Debian11 - zcore cannot access ldap server

ladas

Hi everybody,
I connect new installed server into customer samba4 addc controller. When I set users email address, the users are found and can be imported, but they cannot log-in in grommunio-web. I searched log files and fount in mail.err this line:
zcore[3279]: ldap_adaptor: search with base "dc=mydomain,dc=deu" filter "mail=username@domain.de": Can't contact LDAP server

I tried to search forum, but did not find anything which work for me. Can someone help please, where could be problem?

ladas

Hi everybody,
I can see ldap problem it is not so important. For me it is, so I tried to push it forward a bit. I downloaded apliance image and fastly install new official grommunio server. I set company, domains and connect it into the same addc samba controller. I must laugh now because it seems it is really broken because it did not work too. Ldap was connected, but I cannot import users: list index out of range 🙂 I tried to add echo "TLS_REQCERT allow" >> /etc/openldap/ldap.conf by @WalterH advice but did not help.
The last what I tried was: grommunio-admin ldap downsync user@mydomain.de AND user was imported! Super, I have a user for tests. Went to user web GUI and successfully login. At the end not all things are broken, maybe.

OK. Why I write this story. I just would like to try to test ldap with the same parameters at official install distro and my debian install. It seems my ldap configuration seems to be good, because at the end user was authorized at official distro.
BUT what is wrong at debian install? I ask again: Should I install some extra ldap packages to start to work or there is some mistake in grommunio packages for debian?
As I asked before, at debian there is NOT /etc/openldap/ directory at all, so is it possible is there something missing? Thank you very much for any answer.

ladas

Small update:
I noticed there are new packages in repo, so I update now both appliance and debian server. It is funny, at appliance server I can import users now properly, but user cannot login from web GUI with the same error:
ldap_adaptor: search with base "dc=mydomain,dc=deu" filter "mail=user.name@mydomain.de": Can't contact LDAP server
Auth rejected for "user.name@mydomain.de": Authentication rejected 🙁

And now what?

WalterH

Try to capture the LDAP packets with tcpdump and analyze the trace.

ladas

Hi WalterH
I installed tcpdump at my debian server and made some tests. I discovered what I suspected at the beginning. But one next each other.

I start tcp dump to monitor host (my addc samba server) comunication. When I sync users at ldap admin gui menu, tcp dump say:

18:51:28.059776 IP myhostname.mydomain.de.58569 > localhost.ldap: Flags [P.], seq 2307:2447, ack 205149, win 1970, options [nop,nop,TS val 1542513632 ecr 1365198223], length 140
18:51:28.061791 IP localhost.ldap > myhostname.mydomain.de.58569: Flags [P.], seq 205149:206490, ack 2447, win 501, options [nop,nop,TS val 1365217714 ecr 1542513632], length 1341
18:51:28.061825 IP myhostname.mydomain.de.58569 > localhost.ldap: Flags [.], ack 206490, win 1992, options [nop,nop,TS val 1542513634 ecr 1365217714], length 0

When I try log in as a user user.name@mydomain.de in user web gui I get answer at web gui: Logon failed. Please verify your credentials and try again.
tcpdump did not detect any traffic. So it seems server do not try to contact addc server to check for login credentials.
I test the same at grommunio appliance installed yesterday espetialy for ldap tests to know how it should work and I have the same experience. No comunication to addc server when user try to log in. Does it means my ldap configuration is wrong? I thought when I can communicate with addc server by grommunio-admin ldap .... and get all information without any error the configuration should be correct. Or am I wrong?

crpb

Hey Ladas,

grommunio-admin ldap returns something like "Successfully connected to ..."
You can actually use the command with "downsync" to create the Users
The actual "Login" in the "Web-Mail" doesn't work?!
Does https://your.host/dav also not work?
What about gromox-dscli?
What is the content of /etc/gromox/authmgr.cfg?
- "auth_backend_selection=externid" ?

ladas

Hi crpb
ad. 1 gommunio-admin ldap ... works. All of them without any error. Even in web-admin gui I can import / synchronize users

ad. 2 yes, I imported users and I can see them in user menu

ad. 3 yes. at grommunio-web I get message: Logon failed. Please verify your credentials and try again. At /var/log/mail.err and in admin-web gui in logging - gromox zcore is error:

zcore[3279]: ldap_adaptor: search with base "dc=mydomain,dc=deu" filter "mail=username@domain.de": Can't contact LDAP server
Auth rejected for "user.name@mydomain.de": Authentication rejected

ad. 4.1 at my debian installation I get error: Error 500 - Internal Server Error. I look at /var/log/grommunio/nginx-dav-error.log and this is last line:

