Ubuntu
openldap package

ldapsearch ignores TLS_CACERT from /etc/ldap/ldap.conf but gladly reads ~/.ldapcert.pem

Bug #618715 reported by Anders Bruun Olsen
16
This bug affects 2 people
Affects Status Importance Assigned to Milestone
openldap (Ubuntu)
Expired
Low
Unassigned

Bug Description

Binary package hint: ldap-utils

I have setup an OpenLDAP server with TLS support using the guide at https://help.ubuntu.com/10.04/serverguide/C/openldap-server.html. When I tried to do an ldapsearch over ldaps:// or using start-tls (-Z) it would refuse and give the error message TLS: peer cert untrusted or revoked (0x42). That message is given because the CA certificate is not read and thus the server certificate can not be verified. I made sure that TLS_CACERT was specified correctly in /etc/ldap/ldap.conf, but that made no difference. According to strace the CA certificate file was not even read. It did however try to read ~/.ldapcert.pem, and when I copied the CA certificate file to that path, it worked. I seems that the ldap-utilities ignore part of ldap.conf.

ProblemType: Bug
DistroRelease: Ubuntu 10.04
Package: ldap-utils 2.4.21-0ubuntu5.3
ProcVersionSignature: Ubuntu 2.6.32-24.39-generic 2.6.32.15+drm33.5
Uname: Linux 2.6.32-24-generic x86_64
NonfreeKernelModules: nvidia
Architecture: amd64
Date: Mon Aug 16 17:05:10 2010
InstallationMedia: Ubuntu 10.04 LTS "Lucid Lynx" - Release amd64 (20100427.1)
ProcEnviron:
 PATH=(custom, user)
 LANG=en_DK.utf8
 SHELL=/bin/bash
SourcePackage: openldap

Revision history for this message
Anders Bruun Olsen (abo-dsl.dk) wrote :
Revision history for this message
Mathias Gug (mathiaz) wrote :

Thank you for taking the time to report this bug and helping to make Ubuntu better.

Could you post the complete ldapsearch command line you've used?

Changed in openldap (Ubuntu):
importance: Undecided → Low
status: New → Incomplete
Revision history for this message
Anders Bruun Olsen (abo-dsl.dk) wrote :

abo@ginnungagap:~$ cat /etc/ldap/ldap.conf
#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

BASE dc=dsl,dc=dk
URI ldap://admin1.dsl.lan

#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
TLS_CACERT /etc/ssl/certs/cacert.pem
SSL start_tls

abo@ginnungagap:~$ ldapsearch -x -D "cn=admin,dc=dsl,dc=dk" -Z -W uid=abo cn
ldap_start_tls: Connect error (-11)
Enter LDAP Password:
ldap_result: Can't contact LDAP server (-1)

abo@ginnungagap:~$ cp /etc/ssl/certs/cacert.pem .ldapcert.pem

abo@ginnungagap:~$ ldapsearch -x -D "cn=admin,dc=dsl,dc=dk" -Z -W uid=abo cn
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <dc=dsl,dc=dk> (default) with scope subtree
# filter: uid=abo
# requesting: cn
#

# abo, people, dsl.dk
dn: uid=abo,ou=people,dc=dsl,dc=dk
cn: Anders Bruun Olsen

# search result
search: 3
result: 0 Success

# numResponses: 2
# numEntries: 1

Revision history for this message
Adam Sommer (asommer) wrote : Re: [Bug 618715] Re: ldapsearch ignores TLS_CACERT from /etc/ldap/ldap.conf but gladly reads ~/.ldapcert.pem

Might just be a shot in the dark, but what are the permissions of
/etc/ssl/certs/cacert.pem?
 Can the abo user read the file?

Thanks.

--
Party On,
Adam

Revision history for this message
Anders Bruun Olsen (abo-dsl.dk) wrote :

The file was copied by the user abo, so yes.

Revision history for this message
jetole (jetole) wrote :

I'm also experiencing this same issue. My /etc/ssl/certs/cacert.pem is 0644 and owned by root:root on both my ldap server. Also it seems that my ldap servers are able to sync with each other over TLS/SSL but ldapsearch doesn't seem to work for unless I put "TLS_REQCERT allow" into ~/.ldaprc. I don't know how to set this globally since /etc/ldap.conf and /etc/ldap/ldap.conf seem to ignore this value. Also I don't know how I can get my ubuntu servers to use ldap for authentication over TLS/SSL until this issue is resolved.

Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for openldap (Ubuntu) because there has been no activity for 60 days.]

Changed in openldap (Ubuntu):
status: Incomplete → Expired
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.