Thanks to everyone who helped me.
Since it was a struggle for me, I thought that I would post how I did it
in case others have the same problems that I had. Maybe it will help
someone else.
My Setup:
Fedora Core 4
Fedora Directory Server 1.0.2
Windows 2000 Server
Install FDS ( or reinstall: rpm -qa | grep fedora-ds | xargs rpm -e; rm
-rf /opt/fedora-ds ; rpm -i fedora-ds-1.0.2 )
create certificates, etc..
I used this simple script that I wrote: (cd to /opt/fedora-ds/alias)
-----------------------------------------------------------------------
echo -n "Creating password and noise file..."
echo "8904859034905834-580943502385430958430958049385" >
/opt/fedora-ds/alias/pwdfile.txt
echo "8374893jkhsdfjkhdjksfah89dskjfkdghkjdfhguiert9348khkfhgkjfd79" >
/opt/fedora-ds/alias/noise.txt
echo -n "Creating Databases..."
$serverroot/shared/bin/certutil -N -d . -f pwdfile.txt
echo -n "Generating encryption key..."
$serverroot/shared/bin/certutil -G -d . -z noise.txt -f pwdfile.txt
echo -n "Generating self-signed certificate..."
$serverroot/shared/bin/certutil -S -n "CA certificate" -s "cn=CAcert" -x
-t "CT,," -m 1000 -v 120 -d . -z noise.txt -f pwdfile.txt
echo -n "Generating server certificate.."
$serverroot/shared/bin/certutil -S -n "Server-Cert" -s
"cn=msas.msd.lbl.gov" -c "CA certificate" -t "u,u,u" -m 1001 -v 120 -d
. -z noise.txt -f pwdfile.txt
mv key3.db slapd-msas-key3.db
mv cert8.db slapd-msas-cert8.db
ln -s slapd-msas-key3.db key3.db
ln -s slapd-msas-cert8.db cert8.db
echo -n "Setting permissions.."
chown nobody.nobody /opt/fedora-ds/alias/slapd-msas*
echo -n "Exporting certificate.."
$serverroot/shared/bin/certutil -L -d . -n "CA certificate" -r > cacert.der
echo "Converting certificate.."
openssl x509 -inform DER -in cacert.der -outform PEM -out cacert.pem
echo "Copying cacert.pem to /etc/openldap/cacerts.."
cp cacert.pem /etc/openldap/cacerts/
echo -n "Enabling SSL in FDS"
echo ""
echo -n "Please enter Manager password..(twice)"
ldapmodify -x -D cn=Manager -W -f /tmp/ssl_enable.ldif
ldapmodify -x -D cn=Manager -W -a -f /tmp/addRSA.ldif
---------------------------------------------------------
restart FDS
Test SSL connections and ldapsearch
netstat -an | grep 636
Install Active Directory on Windows Server
Install Certificate Services --> Enterprise root CA
reboot
Enable SSL on AD
1. Install Certificate Services on Windows 2000 Server and an
Enterprise Certificate Authority in the Active Directory Domain.
Make sure you install an Enterprise Certificate Authority.
2. Create a Security (Group) Policy to direct Domain Controllers to
get an SSL certificate from the Certificate Authority (CA).
1. Open the Active Directory Users and Computers Administrative
tool.
2. Under the domain, right-click on Domain Controllers.
3. Select Properties.
4. In the Group Policy tab, click to edit the Default Domain
Controllers Policy.
5. Go to Computer Configuration->Windows Settings->Security
Settings->Public Key Policies.
6. Right click Automatic Certificate Request Settings.
7. Select New.
8. Select Automatic Certificate Request.
9. Run the wizard. Select the Certificate Template for a Domain
Controller.
10. Select your Enterprise Certificate Authority as the CA.
Selecting a third-party CA works as well.
11. Complete the wizard.
12. All Domain Controllers now automatically request a
certificate from the CA, and support LDAP using SSL on port 636.
3. Retrieve the Certificate Authority Certificate
1. Open a Web browser on the AD machine
2. Go to http://localhost/certsrv/
3. Select the task Retrieve the CA certificate or certificate
revocation list.
4. Click Next.
5. The next page automatically highlights the CA certificate.
Click Download CA certificate.
6. A new download window opens. Save the file to the hard drive.
Save in DER mode
Copy file to FDS server, convert to PEM format
openssl x509 -inform DER -in ad-cert.der -outform PEM -out ad-cert.pem
Import AD CA cert into FDS
certutil -A -d . -P slapd-instance- -t "CT,CT,CT" -a -i ad-cert.pem
check certs ( from /opt/fedora-ds/alias)
certutil -L -d . -P slapd-instance
Check ldapsearch from FDS to AD
ldapsearch -Z -P <RHDS-cert8.db> -h <AD/NT Hostname> -p <AD SSL port>
-D "<sync manager user> -w < sync manager password> -s <scope>
-b "<AD base>" "<filter>"
Install PassSync on Windows machine.
Follow directions from Howto:WindowsSync (certificate creation)
restart AD server
Enable Replication in Directory Server Console:
Go to configuration tab --> Replication --> enable changelog --> default
Expand Replication, click UserRoot
Check "Enable Replica" Single-master
Right Click UserRoot --> Create new windows sync agreement
Up log level in FDS:
dn: cn=config
changetype: modify
replace: nsslapd-errorlog-level
nsslapd-errorlog-level: 8192
ldapmodify -x -D "cn=directory manager" -a -f repl_log.ldif
restart FDS
right click win sync agreement --> Initiate Full Sync
check error logs (/opt/fedora/slapd-instance/logs/errors)
In order for users to be created on the Windows side, users must have
certain attributes.
e.g.
dn: uid=TBird,ou=People, dc=server,dc=com
givenName: Tweetie
ntUserCreateNewAccount: true
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: ntuser
objectClass: posixAccount
facsimileTelephoneNumber: 510-555-5555
uid: TBird
mail: tbird at server.com
uidNumber: 71209
cn: Tweetie Bird
ntUserComment: Tweetie Bird User Account
telephoneNumber: 510-555-5555
loginShell: /bin/bash
ntUserDomainId: tbird
gidNumber: 5000
ntUserDeleteAccount: true
gecos: Tweetie Bird
homeDirectory: /home/tbird
sn: Bird
userPassword::
I hope that I have this right.
