ubuntu - LDAP TSL ldap_modify: error 80

相关文章推荐
无邪的蚂蚁 · 杭州新添一所“附属高中”，属于这所大学！今年 ...· 1 年前 ·
没有腹肌的海豚 · Why does ...· 1 年前 ·
私奔的红烧肉 · mdk平台下，cm3内核单片机使用event ...· 1 年前 ·
谦逊的板凳 · 复旦大学“老教授谈教书育人”专栏（十六）张振 ...· 2 年前 ·
贪玩的皮带 · javascript - How can ...· 2 年前 ·
Stack Exchange network consists of 183 Q&A communities including Stack Overflow , the largest, most trusted online community for developers to learn, share their knowledge, and build their careers. Visit Stack Exchange
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Teams
Q&A for work
Connect and share knowledge within a single location that is structured and easy to search.
Learn more about Teams
I was read few suggestion from this and many others forums and try to fix problem on my own, but without result. I need to add cert to ldap and always it return error 80.
I was add permission to folder with ldap:
ls -la /etc/apache2/ssl/
razem 16
drwxrwxr-- 2 root root 4096 cze 29 12:52 .
drwxr-xr-x 9 root root 4096 lip  2 10:33 ..
-rwxrwxr-- 1 root root 1545 gru 22  2017 od.censored.pl.crt
-rwxrwxr-- 1 root root 1704 gru 22  2017 od.censored.pl.key
I was check permission to temp directory:
ls -la /var/lib/lda*
razem 708
drwxr-xr-x  2 openldap openldap     4096 lip  2 10:39 .
drwxr-xr-x 79 root     root         4096 cze 30 09:06 ..
-rw-r--r--  1 openldap openldap     4096 cze 29 13:50 alock
-rw-------  1 openldap openldap     8192 kwi 13 11:12 cn.bdb
-rw-------  1 openldap openldap   548863 cze 29 14:20 __db.001
-rw-------  1 openldap openldap   147455 lip  2 10:50 __db.002
-rw-------  1 openldap openldap   114687 cze 29 13:50 __db.003
-rw-r--r--  1 openldap openldap       96 kwi 13 11:12 DB_CONFIG
-rw-------  1 openldap openldap     8192 kwi 13 11:12 dn2id.bdb
-rw-------  1 openldap openldap    32768 kwi 13 12:12 id2entry.bdb
-rw-------  1 openldap openldap 10485759 cze 29 14:20 log.0000000001
-rw-------  1 openldap openldap     8192 kwi 13 11:12 objectClass.bdb
The certs.ldif looks:
cat -n certs.ldif 
     1  dn: cn=config
     2  changetype: modify
     3  replace: olcTLSCertificateFile
     4  olcTLSCertificateFile: /etc/apache2/ssl/od.censored.pl.crt
     6  dn: cn=config
     7  changetype: modify
     8  replace: olcTLSCertificateKeyFile
     9  olcTLSCertificateKeyFile: /etc/apache2/ssl/od.censored.pl.key
But I see error over and over:
ldapmodify -Y EXTERNAL -H ldapi:/// -vvv -f certs.ldif
ldap_initialize( ldapi:///??base )
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
replace olcTLSCertificateFile:
    /etc/apache2/ssl/od.censored.pl.crt
modifying entry "cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)
Logs after add tried:
   195  Jul  4 12:50:49 odps02 slapd[18075]: conn=1005 op=1 RESULT tag=103 err=0 text=
   196  Jul  4 12:50:49 odps02 slapd[18075]: conn=1005 op=2 UNBIND
   197  Jul  4 12:50:49 odps02 slapd[18075]: conn=1005 fd=18 closed
   198  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 fd=18 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
   199  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 op=0 BIND dn="" method=163
   200  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 op=0 BIND authcid="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
   201  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 op=0 BIND dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
   202  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 op=0 RESULT tag=97 err=0 text=
   203  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 op=1 MOD dn="cn=config"
   204  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 op=1 MOD attr=olcTLSCertificateFile
   205  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 op=1 RESULT tag=103 err=80 text=
   206  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 op=2 UNBIND
   207  Jul  4 12:54:57 odps02 slapd[18075]: conn=1006 fd=18 closed
