PR#50870: Ticket 50859 - support running only with ldaps socket - 389-ds-base

389-ds-base

#50870 Ticket 50859 - support running only with ldaps socket

Closed 3 years ago by spichugi. Opened 4 years ago by firstyear.

firstyear/389-ds-base 50859-ldaps-only into master

Ticket 50859 - support running only with ldaps socket

William Brown • 4 years ago

5afacd3

dirsrvtests/tests/suites/tls/tls_ldaps_only_test.py

file added

+46

		`@@ -0,0 +1,46 @@`
		`+ # --- BEGIN COPYRIGHT BLOCK ---`
		`+ # Copyright (C) 2020 William Brown <william@blackhats.net.au`
		`+ # All rights reserved.`
		`+ #`
		`+ # License: GPL (version 3 or any later version).`
		`+ # See LICENSE for details.`
		`+ # --- END COPYRIGHT BLOCK ---`
		`+ #`
		`+ import pytest`
		`+ import ldap`
		`+ from lib389.topologies import topology_st`
		`+ from lib389.utils import socket_check_open`
		`+`
		`+ pytestmark = pytest.mark.tier1`
		`+`
		`+ def test_tls_ldaps_only(topology_st):`
		`+ """Test that the server can run with ldaps only.`
		`+`
		`+ :id: 812d806b-9368-4534-a291-cbc60ac92a23`
		`+ :steps:`
		`+ 1. Enable TLS`
		`+ 2. Set the server to ldaps only and restart`
		`+ 3. Set the server to accept both and restart`
		`+ :expectedresults:`
		`+ 1. TlS is setup`
		`+ 2. The server only works on ldaps`
		`+ 3. The server accepts both.`
		`+ """`
		`+ standalone = topology_st.standalone`
		`+ # Enable TLS`
		`+ standalone.enable_tls()`
		`+ # Remember the existing port for later.`
		`+ plain_port = standalone.config.get_attr_val_utf8('nsslapd-port')`
		`+ tls_port = standalone.config.get_attr_val_utf8('nsslapd-securePort')`
		`+ # Disable the plaintext port`
		`+ standalone.config.disable_plaintext_port()`
		`+ standalone.restart()`
		`+ # Check we only have the tls port`
		`+ nport = standalone.config.get_attr_val_utf8('nsslapd-port')`
		`+ assert(nport == '0');`
		`+ # Setup the plain again.`
		`+ standalone.config.enable_plaintext_port(plain_port)`
		`+ standalone.restart()`
		`+ nport = standalone.config.get_attr_val_utf8('nsslapd-port')`
		`+ assert(nport == plain_port);`
		`+`

src/lib389/lib389/cli_conf/security.py

file modified

+13

		`@@ -11,6 +11,7 @@`
		`import os`
		`from lib389.config import Config, Encryption, RSA`
		`from lib389.nss_ssl import NssSsl`
		`+ from lib389.cli_base import _warn`


		`Props = namedtuple('Props', ['cls', 'attr', 'help', 'values'])`
		`@@ -203,6 +204,14 @@`
		`print(*lst, sep='\n')`


		`+ def security_disable_plaintext_port(inst, basedn, log, args, warn=True):`
		`+ if warn and args.json is False:`
		`+ _warn(True, msg="Disabling plaintext ldap port - you must have ldaps configured")`
		`+ inst.config.disable_plaintext_port()`
		`+ log.info("Plaintext port disabled - please restart your instance to take effect")`
		`+ log.info("To undo this change run the subcommand - 'dsconf <instance> config replace nsslapd-port=<port number>'")`
		`+`
		`+`
		`def cert_add(inst, basedn, log, args):`
		`"""Add server certificate`
		`"""`
		`@@ -367,6 +376,10 @@`
		`'Turn off security functionality. The rest of the configuration will be left untouched.'))`
		`security_disable_p.set_defaults(func=security_disable)`

		`+ security_disable_plain_parser = security_sub.add_parser('disable_plain_port',`
		`+ help="Disables the plain text LDAP port, allowing only LDAPS to function")`
		`+ security_disable_plain_parser.set_defaults(func=security_disable_plaintext_port)`
		`+`
		`# Server certificate management`
		`certs = security_sub.add_parser('certificate', help='Manage TLS certificates')`
		`certs_sub = certs.add_subparsers(help='certificate')`

src/lib389/lib389/config.py

file modified

+13

		`@@ -213,6 +213,19 @@`
		`report['fix'] = report['fix'].replace('YOUR_INSTANCE', self._instance.serverid)`
		`yield report`

		`+ def disable_plaintext_port(self):`
		`+ """`
		`+ Configure the server to not-provide the plaintext port.`
		`+ """`
		`+ self.set('nsslapd-port', '0')`
		`+`
		`+ def enable_plaintext_port(self, port):`
		`+ """`
		`+ Configure the server to provide the plaintext port on the specified port number.`
		`+ """`
		`+ self.set('nsslapd-port', port)`
		`+`
		`+`
		`class Encryption(DSLdapObject):`
		`"""`
		`Manage "cn=encryption,cn=config" tree, including:`

firstyear commented 4 years ago

Bug Description: As plaintext protocols have shown they are
unable to be effectively secured, we should have the choice to
be able to run the server only as LDAPS for high assurance
environments.

Fix Description: Add a test to assert we can move to ldaps only
and back to ldap/ldaps. Add a command to help make this easier for
admins to find and discover.

https://pagure.io/389-ds-base/issue/50859

Author: William Brown william@blackhats.net.au

Review by: ???