I run two Debian servers with MIT Kerberos and OpenLDAP backend. I would like to enforce TLS and encrypt replication. So I created and added certificates…

dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/ca.crt
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/server1.crt
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/server1.key

…and enforced STARTTLS

dn: olcDatabase={1}mdb,cn=config
changeType: modify
add: olcSecurity
olcSecurity: tls=1

After some fiddling, I found out that this also applies to IPC (ldapi) and all daemons need access to the root certificate. For example /etc/nslcd.conf:

ssl start_tls
tls_cacertfile /etc/ssl/ca.crt

and of course /etc/ldap/ldap.conf:

TLS_CACERT /etc/ssl/ca.crt

Except for Kerberos. I find no option to tell him about the location of the root certificate. I would expect it in /etc/krb5.conf:

LDAP = {
        db_library              = kldap
        ldap_kdc_dn             = cn=kdc,ou=daemons,dc=example,dc=com
        ldap_kadmind_dn         = cn=adm,ou=daemons,dc=example,dc=com
        ldap_service_password_file = /etc/krb5kdc/service.keyfile
        ldap_servers            = ldapi:///
        ldap_conns_per_server   = 5

Consequentially, it complains:

kadmind: connection with LDAP-server »ldapi:///«
as »cn=adm,ou=daemons,dc=example,dc=com« can not be established: 
Confidentiality required

So, how do I tell Kerberos where to find the root certificate?

  • perhaps you have to use ldaps:// ? – D'Arcy Nader Dec 6 '18 at 18:56
  • Thanks for the idea, I tried ldaps://localhost, but Kerberos can't get a connection because OpenLDP isn't listening on Port 636 (yet). Wouldn't Kerberos still need a certificate? Also, I think STARTLS is preferred nowadays? – Frank Dec 6 '18 at 20:17
  • yes you are right. – D'Arcy Nader Dec 6 '18 at 20:24
  • Funny, with SLAPD_SERVICES="ldap:/// ldapi:/// ldaps:///", ldap_servers = ldaps://localhost and enforced TLS, Kerberos doesn't care about the validity of the certificate. My immediate problem (encryption) seems to be solved, but I still hope to find a cleaner solution. Anyway: Thanks a lot! – Frank Dec 6 '18 at 20:51
  • check this part it seems interesting " TLSVerifyClient { never | allow | try | demand }" openldap.org/doc/admin24/tls.html – D'Arcy Nader Dec 6 '18 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.