Un petit problème s’est posé lors d’un besoin très spécifique consistant à rediriger temporairement le traffic http d’une jail vers une autre jail hébergée sur un autre serveur ayant sa propre GW.

En image, cela sera plus parlant:

Comme on peut le voir; avec une simple règle RDR, le traffic retour repartait sur la gw du Server B (WAN) au lieu de revenir par son chemin original (LAN).

La solution est d’ajouter sur le ServerA une règle PF indiquant de réutiliser une interface particulière – en l’occurence la même que celle utilisée pour l’allée – pour le chemin du retour du paquet.

La règle:

pass in quick on vlan10 reply-to (vlan10 192.168.10.6) proto tcp from any to 192.168.10.206 port http keep state label pra.nli.http

Maintenant le paquet emprunte la même interface pour l’allée et le retour.

Ayant testé la beta, je suis désormais fan de ce service.

Voici comment l’utiliser sous Freebsd:

* Récupérer les sources

git clone https://github.com/letsencrypt/letsencrypt.git

* Installer les dépendances

 ./letsencrypt-auto --help --debug

* Créer un fichier common.ini

mkdir /usr/local/www/letsencrypt
mkdir /usr/local/etc/letsencrypt
vi mkdir /usr/local/etc/letsencrypt/common.ini

authenticator = webroot
webroot-path = /usr/local/www/letsencrypt
server = https://acme-v01.api.letsencrypt.org/directory
renew-by-default
agree-tos
email = xxxx@domain.com
rsa-key-size = 4096

* Editer la conf apache sur son vhost http/80

        ##################
        # LETS ENCRYPT
        ##################
    Alias "/.well-known/acme-challenge" "/usr/local/www/letsencrypt/.well-known/acme-challenge"
    
        Header set Content-Type "application/jose+json"
    

* Si vous avez une rewriteRule qui redirige le http => https; il faut ajouter une condition d’exclusion:

        RewriteEngine On
        RewriteCond %{REMOTE_PORT}  !^443$
        RewriteCond %{REQUEST_URI} !^/\.well\-known/acme\-challenge/
        RewriteRule ^/(.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

* Générer son certif

root@j-transmission:~/letsencrypt # ./letsencrypt-auto --server https://acme-v01.api.letsencrypt.org/directory certonly -c /usr/local/etc/letsencrypt/common.ini -d blog.distran.org
Updating letsencrypt and virtual environment dependencies.......
Running with virtualenv: /root/.local/share/letsencrypt/bin/letsencrypt --server https://acme-v01.api.letsencrypt.org/directory certonly -c /usr/local/etc/letsencrypt/common.ini -d blog.distran.org

IMPORTANT NOTES:
 - If you lose your account credentials, you can recover through
   e-mails sent to letsencrypt@distran.org.
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/blog.distran.org/fullchain.pem. Your cert
   will expire on 2016-03-11. To obtain a new version of the
   certificate in the future, simply run Let's Encrypt again.
 - Your account credentials have been saved in your Let's Encrypt
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Let's
   Encrypt so making regular backups of this folder is ideal.
 - If like Let's Encrypt, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

* Editer la conf apache pour que ca pointe sur le certif

SSLCertificateFile "/etc/letsencrypt/live/blog.distran.org/fullchain.pem"
SSLCertificateKeyFile "/etc/letsencrypt/live/blog.distran.org/privkey.pem"

* EN crontab pour une execution tous les 31 de chaque mois; donc 1 fois tous les 2 mois sachant que ca expire au bout de 3 mois:

10 3 31 * *   ( /root/letsencrypt/letsencrypt-auto --server https://acme-v01.api.letsencrypt.org/directory certonly -c /usr/local/etc/letsencrypt/commo
n.ini -d seed2.distran.org && /usr/local/etc/rc.d/apache24 restart ) > /tmp/cron_letsencrypt.log 2>&1

– Il faut installer les packages:

# pkg install -y nss_ldap pam_ldap openldap-client p5-Mozilla-CA

– Faire la conf du client ldap

vi /usr/local/etc/nss_ldap.conf

BASE ou=People,dc=infranix,dc=eu
URI ldaps://ldap1
TLS_CACERTDIR /usr/local/lib/perl5/site_perl/Mozilla/CA/cacert.pem
TLS_REQCERT allow
SASL_NOCANON    on

– Créer des symlink pour simplier la configuration vers ldap.conf

# ln -s /usr/local/etc/nss_ldap.conf /usr/local/etc/openldap/ldap.conf
# ln -s /usr/local/etc/nss_ldap.conf /usr/local/etc/ldap.conf

– Modifier nsswitch pour qu’il s’appuye sur ldap pour passwd et group

[root@app001 ~]# cat /etc/nsswitch.conf
#
# nsswitch.conf(5) - name service switch configuration file
# $FreeBSD: releng/10.2/etc/nsswitch.conf 224765 2011-08-10 20:52:02Z dougb $
#
group: files ldap
group_compat: nis
hosts: files dns
networks: files
passwd: files ldap
passwd_compat: nis
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files

– Modifier /etc/pam.d/ssh

root@app001 ~]# cat /etc/pam.d/sshd
#
# $FreeBSD: releng/10.2/etc/pam.d/sshd 197769 2009-10-05 09:28:54Z des $
#
# PAM configuration for the "sshd" service
#

# auth
auth        sufficient  /usr/local/lib/pam_ldap.so    no_warn try_first_pass
auth		sufficient	pam_opie.so		no_warn no_fake_prompts
auth		requisite	pam_opieaccess.so	no_warn allow_local
#auth		sufficient	pam_krb5.so		no_warn try_first_pass
#auth		sufficient	pam_ssh.so		no_warn try_first_pass
auth		required	pam_unix.so		no_warn try_first_pass

# account
account     required    /usr/local/lib/pam_ldap.so    no_warn ignore_authinfo_unavail ignore_unknown_user
account		required	pam_nologin.so
#account	required	pam_krb5.so
account		required	pam_login_access.so
account		required	pam_unix.so

# session
#session	optional	pam_ssh.so		want_agent
session     required    /usr/local/lib/pam_mkhomedir.so
session		required	pam_permit.so

# password
#password	sufficient	pam_krb5.so		no_warn try_first_pass
password	required	pam_unix.so		no_warn try_first_pass

– modifier /etc/pam.d/su pour mettre le bon groupe

[root@app001 ~]# cat /etc/pam.d/su
#
# $FreeBSD: releng/10.2/etc/pam.d/su 219663 2011-03-15 10:13:35Z des $
#
# PAM configuration for the "su" service
#

# auth
auth		sufficient	pam_rootok.so		no_warn
auth		sufficient	pam_self.so		no_warn
auth		requisite	pam_group.so		no_warn group=wheel,users root_only fail_safe ruser
auth		include		system

# account
account		include		system

# session
session		required	pam_permit.so

– modifier /etc/pam.d/system

root@app001 /etc/pam.d]# cat system

# $FreeBSD: releng/10.2/etc/pam.d/system 197769 2009-10-05 09:28:54Z des $
#
# System-wide defaults
#

# auth
auth		sufficient	/usr/local/lib/pam_ldap.so   no_warn try_first_pass
auth		sufficient	pam_opie.so		no_warn no_fake_prompts
auth		requisite	pam_opieaccess.so	no_warn allow_local
#auth		sufficient	pam_krb5.so		no_warn try_first_pass
#auth		sufficient	pam_ssh.so		no_warn try_first_pass
auth		required	pam_unix.so		no_warn try_first_pass nullok

# account
#account	required	pam_krb5.so
account         required        /usr/local/lib/pam_ldap.so   ignore_unknown_user ignore_authinfo_unavail
account		required	pam_login_access.so
account		required	pam_unix.so

# session
#session	optional	pam_ssh.so		want_agent
session		required	/usr/local/lib/pam_mkhomedir.so
session		required	pam_lastlog.so		no_fail

# password
#password	sufficient	pam_krb5.so		no_warn try_first_pass
password	required	pam_unix.so		no_warn try_first_pass

– modifier /etc/pam.d/passwd

[root@app001 /etc/pam.d]# cat passwd
#
# $FreeBSD: releng/10.2/etc/pam.d/passwd 113967 2003-04-24 12:22:42Z des $
#
# PAM configuration for the "passwd" service
#

# passwd(1) does not use the auth, account or session services.

# password
#password	requisite	pam_passwdqc.so		enforce=users
#password  required    pam_ldap.so
password	required	pam_unix.so		no_warn try_first_pass nullok

– OPTIONNEL : forcer le gidMember

vi /etc/group
users:*:100:

– pour tester

getent passwd

Dans un prochain post; je présenterais comment créer un schéma LDAP automatiquement en s’appuyant sur un backend SQL; et en l’occurence, celui de postfixadmin.
Toujours est-il que voici en avance une astuce pour qu’openldap reconnaisse les password SHA512 de postfixadmin.

* slapd.conf

Il faut avant tout activer le module sha2 qui permet de supporter des hash SHA étendu (256, 512):

moduleload      pw-sha2

Le format salt ici est ‘$6$’ qui invoque une méthode hash basée sur SHA512 et fournit 16 caractères de salt.

password-hash {CRYPT}                                                                                                                                                  
password-crypt-salt-format "$6$%.16s"

* SQL

update ldap_attr_mappings set sel_expr='replace(users.password, \'SHA512-CRYPT\', \'CRYPT\')' where id=13;

MySQL [ldap]> select * from ldap_attr_mappings where id=13;
+----+-----------+--------------+--------------------------------------------------+------------+-----------+----------------------------+----------+-------------+-----
--------+---------------+
| id | oc_map_id | name         | sel_expr                                         | sel_expr_u | from_tbls | join_where                 | add_proc | delete_proc | para
m_order | expect_return |
+----+-----------+--------------+--------------------------------------------------+------------+-----------+----------------------------+----------+-------------+-----
--------+---------------+
| 13 |         1 | userPassword | replace(users.password, 'SHA512-CRYPT', 'CRYPT') | NULL       | users     | users.password IS NOT NULL | NULL     | NULL        |
     3 |             0 |
+----+-----------+--------------+--------------------------------------------------+------------+-----------+----------------------------+----------+-------------+-----
--------+---------------+
1 row in set (0.01 sec)