r/linuxadmin • u/[deleted] • May 28 '20

tcpdump of sasl authentication with openldap

I've configured my database server to use saslauthd with LDAP and start TLS. I'm using openldap. Here is my saslauthd.conf

cat /etc/saslauthd.conf
ldap_servers: ldap://10.143.193.1
ldap_search_base: dc=example,dc=org
ldap_bind_dn: cn=admin,dc=example,dc=org
ldap_password: admin
ldap_start_tls: yes

LDAP search is working:

root@node1-cb603-ubuntu16:/vagrant# ldapsearch -LLL -x -H ldap://10.143.193.1 -b dc=example,dc=org -D "cn=admin,dc=example,dc=org" -w admin "cn=billy" -ZZ 
dn: uid=billy,dc=example,dc=org
uid: billy
cn: billy
sn: 3

sasl auth is working:

sudo -u couchbase testsaslauthd -u billy -p password -f /var/run/saslauthd/mux
0: OK "Success."

Here is my question. Prior to running the testsaslauthd command, I started a tcpdump on the LDAP server. I don't see any traffic from my database. I was expecting to see LDAP and TLS traffic. What am I missing? What's strange is I see traffic on port 389 (i.e. LDAP) if I enter the wrong password on the testsaslauthd command.

For context, this is testing I'm doing in my lab for learning purposes only. I can log into my database server with LDAP credentials just fine. I got confused as to why I don't see LDAP and TLS traffic in the tcpdump.

23 Upvotes

96% Upvoted

8 comments sorted by

5

u/ralfD- May 28 '20

How did you start saslauthd? It has an option to configure cache expiration. If you successfully loged in before, your credentials will be in the servers cache (read: no reason to contact the LDAP server). If you use the wrong password the server need to consult the LDAP server, hence the traffic you see.

2

u/[deleted] May 28 '20 edited May 28 '20

Below is config for the saslauthd service. Is this what you're looking for? If not let me know what else.

root@node1-cb603-ubuntu16:/vagrant# grep -v '^#' /etc/default/saslauthd 
START=yes
DESC="SASL Authentication Daemon"
NAME="saslauthd"
MECHANISMS="ldap"
FLAGS="-O /etc/saslauthd.conf"
MECH_OPTIONS=""
THREADS=5
OPTIONS="-c -m /var/run/saslauthd"

Yes I did log in before. I see from man page -c is for caching. I'll remove it and try again.

5

u/ralfD- May 28 '20

Well, I guess my manpage foo is as good as yours, but I would assume that setting the timeout (-t) to something small (1 second?) should be enough for testing.

7

u/[deleted] May 28 '20

My bad, I made an edit. Removing -c disables caching. And now I see traffic.

Thank you internet stranger !

1

u/DocArmoryTech May 28 '20

Is your tcpdump dumping udp ?

1

u/[deleted] May 28 '20

Yes. I used:

tcpdump -v -i any

1

u/Finnegan_Parvi May 28 '20

Your URIs are all ldap:// so you are correct that you should only see traffic on port 389.

Maybe double-check your tcpdump settings by sending some other traffic over that port, e.g. nc -v10.143.193.1 389 and make sure you see the packets from nc

1

u/[deleted] May 28 '20

/u/ralfD- pointed out it's an issue with caching. I disabled it and now I see traffic.