Re: [gentoo-user] OpenLDAP works only at localhost, not from outside

[Joost Roeleveld <joost@antarean.org>]

On Wednesday, August 31, 2011 06:24:26 PM Johannes Geiss wrote:
> Hi there,
> 
> I want to access my LDAP-data from anywhere on the internet but I only
> get it working on localhost.
> 
> I installed OpenLDAP 2.4.24, and tried to do the tutorial at
> 
>     http://www.yolinux.com/TUTORIALS/LinuxTutorialLDAP.html
> 
> The LDAP database works fine from localhost with
> 
>     ldapsearch -vLx -b "o=stooges" "(sn=Fine)" -h localhost
> 
> but if I try to do it from the outside (ie. the IP address my router
> gave me via DHCP)

What do you mean with, "outside"?
> 
>     ldapsearch -vLx -b "o=stooges" "(sn=Fine)" -h xxx.xxx.xxx.xxx
> 
> I get the output "ldap_initialize( ldap://xxx.xxx.xxx.xxx )" and the
> client hangs.
> 
> The slapd server prints
> 
> slap_listener_activate(6):
> >>> slap_listener(ldap:///)

Interesting, this should indicate that it does bind to all interfaces.

> 
> and hangs at this point until I Ctrl-C the client or wait approx. 5
> Minutes.

5 minutes is a time-out.

> Does anybody successfully installed an LDAP-service with access from
> the outside? What is the content of slapd.conf?

Yes, slapd.conf doesn't decide this though
> 
> Did I miss anything else?

If it weren't for the log from the slapd logs, I'd answer with the following 
bit:

First the short answer:
*** /etc/conf.d/slapd ***
# conf.d file for openldap
#
OPTS="-f /etc/openldap/slapd.conf -h 'ldaps:// ldap:// 
ldapi://%2fvar%2frun%2fopenldap%2fslapd.sock' -4"
*********

The long answer:

You need to configure "slapd" to listen to all interfaces, you do this by 
setting the "-h " options correctly. I use both SSL and non-SSL for my LDAP 
and also set a socket-file:
" -h 'ldaps:// ldap:// ldapi://%2fvar%2frun%2fopenldap%2fslapd.sock'"

See "man slapd" for more information.

However, the logs show that this should already work.
This makes me wonder about the following possible causes:

1) Outside = on the other side of the router
2) A firewall on your machine is blocking access

These have the following solutions:
1) Forward the correct port (386) to your machine
2) Reconfigure your firewall

Another thing to try would be to check if there is actually something 
listening on the correct port:
# netstat -an | grep 389

This should return a line like:
**
tcp        0      0 0.0.0.0:389             0.0.0.0:*               LISTEN     
**

You could also have a look at the Gentoo-LDAP page:
http://www.gentoo.org/doc/en/ldap-howto.xml

Hope this helps.

--
Joost