How To Install OpenLDAP Server on CentOS 8 / RHEL 8

This tutorial will cover how to install OpenLDAP on CentOS 8 | RHEL 8. LDAP is a lightweight domain authentication protocol. This means that you can use LDAP as a central authentication system for both users and systems such as Postfix. It can be compared to Microsoft’s Active Directory. OpenLDAP is an opensource LDAP system that runs on Linux systems.

Install OpenLDAP on CentOS 8 | RHEL 8

In this guide, we shall build the latest source release of OpenLDAP as opposed to using the available version provided by PowerTools.

Follow the steps below to setup OpenLDAP server on CentOS 8 | RHEL 8.

1. Update System

Run system updates and upgrade the packages.

sudo dnf update -y

Reboot after upgrade:

sudo reboot

2. Install required software Packages

Install the required packages that will allow you to successfully build OpenLDAP.

sudo dnf install wget vim cyrus-sasl-devel libtool-ltdl-devel openssl-devel libdb-devel make libtool autoconf  tar gcc perl perl-devel -y

3. Create LDAP system account

We need to create a non-privileged system user for OpenLDAP.

sudo useradd -r -M -d /var/lib/openldap -u 55 -s /usr/sbin/nologin ldap

4. Download OpenLDAP Source file

Download the latest release from this page.

We’ll declare the version to your shell

VER=2.6.7
wget https://www.openldap.org/software/download/OpenLDAP/openldap-release/openldap-$VER.tgz

Extract the downloaded file:

tar xzf openldap-$VER.tgz

5. Build and Install OpenLDAP

Move the extracted files to /opt/ then compile the source files.

sudo mv openldap-$VER /opt

Change your working directory to OpenLDAP source.

cd /opt/openldap-$VER

Install Development Tools:

sudo dnf groupinstall "Development Tools" -y

Compile the source files

sudo ./configure --prefix=/usr --sysconfdir=/etc \
--enable-debug --with-tls=openssl --with-cyrus-sasl --enable-dynamic \
--enable-crypt --enable-spasswd --enable-slapd --enable-modules \
--enable-rlookups

Upon successful compilation, you should see an output that says: “Please run “make depend” to build dependencies”

Run make depend to build OpenLDAP dependencies.

sudo make depend

Compile OpenLDAP.

sudo make

Install OpenLDAP on CentOS 8 / CentOS Stream 8:

sudo make install

A successful installation creates configuration files at /etc/openldap. The following files are available after installation:

$ ls /etc/openldap
certs  ldap.conf  ldap.conf.default  schema  slapd.conf  slapd.conf.default  slapd.ldif  slapd.ldif.default

6. Configuring OpenLDAP server

Let’s proceed to configuring OpenLDAP.

First, we need to create OpenLDAP database directories.

sudo mkdir /var/lib/openldap /etc/openldap/slapd.d

Set the proper permisions to he OpenLDAP directories

sudo chown -R ldap:ldap /var/lib/openldap
sudo chown root:ldap /etc/openldap/slapd.conf
sudo chmod 640 /etc/openldap/slapd.conf

Create OpenLDAP SUDO schema

Check if your sudo version supports LDAP.

sudo -V |  grep -i "ldap"

You should see the lines below in the output if your system supports LDAP.

ldap.conf path: /etc/sudo-ldap.conf
ldap.secret path: /etc/ldap.secret

Confirm if LDAP sudo schema is available on your system

rpm -ql sudo |  grep -i schema.openldap

Sample output

/usr/share/doc/sudo/schema.OpenLDAP

Copy the schema to the ldap schema directory.

sudo cp /usr/share/doc/sudo/schema.OpenLDAP  /etc/openldap/schema/sudo.schema

Create a sudo schema ldif file.

sudo su -

Run below to add lines to the file:

cat << 'EOL' > /etc/openldap/schema/sudo.ldif
dn: cn=sudo,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: sudo
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who may  run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Command(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s) impersonated by sudo (deprecated)' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Options(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.6 NAME 'sudoRunAsUser' DESC 'User(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.7 NAME 'sudoRunAsGroup' DESC 'Group(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcObjectClasses: ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top STRUCTURAL DESC 'Sudoer Entries' MUST ( cn ) MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoRunAsUser $ sudoRunAsGroup $ sudoOption $ description ) )
EOL

Configure SLAPD database

Update the content of the /etc/openldap/slapd.ldif

sudo mv /etc/openldap/slapd.ldif /etc/openldap/slapd.ldif.bak
sudo vi /etc/openldap/slapd.ldif

Paster below data:

dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/lib/openldap/slapd.args
olcPidFile: /var/lib/openldap/slapd.pid

dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema

dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulepath: /usr/libexec/openldap
olcModuleload: back_mdb.la

# Include more schemas in addition to default core
include: file:///etc/openldap/schema/core.ldif
include: file:///etc/openldap/schema/cosine.ldif
include: file:///etc/openldap/schema/nis.ldif
include: file:///etc/openldap/schema/inetorgperson.ldif
include: file:///etc/openldap/schema/sudo.ldif

dn: olcDatabase=frontend,cn=config
objectClass: olcDatabaseConfig
objectClass: olcFrontendConfig
olcDatabase: frontend
olcAccess: to dn.base="cn=Subschema" by * read
olcAccess: to * 
  by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage 
  by * none

dn: olcDatabase=config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: config
olcRootDN: cn=config
olcAccess: to * 
  by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage 
  by * none

Perform a dry run to check the configurarion

$ sudo slapadd -n 0 -F /etc/openldap/slapd.d -l /etc/openldap/slapd.ldif -u
Closing DB...

