samba - Jun 2014 - PHP ldap_start_tls

I have samba4 4.1.9 on ubuntu 14.04 and I am trying to connect with
phpldapadmin.

Problem seems to be with the start tls and that PHP ldap_start_tls doesn't
like self signed certificates that are not in the local ca.

The samba certs are in /var/lib/samba/private/tls.

Does php ldap_start_tls use /etc/ldap/ldap.conf ?

# TLS certificates (needed for GnuTLS)
TLS_CACERT	/etc/ssl/certs/ca-certificates.crt

Should that line change or BARK! am I doing it again and should find another
tree to howl at :)

Apols but struggling.

Stuart


 
 
-----Original message-----
> From:samba-request at lists.samba.org <samba-request at
lists.samba.org>
> Sent: Friday 27th June 2014 18:23
> To: samba at lists.samba.org
> Subject: samba Digest, Vol 138, Issue 36
> 
> Send samba mailing list submissions to
> 	samba at lists.samba.org
> 
> To subscribe or unsubscribe via the World Wide Web, visit
> 	https://lists.samba.org/mailman/listinfo/samba
> or, via email, send a message with subject or body 'help' to
> 	samba-request at lists.samba.org
> 
> You can reach the person managing the list at
> 	samba-owner at lists.samba.org
> 
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of samba digest..."
> Today's Topics:
> 
>    1. Re: Join AD fails DNS update (Rowland Penny)
>    2. Re: Ms-AD with samba AD (David Bear)
>    3. Re: Join AD fails DNS update (Lars Hanke)
>    4. samba-tool issue (David Bear)
>    5. Re: File size is sometimes 0 after saving (Jeremy Allison)
>    6. Re: Join AD fails DNS update (Rowland Penny)
>    7. Re: samba-tool issue (Marc Muehlfeld)
>    8. Re: Upgrade From 4.0.16 To 4.0.17+ Breaks (Andrew Bartlett)
>    9. Re: about samba failover (Chan Min Wai)
>   10. Re: Upgrade From 4.0.16 To 4.0.17+ Breaks (David Minard)
>   11. Samba 3.6.22 on AIX 7.1 with Windows AD (Kerberos and
>       winbind) (Philippe Arcudi)
>   12. CentOS6.5 Samba 3.6.9 Windows8.1 login possible after 15
>       minutes after logoff (Jan Kus? OrangeFactory)
>   13. Re: Samba 3.6.22 on AIX 7.1 with Windows AD (Kerberos and
>       winbind) (Sven Schwedas)
>   14. Re: Samba 3.6.22 on AIX 7.1 with Windows AD (Kerberos and
>       winbind) (steve)
>   15. Re: posix gid mapping of built-in groups (Henrik Langos)
>   16. Re: Unable to join a DC to a Site that doesn't already have a
>       DC in that subnet (Chris Alavoine)
>   17. Re: posix gid mapping of built-in groups (Sven Schwedas)
>   18. Re: Unable to join a DC to a Site that doesn't already have a
>       DC in that subnet (Davor Vusir)
>   19. Re: posix gid mapping of built-in groups (L.P.H. van Belle)
>   20. Missing features, RLY?!?   & readme1st again (Klaus Hartnegg)
>   21. Re: Join AD fails DNS update (Lars Hanke)
>   22. Re: Missing features, RLY?!?   & readme1st again
>       (mourik jan heupink - merit)
>   23. Re: Missing features, RLY?!?   & readme1st again (Sven Schwedas)
>   24. Win7 registry change only non-AD (Klaus Hartnegg)
>   25. Permission issue writing to demo share (Lars Hanke)
>   26. Re: Permission issue writing to demo share (steve)
>   27. Re: Win7 registry change only non-AD (Sven Schwedas)
>   28. Re: Permission issue writing to demo share (Marcel de Reuver)
>   29. Re: Join AD fails DNS update (L.P.H. van Belle)
>   30. Re: Missing features, RLY?!?   & readme1st again (Allen Chen)
>   31. Re: Permission issue writing to demo share (Lars Hanke)
>   32. Re: Permission issue writing to demo share (steve)
>   33. Re: Permission issue writing to demo share (Rowland Penny)
>   34. Re: Permission issue writing to demo share (Rowland Penny)
>   35. Re: Permission issue writing to demo share (steve)
>   36. Re: Permission issue writing to demo share (Rowland Penny)
>   37. Re: Permission issue writing to demo share (Lars Hanke)
>   38. Re: Permission issue writing to demo share (Rowland Penny)
>   39. Re: Permission issue writing to demo share (steve)
>   40. Re: Permission issue writing to demo share (Lars Hanke)
>   41. Re: Permission issue writing to demo share (Lars Hanke)
>   42. Re: Permission issue writing to demo share (Lars Hanke)
>   43. Re: Permission issue writing to demo share (Rowland Penny)
> _______________________________________________
> samba mailing list
> samba at lists.samba.org
> https://lists.samba.org/mailman/listinfo/samba
>

Hi Stuart,

just guessing, since you do not provide proper logs and configs. But I 
think that your client (phpldapadmin) doesn't recognize the self-signed 
certificate - which actually is what it is expected to do.

So you have two options:

1) do without TLS - on a trusted network this doesn't hurt and doesn't 
lull you into imagined security from an accept anything configuration.

2) use openssl to set up a primitive CA, use one of those certs for 
samba and make known the CA cert to phpldapadmin. A little more 
complicated, but meets the idea of PKI security.

Regards,
  - lars.