LDAP TSL ldap_modify: error 80

Question

I was read few suggestion from this and many others forums and try to fix problem on my own, but without result. I need to add cert to ldap and always it return error 80.

I was add permission to folder with ldap:

ls -la /etc/apache2/ssl/
razem 16
drwxrwxr-- 2 root root 4096 cze 29 12:52 .
drwxr-xr-x 9 root root 4096 lip  2 10:33 ..
-rwxrwxr-- 1 root root 1545 gru 22  2017 od.censored.pl.crt
-rwxrwxr-- 1 root root 1704 gru 22  2017 od.censored.pl.key

I was check permission to temp directory:

ls -la /var/lib/lda*
razem 708
drwxr-xr-x  2 openldap openldap     4096 lip  2 10:39 .
drwxr-xr-x 79 root     root         4096 cze 30 09:06 ..
-rw-r--r--  1 openldap openldap     4096 cze 29 13:50 alock
-rw-------  1 openldap openldap     8192 kwi 13 11:12 cn.bdb
-rw-------  1 openldap openldap   548863 cze 29 14:20 __db.001
-rw-------  1 openldap openldap   147455 lip  2 10:50 __db.002
-rw-------  1 openldap openldap   114687 cze 29 13:50 __db.003
-rw-r--r--  1 openldap openldap       96 kwi 13 11:12 DB_CONFIG
-rw-------  1 openldap openldap     8192 kwi 13 11:12 dn2id.bdb
-rw-------  1 openldap openldap    32768 kwi 13 12:12 id2entry.bdb
-rw-------  1 openldap openldap 10485759 cze 29 14:20 log.0000000001
-rw-------  1 openldap openldap     8192 kwi 13 11:12 objectClass.bdb

The certs.ldif looks:

cat -n certs.ldif 
     1  dn: cn=config
     2  changetype: modify
     3  replace: olcTLSCertificateFile
     4  olcTLSCertificateFile: /etc/apache2/ssl/od.censored.pl.crt
     5  
     6  dn: cn=config
     7  changetype: modify
     8  replace: olcTLSCertificateKeyFile
     9  olcTLSCertificateKeyFile: /etc/apache2/ssl/od.censored.pl.key

But I see error over and over:

ldapmodify -Y EXTERNAL -H ldapi:/// -vvv -f certs.ldif
ldap_initialize( ldapi:///??base )
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
replace olcTLSCertificateFile:
    /etc/apache2/ssl/od.censored.pl.crt
modifying entry "cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)

Logs after add tried:

   195  Jul  4 12:50:49 odps02 slapd[18075]: conn=1005 op=1 RESULT tag=103 err=0 text=
   196  Jul  4 12:50:49 odps02 slapd[18075]: conn=1005 op=2 UNBIND
   197  Jul  4 12:50:49 odps02 slapd[18075]: conn=1005 fd=18 closed
   198  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 fd=18 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
   199  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 op=0 BIND dn="" method=163
   200  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 op=0 BIND authcid="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
   201  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 op=0 BIND dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
   202  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 op=0 RESULT tag=97 err=0 text=
   203  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 op=1 MOD dn="cn=config"
   204  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 op=1 MOD attr=olcTLSCertificateFile
   205  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 op=1 RESULT tag=103 err=80 text=
   206  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 op=2 UNBIND
   207  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 fd=18 closed

Debug import try:

ldap_url_parse_ext(ldapi:///)
ldap_create
ldap_url_parse_ext(ldapi:///??base)
ldap_sasl_interactive_bind: user selected: EXTERNAL
ldap_int_sasl_bind: EXTERNAL
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_path
ldap_new_socket: 4
ldap_connect_to_path: Trying /var/run/slapd/ldapi
ldap_connect_timeout: fd: 4 tm: -1 async: 0
ldap_ndelay_on: 4
ldap_ndelay_off: 4
ldap_int_sasl_open: host=odps02
SASL/EXTERNAL authentication started
ldap_sasl_bind
ldap_send_initial_request
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_dump: buf=0x55ab9f63d3f0 ptr=0x55ab9f63d3f0 end=0x55ab9f63d40a len=26
  0000:  30 18 02 01 01 60 13 02  01 03 04 00 a3 0c 04 08   0....`..........  
  0010:  45 58 54 45 52 4e 41 4c  04 00                     EXTERNAL..        
ber_scanf fmt ({i) ber:
ber_dump: buf=0x55ab9f63d3f0 ptr=0x55ab9f63d3f5 end=0x55ab9f63d40a len=21
  0000:  60 13 02 01 03 04 00 a3  0c 04 08 45 58 54 45 52   `..........EXTER  
  0010:  4e 41 4c 04 00                                     NAL..             
ber_flush2: 26 bytes to sd 4
  0000:  30 18 02 01 01 60 13 02  01 03 04 00 a3 0c 04 08   0....`..........  
  0010:  45 58 54 45 52 4e 41 4c  04 00                     EXTERNAL..        
ldap_write: want=26, written=26
  0000:  30 18 02 01 01 60 13 02  01 03 04 00 a3 0c 04 08   0....`..........  
  0010:  45 58 54 45 52 4e 41 4c  04 00                     EXTERNAL..        
ldap_msgfree
ldap_result ld 0x55ab9f63b260 msgid 1
wait4msg ld 0x55ab9f63b260 msgid 1 (infinite timeout)
wait4msg continue ld 0x55ab9f63b260 msgid 1 all 1
** ld 0x55ab9f63b260 Connections:
* host: (null)  port: 0  (default)
  refcnt: 2  status: Connected
  last used: Fri Jul  6 15:04:50 2018


