OpenLDAP Centos 7 LDAP 服务器请求密码

Question

我正在尝试设置使用 TLS（2.4.39 和 Centos 7）运行的 OpenLDAP。当客户端发送 ldapsearch 请求时，服务器会以某种方式提示输入密码/密码。运行“slapd”输出时见下文（最后要求输入密码）。我一定是在设置 Mozilla nss 证书时做错了什么？

# slapd -u ldap -h ldaps:// -d -1
...
55305109 slapd startup: initiated.
55305109 backend_startup_one: starting "cn=config"
55305109 config_back_db_open
Backend ACL: access to *
    by * none

55305109 config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context
55305109 backend_startup_one: starting "dc=xxxxxxx,dc=com"
55305109 bdb_db_open: "dc=xxxxxxx,dc=com"
55305109 bdb_db_open: database "dc=xxxxxxx,dc=com": dbenv_open(/var/lib/ldap/xxxxxxx.com).
55305109 bdb_monitor_db_open: monitoring disabled; configure monitor database to enable
55305109 slapd starting
55305109 daemon: added 4r listener=(nil)
55305109 daemon: added 7r listener=0x7fb461bbd430
55305109 daemon: added 8r listener=0x7fb461bbd530
55305109 daemon: epoll: listen=7 active_threads=0 tvp=zero
55305109 daemon: epoll: listen=8 active_threads=0 tvp=zero
55305109 daemon: activity on 1 descriptor
55305109 daemon: activity on:55305109 
55305109 daemon: epoll: listen=7 active_threads=0 tvp=zero
55305109 daemon: epoll: listen=8 active_threads=0 tvp=zero
55305156 daemon: activity on 1 descriptor
55305156 daemon: activity on:55305156 
55305156 slap_listener_activate(7): 
55305156 daemon: epoll: listen=7 busy
55305156 daemon: epoll: listen=8 active_threads=0 tvp=zero
55305156 >>> slap_listener(ldaps://)
55305156 daemon: activity on 1 descriptor
55305156 daemon: activity on:55305156 
55305156 daemon: epoll: listen=7 active_threads=0 tvp=zero
55305156 daemon: epoll: listen=8 active_threads=0 tvp=zero
55305156 daemon: listen=7, new connection on 15
55305156 daemon: added 15r (active) listener=(nil)
55305156 conn=1000 fd=15 ACCEPT from IP=10.42.0.215:50115 (IP=0.0.0.0:636)
55305156 daemon: activity on 1 descriptor
55305156 daemon: activity on:55305156 
55305156 daemon: epoll: listen=7 active_threads=0 tvp=zero
55305156 daemon: epoll: listen=8 active_threads=0 tvp=zero
55305156 daemon: activity on 1 descriptor
55305156 daemon: activity on:55305156  15r55305156 
55305156 daemon: read active on 15
55305156 daemon: epoll: listen=7 active_threads=0 tvp=zero
55305156 daemon: epoll: listen=8 active_threads=0 tvp=zero
55305156 connection_get(15)
55305156 connection_get(15): got connid=1000
55305156 connection_read(15): checking for input on id=1000
TLS: certdb config: configDir='/etc/openldap/certs' tokenDescription='ldap(0)' certPrefix='' keyPrefix='' flags=readOnly
TLS: using moznss security dir /etc/openldap/certs prefix .
TLS: certificate 'Server-Cert' successfully loaded from moznss database.
TLS: no unlocked certificate for certificate 'CN=ldapserver.xxxxxxx.com'.
Please enter pin, password, or pass phrase for security token 'ldap(0)': 
TLS: certificate [CN=ldapserver.xxxxxxx.com] is valid
tls_read: want=3, got=3
  0000:  16 03 01                                           ...               
tls_read: want=2, got=2
  0000:  00 ae                                                ..                
tls_read: want=174, got=174

...

这是生成的证书：

# cd /etc/openldap/certs
# echo 12345 > password
# certutil -N -d . -f password 
# certutil -S -n "CA certificate" -s "cn=CAcert, dc=xxxxxxx,dc=com" -2 -x -t "CT,," -m 1000 -v 120 -d . -k rsa -f password 
# certutil -S -n "Server-Cert" -s "cn=ldapserver.xxxxxxx.com" -c "CA certificate" -t "u,u,u" -m 1001 -v 120 -d . -k rsa -f password

# # export the certificate for client
# stored in client machine /etc/openldap/certs/
# certutil -d . -L -n "CA certificate" -a > cacert.pem

客户端 /etc/openldap/ldap.conf 包含：

BASE dc=xxxxxxx,dc=com
URI ldaps://10.42.0.1
TLS_CACERT    /etc/openldap/certs/cacert.pem
TLS_CIPHER_SUITE ALL:!NULL

（编辑：） 服务器/etc/openldap/slapd.conf：

include     /etc/openldap/schema/core.schema
include     /etc/openldap/schema/cosine.schema
include     /etc/openldap/schema/inetorgperson.schema
include     /etc/openldap/schema/nis.schema

TLSCACertificatePath    /etc/openldap/certs
TLSCertificateFile  Server-Cert
TLSCipherSuite        ALL:!NULL
TLSVerifyClient       never
disallow          bind_anon
#require              bind
#security         simple_bind=128

database    bdb
suffix      "dc=xxxxxxx,dc=com"
rootdn      "cn=ldapadmin,dc=xxxxxxx,dc=com"
rootpw      {SSHA}B1auWTJT2Prj9kOlci1vqALlROb48iBu
directory   /var/lib/ldap/xxxxxxx.com
pidfile     /var/run/openldap/slapd.pid
argsfile    /var/run/openldap/slapd.args
cachesize   10000
checkpoint  128 15

database    config
rootdn      "cn=ldapadmin,cn=config"
rootpw      {SSHA}B1auWTJT2Prj9kOlci1vqALlROb48iBu

Answer 1

documentation 说：

TLSCertificateKeyFile

指定包含与存储在 TLSCertificateFile 文件中的证书匹配的 slapd 服务器私钥的文件。 > 目前，私钥 不能用密码保护，所以它是 对其进行仔细保护至关重要。

我断定您的私钥文件有密码。你需要改变它，这样它就不会了。

（Apache HTTPD 提供了处理此提示的规定，我相信它来自 OpenSSL 的内部。我从未在 slapd.conf 中找到等效项。）

它还说：

TLSCertificatePath

指定包含单独文件中的证书颁发机构证书的目录的路径。 通常只使用其中一个或 TLSCACertificateFile。

你的配置很奇怪。