3

I have set up an openldap server using this guide here. It worked fine. But as I want to use sssd I also need TLS to be working for LDAP. I looked into and followed the TLS part of the guide.

I never got any errors and slapd started fine again.

BUT. It does not seem to work when I try to use LDAP over TLS.

root@server:~# ldapsearch -x -ZZ -H ldap://83.209.243.253 -b dc=daladevelop,dc=se
ldap_start_tls: Protocol error (2)
    additional info: unsupported extended operation

Cranking up the debug level some notches returns some more information:

root@server:~# ldapsearch -x -ZZ -H ldap://83.209.243.253 -b dc=daladevelop,dc=se -d 5
ldap_url_parse_ext(ldap://83.209.243.253)
ldap_create
ldap_url_parse_ext(ldap://83.209.243.253:389/??base)
ldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 83.209.243.253:389
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 83.209.243.253:389
ldap_pvt_connect: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_scanf fmt ({) ber:
ber_flush2: 31 bytes to sd 3
ldap_result ld 0x7f25df51e220 msgid 1
wait4msg ld 0x7f25df51e220 msgid 1 (infinite timeout)
wait4msg continue ld 0x7f25df51e220 msgid 1 all 1
** ld 0x7f25df51e220 Connections:
* host: 83.209.243.253  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Fri Jun  6 08:52:16 2014


** ld 0x7f25df51e220 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x7f25df51e220 request count 1 (abandoned 0)
** ld 0x7f25df51e220 Response Queue:
   Empty
  ld 0x7f25df51e220 response count 0
ldap_chkResponseList ld 0x7f25df51e220 msgid 1 all 1
ldap_chkResponseList returns ld 0x7f25df51e220 NULL
ldap_int_select
read1msg: ld 0x7f25df51e220 msgid 1 all 1
ber_get_next
ber_get_next: tag 0x30 len 42 contents:
read1msg: ld 0x7f25df51e220 msgid 1 message type extended-result
ber_scanf fmt ({eAA) ber:
read1msg: ld 0x7f25df51e220 0 new referrals
read1msg:  mark request completed, ld 0x7f25df51e220 msgid 1
request done: ld 0x7f25df51e220 msgid 1
res_errno: 2, res_error: <unsupported extended operation>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_parse_extended_result
ber_scanf fmt ({eAA) ber:
ldap_parse_result
ber_scanf fmt ({iAA) ber:
ber_scanf fmt (}) ber:
ldap_msgfree
ldap_err2string
ldap_start_tls: Protocol error (2)
        additional info: unsupported extended operation
ldap_free_connection 1 1
ldap_send_unbind
ber_flush2: 7 bytes to sd 3
ldap_free_connection: actually freed

So no good information there either.

In /var/log/syslog I get:

Jun  6 08:55:42 master slapd[21383]: conn=1008 fd=23 ACCEPT from IP=83.209.243.253:56440 (IP=0.0.0.0:389)
Jun  6 08:55:42 master slapd[21383]: conn=1008 op=0 EXT oid=1.3.6.1.4.1.1466.20037
Jun  6 08:55:42 master slapd[21383]: conn=1008 op=0 do_extended: unsupported operation "1.3.6.1.4.1.1466.20037"
Jun  6 08:55:42 master slapd[21383]: conn=1008 op=0 RESULT tag=120 err=2 text=unsupported extended operation
Jun  6 08:55:42 master slapd[21383]: conn=1008 op=1 UNBIND
Jun  6 08:55:42 master slapd[21383]: conn=1008 fd=23 closed

If I portscan the host I get the following:

Starting Nmap 6.40 ( http://nmap.org ) at 2014-06-06 08:56 CEST
Nmap scan report for h83-209-243-253.static.se.alltele.net (83.209.243.253)
Host is up (0.0072s latency).
Not shown: 996 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
389/tcp open  ldap
636/tcp open  ldapssl

But when I check certs

root@master:~# openssl s_client -connect daladevelop.se:636 -showcerts -state
CONNECTED(00000003)
SSL_connect:before/connect initialization
SSL_connect:unknown state
140244859233952:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 317 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

I feel like I am clearly out in deep water not knowing at all where to go from here. Any hints appreciated on what to do or to get better debug logging.

EDIT: This is my config slapcated from cn=config and it does not mention anything about TLS.

I have inserted my certinfo.ldif:

root@master:~# cat certinfo.ldif 
dn: cn=config

add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/daladevelop_slapd_cert.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/daladevelop_slapd_key.pem

and when doing that I only got this as an answer.

root@master:~# sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f certinfo.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"

So still no wiser.

2
  • Everything you have posted demonstrates that the SSL part of your configuration is working correctly. Otherwise you could not possibly get LDAP-specific error codes returned by the server. Your question remains unclear.
    – user207421
    Jun 7, 2014 at 23:20
  • Does this answer your question? Persuading openldap to work with SSL on Ubuntu with cn=config
    – Braiam
    May 10, 2020 at 16:55

2 Answers 2

2

I found the solution over at Persuading openldap to work with SSL on Ubuntu with cn=config

which links to: http://rogermoffatt.com/2011/08/24/ubuntu-openldap-with-ssltls/ that has the complete solution.

0

TLS seems to require that the local hostname of the machine correlates to the name in the certificate. That seems to not be necessary for ldaps, where it is happy if the certificate is returned when requested using the domain of the ldap server address.

As Roger's blog has since gone offline, I posted a suggested solution over here, for users using auto-renewable LetsEncrypt certificates.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .