I'm having a hard time trying to populate an LDAP with PGP keys. I have set up my LDAP (OpenLDAP if that matters) for a PGP key server structure as explained here which worked well so far.

Now I want to use the gpg command to send some keys to the LDAP like so:

gpg --keyserver ldap://ldap.example.com --send-keys 1234CAFE

but this fails with

Strong(er) LDAP authentication required

The LDAP (running with loglevel debug) outputs

fd=12 ACCEPT from IP=n.n.n.n:57480 (IP=
op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)"
op=0 SRCH attr=namingContexts
op=0 SEARCH RESULT tag=101 err=0 nentries=1 text=
op=1 SRCH base="cn=pgpServerInfo,dc=example,dc=com" scope=0 deref=0 filter="(objectClass=*)"
op=1 SRCH attr=pgpBaseKeySpaceDN pgpVersion pgpSoftware
op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
op=2 MOD dn="pgpCertID=9BB4C6C315EA172A,ou=GnuPG Keys,dc=example,dc=com"
op=2 MOD attr=pgpDisabled pgpKeyID pgpKeyType pgpUserID pgpKeyCreateTime pgpSignerID pgpRevoked pgpSubKeyID pgpKeySize pgpKeyExpireTime pgpCertID objectClass pgpKey
op=2 RESULT tag=103 err=8 text=modifications require authentication
fd=12 closed

From the message "modifications require authentication" I understanding that the keys could not be sent because gpg does not authenticate against the LDAP server, so tries to add the key as an anonymous user which is denied.

I haven't found out how to let gpg authenticate, so I tried to allow anonymous write access by adding the following acl:

olcAccess: {0}to dn.subtree="ou=GnuPG Keys,dc=example,dc=com"
  by * write

But it doesn't seem to make a difference. Shouldn't this allow anonymous users to create objects below GnuP Keys?

What am I doing wrong?

1 Answer 1


by * write is not enough to allow anonymous updates. This must be allowed explicitly by adding

# Allow any connection to update the PGP keys 
# (including removing them!) 
# This is only needed if the anonymous
# updates from localhost are desired.
dn: cn=config
add: olcAllows
olcAllows: update_anon

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .