1 (edited by lug 2023-05-25 22:37:47)

Topic: openldap stopped working after switching to letsencrypt

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.6.3
- Deployed with iRedMail Easy or the downloadable installer? installer
- Linux/BSD distribution name and version: Ubuntu 20.04
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):  LDAP
- Web server (Apache or Nginx): nginx
- Manage mail accounts with iRedAdmin-Pro? yes
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

hi,

i just upgraded to iredmail 1.6.3 and iredadmin-pro-5.5-ldap.
after the upgrade i cannot login as the global postmaster account, i get the message "Username or password is incorrect."

The password is automatically filled by my password manager, so a typo can be excluded. But I also double checked it. I just logged in, to get the download link for the iredadmin-pro installer, so the login worked before the upgrade.

https://i.imgur.com/5o5A2V0.png

Edit:

Issue: slapd service won't start, but I cannot get any log info so far.

Edit 2:
Tracking down the ldap service so far, I see it uses the /etc/ssl/certs/iRedMail.crt cert, I recently switched over to letsencrypt, before that I used a bought certificate.
But it looks right:

lrwxrwxrwx 1 root root 49 Dez 20 10:55 /etc/ssl/certs/iRedMail.crt -> /etc/letsencrypt/live/my.domain.tld/fullchain.pem
lrwxrwxrwx 1 root root 47 Dez 20 10:55 /etc/ssl/private/iRedMail.key -> /etc/letsencrypt/live/my.domain.tld/privkey.pem

/etc/ldap/slapd.conf

[...]
TLSCACertificateFile /etc/ssl/certs/iRedMail.crt
TLSCertificateFile /etc/ssl/certs/iRedMail.crt
TLSCertificateKeyFile /etc/ssl/private/iRedMail.key
[...]

Edit 3:
May 25 16:27:14 mail slapd[4330]: main: TLS init def ctx failed: -1

Edit 4:
As my slapd service runs without tls (port 389) I commented out the TLS*File lines in slapd.conf, then it started just fine.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: openldap stopped working after switching to letsencrypt

What's the permission of directory /etc/letsencrypt/live/? Does slapd daemon user have privilege to access it?

3

Re: openldap stopped working after switching to letsencrypt

/etc/letsencrypt

drwxr-xr-x   9 root root       4096 Mai 26 05:42 letsencrypt

/etc/letsencrypt/live

drwxr-xr-x   3 root root  4096 Dez 20 10:47 live

/etc/letsencrypt/live/my.domain.tld

drwxr-xr-x 2 root root 4096 Apr 19 23:38 my.domain.tld

the files

lrwxrwxrwx 1 root root   37 Apr 19 23:38 cert.pem -> ../../archive/my.domain.tld/cert4.pem
lrwxrwxrwx 1 root root   38 Apr 19 23:38 chain.pem -> ../../archive/my.domain.tld/chain4.pem
lrwxrwxrwx 1 root root   42 Apr 19 23:38 fullchain.pem -> ../../archive/my.domain.tld/fullchain4.pem
lrwxrwxrwx 1 root root   40 Apr 19 23:38 privkey.pem -> ../../archive/my.domain.tld/privkey4.pem

4

Re: openldap stopped working after switching to letsencrypt

If OpenLDAP is listening on localhost and not accessible from external network, better disable TLS/SSL in openldap.

Try to start openldap daemon with command below:

slapd -d 256 -u openldap -g openldap -f /etc/ldap/slapd.conf

I expect it logs detailed error message related to ssl cert.

5

Re: openldap stopped working after switching to letsencrypt

lug wrote:

Edit 4:
As my slapd service runs without tls (port 389) I commented out the TLS*File lines in slapd.conf, then it started just fine.

Already did that smile
It's running on localhost.

6

Re: openldap stopped working after switching to letsencrypt

- ok, so is issue "solved" now?
- Or you still want to enable ssl cert in slapd? If yes, please run the command mentioned in my previous reply, i need detailed openldap log for troubleshooting. But it looks like cert/key file permission issue (slapd daemon user doesn't have permission to enter directory and read cert/key files).

7

Re: openldap stopped working after switching to letsencrypt

Solved smile