1

Ubuntu 20.04, OpenLDAP, phpLDAPadmin

I want to use LDAPS, LDAP over TLS, so that a connection can't even be made unless TLS connects first, so I'm not going the STARTLS route.

Even though I can log in with phpLDAPadmin using the "admin" account, I know it's not using TLS because phpLDAPadmin display a big error message at the top of the page that says:

Could not start TLS. (My LDAP Server)
Error: Could not start TLS. Please check your LDAP server configuration.

Hostname for LDAP = DIR.MYDOMAIN.com (using the subdirectory "dir" for mydomain)

When I run ldapsearch -H ldap://DIR.MYDOMAIN.com/ -b dc=DIR,dc=MYDOMAIN,dc=com -x, I get:

# extended LDIF
#
# LDAPv3
# base <dc=DIR,dc=MYDOMAIN,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# DIR.MYDOMAIN.com
dn: dc=DIR,dc=MYDOMAIN,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: myorg
dc: dir

# admin, DIR.MYDOMAIN.com
dn: cn=admin,dc=DIR,dc=MYDOMAIN,dc=com
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntries: 2

When I try to run that same command with LDAPS ("ldaps://DIR.MYDOMAIN.com"), it returns:

ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

When I run openssl s_client -connect DIR.MYDOMAIN.com:636, it returns:

write:errno=0
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 314 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

When I run LDAPTLS_CACERT=/etc/ldap/sasl2/cert1.pem ldapwhoami -H ldaps://DIR.MYDOMAIN.com -ZZ -x -d 1, I get:

ldap_url_parse_ext(ldaps://DIR.MYDOMAIN.com)
ldap_create
ldap_url_parse_ext(ldaps://DIR.MYDOMAIN.com:636/??base)
ldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP DIR.MYDOMAIN.com:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying MY.SERVER.IP.ADDRESS:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
attempting to connect: 
connect success
TLS: can't connect: The TLS connection was non-properly terminated..
ldap_err2string
ldap_start_tls: Can't contact LDAP server (-1)
        additional info: The TLS connection was non-properly terminated.

This is what my /etc/ldap/ldap.conf file looks like:

# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

# TLS certificates (needed for GnuTLS)
TLS_REQCERT             demand

TLS_CACERT              /etc/letsencrypt/live/MYDOMAIN.COM/chain.pem
TLSCertificateFile      /etc/letsencrypt/live/MYDOMAIN.COM/cert.pem
TLSCertificateKeyFile   /etc/letsencrypt/live/MYDOMAIN.COM/privkey.pem
TLS_CIPHER_SUITE        ECDHE-RSA-AES256-SHA384:AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!EXP:!SSLV2:!eNULL
TLS_PROTOCOL_MIN        3.3

BASE  dc=MYDOMAIN,dc=com
URI   ldapi://localhost  ldapi://127.0.0.1  ldaps://DIR.MYDOMAIN.com:636

SIZELIMIT       12
TIMELIMIT       15
#DEREF          never

The SSL certificates listed there were requested from LetsEncrypt for the domain "DIR.MYDOMAIN.com", which is what I used as the hostname for my LDAP directory. I just moved them from the /etc/letsencrypt/archive directory to the /etc/ldap/sasl2 directory.

Also, I input "DIR.MYDOMAIN.com" for the CN (common name) when registering the certificate, so that matches.

All of the lines I have enabled in /etc/phpldapadmin/config.php are:

<?php

 * Useful important configuration overrides  *

#  $config->custom->debug['level'] = 255;
#  $config->custom->debug['syslog'] = true;
#  $config->custom->debug['file'] = '/tmp/pla_debug.log';
#  $config->custom->appearance['timezone'] = 'America/Chicago';

 * Appearance                                *

#  $config->custom->appearance['tree'] = 'HTMLTree';
#  $config->custom->appearance['hide_template_warning'] = true;
#  $config->custom->appearance['tree_height'] = 600;
#  $config->custom->appearance['tree_width'] = 250;

 * User-friendly attribute translation       *

$config->custom->appearance['friendly_attrs'] = array(
        'facsimileTelephoneNumber' => 'Fax',
        'gid'                      => 'Group',
        'mail'                     => 'Email',
        'telephoneNumber'          => 'Telephone',
        'uid'                      => 'User Name',
        'userPassword'             => 'Password'
);

 * Hidden attributes                         *

#  $config->custom->appearance['hide_attrs'] = array('objectClass');
#  $config->custom->appearance['hide_attrs_exempt'] = 'cn=PLA UnHide,ou=Groups,c=US';

 * Read-only attributes                      *

#  $config->custom->appearance['readonly_attrs_exempt'] = 'cn=PLA ReadWrite,ou=Groups,c=US';

 * Support for attrs display order           *

#  $config->custom->appearance['attr_display_order'] = array(
#   'givenName',
#   'sn',
#   'cn',
#   'displayName',
#   'uid',
#   'uidNumber',
#   'gidNumber',
#   'homeDirectory',
#   'mail',
#   'userPassword'
#  );

 * Define your LDAP servers in this section  *

$servers = new Datastore();

$servers->newServer('ldap_pla');
$servers->setValue('server','name','My LDAP Server');
$servers->setValue('server','host','ldaps://DIR.MYDOMAIN.com');
$servers->setValue('server','port',636);
$servers->setValue('server','base',array('dc=DIR,dc=MYDOMAIN,dc=com'));
$servers->setValue('login','auth_type','session');
$servers->setValue('login','bind_id','');
$servers->setValue('login','bind_pass','');
$servers->setValue('server','tls',true);

 *      SASL Authentication         *

#  $servers->setValue('sasl','authz_id_regex','/^uid=([^,]+)(.+)/i');
#  $servers->setValue('sasl','authz_id_replacement','$1');
#  $servers->setValue('auto_number','search_base','ou=People,dc=DIR,dc=MYDOMAIN,dc=com');
$servers->setValue('login','anon_bind',false);
#  $servers->setValue('custom','pages_prefix','custom_');
#  $servers->setValue('login','timeout',30);
#  $servers->setValue('server','custom_sys_attrs',array('passwordExpirationTime','passwordAllowChangeTime'));
#  $servers->setValue('server','custom_attrs',array('nsRoleDN','nsRole','nsAccountLock'));
#  $servers->setValue('server','force_may',array('uidNumber','gidNumber','sambaSID'));

 * Unique attributes                         *

#  $servers->setValue('unique','attrs',array('mail','uid','uidNumber'));

?>

nmap localhost returns:

root@mail:~# nmap localhost
Starting Nmap 7.80 ( https://nmap.org ) at 2021-05-17 09:45 EDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000050s latency).
Not shown: 987 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
25/tcp    open  smtp
53/tcp    open  domain
80/tcp    open  http
143/tcp   open  imap
389/tcp   open  ldap
443/tcp   open  https
465/tcp   open  smtps
587/tcp   open  submission
636/tcp   open  ldapssl
993/tcp   open  imaps
3306/tcp  open  mysql
10000/tcp open  snet-sensor-mgmt

Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds

netstat -lpn | grep 636 returns:

root@mail:~# netstat -lpn | grep 636
tcp        0      0 0.0.0.0:636             0.0.0.0:*               LISTEN      58496/slapd         
tcp6       0      0 :::636                  :::*                    LISTEN      58496/slapd

Netcat ldaphost:636 -vz returns:

root@mail:/etc/ldap/ldif-files# netcat 127.0.0.1 636 -vz
Connection to 127.0.0.1 636 port [tcp/ldaps] succeeded!

root@mail:/etc/ldap/ldif-files# netcat DIR.MYDOMAIN.com 636 -vz
Connection to DIR.MYDOMAIN.com 636 port [tcp/ldaps] succeeded!

