Samba AD DCでLDAP over SSL(LDAPS)を構成する - 版の履歴

Meisina04: /* Verifying the certificate */

2018-09-26T00:55:01Z

Verifying the certificate

← 古い版		2018年9月26日 (水) 09:55時点における版
149行目:		149行目:
	.....{removed to keep this example output shorter}.....		.....{removed to keep this example output shorter}.....

	= ~~Verifying the certificate~~ =		= 証明書の確認 =

	== ~~Local~~ ==		== ローカル ==

	# openssl verify /usr/local/samba/private/tls/myCert.pem		# openssl verify /usr/local/samba/private/tls/myCert.pem
158行目:		158行目:
	OK		OK

	~~If you are using a CA file in your~~ smb.~~conf, use the following command instead:~~		smb.confでCAファイルを使用している場合は、代わりに次のコマンドを使用します。：

	# openssl verify /usr/local/samba/private/tls/myCert.pem -CApath /path/to/ca-file.pem		# openssl verify /usr/local/samba/private/tls/myCert.pem -CApath /path/to/ca-file.pem
164行目:		164行目:


	== ~~Remote via TCP~~ ==		== TCP経由のリモート ==

	# openssl s_client -showcerts -connect dc1.samdom.example.com:636		# openssl s_client -showcerts -connect dc1.samdom.example.com:636
210行目:		210行目:
	---		---

	''~~You can quit s_client by pressing~~ [Ctrl]+[C].''		'' [Ctrl] + [C]を押すとs_clientを終了できます。 ''

	~~If you are using a CA file in your~~ smb.~~conf, use the following command instead:~~		smb.confでCAファイルを使用している場合は、代わりに次のコマンドを使用します：

	# openssl s_client -showcerts -connect localhost:636 -CApath /path/to/ca-file.pem		# openssl s_client -showcerts -connect localhost:636 -CApath /path/to/ca-file.pem

Meisina04: /* View certificate details */

2018-09-26T00:50:22Z

View certificate details

← 古い版		2018年9月26日 (水) 09:50時点における版
118行目:		118行目:
	* Sambaを再起動する		* Sambaを再起動する

	= ~~View certificate details~~ =		= 証明書の詳細を表示する =

	# openssl x509 -in /usr/local/samba/private/tls/myCert.pem -noout -text		# openssl x509 -in /usr/local/samba/private/tls/myCert.pem -noout -text
148行目:		148行目:
	Signature Algorithm: sha1WithRSAEncryption		Signature Algorithm: sha1WithRSAEncryption
	.....{removed to keep this example output shorter}.....		.....{removed to keep this example output shorter}.....





	= Verifying the certificate =		= Verifying the certificate =

Meisina04: /* Using a trusted certificate */

2018-09-26T00:48:42Z

Using a trusted certificate

← 古い版		2018年9月26日 (水) 09:48時点における版
78行目:		78行目:
	* Sambaを再起動する。		* Sambaを再起動する。

	= ~~Using a trusted certificate~~ =		= 信頼できる証明書を使用する =

	* ~~Change into the directory you want to store the key and certificate~~		* キーと証明書を保存するディレクトリに移動します
	# cd /usr/local/samba/private/tls/		# cd /usr/local/samba/private/tls/

	* ~~Create a 2048 server key~~		* 2048ビットのサーバーキーを作成します
	# openssl genrsa -out myKey.pem 2048		# openssl genrsa -out myKey.pem 2048

	* Generate a certificate request (CSR). You'll be asked a couple of questions. The most important is, that you fill „Common Name“ with the FQDN of the DC you are generating the certificate for („hostname -~~f“)!~~		* 証明書要求（CSR）を生成します。いくつかの質問があります。最も重要なのは、証明書を生成するDCのFQDN（ "hostname -f"）を "Common Name"に入力することです。
	# openssl req -new -key myKey.pem -out myCSR.pem		# openssl req -new -key myKey.pem -out myCSR.pem

104行目:		104行目:
	Email Address []:demo@example.com		Email Address []:demo@example.com

	* ~~Use your CSR to obtain a trusted certificate from a CA. Please check the vendors page for details on the process.~~		* CSRを使用して、CAから信頼できる証明書を取得します。プロセスの詳細については、ベンダーのページを確認してください。

	* ~~If you received your trusted certificate, store it in the directory with the server key (name it e. g. myCert.pem)~~.		* 信頼できる証明書を受け取った場合は、その証明書をサーバーキー（たとえば、myCert.pemという名前）を持つディレクトリーに保管します。

	* ~~If your CA requires intermediate certificates also store it in same directory as the other files (e. g. myIntermediate.pem)~~.		* CAが中間証明書を必要とする場合は、他のファイルと同じディレクトリに格納します（myIntermediate.pemなど）。

	* ~~Add the following parameters to your~~ smb.~~conf~~		* smb.confに次のパラメータを追加します。
	tls enabled = yes		tls enabled = yes
	tls keyfile = tls/myKey.pem		tls keyfile = tls/myKey.pem
116行目:		116行目:
	tls cafile = tls/myIntermediate .pem # if not required, set empty		tls cafile = tls/myIntermediate .pem # if not required, set empty

	* ~~Restart Samba.~~		* Sambaを再起動する






	= View certificate details =		= View certificate details =

Meisina04: /* Using a custom self-signed certificate */

2018-09-26T00:39:56Z

Using a custom self-signed certificate

← 古い版		2018年9月26日 (水) 09:39時点における版
38行目:		38行目:
	tls cafile = tls/ca.pem		tls cafile = tls/ca.pem

	= ~~Using a custom self-signed certificate~~ =		= 独自の自己署名証明書を使用する =

	* ~~Change into the directory you want to store the key and certificate~~		* キーと証明書を保存するディレクトリに移動します
	# cd /usr/local/samba/private/tls/		# cd /usr/local/samba/private/tls/

	* ~~Create a private key (2048 bit) and a self~~-signed certificate, valid for 1 year. You'll be asked a couple of questions. It is very important that you fill „Common Name“, with the FQDN of the DC you are generating the certificate for („hostname -f“)!		* 1年間有効な秘密鍵（2048ビット）と自己署名証明書を作成します。いくつかの質問があります。 "Common Name"に証明書を生成するDCのFQDN（ "hostname -f"）を入力することは非常に重要です！

	# openssl req -newkey rsa:2048 -keyout myKey.pem -nodes -x509 -days 365 -out myCert.pem		# openssl req -newkey rsa:2048 -keyout myKey.pem -nodes -x509 -days 365 -out myCert.pem
67行目:		67行目:
	Email Address []:demo@example.com		Email Address []:demo@example.com

	* ~~Restrict rights on the private key~~		* 秘密鍵のアクセス権を制限する
	# chmod 600 myKey.pem		# chmod 600 myKey.pem

	* ~~Add the following to your~~ smb.~~conf~~		* smb.confに以下を追加してください
	tls enabled = yes		tls enabled = yes
	tls keyfile = tls/myKey.pem		tls keyfile = tls/myKey.pem
76行目:		76行目:
	tls cafile =		tls cafile =

	* ~~Restart Samba.~~		* Sambaを再起動する。

	= Using a trusted certificate =		= Using a trusted certificate =

Meisina04: /* Using the Samba autogenerated self-signed certificate (default) */

2018-09-26T00:32:16Z

Using the Samba autogenerated self-signed certificate (default)

← 古い版		2018年9月26日 (水) 09:32時点における版
21行目:		21行目:
	"tls *"パラメータは、smb.confの "[global]"セクションで設定します。変更が終わったら、Sambaを再起動する必要があります。		"tls *"パラメータは、smb.confの "[global]"セクションで設定します。変更が終わったら、Sambaを再起動する必要があります。

	= ~~Using the Samba autogenerated self-signed certificate (default)~~ =		= Sambaで自動生成された自己署名証明書を使用する（デフォルト） =

	~~On its first startup, Samba creates a private key, a self signed certificate and a CA certificate:~~		最初の起動時に、Sambaは秘密鍵、自己署名証明書、およびCA証明書を作成します。

	* /usr/local/samba/private/tls/ca.pem		* /usr/local/samba/private/tls/ca.pem
29行目:		29行目:
	* /usr/local/samba/private/tls/key.pem		* /usr/local/samba/private/tls/key.pem

	~~The certificates are valid for 700 days after creation (the lifetime used when auto-creating the certificates is hardcoded in „source4~~/lib/tls/tlscert.~~c“).~~		証明書は作成後700日間有効です（証明書の自動作成時に使用される有効期間は "source4/lib/tls/tlscert.c"にハードコードされています）。

	~~By default TLS is enabled („tls~~ enabled = ~~yes“), the above files are used and correspond to the following smb~~.~~conf parameters:~~		デフォルトでは、TLSが有効（ "tls enabled = yes"）の場合、上記のファイルが使用され、次のsmb.confパラメータに対応します。

	tls enabled = yes		tls enabled = yes
37行目:		37行目:
	tls certfile = tls/cert.pem		tls certfile = tls/cert.pem
	tls cafile = tls/ca.pem		tls cafile = tls/ca.pem






	= Using a custom self-signed certificate =		= Using a custom self-signed certificate =

Meisina04: /* Important smb.conf parameters for LDAPS */

2018-09-26T00:28:22Z

Important smb.conf parameters for LDAPS

← 古い版		2018年9月26日 (水) 09:28時点における版
15行目:		15行目:
	* 中間証明書を使用する場合は、サーバー証明書の後にcert.pemファイルに追加する必要があります。		* 中間証明書を使用する場合は、サーバー証明書の後にcert.pemファイルに追加する必要があります。

	= ~~Important smb~~.~~conf parameters for LDAPS~~ =		= LDAPSの重要なsmb.confパラメータ =

	~~LDAPS is controlled by various smb.conf parameters, which all start with „tls“. See the manpage for details.~~

	~~The „tls*“ parameters are set in the „[global]“ section of your smb.conf. After any changes, you will have to restart Samba.~~




			LDAPSはさまざまなsmb.confパラメータによって制御され、すべてが "tls"で始まります。詳細については、マニュアルページを参照してください。

			"tls *"パラメータは、smb.confの "[global]"セクションで設定します。変更が終わったら、Sambaを再起動する必要があります。

	= Using the Samba autogenerated self-signed certificate (default) =		= Using the Samba autogenerated self-signed certificate (default) =

Meisina04: /* 一般情報 */

2018-09-26T00:14:50Z

一般情報

← 古い版		2018年9月26日 (水) 09:14時点における版
9行目:		9行目:
	ENABLE_GNUTLS		ENABLE_GNUTLS

	* ~~The private key must be accessible without a passphrase, i.e. it must not be encrypted!~~		* 秘密鍵はパスフレーズなしでアクセスできる必要があります。つまり、暗号化しないでください！

	* ~~The files that samba uses have to be in PEM format (Base64-encoded DER). The content is enclosed between e. g.~~ "-----BEGIN CERTIFICATE-----" ~~and~~ "-----END CERTIFICATE-----".		* sambaが使用するファイルは、PEM形式（Base64エンコードDER）でなければなりません。内容は、"-----BEGIN CERTIFICATE-----" と "-----END CERTIFICATE-----"で、囲まれています。

	* ~~When intermediate certificates are used they should be appended to the cert~~.~~pem file after the server certificate~~		* 中間証明書を使用する場合は、サーバー証明書の後にcert.pemファイルに追加する必要があります。

	= Important smb.conf parameters for LDAPS =		= Important smb.conf parameters for LDAPS =

Meisina04: /* General information */

2018-09-25T09:51:53Z

General information

← 古い版		2018年9月25日 (火) 18:51時点における版
3行目:		3行目:
	Active Directoryは、LDAP（Lightweight Directory Access Protocol）を読み取りおよび書き込みアクセスに使用します。デフォルトでは、LDAP接続は暗号化されていません。 LDAPトラフィックを保護するには、SSL / TLSを使用できます。このドキュメントでは、Sambaに証明書をインストールすることにより、LDAP over SSL（LDAPS）を有効にする方法について説明します。		Active Directoryは、LDAP（Lightweight Directory Access Protocol）を読み取りおよび書き込みアクセスに使用します。デフォルトでは、LDAP接続は暗号化されていません。 LDAPトラフィックを保護するには、SSL / TLSを使用できます。このドキュメントでは、Sambaに証明書をインストールすることにより、LDAP over SSL（LDAPS）を有効にする方法について説明します。

	= ~~General information~~ =		= 一般情報 =

	* ~~To use TLS, Samba has to be compiled with „~~--enable-~~gnutls“. To verify, use the following command:~~		* TLSを使うには、Sambaを„--enable-gnutls“でコンパイルする必要があります。確認するには、次のコマンドを使用してください：
	# smbd -b \| grep "ENABLE_GNUTLS"		# smbd -b \| grep "ENABLE_GNUTLS"
	ENABLE_GNUTLS		ENABLE_GNUTLS

Meisina04: /* Introduction */

2018-09-25T09:49:33Z

Introduction

← 古い版		2018年9月25日 (火) 18:49時点における版
1行目:		1行目:
	= ~~Introduction~~ =		= はじめに =

	Active Directory uses the LDAP (Lightweight Directory Access Protocol) for read and write access. By default LDAP connections are unencrypted. To secure LDAP traffic, you can use SSL/TLS. This document will describe how to enable LDAP over SSL (LDAPS) by installing a certificate in Samba.




