Differences

This shows you the differences between two versions of the page.

--- technical:fr-ldap [2026/07/24 11:00] – [Sign the request] system
+++ technical:fr-ldap [2026/07/26 18:39] (current) – [Configure OpenLDAP for ldaps] system
@@ Line 455: / Line 455: @@
 done.
 done.
-#Now we cna just use plain ldapsearch
+#Now we can just use plain ldapsearch
 ldapsearch -H ldaps://ldap.radiusdesk.com -x -D "cn=admin,dc=radiusdesk,dc=com" -w testing123 -b dc=radiusdesk,dc=com
 </code>
 </WRAP>
+==== What does update-ca-certificates do? ====
+I like to know how things work. If you also like to know how things work the following insert is for you :-)
+  * The primary master CA file that is updated and can be used on Ubuntu is  **/etc/ssl/certs/ca-certificates.crt**
+  * This command rebuilds the system's trusted certificate store by consolidating certificates from a few key locations:
+    * **System Certificates:** The command reads the configuration file **/etc/ca-certificates.conf** to determine which certificates from **/usr/share/ca-certificates/** should be trusted.
+    * **Local Certificates:** It automatically trusts all .crt files found in /usr/local/share/ca-certificates/. This is the place where we add our internal CA certificate.
+  * **Output:** It then generates the single, concatenated bundle file at **/etc/ssl/certs/ca-certificates.crt**. This file is the master list used by many applications (like OpenSSL) to verify SSL/TLS connections.
-==== Install OpenLDAP ====
+==== Update FreeRADIUS for ldaps:// ====
+  * Do the following steps.
+<code bash>
+sudo su
+#Copy the OpenLDAP's CA to FreeRADIUS
+cp /etc/ldap/tls/ca /etc/freeradius/3.0/certs/ca.crt
+</code>
+  * Edit **/etc/freeradius/3.0/mods-enabled/ldap**
+<code bash>
+#Look for these items...
+#server = 'localhost'
+#---This has to match the cert's  ubjectAltName (SAN)---
+server = 'ldap.radiusdesk.com'
+#       server = 'ldap.rrdns.example.org'
+#       server = 'ldap.rrdns.example.org'
+#  Port to connect on, defaults to 389, will be ignored for LDAP URIs.
+##port = 389
+#--We specify the ldaps port--
+port = 636
+#--- Then loop for the tls section
+tls {
+        # Set this to 'yes' to use TLS encrypted connections
+        # to the LDAP database by using the StartTLS extended
+        # operation.
+        #
+        # The StartTLS operation is supposed to be
+        # used with normal ldap connections instead of
+        # using ldaps (port 636) connections
+        #--- Disable start_tls since we are forcing ssl/tls ---
+        #start_tls = yes
+#               ca_file = ${certdir}/cacert.pem
+       #--- The CA file from OpenLDAP--
+        ca_file = /etc/freeradius/3.0/certs/ca.crt
+#               ca_path = ${certdir}
+#               certificate_file = /path/to/radius.crt
+#               private_key_file = /path/to/radius.key
+#               random_file = /dev/urandom
+        #  Certificate Verification requirements.  Can be:
+        #    'never' (do not even bother trying)
+        #    'allow' (try, but don't fail if the certificate
+        #               cannot be verified)
+        #    'demand' (fail if the certificate does not verify)
+        #    'hard'  (similar to 'demand' but fails if TLS
+        #             cannot negotiate)
+        #
+        #  The default is libldap's default, which varies based
+        #  on the contents of ldap.conf.
+        #---Enforce FreeRADIUS to check the validity of the certificate ---
+        require_cert    = 'demand'
+        #
+        #  Check the CRL, as with the EAP module.
+        #
+</code>
+  * After you made these changes, restart FreeRADIUS in debug mode and to a test authentication to confirm that it is now using ldaps (port 636)
+  * See the results from out setup below:
+<code bash>
+rlm_ldap (ldap): Reserved connection (3)
+(3) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})
+(3) ldap:    --> (uid=testuser)
+(3) ldap: Performing search in "ou=people,dc=radiusdesk,dc=com" with filter "(uid=testuser)", scope "sub"
+(3) ldap: Waiting for search result...
+(3) ldap: User object found at DN "uid=testuser,ou=people,dc=radiusdesk,dc=com"
+(3) ldap: Processing user attributes
+(3) ldap: control:Password-With-Header += 'mysecretpassword'
+rlm_ldap (ldap): Released connection (3)
+Need more connections to reach 10 spares
+rlm_ldap (ldap): Opening additional connection (7), 1 of 25 pending slots used
+rlm_ldap (ldap): Connecting to ldap://ldap.radiusdesk.com:636
+rlm_ldap (ldap): Waiting for bind result...
+rlm_ldap (ldap): Bind successful
+</code>