ldapsearch -H ldaps://DIR.MYDOMAIN.com -D cn=admin,dc=DIR,dc=MYDOMAIN,dc=com -W -d 9 returns:

root@mail:/etc/ldap# ldapsearch -H ldaps://DIR.MYDOMAIN.com -D cn=admin,dc=DIR,dc=MYDOMAIN,dc=com -W -d 9
ldap_url_parse_ext(ldaps://DIR.MYDOMAIN.com)
ldap_create
ldap_url_parse_ext(ldaps://DIR.MYDOMAIN.com:636/??base)
Enter LDAP Password: 
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP DIR.MYDOMAIN.com:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying MY.SERVER.IP.ADDRESS:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
attempting to connect: 
connect success
TLS: could not set cipher list ECDHE-RSA-AES256-SHA384:AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!EXP:!SSLV2:!eNULL.
ldap_err2string
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

ldapsearch -H ldap://DIR.MYDOMAIN.com -D cn=admin,dc=DIR,dc=MYDOMAIN,dc=com -W -d 9 returns:

root@mail:/etc/ldap# ldapsearch -H ldap://DIR.MYDOMAIN.com -D cn=admin,dc=DIR,dc=MYDOMAIN,dc=com -W -d 9
ldap_url_parse_ext(ldap://DIR.MYDOMAIN.com)
ldap_create
ldap_url_parse_ext(ldap://DIR.MYDOMAIN.com:389/??base)
Enter LDAP Password: 
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP DIR.MYDOMAIN.com:389
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying MY.SERVER.IP.ADDRESS:389
ldap_pvt_connect: fd: 3 tm: -1 async: 0
attempting to connect: 
connect success
ldap_open_defconn: successful
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_scanf fmt ({i) ber:
ber_flush2: 76 bytes to sd 3
ldap_result ld 0x562bb7079c80 msgid 1
wait4msg ld 0x562bb7079c80 msgid 1 (infinite timeout)
wait4msg continue ld 0x562bb7079c80 msgid 1 all 1
** ld 0x562bb7079c80 Connections:
* host: DIR.MYDOMAIN.com  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Mon May 17 16:15:24 2021


** ld 0x562bb7079c80 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x562bb7079c80 request count 1 (abandoned 0)
** ld 0x562bb7079c80 Response Queue:
   Empty
  ld 0x562bb7079c80 response count 0
ldap_chkResponseList ld 0x562bb7079c80 msgid 1 all 1
ldap_chkResponseList returns ld 0x562bb7079c80 NULL
ldap_int_select
read1msg: ld 0x562bb7079c80 msgid 1 all 1
ber_get_next
ber_get_next: tag 0x30 len 12 contents:
read1msg: ld 0x562bb7079c80 msgid 1 message type bind
ber_scanf fmt ({eAA) ber:
read1msg: ld 0x562bb7079c80 0 new referrals
read1msg:  mark request completed, ld 0x562bb7079c80 msgid 1
request done: ld 0x562bb7079c80 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_parse_result
ber_scanf fmt ({iAA) ber:
ber_scanf fmt (}) ber:
ldap_msgfree
# extended LDIF
#
# LDAPv3
# base <dc=DIR,dc=MYDOMAIN,dc=com> (default) with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

ldap_search_ext
put_filter: "(objectclass=*)"
put_filter: simple
put_simple_filter: "objectclass=*"
ldap_send_initial_request
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_scanf fmt ({) ber:
ber_flush2: 70 bytes to sd 3
ldap_result ld 0x562bb7079c80 msgid -1
wait4msg ld 0x562bb7079c80 msgid -1 (infinite timeout)
wait4msg continue ld 0x562bb7079c80 msgid -1 all 0
** ld 0x562bb7079c80 Connections:
* host: DIR.MYDOMAIN.com  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Mon May 17 16:15:24 2021


** ld 0x562bb7079c80 Outstanding Requests:
 * msgid 2,  origid 2, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x562bb7079c80 request count 1 (abandoned 0)
** ld 0x562bb7079c80 Response Queue:
   Empty
  ld 0x562bb7079c80 response count 0
ldap_chkResponseList ld 0x562bb7079c80 msgid -1 all 0
ldap_chkResponseList returns ld 0x562bb7079c80 NULL
ldap_int_select
read1msg: ld 0x562bb7079c80 msgid -1 all 0
ber_get_next
ber_get_next: tag 0x30 len 122 contents:
read1msg: ld 0x562bb7079c80 msgid 2 message type search-entry
ldap_get_dn_ber
ber_scanf fmt ({ml{) ber:
ldap_dn2ufn
ldap_dn_normalize
# DIR.MYDOMAIN.com
dn: dc=DIR,dc=MYDOMAIN,dc=com
ber_scanf fmt ({xx) ber:
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
objectClass: top
objectClass: dcObject
objectClass: organization
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
o: ORG
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
dc: dir
ldap_get_attribute_ber
ldap_msgfree
ldap_result ld 0x562bb7079c80 msgid -1
wait4msg ld 0x562bb7079c80 msgid -1 (infinite timeout)
wait4msg continue ld 0x562bb7079c80 msgid -1 all 0
** ld 0x562bb7079c80 Connections:
* host: DIR.MYDOMAIN.com  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Mon May 17 16:15:24 2021


** ld 0x562bb7079c80 Outstanding Requests:
 * msgid 2,  origid 2, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x562bb7079c80 request count 1 (abandoned 0)
** ld 0x562bb7079c80 Response Queue:
   Empty
  ld 0x562bb7079c80 response count 0
ldap_chkResponseList ld 0x562bb7079c80 msgid -1 all 0
ldap_chkResponseList returns ld 0x562bb7079c80 NULL
ldap_int_select
read1msg: ld 0x562bb7079c80 msgid -1 all 0
ber_get_next
ber_get_next: tag 0x30 len 220 contents:
read1msg: ld 0x562bb7079c80 msgid 2 message type search-entry

ldap_get_dn_ber
ber_scanf fmt ({ml{) ber:
ldap_dn2ufn
ldap_dn_normalize
# admin, DIR.MYDOMAIN.com
dn: cn=admin,dc=DIR,dc=MYDOMAIN,dc=com
ber_scanf fmt ({xx) ber:
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
objectClass: simpleSecurityObject
objectClass: organizationalRole
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
cn: admin
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
description: LDAP administrator
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
userPassword:: {a-hash-was-here}
ldap_get_attribute_ber
ldap_msgfree
ldap_result ld 0x562bb7079c80 msgid -1
wait4msg ld 0x562bb7079c80 msgid -1 (infinite timeout)
wait4msg continue ld 0x562bb7079c80 msgid -1 all 0
** ld 0x562bb7079c80 Connections:
* host: DIR.MYDOMAIN.com  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Mon May 17 16:15:24 2021


** ld 0x562bb7079c80 Outstanding Requests:
 * msgid 2,  origid 2, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x562bb7079c80 request count 1 (abandoned 0)
** ld 0x562bb7079c80 Response Queue:
   Empty
  ld 0x562bb7079c80 response count 0
ldap_chkResponseList ld 0x562bb7079c80 msgid -1 all 0
ldap_chkResponseList returns ld 0x562bb7079c80 NULL
ldap_int_select
read1msg: ld 0x562bb7079c80 msgid -1 all 0
ber_get_next
ber_get_next: tag 0x30 len 124 contents:
read1msg: ld 0x562bb7079c80 msgid 2 message type search-entry

ldap_get_dn_ber
ber_scanf fmt ({ml{) ber:
ldap_dn2ufn
ldap_dn_normalize
# LDAPuser, DIR.MYDOMAIN.com
dn: cn=LDAPuser,dc=DIR,dc=MYDOMAIN,dc=com
ber_scanf fmt ({xx) ber:
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
gidNumber: 500
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
cn: LDAPuser
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
objectClass: posixGroup
objectClass: top
ldap_get_attribute_ber
ldap_msgfree
ldap_result ld 0x562bb7079c80 msgid -1
wait4msg ld 0x562bb7079c80 msgid -1 (infinite timeout)
wait4msg continue ld 0x562bb7079c80 msgid -1 all 0
** ld 0x562bb7079c80 Connections:
* host: DIR.MYDOMAIN.com  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Mon May 17 16:15:24 2021


