LDAP

Synopsis #

LDAP (Lightweight Directory Access Protocol) provides network access to directory records such as users, groups, and hosts. LDAP servers can control access to those records and protect connections with TLS.

LDAP is not the same as YP (NIS):

• YP is an older, SunRPC-based protocol included in the OpenBSD base system.
• LDAP is an extensible, industry-standard protocol (RFC 4511), designed to operate over TCP and optionally with TLS.
• OpenBSD includes the ldapd(8) LDAP server in base. OpenLDAP, the server documented in this chapter, is available via packages.

The examples below configure an OpenLDAP server, query it with client tools, and describe integration with OpenBSD account lookups.

Installation #

Install the OpenLDAP server and client tools:

doas pkg_add openldap-server openldap-client

This provides the slapd(8) daemon and tools such as ldapadd, ldapmodify, ldapsearch, and slappasswd.

The configuration and database directories will be located under:

• /etc/openldap/: Configuration files (if using legacy slapd.conf)
• /var/openldap-data/: Backend database
• /etc/openldap/slapd.d/: Dynamic configuration tree when using cn=config

Configuration #

OpenLDAP can be configured in two ways:

1. Static configuration via /etc/openldap/slapd.conf (simpler, but deprecated)
2. Dynamic configuration via the cn=config backend

The examples below use /etc/openldap/slapd.conf. Use cn=config when dynamic configuration is required.

Creating the Configuration File #

Example /etc/openldap/slapd.conf:

include         /etc/openldap/schema/core.schema

pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args

loglevel        stats

modulepath      /usr/local/libexec/openldap
moduleload      back_mdb.la

backend         mdb
database        mdb
maxsize         1073741824
suffix          "dc=example,dc=org"
rootdn          "cn=admin,dc=example,dc=org"
rootpw          {SSHA}xxxxxxxxxxxxxxxxxxxxxxx
directory       /var/openldap-data

Use slappasswd to generate a secure hashed password:

# slappasswd
New password:
Re-enter new password:
{SSHA}pFhVhOLHbI4YXEbrr4AQF4r+fpdU6xgF

Insert the result as rootpw.

Create the database and runtime directories before validation:

doas mkdir -p /var/openldap-data /var/run/openldap
doas chown _openldap:_openldap /var/openldap-data /var/run/openldap
doas chmod 700 /var/openldap-data
doas chmod 755 /var/run/openldap

Running the Server #

Use the packaged slapd service and explicitly select the legacy configuration used above:

doas slaptest -u -f /etc/openldap/slapd.conf
doas rcctl enable slapd
doas rcctl set slapd flags -u _openldap -f /etc/openldap/slapd.conf
doas rcctl start slapd

Correct validation errors before starting. Do not start a second manual daemon alongside the rc service.

Adding Initial Entries #

Create an LDIF file for the base domain:

dn: dc=example,dc=org
objectClass: top
objectClass: dcObject
objectClass: organization
o: Example Organization
dc: example

dn: cn=admin,dc=example,dc=org
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: Directory administrator
userPassword: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxx

Add entries with:

doas ldapadd -x -D "cn=admin,dc=example,dc=org" -W -f base.ldif

Enter the admin password when prompted.

Searching and Querying #

To search the directory:

ldapsearch -x -b "dc=example,dc=org"

To look for users in a specific subtree:

ldapsearch -x -b "ou=people,dc=example,dc=org" "(uid=wouter)"

Use -D and -W to authenticate as a bind user if necessary.

TLS Encryption #

LDAP can operate with or without encryption. To secure connections:

1. Create a certificate and private key under /etc/ssl/openldap/
2. Add the following to slapd.conf:

TLSCertificateFile     /etc/ssl/openldap/server.crt
TLSCertificateKeyFile  /etc/ssl/openldap/server.key
TLSCACertificateFile   /etc/ssl/openldap/ca.crt

3. Restart slapd and require StartTLS on the LDAP listener. The certificate must match the server hostname and be trusted by the client:

ldapsearch -H ldap://ldap.example.org -ZZ -x -b "dc=example,dc=org"

Replace ldap.example.org with the server name from the certificate and make sure it resolves to the LDAP server.

This example uses TCP 389 with StartTLS. LDAPS additionally requires an ldaps:/// listener in the daemon’s -h flags; certificate directives alone do not open TCP 636.

System Account Integration #

OpenBSD does not use /etc/nsswitch.conf or PAM for base-system account lookups and authentication. Advice for nss_ldap, nslcd, or Linux PAM modules does not describe the native OpenBSD setup.

The base-system ypldap(8) daemon can expose LDAP directory entries as YP maps. It takes the place of ypserv(8); the two daemons must not run together. Configure the LDAP mappings in ypldap.conf(5) , then configure ypbind(8) and the password and group inclusions described in YP Client Configuration .

Serving account records through YP does not perform an LDAP bind for each login. Password authentication requires a password hash usable by OpenBSD in the account map; home directories and login shells must also be available on each client.

Firewall Notes #

Allow TCP access to the desired LDAP port(s) on internal interfaces only:

pass in on $int_if proto tcp to port { 389, 636 }

Do not expose LDAP services to the public internet without encryption, strict ACLs, and authentication mechanisms in place.

YP vs LDAP Recap #