LDAP authentication with non-anonymous bind

[hrhansen]

Hi Proxmoxers.

I have a small feature request: Our LDAP server requires authentication to do _anything_. Adding support for this to PVE/Auth/LDAP.pm is just a few lines of code (see patch), but I couldn't find where to add this to the web GUI. Where would I do that? And what is the procedure to submit patches?

Thanks

 

[tom]

See http://pve.proxmox.com/wiki/Developer_Documentation

 

[kokoticek]

Did anything ever happen with this patch? Was this ever added to ProxmoxVE?
I'd really like to see this as well.

 

[Fleg]

I need it too !

 

[swartz]

Just noticed this still isn't in Proxmox v3.4.
Any reason why this hasn't been added?

Running an LDAP server with anonymous binds is a security issue in my book.

 

[fireon]

With more security, it is a good feature.

 

[plcollard]

I applied the patch to the file /usr/share/perl5/PVE/Auth/LDAP.pm then restart pveproxy but the authentification is not working.

The bind_dn and the bind_pw have been added in /etc/pve/domains.cfg. I added the user in Proxmox with a administrator role. Anything else missing ?

I receive a Login failed message when I try. I turned on debugging on my LDAP server but I don't see the request from the PVE server.

A simple ldapsearch is working from the same server so I think the authentification is not working at all.

Anybody can help ?

Thanks

 

[plcollard]

Fixed it: a simple reboot of the server and now it works!

 

[aus]

Hi!

I could use it too. Any news on submitting this to git?

What services do I need to restart if I apply this patch manually? I restarted only pveproxy, but this did not help.
I edited /etc/pve/domains.cfg file, added bind_dn and bind_pw.

 

[t.lamprecht]

If you are able to manually patch it for your system your probably familiar with basic development skills.

As you have ways to test and verify it (contrary to me atm.), it would be nice if you could sent it to out developer list, so it get's it way to the git repos.

look at http://pve.proxmox.com/wiki/Developer_Documentation for help.

btw. the code is in the pve-access-control package.

restart pve-cluster and pve manager if possible.

 

[aus]

Hi!

I can confirm that the bind patch is working.

But getting authentication from LDAP requires node reboot. I tried restarting three services, but it did not help.

service pve-cluster restart && service pve-manager restart && service pveproxy restart

After a reboot, Proxmox binded LDAP authentication is working properly.

So, what service holds LDAP.pm file in memory? Can I restart it without restarting all KVMs and nodes one by one?

 

[aus]

Pvedaemon restart helps to re-read LDAP.pm file

service pvedaemon restart

And it does not affect VMs.

 

[MoepMan]

Is there any chance this goes upstream?

Anonymous LDAP really isn't a good idea from a security perspective.

 

[remko]

The attached patch file ldap-bind.diff.txt contains an error!
On line 21 a comma (,) is missing after the }

 

[wbumiller]

Available with pve-saccess-control>=4.0-19, `bind_dn`, with the password read from `/etc/pve/priv/ldap/<realm>.pw`

 

[aus]

Thanks! Will try it out in a couple of months, when upgrading to Proxmox 4.0!

 

[udo]

Available with pve-saccess-control>=4.0-19, `bind_dn`, with the password read from `/etc/pve/priv/ldap/<realm>.pw`

Hi,
are there any examples or docu about that?

I tried to use ldap with authentication but without luck. I guess I make an mistake anywhere?

pveversion -v | grep access
libpve-access-control: 4.0-19

grep ldap: /etc/pve/domains.cfg
ldap: Pve-Ldap

ls -lsa /etc/pve/priv/ldap/*.pw
1 -rw------- 1 root www-data 10 Sep 30 11:54 /etc/pve/priv/ldap/Pve-Ldap.pw

grep bind /etc/pve/datacenter.cfg
bind_dn: "cn=binduser,ou=system,o=company"

syslog:
Sep 30 12:12:29 pve02 pvedaemon[3313]: authentication failure; rhost=192.168.2.66 user=udo@Pve-Ldap msg=no entries returned

such ldapsearch with the cleartext-pw, like in /etc/pve/priv/ldap/Pve-Ldap.pw work:

ldapsearch -h 192.168.2.66 -b ou=section,ou=people,o=company -D 'cn=binduser,ou=system,o=company' -W

any hints?

Udo

 

[wbumiller]

Doc examples are on my todo list (as well as the GUI side of this). bind_dn is a property of the realm/domain, so it should be in /etc/pve/domans.cfg, not datacenter.cfg.

# /etc/pve/domains.cfg
ldap: test-ldap
        server1 fc00:c::2100
        base_dn ou=People,dc=testldap,dc=foo
        bind_dn uid=pve-server,ou=People,dc=testldap,dc=foo
        user_attr uid

 

[udo]

Doc examples are on my todo list (as well as the GUI side of this). bind_dn is a property of the realm/domain, so it should be in /etc/pve/domans.cfg, not datacenter.cfg.

# /etc/pve/domains.cfg
ldap: test-ldap
        server1 fc00:c::2100
        base_dn ou=People,dc=testldap,dc=foo
        bind_dn uid=pve-server,ou=People,dc=testldap,dc=foo
        user_attr uid

Hi,
THANKS!

is running...

Udo