openldap: is possible to force the starttls from a client?

Question

I don't explain how to configure tls-ldap on server, on google there is a lot of stuff to configure it(create tls certs, create ldif, import ldif, try ldapsearch -ZZ, etc..). Is also easy to force the tls from server, so connection without -Z or -ZZ are refused

ldapsearch -LLL -D "cn=ldapadm,dc=ldap1,dc=mydom,dc=priv" -wPASSWORD -b dc=ldap1,dc=mydom,dc=priv uidNumber=10009 uidNumber
ldap_bind: Confidentiality required (13)
    additional info: TLS confidentiality required

with ldapsearch using -Z is ok

ldapsearch -Z -LLL -D "cn=ldapadm,dc=ldap1,dc=mydom,dc=priv" -wPASSWORD -b dc=ldap1,dc=mydom,dc=priv uidNumber=10009 uidNumber
dn: sambaSID=S-1-5-21-38458588-165473958-13245875-1289,ou=idmap,dc=ldap1,dc=mydom,dc=priv
uidNumber: 10009

I have force TLS using this ldif on server

dn: olcDatabase={1}mdb,cn=config
changetype: modify
add: olcSecurity
olcSecurity: tls=1

Now the problem, even with the tls force the password can be sniffed from the lan

I run the command without -Z, connection is refused

ldapsearch -LLL -D "cn=ldapadm,dc=ldap1,dc=mydom,dc=priv" -wPASSWORD -b dc=ldap1,dc=mydom,dc=priv uidNumber=10009 uidNumber
ldap_bind: Confidentiality required (13)
    additional info: TLS confidentiality required

but tcpdump can see the password!

tcpdump -i any port 389 -vvv -Xx|egrep --colour cn= -A 11
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
    blah blah blah blah blah blah blah blah blah blah  .`7...."cn=ldapa
    blah blah blah blah blah blah blah blah blah blah  dm,dc=ldap1,dc=m
    blah blah blah blah blah blah blah blah blah blah  ydom,dc=priv..PAS
    blah blah blah blah blah blah blah blah blah blah  SSWORDCLEAR!
....

The question is simple, is possible to force ldapsearch and all ldap clients to use -Z when tls is forced on server? If not possible as it seems, I can propose some "ideas"

1)An rc file with options for ldap clients which contain the options to pass for clients, for example

LDAPSEARCH_OPTIONS="-ZZ"

2)A mechanism wich recognize the tls forced server and automatic enable the -ZZ with the exception for localhost or ldapi.

Answer 1

You can try adding an LDAP extended operation for STARTTLS onto the URI in your client LDAP configuration file (e.g. ~/.ldaprc or /etc/ldap/ldap.conf).

URI ldap://<ldap-server>/????1.3.6.1.4.1.1466.20037

I seem to have had some success with that. Although I find the option TLS_REQCERT demand either stops working or I don't quite understand how STARTTLS interacts with the certificate options in the LDAP config files. I.e. Using the above extended operation config, I have still seen the session try STARTTLS with a server that does not support STARTTLS and then go back to clear text.

UPDATE: If you add an exclamation point (!) before the OID, then this seems to prevent the client from failing back to cleartext. E.g.
URI ldap://<ldap-server>/????!1.3.6.1.4.1.1466.20037

So it appears that the client (e.g. ldapsearch) command line option:
-Z is equivalent to adding ????1.3.6.1.4.1.1466.20037 to the URI
-ZZ is equivalent to adding ????!1.3.6.1.4.1.1466.20037 to the URI
END UPDATE

References with some hints:

https://lists.openldap.org/hyperkitty/list/openldap-devel@openldap.org/thread/SXWOL5SVSLWSNX35QFPVP6BPSLSHWOYG/#SXWOL5SVSLWSNX35QFPVP6BPSLSHWOYG
https://www.openldap.org/lists/openldap-devel/200202/msg00070.html https://ldapwiki.com/wiki/StartTLS
https://www.rfc-editor.org/rfc/rfc4511#page-40
https://git.openldap.org/search?utf8=%E2%9C%93&snippets=false&scope=&repository_ref=master&search=LDAP_EXOP_START_TLS&group_id=13&project_id=1