2

I am struggling with setting up TLS for a new OpenLDAP server. The system is Debian Jessie (updated to the latest 8.7 stable), and I have set up the server by installing the slapd package, with almost no modifications to date.

One of the things I am trying to configure is the TLS Cipher Suite. Here is the LDIF:

dn: cn=config
changetype: modify
add: olcTLSCipherSuite
olcTLSCipherSuite: HIGH

When I try to submit this change with the following command:

ldapmodify -Y EXTERNAL -H ldapi:/// -f set-cipher-suite.ldif

I get this error:

ldap_modify: Server is unwilling to perform (53)

I also tried to set the certificate file with the following LDIF:

dn: cn=config
changetype: modify
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/foo.crt

Here I get an error 80 instead of an error 53.

ldap_modify: Other (e.g., implementation specific) error (80)

I double-checked that the file exists and that slapd has access to the file.

I changed olcLogLevel to any (thus proving that I am capable of modifying the configuration) and checked the debug output, but what I see there has no information value to my untrained eye. Here is the snippet where error 53 occurs:

[...]
Jun  8 16:46:21 pelargir slapd[36937]: slap_queue_csn: queueing 0x7f3648f4a430 20160608144621.742848Z#000000#000#000000
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_required entry (cn=config), objectClass "olcGlobal"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "objectClass"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "cn"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "olcArgsFile"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "olcLogLevel"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "olcPasswordHash"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "olcPidFile"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "olcToolThreads"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "structuralObjectClass"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "entryUUID"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "creatorsName"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "createTimestamp"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "olcTLSCipherSuite"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "entryCSN"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "modifiersName"
Jun  8 16:46:21 pelargir slapd[36937]: oc_check_allowed type "modifyTimestamp"
Jun  8 16:46:21 pelargir slapd[36937]: send_ldap_result: conn=1002 op=1 p=3
Jun  8 16:46:21 pelargir slapd[36937]: send_ldap_result: err=53 matched="" text=""
Jun  8 16:46:21 pelargir slapd[36937]: send_ldap_response: msgid=2 tag=103 err=53
Jun  8 16:46:21 pelargir slapd[36937]: conn=1002 op=1 RESULT tag=103 err=53 text=
[...]

Can anyone give me a hint what I might be doing wrong here? What I find utterly baffling is that I can successfully modify simple options such as olcLogLevel or olcPasswordHash, but that I fail when I try to do the same for similarly simple TLS options such as olcTLSCipherSuite.

0

I ran into the same problem, openldap in debian is compiled against the gnu-tls package and that is not installed by default.

This might help:

apt install gnutls-bin

Also make sure that the openldap user have sufficient permissions to read the certificates. For example:

useradd letsencrypt
chown openldap:letsencrypt /etc/letsencrypt/ -R
usermod -a -G letsencrypt openldap
  • It's true that OpenLDAP in Debian is compiled against GnuTLS, but that is covered by the slapd package depending on a GnuTLS library package (currently libgnutls-deb0-28). The package you are suggesting (gnutls-bin) contains commandline utilities, which is certainly not something the OpenLDAP server is going to need. I tried installing gnutls-bin on the off chance that I might be wrong, but as expected this didn't help. Regarding file permissions: As mentioned in the question that's something I already checked. – herzbube Feb 18 '17 at 12:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.