OpenLDAP integration with SonicWall firewall

Install OpenLDAP Packages

On CentOS and RedHat, use yum install as shown below, to install the openldap related packages.

yum install -y openldap openldap-clients openldap-servers

You should install the following three packages:

1.    openldap-servers – This is the main LDAP server

2.    openldap-clients – This contains all required LDAP client utilities

3.    openldap – This packages contains the LDAP support libraries

Create olcRootDN Account as Admin

It is always recommended to create a dedicated user account first with the full permissions to change information on the LDAP database.

Modify the olcDatabase={2}bdb.ldif file, and change the olcRootDN entry. The following is the default entry.

# grep olcRootDN /etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb.ldif

olcRootDN: cn=Manager,dc=my-domain,dc=com

Change the above line to an admin user. In this example, user “ramesh” will be the olcRootDN.

olcRootDN: cn=ramesh,dc=aeri,dc=com

Create olcRootPW Root Password

Now use slappasswd command to create a hash for the root password you want to use. Once the password is generated, open the cn=config.ldif file, include the olcRootPW parameter, and copy the hashed password as shown below.

Execute the following command and specify a password. This will generate the hash for the given password.

# slappasswd

New password: SecretLDAPRootPass2015

Re-enter new password: SecretLDAPRootPass2015

{SSHA}1pgok6qWn24lpBkVreTDboTr81rg4QC6

Take the hash output of the above command and add it to the oclRootPW parameter in the config.ldif file as shown below.

# vi /etc/openldap/slapd.d/cn=config.ldif

olcRootPW: {SSHA}1pgok6qWn24lpBkVreTDboTr81rg4QC6

Create olcSuffix Domain Name

Now setup the olcSuffix and to set the domain that you want. Simply modify the line that starts with olcSuffix in the file olcDatabase={2}bdb.ldif as shown below.

# vi /etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb.ldif

olcSuffix: dc=aeri,dc=com

Verify The Configuration Files

Use slaptest command to verify the configuration file as shown below. This should display “testing succeeded” message as shown below.

# slaptest -u

config file testing succeeded

You might get the following messages during the above command, which you can ignore for now.

54a39508 ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif"

54a39508 ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb.ldif"

Start the LDAP Server

Start the ldap server as shown below.

# service slapd start

Checking configuration files for slapd: [WARNING]

config file testing succeeded

Starting slapd:                         [  OK  ]

Verify the LDAP Search

To verify the ldap server is configured successfully, you can use the below command and verify that the domain entry is present.

# ldapsearch -x -b "dc=aeri,dc=com"

# extended LDIF

#

# LDAPv3

# base <dc=aeri,dc=com> with scope subtree

# filter: (objectclass=*)

# requesting: ALL

#

# search result

search: 2

result: 32 No such object

# numResponses: 1

Base LDAP Structure in base.ldif

The use of OU (organizational unit) objects can help you in providing additional structure to the LDAP database. If you are planning on adding in different types of entries, such as users, groups, computers, printers and more to the LDAP directory, it makes it easier to put every entry type into its own container.

To create these OU’s, you can create an initial LDIF file as shown in the below example. In this example, this file allows you to create the base container which is dc=aeri,dc=com and it creates two organizational units with the names users and groups in that container.

# cat base.ldif

dn: dc=aeri,dc=com

objectClass: dcObject

objectClass: organization

o: aeri.com

dc: aeri

dn: ou=users,dc=aeri,dc=com

objectClass: organizationalUnit

objectClass: top

ou: users

dn: ou=groups,dc=aeri,dc=com

objectClass: organizationalUnit

objectClass: top

ou: groups

Import Base Structure Using ldapadd

Now we can import the base structure in to the LDAP directory using the ldapadd command as shown below.

# ldapadd -x -W -D "cn=ramesh,dc=aeri,dc=com" -f base.ldif

Enter LDAP Password:

adding new entry "dc=aeri,dc=com"

adding new entry "ou=users,dc=aeri,dc=com"

adding new entry "ou=groups,dc=aeri,dc=com"

Verify the Base Structure using ldapsearch

To verify the OUs are successfully created, use the following ldapsearch command.

# ldapsearch -x -W -D "cn=ramesh,dc=aeri,dc=com" -b "dc=aeri,dc=com" "(objectclass=*)"

Enter LDAP Password:

The output of the above command will display all the objects in the LDAP directory structure.

# extended LDIF

#

# LDAPv3

# base <dc=aeri,dc=com> with scope subtree

# filter: (objectclass=*)

# requesting: ALL

#

# aeri.com

dn: dc=aeri,dc=com

objectClass: dcObject

objectClass: organization

o: aeri.com

dc: aeri

# users, aeri.com

dn: ou=users,dc=aeri,dc=com

objectClass: organizationalUnit

objectClass: top

ou: users

# groups, aeri.com

dn: ou=groups,dc=aeri,dc=com

objectClass: organizationalUnit

objectClass: top

ou: groups

# search result

search: 2

result: 0 Success

# numResponses: 4

# numEntries: 3

In the next OpenLDAP article, we’ll explain how to add new users and groups to the LDAP Directory.

1.    ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif

2.    ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif

3.    ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif

Change LDAP Password for the user:

ldappasswd -s kanna@123 -W -D “cn=Manager,dc=aeri,dc=local” -x “uid=kanna,ou=Employees,dc=aeri,dc=local”

Login to Firewall: