Setup 389 Directory Server, LDAPS, dan Cockpit di CentOS Stream 9

Pada bagian pertama ini, kita akan melakukan provisioning identity server menggunakan 389 Directory Server di CentOS Stream 9, mengaktifkan LDAPS :636, dan mengamankan Web Console Cockpit dengan sertifikat TLS.

Catatan keamanan: Seluruh password/token pada snippet di bawah menggunakan nilai placeholder. Jangan commit atau publish credential asli Anda.

Arsitektur

CentOS Stream 9
      |
      +-- Cockpit :9090
      |
      +-- 389 Directory Server (iqiterate)
            +-- LDAP  :389
            +-- LDAPS :636

Parameter yang digunakan:

Hostname : ldap.iqiterate.id
Instance : iqiterate
Base DN  : dc=iqiterate,dc=id

1. Hostname dan Firewall

hostnamectl set-hostname ldap.iqiterate.id
hostname -f

firewall-cmd --permanent --add-port=9090/tcp
firewall-cmd --permanent --add-port=636/tcp
firewall-cmd --reload

Untuk production, jangan expose port 9090 secara publik jika Cockpit akan diakses dari belakang reverse proxy atau VPN.

2. Install acme.sh

curl https://get.acme.sh | sh
source ~/.bashrc

Sertifikat TLS/SSL diterbitkan menggunakan ACME secara standalone. Pastikan port 80 terbuka saat proses issue berlangsung:

acme.sh --issue \
  -d ldap.iqiterate.id \
  -d cockpit.iqiterate.id \
  --standalone

Simpan certificate ke path sistem:

mkdir -p /etc/ssl/iqiterate

cp ~/.acme.sh/ldap.iqiterate.id_ecc/fullchain.cer \
  /etc/ssl/iqiterate/fullchain.pem

cp ~/.acme.sh/ldap.iqiterate.id_ecc/ldap.iqiterate.id.key \
  /etc/ssl/iqiterate/privkey.pem

3. Install Cockpit, 389 Directory Server, dan Plugin

Aktifkan repositori resmi 389 Directory Server via COPR, lalu install package cockpit, 389-ds-base, beserta plugin cockpit-389-ds secara bersamaan:

dnf copr enable -y @389ds/389-directory-server
dnf install -y cockpit cockpit-389-ds 389-ds-base
systemctl enable --now cockpit.socket

Plugin Cockpit 389 DS: Mengintegrasikan kapabilitas manajemen 389 Directory Server langsung di sidebar Cockpit. Berguna untuk memantau status instance, metrik traffic, log query, TLS/SSL, dan visualisasi database suffix.

Konfigurasi Certificate Cockpit

Pasang sertifikat TLS pada web server Cockpit:

cp /etc/ssl/iqiterate/fullchain.pem /etc/cockpit/ws-certs.d/50-iqiterate.crt
cp /etc/ssl/iqiterate/privkey.pem /etc/cockpit/ws-certs.d/50-iqiterate.key

chown --reference=/etc/cockpit/ws-certs.d/0-self-signed.cert /etc/cockpit/ws-certs.d/50-iqiterate.crt
chown --reference=/etc/cockpit/ws-certs.d/0-self-signed.cert /etc/cockpit/ws-certs.d/50-iqiterate.key
chmod --reference=/etc/cockpit/ws-certs.d/0-self-signed.cert /etc/cockpit/ws-certs.d/50-iqiterate.crt
chmod --reference=/etc/cockpit/ws-certs.d/0-self-signed.cert /etc/cockpit/ws-certs.d/50-iqiterate.key
restorecon -v /etc/cockpit/ws-certs.d/50-iqiterate.*

systemctl restart cockpit.socket cockpit.service

Akses Web Console:

https://ldap.iqiterate.id:9090

Inisialisasi Instance 389 Directory Server

Buat file konfigurasi instance.inf:

[general]
config_version = 2

[slapd]
instance_name = iqiterate
root_dn = cn=Directory Manager
root_password = PASSWORD_DIRECTORY_MANAGER
port = 389
secure_port = 636

[backend-userroot]
suffix = dc=iqiterate,dc=id

Lakukan provisioning instance:

dscreate from-file instance.inf
dsctl iqiterate status

4. Import Certificate ke NSS Database

Ekstrak NSS database password bawaan dari instance:

cat /etc/dirsrv/slapd-iqiterate/pin.txt | cut -d':' -f2 | tr -d ' ' > /etc/dirsrv/slapd-iqiterate/pwdfile.txt
chown dirsrv:dirsrv /etc/dirsrv/slapd-iqiterate/pwdfile.txt
chmod 400 /etc/dirsrv/slapd-iqiterate/pwdfile.txt

Ekstrak hanya sertifikat server (leaf certificate):

openssl x509 -in /etc/ssl/iqiterate/fullchain.pem -out /tmp/server-only.pem

Generate file PKCS#12 (.p12) dengan nickname ldap-cert:

openssl pkcs12 -export -legacy \
  -out /tmp/ldap_clean.p12 \
  -in /tmp/server-only.pem \
  -inkey /etc/ssl/iqiterate/privkey.pem \
  -passout pass:PASSWORD_PKCS12 \
  -name "ldap-cert"

Hapus nickname lama jika sudah ada (mencegah conflict):

certutil -d /etc/dirsrv/slapd-iqiterate -D -n "ldap-cert" -f /etc/dirsrv/slapd-iqiterate/pwdfile.txt 2>/dev/null || true

Import ke database NSS:

pk12util -d /etc/dirsrv/slapd-iqiterate \
  -i /tmp/ldap_clean.p12 \
  -k /etc/dirsrv/slapd-iqiterate/pwdfile.txt \
  -w <(echo "PASSWORD_PKCS12")

chown dirsrv:dirsrv /etc/dirsrv/slapd-iqiterate/*.db
rm -f /tmp/ldap_clean.p12 /tmp/server-only.pem

Set ldap-cert sebagai primary certificate di konfigurasi 389-ds:

ldapmodify -H ldap://localhost:389 -x -D "cn=Directory Manager" -w "PASSWORD_DIRECTORY_MANAGER" <<EOF
dn: cn=RSA,cn=encryption,cn=config
changetype: modify
replace: nsSSLPersonalitySSL
nsSSLPersonalitySSL: ldap-cert
EOF

Restart service:

dsctl iqiterate restart

5. Verifikasi LDAPS dan Cockpit Web Console

Pastikan port TLS (636) sudah berstatus listening:

ss -lntp | grep -E ':389|:636'

Periksa respon certificate:

openssl s_client \
  -connect ldap.iqiterate.id:636 \
  -servername ldap.iqiterate.id \
  -showcerts </dev/null

Test validasi bind:

ldapsearch \
  -H ldaps://ldap.iqiterate.id:636 \
  -x \
  -D "cn=Directory Manager" \
  -W \
  -b "dc=iqiterate,dc=id" \
  "(objectClass=*)"

Verifikasi di Cockpit Web Console

1. Buka browser: https://ldap.iqiterate.id:9090
2. Login menggunakan user administratif Linux (misal: user dengan hak sudo).
3. Pada sidebar navigasi sebelah kiri, klik menu 389 Directory Server.
4. Instance iqiterate akan otomatis terdeteksi dengan status Running, menampilkan port aktif (389 & 636), status TLS certificate, dan konfigurasi database suffix dc=iqiterate,dc=id.

6. Hasil Akhir

                 ldap.iqiterate.id
                        |
          +-------------+-------------+
          |                           |
       Cockpit                     389-ds
        :9090                        |
                              +------+------+
                              :389          :636
                              LDAP         LDAPS

Setelah tahap ini selesai, identity server dan secure LDAPS sudah siap digunakan. Pada bagian selanjutnya, kita akan merancang arsitektur struktur Directory Information Tree (DIT) untuk persiapan integrasi bersama klaster OpenShift.