(ITS#9019) NSSDB + OpenLDAP

[vangelier@hotmail.com]

Full_Name: Victor Angelier
Version: OpenLDAP: slapd 2.4.44
OS: CentOS
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (78.78.44.170)


When using OpenLDAP with NSS DB in HA setup you can not change the TLS
certificate name through LDIF with ldapmodify.

The only way to update the TLS certificate name is by editing the cn=config.ldif
file with breaches the signature.

This is especially with HA setup a serious issue.

Reproduce. Install and setup OpenLDAP in HA (I have 2 nodes)
Configure it so that it uses NSS DB

cn=config.ldif

cat /etc/openldap/slapd.d/cn\=config.ldif
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 13782a66
dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/openldap/slapd.args
olcPidFile: /var/run/openldap/slapd.pid
olcTLSProtocolMin: 3.3
olcTLSCipherSuite: ECDHE-RSA-AES256-SHA384:AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!EXP:!SSLV2:!eNULL:!SSLV3
olcTLSDHParamFile: /etc/openldap/ssl/dhparams
structuralObjectClass: olcGlobal
entryUUID: ef483c7c-da8d-1038-907a-df6f97fe6ec7
creatorsName: cn=config
createTimestamp: 20190314101611Z
olcTLSCACertificatePath: /etc/openldap/ssl
olcTLSCACertificateFile: /etc/pki/tls/certs/ca-bundle.crt
olcTLSCertificateFile: "Cyberdyne Security"
olcTLSCertificateKeyFile: /etc/openldap/ssl/password
olcTLSVerifyClient: allow
olcServerID: 1 ldaps://ldap-n1.cyberdynesecurity.ae
olcServerID: 2 ldaps://ldap-n2.cyberdynesecurity.ae
olcLogFile: /var/log/slapd.log
entryCSN: 20190507074650.989216Z#000000#001#000000
modifiersName: cn=Manager,dc=cyberdynesecurity,dc=ae
modifyTimestamp: 20190507074650Z
contextCSN: 20190507074650.989216Z#000000#001#000000
contextCSN: 20190402094130.452589Z#000000#002#000000

Now try change "olcTLSCertificateFile" through LDIF

vi change.ldif

dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: "new certificate name"

ldapmodify -Y EXTERNAL -H ldapi:/// -f edit.ldif -v

ldap_initialize( ldapi:///??base )
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
replace olcTLSCertificateFile:
        "new certificate name"
modifying entry "cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)


If "olcTLSCertificateFile" is set to an existing file like /tmp/certificate.crt
it works fine.