tls

Dockerfile

@@ -1,7 +1,21 @@
-FROM phusion/baseimage:0.9.8
-MAINTAINER Nick Stenning <nick@whiteink.com>
+FROM phusion/baseimage
+MAINTAINER Bertrand Gouny <bertrand.gouny@osixia.fr>
 
+# From Nick Stenning's work
+# https://github.com/nickstenning/docker-slapd
+
+# Default configuration: can be overridden at the docker command line
+ENV LDAP_ADMIN_PWD toor
+ENV LDAP_ORGANISATION Example Inc.
+ENV LDAP_DOMAIN example.com
+
+# /!\ To store the data outside the container, mount /var/lib/ldap as a data volume
+# add -v /some/host/directory:/var/lib/ldap to the run command
+
+# Set correct environment variables
 ENV HOME /root
+ENV LC_ALL C
+ENV DEBIAN_FRONTEND noninteractive
 
 # Disable SSH
 RUN rm -rf /etc/service/sshd /etc/my_init.d/00_regen_ssh_host_keys.sh
@@ -9,25 +23,23 @@ RUN rm -rf /etc/service/sshd /etc/my_init.d/00_regen_ssh_host_keys.sh
 # Use baseimage-docker's init system.
 CMD ["/sbin/my_init"]
 
-# Configure apt
-RUN echo 'deb http://us.archive.ubuntu.com/ubuntu/ precise universe' >> /etc/apt/sources.list
+# Resynchronize the package index files from their sources
 RUN apt-get -y update
 
 # Install slapd
-RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y slapd
-
-# Default configuration: can be overridden at the docker command line
-ENV LDAP_ROOTPASS toor
-ENV LDAP_ORGANISATION Acme Widgets Inc.
-ENV LDAP_DOMAIN example.com
+RUN apt-get install -y slapd
 
+# Expose ldap default port
 EXPOSE 389
 
+# Create TSL certificats directory
+# /!\ If used the deamon must be lauch with a hostname matching the certificat common mame
+# add -h my.hostname.com to the run command
+RUN mkdir /etc/ldap/ssl
+
+# Add slapd deamon
 RUN mkdir /etc/service/slapd
 ADD slapd.sh /etc/service/slapd/run
 
-# To store the data outside the container, mount /var/lib/ldap as a data volume
-
+# Clear out the local repository of retrieved package files
 RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
-
-# vim:ts=8:noet:

slapd.sh

@@ -7,7 +7,7 @@ status () {
 }
 
 set -x
-: LDAP_ROOTPASS=${LDAP_ROOTPASS}
+: LDAP_ADMIN_PWD=${LDAP_ADMIN_PWD}
 : LDAP_DOMAIN=${LDAP_DOMAIN}
 : LDAP_ORGANISATION=${LDAP_ORGANISATION}
 
@@ -15,10 +15,10 @@ if [ ! -e /var/lib/ldap/docker_bootstrapped ]; then
   status "configuring slapd for first run"
 
   cat <<EOF | debconf-set-selections
-slapd slapd/internal/generated_adminpw password ${LDAP_ROOTPASS}
-slapd slapd/internal/adminpw password ${LDAP_ROOTPASS}
-slapd slapd/password2 password ${LDAP_ROOTPASS}
-slapd slapd/password1 password ${LDAP_ROOTPASS}
+slapd slapd/internal/generated_adminpw password ${LDAP_ADMIN_PWD}
+slapd slapd/internal/adminpw password ${LDAP_ADMIN_PWD}
+slapd slapd/password2 password ${LDAP_ADMIN_PWD}
+slapd slapd/password1 password ${LDAP_ADMIN_PWD}
 slapd slapd/dump_database_destdir string /var/backups/slapd-VERSION
 slapd slapd/domain string ${LDAP_DOMAIN}
 slapd shared/organization string ${LDAP_ORGANISATION}
@@ -32,11 +32,29 @@ EOF
 
   dpkg-reconfigure -f noninteractive slapd
 
+  if [ -e /etc/ldap/ssl/ldap.crt ] && [ -e /etc/ldap/ssl/ldap.key ] && [ -e /etc/ldap/ssl/ca.crt ]; then
+    status "certificates found"
+  
+    chown openldap /etc/ldap/ssl/ldap.key
+    chmod 400 /etc/ldap/ssl/ldap.key
+
+    echo 'TLSCipherSuite   HIGH:MEDIUM:+SSLv3' >> /usr/share/slapd/slapd.conf
+    echo 'TLSCACertificateFile /etc/ldap/ssl/ca.crt' >> /usr/share/slapd/slapd.conf
+    echo 'TLSCertificateFile /etc/ldap/ssl/ldap.crt' >> /usr/share/slapd/slapd.conf
+    echo 'TLSCertificateKeyFile /etc/ldap/ssl/ldap.key' >> /usr/share/slapd/slapd.conf
+    echo 'TLSVerifyClient never' >> /usr/share/slapd/slapd.conf
+
+    sed -i "s/TLS_CACERT.*/TLS_CACERT       \/etc\/ldap\/ssl\/ca.crt/g" /etc/ldap/ldap.conf
+    sed -i '/TLS_CACERT/a\TLS_CIPHER_SUITE        HIGH:MEDIUM:+SSLv3' /etc/ldap/ldap.conf
+
+  fi
+
   touch /var/lib/ldap/docker_bootstrapped
+
 else
   status "found already-configured slapd"
 fi
 
-status "starting slapd"
+status "starting slapd on default port 389"
 set -x
 exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d 0