#4695 Login with LDAP based account fails

[Sven Meeus]

Hi,

With the update to 1.780, all LDAP based account logins fail. Login with users stored in local files still works.

I will try to explain my common setup as good as I can. The OS used is CentOS and 6.7. For obvious reasons, I only use Webmin over HTTPS.

All my servers have LDAP integration with OpenLDAP using pam_ldap and nslcd. Logging on to my servers over ssh works perfect, I can also use getent passwd/group to list all local and LDAP users and groups.
My OS LDAP users are stored in the DN ou=users,dc=private,dc=domain
My OS LDAP groups are stored in the DN ou=groups,dc=private,dc=domain

I have configured webmin to use LDAP based users and groups via the Webmin Users/User and Group Database interface:

• Hostname: IP address of my LDAP server
• Connections Encryption: TLS
• Username: cn=webminproxy,...
• Password: the password for the username
• Create under DN: ou=webmin,dc=private,dc=domain
• Object class for users: webminUser
• Object class for groups: webminGroup
• Add new users to database selected above

I have the standard root webmin user using unix authentication and stored in local files.
Then I have a couple of webmin users and groups, all stored in LDAP.
Users:

• myuser
• otheruser
• ...
• WebminServer
  Groups:
• Administrators
• ...
• WebminServers

The WebminServer/WebminServers user/group is used to link several servers via RPC in the Webmin Servers module. The WebminServer user uses password authentication. It is not an OS user.

The webmin users myuser and otheruser use unix authentication. In order to get this to work, I had to modify the /etc/pam.d/webmin file to:

#%PAM-1.0
auth    sufficient      pam_ldap.so
auth    required        pam_unix.so     nullok
account sufficient      pam_ldap.so
account required        pam_unix.so
session sufficient      pam_ldap.so
session required        pam_unix.so

Up to Webmin 1.773 everything works fine, I can log in with both the myuser and otheruser accounts without any problem.

After the upgrade to Webmin 1.780 I can only log in with the root and WebminUser webmin users. Login with the myuser and otheruser give a 'Secure connection failed' error in Firefox and 'Empty content returned' error in Chrome.

I have tried to increase the logging output for webmin to include login and logouts, but the logs don't even show any login attempt from myuser or otheruser.
I also tried setting the LDAP bind to use no encryption or SSL encryption, neither have any result.

My OpenLDAP logs show queries coming from Webmin querying details for myuser.

Jan  2 16:59:54 server slapd[20810]: conn=2328550 fd=50 ACCEPT from IP=10.60.4.8:52264 (IP=0.0.0.0:389)
Jan  2 16:59:54 server slapd[20810]: conn=2328550 op=0 EXT oid=1.3.6.1.4.1.1466.20037
Jan  2 16:59:54 server slapd[20810]: conn=2328550 op=0 STARTTLS
Jan  2 16:59:54 server slapd[20810]: conn=2328550 op=0 RESULT oid= err=0 text=
Jan  2 16:59:54 server slapd[20810]: conn=2328550 fd=50 TLS established tls_ssf=256 ssf=256
Jan  2 16:59:54 server slapd[20810]: conn=2328550 op=1 BIND dn="cn=webminproxy,..." method=128
Jan  2 16:59:54 server slapd[20810]: conn=2328550 op=1 BIND dn="cn=webminproxy,..." mech=SIMPLE ssf=0
Jan  2 16:59:54 server slapd[20810]: conn=2328550 op=1 RESULT tag=97 err=0 text=
Jan  2 16:59:54 server slapd[20810]: conn=2328550 op=2 SRCH base="ou=webmin,dc=private,dc=domain" scope=2 deref=2 filter="(&(cn=myuser)(objectClass=webminUser))"
Jan  2 16:59:54 server slapd[20810]: conn=2328550 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text=
Jan  2 16:59:54 server slapd[20810]: conn=2328550 fd=50 closed (connection lost)

When I go to the Webmin Users module, the LDAP webmin users and groups show up and I can also see in my OpenLDAP logs that Webmin makes successful queries for them.

The above configuration is the simplest configuration I have, but I also have servers running Cloudmin and Virtualmin that rely on the same structure for logins.

If you need any suggestions on what I can try next, or require more information or logs, please let me know.

Kind Regards,

Sven.

[Sven Meeus]

Hi again,

I figured out a little bit more and managed to get my LDAP users login working again.

I overlooked the /var/webmin/miniserv.error logfile before, and when I looked at it again, I saw the following error message:

Can't locate object method "cn" via package "Net::LDAP::Entry" at /usr/libexec/webmin/miniserv.pl line 4665.

This lead me to create a diff of the /usr/libexec/webmin/miniserv.pl against a version 1.770 one, with the following result:

# diff miniserv.pl-1.780 /usr/libexec/webmin/miniserv.pl
3243a3244
>               print STDERR "finished reading - shutting down socket\n";
3277a3279
>               print STDERR "finished reading - shutting down socket\n";
4665c4667
<               if (!$u || $u->cn() ne $username) {
---
>               if (!$u) {

So, I went back to the server with 1.780 installed and changed line 4665 in /usr/libexec/webmin/miniserv.pl back to

              if (!$u) {

I restarted Webmin and tried logging in with both myuser and otheruser LDAP users and it worked without any problem.

This is obviously a crude workaround and not optimal, but it hopefully may give you some extra insight in what is going wrong.

Kind regards,

Sven.

[Jamie Cameron]

Damn, this is a bug in Webmin 1.780. I've implemented a proper fix, which you can see at https://github.com/webmin/webmin/commit/650c06300a7cd8c22e071db9a2428093b2ec6ba3

Please let me know if this works on your system.

[Sven Meeus]

Hi,

The fix on Github works like a charm. I've implemented it on all my systems now.

Kind regards,

Sven.

[Jamie Cameron]

Great!