** ld 0x562bb7079c80 Outstanding Requests:
 * msgid 2,  origid 2, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x562bb7079c80 request count 1 (abandoned 0)
** ld 0x562bb7079c80 Response Queue:
   Empty
  ld 0x562bb7079c80 response count 0
ldap_chkResponseList ld 0x562bb7079c80 msgid -1 all 0
ldap_chkResponseList returns ld 0x562bb7079c80 NULL
ldap_int_select
read1msg: ld 0x562bb7079c80 msgid -1 all 0
ber_get_next
ber_get_next: tag 0x30 len 361 contents:
read1msg: ld 0x562bb7079c80 msgid 2 message type search-entry

ldap_get_dn_ber
ber_scanf fmt ({ml{) ber:
ldap_dn2ufn
ldap_dn_normalize
# testldapuser, DIR.MYDOMAIN.com
dn: cn=testldapuser,dc=DIR,dc=MYDOMAIN,dc=com
ber_scanf fmt ({xx) ber:
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
givenName: Test
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
gidNumber: 500
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
homeDirectory: /home/users/tldapuser
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
sn: LDAPuser
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
loginShell: /bin/sh
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
userPassword:: {a-hash-was-here}
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
uidNumber: 1000
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
uid: tldapuser
ldap_get_attribute_ber
ber_scanf fmt ({mM}) ber:
cn: testldapuser
ldap_get_attribute_ber
ldap_msgfree
ldap_result ld 0x562bb7079c80 msgid -1
wait4msg ld 0x562bb7079c80 msgid -1 (infinite timeout)
wait4msg continue ld 0x562bb7079c80 msgid -1 all 0
** ld 0x562bb7079c80 Connections:
* host: DIR.MYDOMAIN.com  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Mon May 17 16:15:24 2021


** ld 0x562bb7079c80 Outstanding Requests:
 * msgid 2,  origid 2, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x562bb7079c80 request count 1 (abandoned 0)
** ld 0x562bb7079c80 Response Queue:
   Empty
  ld 0x562bb7079c80 response count 0
ldap_chkResponseList ld 0x562bb7079c80 msgid -1 all 0
ldap_chkResponseList returns ld 0x562bb7079c80 NULL
ldap_int_select
read1msg: ld 0x562bb7079c80 msgid -1 all 0
ber_get_next
ber_get_next: tag 0x30 len 12 contents:
read1msg: ld 0x562bb7079c80 msgid 2 message type search-result
ber_scanf fmt ({eAA) ber:
read1msg: ld 0x562bb7079c80 0 new referrals
read1msg:  mark request completed, ld 0x562bb7079c80 msgid 2
request done: ld 0x562bb7079c80 msgid 2
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 2, msgid 2)

# search result
search: 2
ldap_parse_result
ber_scanf fmt ({iAA) ber:
ber_scanf fmt (}) ber:
ldap_err2string
result: 0 Success
ldap_msgfree

# numResponses: 5
# numEntries: 4
ldap_free_connection 1 1
ldap_send_unbind
ber_flush2: 7 bytes to sd 3
ldap_free_connection: actually freed

journalctl -xe returns:

root@mail:~# journalctl -xe
-- Subject: A start job for unit phpsessionclean.service has finished successfully
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
-- 
-- A start job for unit phpsessionclean.service has finished successfully.
-- 
-- The job identifier is 38068.

May 17 18:39:18 mail.MYDOMAIN.com slapd[68175]: SASL [conn=1061] Failure: no secret in database

[...repeated several times...]

May 17 18:44:31 mail.MYDOMAIN.com systemd[1]: fwupd.service: Succeeded.
-- Subject: Unit succeeded
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
-- 
-- The unit fwupd.service has successfully entered the 'dead' state.

[...SASL error message repeated more times...]

May 17 18:50:41 mail.MYDOMAIN.com postfix/pickup[68281]: nss_ldap: could not connect to any LDAP server as cn=admin,dc=DIR,dc=MYDOMAIN,dc=com - Can't contact LDAP server
May 17 18:50:41 mail.MYDOMAIN.com postfix/pickup[68281]: nss_ldap: failed to bind to LDAP server ldaps://DIR.MYDOMAIN.com:636: Can't contact LDAP server
May 17 18:50:41 mail.MYDOMAIN.com postfix/pickup[68281]: nss_ldap: reconnecting to LDAP server...

[...this error repeated several times...]

[...SASL error repeated more...]

I can't ever seem to modify any LDIFs with the interactive SASL option, because I always get:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=admin,dc=DIR,dc=MYDOMAIN,dc=com"
ldap_modify: Insufficient access (50)

ldapsearch -x -s base -b "" supportedSASLMechanisms returned:

# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectclass=*)
# requesting: supportedSASLMechanisms 
#

#
dn:
supportedSASLMechanisms: DIGEST-MD5
supportedSASLMechanisms: NTLM
supportedSASLMechanisms: CRAM-MD5

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

But when I try to log in with (simple) using -x, using ldapmodify -a -x -D "cn=config" -w MYLDAPROOTPASSWORD -H ldap:/// -f ldap-tls.ldif, it returns:

ldap_bind: Invalid credentials (49)

So basically, I can't import LDIFs because I can't authenticate in any way.

I'm guessing that, despite posting a 'lot' of information here, I didn't post the 'correct' information and will need to add more. I just hope that while I obviously can't find the answer, someone else can.

If something looks off, it's because after following LinuxBabe's tutorial, I've been going through what looks like 50 open tabs (that have managed to survive in the browser tab section), making alterations based on what I'm finding other people talk about, so I don't have full confidence in the changes I've made so far.

Does anything stand out to you?

5
  • can you open a connection to the ldap host on port 636/tcp? If you can't then it's not listening on ldaps, so it will not work Commented May 16, 2021 at 18:22
  • could you try netcat ldaphost 636 -vz? this should show if you can connect to the ldap port. Verify as well that your certificate chain is correct. When running the openssl s_client command, you should see the subject name of the ldap host somewhere in its output. When I try it on a host here, I see very different results for the ssl handshake: "SSL handshake has read 3098 bytes and written 405 bytes", the numbers look rather small . And finally try something like: "ldapsearch -H ldaps://ldaphost -D cn=admin,dc=DIR,dc=MYDOMAIN,dc=com -W -d 9", this should be very verbose Commented May 17, 2021 at 18:52
  • thanks, looks indeed open. So it is now most probable that the problem is in the certificate chain. Could you run the ldapsearch command in my previous comment? You do not need to post everything (it will be very verbose), but the error should be somewhere there. Maybe post it to the chat Commented May 17, 2021 at 19:50
  • So the solution should be to configure the certificate chain correctly on the openldap server. Apparently, ubuntu uses apparmour, and this could prevent the slapd process from reading the let's encrypt certificates (see blog.poggs.com/2018/08/19/…) Commented May 17, 2021 at 20:41
  • Let us continue this discussion in chat. Commented May 18, 2021 at 5:53

1 Answer 1

1

Old question, but I just dig into this myself, I can bring some inputs, maybe it can help other.

LDAP client config

You need the LetEncrypt CA cert in TLS_CACERT of /etc/ldap/ldap.conf

So more something like TLS_CACERT /etc/ssl/certs/ca-certificates.crt

openldap server config

It might be better to use the letencrypt fullchain in your ldap config :

TLSCertificateFile      /etc/letsencrypt/live/MYDOMAIN.COM/fullchain.pem

phpLDAPAdmin & tls

Be careful about PDA option for server.tls. It just means StartTLS.

You need to give the full uri like ldaps://DIR.MYDOMAIN.com, with no server options, not just the hostname DIR.MYDOMAIN.com with options server.tls/server.port.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .