[SOLVED] OpenVPN Server With Authentication Against OpenLDAP

lakul

Hello,

I run a Debian server 6 on which I have already successfully set up OpenLDAP 2.4.23 including phpLDAPadmin. LDAP seems to be working wonderfully so far. An SVN server can easily connect to the OpenLDAP server to authenticate the user. Now I would like to have my OpenVPN to connect to the LDAP DB. I proceeded with the following instructions:

http://www.howtoforge.com/set-up-openvpn-server-with-authentication-against-openldap-on-debian-6.0-squeeze

All the steps I was able to work through problems. But now when I want to build a connection from a client, the server reports:

MULTI: multi_create_instance called
Re-using SSL/TLS context
LZO compression initialized
Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Local Options hash (VER=V4): '530fdded'
Expected Remote Options hash (VER=V4): '41690919'
TLS: Initial packet from [AF_INET]141.76.185.231:63374, sid=108a515f 74d0ce81
LDAP bind failed immediately: Can't contact LDAP server
Unable to bind as cn=admin,dc=testdomain
LDAP connect failed.
PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-ldap.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-auth-ldap.so
TLS Auth Error: Auth Username/Password verification failed for peer
Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
[] Peer Connection Initiated with [AF_INET]141.76.185.231:63374
PUSH: Received control message: 'PUSH_REQUEST'
Delayed exit in 5 seconds
Sat Aug 13 10:41:19 2011 141.76.185.231:63374 SENT CONTROL [UNDEF]: 'AUTH_FAILED' (status=1)
Sat Aug 13 10:41:21 2011 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sat Aug 13 10:41:24 2011 141.76.185.231:63374 SIGTERM[soft,delayed-exit] received, client-instance exiting

According this message may OpenVPN with the data in the auth-ldap.conf ie "cn=admin,dc=testdomain" and produce the specified password is no connection.
Can check them here my /etc/openvpn/auth/auth-ldap.conf

<LDAP>
        URL ldap://127.0.0.1
        BindDN cn=admin,dc=testdomain
        Password {SSHA}<verschiedene zeichen>
        Timeout         15
        TLSEnable no
        FollowReferrals yes
        TLSCACertFile   /usr/local/etc/ssl/ca.pem
        TLSCACertDir    /etc/ssl/certs
        TLSCertFile     /usr/local/etc/ssl/client-cert.pem
        TLSKeyFile      /usr/local/etc/ssl/client-key.pem
</LDAP>
<Authorization>
        BaseDN "ou=people,dc=testdomain"
        SearchFilter "(&(uid=%u)(accountStatus=active))"
        RequireGroup false
</Authorization>

My SVN server does not require any login credentials to the LDAP server, so I tried the following and changed the auth-ldap.conf:

<LDAP>
        URL ldap://127.0.0.1:389
        # BindDN cn=admin,dc=testdomain
        # Password {SSHA}<verschiedene zeichen>
        Timeout         15
        TLSEnable no
        FollowReferrals yes
        TLSCACertFile   /usr/local/etc/ssl/ca.pem
        TLSCACertDir    /etc/ssl/certs
        TLSCertFile     /usr/local/etc/ssl/client-cert.pem
        TLSKeyFile      /usr/local/etc/ssl/client-key.pem
</LDAP>
<Authorization>
        BaseDN "ou=people,dc=testdomain"
        SearchFilter "(&(uid=%u)(accountStatus=active))"
        RequireGroup false
</Authorization>

I did not specify a binddn and a password. If I am now back with a user trying to log on. I get the following message from the OpenVPN server:

LDAP search failed: No such object
LDAP user "testuser" was not found.

This user definitely exists, however. Likewise, I can successfully register via SVN. Similarly, the application works on other clients on the network, which rely on the LDAP server.

Do you have an idea where my mistake might be, or where I should look again? If there are any questions just write. Thank you

lakul

janjust

the message

LDAP bind failed immediately: Can't contact LDAP server
Unable to bind as cn=admin,dc=testdomain

suggests that the openvpn server cannot connect to the LDAP server; try running something like 'ldapsearch' to see if you can query the LDAP server using 'cn=admin,dc=testadmin'

lakul

Hello,

thanks for the quick reply. I've tried the following:

ldapsearch -x -D "cn=admin,dc=campusnavigator" -W

I was asked for the password and I received the following output:

# extended LDIF
#
# LDAPv3
# base <dc=testdomain> (default) with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# testdomain
dn: dc=testdomain
objectClass: top
objectClass: dcObject
objectClass: organization
o: testdomain
dc: testdomain

# admin, testdomain
dn: cn=admin,dc=testdomain
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator
userPassword:: e1NTSEF9VFNGNGNNZS9uS0dlSkZ5Y3lEUHRmc2tReDJxVjFIKzc=

# tesuser, testdomain
dn: uid=testuser,dc=testdomain
uid: testuser
givenName: Bob
sn: Hope
cn: Bob Hope
userPassword:: e1NTSEF9SEpsSld0NWdqVysxd0RncUY3cG9qaTVpa1ZmSFZ0emM=
loginShell: /bin/bash
uidNumber: 1010
gidNumber: 2000
homeDirectory: /home/hope
shadowMin: -1
shadowMax: 999999
shadowWarning: 7
shadowInactive: -1
shadowExpire: -1
shadowFlag: 0
objectClass: top
objectClass: person
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson

# search result
search: 2
result: 0 Success

# numResponses: 4
# numEntries: 3

I think this issue is correct, right?

janjust

so in order to query the LDAP server a bind password is needed , right? the openvpn ldap plugin needs to know this password, otherwise it can never query the LDAP server to determine if a username/password is correct. did you specify a 'bindpw' value?

lakul

Yes, I've defined as follows:

URL ldap://127.0.0.1
        BindDN cn=admin,dc=testdomain
        Password e1NTSEF9VFNGNGNNZS9uS0dlSkZ5Y3lEUHRmc2tReDJxVjFIKzc=

From the issue:

ldapsearch -x -D "cn=admin,dc=campusnavigator" -W

I've used the "userPassword" as password.

janjust

ah, this plugin works differently from what I expected ; did you check the second page of the Debian HOWTO about troubleshooting? what happens if you set 'loglevel 256' in /etc/ldap/slapd.conf ? what is shown when the openvpn server process tries to connect?

lakul

Hello,

I changed the loglevel to 256:

Aug 15 14:13:35 hostname slapd[1759]: conn=1003 fd=13 ACCEPT from IP=127.0.0.1:51471 (IP=0.0.0.0:389)
Aug 15 14:13:35 hostname slapd[1759]: conn=1003 op=0 BIND dn="cn=admin,dc=testdomain" method=128
Aug 15 14:13:35 hostname slapd[1759]: conn=1003 op=0 RESULT tag=97 err=49 text=
Aug 15 14:13:35 hostname ovpn-server[1895]: LDAP bind failed: Invalid credentials
Aug 15 14:13:35 hostname ovpn-server[1895]: Unable to bind as cn=admin,dc=campusnavigator
Aug 15 14:13:35 hostname slapd[1759]: conn=1003 op=1 UNBIND
Aug 15 14:13:35 hostname slapd[1759]: conn=1003 fd=13 closed
Aug 15 14:13:35 hostname ovpn-server[1895]: LDAP connect failed.

Unfortunately, I do not understand the message. Tell you what?

lakul

I have found my error. The file should look like this:

<LDAP>
        URL ldap://localhost:389/dc=testdomain?uid?sub
        # Bind DN (If your LDAP server doesn't support anonymous binds)
        # BindDN cn=admin,dc=testdomain
        # Bind Password
        # Password 70jIGP5IqMKWo
        # Network timeout (in seconds)
        Timeout         15
        # Enable Start TLS
        TLSEnable no
        # Follow LDAP Referrals (anonymously)
        FollowReferrals yes
        # TLS CA Certificate File
        TLSCACertFile   /usr/local/etc/ssl/ca.pem
        # TLS CA Certificate Directory
        TLSCACertDir    /etc/ssl/certs
        # Client Certificate and key
        # If TLS client authentication is required
        TLSCertFile     /usr/local/etc/ssl/client-cert.pem
        TLSKeyFile      /usr/local/etc/ssl/client-key.pem
        # Cipher Suite
        # The defaults are usually fine here
        # TLSCipherSuite ALL:!ADH:@STRENGTH
</LDAP>
<Authorization>
        # Base DN
        BaseDN "dc=testdomain"
        # User Search Filter
        SearchFilter "(&(uid=%u))"
        # Require Group Membership
        RequireGroup false
        # Add non-group members to a PF table (disabled)
        #PFTable ips_vpn_users
        <Group>
                BaseDN "ou=Groups,dc=example,dc=com"
                SearchFilter "(|(cn=developers)(cn=artists))"
                MemberAttribute uniqueMember
                # Add group members to a PF table (disabled)
                #PFTable ips_vpn_eng
        </Group>
</Authorization>

janjust

I'm glad you've found the problem yourself - problem fixed, case closed?

thanks for sharing your solution (although I'm not sure I fully understand this LDAP configuration stuff 😉)