Knowledgebase

An LDAP (Lightweight Directory Access Protocol) server is a crucial tool for managing directories of users, groups, and other resources in your network. By creating your own LDAP server on a VPS using OpenLDAP, you gain full control over user authentication and management. This guide will show you how to set up a secure LDAP server with OpenLDAP on your AnonVM VPS.

Why Use AnonVM for Your LDAP Server?

• Privacy and Security: Hosting your LDAP server offshore ensures maximum privacy and security.
• Scalability: AnonVM provides scalable VPS options to match your needs.
• Control: Full control over the configuration and management of your LDAP server.

Prerequisites

• An active AnonVM VPS with at least 2GB of RAM and 1 CPU core (ideal for small to medium-sized setups).
• Basic knowledge of Linux commands.
• A domain name (optional, but recommended for SSL/TLS configuration).

Step 1: Access Your VPS

1. Purchase an AnonVM VPS from AnonVM.
2. Access your VPS via SSH:
    

   ssh root@<your_vps_ip>
   Replace <your_vps_ip> with the actual IP address of your VPS.

Step 2: Update Your VPS

To ensure the latest security patches and updates are installed, run the following commands:

Step 3: Install OpenLDAP

Install the OpenLDAP server and related utilities:

Step 4: Configure OpenLDAP

During the installation, you'll be prompted to set an Administrator password for your LDAP server. This password is used for administrative tasks, so choose a secure password and make sure to remember it.

Once the installation is complete, you can configure the OpenLDAP server.

1. Reconfigure the OpenLDAP server with the following command:

    

   dpkg-reconfigure slapd

2. During the reconfiguration, you'll be prompted with the following questions:

   • Omit OpenLDAP server configuration?: Choose No.
   • DNS domain name: Set your domain name (e.g., example.com).
   • Organization name: Set the name of your organization (e.g., Example Corp).
   • Administrator password: Enter a secure password.
   • Database backend: Select MDB (default).
   • Remove the database when slapd is purged?: Choose No.
   • Allow LDAPv2 protocol?: Choose No (LDAPv2 is deprecated and less secure).

3. After configuring, OpenLDAP will be running on your server. You can check the status of the service using:

    

   systemctl status slapd

Step 5: Set Up Secure LDAP with TLS/SSL

To secure your LDAP server, it’s crucial to enable TLS/SSL encryption.

Install SSL Certificates

1. If you don’t have a domain, you can generate a self-signed certificate. However, it’s recommended to use Let’s Encrypt for production environments to get free, trusted SSL certificates.

To install Let’s Encrypt SSL certificates, follow these steps:

Replace <your_domain> with your actual domain name.

2. The certificates will be stored in /etc/letsencrypt/live/<your_domain>/.

Configure OpenLDAP to Use SSL/TLS

1. Create a backup of the current OpenLDAP configuration:

    

   cp /etc/ldap/slapd.d/cn=config.ldif /etc/ldap/slapd.d/cn=config.ldif.backup

2. Edit the OpenLDAP configuration to use SSL:

    

   nano /etc/ldap/slapd.d/cn=config.ldif

3. Add the following lines to enable TLS/SSL:

   ldif

    

   olcTLSCertificateFile: /etc/letsencrypt/live/<your_domain>/fullchain.pem olcTLSCertificateKeyFile: /etc/letsencrypt/live/<your_domain>/privkey.pem olcTLSCipherSuite: HIGH:MEDIUM:+TLSv1.2:+TLSv1.3

4. Restart the OpenLDAP service:

    

   systemctl restart slapd

5. To test if TLS is working, use the ldapsearch command:

    

   ldapsearch -H ldaps://<your_vps_ip> -x

If the connection is successful, your LDAP server is now securely running over LDAPS (port 636).

Step 6: Add LDAP Entries (Users and Groups)

Once your server is up and running, you can begin adding users and groups.

Add a Group

1. Create an LDIF file to define a group:

    

   nano add_group.ldif

   Add the following content:

   ldif

    

   dn: cn=admins,dc=example,dc=com objectClass: posixGroup cn: admins gidNumber: 1001

2. Add the group to LDAP:

    

   ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f add_group.ldif

Add a User

1. Create an LDIF file to define a user:

    

   nano add_user.ldif

   Add the following content:

   ldif

    

   dn: uid=john,ou=users,dc=example,dc=com objectClass: inetOrgPerson uid: john sn: Doe cn: John Doe uidNumber: 1002 gidNumber: 1001 homeDirectory: /home/john loginShell: /bin/bash userPassword: {SSHA}hashedpassword

2. Add the user to LDAP:

    

   ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f add_user.ldif

Step 7: Test LDAP Authentication

1. To verify that users can authenticate against the LDAP server, use the following command:

    

   ldapwhoami -x -D "uid=john,ou=users,dc=example,dc=com" -W

2. If authentication is successful, you should receive a response like:

    

   dn: uid=john,ou=users,dc=example,dc=com

Step 8: Backup Your LDAP Database

Backing up your LDAP data is essential to avoid data loss.

1. Create a backup of the LDAP database:

    

   slapcat -v -l backup.ldif

2. To restore the backup, use:

    

   slapadd -v -l backup.ldif

Step 9: Firewall and Security

If you are using a firewall, ensure the necessary ports are open:

Conclusion

You’ve now set up a secure LDAP server on your AnonVM VPS with OpenLDAP. This setup ensures that your authentication and user management are secure, scalable, and fully under your control. Whether you're managing a small organization or need a private directory service, this secure LDAP server is a great solution for centralized authentication and user management.

By using TLS/SSL encryption, you've secured the communication with your LDAP server, protecting sensitive data from unauthorized access.