2

I am struggling with setting up TLS for a new OpenLDAP server. The system is Debian Jessie (updated to the latest 8.7 stable), and I have set up the server by installing the slapd package, with almost no modifications to date.

One of the things I am trying to configure is the TLS Cipher Suite. Here is the LDIF:

dn: cn=config
changetype: modify
add: olcTLSCipherSuite
olcTLSCipherSuite: HIGH

When I try to submit this change with the following command:

ldapmodify -Y EXTERNAL -H ldapi:/// -f set-cipher-suite.ldif

I get this error:

ldap_modify: Server is unwilling to perform (53)

I also tried to set the certificate file with the following LDIF:

dn: cn=config
changetype: modify
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/foo.crt

Here I get an error 80 instead of an error 53.

ldap_modify: Other (e.g., implementation specific) error (80)

I double-checked that the file exists and that slapd has access to the file.

I changed olcLogLevel to any (thus proving that I am capable of modifying the configuration) and checked the debug output, but what I see there has no information value to my untrained eye. Here is the snippet where error 53 occurs:

[...]
Jun  8 16:46:21 pelargir slapd[36937]: slap_queue_csn: queueing 0x7f3648f4a430 20160608144621.742848Z#000000#000#000000
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_required entry (cn=config), objectClass "olcGlobal"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "objectClass"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "cn"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "olcArgsFile"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "olcLogLevel"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "olcPasswordHash"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "olcPidFile"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "olcToolThreads"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "structuralObjectClass"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "entryUUID"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "creatorsName"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "createTimestamp"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "olcTLSCipherSuite"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "entryCSN"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "modifiersName"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "modifyTimestamp"
Jun  8 16:46:21 pelargir slapd[36937]: send_ldap_result: conn=1002 op=1 p=3
Jun  8 16:46:21 pelargir slapd[36937]: send_ldap_result: err=53 matched="" text=""
Jun  8 16:46:21 pelargir slapd[36937]: send_ldap_response: msgid=2 tag=103 err=53
Jun  8 16:46:21 pelargir slapd[36937]: conn=1002 op=1 RESULT tag=103 err=53 text=
[...]

Can anyone give me a hint what I might be doing wrong here? What I find utterly baffling is that I can successfully modify simple options such as olcLogLevel or olcPasswordHash, but that I fail when I try to do the same for similarly simple TLS options such as olcTLSCipherSuite.

Improve this question

2 Answers 2

Reset to default
0

I ran into the same problem, openldap in debian is compiled against the gnu-tls package and that is not installed by default.

This might help:

apt install gnutls-bin

Also make sure that the openldap user have sufficient permissions to read the certificates. For example:

useradd letsencrypt
chown openldap:letsencrypt /etc/letsencrypt/ -R
usermod -a -G letsencrypt openldap
Improve this answer
1
  • It's true that OpenLDAP in Debian is compiled against GnuTLS, but that is covered by the slapd package depending on a GnuTLS library package (currently libgnutls-deb0-28). The package you are suggesting (gnutls-bin) contains commandline utilities, which is certainly not something the OpenLDAP server is going to need. I tried installing gnutls-bin on the off chance that I might be wrong, but as expected this didn't help. Regarding file permissions: As mentioned in the question that's something I already checked.
    – herzbube
    Feb 18, 2017 at 12:04
0

The issue with

olcTLSCipherSuite: HIGH

is that GnuTLS does not know the "HIGH" cipher suite, because this is a convenience name supported only by OpenSSL. If you want to see the available cipher names supported by GnuTLS, run the command gnutls-cli -l. Install the gnutls-bin Debian package to get access to the gnutls-cli utility.

The issue with

olcTLSCertificateFile: /etc/ssl/certs/foo.crt

I could not reproduce after more than 3 years. As Alexander Kjäll pointed out in his answer, it could have been a permission problem after all.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .