LDAP configuration to resolve mongo bans

Question

I am new to MongoDB and LDAP. I am trying to use LDAP to authenticate users in mongo. These are the steps that I have taken so far.

• Created a saslauthd.conf file inside the / etc folder, which contains the following line:

ldap_servers: ldap://com.myldap.server ldap_use_sasl: yes ldap_mech: DIGEST-MD5 ldap_auth_method: fastbind 

2. created by mux dir inside /var/run/saslauthd , which now looks like /var/run/saslauthd/mux

3. set resolution 755 using sudo chmod 755 /var/run/saslauthd

4. Changed /etc/sysconfig/saslauthd to have the following

MECH=ldap

5. Uncomment a line in the same file that says:

DAEMONOPTS=--user saslauth

Now that I have tried to test the authentication mechanism using the following command:

testsaslauthd -u username -p password -f /var/run/saslauthd/mux

I get the following message:

connect(): Permission Denied

my work is based on this and this Can anyone point out that I am not here? thanks in advance.

UPDATE:

I tried the test command with sudo as shown below:

sudo testsaslauthd -u username -p password -f /var/run/saslauthd/mux

And I get the following:

connect() : Connection refused

Answer 1

Thanks for your question. I liked setting up the environment to try and reproduce the error. You will be glad to hear that I do not think this is a difficult problem. However, I probably spent more time than I wanted to configure MongoDB, cyrus-sasl-md5 , parameter permissions, etc., When nothing is related to your problem, at least at first glance.

Your problem (and I'm 90% sure) is that either your saslauthd daemon saslauthd not working, or it is configured incorrectly. Let's look at the following:

Check service status . The output of service saslauthd status should be similar to mine pasted below. Pay attention to some key values, such as the location of the init script, /etc/init.d/saslauthd/ in my case; and the socket /var/run/saslauthd/mux , the same file location that you need to enter in the testsaslauthd [...] -f /var/run/saslauthd/mux .

 root@hectorvp-pc :~# service saslauthd status ● saslauthd.service - LSB: saslauthd startup script Loaded: loaded (/etc/init.d/saslauthd) Active: active (running) since Tue 2016-04-26 12:04:59 BST; 1s ago Docs: man:systemd-sysv-generator(8) Process: 11569 ExecStop=/etc/init.d/saslauthd stop (code=exited, status=0/SUCCESS) Process: 11586 ExecStart=/etc/init.d/saslauthd start (code=exited, status=0/SUCCESS) Memory: 2.0M CGroup: /system.slice/saslauthd.service ├─11606 /usr/sbin/saslauthd -a ldap -c -m /var/run/saslauthd -n 5 ├─11607 /usr/sbin/saslauthd -a ldap -c -m /var/run/saslauthd -n 5 ├─11608 /usr/sbin/saslauthd -a ldap -c -m /var/run/saslauthd -n 5 ├─11609 /usr/sbin/saslauthd -a ldap -c -m /var/run/saslauthd -n 5 └─11610 /usr/sbin/saslauthd -a ldap -c -m /var/run/saslauthd -n 5 Apr 26 12:04:59 hectorvp-pc systemd[1]: Starting LSB: saslauthd startup script... Apr 26 12:04:59 hectorvp-pc saslauthd[11586]: * Starting SASL Authentication Daemon saslauthd Apr 26 12:04:59 hectorvp-pc saslauthd[11606]: detach_tty : master pid is: 11606 Apr 26 12:04:59 hectorvp-pc saslauthd[11606]: ipc_init : listening on socket: /var/run/saslauthd/mux Apr 26 12:04:59 hectorvp-pc systemd[1]: Started LSB: saslauthd startup script. Apr 26 12:04:59 hectorvp-pc saslauthd[11586]: ...done. 

If the service is not running, simply start it with service saslauthd start and check the status ( service saslauthd status ) again to check for possible upstream errors.

Your ldap server is probably not running or not configured. You can view the status of the service as described above ( service slapd status ).

Please try this and tell us about the outcome.

EDIT (04/26/2016) . From the conversation in the comments of this answer, I took a few more steps. I apologize for the extensive conversation under the answer, here it is summarized:

Debugging saslauthd service . As indicated here , this service uses syslogs. In my case (Ubuntu) these logs are in /var/log/syslog , but they can be in /var/log/messages in your case. At least by default. Look at these logs while you are trying to start the service, and see if an error message appears that may give you additional information about the problem.

The error that appears in /var/logs/messages was: could not bind to socket : /var/run/saslauthd/mux , bind: address already in use .

We checked the mux socket using the file: file /var/run/saslauthd/mux , and the output indicates that it is a directory. It must be a socket . Then we uninstalled it and restarted the service. Now the service is running.