Openldap Proxy

jorgerod · 02-20-2019, 11:15 AM

Hello all.

I have searched the forum for this topic but failed to find a similar thread.

I'm trying to configure an OpenLdap proxy on a Ubuntu 16.04.
I've searched for Openldap tutorials on the internet and most of them are for centos and redhat so I've been trying to adapt them to my case.

The objective for this Openldap proxy is to provide authentication for a set of servers by forwarding the authentication to an active directory server via "ldaps".

I have set up a lab environment with a windows server 2016 and active directory and I have enabled ldaps.

On the openldap server I have adapted the configuration of the following pages:

https://wiki.samba.org/index.php/Ope...as_proxy_to_AD
https://gist.github.com/tuxfight3r/5...49be9c0a1ea61b

This is my current configuration:

Code:

### Schema includes ###########################################################

include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema

# Main settings ###############################################################

pidfile         /var/run/slapd/slapd.pid
argsfile        /var/run/slapd/slapd.args

### Logging ###################################################################

loglevel       -1

## Module paths ##############################################################


modulepath      /usr/lib/ldap
moduleload      back_ldap.la
moduleload      memberof.la
moduleload      rwm


### Database definition (Proxy to AD) #########################################
database        ldap
lastmod         off
uri             ldaps://dc.example.com
suffix          "dc=example,dc=com"
cancel abandon
chase-referrals no
readonly yes
protocol-version 3
rebind-as-user yes
session-tracking-request yes
use-temporary-conn yes
idassert-bind  bindmethod=simple
               binddn="cn=openldap,cn=users,dc=example,dc=com"
               credentials={SHA}/aMjJzEE2Y+gyTCjYfiX808Oio4=
               tls_reqcert=never
               tls_cacert=/etc/ldap/cert/cert.pem

From the openldap server I am able to query the AD server directly with:

Code:

LDAPTLS_REQCERT=never ldapsearch -H ldaps://dc.example.com -x -LLL -s base -b "" -D user@example.com -w XXXXXXXXX

If I query the openldap proxy address:

Code:

ldapsearch -H ldap://localhost -x -LLL -s base -b "" -D user@example.com -w XXXXXXXXX

ldap_bind: Invalid DN syntax (34)
        additional info: invalid DN

Changing the binddn on the command produces the following:

Code:

ldapsearch -H ldap://localhost -x -LLL -s base -b "" -D "cn=user,cn=users,dc=example,dc=com" -w XXXXXX

ldap_bind: Invalid credentials (49)

The certificate was exported with the key from the Domain controller and converted with the command bellow:

Code:

openssl pkcs12 -in dc.pfx -clcerts -nokeys -out cert.pem

I'm sorry if I am doing an ovious error here but I'm unable to understand what is failing.
Can some one point me in the right direction?

Thanks in advance.

leroyz84 · 02-21-2019, 03:18 PM

i have no experience with proxying to AD (why would you want to that anyway? aren't there other Solutions?)

Some things i would try:

cn=user,cn=users,dc=example,dc=com -> cn=user,cn=Users,dc=example,dc=com
or
cn=user,ou=Users,dc=example,dc=com
or
EXAMPLE\user
or EXAMPLE.COM\user

locally you are connecting without s?

turn on verbose or debug logging;

check the audit logging on your domain controller, maybe there is something that helps you in the right direction..

Missing some kerberos implementation / configuration perhaps?

AD = LDAP + Kerberos?

Since ad heavliy relies on DNS for srv records and sorts... are you using same DNS servers?

tyler2016 · 02-28-2019, 02:02 PM

If you have control over the AD servers, there is a way to add posix attributes. I would go that route if you can instead of trying to proxy it. This article should point you in the right direction:

https://banck.net/2014/02/preparing-...ory-for-linux/

I wrote a guide covering Debian that might work for Ubuntu. Just make sure you create service account on the AD domain that can read the posix attributes of your users. Other than that, just plugin the correct information for your DCs. If the step where you run pam-auth-update doesn't work, you will have to look up how to do this on ubuntu. You pretty much just need to add pam_ldap.so to the relevant files in /etc/pam.d

https://tylersguides.com/guides/debi...uthentication/

jorgerod · 03-01-2019, 10:06 AM

So I was able to get it to work.

So basically I was generating the configuration from the slapd.conf with the command:

Code:

slaptest -f /etc/ldap/slapd.conf /etc/ldap/slapd.d

Something migh have gone wrong with the information that was generated so I decided to use the /etc/ldap/slapd.conf directly instead of generating the config from it.

To use the /etc/ldap/slapd.conf directly I have edited /etc/default/slapd and added the following:

Code:

SLAPD_CONF=/etc/ldap/slapd.conf

After this the troubleshooting was quicker. I also started running the process manually with the debug option so it would help me identify the errors:

Code:

slapd -d -1

In the end everything is working with the following configuration:

Server:

Code:

#/etc/ldap/slapd.conf
### Schema includes ###########################################################

include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema

# Main settings ###############################################################

pidfile         /var/run/slapd/slapd.pid
argsfile        /var/run/slapd/slapd.args

### Logging ###################################################################

loglevel       -1

## Module paths ##############################################################


modulepath      /usr/lib/ldap
moduleload      back_ldap.la
moduleload      memberof.la
moduleload      rwm


### Database definition (Proxy to AD) #########################################
database        ldap
lastmod         off
uri             ldaps://dc.example.com
tls             ldaps tls_reqcert=never
suffix          "dc=example,dc=com"
#overlay                 rwm
#rwm-map                 attribute       uid     sAMAccountName
#rwm-map                 attribute       mail    proxyAddresses
cancel abandon
chase-referrals no
readonly yes
protocol-version 3
rebind-as-user yes
session-tracking-request yes
use-temporary-conn yes
idassert-bind  bindmethod=simple
               binddn="cn=XXXXXXX,cn=users,dc=example,dc=com"
               credentials=XXXXXXXXXXXXXXX

TLSCACertificateFile /etc/ldap/certs/cacert.pem
TLSCertificateFile /etc/ldap/certs/servercert.pem
TLSCertificateKeyFile /etc/ldap/certs/serverkey.pem
TLSVerifyClient never

Client:

Code:

# /etc/nslcd.conf
# nslcd configuration file. See nslcd.conf(5)
# for details.

# The user and group nslcd should run as.
uid nslcd
gid nslcd

# The location at which the LDAP server(s) should be reachable.
uri ldaps://XXXXXXXXX:636/

# The search base that will be used for all queries.
#base dc=example,dc=com
base dc=example,dc=com

# The LDAP protocol version to use.
#ldap_version 3

# The DN to bind with for normal lookups.
binddn cn=XXXXXXX,cn=users,dc=example,dc=com
bindpw XXXXXXXXXX

# The DN used for password modifications by root.
#rootpwmoddn cn=admin,dc=example,dc=com

# SSL options
ssl on
tls_reqcert allow
tls_cacertfile /etc/ssl/certs/cacert.pem

# The search scope.
#scope sub
pagesize 1000
referrals off
idle_timelimit 800
filter passwd (&(objectClass=user)(objectClass=person)(!(objectClass=computer)))
map    passwd uid           cn
map    passwd uidNumber     objectSid:XXXXXXXXX
map    passwd gidNumber     objectSid:XXXXXXXXX
map    passwd homeDirectory "/home/$cn"
map    passwd gecos         displayName
map    passwd loginShell    "/bin/bash"
filter group (|(objectClass=group)(objectClass=person))
map    group gidNumber      objectSid:XXXXXXXXX

I replaced the objectsid with the domain SID after obtaining it with powershell from a domain machine.

Code:

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat ldap
group:          compat ldap
shadow:         compat ldap
gshadow:        files

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

Code:

#
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system.  The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.
#

# here are the per-package modules (the "Primary" block)
account [success=1 new_authtok_reqd=done default=ignore]        pam_unix.so
# here's the fallback if no module succeeds
account requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
account [success=ok new_authtok_reqd=done ignore=ignore user_unknown=ignore authinfo_unavail=ignore default=bad]        pam_ldap.so minimum_uid=1000
# end of pam-auth-update config

Code:

#
# The PAM configuration file for the Shadow `login' service
#

# Enforce a minimal delay in case of failure (in microseconds).
# (Replaces the `FAIL_DELAY' setting from login.defs)
# Note that other modules may require another minimal delay. (for example,
# to disable any delay, you should add the nodelay option to pam_unix)
auth       optional   pam_faildelay.so  delay=3000000

# Outputs an issue file prior to each login prompt (Replaces the
# ISSUE_FILE option from login.defs). Uncomment for use
# auth       required   pam_issue.so issue=/etc/issue

# Disallows root logins except on tty's listed in /etc/securetty
# (Replaces the `CONSOLE' setting from login.defs)
#
# With the default control of this module:
#   [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die]
# root will not be prompted for a password on insecure lines.
# if an invalid username is entered, a password is prompted (but login
# will eventually be rejected)
#
# You can change it to a "requisite" module if you think root may mis-type
# her login and should not be prompted for a password in that case. But
# this will leave the system as vulnerable to user enumeration attacks.
#
# You can change it to a "required" module if you think it permits to
# guess valid user names of your system (invalid user names are considered
# as possibly being root on insecure lines), but root passwords may be
# communicated over insecure lines.
auth [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die] pam_securetty.so

# Disallows other than root logins when /etc/nologin exists
# (Replaces the `NOLOGINS_FILE' option from login.defs)
auth       requisite  pam_nologin.so

