0000478: Samba is configured to use start tls for LDAP ; slapd is not configured this way

View Issue Details [ Jump to Notes ]

[ Issue History ] [ Print ]

Project

Category

View Status

Date Submitted

Last Update

0000478

ClearOS

app-samba - Windows Networking

public

2012-03-09 19:35

2012-04-18 19:39

Reporter

user2

Assigned To

user2

Priority

normal

Severity

major

Reproducibility

always

Status

closed

Resolution

fixed

Platform

OS Version

Product Version

Target Version

Fixed in Version

6.2.0 RC 1

Summary

0000478: Samba is configured to use start tls for LDAP ; slapd is not configured this way

Description

By default, samba uses start tls when talking to an LDAP server (see man smb.conf, parameter "ldap ssl"). For ClearOS, this configuration is wrong, because slapd is not set up for ssl.

In my case, I'm pretty much certain that this misconfiguration exposes bugs in slapd which lead to it becoming progressively less responsive.. see http://www.clearfoundation.com/component/option,com_kunena/Itemid,232/catid,26/func,view/id,32600/limit,10/limitstart,20/#35057 [^]

I've listed the severity as major, because failing slapd was definitely a major problem for me.

But in any case, samba shouldn't be using ssl when talking to ldap, the samba and slapd configurations should align.

Additional Information

To fix this, just add

ldap ssl = no

to /etc/openldap/templates/smb.ldap.conf.template

Note that you won't see direct evidence of this misconfiguration unless you turn on debugging in samba; in /etc/samba/smb.conf add

ldap debug level = 264
ldap debug threshold = 1

After this, you'll get messages in the samba logs repeated for every single ldap connection:

[2011/10/29 22:36:39.253617, 1] lib/ldap_debug_handler.c:25(samba_ldap_log_print_fn)
[LDAP] TLS certificate verification: Error, self signed certificate
[2011/10/29 22:36:39.268720, 1] lib/ldap_debug_handler.c:25(samba_ldap_log_print_fn)
[LDAP] TLS: unable to get peer certificate.

Tags

No tags attached.

Attached Files

Relationships

Notes
(0000436) user2 2012-03-09 19:38	This was fixed in version 6 development (June 2011): http://code.clearfoundation.com/svn/diff.php?repname=ClearOS&path=%2Fwebconfig%2Fapps%2Fsamba%2Ftrunk%2Fpackaging%2Fsmb.ldap.conf&rev=1600&peg=1600 [^]

Issue History
Date Modified	Username	Field	Change
2012-03-09 19:35	user2	New Issue
2012-03-09 19:35	user2	Status	new => assigned
2012-03-09 19:35	user2	Assigned To	=> user2
2012-03-09 19:35	user2	Issue generated from: 0000456
2012-03-09 19:38	user2	Note Added: 0000436
2012-03-09 19:38	user2	Status	assigned => resolved
2012-03-09 19:38	user2	Fixed in Version	=> 6.2.0 RC 1
2012-03-09 19:38	user2	Resolution	open => fixed
2012-03-09 19:39	user2	Category	samba => app-samba - Windows Networking
2012-04-18 19:39	user2	Status	resolved => closed

ClearOS Bug Tracker