0

I am trying to authenticate different services (specifically openfire for now) against Samba Active Directory over StartTLS (port 389).

While setting openfire up, I checked this option (Use StartTLS), but when I test the connection, I get this error:

[LDAP: error code 1 - 00002020: Operation unavailable without authentication]

I have to say that when I try to connect over LDAPS (using port 636), everything goes perfectly. Anyway that is clear that the connection without encryption on 389 will not work with AD (when I tried, openfire told me that I must use encryotion layer).

Could someone help me please to connect successfully over StartTLS?

Here is my smb.conf

[global]
        netbios name = S1
        realm = NOURELDIN.LOCAL
        workgroup = NOURELDIN
        dns forwarder = 8.8.8.8
        server role = active directory domain controller
        idmap_ldb:use rfc2307 = yes
        ldap ssl = start tls

[netlogon]
        path = /usr/local/samba/var/locks/sysvol/noureldin.local/scripts
        read only = No

[sysvol]
        path = /usr/local/samba/var/locks/sysvol
        read only = No

ps. I tried both adding and removing (ldap ssl = start tls) line with no difference.

I appreciate any help.

1 Answer 1

1

you probably need to import the samba ADS CA certificate in the openfire system

Edit: I installed samba4 in a centos vm and configured openfire to use ldap with startls.

After installing samba4 from sources as indicated in the samba wiki (https://wiki.samba.org/index.php/Build_Samba_from_source, https://wiki.samba.org/index.php/Setup_a_Samba_Active_Directory_Domain_Controller), I changed directory in the samba domain controller to /usr/local/samba/private/tls

Inside this folder you have three files:

# pwd
/usr/local/samba/private/tls
[root@dc1 tls]# ls -l
total 12
-rw-r--r--. 1 root root 2025 Jun 20 21:29 ca.pem
-rw-r--r--. 1 root root 2029 Jun 20 21:29 cert.pem
-rw-------. 1 root root 3243 Jun 20 21:29 key.pem

Copy the content of ca.pem. One way is:

# cat ca.pem 

Copy everything from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----

In the openfire console, go to TLS/SSL certificates and click on manage store contents of the trust store of server federation stores:

enter image description here

Click on 'import from':

and give the new CA a name like 'my awesome samba4 domain', and paste the contents of ca.pem:

enter image description here enter image description here

Verify the new CA is in there, it should be added to the list of the trusted stores:

enter image description here

verify in the server settings that you are using startls:

enter image description here

restart openfire, login as your administrative user in the web console. To verify you are using starttls you can use tcpdump.

Done.

8
  • Du you mean not using the auto generated CA, but generating my own self-signed CA and then import it to both Samba and Openfire? Jun 18, 2016 at 9:53
  • 1
    no, I mean using the samba ADS CA: wiki.samba.org/index.php/… Jun 18, 2016 at 10:06
  • I will try to copy and import it into openfire, anyway I am trying now at the very first step of setting openfire up and I cannot change the CA, but I still can check StartTLS, if that is really the problem, it doesnot make sesnse to show that startTLS option at this step. Jun 18, 2016 at 11:32
  • just for kicks I installed openfire in a centos 7 host. I do not have a samba ADS environment handy, but I do have a freeipa domain with both ldap and a PKI. So after joining the host to the domain and installing the openfire rpm I modified the start script /etc/rc.d/init.d/openfire, and added this: -Djavax.net.ssl.trustStore=/etc/pki/ca-trust/extracted/java/cacerts to the line starting with OPENFIRE_OPTS. After restarting the daemon I could use startls against the ldap server. Jun 18, 2016 at 21:19
  • so I have to use the CA certificate of samba, and then use it to generate all certifiactes of the other services? (sorry but I am not good practically in certs) Jun 20, 2016 at 13:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .