Replication Over SSL
You can configure Directory Servers involved in replication so that all replication operations occur over an SSL connection.
To Configure Replication Operations for
SSL
This procedure shows example commands for setting up replication on a replication topology with two masters.
Note –
This example shows a simple replication configuration, using a self-signed certificate as generated during instance creation. When setting up replication over SSL in a production environment, you will have better security if you use Certificate Authority trusted certificates instead.
Replication over SSL will fail if the supplier server certificate is an SSL server-only certificate that cannot act as a client during an SSL handshake.
While replication is secure by SSL, authentication of the replication manager is still done using a simple bind and password. You can use client-based authentication to fully secure replication, but this requires more complex settings. For more information about replication using client based authentication, see To Configure Client Authentication Based Replication for SSL
You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.
-
Create new servers and start them.
$ dsadm create -p 1389 -P 1636 /local/ds1 $ dsadm create -p 2389 -P 2636 /local/ds2 $ dsadm start /local/ds1 $ dsadm start /local/ds2
For more information about configuring SSL, see Using SSL With Directory Server.
-
On all servers, create empty suffixes.
$ dsconf create-suffix -e -w password-file -p 1389 dc=example,dc=com $ dsconf create-suffix -e -w password-file -p 2389 dc=example,dc=com
-
On all servers, set the multimaster password file.
$ dsconf set-server-prop -e -i -w password-file -h example1.server -p 1389 \ def-repl-manager-pwd-file:/local/ds1/replmanrpwd1.txt $ dsconf set-server-prop -e -i -w password-file -h example2.server -p 2389 \ def-repl-manager-pwd-file:/local/ds1/replmanrpwd2.txt
-
On all servers, enable replication.
$ dsconf enable-repl -h example1.server -p 1389 -e -i -w password-file \ -d 1 master dc=example,dc=com $ dsconf enable-repl -h example2.server -p 2389 -e -i -w password-file \ -d 2 master dc=example,dc=com
-
On all servers, export the existing default certificate.
$ dsadm show-cert -F der -o certfile1 /local/ds1 defaultCert $ dsadm show-cert -F der -o certfile2 /local/ds2 defaultCert
-
On all servers, add the certificate from all other servers.
$ dsadm add-cert --ca /local/ds1 "ds2 Repl Manager Cert" certfile2 $ dsadm add-cert --ca /local/ds2 "ds1 Repl Manager Cert" certfile1
-
Create replication agreement between the servers just configured.
Note that secure LDAP ports are used for the replication agreements.
$ dsconf create-repl-agmt -h example1.server -p 1389 -e -i -w password-file\ --auth-protocol "ssl-simple" dc=example,dc=com example2.server:2636 $ dsconf create-repl-agmt -h example2.server -p 2389 -e -i -w password-file\ --auth-protocol "ssl-simple" dc=example,dc=com example1.server:1636
-
For all replication agreements, configure the authentication password file to be the replication manager password file of the consumer (destination) server in the replication agreement.
$ dsconf set-repl-agmt-prop -h example1.server -p 1389 -e -i -w password-file\ dc=example,dc=com example2.server:2636 auth-pwd-file:/local/ds1/replmanrpwd2.txt $ dsconf set-repl-agmt-prop -h example2.server -p 2389 -e -i -w password-file\ dc=example,dc=com example1.server:1636 auth-pwd-file:/local/ds1/replmanrpwd1.txt
After you have initialized the suffixes, the supplier will send all replication update messages to the consumer over SSL and will use certificates if you chose that option. Customer initialization will also use a secure connection if performed through DSCC using an agreement configure for SSL.
-
On all servers, restart the server in order to take configuration changes into account.
$ dsadm restart /local/ds1 $ dsadm restart /local/ds2
-
On one of the master servers, initialize the suffix.
$ dsconf import -h example1.server -p 1389 -e -i \ -w password-file /tmp/Example.ldif dc=example,dc=com
-
On all servers not yet initialized, initialize the servers by using a replication agreement.
$ dsconf init-repl-dest -e -i -w password-file \ -h example1.server -p 1389 dc=example,dc=com example1.server:2636
To Configure Client Authentication
Based Replication for SSL
In the following procedure, it is assumed that you requested properly signed certificate/key pairs from a trusted Certificate Authority (CA) and the CA certificate of such authority is present in all security databases.
The certificate/key pairs should be issued to the user having replication rights, that is the certificate subject is the DN of a user allowed to transfer replication data between the servers. In the following example, such users are ou=user1,o=users and ou=user1,o=users; the certificates short names in the security database are replmgr1 and replmgr2 respectively.
-
Create new servers.
$ dsadm create -p 1389 -P 1636 /local/ds1 $ dsadm create -p 2389 -P 2636 /local/ds2
-
Add a user Certificate/Key pair on each server, as received by the CA.
$ dsadm import-cert /local/ds1 user1.der $ dsadm import-cert /local/ds2 user2.der
The user1.der and user2.der are the CA provided files.
-
Export the users' certificates for later use
$ dsadm show-cert -F ascii /local/ds1 replmgr1 > user1.ldif $ dsadm show-cert -F ascii /local/ds2 replmgr2 > user2.ldif
The files should contain base64 encoded binary certificates.
-
Start the servers.
$ dsadm start /local/ds1 $ dsadm start /local/ds2
-
Create empty suffixes on all the servers, where the users and their certificate will be stored.
$ dsconf create-suffix -p 1389 -e o=example.com $ dsconf create-suffix -p 2389 -e o=example.com $ dsconf create-suffix -p 1389 -e o=users $ dsconf create-suffix -p 2389 -e o=users
Note –Alternatively, the users and their certificates could be in another suffix. It is not recommended to have the user in the same suffix that is to be replicated.
-
On all servers, enable replication.
$ dsconf enable-repl -p 1389 -e -d 1 master o=example.com $ dsconf enable-repl -p 2389 -e -d 1 master o=example.com
-
Prepare the users to be set as replication managers. Edit user1.ldif and user2.ldif to look like the following:
dn: cn=user1,o=users objectclass: top objectclass: inetorgperson sn: user1 userCertificate;binary:: MIIBqDCCARGgAwIBAgI <...> dXNlcnMwHh <...> <...>
The files must be a valid LDIF files.
Get rid of the lines, BEGIN CERTIFICATE and END CERTIFICATE. The value of userCertificate;binary:: is simply the base64 encoding. If it spans multiple lines, the first character of the line must be a space.
-
Add the user definitions on the server where the user is going to be allowed to replicate.
$ ldapmodify -p 1389 -D binddn -w password -a < user2.ldif $ ldapmodify -p 2389 -D binddn -w password -a < user1.ldif
Note –Alternatively, you can issue the ldapmodify commands directly and create the two users interactively. Make sure that you use the correct syntax while setting the userCertifacte attribute.
-
Set the user allowed to replicate between servers as replication manager.
$ dsconf -p 1389 set-suffix-prop repl-manager-bind-dn: cn=user2,o=users $ dsconf -p 2389 set-suffix-prop repl-manager-bind-dn: cn=user1,o=users
-
Set the server certificate to use the user Certificate/key pair as its own.
$ dsconf -p 1389 set-server-prop ssl-rsa-cert-name:replmgr1 $ dsconf -p 2389 set-server-prop ssl-rsa-cert-name:replmgr2
-
Restart the servers to take into account the new changes.
$ dsadm restart /local/ds1 $ dsadm restart /local/ds2
-
Create the replication agreements.
$ dsconf create-repl-agmt -p 1389 -e -A ssl-client o=example.com hostname:2636 $ dsconf create-repl-agmt -p 2389 -e -A ssl-client o=example.com hostname:1636
- © 2010, Oracle Corporation and/or its affiliates