** ld 0x55ab9f63b260 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x55ab9f63b260 request count 1 (abandoned 0)
** ld 0x55ab9f63b260 Response Queue:
   Empty
  ld 0x55ab9f63b260 response count 0
ldap_chkResponseList ld 0x55ab9f63b260 msgid 1 all 1
ldap_chkResponseList returns ld 0x55ab9f63b260 NULL
ldap_int_select
read1msg: ld 0x55ab9f63b260 msgid 1 all 1
ber_get_next
ldap_read: want=8, got=8
  0000:  30 0c 02 01 01 61 07 0a                            0....a..          
ldap_read: want=6, got=6
  0000:  01 00 04 00 04 00                                  ......            
ber_get_next: tag 0x30 len 12 contents:
ber_dump: buf=0x55ab9f61d990 ptr=0x55ab9f61d990 end=0x55ab9f61d99c len=12
  0000:  02 01 01 61 07 0a 01 00  04 00 04 00               ...a........      
read1msg: ld 0x55ab9f63b260 msgid 1 message type bind
ber_scanf fmt ({eAA) ber:
ber_dump: buf=0x55ab9f61d990 ptr=0x55ab9f61d993 end=0x55ab9f61d99c len=9
  0000:  61 07 0a 01 00 04 00 04  00                        a........         
read1msg: ld 0x55ab9f63b260 0 new referrals
read1msg:  mark request completed, ld 0x55ab9f63b260 msgid 1
request done: ld 0x55ab9f63b260 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_int_sasl_bind: EXTERNAL
ldap_parse_sasl_bind_result
ber_scanf fmt ({eAA) ber:
ber_dump: buf=0x55ab9f61d990 ptr=0x55ab9f61d993 end=0x55ab9f61d99c len=9
  0000:  61 07 0a 01 00 04 00 04  00                        a........         
ldap_parse_result
ber_scanf fmt ({iAA) ber:
ber_dump: buf=0x55ab9f61d990 ptr=0x55ab9f61d993 end=0x55ab9f61d99c len=9
  0000:  61 07 0a 01 00 04 00 04  00                        a........         
ber_scanf fmt (}) ber:
ber_dump: buf=0x55ab9f61d990 ptr=0x55ab9f61d99c end=0x55ab9f61d99c len=0

SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
ldap_msgfree
modifying entry "cn=config"
ldap_modify_ext
ldap_send_initial_request
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_dump: buf=0x55ab9f640b00 ptr=0x55ab9f640b00 end=0x55ab9f640b58 len=88
  0000:  30 56 02 01 02 66 51 04  09 63 6e 3d 63 6f 6e 66   0V...fQ..cn=conf  
  0010:  69 67 30 44 30 42 0a 01  02 30 3d 04 17 6f 6c 63   ig0D0B...0=..olc  
  0020:  54 4c 53 43 41 43 65 72  74 69 66 69 63 61 74 65   TLSCACertificate  
  0030:  46 69 6c 65 31 22 04 20  2f 65 74 63 2f 61 70 61   File1". /etc/apa  
  0040:  63 68 65 32 2f 73 73 6c  2f 6f 64 2e 70 67 6e 69   che2/ssl/od.pgni  
  0050:  67 2e 70 6c 2e 63 73 72                            g.pl.csr          
ber_scanf fmt ({) ber:
ber_dump: buf=0x55ab9f640b00 ptr=0x55ab9f640b05 end=0x55ab9f640b58 len=83
  0000:  66 51 04 09 63 6e 3d 63  6f 6e 66 69 67 30 44 30   fQ..cn=config0D0  
  0010:  42 0a 01 02 30 3d 04 17  6f 6c 63 54 4c 53 43 41   B...0=..olcTLSCA  
  0020:  43 65 72 74 69 66 69 63  61 74 65 46 69 6c 65 31   CertificateFile1  
  0030:  22 04 20 2f 65 74 63 2f  61 70 61 63 68 65 32 2f   ". /etc/apache2/  
  0040:  73 73 6c 2f 6f 64 2e 70  67 6e 69 67 2e 70 6c 2e   ssl/od.censored.pl.  
  0050:  63 73 72                                           csr               
ber_flush2: 88 bytes to sd 4
  0000:  30 56 02 01 02 66 51 04  09 63 6e 3d 63 6f 6e 66   0V...fQ..cn=conf  
  0010:  69 67 30 44 30 42 0a 01  02 30 3d 04 17 6f 6c 63   ig0D0B...0=..olc  
  0020:  54 4c 53 43 41 43 65 72  74 69 66 69 63 61 74 65   TLSCACertificate  
  0030:  46 69 6c 65 31 22 04 20  2f 65 74 63 2f 61 70 61   File1". /etc/apa  
  0040:  63 68 65 32 2f 73 73 6c  2f 6f 64 2e 70 67 6e 69   che2/ssl/od.pgni  
  0050:  67 2e 70 6c 2e 63 73 72                            g.pl.csr          
ldap_write: want=88, written=88
  0000:  30 56 02 01 02 66 51 04  09 63 6e 3d 63 6f 6e 66   0V...fQ..cn=conf  
  0010:  69 67 30 44 30 42 0a 01  02 30 3d 04 17 6f 6c 63   ig0D0B...0=..olc  
  0020:  54 4c 53 43 41 43 65 72  74 69 66 69 63 61 74 65   TLSCACertificate  
  0030:  46 69 6c 65 31 22 04 20  2f 65 74 63 2f 61 70 61   File1". /etc/apa  
  0040:  63 68 65 32 2f 73 73 6c  2f 6f 64 2e 70 67 6e 69   che2/ssl/od.pgni  
  0050:  67 2e 70 6c 2e 63 73 72                            g.pl.csr          
ldap_result ld 0x55ab9f63b260 msgid 2
wait4msg ld 0x55ab9f63b260 msgid 2 (timeout 100000 usec)
wait4msg continue ld 0x55ab9f63b260 msgid 2 all 1
** ld 0x55ab9f63b260 Connections:
* host: (null)  port: 0  (default)
  refcnt: 2  status: Connected
  last used: Fri Jul  6 15:04:50 2018


** ld 0x55ab9f63b260 Outstanding Requests:
 * msgid 2,  origid 2, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x55ab9f63b260 request count 1 (abandoned 0)
** ld 0x55ab9f63b260 Response Queue:
   Empty
  ld 0x55ab9f63b260 response count 0
ldap_chkResponseList ld 0x55ab9f63b260 msgid 2 all 1
ldap_chkResponseList returns ld 0x55ab9f63b260 NULL
ldap_int_select
read1msg: ld 0x55ab9f63b260 msgid 2 all 1
ber_get_next
ldap_read: want=8, got=8
  0000:  30 0c 02 01 02 67 07 0a                            0....g..          
ldap_read: want=6, got=6
  0000:  01 50 04 00 04 00                                  .P....            
ber_get_next: tag 0x30 len 12 contents:
ber_dump: buf=0x55ab9f61c910 ptr=0x55ab9f61c910 end=0x55ab9f61c91c len=12
  0000:  02 01 02 67 07 0a 01 50  04 00 04 00               ...g...P....      
read1msg: ld 0x55ab9f63b260 msgid 2 message type modify
ber_scanf fmt ({eAA) ber:
ber_dump: buf=0x55ab9f61c910 ptr=0x55ab9f61c913 end=0x55ab9f61c91c len=9
  0000:  67 07 0a 01 50 04 00 04  00                        g...P....         
read1msg: ld 0x55ab9f63b260 0 new referrals
read1msg:  mark request completed, ld 0x55ab9f63b260 msgid 2
request done: ld 0x55ab9f63b260 msgid 2
res_errno: 80, res_error: <>, res_matched: <>
ldap_free_request (origid 2, msgid 2)
ldap_parse_result
ber_scanf fmt ({iAA) ber:
ber_dump: buf=0x55ab9f61c910 ptr=0x55ab9f61c913 end=0x55ab9f61c91c len=9
  0000:  67 07 0a 01 50 04 00 04  00                        g...P....         
ber_scanf fmt (}) ber:
ber_dump: buf=0x55ab9f61c910 ptr=0x55ab9f61c91c end=0x55ab9f61c91c len=0

ldap_msgfree
ldap_err2string
ldap_modify: Other (e.g., implementation specific) error (80)

ldap_free_connection 1 1
ldap_send_unbind
ber_flush2: 7 bytes to sd 4
  0000:  30 05 02 01 03 42 00                               0....B.           
ldap_write: want=7, written=7
  0000:  30 05 02 01 03 42 00                               0....B.           
ldap_free_connection: actually freed

Please for any suggestion how to fix it.

The issue is big problem for me, because I can't finish configuration of necessary server, please for help.

What do your logs say? (Have you configured logging? slapd by default logs to LOCAL4.) — 84104, Jul 3, 2018 at 19:48
Hi, very thanks for your response. I just add log's form var. For me this don't mean any thing. Maybe some ware are more specific logs. — DevAxeQuestion, Jul 4, 2018 at 11:01
Does this help? That is, are your certs in PEM format? Is they key file not encrypted? — kostix, Jul 4, 2018 at 14:05
Yes, all off them are in .pem. Starts from -----BEGIN CERTIFICATE----- \ -----BEGIN CERTIFICATE REQUEST-----\ -----BEGIN PRIVATE KEY----- and finish like -----END...-----. No, I can show key file like certificates using cat in terminal so it isn't encrypted. — DevAxeQuestion, Jul 5, 2018 at 8:12

Michael Ströder · Accepted Answer · 2018-07-21 22:25:58Z

If openldap is the system user for running OpenLDAP's slapd this ownership/permission listed in your question does not allow slap to read the server certificate and private key:

ls -la /etc/apache2/ssl/
razem 16
drwxrwxr-- 2 root root 4096 cze 29 12:52 .
drwxr-xr-x 9 root root 4096 lip  2 10:33 ..
-rwxrwxr-- 1 root root 1545 gru 22  2017 od.censored.pl.crt
-rwxrwxr-- 1 root root 1704 gru 22  2017 od.censored.pl.key

In opposite to e.g. Apache slapd initializes the SSLContext after setuid() call even when using static config file. And with dynamic configuration (cn=config) it has to read the files during processing your LDAP modification anyway.

Therefore try this to fix group ownership:

chgrp -R openldap /etc/apache2/ssl

And also remove unneeded exec permission:

chmod 0640 /etc/apache2/ssl/od.censored.pl.crt /etc/apache2/ssl/od.censored.pl.key

warbjoh · Accepted Answer · 2019-12-17 05:18:58Z

1

Ubuntu 16.04 - apparmor doesn't like the certs to be elsewhere for slapd

From our logs

audit: type=1400 audit(1576557786.149:51): apparmor="DENIED" operation="open" profile="/usr/sbin/slapd" name="/usr/local/etc/ssl_certs/our.pri_key" pid=15900 comm="slapd" requested_mask="r" denied_mask="r" fsuid=114 ouid=0

Fixed by disabling apparmor for slapd and rebooting

root@alc-jw-test5:~# ls -l /etc/apparmor.d/disable/usr.sbin.slapd
lrwxrwxrwx 1 root root 30 Dec 17 15:43 /etc/apparmor.d/disable/usr.sbin.slapd -> /etc/apparmor.d/usr.sbin.slapd

answered Dec 17, 2019 at 5:18

warbjoh

111 bronze badge

Disabling a security system is not, generally, a winning idea.
– womble ♦
Dec 17, 2019 at 11:34

Add a comment |

Kartik Agarwal · Accepted Answer · 2020-03-17 14:46:43Z

1

I solved the problem just use in the correct order first key then cert. And it worked for me.

dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/myldap.kart.com.key 

dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/myldap.kart.com.cert

answered Mar 17, 2020 at 14:46

Kartik Agarwal

1215 bronze badges

Add a comment |

Arby's · Accepted Answer · 2021-06-05 06:58:29Z

I had this issue, I tried many solutions, and came to the ultimate conclusion it was an apparmor issue. I solved this by installing reconfiguring the slapd profile.

So first I had to install app-armor profiles

apt install apparmor-profiles

Secondly, I had to reconfigure the profile. So you will either need two ssh sessions open or do this in a screen session with one running your ldap commands and one running aa-genprof.

So in one session run

aa-genprof slapd

You will see something like this > Profiling: /usr/sbin/slapd

Please start the application to be profiled in
another window and exercise its functionality now.
Once completed, select the "Scan" option below in
order to scan the system logs for AppArmor events.
For each AppArmor event, you will be given the
opportunity to choose whether the access should be
allowed or denied.
[(S)can system log for AppArmor events] / (F)inish

Now.. in your other session run your ldif script or commands in ldapmodify.

In your session that genprof you will Scan system log for AppArmor events, and you will get the option to Allow the action.... So simply, allow it, when your done Finish and Save the new profile.. Wooola!

Stack Exchange Network

LDAP TSL ldap_modify: error 80

4 Answers 4

Your Answer

Not the answer you're looking for? Browse other questions tagged
ubuntu
ssl
ssl-certificate
ldap
openldap
or ask your own question.

Hot Network Questions

LDAP TSL ldap_modify: error 80

4 Answers 4

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged ubuntusslssl-certificateldapopenldap or ask your own question.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
ubuntu
ssl
ssl-certificate
ldap
openldap
or ask your own question.