The next step is to configure our LDAP settings in NxFilter.
The configuration of stunnel for other linux distros is similar and for Ubuntu, you can follow Google's instructions here: īe sure to enable the LDAP client service in the Google Admin panel! To see the service status and logs: systemctl status stunnel Then enable the service to start/stop with the system: systemctl enable stunnel and start it: systemctl start stunnel. The CentOS stunnel rpm doesn't provide a startup script but you can add this to /etc/systemd/system/rvice to have stunnel started and stopped with the system: ĭescription=SSL tunnel for network daemonsĮxecStart=/usr/bin/stunnel /etc/stunnel/nf On CentOS 7, it's packaged in the base repository and can be installed by running yum -y install stunnel Next you'll need to create a tunnel configuration in /etc/stunnel/nf and unzip your Google LDAP certificate and key to /etc/stunnel/ The nf file should be similar to this: Now we need to install stunnel on our NxFilter server. You'll need to follow these instructions to create the LDAP client certificates in your GSuite Admin panel for stunnel here: and download the generated zip file with the crt and key files to your NxFilter server. Ideally, you'll run stunnel on the same server as NxFilter and only listen locally so that you don't expose your GSuite LDAP directory beyond that server. For clients that don't offer a way to authenticate to LDAP with a client certificate, we'll use stunnel as a proxy and configure stunnel to provide the client certificate to the Google LDAP server and configure NxFilter to connect to stunnel. Currently, NxFilter doesn't have a way to import the certificates to connect directly to Google's Secure LDAP. In order to use GSuite's Secure LDAP, it requires the client(NxFilter) to authenticate with a certificate. You can read more about Secure LDAP and how to configure it in your admin console here: It's now possible to import your Google GSuite users and groups into NxFilter thanks to Google opening up access to their Secure LDAP service.
0 kommentar(er)
