{"id":5719,"date":"2023-04-07T16:31:30","date_gmt":"2023-04-07T14:31:30","guid":{"rendered":"https:\/\/www.bdjl.de\/localhost\/?p=5719"},"modified":"2023-04-07T16:47:46","modified_gmt":"2023-04-07T14:47:46","slug":"ldaps-via-haproxy","status":"publish","type":"post","link":"https:\/\/www.bdjl.de\/localhost\/?p=5719","title":{"rendered":"LDAPs via HAProxy"},"content":{"rendered":"<p>Situation: LDAPs Verbindungen sollen via pfSense und dem dortigen HAProxy an den LD-Server ge-proxied werden, um mehr Kontrolle \u00fcber die zul\u00e4ssigen LDAP-Hosts zu haben als mit plain LD-Server.<\/p>\n<p>Problem: Obwohl die LDAPs Verbindung vom Client via pfSense und HAProxy zum lokalen LDAP-Server klappt, geht keine Antwort vom LDAP-Server nach Au\u00dfen.<\/p>\n<p>L\u00f6sung: TLS1.3 verbieten &#8211; mit TLS1.2 funktioniert es. Das Feld im Frontend nennt sich &#8222;Advanced ssl options&#8220; und braucht den folgenden Eintrag:<\/p>\n<pre>no-tlsv13<\/pre>\n<p><a href=\"https:\/\/www.bdjl.de\/localhost\/wp-content\/uploads\/2023\/04\/haproxy-frontend-ldaps.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-5720\" src=\"https:\/\/www.bdjl.de\/localhost\/wp-content\/uploads\/2023\/04\/haproxy-frontend-ldaps-640x78.png\" alt=\"\" width=\"640\" height=\"78\" srcset=\"https:\/\/www.bdjl.de\/localhost\/wp-content\/uploads\/2023\/04\/haproxy-frontend-ldaps-640x78.png 640w, https:\/\/www.bdjl.de\/localhost\/wp-content\/uploads\/2023\/04\/haproxy-frontend-ldaps-768x94.png 768w, https:\/\/www.bdjl.de\/localhost\/wp-content\/uploads\/2023\/04\/haproxy-frontend-ldaps-624x76.png 624w, https:\/\/www.bdjl.de\/localhost\/wp-content\/uploads\/2023\/04\/haproxy-frontend-ldaps.png 944w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/a><\/p>\n<p>Dann ist es im \u00fcbrigen auch auf der pfSense einstellbar, dass es Wurst sein soll, dass das LDAP-Zertifikat auf dem LD-Server self signed ist. Hauptsache das Zertifikat in Richtung Internet ist sauber (z.B. Let&#8217;sEncrypt-Certificate mit ACME Plugin f\u00fcr pfSense), damit sich z.B. ein Moodle verbinden kann.<\/p>\n<p>Tools zum Debuggen: <a href=\"https:\/\/www.tcpdump.org\/\">tcpdump<\/a>, <a href=\"https:\/\/directory.apache.org\/studio\/\">Apache directory Studio<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Situation: LDAPs Verbindungen sollen via pfSense und dem dortigen HAProxy an den LD-Server ge-proxied werden, um mehr Kontrolle \u00fcber die zul\u00e4ssigen LDAP-Hosts zu haben als mit plain LD-Server. Problem: Obwohl die LDAPs Verbindung vom Client via pfSense und HAProxy zum lokalen LDAP-Server klappt, geht keine Antwort vom LDAP-Server nach Au\u00dfen. L\u00f6sung: TLS1.3 verbieten &#8211; mit [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,19,10],"tags":[468,489,628],"class_list":["post-5719","post","type-post","status-publish","format-standard","hentry","category-linux","category-paedml","category-schule","tag-ldap","tag-logodidact","tag-pfsense"],"_links":{"self":[{"href":"https:\/\/www.bdjl.de\/localhost\/index.php?rest_route=\/wp\/v2\/posts\/5719","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.bdjl.de\/localhost\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.bdjl.de\/localhost\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.bdjl.de\/localhost\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bdjl.de\/localhost\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5719"}],"version-history":[{"count":8,"href":"https:\/\/www.bdjl.de\/localhost\/index.php?rest_route=\/wp\/v2\/posts\/5719\/revisions"}],"predecessor-version":[{"id":5728,"href":"https:\/\/www.bdjl.de\/localhost\/index.php?rest_route=\/wp\/v2\/posts\/5719\/revisions\/5728"}],"wp:attachment":[{"href":"https:\/\/www.bdjl.de\/localhost\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5719"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.bdjl.de\/localhost\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5719"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.bdjl.de\/localhost\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5719"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}