Questions[openldap](ubuntu)

20.04/'Focal Fossa' uses sssd to handle authentication, authorization, and user and group information against LDAP.

Nevertheless, sssd does not support authentication over an unencrypted channel.

I have a very small network with an ldap server which is part of a NAS. This server does not support encryption. And yes, I could setup a modern ldap server in a LXC on this NAS. (If I had the knowledge...)

Much easier for me would be, making 20.04 working with unencrypted ldap server again.

Do any of you know if and how this works?

I have installed OpenLDAP, and configured some basic users. Next, I want to configure users in my directory to be able to authenticate through my server. I was reading a little about something called PAM. Is this what I should use? If so, can someone point me to some good instructions?

I'm in the process of installing OpenLDAP, and the README file states that "Reentrant POSIX REGEX software" is required. Is there a package I can install with apt install to get this?

Configuring StartTLS for OpenLDAP.

• Ubuntu server 16.04
• Slapd 2.4.42+dfsg-2ubuntu3.2

I have my own internal Certificate authority that is providing certificates.

I have set up certificates and key: in /etc/ssl/certs:

-rw-r----- 1 root ssl-cert   3268 Jul 14 23:02 ldaptest.roenix.net.cert.pem

lrwxrwxrwx 1 root root         51 Jul  2 13:22 roenix.ca.cert.pem -> /usr/local/share/ca-certificates/roenix.ca.cert.crt

in /etc/ssl/private:

-rw-r----- 1 root ssl-cert 3243 Jul 14 23:01 ldaptest.roenix.net.key.pem

I have correctly set hostname:

@ldaptest:/etc/ssl/certs$ hostname -f
ldaptest.roenix.net

I try to add the configuration to slapd with this LDIF:

dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/roenix.ca.cert.pem
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/ldaptest.roenix.net.cert.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/ldaptest.roenix.net.key.pem

With the command:

sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f certinfo.ldif

I get this error:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)

Any help greatly appreciated!

so I followed this guide: https://help.ubuntu.com/11.04/serverguide/C/openldap-server.html

to install and configure ldap but then I discoverd both phpLDAPadmin and Luma and have decided to rebuild my tree from scratch using one of those tools. However Im not sure how to completely remove LDAP now. I can remove it using apt-get, but if I attempt to reinstall it and login using phpLDAPadmin it seems that it's still looking for older authentication and gives me a credential error