From b020cc9cff86493215d0832c5cf94473238a0cc2 Mon Sep 17 00:00:00 2001
From: Bertrand Gouny <bgouny@hi-media.com>
Date: Fri, 2 May 2014 17:34:12 +0200
Subject: [PATCH] tls

---
 Dockerfile           | 15 +++++++--------
 config/auto/tls.ldif | 16 ++++++++++++++++
 config/logging.ldif  |  4 ++++
 slapd.sh             | 24 +++++++++++++-----------
 4 files changed, 40 insertions(+), 19 deletions(-)
 create mode 100644 config/auto/tls.ldif
 create mode 100644 config/logging.ldif

diff --git a/Dockerfile b/Dockerfile
index a0c5027..bbd9723 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM phusion/baseimage
+FROM osixia-baseimage
 MAINTAINER Bertrand Gouny <bertrand.gouny@osixia.fr>
 
 # From Nick Stenning's work
@@ -12,11 +12,6 @@ ENV LDAP_DOMAIN example.com
 # /!\ To store the data outside the container, mount /var/lib/ldap as a data volume
 # add -v /some/host/directory:/var/lib/ldap to the run command
 
-# Set correct environment variables
-ENV HOME /root
-ENV LC_ALL C
-ENV DEBIAN_FRONTEND noninteractive
-
 # Disable SSH
 RUN rm -rf /etc/service/sshd /etc/my_init.d/00_regen_ssh_host_keys.sh
 
@@ -26,8 +21,8 @@ CMD ["/sbin/my_init"]
 # Resynchronize the package index files from their sources
 RUN apt-get -y update
 
-# Install slapd
-RUN apt-get install -y slapd
+# Install openldap (slapd) and ldap-utils
+RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y slapd ldap-utils
 
 # Expose ldap default port
 EXPOSE 389
@@ -37,6 +32,10 @@ EXPOSE 389
 # add -h my.hostname.com to the run command
 RUN mkdir /etc/ldap/ssl
 
+# Add config directory 
+RUN mkdir /etc/ldap/config
+ADD config /etc/ldap/config
+
 # Add slapd deamon
 RUN mkdir /etc/service/slapd
 ADD slapd.sh /etc/service/slapd/run
diff --git a/config/auto/tls.ldif b/config/auto/tls.ldif
new file mode 100644
index 0000000..90178dd
--- /dev/null
+++ b/config/auto/tls.ldif
@@ -0,0 +1,16 @@
+dn: cn=config
+add: olcTLSCACertificateFile
+olcTLSCACertificateFile: /etc/ldap/ssl/ca.crt
+-
+add: olcTLSCertificateFile
+olcTLSCertificateFile: /etc/ldap/ssl/ldap.crt
+-
+add: olcTLSCertificateKeyFile
+olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap.key
+-
+add: olcTLSDHParamFile
+olcTLSDHParamFile: /etc/ldap/ssl/dhparam.pem
+-
+add: olcTLSVerifyClient
+olcTLSVerifyClient: never
+
diff --git a/config/logging.ldif b/config/logging.ldif
new file mode 100644
index 0000000..bab9364
--- /dev/null
+++ b/config/logging.ldif
@@ -0,0 +1,4 @@
+dn: cn=config
+changetype: modify
+add: olcLogLevel
+olcLogLevel: stats
diff --git a/slapd.sh b/slapd.sh
index 96c98a9..07781f1 100755
--- a/slapd.sh
+++ b/slapd.sh
@@ -31,24 +31,26 @@ slapd slapd/dump_database select when needed
 EOF
 
   dpkg-reconfigure -f noninteractive slapd
+  chown -R openldap:openldap /etc/ldap
+
+  # Lauch slapd deamon
+  slapd -h "ldap:///" -u openldap -g openldap
 
   if [ -e /etc/ldap/ssl/ldap.crt ] && [ -e /etc/ldap/ssl/ldap.key ] && [ -e /etc/ldap/ssl/ca.crt ]; then
     status "certificates found"
-  
-    chown openldap /etc/ldap/ssl/ldap.key
-    chmod 400 /etc/ldap/ssl/ldap.key
 
-    echo 'TLSCipherSuite   HIGH:MEDIUM:+SSLv3' >> /usr/share/slapd/slapd.conf
-    echo 'TLSCACertificateFile /etc/ldap/ssl/ca.crt' >> /usr/share/slapd/slapd.conf
-    echo 'TLSCertificateFile /etc/ldap/ssl/ldap.crt' >> /usr/share/slapd/slapd.conf
-    echo 'TLSCertificateKeyFile /etc/ldap/ssl/ldap.key' >> /usr/share/slapd/slapd.conf
-    echo 'TLSVerifyClient never' >> /usr/share/slapd/slapd.conf
+    chmod 600 /etc/ldap/ssl/ldap.key
 
-    sed -i "s/TLS_CACERT.*/TLS_CACERT       \/etc\/ldap\/ssl\/ca.crt/g" /etc/ldap/ldap.conf
-    sed -i '/TLS_CACERT/a\TLS_CIPHER_SUITE        HIGH:MEDIUM:+SSLv3' /etc/ldap/ldap.conf
+    # create DHParamFile if not found
+    [ -f /etc/ldap/ssl/dhparam.pem ] || openssl dhparam -out /etc/ldap/ssl/dhparam.pem 2048
+
+    ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/config/auto/tls.ldif 
 
   fi
 
+  # kill slapd deamon
+  pkill -f slapd
+
   touch /var/lib/ldap/docker_bootstrapped
 
 else
@@ -57,4 +59,4 @@ fi
 
 status "starting slapd on default port 389"
 set -x
-exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d 0
+exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d -1