I am trying to use Python-LDAP (version 2.4.19) under MacOS X 10.9.5 and Python 2.7.9
I want to test my connection to this LDAP server after I call .start_tls_s() (or so that the method will raise and exclude if the certificate cannot be verified). (I would also like to check the CRL, but that is another matter).
Here is my code:
#!python #!/usr/bin/env python import ConfigParser, os, sys import ldap CACERTFILE='./ca_ldap.bad' ## CACERTFILE='./ca_ldap.crt' config = ConfigParser.ConfigParser() config.read(os.path.expanduser('~/.ssh/creds.ini')) uid = config.get('LDAP', 'uid') pwd = config.get('LDAP', 'pwd') svr = config.get('LDAP', 'svr') bdn = config.get('LDAP', 'bdn') ld = ldap.initialize(svr) ld.protocol_version=ldap.VERSION3 ld.set_option(ldap.OPT_DEBUG_LEVEL, 255 ) ld.set_option(ldap.OPT_PROTOCOL_VERSION, 3) ld.set_option(ldap.OPT_X_TLS_CACERTFILE, CACERTFILE) ld.set_option(ldap.OPT_X_TLS_DEMAND, True ) ld.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_HARD) ## From: /questions/475316/pythonldapssl/2050886#2050886 ## and : http://python-ldap.cvs.sourceforge.net/viewvc/python-ldap/python-ldap/Demo/initialize.py?revision=1.14&view=markup ld.start_tls_s() for each in dir(ldap): if 'OPT_X_TLS' in each: try: print '\t*** %s: %s' % (each, ld.get_option((getattr(ldap, each)))) except Exception, e: print >> sys.stderr, '... Except %s: %s\n' % (each, e) ld.simple_bind_s(uid, pwd) results = ld.search_s(bdn, ldap.SCOPE_SUBTREE) print 'Found %s entries under %s' % (len(results), bdn) sys.exit()
As noted in the comments, I copied most of this from https://stackoverflow.com/a/464316/ ... and from http://python-ldap.cvs.sourceforge.net/viewvc/python-ldap/python-ldap/Demo/ initialize.py?revision=1.14&view=markup ... although I have tried many variations and sequences of this.
As shown, I have two files that represent a bad certificate, and one that should work (it is actually taken from one of our systems, which is configured to run sssd (Daemon System Security), which is supposed to check correctly .
In a “bad” copy, I simply replaced the first character of each line of the line with the letter “x” to suggest that this would damage the CA key and cause some code to try to verify the signature chain.
However, it looks like the LDAP Python code ignores this; even if I set it to /dev/null or the completely dummy path that my code still works, still binds to the LDAP server and still completes my search request.
So, the question is, how can I make this “fail” for its intended purpose (or, more broadly, how can I prevent my code from being vulnerable to MITM (Mallory) attacks?
If this makes any difference in this discussion, here is my version of OpenSSL:
$ openssl version OpenSSL 0.9.8za 5 Jun 2014
OpenLDAP runs on the LDAP server, but I don’t know the details about its version and configuration.
Here is an example output from my code:
*** OPT_X_TLS: 0 *** OPT_X_TLS_ALLOW: 0 *** OPT_X_TLS_CACERTDIR: None *** OPT_X_TLS_CACERTFILE: /bogus/null *** OPT_X_TLS_CERTFILE: None *** OPT_X_TLS_CIPHER_SUITE: None *** OPT_X_TLS_CRLCHECK: 0 *** OPT_X_TLS_CRLFILE: None *** OPT_X_TLS_CRL_ALL: 1 *** OPT_X_TLS_CRL_NONE: {'info_version': 1, 'extensions': ('X_OPENLDAP', 'THREAD_SAFE', 'SESSION_THREAD_SAFE', 'OPERATION_THREAD_SAFE', 'X_OPENLDAP_THREAD_SAFE'), 'vendor_version': 20428, 'protocol_version': 3, 'vendor_name': 'OpenLDAP', 'api_version': 3001} *** OPT_X_TLS_CRL_PEER: 3 ... Except OPT_X_TLS_CTX: unknown option 24577 *** OPT_X_TLS_DEMAND: 1 *** OPT_X_TLS_DHFILE: None *** OPT_X_TLS_HARD: 3 *** OPT_X_TLS_KEYFILE: None *** OPT_X_TLS_NEVER: {'info_version': 1, 'extensions': ('X_OPENLDAP', 'THREAD_SAFE', 'SESSION_THREAD_SAFE', 'OPERATION_THREAD_SAFE', 'X_OPENLDAP_THREAD_SAFE'), 'vendor_version': 20428, 'protocol_version': 3, 'vendor_name': 'OpenLDAP', 'api_version': 3001} ... Except OPT_X_TLS_NEWCTX: unknown option 24591 *** OPT_X_TLS_PACKAGE: OpenSSL *** OPT_X_TLS_PROTOCOL_MIN: 0 *** OPT_X_TLS_RANDOM_FILE: None *** OPT_X_TLS_REQUIRE_CERT: 1 *** OPT_X_TLS_TRY: 0 Found 883 entries under [... redacted ...]