Execute the command to write the changes

sudo slapadd -n 0 -F /etc/openldap/slapd.d -l /etc/openldap/slapd.ldif

The above command creates slapd database configurations and puts them under /etc/openldap/slapd.d.

$ ls /etc/openldap/slapd.d
'cn=config'  'cn=config.ldif'

Set the right ownership to the slapd directory

sudo chown -R ldap:ldap /etc/openldap/slapd.d

Create OpenLDAP Service

Create a systemd service

$ sudo vim /etc/systemd/system/slapd.service
[Unit]
Description=OpenLDAP Server Daemon
After=syslog.target network-online.target
Documentation=man:slapd
Documentation=man:slapd-mdb

[Service]
Type=forking
PIDFile=/var/lib/openldap/slapd.pid
Environment="SLAPD_URLS=ldap:/// ldapi:/// ldaps:///"
Environment="SLAPD_OPTIONS=-F /etc/openldap/slapd.d"
ExecStart=/usr/libexec/slapd -u ldap -g ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS

[Install]
WantedBy=multi-user.target

Restart daemon

sudo systemctl daemon-reload

Start slapd service

sudo systemctl enable --now slapd

Check status

$ systemctl status slapd
● slapd.service - OpenLDAP Server Daemon
   Loaded: loaded (/etc/systemd/system/slapd.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2023-10-25 12:18:26 UTC; 1min 7s ago
     Docs: man:slapd
           man:slapd-mdb
 Main PID: 82272 (slapd)
    Tasks: 2 (limit: 22612)
   Memory: 3.0M
   CGroup: /system.slice/slapd.service
           └─82272 /usr/libexec/slapd -u ldap -g ldap -h ldap:/// ldapi:/// ldaps:/// -F /etc/openldap/slapd.d

Oct 25 12:18:26 rocky8.mylab.io systemd[1]: Starting OpenLDAP Server Daemon...
Oct 25 12:18:26 rocky8.mylab.io slapd[82271]: @(#) $OpenLDAP: slapd 2.6.6 (Oct 25 2023 12:15:26) $
                                                      [email protected]:/opt/openldap-2.6.6/servers/slapd
Oct 25 12:18:26 rocky8.mylab.io slapd[82272]: slapd starting
Oct 25 12:18:26 rocky8.mylab.io systemd[1]: Started OpenLDAP Server Daemon.

Configure OpenLDAP Default Root DN

Create MDB database with the root DN and the ACLs.

Generate root password:

$ sudo slappasswd
New password:
Re-enter new password:
{SSHA}MnsvmiMXvuXOHjDJi/rrqYra/1qo+hHE

Copy the generated hash password to a text editor. This will be needed in the rootdn.ldif file at the olcRootPW entry.

vim rootdn.ldif

Add the content below replacing dc=ldapmaster,dc=computingforgeeks,dc=com with your domain information. and olcRootPW with generated password value.

dn: olcDatabase=mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: mdb
olcDbMaxSize: 42949672960
olcDbDirectory: /var/lib/openldap
olcSuffix: dc=ldapmaster,dc=computingforgeeks,dc=com
olcRootDN: cn=admin,dc=ldapmaster,dc=computingforgeeks,dc=com
olcRootPW: {SSHA}MnsvmiMXvuXOHjDJi/rrqYra/1qo+hHE
olcDbIndex: uid pres,eq
olcDbIndex: cn,sn pres,eq,approx,sub
olcDbIndex: mail pres,eq,sub
olcDbIndex: objectClass pres,eq
olcDbIndex: loginShell pres,eq
olcDbIndex: sudoUser,sudoHost pres,eq
olcAccess: to attrs=userPassword,shadowLastChange,shadowExpire
  by self write
  by anonymous auth
  by dn.subtree="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage 
  by dn.subtree="ou=system,dc=ldapmaster,dc=computingforgeeks,dc=com" read
  by * none
olcAccess: to dn.subtree="ou=system,dc=ldapmaster,dc=computingforgeeks,dc=com" by dn.subtree="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
  by * none
olcAccess: to dn.subtree="dc=ldapmaster,dc=computingforgeeks,dc=com" by dn.subtree="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
  by users read 
  by * none

Update the slapd database

$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f rootdn.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "olcDatabase=mdb,cn=config"

7. Define your Organization structure

Create the basedn.ldif file to define your organization structure.

vim basedn.ldif

With info similar to below – update to suit your domain.

dn: dc=ldapmaster,dc=computingforgeeks,dc=com
objectClass: dcObject
objectClass: organization
objectClass: top
o: computingforgeeks
dc: ldapmaster

dn: ou=groups,dc=ldapmaster,dc=computingforgeeks,dc=com
objectClass: organizationalUnit
objectClass: top
ou: groups

dn: ou=people,dc=ldapmaster,dc=computingforgeeks,dc=com
objectClass: organizationalUnit
objectClass: top
ou: people

Update database:

$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f basedn.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "dc=ldapmaster,dc=computingforgeeks,dc=com"

adding new entry "ou=groups,dc=ldapmaster,dc=computingforgeeks,dc=com"

adding new entry "ou=people,dc=ldapmaster,dc=computingforgeeks,dc=com"

8. Configure OpenLDAP SSL/TLS (Optional)

You can secure client-server communication between OpenLDAP and the client systems by enabling TLS/SSL.

You could use a self signed cert or Let’s Encrypt for this. We shall be using a self signed cert in this guide.

sudo openssl req -x509 -nodes -days 365 \
  -newkey rsa:2048 \
  -keyout /etc/pki/tls/ldapserver.key \
  -out /etc/pki/tls/ldapserver.crt

Set correct ownership.

sudo chown ldap:ldap /etc/pki/tls/{ldapserver.crt,ldapserver.key}

Create SSL configuration file:

sudo vi add-tls.ldif

With below information:

dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/pki/tls/ldapserver.crt
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/pki/tls/ldapserver.key
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/pki/tls/ldapserver.crt

Update slapd database

sudo ldapadd -Y EXTERNAL -H ldapi:/// -f add-tls.ldif

Update the CA locatin for OpenLDAP.

$ sudo vim /etc/openldap/ldap.conf
...
#TLS_CACERT     /etc/pki/tls/cert.pem
TLS_CACERT     /etc/pki/tls/ldapserver.crt

9. Create OpenLDAP Users

Define your users in the users.ldif file as follows:

vim users.ldif

Here is sample data:

dn: uid=user1,ou=people,dc=ldapmaster,dc=computingforgeeks,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: user1
cn: Test
sn: User1
loginShell: /bin/bash
uidNumber: 10000
gidNumber: 10000
homeDirectory: /home/user1
shadowMax: 60
shadowMin: 1
shadowWarning: 7
shadowInactive: 7
shadowLastChange: 0

dn: cn=user1,ou=groups,dc=ldapmaster,dc=computingforgeeks,dc=com
objectClass: posixGroup
cn: user1
gidNumber: 10000
memberUid: user1

Update the LDAP database to add the new user

$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f users.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "uid=user1,ou=people,dc=ldapmaster,dc=computingforgeeks,dc=com"

adding new entry "cn=user1,ou=groups,dc=ldapmaster,dc=computingforgeeks,dc=com"

Set the password for the user above with the command below:

sudo ldappasswd -H ldapi:/// -Y EXTERNAL -S "uid=user1,ou=people,dc=ldapmaster,dc=computingforgeeks,dc=com"

Output example:

New password:
Re-enter new password:
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0

Create LDAP Bind user

Create the OpenLDAP Bind DN and bind user. This is a user that will be used to perform LDAP openrations such as resolving user IDs and group IDs.

Create the BindDN password.

$ sudo slappasswd
New password: 
Re-enter new password: 
{SSHA}YPkUdvnqpYcHM5mMKH6YWMb0AY36OJCd

Obtain the hashed password and save it somewhere.

Create the bindDNuser.ldif file and add the content below, remember to replace the hashed password and the domain information with your details.

vim bindDNuser.ldif

Here is my configurations:

dn: ou=system,dc=ldapmaster,dc=computingforgeeks,dc=com
objectClass: organizationalUnit
objectClass: top
ou: system

dn: cn=readonly,ou=system,dc=ldapmaster,dc=computingforgeeks,dc=com
objectClass: organizationalRole
objectClass: simpleSecurityObject
cn: readonly
userPassword: {SSHA}YPkUdvnqpYcHM5mMKH6YWMb0AY36OJCd
description: Bind DN user for LDAP Operations

Update ldap database:

$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f bindDNuser.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "ou=system,dc=ldapmaster,dc=computingforgeeks,dc=com"

adding new entry "cn=readonly,ou=system,dc=ldapmaster,dc=computingforgeeks,dc=com"

10. Allow OpenLDAP through Firewall

Allow OpenLDAP through the firewall to allow connections.

sudo firewall-cmd --add-service={ldap,ldaps} --permanent
sudo firewall-cmd --reload

At this point, OpenLDAP is configured and ready for use. You need to configure OpenLDAP clients on your systems to be able to connect to the OpenLDAP server.

OpenLDAP Replication guides:

• Setup OpenLDAP Multi-Master Replication on CentOS 8
• setup OpenLDAP Provider-Consumer replication

Follow the guide below to configure OpenLDAP clients:

• Configure LDAP Client on Ubuntu