# SELinux needs to be the first session rule. This ensures that any
# lingering context has been cleared. Without out this it is possible
# that a module could execute code in the wrong domain.
# When the module is present, "required" would be sufficient (When SELinux
# is disabled, this returns success.)
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close

# This module parses environment configuration file(s)
# and also allows you to use an extended config
# file /etc/security/pam_env.conf.
#
# parsing /etc/environment needs "readenv=1"
session       required   pam_env.so readenv=1
# locale variables are also kept into /etc/default/locale in etch
# reading this file *in addition to /etc/environment* does not hurt
session       required   pam_env.so readenv=1 envfile=/etc/default/locale

# Standard Un*x authentication.
@include common-auth

Code:

# PAM configuration for the Secure Shell service

# Standard Un*x authentication.
@include common-auth

# Disallow non-root logins when /etc/nologin exists.
account required pam_nologin.so

# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account required pam_access.so

# Standard Un*x authorization.
@include common-account

# SELinux needs to be the first session rule. This ensures that any
# lingering context has been cleared. Without this it is possible that a
# module could execute code in the wrong domain.
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close

# Set the loginuid process attribute.
session required pam_loginuid.so

# Create a new session keyring.
session optional pam_keyinit.so force revoke

# Standard Un*x session setup and teardown.
@include common-session

# Print the message of the day upon successful login.
# This includes a dynamically generated part from /run/motd.dynamic
# and a static (admin-editable) part from /etc/motd.
session optional pam_motd.so motd=/run/motd.dynamic
session optional pam_motd.so noupdate

# Print the status of the user's mailbox upon successful login.
session optional pam_mail.so standard noenv # [1]

# Set up user limits from /etc/security/limits.conf.
session required pam_limits.so

# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
session required pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
session required pam_env.so user_readenv=1 envfile=/etc/default/locale

# SELinux needs to intervene at login time to ensure that the process starts
# in the proper default security context. Only sessions which are intended
# to run in the user's context should be run after this.
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open

# Standard Un*x password updating.
@include common-password

account required pam_access.so debug

Code:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
auth    [success=2 default=ignore]      pam_unix.so nullok_secure
auth    [success=1 default=ignore]      pam_ldap.so minimum_uid=1000 use_first_pass
# here's the fallback if no module succeeds
auth    requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config

Code:

#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
session [default=1]                     pam_permit.so
# here's the fallback if no module succeeds
session requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required                        pam_permit.so
# The pam_umask module will set the umask according to the system default in
# /etc/login.defs and user settings, solving the problem of different
# umask settings with different shells, display managers, remote sessions etc.
# See "man pam_umask".
session optional                        pam_umask.so
# and here are more per-package modules (the "Additional" block)
session required        pam_unix.so
session [success=ok default=ignore]     pam_ldap.so minimum_uid=1000
session optional                        pam_mkhomedir.so
# end of pam-auth-update config
session required        pam_mkhomedir.so skel=/etc/skel umask=0022
~
~

Code:

#/etc/security/access.conf
+ : vagrant : ALL
+ : root : ALL
+ : Allow-AD : ALL
- : ALL : ALL

So now it's working. If anybody have tips to optimize or secure it feel free to share.

Thanks.

jorgerod · 03-01-2019, 10:08 AM

Quote:

Originally Posted by tyler2016

If you have control over the AD servers, there is a way to add posix attributes. I would go that route if you can instead of trying to proxy it. This article should point you in the right direction:

https://banck.net/2014/02/preparing-...ory-for-linux/

I wrote a guide covering Debian that might work for Ubuntu. Just make sure you create service account on the AD domain that can read the posix attributes of your users. Other than that, just plugin the correct information for your DCs. If the step where you run pam-auth-update doesn't work, you will have to look up how to do this on ubuntu. You pretty much just need to add pam_ldap.so to the relevant files in /etc/pam.d

https://tylersguides.com/guides/debi...uthentication/

Thanks for the guide tyler2016!

jorgerod · 03-01-2019, 10:10 AM

Quote:

Originally Posted by leroyz84

i have no experience with proxying to AD (why would you want to that anyway? aren't there other Solutions?)

Some things i would try:

cn=user,cn=users,dc=example,dc=com -> cn=user,cn=Users,dc=example,dc=com
or
cn=user,ou=Users,dc=example,dc=com
or
EXAMPLE\user
or EXAMPLE.COM\user

locally you are connecting without s?

turn on verbose or debug logging;

check the audit logging on your domain controller, maybe there is something that helps you in the right direction..

Missing some kerberos implementation / configuration perhaps?

AD = LDAP + Kerberos?

Since ad heavliy relies on DNS for srv records and sorts... are you using same DNS servers?

Thanks for the usefull tips leroyz84. Debug ended up to be my best friend.