OpenLDAP Quick Tips: Encrypt your Oracle Berkeley DB if necessary

Twitter

Calendar

Tuesday, December 9. 2008

OpenLDAP Quick Tips: Encrypt your Oracle Berkeley DB if necessary

Hi All,

Here's the 18th tip in the "OpenLDAP Quick Tips" series:

"You need to encrypt the raw bdb files":

This might be useful various reasons:

It may actually provide some value to sites that do regular backups of their raw DB files. It may actually be useful in some cases where you provide an encryption key on separate removable media (e.g. a USB flash drive). It might actually prevent a news article down the road on how some organization lost their 5 million record customer database and now all that unprotected data is now being exploited by criminals.

I doubt it, of course. It exacts a performance penalty on every DB operation, so I don't think anyone will be able to use this long-term. For the off-site backup scenario, it makes more sense to just encrypt the backup images (tar format or whatever backup utility is used). That way you only spend cycles on encryption once, at backup time. Any site that's savvy enough to do automated backups can certainly figure out how to protect those backups with encryption.

Also:

The one place where I could see using this is if one is using OpenLDAP as
the backend to a Kerberos KDC. It's considered best practice right now to
always encrypt the KDC database at rest on disk, and some sites even
require an administrator be present with a USB key to unlock the database
whenever a KDC has to be rebooted. Given the increasing interest in using
LDAP^[?] as a backend store for the KDC, this may be a simpler method for
providing equivalent KDC security without encrypting various bits of data
individually

Taking this all into account, what is needed is simply adding to your slapd.conf file:

CODE:

cryptkey testing

Note: there is also a cryptfile option to store the password in a seperate file.

If you already have a directory setup, then exporting your data and importing it again is needed to encrypt the files. A basic slapd.conf file needed would be:

CODE:

include /usr/local/etc/openldap/schema/core.schema pidfile ./slapd.pid argsfile ./slapd.args modulepath /usr/local/libexec/openldap moduleload back_bdb.la database bdb suffix "dc=suretecsystems,dc=com" rootdn "cn=admin,dc=suretecsystems,dc=com" rootpw secret directory ./openldap-data cryptkey testing index objectClass eq

Then import your data with slapadd and test with the bdb tools:

CODE:

[ghenry@suretec openldap-data]$ /usr/local/BerkeleyDB.4.7/bin/db_dump objectClass.bdb db_verify: Encrypted environment: no encryption key supplied [ghenry@suretec openldap-data]$ /usr/local/BerkeleyDB.4.7/bin/db_dump -P "test" objectClass.bdb db_verify: Invalid password [ghenry@suretec openldap-data]$ /usr/local/BerkeleyDB.4.7/bin/db_dump -P "testing" objectClass.bdb VERSION=3 format=bytevalue type=btree chksum=1 duplicates=1 dupsort=1 db_pagesize=4096 HEADER=END 0096defd 00000001 21d9e0af 00000001 62c4d55f 00000001 DATA=END