3

I don't explain how to configure tls-ldap on server, on google there is a lot of stuff to configure it(create tls certs, create ldif, import ldif, try ldapsearch -ZZ, etc..). Is also easy to force the tls from server, so connection without -Z or -ZZ are refused

ldapsearch -LLL -D "cn=ldapadm,dc=ldap1,dc=mydom,dc=priv" -wPASSWORD -b dc=ldap1,dc=mydom,dc=priv uidNumber=10009 uidNumber
ldap_bind: Confidentiality required (13)
    additional info: TLS confidentiality required

with ldapsearch using -Z is ok

ldapsearch -Z -LLL -D "cn=ldapadm,dc=ldap1,dc=mydom,dc=priv" -wPASSWORD -b dc=ldap1,dc=mydom,dc=priv uidNumber=10009 uidNumber
dn: sambaSID=S-1-5-21-38458588-165473958-13245875-1289,ou=idmap,dc=ldap1,dc=mydom,dc=priv
uidNumber: 10009

I have force TLS using this ldif on server

dn: olcDatabase={1}mdb,cn=config
changetype: modify
add: olcSecurity
olcSecurity: tls=1

Now the problem, even with the tls force the password can be sniffed from the lan

I run the command without -Z, connection is refused

ldapsearch -LLL -D "cn=ldapadm,dc=ldap1,dc=mydom,dc=priv" -wPASSWORD -b dc=ldap1,dc=mydom,dc=priv uidNumber=10009 uidNumber
ldap_bind: Confidentiality required (13)
    additional info: TLS confidentiality required

but tcpdump can see the password!

tcpdump -i any port 389 -vvv -Xx|egrep --colour cn= -A 11
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
    blah blah blah blah blah blah blah blah blah blah  .`7...."cn=ldapa
    blah blah blah blah blah blah blah blah blah blah  dm,dc=ldap1,dc=m
    blah blah blah blah blah blah blah blah blah blah  ydom,dc=priv..PAS
    blah blah blah blah blah blah blah blah blah blah  SSWORDCLEAR!
....

The question is simple, is possible to force ldapsearch and all ldap clients to use -Z when tls is forced on server? If not possible as it seems, I can propose some "ideas"

1)An rc file with options for ldap clients which contain the options to pass for clients, for example

LDAPSEARCH_OPTIONS="-ZZ"

2)A mechanism wich recognize the tls forced server and automatic enable the -ZZ with the exception for localhost or ldapi.

2
  • Wouldn't it be maybe simpler to discard LDAP in favour of LDAPS on port 636?
    – LSerni
    Nov 10 '20 at 14:56
  • Ldaps as I know can be deprecated in the next years
    – elbarna
    Nov 10 '20 at 15:05
3

You can try adding an LDAP extended operation for STARTTLS onto the URI in your client LDAP configuration file (e.g. ~/.ldaprc or /etc/ldap/ldap.conf).

URI ldap://<ldap-server>/????1.3.6.1.4.1.1466.20037

I seem to have had some success with that. Although I find the option TLS_REQCERT demand either stops working or I don't quite understand how STARTTLS interacts with the certificate options in the LDAP config files. I.e. Using the above extended operation config, I have still seen the session try STARTTLS and then fail the certificate check and then go back to clear text.

UPDATE: If you add and exclamation point (!) before the OID, then this seems to prevent the client from failing back to cleartext. E.g.
URI ldap://<ldap-server>/????!1.3.6.1.4.1.1466.20037

So it appears that the client (e.g. ldapsearch) command line option:
-Z is equivalent to adding ????1.3.6.1.4.1.1466.20037 to the URI
-ZZ is equivalent to adding ????!1.3.6.1.4.1.1466.20037 to the URI
END UPDATE

References with some hints:

https://lists.openldap.org/hyperkitty/list/openldap-devel@openldap.org/thread/SXWOL5SVSLWSNX35QFPVP6BPSLSHWOYG/#SXWOL5SVSLWSNX35QFPVP6BPSLSHWOYG
https://www.openldap.org/lists/openldap-devel/200202/msg00070.html https://ldapwiki.com/wiki/StartTLS
https://www.rfc-editor.org/rfc/rfc4511#page-40
https://git.openldap.org/search?utf8=%E2%9C%93&snippets=false&scope=&repository_ref=master&search=LDAP_EXOP_START_TLS&group_id=13&project_id=1

1
  • works perfect at least in my configuration(i don't use reqcert because is a home-test environment)
    – elbarna
    Nov 17 '20 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.