We have an openldap server and don't want to allow unencrypted communication, so acceptable is either tls over port 389 (
starttls) or ssl over 636 (
As we use slapd.conf for configuration,
olcSecurity isn't an option.
TLSCipherSuite seems to be the way to do it with slapd.conf. But when using that slapd either doesn't start or ignores the settings (i.e. accepts unencrypted requests).
slapd doesn't start (error: TLS init def ctx failed: -1) when using:
- TLSCipherSuite ALL - TLSCipherSuite Default - TLSCipherSuite ALL:!NULL - TLSCipherSuite ALL:!aNULL - TLSCipherSuite AES256-SHA #one of the ciphers offered by openssl
slapd starts but accepts unencrypted requests when using:
- TLSCipherSuite NORMAL - TLSCipherSuite NORMAL:!NULL #would be acceptable - TLSCipherSuite !NULL #would be acceptable
We test with
ldapsearch -L -x -W -h [SERVER] -D [USER] - b [SEARCHBASE] uid=[USER]
ldapsearch -L -x -W -ZZ -h [SERVER] -D [USER] - b [SEARCHBASE] uid=[USER]
The os openldap is running on is debian 8.7. The openldap version seems to be using gnutls, not openssl, so that may be the reason for the problems.
But the last three
TLSCipherSuite variations seem to be valid syntax, at least slapd starts without errors. Why doesn't
!NULL prevent slapd from accepting unencrypted requests? The last two (use any cipher available but don't allow no cipher) would be acceptable.
Are additional settings / parameters required?
Note that we tried the suggestions given here (as described above) but that didn't work.