How to Install OpenLDAP Server and Client on Rocky Linux 9

OpenLDAP is a software implementation of the Lightweight Directory Access Protocol (LDAP). OpenLDAP is free and open-source software with its BSD-style license called OpenLDAP Public License. Its command-line drive LDAP software is available on most Linux distributions such as CentOS, Ubuntu, Debian, SUSE, and many more. OpenLDAP is a complete software suite for LDAP servers, which includes SLAPD (standalone LDAP daemon), SLURPD (standalone LDAP update replication daemon), and some utilities and tools for managing LDAP servers. OpenLDAP is a highly customizable LDAP server and supports all major computing platforms.

In this guide, you will install and set up OpenLDAP on a Rocky Linux 9 server. You will install the OpenLDAP server, configure the OpenLDAP server manually, and enable secure SSL/TLS on the OpenLDAP server. You will also add a client machine to the OpenLDAP server via OpenLDAP client and SSSD (System Security Services Daemon). Also, verify your installation by logging in to the client machine via OpenLDAP user.

Prerequisites

To complete this guide, you must have the following requirements:

• A server with at least 4 GB of RAM and 2 CPUs running Rocky Linux 9 system - This example uses a Rocky Linux with the hostname 'ldap' and fqdn 'ldap.hwdomain.lan'.
• A machine that will be used as a client - This example uses a client machine Rocky Linux with the hostname 'client'.
• A non-root user with sudo/root administrator privileges.
• An SELinux running on permissive mode.

Below is the detailed servers that will be used for this guide:

Hostname    IP Address    Used as
-----------------------------------------
ldap        192.168.5.25  OpenLDAP Server
client      192.168.5.80  OpenLDAP Client

When those requirements are ready, you can now start the OpenLDAP installation.

Setup FQDN and /etc/hosts

Before jumping onto the OpenLDAP installation, you must set up the proper fqdn (fully qualified domain name) and the /etc/hosts file on the target server.

Enter the following 'hostnamectl' command to set up the fqdn of your OpenLDAP server. In this example, the fqdn will of the OpenLDAP server will be 'ldap.hwdomain.lan'.

sudo hostnamectl set-hostname ldap.hwdomain.lan

Now open the '/etc/hosts' file using the following nano editor command.

sudo nano /etc/hosts

Add the following line to the file and be sure to change the detail hostname, fqdn, and IP address.

# ip - fqdn - hostname
192.168.5.25 ldap.hwdomain.lan ldap

Save and close the file when finished.

Now enter the following command to verify the fqdn of your server and ensure that the fqdn is pointed to the correct server IP address.

sudo hostname -f
ping -c3 ldap.hwdomain.lan

When successful, you should receive an output similar to this -  The fqdn of the OpenLDAP server is 'ldap.hwdomain.lan', which is pointed to the server IP address '192.168.5.25'.

Now move to the next step to start installing the OpenLDAP server.

Installing OpenLDAP Server

On the latest Rocky Linux 9 server, OpenLDAP packages are available on the 'plus' repository, which is not enabled by default.

In this section, you will install the OpenLDAP server and client to your Rocky Linux server. But before that, you must enable the 'plus' repository on your system.

Enter the following 'dnf config-manager' command to enable the 'plus' repository. Then, verify the list of repositories on your system.

sudo dnf config-manager --set-enabled plus
sudo dnf repolist

You should receive an output like this - The Rocky Linux 'plus' repository is enabled.

Now enter the following 'dnf install' command to install the OpenLDAP server and client packages. When prompted, input y to confirm and press ENTER to proceed.

sudo dnf install openldap-servers openldap-clients

Once OpenLDAP is installed, enter the following systemctl command utility to start and enable the OpenLDAP service 'slapd'. With this, the OpenLDAP should be running with the default configuration and enabled, which means it will start automatically upon the system startup.

sudo systemctl start slapd
sudo systemctl enable slapd

Verify the OpenLDAP service status by entering the following command.

sudo systemctl status slapd

An output 'active (running)' confirms that the OpenLDAP service 'slapd' is running. And the output '...enabled..' confirms that the OpenLDAP will start automatically at system boot.

With the OpenLDAP server installed and running, you will set up the firewalld to add the LDAP and LDAPS service to ensure both service ports are accessible from outside the network.

Setup Firewalld

In this section, you will set up the firewalld to open the LDAP and LDAPS services and ensure both services are accessible from outside networks.

Enter the following 'firewall-cmd' command to add the LDAP and LDAPS services to the firewalld. Then, reload the firewalld to apply the changes. An output 'success' confirms that the new rule was added to the firewalld.

sudo firewall-cmd --add-service={ldap,ldaps} --permanent
sudo firewall-cmd --reload

Now run the following 'firewall-cmd' command to verify the list of enabled services on firewalld.

sudo firewall-cmd --list-all

When you see 'ldap' and 'ldaps' on the 'services' section, that means that both services added to the firewalld will be accessible from outside networks.

Configuring Basic OpenLDAP Server

In this section, you will configure the OpenLDAP server installation. You will set up the password for the OpenLDAP server and import some basic schemas to the OpenLDAP server. These operations can be done via the 'ldapadd' utility provided by the OpenLDAP server package.

Before you begin, enter the following 'slappasswd' command to generate the password hash for your OpenLDAP server. Input your password and repeat, then copy the generated hash password.

slappasswd

Now create a new LDIF file 'changerootpass.ldif' using the following nano editor command. The LDIF or LDAP Data Interchange Format is a file format that contains a set of records of LDAP entries and can be used to update the LDAP server.

nano changerootpass.ldif

Add the following contents to the file and be sure to change the hashed password with your generated password.

dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}Uf13AbVHOcs/aDWJOvDxxfBSl3omExG2

Save and close the file when you're done.

Now run the following 'ldapadd' command to change the OpenLDAP root password via the 'changerootpass.ldif' file.

sudo ldapadd -Y EXTERNAL -H ldapi:/// -f changerootpass.ldif

When successful, you should receive an output similar to this:

Next, enter the following 'ldapadd' command to import basic schemas for the OpenLDAP server.

sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif 
sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif

Output:

Lastly, you can now enter the following systemctl command utility to restart the OpenLDAP service and apply the changes.

sudo systemctl restart slapd

With this, you have now configured the root password and imported basic schemas for the OpenLDAP server. In the next step, you will set up the default DN (Distinguished Name) and the Base Group and Organization entries on the OpenLDAP server.

Configuring Base Domain

In this section, you will set up the base DN (Domain Name) via LDIF file for your OpenLDAP server. In this example, the base dn for OpenLDAP is 'hwdomain.lan'.

Create a new file 'setdomain.ldif' using the following nano editor command.

nano setdomain.ldif

Add the following contents to the file and be sure to change the base dn 'dc=hwdomain,dc=lan' with your domain. Also, be sure to change the hashed password with your generated root password.

# setdomain.ldif

dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
  read by dn.base="cn=Manager,dc=hwdomain,dc=lan" read by * none

dn: olcDatabase={2}mdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=hwdomain,dc=lan

dn: olcDatabase={2}mdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=hwdomain,dc=lan

dn: olcDatabase={2}mdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}Uf13AbVHOcs/aDWJOvDxxfBSl3omExG2

dn: olcDatabase={2}mdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
  dn="cn=Manager,dc=hwdomain,dc=lan" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=hwdomain,dc=lan" write by * read

Save and close the file when finished.

Now enter the following 'ldapmodify' command to apply the new dn for your OpenLDAP server. In this, you've used the 'ldapmodify' instead of 'ldapadd' because you want to modify the current OpenLDAP server.

sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f setdomain.ldif

When successful, you should receive an output like this.

You can now enter the following 'ldapsearch' command to verify the base dn of your OpenLDAP server. The base dn of the OpenLDAP server is stored at 'namingContexts'.

sudo ldapsearch -H ldap:// -x -s base -b "" -LLL "namingContexts"

When successful, you should get the base dn of your OpenLDAP server. The base dn for the OpenLDAP server for this example is 'dn=hwdomain,dn=lan' or 'hwdomain.lan'.

After you have configured the base dn, you will next set up the base group and organization, where you can store OpenLDAP users on top of it. The way to achieve that is similar to the way of setting up the base dn.

Configuring Base Group and Organization

In this example, you will set up two base groups for your OpenLDAP server. You will add two 'ou' or organization unit called 'People' and 'Group' via the LDIF file. You will store all of your OpenLDAP users within these ou, People, and Group.

Enter the following nano editor command to create a new file 'addou.ldif'.

nano addou.ldif

Add the following contents to the file and be sure to change the base domain name with your domain.

# addou.ldif

dn: dc=hwdomain,dc=lan
objectClass: top
objectClass: dcObject
objectclass: organization
o: My hwdomain Organisation
dc: hwdomain

dn: cn=Manager,dc=hwdomain,dc=lan
objectClass: organizationalRole
cn: Manager
description: OpenLDAP Manager

dn: ou=People,dc=hwdomain,dc=lan
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=hwdomain,dc=lan
objectClass: organizationalUnit
ou: Group

Save and close the file when finished.

Next, enter the following 'ldapadd' command to add the ou 'People' and 'Group'. When prompted for the password, input the OpenLDAP server password.

sudo ldapadd -x -D cn=Manager,dc=hwdomain,dc=lan -W -f addou.ldif

When the operation success, you should receive an output similar to this.

Verify the list of 'ou' on your OpenLDAP server by entering the following 'ldapsearch' command to your terminal.

sudo ldapsearch -x -b "dc=hwdomain,dc=lan" ou

You should see the two ou called 'People' and 'Group' are added and available on the OpenLDAP server.

At this point, you have added and configured the base dn or domain name, two ou or organization unit for the OpenLDAP server. In the next step, you will learn how to add a new user via the LDIF file.

Adding New User to OpenLDAP Server

In this section, you will add and set up a new user in OpenLDAP via the LDIF file. The steps are simple, you just need to generate the hashed password via 'slappasswd', then create a new LDIF file for adding a user, then run the 'ldapadd' command to add the new user to the OpenLDAP server.

First, enter the following 'slappasswd' command to generate the hash password for the new user. Input your password and repeat, then copy the generated password.

slappasswd

Now enter the following nano editor command to create a new file 'adduser.ldif'.

nano adduser.ldif

Add the following contents to the file and be sure to change the username, password, and the default dn. in this example, you will create a new user called 'rocky' and will be part of the ou 'People'.

# adduser.ldif

dn: uid=rocky,ou=People,dc=hwdomain,dc=lan
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: rocky
sn: temp
userPassword: {SSHA}cDG5NuQd+rYn6rWh1r5UnysUOwJlt1uk
loginShell: /bin/bash
uidNumber: 2000
gidNumber: 2000
homeDirectory: /home/rocky
shadowLastChange: 0
shadowMax: 0
shadowWarning: 0

dn: cn=rocky,ou=Group,dc=hwdomain,dc=lan
objectClass: posixGroup
cn: rocky
gidNumber: 2000
memberUid: rocky

Save and close the file when finished.

Now enter the following 'ldapadd' command to add your new user via the 'adduser.ldif' file.

sudo ldapadd -x -D cn=Manager,dc=hwdomain,dc=lan -W -f adduser.ldif

Input the OpenLDAP server when prompted, and when successful, you should receive an output like this.

Enter the following 'ldapsearch' command to verify the new user 'rocky' and ensure that it's added and available on your OpenLDAP server. This command will print out all available users on the ou 'People'.

sudo ldapsearch -x -b "ou=People,dc=hwdomain,dc=lan"

Output like this confirms that the OpenLDAP user 'rocky' is created and added to the OpenLDAP server.

Securing OpenLDAP with SSL/TLS

In this section, you will set up and enable secure LDAPS on the OpenLDAP server. You will generate SSL/TLS certificates that will be used by the OpenLDAP server, then set up OpenLDAP to use SSL/TLS certificates and enable the secure LDAPS protocol.

Enter the following 'openssl' command to generate the SSL/TLS Self-Signed certificates. Input detailed information about your certificates, when finished, your certificates will be stored in the '/etc/pki/tls/' directory.

sudo openssl req -x509 -nodes -days 365 \
  -newkey rsa:2048 \
  -keyout /etc/pki/tls/ldapse