1

I am attempting to get ldaps working with openldap. I have a wildcard ssl certificate that was issued for this domain and have used ldapmodify to add the relevant files to cn=config as show here.

Once I have completed this, I am unable to restart OpenLDAP.

I have completed setup for OpenLDAP and have confirmed that I can bind successfully using ldap.

I am using Ubuntu 14.04 TLS on an AWS EC2 instance with ports 389 AND 636 open.

Some diagnostics:

/etc/init.d/slapd restart

restart
 * Stopping OpenLDAP slapd                     [ OK ] 
 * Starting OpenLDAP slapd                     [fail]

slapd -u ldap -g ldap -d 65

563e5b20 @(#) $OpenLDAP: slapd  (Ubuntu) (Sep 15 2015 18:19:13) $
    buildd@lgw01-53:/build/openldap-2QUgtL/openldap-2.4.31/debian/build/servers/slapd
ldap_pvt_gethostbyname_a: host=ip-172-31-62-171, r=0
563e5b20 daemon_init: listen on ldap:///
563e5b20 daemon_init: 1 listeners to open...
ldap_url_parse_ext(ldap:///)
563e5b20 daemon: listener initialized ldap:///
563e5b20 daemon_init: 2 listeners opened
563e5b20 No passwd entry for user ldap

2 Answers 2

0

Issue was that openldap was being denied access to the key file by apparmor. Issue was resolved by proper configuration of openldap's permissions.

0

If anyone else comes here looking for a solution, using certificates from LetsEncrypt, this should fix it.

Set the correct access permissions for the LetsEncrypt directories and files in two steps.

setfacl

$ sudo setfacl -m user:openldap:r-x /etc/letsencrypt/live
$ sudo setfacl -m user:openldap:r-x /etc/letsencrypt/archive

apparmor

Create /etc/apparmor.d/local/usr.sbin.slapd with the following content.

/etc/letsencrypt/live/your.domain.here r,
/etc/letsencrypt/archive/your.domain.here r,
/etc/letsencrypt/archive/your.domain.here/** r,

Restart apparmor.

sudo service apparmor restart

Slapd should now restart fine and be accessible via LDAPS/TLS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .