Configuring OpenLdap

Linux on Servers
1

Hi, Everyone.

I am in trying to learn Openldap and following a video tutorial by theurbanpenguin. In his tutorial he created a file called “configure.ldif” in this file he added the following:

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=example,dc=com
			
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=example,dc=com
			
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootPW
#Password is Password1 or add your own
olcRootPW: {SSHA}EJESqvRThIecvYYkIU1NXr8niuNvaotm
			
dn: cn=config
changetype: modify
replace: olcLogLevel
olcLogLevel: 0
			
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=example,dc=com" read by * none

My problem with this is with the “olcRootPW” if I use the actual password in that area and then execute the command:

ldapmodify -Y EXTERNAL -H ldapi:/// -f config1.ldif

and then perform an ldapadd

ldapadd -x -W -D "cn=Manager,dc=example,dc=com" -f structure.ldif

It accepts the password that I enter but if I replace the value of “olcRootPW” with a hash that was generated by

slappasswd -s n0v1ru$123 -n > rootpwd

and ran

ldapadd -x -W -D "cn=Manager,dc=example,dc=com" -f structure.ldif

and

ldapmodify -Y EXTERNAL -H ldapi:/// -f config1.ldif

it does not accept the password that I enter although it is the same password.

If you need more info so you can help me make this work and help me understand what happen, please let me know so I can provide those information.

1 Like
2

It’s been 4 years or so since I last gave OpenLDAP a try. I don’t know if I feel like installing it now. It may be worth it in the long run if I want a unified authentication system, but IMO, with all the hackings going on in the world, I would like the users of my (future) services to have one different account for everything.

3

Thanks for pointing out the possible security flaw but as mention this is for educational purpose and I am trying to follow certification track created by the Urbanpenguin so I need to take this path in order to finish that course. So this will not go into production but a mere educational path for me.

1 Like