1

I've been trying to get LDAP working and set up for a few days now. The real head scratcher is that everything went fine until I got to the point of setting up TLS. I was using this guide from the official Ubuntu documentation site.

Doing this produced a really high number of errors that resulted in slapd not being able to restart.

Most of the errors had to do with apparmor not allowing permissions to parts of the computer, but one error in particular kept coming back around.

TLS init def ctx failed: -1

Completely stumped!

Improve this question

2 Answers 2

Reset to default
1

The answer turned out to be that the instructions given in the guide I was following did not produce a usable TLS certificate. I tested this by trying to use the generated certificate on other services (dovecot and postfix) which made them fail too.

I ended up using this guide, also from the official Ubuntu documentation to configure a self-signed CA (as suggested in the OpenLDAP documentation). The keys/certs this creates work perfectly and I'm even able to use the same cert/key for all of my TLS/SSL enabled services. Since this is for internal use, they are all self signed but gives me the option to make more easily.

The apparmor problem was very strange as well. I was getting a lot of errors to do with p11-kit and pkcs11. Doing some research I found that these seem to be tools ralted to certificates. I added the following lines to my /etc/apparmor.d/local/usr.sbin.slapd file.

/usr/share/p11-kit/modules/ r,
/usr/share/p11-kit/modules/* r,
/usr/lib/x86_64-linux-gnu/pkcs11/ m,
/usr/lib/x86_64-linux-gnu/pkcs11/* m,

Now the sldap server starts without a problem with TLS ready for use.

I hope this helps someone.

Improve this answer
1

I just encountered the same error, but ended up fixing it by ensuring that slapd had read permission on the private key file used for TLS

sudo usermod -a -G ssl-cert openldap

I messed around with the apparmor stuff mentioned by the OP in his answer for a while, but even after getting all the apparmor errors to go away, slapd wasn't starting.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .