Debian11 - zcore cannot access ldap server

ladas · 2023-04-03T14:20:24+00:00

Hi everybody, I connect new installed server into customer samba4 addc controller. When I set users email address, the users are found and can be imported, b...

ladas

Hi crpb
I look at /usr/share/grommunio-dav at my appliance installation and discovered there are two link to /etc/grommunio/dav/config.php and /etc/grommunio/dav/log4php.xml
This two links at debian installation are missing. In advance at debian the config.php has name grommunio-dav.conf.php
When I linked them into /usr/share/grommunio-dav as a config.php and log4php.xml I can get login at https://your.host/dav
Unfortunately after fill and login I get the same error: : Can't contact LDAP server

Can you please open ticket to be repaired at debian install packages? Or should it be done by debian installation script?

crpb

ladas

On those missing Links.

I looked at the .rpm

grommunio-2022121-iso:/usr/share/grommunio-setup # rpm -q --dump grommunio-dav  |grep config.php
/etc/grommunio-dav/config.php 688 1678902490 4b87c7ad35ef9b7e3f2e92d57fc8e88af5527380f9a1b1226d1fb3ff2434c148 0100644 root root 1 0 0 X
/usr/share/grommunio-dav/config.php 29 1679698865 0000000000000000000000000000000000000000000000000000000000000000 0120777 root root 0 0 0 /etc/grommunio-dav/config.php

Here you can see that the Link in the third line for config.php

And on the Debian-Host

# dpkg -e grommunio-dav_1.2.3.9ad798e-1_all.deb ./
# ls -1
conffiles
control
grommunio-dav_1.2.3.9ad798e-1_all.deb
md5sums
postinst
postrm
# cat postinst
#!/bin/sh
# postinst script for grommunio-dav
#
# see: dh_installdeb(1)

set -e

# Use debconf
. /usr/share/debconf/confmodule

set_perms() {
        USER="$1"
        GROUP="$2"
        MODE="$3"
        FILE="$4"
        if ! dpkg-statoverride --list "$FILE" > /dev/null 2>&1; then
            chown -h "$USER:$GROUP" "$FILE"
            chmod $MODE "$FILE"
        fi
}

case "$1" in
    configure|reconfigure)
        # Set permissions
        if [ -x /usr/bin/systemd-sysusers ]; then
                /usr/bin/systemd-sysusers grommunio-dav.conf
        else
                getent group grodav >/dev/null || addgroup --system grodav
                getent passwd grodav >/dev/null || \
                        adduser --system grodav --home / --no-create-home --disabled-password --ingroup grodav
        fi

        set_perms grodav root 0770 /var/lib/grommunio-dav
        set_perms root root 750 /var/log/grommunio
        set_perms grodav root 0770 /var/log/grommunio-dav

        systemctl list-units --plain --no-legend --quiet "php*fpm.service" | \
        awk '{print$1}' | xargs /usr/bin/systemctl try-restart
        if [ -f /usr/share/grommunio-common/nginx/locations.d/grommunio-dav.conf ]; then
            /usr/bin/systemctl reload nginx.service
        fi
        ;;

    abort-upgrade|abort-remove|abort-deconfigure)
        ;;

    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
        ;;
esac



exit 0

This would be the preferred Option:
https://manpages.debian.org/bullseye/debhelper/dh_link.1.en.html

I will add this Post to the currently open Ticket 😛

ladas

Hi WalterH
I installed tcpdump at my debian server and made some tests. I discovered what I suspected at the beginning. But one next each other.

I start tcp dump to monitor host (my addc samba server) comunication. When I sync users at ldap admin gui menu, tcp dump say:

18:51:28.059776 IP myhostname.mydomain.de.58569 > localhost.ldap: Flags [P.], seq 2307:2447, ack 205149, win 1970, options [nop,nop,TS val 1542513632 ecr 1365198223], length 140
18:51:28.061791 IP localhost.ldap > myhostname.mydomain.de.58569: Flags [P.], seq 205149:206490, ack 2447, win 501, options [nop,nop,TS val 1365217714 ecr 1542513632], length 1341
18:51:28.061825 IP myhostname.mydomain.de.58569 > localhost.ldap: Flags [.], ack 206490, win 1992, options [nop,nop,TS val 1542513634 ecr 1365217714], length 0

When I try log in as a user user.name@mydomain.de in user web gui I get answer at web gui: Logon failed. Please verify your credentials and try again.
tcpdump did not detect any traffic. So it seems server do not try to contact addc server to check for login credentials.
I test the same at grommunio appliance installed yesterday espetialy for ldap tests to know how it should work and I have the same experience. No comunication to addc server when user try to log in. Does it means my ldap configuration is wrong? I thought when I can communicate with addc server by grommunio-admin ldap .... and get all information without any error the configuration should be correct. Or am I wrong?

crpb

@ladas
Just dump the config and remove the "sensible-data".

grommunio-admin mconf dump ldap

And take a look here
~~https://community.grommunio.com/d/120-solved-suche-nach-emails-erzeugt-http-500-fehlermeldung/33~~
Wrong one.. i basically meant to link this. Please try if that even works now with the Account you try to log-in for the Authentication-Data

ldapsearch -h ldap.example.com -x -D ldap@example.com -w password -b "dc=example,dc=com" '(&(objectCategory=person)(mail=*)(objectClass=user))' mail

There is also the possibility that you account is blocked because of "whateverhappenedinthiswholeprocess" 😛

ladas

Hi crpb
thank you for answer at this time. It is very kind of you. Here is my ldap dump:
ldap_disabled=False
ldap_host=ip.address.my.addc.samba.server
ldap_bind_user=cn=administrator,cn=users,dc=mydomain,dc=deu
ldap_bind_pass=DomainAdministratorPassword
ldap_start_tls=True
ldap_search_base=dc=mydomain,dc=deu
ldap_object_id=objectGUID
ldap_mail_attr=mail
ldap_user_displayname=displayName
ldap_user_filter=(objectClass=user)
ldap_contact_filter=objectclass=contact
ldap_user_search_attrs=mail
ldap_user_search_attrs=givenName
ldap_user_search_attrs=cn
ldap_user_search_attrs=sn
ldap_user_search_attrs=name
ldap_user_search_attrs=displayName
ldap_user_search_attrs=uid
ldap_user_templates=common
ldap_user_templates=ActiveDirectory
ldap_user_aliases=proxyAddresses

ladas

Hi crpb
second part ldapsearch. I must install ldapscripts 🙂 Here it is:
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

why sasl is in the answer?

crpb

ladas
ldap_bind_user=cn=administrator,cn=users,dc=mydomain,dc=deu
ldap_bind_pass=DomainAdministratorPassword

Create a simple Guest-Account for that!!!

You only need Read-Access!

crpb

ladas ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

apt install nmap -y
nmap -Pn -p ldap,ldapssl ip.address.my.addc.samba.server

ladas why sasl is in the answer?

Because this is nowadays the "default" i think.
You can also use -H ldap://hostname or -H ldaps://hostname

https://docs.ldap.com/ldap-sdk/docs/tool-usages/ldapsearch.html
Scroll down, there are Examples! 😛

ladas

Hi crpb
here is an nmap:
Starting Nmap 7.80 ( https://nmap.org ) at 2023-04-06 20:56 CEST
Nmap scan report for localhost (10.0.0.247)
Host is up (0.00021s latency).

PORT STATE SERVICE
389/tcp open ldap
636/tcp open ldapssl
MAC Address: B6:85:5E:7E:3F:AA (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 0.20 seconds

ladas

Hi crpb
when I use:
ldapsearch -H ldap://ip.address.addc.samba -x -D ldap@example.com -w password -b "dc=example,dc=com" '(&(objectCategory=person)(mail=*)(objectClass=user))' mail

I get correct answer with user list and other things!

crpb

ladas

For now change the following options in /etc/gromox/ldap_adaptor.cfg

ldap_host=ldap://your.domain.name   # or the IP if it is only one server anyway
ldap_start_tls=False

And maybe reboot. Some service-restarts are usually enough but this system doesn't work currently anyway 😛

EDIT: Odd thing is that the downsync worked before..

ladas

Hi crpb
IT WORKS! Thank you very much for your patience. I spend lot of time with it and at the end I made wrong settings. At the beginning I use ldap://ip.address:389 but it did not work and I found here in forum, the address is enough. Hmm, it seems is not. So stupid mistake.
Next time, Thank you very much for your help.

P.S. the missing links in grommunio-dav is error in grommunio package or should they be created by installation script? (I linked them into /usr/share/grommunio-dav as a config.php and log4php.xml)

and have a nice Easters 🙂

ladas

crpb
Thank you.