Home / ubuntu / Questions / 936382
Accepted
Ph4edrus
Asked: 2017-07-16 02:32:16 +0800 CST

OpenLDAP error configuring StartTLS: ldap_modify: Other (e.g., implementation specific) error (80)

  • 772

Configuring StartTLS for OpenLDAP.

  • Ubuntu server 16.04
  • Slapd 2.4.42+dfsg-2ubuntu3.2

I have my own internal Certificate authority that is providing certificates.

I have set up certificates and key: in /etc/ssl/certs:

-rw-r----- 1 root ssl-cert   3268 Jul 14 23:02 ldaptest.roenix.net.cert.pem

lrwxrwxrwx 1 root root         51 Jul  2 13:22 roenix.ca.cert.pem -> /usr/local/share/ca-certificates/roenix.ca.cert.crt

in /etc/ssl/private:

-rw-r----- 1 root ssl-cert 3243 Jul 14 23:01 ldaptest.roenix.net.key.pem

I have correctly set hostname:

@ldaptest:/etc/ssl/certs$ hostname -f
ldaptest.roenix.net

I try to add the configuration to slapd with this LDIF:

dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/roenix.ca.cert.pem
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/ldaptest.roenix.net.cert.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/ldaptest.roenix.net.key.pem

With the command:

sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f certinfo.ldif

I get this error:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)

Any help greatly appreciated!

openldap

6 Answers

  1. I solved this problem by changing the order in the file.ldif like this:

    dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/your_key

dn: cn=config 
changetype: modify
replace: olcTLSCertificateFile 
olcTLSCertificateFile: /etc/openldap/certs/your_certificate

    and the I ran the command 

    ldapmodify -Y EXTERNAL -H ldapi:/// -f your_file.ldif

    make sure that there an acl that makes the root eligible to make change with authenticating with SASL bind.

    To make sure that changes have been done, run this command 

    ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config | grep olcTLS
    • 5

  2. I had the same problem. Certificates were stored in the /opt/local/cert.

    You must add this directory to the list of the resolved files in /etc/apparmor.d/local/usr.sbin.slapd:

    /opt/local/cert/ r,
/opt/local/cert/* r,
    • 2

  3. This error can be also a permission error. For example if did this command

    vim newcerts.ldif

dn: cn=config
changetype: modify
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/myca.crt
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/ldap1.mydom.crt
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/ldap1.mydom.key
-
replace: olcTLSRandFile
olcTLSRandFile: /dev/urandom

    then

    ldapmodify -Y EXTERNAL -H ldapi:/// -f newcerts.ldif

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)

    but after give with setfacl the permission of read keyfile to openldap user(the certs are usually 644 readable by all)

    setfacl -m u:openldap:r-x /etc/ssl/private
setfacl -m u:openldap:r-x /etc/ssl/private/ldap1.mydom.key

    all works

    ldapmodify -Y EXTERNAL -H ldapi:/// -f newcerts.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
    • 1

  4. I solved the problem just use in the correct order first key then cert. And it worked for me. 

    dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/myldap.kart.com.key 

dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/myldap.kart.com.cert
    • 1

  5. Problem could also be that SELinux is preventing slapd from read access to the .key and .cert file. Please add policy for the files, dont turn SELinux off.

    Having problem with SELinux. Use tool setroubleshoot.

    • 0
  6. Best Answer

    Thomas' comment put me on the right track.

    Cause of the problem: I failed to realize that /etc/ssl/certs/roenix.ca.cert.crt is actually a symlink to /usr/local/share/ca-certificates/roenix.ca.cert.crt.

    Solution: Set correct permissions on the actual cert file in /usr/local/share/ca-certificates.

    Also read the other comments and learned a lot! Thanks all.

    • 0