-
Notifications
You must be signed in to change notification settings - Fork 7
/
Copy pathApache LDAPS Template for nagios.conf
166 lines (163 loc) · 7.66 KB
/
Apache LDAPS Template for nagios.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
# ====================================================================================
# OsbornePro LLC. Nagios Core Apache2 Configuration file template to use LDAP over SSL
# ====================================================================================
# Configuration Starts at line 63
#
# LDAPS REQUIREMENTS:
# 1.) Root CA Subject Name (CN value) must differ from the LDAPS Subject Name (CN value) in order to be trusted by OpenSSL
# 2.) LDAPS Certificate contents must contain the base64 server certificate followed by the base64 Root CA certificates
# 3.) Define users allowed to access Nagios in your Nagios /usr/local/nagios/etc/cgi.cfg file (EXAMPLE SETTING: authorized_for_all_service_commands=nagiosadmin,domainuser)
#
#--------------------------------------------------------------------------------------------------------------------------
# (If not already done) CREATE A ROOT CA ON A SERVER THAT IS DIFFERENT FROM YOUR LDAP SERVER USING THE BELOW COMMANDS
#--------------------------------------------------------------------------------------------------------------------------
#sudo openssl genrsa -des3 -out private/ca.key 4096
#sudo openssl req -new -x509 -days 365 -key /etc/ssl/private/ca.key -out /etc/ssl/certs/ca.crt
#
#--------------------------------------------------------------------------------------------------------------------------
# TRUST THE NEWLY CREATED CA BY COPYING IT TO YOUR LDAP SERVER AND ADDING IT TO THE TRUSTED CERTIFICATE STORE
#--------------------------------------------------------------------------------------------------------------------------
#scp -P 22 -i ~/.ssh/id_rsa /etc/ssl/certs/ca.crt [email protected]:/tmp/ca.crt
#
#--------------------------------------------------------------------------------------------------------------------------
# CREATE A CERTIFICATE REQUEST ON LDAP SERVER AND TRUST THE ca.crt CERTIFICATE
#--------------------------------------------------------------------------------------------------------------------------
#sudo cp /tmp/ca.crt /usr/share/ca-certificates/mozilla/ca.crt
#echo "[*] Ensure your ca.crt certificate is selected by using the space bar in the below commands select window
#dpkg-reconfigure ca-certificates
#
#echo "[*] Creating CSR request"
#sudo mkdir /etc/ssl/requests
#sudo openssl req -out /etc/ssl/requests/ldap.csr -new -newkey rsa:2048 -nodes -keyout /etc/ssl/private/ldap.key
#
#echo "[*] Copy the CSR request over to your CA server"
#scp -P 22 -i ~/.ssh/id_rsa /etc/ssl/requests/ldap.csr [email protected]:/tmp/ldap.csr
#
#--------------------------------------------------------------------------------------------------------------------------
# COMPLETE CSR REQUEST USING THIS COMMAND ON YOUR CA
#--------------------------------------------------------------------------------------------------------------------------
#sudo openssl x509 -req -days 365 -in /tmp/ldap.csr -CA /etc/ssl/certs/ca.crt -CAkey /etc/ssl/private/ca.key -CAcreateserial -out /etc/ssl/certs/ldap.crt -sha256
#
#echo "[*] Copy the completed certificate back over to your LDAP server"
#scp -P 22 -i ~/.ssh/id_rsa /etc/ssl/requests/ldap.crt [email protected]:/tmp/ldap.crt
#
#--------------------------------------------------------------------------------------------------------------------------
# MOVE /tmp/ldap.crt OUT OF /tmp DIRECTORY AND INTO APPRORPIATE ONE AND SET PERMISSIONS OF LDAP SERVICE ON THOSE CERTS
#--------------------------------------------------------------------------------------------------------------------------
#sudo cp /tmp/ldap.crt /etc/ssl/certs/ldap.crt
#USER=$(ps aux | grep slapd | cut -d" " -f1 | grep -wv root)
