-based authentication as optional, enter:

   # dsconf <instance_name> security set --tls-client-auth="allowed"

   Copy to Clipboard Toggle word wrap

   Use the --tls-client-auth=required option to configure certificate-based authentication as mandatory.

3. Optional: If you configured certificate-based authentication as required, enable the nsslapd-require-secure-binds parameter:

   # dsconf <instance_name> config replace nsslapd-require-secure-binds=on

   Copy to Clipboard Toggle word wrap

   This setting ensures that users cannot bypass the certificate-based authentication by using an unencrypted connection.

4. Optional: If Directory Server should use the identity from the certificate instead of the credentials in the bind request, configure Directory Server to use the EXTERNAL simple authentication and security layer (SASL) mechanism:

   # dsconf <instance_name> config replace nsslapd-force-sasl-external=on

   Copy to Clipboard Toggle word wrap

   With this setting, Directory Server ignores any other bind method than the identity in the certificate.

5. Restart the instance:

   # dsctl <instance_name> restart

   Copy to Clipboard Toggle word wrap

Procedure

1. If the certificate is not in DER format, convert it. For example, to convert a certificate from privacy enhanced mail (PEM) to DER, enter:

   # openssl x509 -in /home/user_name/certificate.pem -out /home/user_name/certificate.der -outform DER

   Copy to Clipboard Toggle word wrap

2. Add the certificate to the user’s userCertificate attribute:

   # ldapmodify -D "cn=Directory Manager" -W -H ldaps://server.example.com -x
   
   dn: uid=user_name,ou=People,dc=example,dc=com
   changetype: modify
   add: userCertificate
   userCertificate:< file:///home/user_name/example.der

   Copy to Clipboard Toggle word wrap

Verification

1. Authenticate as the user using certificate-based authentication:

   1. Set the following environment variables to the corresponding paths to the CA certificate, the user key, and the user certificate:

      LDAPTLS_CACERT=/home/user_name/CA.crt
      LDAPTLS_KEY=/home/user_name/user.key
      LDAPTLS_CERT=/home/user_name/user.der

      Copy to Clipboard Toggle word wrap

      Alternatively, set the TLS_CACERT, TLS_KEY, and TLS_CERT parameters in the ~/.ldaprc file of the current user.

   2. Connect to the server:

      # ldapwhoami -H ldaps://server.example.com -Y EXTERNAL
      dn: uid=example,ou=people,dc=example,dc=com

      Copy to Clipboard Toggle word wrap

Procedure

1. Enable the RootDN Access Control plug-in:

   # dsconf <instance_name> plugin root-dn enable

   Copy to Clipboard Toggle word wrap

2. Set the bind rules. For example, to allow the Directory Manager account to only log in between 6am and 9pm from the host with IP address 192.0.2.1, enter:

   # dsconf <instance_name> plugin root-dn set --open-time=0600 --close-time=2100 --allow-ip="192.0.2.1"

   Copy to Clipboard Toggle word wrap

   For the full list of parameters you can set and their descriptions, enter:

   # dsconf <instance_name> plugin root-dn set --help

   Copy to Clipboard Toggle word wrap

3. Restart the instance:

   # *dsctl <instance_name> restart`

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to Plugins RootDN Access Control.
2. Enable the plug-in.

3. Fill the fields according to your requirements.

   

   View larger image

   
4. Click Save.
5. Click Actions in the top right corner, and select Restart Instance.