lanycrost/openldap
OpenLDAP server w/TLS + replication support, S6 overlay, Fusion Directory schema's included.
10K+
lanycrost/openldap repository overview
Docker OpenLDAP container w/ Fusion Directory schema's included
Introduction
Dockerfile to build a OpenLDAP Server for maintaining a directory with Fusion Directory Schema's Included. Upon starting this image it will give you a ready to run server with many configurable options.
- This Container uses a Alpine Linux.
- Compiles from source
- Multiple backends (bdb, hdb, mdb, sql)
- All overlays compiled
- Supports TLS encryption
- Supports Replication
- Scheduled Backups of Data
- Ability to choose NIS or rfc2307bis Schema
- Two Password Checking Modules - check_password.so and ppm.so
NOTE:This Container uses a customized Alpine Linux which includes s6 overlay enabled for PID 1 Init capabilities, Cron also installed along with other tools (bash, curl, less, vim) for easier management.
Table of Contents
Dependencies
To utilize, you must also have the Fusion Directory image built and available.
Installation
Automated builds of the image are available on Registry and is the recommended method of installation.
docker pull lanycrost/openldap
Quick Start
-
The quickest way to get started is using docker-compose. See the examples folder for a working docker-compose.yml that can be modified for development or production use.
-
Set various environment variables to understand the capabilities of this image.
-
Map persistent storage for access to configuration and data files for backup.
-
Map Network Ports to allow external access.
Start openldap using:
docker-compose up
NOTE: Please allow up to 2 minutes for the application to start for the first time if you are generating TLS certificates.
Data-Volumes
The following directories are used for configuration and can be mapped for persistent storage.
| Directory | Description |
|---|---|
/var/lib/openldap | Data Directory |
/etc/openldap/slapd.d | Configuration Directory |
/assets/custom-scripts/ | If you'd like to execute a script during the initialization process drop it here (Useful for using this image as a base) |
/assets/slapd/certs/ | Drop TLS Certificates here |
/data/backup | Backup Directory |
/assets/fusiondirectory-custom/ | Place Schema files here to be imported into Fusion Directory |
Environment Variables
Below is the complete list of available options that can be used to customize your installation.
Required and used for new ldap server only:
| Variable | Description |
|---|---|
DOMAIN | LDAP domain. Default vtg.local |
BASE_DN | LDAP base DN. If empty automatically set from DOMAIN value. Default (empty) |
ADMIN_PASS | Ldap Admin password. Default admin |
CONFIG_PASS | Ldap Config password. Default config |
ORGANIZATION | Organization Name Default: VTG Software |
ENABLE_READONLY_USER | Add a read only user. Defaultfalse |
READONLY_USER_USER | Read only user username. Default `readonly |
READONLY_USER_PASS | Read only user password. Default readonly |
SCHEMA_TYPE | Use nis or rfc2307bis core schema. Default nis |
Required and used for Fusion Directory:
| Variable | Description |
|---|---|
FUSIONDIRECTORY_ADMIN_USER | Default FD Admin User - Default fd-admin |
FUSIONDIRECTORY_ADMIN_PASS | Default FD Admin Password - Default admin |
ORGANIZATION | Organization Name Default: VTG Software |
| Variable | Description |
|---|---|
BACKEND | Ldap backend. bdb hdb mdb and others. Default mdb |
LOG_LEVEL | Set LDAP Log Level - Default 256 |
Backup Options:
| Variable | Description |
|---|---|
BACKUP_CONFIG_CRON_PERIOD | Cron expression to schedule OpenLDAP config backup. Defaults 0 4 * * * Every day at 4am. |
BACKUP_DATA_CRON_PERIOD | Cron expression to schedule OpenLDAP data backup. Defaults 0 4 * * * Every day at 4am. |
BACKUP_TTL | Automatically cleanup backup after how many days. Default 15 |
Password Policy Options:
If you already have a check_password.conf or ppm.conf in /etc/openldap/ the following environment variables will not be applied
| Variable | Description |
|---|---|
PPOLICY_CHECK_RDN | Check RDN Parameter (ppm.so) - Default 0 |
PPOLICY_FORBIDDEN_CHARACTERS | Forbidden Characters (ppm.so) - Default `` |
PPOLICY_MAX_CONSEC | Maximum Consective Character Pattern - Default 0 |
PPOLICY_MIN_DIGIT | Minimum Digit Characters - Default 0 |
PPOLICY_MIN_LOWER | Minimum Lowercase Characters - Default 0 |
PPOLICY_MIN_POINTS | Minimum Points required to pass checker - Default 3 |
PPOLICY_MIN_PUNCT | Minimum Punctuation Characters - Default 0 |
PPOLICY_MIN_UPPER | Minimum Uppercase Characters - Default 0 |
PPOLICY_USE_CRACKLIB | Use Cracklib for verifying words (ppm.so) - Default 1 |
TLS options:
| Variable | Description |
|---|---|
ENABLE_TLS | Add TLS capabilities. Can't be removed once set to true. Defaults true |
TLS_CRT_FILENAME | Ldap ssl certificate filename. Default cert.pem |
TLS_KEY_FILENAME | Ldap ssl certificate private key filename. Default key.pem |
TLS_CA_CRT_FILENAME | Ldap ssl CA certificate filename. Default ca.pem |
TLS_ENFORCE | Enforce TLS. Can't be disabled once set to true. Defaults false |
TLS_CIPHER_SUITE | TLS cipher suite. Default ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:-DHE-DSS:-RSA:!aNULL:!MD5:!DSS:!SHA |
TLS_VERIFY_CLIENT | TLS verify client. Default try |
Help: http://www.openldap.org/doc/admin24/tls.html
Replication options:
| Variable | Description |
|---|---|
ENABLE_REPLICATION | Add replication capabilities. Multimaster only at present. Default false |
REPLICATION_CONFIG_SYNCPROV | olcSyncRepl options used for the config database. Without rid and provider which are automatically added based on REPLICATION_HOSTS. Default binddn="cn=admin,cn=config" bindmethod=simple credentials=$CONFIG_PASS searchbase="cn=config" type=refreshAndPersist retry="60 +" timeout=1 starttls=critical |
REPLICATION_DB_SYNCPROV | olcSyncRepl options used for the database. Without rid and provider which are automatically added based on REPLICATION_HOSTS. Default binddn="cn=admin,$BASE_DN" bindmethod=simple credentials=$ADMIN_PASS searchbase="$BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="60 +" timeout=1 starttls=critical |
REPLICATION_HOSTS | list of replication hosts seperated by a space, must contain the current container hostname set by --hostname on docker run command. If replicating all hosts must be set in the same order. Example - ldap://ldap1.example.com ldap://ldap2.example.com ldap://ldap3.example.com |
Other environment variables:
| Variable | Description |
|---|---|
REMOVE_CONFIG_AFTER_SETUP | Delete config folder after setup. Default true |
SSL_HELPER_PREFIX | Ssl-helper environment variables prefix. Default ldap, ssl-helper first search config from SSL_HELPER_* variables, before SSL_HELPER_* variables. |
Fusion Directory Schema Installation
Depending on your choices, the following schemas are available for installation. You must have these also enabled on the Fusion Directory application image to make use of it. If you would like to reapply the schemas set REAPPLY_PLUGIN_SCHEMAS to TRUE.
| Variable | Description |
|---|---|
REAPPLY_PLUGIN_SCHEMAS | Reapply Plugin Schemas TRUE or FALSE - Default: FALSE |
PLUGIN_ALIAS | Mail Aliases - Default: FALSE |
PLUGIN_APPLICATIONS | Applications - Default: FALSE |
PLUGIN_ARGONAUT | Argonaut - Default: FALSE |
PLUGIN_AUDIT | Audit Trail - Default: TRUE |
PLUGIN_AUTOFS | AutoFS - Default: FALSE |
PLUGIN_CERTIFICATES | Manage Certificates - Default: FALSE |
PLUGIN_COMMUNITY | Community Plugin - Default: FALSE |
PLUGIN_CYRUS | Cyrus IMAP - Default: FALSE |
PLUGIN_DEBCONF | Argonaut Debconf - Default: FALSE |
PLUGIN_DEVELOPERS | Developers Plugin - Default: FALSE |
PLUGIN_DHCP | Manage DHCP - Default: FALSE |
PLUGIN_DNS | Manage DNS - Default: FALSE |
PLUGIN_DOVECOT | Dovecot IMAP - Default: FALSE |
PLUGIN_DSA | System Accounts - Default: TRUE |
PLUGIN_EJBCA | Unknown - Default: FALSE |
PLUGIN_FAI | Unknown - Default: FALSE |
PLUGIN_FREERADIUS | FreeRadius Management - Default: FALSE |
PLUGIN_FUSIONINVENTORY | Inventory Plugin - Default: FALSE |
PLUGIN_GPG | Manage GPG Keys - Default: FALSE |
PLUGIN_IPMI | IPMI Management - Default: FALSE |
PLUGIN_MAIL | Mail Attributes - Default: TRUE |
PLUGIN_MIXEDGROUPS | Unix/LDAP Groups - Default: FALSE |
PLUGIN_NAGIOS | Nagios Monitoring - Default: FALSE |
PLUGIN_NETGROUPS | NIS - Default: FALSE |
PLUGIN_NEWSLETTER | Manage Newsletters - Default: FALSE |
PLUGIN_OPSI | Inventory - Default: FALSE |
PLUGIN_PERSONAL | Personal Details - Default: TRUE |
PLUGIN_POSIX | Posix Groups - Default: FALSE |
PLUGIN_POSTFIX | Postfix SMTP - Default: FALSE |
PLUGIN_PPOLICY | Password Policy - Default: TRUE |
PLUGIN_PUPPET | Puppet CI - Default: FALSE |
PLUGIN_PUREFTPD | FTP Server - Default: FALSE |
PLUGIN_QUOTA | Manage Quotas - Default: FALSE |
PLUGIN_RENATER_PARTAGE | Unknown - Default: FALSE |
PLUGIN_REPOSITORY | Argonaut Deployment Registry - Default: FALSE |
PLUGIN_SAMBA | File Sharing - Default: FALSE |
PLUGIN_SOGO | Groupware - Default: FALSE |
PLUGIN_SPAMASSASSIN | Anti Spam - Default: FALSE |
PLUGIN_SQUID | Proxy - Default: FALSE |
PLUGIN_SSH | Manage SSH Keys - Default: TRUE |
PLUGIN_SUBCONTRACTING | Unknown - Default: FALSE |
PLUGIN_SUDO | Manage SUDO on Hosts - Default: FALSE |
PLUGIN_SUPANN | SUPANN - Default: FALSE |
PLUGIN_SYMPA | Sympa Mailing List - Default: FALSE |
PLUGIN_SYSTEMS | Systems Management - Default: TRUE |
PLUGIN_USER_REMINDER | Password Expiry - Default: FALSE |
PLUGIN_WEBLINK | Display Weblink - Default: FALSE |
Networking
The following ports are exposed and available to public interfaces
| Variable | Description |
|---|---|
389 | Unecrypted LDAP |
636 | TLS Encrypted LDAP |
Maintenance
Shell Access
For debugging and maintenance purposes you may want access the containers shell.
docker exec -it (whatever your container name is e.g. openldap) bash
Authors
References
Tag summary
Content type
Image
Digest
Size
166.5 MB
Last updated
almost 8 years ago
docker pull lanycrost/openldap