#sudo chown $USER:$USER /etc/ssl/certs/ldap.crt
#sudo chown $USER:$USER /etc/ssl/private/ldap.key
#
#echo "[*] Create expected certificate file contents for LDAPS"
#sudo cat {/etc/ssl/certs/ldap.crt,/etc/ssl/certs/ca.crt} > /etc/ssl/certs/ldaps-cert.crt
#sudo chown $USER:$USER /etc/ssl//certs/ldaps-cert.crt
#
#echo "[*] Ensure the slapd service is configured to use those certificates
# Modify /etc/ldap/ldap.conf file so it uses the below values
# olcTLSCertificateKeyFile: /etc/ssl/private/ldap.key
# olcTLSCertificateFile: /etc/ssl/certs/ldaps-cert.crt
#sudo systemctl restart slapd.service
#sudo slapcat -b "cn=config" | egrep "olcTLSCertificateFile|olcTLSCertificateKeyFile"
#-------------------------------------------------- BEGIN CONFIGURATION ---------------------------------------------------#
# Below values are to ensure current LDAP authentication is used instead of cached values
LDAPSharedCacheSize 500000
LDAPCacheEntries -1
LDAPCacheTTL -1
LDAPOpCacheEntries -1
LDAPOpCacheTTL -1
ScriptAlias /nagios/cgi-bin "/usr/local/nagios/sbin"
<Directory "/usr/local/nagios/sbin">
SSLRequireSSL
Options ExecCGI
AllowOverride None
Order allow,deny
Allow from all
AuthBasicProvider ldap
AuthType Basic
AuthLDAPGroupAttributeIsDN on
AuthName "Enter LDAP Credentials"
#
# FOR OPEN LDAP
AuthLDAPGroupAttribute member
# AuthLDAPURL "ldap://ldapserver.domain.com:389/ou=People,dc=domain,dc=com?uid?sub?(objectClass=*)" NONE
AuthLDAPURL "ldaps://ldapserver.domain.com:636/ou=People,dc=domain,dc=com?uid?sub?(objectClass=*)" NONE
#
# FOR ACTIVE DIRECTORY
# AuthLDAPGroupAttribute memberOf
# #AuthLDAPURL "ldap://ldapserver.domain.com:389/cn=Users,dc=domain,dc=com?sAMAccountName?sub?(objectClass=*)" NONE
# AuthLDAPURL "ldaps://ldapserver.domain.com:636/cn=Users,dc=domain,dc=com?sAMAccountName?sub?(objectClass=*)" NONE
#
AuthLDAPBindDN "cn=admin,dc=domain,dc=com"
AuthLDAPBindPassword "Password123!"
Require ldap-group cn=nagiosusers,ou=Groups,dc=domain,dc=com
# OR
# Require valid-user
#
# BELOW IS USED FOR LOCAL USER ACCESS
# <IfVersion >= 2.3>
# <RequireAll>
# Require all granted
# AuthName "Nagios Access"
# AuthType Basic
# AuthUserFile /usr/local/nagios/etc/htpasswd.users
# Require valid-user
# </RequireAll>
# </IfVersion>
# <IfVersion < 2.3>
# Order allow,deny
# Allow from all
# AuthName "Nagios Access"
# AuthType Basic
# AuthUserFile /usr/local/nagios/etc/htpasswd.users
# Require valid-user
# </IfVersion>
</Directory>
Alias /nagios "/usr/local/nagios/share"
<Directory "/usr/local/nagios/share">
SSLRequireSSL
Options ExecCGI
AllowOverride None
Order allow,deny
Allow from all
AuthBasicProvider ldap
AuthType Basic
AuthLDAPGroupAttributeIsDN on
AuthName "Enter LDAP Credentials"
#
# FOR OPEN LDAP
AuthLDAPGroupAttribute member
# AuthLDAPURL "ldap://ldapserver.domain.com:389/ou=People,dc=domain,dc=com?uid?sub?(objectClass=*)" NONE
AuthLDAPURL "ldaps://ldapserver.domain.com:636/ou=People,dc=domain,dc=com?uid?sub?(objectClass=*)" NONE
#
# FOR ACTIVE DIRECTORY
# AuthLDAPGroupAttribute memberOf
# #AuthLDAPURL "ldap://ldapserver.domain.com:389/cn=Users,dc=domain,dc=com?sAMAccountName?sub?(objectClass=*)" NONE
# AuthLDAPURL "ldaps://ldapserver.domain.com:636/cn=Users,dc=domain,dc=com?sAMAccountName?sub?(objectClass=*)" NONE
#
AuthLDAPBindDN "cn=admin,dc=domain,dc=com"
AuthLDAPBindPassword "Password123!"
Require ldap-group cn=nagiosusers,ou=Groups,dc=domain,dc=com
# OR
# Require valid-user
#
# BELOW IS USED FOR LOCAL USER ACCESS
#
# <IfVersion >= 2.3>
# <RequireAll>
# Require all granted
# AuthName "Nagios Access"
# AuthType Basic
# AuthUserFile /usr/local/nagios/etc/htpasswd.users
# Require valid-user
# </RequireAll>
# </IfVersion>
# <IfVersion < 2.3>
# Order allow,deny
# Allow from all
# AuthName "Nagios Access"
# AuthType Basic
# AuthUserFile /usr/local/nagios/etc/htpasswd.users
# Require valid-user
# </IfVersion>
</Directory>