2023/04/06 15:23:58 [error] 987#987: *75 FastCGI sent in stderr: "PHP message: PHP Warning:  require(/usr/share/grommunio-dav/vendor/composer/../../config.php): failed to open stream: No su
ch file or directory in /usr/share/grommunio-dav/vendor/composer/autoload_real.php on line 78PHP message: PHP Fatal error:  require(): Failed opening required '/usr/share/grommunio-dav/vend
or/composer/../../config.php' (include_path='.:/usr/share/php') in /usr/share/grommunio-dav/vendor/composer/autoload_real.php on line 78" while reading response header from upstream, client
: 10.0.0.251, server: _, request: "GET /dav HTTP/2.0", upstream: "fastcgi://unix:/run/php/php-grommunio-dav-fpm.sock:", host: "webmail.mydomain.de"

I checked php-grommunio-dav-fpm.sock at /run/php/ and it exist. I look at /usr/share/grommunio-dav/vendor/composer/../../config.php and config.php is really missing at this place.

ad 4.2 at grommunio appliance I get login, when I fill it out, login appears again and in gromox zcore log is the same ldap error descibed above: Can't contact LDAP server

ad. 5 autodiscover works I think. For local users (non domain one) outlook and android device connect in first kick.

ad. 6 yes, exactly the same.

ladas

Hi crpb
I look at /usr/share/grommunio-dav at my appliance installation and discovered there are two link to /etc/grommunio/dav/config.php and /etc/grommunio/dav/log4php.xml
This two links at debian installation are missing. In advance at debian the config.php has name grommunio-dav.conf.php
When I linked them into /usr/share/grommunio-dav as a config.php and log4php.xml I can get login at https://your.host/dav
Unfortunately after fill and login I get the same error: : Can't contact LDAP server

Can you please open ticket to be repaired at debian install packages? Or should it be done by debian installation script?

crpb

ladas

On those missing Links.

I looked at the .rpm

grommunio-2022121-iso:/usr/share/grommunio-setup # rpm -q --dump grommunio-dav  |grep config.php
/etc/grommunio-dav/config.php 688 1678902490 4b87c7ad35ef9b7e3f2e92d57fc8e88af5527380f9a1b1226d1fb3ff2434c148 0100644 root root 1 0 0 X
/usr/share/grommunio-dav/config.php 29 1679698865 0000000000000000000000000000000000000000000000000000000000000000 0120777 root root 0 0 0 /etc/grommunio-dav/config.php

Here you can see that the Link in the third line for config.php

And on the Debian-Host

# dpkg -e grommunio-dav_1.2.3.9ad798e-1_all.deb ./
# ls -1
conffiles
control
grommunio-dav_1.2.3.9ad798e-1_all.deb
md5sums
postinst
postrm
# cat postinst
#!/bin/sh
# postinst script for grommunio-dav
#
# see: dh_installdeb(1)

set -e

# Use debconf
. /usr/share/debconf/confmodule

set_perms() {
        USER="$1"
        GROUP="$2"
        MODE="$3"
        FILE="$4"
        if ! dpkg-statoverride --list "$FILE" > /dev/null 2>&1; then
            chown -h "$USER:$GROUP" "$FILE"
            chmod $MODE "$FILE"
        fi
}

case "$1" in
    configure|reconfigure)
        # Set permissions
        if [ -x /usr/bin/systemd-sysusers ]; then
                /usr/bin/systemd-sysusers grommunio-dav.conf
        else
                getent group grodav >/dev/null || addgroup --system grodav
                getent passwd grodav >/dev/null || \
                        adduser --system grodav --home / --no-create-home --disabled-password --ingroup grodav
        fi

        set_perms grodav root 0770 /var/lib/grommunio-dav
        set_perms root root 750 /var/log/grommunio
        set_perms grodav root 0770 /var/log/grommunio-dav

        systemctl list-units --plain --no-legend --quiet "php*fpm.service" | \
        awk '{print$1}' | xargs /usr/bin/systemctl try-restart
        if [ -f /usr/share/grommunio-common/nginx/locations.d/grommunio-dav.conf ]; then
            /usr/bin/systemctl reload nginx.service
        fi
        ;;

    abort-upgrade|abort-remove|abort-deconfigure)
        ;;

