tls

Dockerfile

@@ -1,4 +1,4 @@
-FROM phusion/baseimage
+FROM osixia-baseimage
 MAINTAINER Bertrand Gouny <bertrand.gouny@osixia.fr>
 
 # From Nick Stenning's work
@@ -12,11 +12,6 @@ ENV LDAP_DOMAIN example.com
 # /!\ To store the data outside the container, mount /var/lib/ldap as a data volume
 # add -v /some/host/directory:/var/lib/ldap to the run command
 
-# Set correct environment variables
-ENV HOME /root
-ENV LC_ALL C
-ENV DEBIAN_FRONTEND noninteractive
-
 # Disable SSH
 RUN rm -rf /etc/service/sshd /etc/my_init.d/00_regen_ssh_host_keys.sh
 
@@ -26,8 +21,8 @@ CMD ["/sbin/my_init"]
 # Resynchronize the package index files from their sources
 RUN apt-get -y update
 
-# Install slapd
+# Install openldap (slapd) and ldap-utils
-RUN apt-get install -y slapd
+RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y slapd ldap-utils
 
 # Expose ldap default port
 EXPOSE 389
@@ -37,6 +32,10 @@ EXPOSE 389
 # add -h my.hostname.com to the run command
 RUN mkdir /etc/ldap/ssl
 
+# Add config directory 
+RUN mkdir /etc/ldap/config
+ADD config /etc/ldap/config
+
 # Add slapd deamon
 RUN mkdir /etc/service/slapd
 ADD slapd.sh /etc/service/slapd/run

config/auto/tls.ldif

@@ -0,0 +1,16 @@
+dn: cn=config
+add: olcTLSCACertificateFile
+olcTLSCACertificateFile: /etc/ldap/ssl/ca.crt
+-
+add: olcTLSCertificateFile
+olcTLSCertificateFile: /etc/ldap/ssl/ldap.crt
+-
+add: olcTLSCertificateKeyFile
+olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap.key
+-
+add: olcTLSDHParamFile
+olcTLSDHParamFile: /etc/ldap/ssl/dhparam.pem
+-
+add: olcTLSVerifyClient
+olcTLSVerifyClient: never
+

config/logging.ldif

@@ -0,0 +1,4 @@
+dn: cn=config
+changetype: modify
+add: olcLogLevel
+olcLogLevel: stats

slapd.sh

@@ -31,24 +31,26 @@ slapd slapd/dump_database select when needed
 EOF
 
   dpkg-reconfigure -f noninteractive slapd
+  chown -R openldap:openldap /etc/ldap
+
+  # Lauch slapd deamon
+  slapd -h "ldap:///" -u openldap -g openldap
 
   if [ -e /etc/ldap/ssl/ldap.crt ] && [ -e /etc/ldap/ssl/ldap.key ] && [ -e /etc/ldap/ssl/ca.crt ]; then
     status "certificates found"
-  
-    chown openldap /etc/ldap/ssl/ldap.key
-    chmod 400 /etc/ldap/ssl/ldap.key
 
-    echo 'TLSCipherSuite   HIGH:MEDIUM:+SSLv3' >> /usr/share/slapd/slapd.conf
+    chmod 600 /etc/ldap/ssl/ldap.key
-    echo 'TLSCACertificateFile /etc/ldap/ssl/ca.crt' >> /usr/share/slapd/slapd.conf
-    echo 'TLSCertificateFile /etc/ldap/ssl/ldap.crt' >> /usr/share/slapd/slapd.conf
-    echo 'TLSCertificateKeyFile /etc/ldap/ssl/ldap.key' >> /usr/share/slapd/slapd.conf
-    echo 'TLSVerifyClient never' >> /usr/share/slapd/slapd.conf
 
-    sed -i "s/TLS_CACERT.*/TLS_CACERT       \/etc\/ldap\/ssl\/ca.crt/g" /etc/ldap/ldap.conf
+    # create DHParamFile if not found
-    sed -i '/TLS_CACERT/a\TLS_CIPHER_SUITE        HIGH:MEDIUM:+SSLv3' /etc/ldap/ldap.conf
+    [ -f /etc/ldap/ssl/dhparam.pem ] || openssl dhparam -out /etc/ldap/ssl/dhparam.pem 2048
+
+    ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/config/auto/tls.ldif 
 
   fi
 
+  # kill slapd deamon
+  pkill -f slapd
+
   touch /var/lib/ldap/docker_bootstrapped
 
 else
@@ -57,4 +59,4 @@ fi
 
 status "starting slapd on default port 389"
 set -x
-exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d 0
+exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d -1