haraka/haraka-plugin-auth-ldap

Authenticate SMTP clients against LDAP

haraka-plugin-auth-ldap

The auth/auth_ldap plugin uses an LDAP bind to authenticate a user. Currently only one server and multiple DNs can be configured. If any of the DN binds succeed, the user is authenticated.

Configuration

Configuration is stored in config/auth_ldap.ini and uses the INI style formatting.

PLAIN and LOGIN authentication methods are supported assuming that passwords in the LDAP database are not stored in cleartext (which would allow for CRAM-MD5). Note that this means passwords will be sent in the clear to the LDAP server unless an ldaps:// conection is used.

Current configuration options in [core] are:

server - the url of the LDAP server (ldap:// or ldaps://)
timeout - time in miliseconds to wait for the server resonse before giving up
rejectUnauthorized - boolean (true or false) as to whether to reject connections
    not verified against a CA. Meaning, a "false" allows non-verified.

Example:

[core]
server=ldaps://ldap.opoet.com
timeout=5000
rejectUnauthorized=false

The [dns] section (that is plural DN and not domain name system), is a list of DNs to use to bind. The %u in the strings is substituted with the user name used in the SMTP authentication. Note that the keys have no meaning and the DNs are tried in series until the first successful bind. The LDAP RFC does not allow for parallel binds on a connection, so it is suggested that the most commonly used DN be placed earlier in the list.

Example:

[dns]
dn1=uid=%u,ou=Users,dc=opoet,dc=com
dn2=uid=%u,ou=people,dc=opoet,dc=com

haraka-plugin-auth-ldap's Issues

auth-ldap doesn't populate config during register

system info

Haraka	Haraka.js — Version: 2.8.18
Node	v7.10.1
OS	Linux ubuntu 3.10.0-693.21.1.el7.x86_64 #1 SMP Wed Mar 7 19:03:37 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
openssl	OpenSSL 1.0.2k-fips 26 Jan 2017

Expected behavior

Observed behavior

auth-ldap doesn't work. Broke somewhere b/w .13 and .18, is my guess. Probable root cause: exports.register is missing a line. Should look like this:

exports.register = function () { this.inherits('auth/auth_base'); this.load_auth_ldap_ini(); //<-- this is the missing line }

Otherwise, the this.cfg is always null:

[CRIT] [C6653449-9CEF-4709-8F29-4E0EA68CBD8B] [core] Plugin auth-ldap failed: TypeError: Cannot read property 'core' of undefined
at Plugin.exports.check_plain_passwd (/home/greeble31/mail/node_modules/haraka-plugin-auth-ldap/index.js:37:15)
at Plugin.exports.check_user (/home/greeble31/mail/node_modules/Haraka/plugins/auth/auth_base.js:148:16)
at Plugin.exports.auth_login (/home/greeble31/mail/node_modules/Haraka/plugins/auth/auth_base.js:233:23)
at Plugin.exports.hook_unrecognized_command (/home/greeble31/mail/node_modules/Haraka/plugins/auth/auth_base.js:42:23)
.
.
.

Side note: The default config/plugins has bad syntax for the commented auth-ldap: It is "# auth_ldap", but should be "# auth-ldap". Anyone who uncomments that line, expecting it to use the new auth-ldap module, will instead be getting an error message from the old auth_ldap.

Steps to reproduce

Do a trivial install of Haraka, and enable auth_ldap.

Haraka does not support self-signed certificates for LDAP-based authentication

system info

Haraka: 2.8.24
Node: 11.13.0
OS: FreeBSD mail 12.0-RELEASE-p3 FreeBSD 12.0-RELEASE-p3 GENERIC amd64
OpenSSL: OpenSSL 1.1.1a-freebsd 20 Nov 2018

Expected behavior

Haraka should accept self-signed certificates for OpenLDAP, as seen with Dovecot, for example.

Observed behavior

Haraka does not allow ldaps://[ldap server], unless the certificate is publicly signed and recognised, e.g. via LetsEncrypt.

Steps to reproduce

In both auth_ldap.ini and rcpt_to.ldap.ini:

server=ldaps://ldap.jail.vlan

creates LDAP TLS errors. In slapd.conf, security has to be disabled, and in the above configuration files "ldaps" has to be replaced with "ldap" for authentication to work.
The following configuration, however, work with Dovecot on the same server instance, connecting to a remote OpenLDAP server instance:
slapd.conf:

# Global SSL/TLS configuration:
# self-signed CA certificate
TLSCACertificateFile            /etc/ssl/cacerts/ca.jail.vlan.cacert.pem
# self-signed certificate
TLSCertificateFile              /etc/ssl/certs/ldap.jail.vlan.cert.pem
# corresponding private key
# We only want to communicate LDAP data to certified clients
# Works with Dovekot, but not with Haraka, had to be commented out
#TLSVerifyClient                demand
# Reject connections to clients with certificates that cannot be verified;
# accept clients with no certificate
# Had to be uncommented to work with Haraka
TLSVerifyClient                 try

# Security restrictions
# Require 256-bit encryption for all connections
# Had to be uncommented to work with Haraka, though it works with Dovecot
#security ssf=256

Local ldap.conf client TLS configuration:

# SSL/TLS configuration, works with Dovekot, but now irrelevant,
# as SSL/TLS had to be disabled for Haraka
# Self-signed local CA
TLS_CACERT      /etc/ssl/cacerts/ca.jail.vlan.cacert.pem
TLS_REQCERT     demand

Rationale:
We do want to encrypt connections to our central OpenLDAP server used for user authentication. This server ius not publicly accessible, and therefore does not have any LetsEncrypt certificates, and we use self-signed certificates with a local CA instead.
This all works like a charm with Dovecot, but Haraka seems to insist on "proper" certificates. While with is cool for certificates for SMTP and IMAP, where we have FQDN for the mail server, no such thing is available for the non-public OpenLDAP server. Therefore, self-signed certificates should be acceptable for LDAP purposes.
What do you think, or ma I missing something?
Thank you!
Chris