    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
        ;;
esac



exit 0

This would be the preferred Option:
https://manpages.debian.org/bullseye/debhelper/dh_link.1.en.html

I will add this Post to the currently open Ticket 😛

crpb

@ladas
Just dump the config and remove the "sensible-data".

grommunio-admin mconf dump ldap

And take a look here
~~https://community.grommunio.com/d/120-solved-suche-nach-emails-erzeugt-http-500-fehlermeldung/33~~
Wrong one.. i basically meant to link this. Please try if that even works now with the Account you try to log-in for the Authentication-Data

ldapsearch -h ldap.example.com -x -D ldap@example.com -w password -b "dc=example,dc=com" '(&(objectCategory=person)(mail=*)(objectClass=user))' mail

There is also the possibility that you account is blocked because of "whateverhappenedinthiswholeprocess" 😛

ladas

Hi crpb
thank you for answer at this time. It is very kind of you. Here is my ldap dump:
ldap_disabled=False
ldap_host=ip.address.my.addc.samba.server
ldap_bind_user=cn=administrator,cn=users,dc=mydomain,dc=deu
ldap_bind_pass=DomainAdministratorPassword
ldap_start_tls=True
ldap_search_base=dc=mydomain,dc=deu
ldap_object_id=objectGUID
ldap_mail_attr=mail
ldap_user_displayname=displayName
ldap_user_filter=(objectClass=user)
ldap_contact_filter=objectclass=contact
ldap_user_search_attrs=mail
ldap_user_search_attrs=givenName
ldap_user_search_attrs=cn
ldap_user_search_attrs=sn
ldap_user_search_attrs=name
ldap_user_search_attrs=displayName
ldap_user_search_attrs=uid
ldap_user_templates=common
ldap_user_templates=ActiveDirectory
ldap_user_aliases=proxyAddresses

ladas

Hi crpb
second part ldapsearch. I must install ldapscripts 🙂 Here it is:
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

why sasl is in the answer?

crpb

ladas
ldap_bind_user=cn=administrator,cn=users,dc=mydomain,dc=deu
ldap_bind_pass=DomainAdministratorPassword

Create a simple Guest-Account for that!!!

You only need Read-Access!

crpb

ladas ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

apt install nmap -y
nmap -Pn -p ldap,ldapssl ip.address.my.addc.samba.server

ladas why sasl is in the answer?

Because this is nowadays the "default" i think.
You can also use -H ldap://hostname or -H ldaps://hostname

https://docs.ldap.com/ldap-sdk/docs/tool-usages/ldapsearch.html
Scroll down, there are Examples! 😛

ladas

Hi crpb
here is an nmap:
Starting Nmap 7.80 ( https://nmap.org ) at 2023-04-06 20:56 CEST
Nmap scan report for localhost (10.0.0.247)
Host is up (0.00021s latency).

PORT STATE SERVICE
389/tcp open ldap
636/tcp open ldapssl
MAC Address: B6:85:5E:7E:3F:AA (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 0.20 seconds

ladas

Hi crpb
when I use:
ldapsearch -H ldap://ip.address.addc.samba -x -D ldap@example.com -w password -b "dc=example,dc=com" '(&(objectCategory=person)(mail=*)(objectClass=user))' mail

I get correct answer with user list and other things!

crpb

ladas

For now change the following options in /etc/gromox/ldap_adaptor.cfg

ldap_host=ldap://your.domain.name   # or the IP if it is only one server anyway
ldap_start_tls=False

And maybe reboot. Some service-restarts are usually enough but this system doesn't work currently anyway 😛

EDIT: Odd thing is that the downsync worked before..

ladas

Hi crpb
IT WORKS! Thank you very much for your patience. I spend lot of time with it and at the end I made wrong settings. At the beginning I use ldap://ip.address:389 but it did not work and I found here in forum, the address is enough. Hmm, it seems is not. So stupid mistake.
Next time, Thank you very much for your help.

P.S. the missing links in grommunio-dav is error in grommunio package or should they be created by installation script? (I linked them into /usr/share/grommunio-dav as a config.php and log4php.xml)

and have a nice Easters 🙂

ladas

crpb
Thank you.