			Active Directoryは、LDAP（Lightweight Directory Access Protocol）を読み取りおよび書き込みアクセスに使用します。デフォルトでは、LDAP接続は暗号化されていません。 LDAPトラフィックを保護するには、SSL / TLSを使用できます。このドキュメントでは、Sambaに証明書をインストールすることにより、LDAP over SSL（LDAPS）を有効にする方法について説明します。

	= General information =		= General information =

Meisina04: ページの作成:「= Introduction = Active Directory uses the LDAP (Lightweight Directory Access Protocol) for read and write access. By default LDAP connections are unencrypted. To secure...」

2018-09-25T09:47:04Z

ページの作成:「= Introduction = Active Directory uses the LDAP (Lightweight Directory Access Protocol) for read and write access. By default LDAP connections are unencrypted. To secure...」

新規ページ

= Introduction =

Active Directory uses the LDAP (Lightweight Directory Access Protocol) for read and write access. By default LDAP connections are unencrypted. To secure LDAP traffic, you can use SSL/TLS. This document will describe how to enable LDAP over SSL (LDAPS) by installing a certificate in Samba.

= General information =

* To use TLS, Samba has to be compiled with „--enable-gnutls“. To verify, use the following command:
# smbd -b | grep "ENABLE_GNUTLS"
ENABLE_GNUTLS

* The private key must be accessible without a passphrase, i.e. it must not be encrypted!

* The files that samba uses have to be in PEM format (Base64-encoded DER). The content is enclosed between e. g. "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----".

* When intermediate certificates are used they should be appended to the cert.pem file after the server certificate

= Important smb.conf parameters for LDAPS =

LDAPS is controlled by various smb.conf parameters, which all start with „tls“. See the manpage for details.

The „tls*“ parameters are set in the „[global]“ section of your smb.conf. After any changes, you will have to restart Samba.

= Using the Samba autogenerated self-signed certificate (default) =

On its first startup, Samba creates a private key, a self signed certificate and a CA certificate:

* /usr/local/samba/private/tls/ca.pem
* /usr/local/samba/private/tls/cert.pem
* /usr/local/samba/private/tls/key.pem

The certificates are valid for 700 days after creation (the lifetime used when auto-creating the certificates is hardcoded in „source4/lib/tls/tlscert.c“).

By default TLS is enabled („tls enabled = yes“), the above files are used and correspond to the following smb.conf parameters:

tls enabled = yes
tls keyfile = tls/key.pem
tls certfile = tls/cert.pem
tls cafile = tls/ca.pem

= Using a custom self-signed certificate =

* Change into the directory you want to store the key and certificate
# cd /usr/local/samba/private/tls/

* Create a private key (2048 bit) and a self-signed certificate, valid for 1 year. You'll be asked a couple of questions. It is very important that you fill „Common Name“, with the FQDN of the DC you are generating the certificate for („hostname -f“)!

# openssl req -newkey rsa:2048 -keyout myKey.pem -nodes -x509 -days 365 -out myCert.pem

Generating a 2048 bit RSA private key
......+++
..................+++
writing new private key to 'myKey.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:DE
State or Province Name (full name) []:My State
Locality Name (eg, city) [Default City]:My City
Organization Name (eg, company) [Default Company Ltd]:My Company
Organizational Unit Name (eg, section) []:My Department
Common Name (eg, your name or your server's hostname) []:DC1.samdom.example.com
Email Address []:demo@example.com

* Restrict rights on the private key
# chmod 600 myKey.pem

* Add the following to your smb.conf
tls enabled = yes
tls keyfile = tls/myKey.pem
tls certfile = tls/myCert.pem
tls cafile =

* Restart Samba.

= Using a trusted certificate =

* Change into the directory you want to store the key and certificate
# cd /usr/local/samba/private/tls/

* Create a 2048 server key
# openssl genrsa -out myKey.pem 2048

* Generate a certificate request (CSR). You'll be asked a couple of questions. The most important is, that you fill „Common Name“ with the FQDN of the DC you are generating the certificate for („hostname -f“)!
# openssl req -new -key myKey.pem -out myCSR.pem

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:DE
State or Province Name (full name) []:My State
Locality Name (eg, city) [Default City]:My City
Organization Name (eg, company) [Default Company Ltd]:My Company
Organizational Unit Name (eg, section) []:My Department
Common Name (eg, your name or your server's hostname) []:DC1.samdom.example.com
Email Address []:demo@example.com

* Use your CSR to obtain a trusted certificate from a CA. Please check the vendors page for details on the process.

* If you received your trusted certificate, store it in the directory with the server key (name it e. g. myCert.pem).

* If your CA requires intermediate certificates also store it in same directory as the other files (e. g. myIntermediate.pem).

* Add the following parameters to your smb.conf
tls enabled = yes
tls keyfile = tls/myKey.pem
tls certfile = tls/myCert.pem
tls cafile = tls/myIntermediate .pem # if not required, set empty

* Restart Samba.

= View certificate details =

# openssl x509 -in /usr/local/samba/private/tls/myCert.pem -noout -text

Certificate:
Data:
Version: 3 (0x2)
Serial Number:
d7:16:0c:a9:2e:ce:6f:a6
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=DE, ST=My State, L=My City, O=My Company, OU=My Section, CN=DC1.samdom.example.com/emailAddress=demo@example.com
Validity
Not Before: Jun 22 06:44:35 2013 GMT
Not After : Jun 22 06:44:35 2014 GMT
Subject: C=DE, ST=My State, L=My City, O=My Company, OU=My Section, CN=DC1.samdom.example.com/emailAddress=demo@example.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
.....{removed to keep this example output shorter}.....
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
D3:CC:57:AD:2E:03:AC:EE:F9:1F:88:C7:96:A3:79:23:1E:1A:7E:45
X509v3 Authority Key Identifier:
keyid:D3:CC:57:AD:2E:03:AC:EE:F9:1F:88:C7:96:A3:79:23:1E:1A:7E:45
X509v3 Basic Constraints:
CA:TRUE
Signature Algorithm: sha1WithRSAEncryption
.....{removed to keep this example output shorter}.....

= Verifying the certificate =

== Local ==

# openssl verify /usr/local/samba/private/tls/myCert.pem
myCert.pem: C = DE, ST = My State, L = My City, O = My Company, OU = My Section, CN = DC1.samdom.example.com, emailAddress = demo@example.com
error 18 at 0 depth lookup:self signed certificate
OK

If you are using a CA file in your smb.conf, use the following command instead:

# openssl verify /usr/local/samba/private/tls/myCert.pem -CApath /path/to/ca-file.pem

== Remote via TCP ==

# openssl s_client -showcerts -connect dc1.samdom.example.com:636

CONNECTED(00000003)
depth=0 C = DE, ST = My State, L = My City, O = My Company, OU = My Section, CN = DC1.samdom.example.com, emailAddress = demo@example.com
verify error:num=18:self signed certificate
verify return:1
depth=0 C = DE, ST = My State, L = My City, O = My Company, OU = My Section, CN = DC1.samdom.example.com, emailAddress = demo@example.com
verify return:1
---
Certificate chain
0 s:/C=DE/ST=My State/L=My City/O=My Company/OU=My Section/CN=DC1.samdom.example.com/emailAddress=demo@example.com
i:/C=DE/ST=My State/L=My City/O=My Company/OU=My Section/CN=DC1.samdom.example.com/emailAddress=demo@example.com
-----BEGIN CERTIFICATE-----
.....{removed to keep this example output shorter}.....
-----END CERTIFICATE-----
---
Server certificate
subject=/C=DE/ST=My State/L=My City/O=My Company/OU=My Section/CN=DC1.samdom.example.com/emailAddress=demo@example.com
issuer=/C=DE/ST=My State/L=My City/O=My Company/OU=My Section/CN=DC1.samdom.example.com/emailAddress=demo@example.com
---
No client certificate CA names sent
---
SSL handshake has read 1870 bytes and written 322 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : DHE-RSA-AES256-SHA
Session-ID: 7B522F38E50A807426CBB438841A40360B8A32C2A6FA74B1705D2978E7100E9A
Session-ID-ctx:
Master-Key: D65E7EC785151B6DDA2CAB40320A16DADB5A24019B23C533738B43EA36DBC4E766BE16C292E35976BB6CD09B1C537D21
Key-Arg : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
Start Time: 1371887189
Timeout : 300 (sec)
Verify return code: 18 (self signed certificate)
---

''You can quit s_client by pressing [Ctrl]+[C].''

If you are using a CA file in your smb.conf, use the following command instead:

# openssl s_client -showcerts -connect localhost:636 -CApath /path/to/ca-file.pem

----
[[Category:Active Directory]]