Debug import try:
ldap_url_parse_ext(ldapi:///)
ldap_create
ldap_url_parse_ext(ldapi:///??base)
ldap_sasl_interactive_bind: user selected: EXTERNAL
ldap_int_sasl_bind: EXTERNAL
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_path
ldap_new_socket: 4
ldap_connect_to_path: Trying /var/run/slapd/ldapi
ldap_connect_timeout: fd: 4 tm: -1 async: 0
ldap_ndelay_on: 4
ldap_ndelay_off: 4
ldap_int_sasl_open: host=odps02
SASL/EXTERNAL authentication started
ldap_sasl_bind
ldap_send_initial_request
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_dump: buf=0x55ab9f63d3f0 ptr=0x55ab9f63d3f0 end=0x55ab9f63d40a len=26
  0000:  30 18 02 01 01 60 13 02  01 03 04 00 a3 0c 04 08   0....`..........  
  0010:  45 58 54 45 52 4e 41 4c  04 00                     EXTERNAL..        
ber_scanf fmt ({i) ber:
ber_dump: buf=0x55ab9f63d3f0 ptr=0x55ab9f63d3f5 end=0x55ab9f63d40a len=21
  0000:  60 13 02 01 03 04 00 a3  0c 04 08 45 58 54 45 52   `..........EXTER  
  0010:  4e 41 4c 04 00                                     NAL..             
ber_flush2: 26 bytes to sd 4
  0000:  30 18 02 01 01 60 13 02  01 03 04 00 a3 0c 04 08   0....`..........  
  0010:  45 58 54 45 52 4e 41 4c  04 00                     EXTERNAL..        
ldap_write: want=26, written=26
  0000:  30 18 02 01 01 60 13 02  01 03 04 00 a3 0c 04 08   0....`..........  
  0010:  45 58 54 45 52 4e 41 4c  04 00                     EXTERNAL..        
ldap_msgfree
ldap_result ld 0x55ab9f63b260 msgid 1
wait4msg ld 0x55ab9f63b260 msgid 1 (infinite timeout)
wait4msg continue ld 0x55ab9f63b260 msgid 1 all 1
** ld 0x55ab9f63b260 Connections:
* host: (null)  port: 0  (default)
  refcnt: 2  status: Connected
  last used: Fri Jul  6 15:04:50 2018
** ld 0x55ab9f63b260 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x55ab9f63b260 request count 1 (abandoned 0)
** ld 0x55ab9f63b260 Response Queue:
   Empty
  ld 0x55ab9f63b260 response count 0
ldap_chkResponseList ld 0x55ab9f63b260 msgid 1 all 1
ldap_chkResponseList returns ld 0x55ab9f63b260 NULL
ldap_int_select
read1msg: ld 0x55ab9f63b260 msgid 1 all 1
ber_get_next
ldap_read: want=8, got=8
  0000:  30 0c 02 01 01 61 07 0a                            0....a..          
ldap_read: want=6, got=6
  0000:  01 00 04 00 04 00                                  ......            
ber_get_next: tag 0x30 len 12 contents:
ber_dump: buf=0x55ab9f61d990 ptr=0x55ab9f61d990 end=0x55ab9f61d99c len=12
  0000:  02 01 01 61 07 0a 01 00  04 00 04 00               ...a........      
read1msg: ld 0x55ab9f63b260 msgid 1 message type bind
ber_scanf fmt ({eAA) ber:
ber_dump: buf=0x55ab9f61d990 ptr=0x55ab9f61d993 end=0x55ab9f61d99c len=9
  0000:  61 07 0a 01 00 04 00 04  00                        a........         
read1msg: ld 0x55ab9f63b260 0 new referrals
read1msg:  mark request completed, ld 0x55ab9f63b260 msgid 1
request done: ld 0x55ab9f63b260 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_int_sasl_bind: EXTERNAL
ldap_parse_sasl_bind_result
ber_scanf fmt ({eAA) ber:
ber_dump: buf=0x55ab9f61d990 ptr=0x55ab9f61d993 end=0x55ab9f61d99c len=9
  0000:  61 07 0a 01 00 04 00 04  00                        a........         
ldap_parse_result
ber_scanf fmt ({iAA) ber:
ber_dump: buf=0x55ab9f61d990 ptr=0x55ab9f61d993 end=0x55ab9f61d99c len=9
  0000:  61 07 0a 01 00 04 00 04  00                        a........         
ber_scanf fmt (}) ber:
ber_dump: buf=0x55ab9f61d990 ptr=0x55ab9f61d99c end=0x55ab9f61d99c len=0
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
ldap_msgfree
modifying entry "cn=config"
ldap_modify_ext
ldap_send_initial_request
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_dump: buf=0x55ab9f640b00 ptr=0x55ab9f640b00 end=0x55ab9f640b58 len=88
  0000:  30 56 02 01 02 66 51 04  09 63 6e 3d 63 6f 6e 66   0V...fQ..cn=conf  
  0010:  69 67 30 44 30 42 0a 01  02 30 3d 04 17 6f 6c 63   ig0D0B...0=..olc  
  0020:  54 4c 53 43 41 43 65 72  74 69 66 69 63 61 74 65   TLSCACertificate  
  0030:  46 69 6c 65 31 22 04 20  2f 65 74 63 2f 61 70 61   File1". /etc/apa  
  0040:  63 68 65 32 2f 73 73 6c  2f 6f 64 2e 70 67 6e 69   che2/ssl/od.pgni  
  0050:  67 2e 70 6c 2e 63 73 72                            g.pl.csr          
ber_scanf fmt ({) ber:
ber_dump: buf=0x55ab9f640b00 ptr=0x55ab9f640b05 end=0x55ab9f640b58 len=83
  0000:  66 51 04 09 63 6e 3d 63  6f 6e 66 69 67 30 44 30   fQ..cn=config0D0  
  0010:  42 0a 01 02 30 3d 04 17  6f 6c 63 54 4c 53 43 41   B...0=..olcTLSCA  
  0020:  43 65 72 74 69 66 69 63  61 74 65 46 69 6c 65 31   CertificateFile1  
  0030:  22 04 20 2f 65 74 63 2f  61 70 61 63 68 65 32 2f   ". /etc/apache2/  
  0040:  73 73 6c 2f 6f 64 2e 70  67 6e 69 67 2e 70 6c 2e   ssl/od.censored.pl.  
  0050:  63 73 72                                           csr               
ber_flush2: 88 bytes to sd 4
  0000:  30 56 02 01 02 66 51 04  09 63 6e 3d 63 6f 6e 66   0V...fQ..cn=conf  
  0010:  69 67 30 44 30 42 0a 01  02 30 3d 04 17 6f 6c 63   ig0D0B...0=..olc  
  0020:  54 4c 53 43 41 43 65 72  74 69 66 69 63 61 74 65   TLSCACertificate  
  0030:  46 69 6c 65 31 22 04 20  2f 65 74 63 2f 61 70 61   File1". /etc/apa  
  0040:  63 68 65 32 2f 73 73 6c  2f 6f 64 2e 70 67 6e 69   che2/ssl/od.pgni  
  0050:  67 2e 70 6c 2e 63 73 72                            g.pl.csr          
ldap_write: want=88, written=88
  0000:  30 56 02 01 02 66 51 04  09 63 6e 3d 63 6f 6e 66   0V...fQ..cn=conf  
  0010:  69 67 30 44 30 42 0a 01  02 30 3d 04 17 6f 6c 63   ig0D0B...0=..olc  
  0020:  54 4c 53 43 41 43 65 72  74 69 66 69 63 61 74 65   TLSCACertificate  
  0030:  46 69 6c 65 31 22 04 20  2f 65 74 63 2f 61 70 61   File1". /etc/apa  
  0040:  63 68 65 32 2f 73 73 6c  2f 6f 64 2e 70 67 6e 69   che2/ssl/od.pgni  
  0050:  67 2e 70 6c 2e 63 73 72                            g.pl.csr          
ldap_result ld 0x55ab9f63b260 msgid 2
wait4msg ld 0x55ab9f63b260 msgid 2 (timeout 100000 usec)
wait4msg continue ld 0x55ab9f63b260 msgid 2 all 1
** ld 0x55ab9f63b260 Connections:
* host: (null)  port: 0  (default)
  refcnt: 2  status: Connected
  last used: Fri Jul  6 15:04:50 2018
** ld 0x55ab9f63b260 Outstanding Requests:
 * msgid 2,  origid 2, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x55ab9f63b260 request count 1 (abandoned 0)
** ld 0x55ab9f63b260 Response Queue:
   Empty
  ld 0x55ab9f63b260 response count 0
ldap_chkResponseList ld 0x55ab9f63b260 msgid 2 all 1
ldap_chkResponseList returns ld 0x55ab9f63b260 NULL
ldap_int_select
read1msg: ld 0x55ab9f63b260 msgid 2 all 1
ber_get_next
ldap_read: want=8, got=8
  0000:  30 0c 02 01 02 67 07 0a                            0....g..          
ldap_read: want=6, got=6
  0000:  01 50 04 00 04 00                                  .P....            
ber_get_next: tag 0x30 len 12 contents:
ber_dump: buf=0x55ab9f61c910 ptr=0x55ab9f61c910 end=0x55ab9f61c91c len=12
  0000:  02 01 02 67 07 0a 01 50  04 00 04 00               ...g...P....      
read1msg: ld 0x55ab9f63b260 msgid 2 message type modify
ber_scanf fmt ({eAA) ber:
ber_dump: buf=0x55ab9f61c910 ptr=0x55ab9f61c913 end=0x55ab9f61c91c len=9
  0000:  67 07 0a 01 50 04 00 04  00                        g...P....         
read1msg: ld 0x55ab9f63b260 0 new referrals
read1msg:  mark request completed, ld 0x55ab9f63b260 msgid 2
request done: ld 0x55ab9f63b260 msgid 2
res_errno: 80, res_error: <>, res_matched: <>
ldap_free_request (origid 2, msgid 2)
ldap_parse_result
ber_scanf fmt ({iAA) ber:
ber_dump: buf=0x55ab9f61c910 ptr=0x55ab9f61c913 end=0x55ab9f61c91c len=9
  0000:  67 07 0a 01 50 04 00 04  00                        g...P....         
ber_scanf fmt (}) ber:
ber_dump: buf=0x55ab9f61c910 ptr=0x55ab9f61c91c end=0x55ab9f61c91c len=0
ldap_msgfree
ldap_err2string
ldap_modify: Other (e.g., implementation specific) error (80)
ldap_free_connection 1 1
ldap_send_unbind
ber_flush2: 7 bytes to sd 4
  0000:  30 05 02 01 03 42 00                               0....B.           
ldap_write: want=7, written=7
  0000:  30 05 02 01 03 42 00                               0....B.           
ldap_free_connection: actually freed
Please for any suggestion how to fix it.
The issue is big problem for me, because I can't finish configuration of necessary server, please for help.
                Hi, very thanks for your response. I just add log's form var. For me this don't mean any thing. Maybe some ware are more specific logs.
– DevAxeQuestion
                Jul 4, 2018 at 11:01
                Yes, all off them are in .pem. Starts from -----BEGIN CERTIFICATE----- \ -----BEGIN CERTIFICATE REQUEST-----\ -----BEGIN PRIVATE KEY----- and finish like -----END...-----. No, I can show key file like certificates using cat in terminal so it isn't encrypted.
– DevAxeQuestion
                Jul 5, 2018 at 8:12
If openldap is the system user for running OpenLDAP's slapd this ownership/permission listed in your question does not allow slap to read the server certificate and private key:
ls -la /etc/apache2/ssl/
razem 16
drwxrwxr-- 2 root root 4096 cze 29 12:52 .
drwxr-xr-x 9 root root 4096 lip  2 10:33 ..
-rwxrwxr-- 1 root root 1545 gru 22  2017 od.censored.pl.crt
-rwxrwxr-- 1 root root 1704 gru 22  2017 od.censored.pl.key
In opposite to e.g. Apache slapd initializes the SSLContext after setuid() call even when using static config file. And with dynamic configuration (cn=config) it has to read the files during processing your LDAP modification anyway.
Therefore try this to fix group ownership:
chgrp -R openldap /etc/apache2/ssl
And also remove unneeded exec permission:
chmod 0640 /etc/apache2/ssl/od.censored.pl.crt /etc/apache2/ssl/od.censored.pl.key
From our logs
audit: type=1400 audit(1576557786.149:51): apparmor="DENIED" operation="open" profile="/usr/sbin/slapd" name="/usr/local/etc/ssl_certs/our.pri_key" pid=15900 comm="slapd" requested_mask="r" denied_mask="r" fsuid=114 ouid=0
Fixed by disabling apparmor for slapd and rebooting
root@alc-jw-test5:~# ls -l /etc/apparmor.d/disable/usr.sbin.slapd
lrwxrwxrwx 1 root root 30 Dec 17 15:43 /etc/apparmor.d/disable/usr.sbin.slapd -> /etc/apparmor.d/usr.sbin.slapd
I solved the problem just use in the correct order first key then cert. And it worked for me. 
dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/myldap.kart.com.key 
dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/myldap.kart.com.cert
I had this issue, I tried many solutions, and came to the ultimate conclusion it was an apparmor issue.  I solved this by installing reconfiguring the slapd profile.
So first I had to install app-armor profiles
apt install apparmor-profiles
Secondly, I had to reconfigure the profile.  So you will either need two ssh sessions open or do this in a screen session with one running your ldap commands and one running aa-genprof.
So in one session run
aa-genprof slapd
You will see something like this
> Profiling: /usr/sbin/slapd
Please start the application to be profiled in

another window and exercise its functionality now.

Once completed, select the "Scan" option below in

order to scan the system logs for AppArmor events.

For each AppArmor event, you will be given the

opportunity to choose whether the access should be

allowed or denied.

[(S)can system log for AppArmor events] / (F)inish
Now.. in your other session run your ldif script or commands in ldapmodify.
In your session that genprof you will Scan system log for AppArmor events, and you will get the option to Allow the action.... So simply, allow it, when your done Finish and Save the new profile.. Wooola!
Stack Exchange Network
