Hardening an OpenLDAP Server with LDIF

OpenLDAP is a popular open-source implementation of the LDAP (Lightweight Directory Access Protocol) protocol, which is used to store and manage user and group information in a central directory. LDAP directories are commonly used to store user authentication and authorization information in enterprise environments.

One important aspect of securing an OpenLDAP server is to configure it properly and use secure practices when storing user passwords. In this blog post, we will discuss how to use an LDIF (LDAP Data Interchange Format) file to harden an OpenLDAP server and improve the security of user passwords.

Setting the Root Password

The first step in hardening an OpenLDAP server is to set a strong root password for the LDAP server. The root password is used to authenticate the LDAP server to clients, and to perform administrative tasks such as adding and modifying entries in the LDAP directory.

To set the root password, you can use the following LDIF file:

dn: cn=config
changetype: modify
replace: olcRootPW
olcRootPW: {SSHA}XUfE6Zu1vLVCV7nD2sjuY4YbP2oVxMxX
-

This LDIF file sets the root password to "XUfE6Zu1vLVCV7nD2sjuY4YbP2oVxMxX" using the SSHA (Salted SHA1) password storage scheme. SSHA combines the SHA1 hashing algorithm with a salt value, which helps to protect against dictionary and rainbow table attacks.

However, it is important to note that SSHA is a deprecated algorithm and should not be used for new installations. Instead, you should use a modern and more secure password storage scheme such as Argon2 or PBKDF2 (Password-Based Key Derivation Function 2).

Enabling TLS

Another important step in hardening an OpenLDAP server is to enable TLS (Transport Layer Security) for secure communication between the LDAP client and server. TLS uses encryption to protect the confidentiality and integrity of LDAP traffic.

To enable TLS, you can use the following LDIF file:

dn: cn=config
changetype: modify
add: olcSecurity
olcSecurity: tls=1
-
add: olcTLSCACertificatePath
olcTLSCACertificatePath: /etc/ssl/certs
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/ldap.crt
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/ldap.key
-

Configuring Access Controls

It is important to properly configure access controls to ensure that only authorized users can access the LDAP server and perform certain actions.

To allow only the root user to manage the LDAP server, while allowing all other users to bind to the server and perform searches, you can use the following LDIF file:

dn: cn=config
changetype: modify
add: olcAccess
olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * break
-

This LDIF file adds an access control rule that grants the root user (identified by the gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth DN) the ability to manage the LDAP server, while allowing all other users to bind to the server and perform searches.

Setting the Password Hashing Algorithm

Finally, you should use a secure password hashing algorithm to store user passwords in the LDAP directory. As mentioned earlier, the SSHA algorithm is deprecated and should not be used for new installations. Instead, you should use a modern and more secure algorithm such as Argon2 or PBKDF2.

To set the password hashing algorithm to Argon2, you can use the following LDIF file:

dn: cn=config
changetype: modify
replace: olcPasswordHash
olcPasswordHash: {ARGON2}
-

To set the password hashing algorithm to PBKDF2, you can use the following LDIF file:

dn: cn=config
changetype: modify
replace: olcPasswordHash
olcPasswordHash: {PBKDF2}
-

It is important to note that changing the password hashing algorithm may cause existing passwords to become invalid. You should make sure to update all user passwords after changing the password hashing algorithm.

Applying the LDIF File

To apply the LDIF file to your OpenLDAP server, you can use the ldapmodify command:

ldapmodify -H ldap://ldap.example.com -D "cn=config" -w rootpassword -f harden.ldif

Replace ldap.example.com with the hostname or IP address of your LDAP server, and rootpassword with the root password you set in the LDIF file.

In conclusion, using an LDIF file to harden an OpenLDAP server can help to improve the security of your LDAP directory by setting a strong root password, enabling TLS, configuring access controls, and using a secure password hashing algorithm. By following these best practices, you can help to protect your LDAP directory and the sensitive information it stores.