samba - Feb 2017 - LDAP problem

Hello everyone,


I'm using Samba4 in my CentOS server, and it was just fine. I could always
use ldap commands like 'ldapsearch' and 'ldapadd' and I had no
problem.


But one day, I don't know why, I couldn't use more ldapsearch or
ldapadd. They return this:
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)



I'm using the same command as always, like:

ldapsearch -H "ldaps://devsamba.lucas.ufes.br:636" -w
'*******' -D
"cn=administrator,cn=users,dc=lucas,dc=ufes,dc=br" -x -b
"dc=lucas,dc=ufes,dc=br"


My /etc/openldap/ldap.conf is:


#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE   dc=example,dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never

TLS_REQCERT     never
TLS_CACERT      /usr/local/samba/private/tls/cert.pem



It worked until now...


I checked that samba-tools still works, but I need to use ldap commands too. Any
idea why is this happening to ldap?






Lucas

add -d1 to your command, see what ldapsearch complains about.

Em 03/02/2017 10:14, Lukz Ferris via samba escreveu:
> Hello everyone,
>
>
> I'm using Samba4 in my CentOS server, and it was just fine. I could
always use ldap commands like 'ldapsearch' and 'ldapadd' and I
had no problem.
>
>
> But one day, I don't know why, I couldn't use more ldapsearch or
ldapadd. They return this:
> ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
>
>
>
> I'm using the same command as always, like:
>
> ldapsearch -H "ldaps://devsamba.lucas.ufes.br:636" -w
'*******' -D
"cn=administrator,cn=users,dc=lucas,dc=ufes,dc=br" -x -b
"dc=lucas,dc=ufes,dc=br"
>
>
> My /etc/openldap/ldap.conf is:
>
>
> #
> # LDAP Defaults
> #
>
> # See ldap.conf(5) for details
> # This file should be world readable but not world writable.
>
> #BASE   dc=example,dc=com
> #URI    ldap://ldap.example.com ldap://ldap-master.example.com:666
>
> #SIZELIMIT      12
> #TIMELIMIT      15
> #DEREF          never
>
> TLS_REQCERT     never
> TLS_CACERT      /usr/local/samba/private/tls/cert.pem
>
>
>
> It worked until now...
>
>
> I checked that samba-tools still works, but I need to use ldap commands
too. Any idea why is this happening to ldap?
>
>
>
>
>
>
> Lucas
-- 

	
Vinicius Silva
SOC


BRA: + 55 51 2117.1000 | 55 11 5521.2021
USA: + 1 888 259.5801
vbs at e-trust.com.br
skype: vinicius.bones.silva

	







	Smiley face

www.e-trust.com.br <http://www.e-trust.com.br/>


Esta mensagem pode conter informações confidenciais ou privilegiadas. Se você
recebeu esta
mensagem por engano, você não deve usar, copiar, divulgar ou tomar qualquer
atitude com
base nestas informações. Solicitamos que você apague a mensagem imediatamente e
avise a
E-TRUST, enviando um e-mail para suporte at e-trust.com.br. Opiniões, conclusões
ou
informações contidas nesta mensagem não necessariamente refletem a posição
oficial da
E-TRUST. Caso assinada digitalmente, a autenticidade desta mensagem pode ser
confirmada
pela Autoridade Certificadora Privada E-TRUST, disponível em www.e-trust.com.br.

This message may contain privileged and confidential information for the use of
the
intended recipients only. If you are not an intended recipient then you should
not
disseminate, copy, or take any action based on its contents. If you have
received this
message in error then please notify E-TRUST by sending an e-mail message to 
suporte at e-trust.com.br immediately. Views and opinions expressed in this
message do not
necessarily reflect the position of E-TRUST. If this message is digitally
signed, its
authenticity can be confirmed by E-TRUST Private Certificate Authority,
available at
www.e-trust.com.br.

On 03/02/2017 12:14, Lukz Ferris wrote:
> But one day, I don't know why, I couldn't use more ldapsearch or
ldapadd. They return this:
> ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
>
>
>
> I'm using the same command as always, like:
>
> ldapsearch -H "ldaps://devsamba.lucas.ufes.br:636" -w
'*******' -D "cn­ministrator,cn=users,dc=lucas,dc=ufes,dc=br"
-x -b "dc=lucas,dc=ufes,dc=br"
This error suggests a problem with your certificate. If it used to work 
previously, then check it hasn't expired.

     openssl s_client -connect devsamba.lucas.ufes.br:636

copy-paste the certificate into a pem file, including begin/end lines

     openssl x509 -in mycert.pem -noout -enddate

And check your root CA cert hasn't expired:

     openssl x509 -in /usr/local/samba/private/tls/cert.pem -noout -enddate