Check_ldap refusing to connect with TLS-requirement on LDAP-server

[Glowsome (Michael Honkoop)]

CMK version: 2.3.0.p22
OS version:RockyLinux 9.5

I am trying to the check_ldap -rule with below options:

However almost any combination i have tested results in “Could not contact LDAP Server”.
Only exception is trying port 389 / no ssl, which results in “Confidentiality required”

Compared to a python script i used to connect (using ldap, not LDAP3) i had to add below to get around this:

ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)

Question is:
Where does above option(if available/any) i set in my script translate to a checkbox/option in the rule in CMK.

• Glowsome

[Virus2500 (Michael Kronika)]

Hi,

i am not aware of an option to disable the certificate check, like you did in the python example, if you enable SSL for the ldap check.

Does your CMK server trust the LDAP certificate?

You could check this with

openssl s_client --connect <your ldap fqdn>:636

At the end it should give you an

Verify return code: 0 (ok)

If it doesn’t you will need to install the root and probably intermediate certificate of the used CA in /usr/local/share/ca-certificates and then run

update-ca-certificates

Then test again with the openssl command.

Besides that i don’t think you can just use cn= as a Bind DN.
AFAIK it requires the complete DN like this:
Bind DN: uid=monitor,ou=people,ou=svcaccounts,dc=mydomain,dc=at

Same for Base DN cn=Monitor
I mean i don’t know your setup but i think this is invalid anyway.

A base dn should end with an “Domain Component” like dc=com.

br

[Glowsome (Michael Honkoop)]

I understand your confusion, but my directory differs from AD …

it is based on eDirectory

• Glowsome

[Virus2500 (Michael Kronika)]

Ah, got you.
Thats why i included “I mean i don’t know your setup”. There is always room for something i have never heard of

[robin.gierse]

You might want to check, whether the Checkmk server can reach the CRLs specified in the certificate used for LDAPS. Also, this might help.