OpenLDAP : TLS not working out of the box #1939
Comments
|
Hi, thanks for reporting. As you note, it certainly does appear to be an issue with the certs: I'm still no expert with OpenLDAP or LDAP in general and I forget the specific details. I've done some quick searching online to try to refresh my memory. FWIW, I'm looking at the Although now re-reading that stuff, I'm wondering if the local client has separate config to the server and it's not preconfigured? While that might make sense, it doesn't seem that we're touching the config of either the OpenLDAP client or the server at build time. So I can only assume that we're using the default cert paths used by both of them. Also it would surprise me somewhat as I'm sure I tested it in a local VM, before pushing it the to OpenLDAP appliance build code overlay. OTOH it wouldn't be the first time that has happened (if I forget to test the script on a clean install, there can be some config I did along the way that meant the script worked on my test server, but might not on a clean install)... So to see if there is perhaps something wrong with my script, please double check for errors that occur in the firstboot scripts: And it might also be worth manually rerunning the script. I.e.: Where I'll try to test myself ASAP but I'm a bit snowed under ATM, so it'd be great if you could report back. |
|
Thanks for the reply. I did the troubleshooting steps you recommended.
As a sanity check, I tried to establish a unencrypted connection with the default admin user, to make sure there wasn't any rights issue. When I change the certs and give it a new FQDN, it works correctly as long as I make sure that the FQDN is reacheable. So I modify my /etc/hosts file according ( 127.0.1.1). One thing I noticed, is that in the webmin OpenLDAP server configuration, I can generate new SSL certificate. However, If I use that option, slapd fails to restart until I regenerate the turnkey certs with the CLI command. I am new to turnkey, so I am not sure if there is any link.
When I regenerate the SSL certs and try to apply the configuration, I get this issue : And when I look up the systemctl status, I get this info : My understanding is that the Generate SSL button is supposed to do the same thing as turnkey-regen-ldap-certs, but I might be wrong. I can restart slapd by using the turnkey-regen-ldap-certs first, and then in webmin, start the server. I will try to generate and sign my certificate manually see if that fixes the issue. I hope that the delta will give us some insight on what is happening with the turnkey image. Let me know if I can test other things to help out. |
|
Is it possible that the issue is that the LDAP client is not configured correctly? When I look into webmin, in the LDAP client, I see this :
When I try to install the module, it says that the module is already installed But when I look for a ldap.conf file, I get nothing. |
|
Thanks for the additional info. It's certainly strange that it's not finding the conf file. Perhaps it needs some more config to make the web UI work properly? TBH, I'm a CLI guy and often forget to check via the web UI. I'll be sure to explicitly check that. I'll have a look into it ASAP and report back (and document). If need be I'll release a new version with the required changes. |
|
Hi Jeremy,
I am more of a CLI guy as well, but I don't know turnkey projects (this is
my first one) so the webmin at least give me an idea of what to look for.
I tried to find the ldap.conf file in the file system. I thought that maybe
the conf file had another name. No success.
I don't know LDAP that well, so I'll see if I can recreate a working
ldap.conf file.
That should give insight on what is missing if that works.
…On Sun, May 5, 2024, 6:46 p.m. Jeremy Davis ***@***.***> wrote:
Thanks for the additional info.
It's certainly strange that it's not finding the conf file. Perhaps it
needs some more config to make the web UI work properly?
TBH, I'm a CLI guy and often forget to check via the web UI. I'll be sure
to explicitly check that.
I'll have a look into it ASAP and report back (and document). If need be
I'll release a new version with the required changes.
—
Reply to this email directly, view it on GitHub
<#1939 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ARCKKK4P3GO277XBY4AHMHTZA2ZD3AVCNFSM6AAAAABHBK4KISVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAOJUHE3TSNRUG4>
.
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
|
Hey @TitanBalls I think I know what the issue is! I haven't tested, but I'm fairly confident. Scroll to the last paragraph for the TL;DR, or read on for the context. :) Before I go on, FYI OpenLDP itself comes direct from Debian - the package is called slapd. The However, it looks like we're not explicitly installing it. See the OpenLDAP appliance specific plan (the Debian packages that are installed). Generally I would not expect that to be a problem, as in my experience To check that, I followed the trail of dependencies. Both ldap-utils & slapd (the packages we're explicitly installing) depend on libldap-2.5-0. But instead of that depending on libldap-common as I would have expected, libldap-common is just a "recommends". By default on Debian "recommends" (soft dependencies) are treated just like "depends" (hard dependencies) and are auto installed. But as "recommends" by nature are not required for core functionality and to try to keep our appliances lean, we configure apt to only install hard dependencies by default. So the package that provides the My guess is that when I developed and tested the OpenLDAP SSL/TLS script (IIRC our last major version release - based on the previous Debian version) that it was a hard dependency - so it all "just worked". But for some reason it has moved to a "recommends" in Bookworm (TKL v18.x), thus isn't being installed! Then when the updated v18.x appliance was tested for this release, my colleague (who did the update) only tested the core OpenLDAP functionality and didn't explicitly test the SSL/TLS support. I did code review and pre-release basic smoke testing, but I didn't test SSL/TLS support until you dropped in - and the rest is history. So... TL;DR try installing libldap-common and see how you go! |
|
You were right. When I installed libldap-common, After that , I simply edited When I try the ldapsearch with the option To verify that, I added the option -d 2 and got a bunch of TLS exchanges like this which I didn't have before. Thank you for your help, it is appreciated. |
|
[WORKAROUND] when starting the turnkey openldap, go through the initial configuration. Then, run the following commands : After that, modify the ldap.conf file to point to the right path Then, either through the webmin, or through the CLI, make sure that the LDAP client is pointing to the right ldap.conf path. By default, the path is Reboot the LDAP service, and the ldap query goes through with the |
|
Awesome! Thanks again for your initial report and bonus points for confirming! 😁 I am going to reopen this issue again though. While this thread (particularly your last post) will assist users to implement it now, IMO our appliance should include support for SSL/TLS OOTB. Especially as this is a regression really. It has supported SSL/TLS in the past. I'll reclose it once the OpenLDAP appliance build code is "fixed". Although I probably won't prioritize rebuilding it. We still have a few appliances left to update to v18.0. Once they're all updated I'll do a batch of updates - at least those that include bugfixes. |
Hello,
it seems that the OpenLDAP turnkey TLS doesn't work out of the box.
[Setup]
Proxmox : 8.0.3
Template : Debian 12 - Turnkey OpenLDAP 18.0
[Issue]
After the initial setup, when trying to make an LDAP + StartTLS connection, it fails with the following error :
The peer cert is untrusted or revoked.
[Additional info]
As per the issue #1557 , the recommended way to use TLS is to use StartTLS. To do so, I use the following command :
where cn=openldap is my bind accout (security object) to make searches in the database.
As per the LDAP documentation, the -ZZ tag is used to initiate a unencrypted connection, and then upgrade the connection with StartTLS.
When looking into the Webmin console, in the OpenLDAP config points to the auto generated certificate for openldap and the CA.
The text was updated successfully, but these errors were encountered: