As requested here's more detailed information about this bug:
$ automount -f -d -v
Starting automounter version 5.1.8, master map auto.master
using kernel protocol version 5.05
lookup_nss_read_master: reading master ldap auto.master
parse_server_string: lookup(ldap): Attempting to parse LDAP information from string "auto.master".
parse_server_string: lookup(ldap): mapname auto.master
parse_ldap_config: lookup(ldap): ldap authentication configured with the following options:
parse_ldap_config: lookup(ldap): use_tls: 0, tls_required: 0, auth_required: 2, sasl_mech: GSSAPI
parse_ldap_config: lookup(ldap): user: (null), secret: unspecified, client principal: dc at EXAMPLE.COM credential cache: /tmp/krb5cc_0
do_init: parse(sun): init gathered global options: (null)
find_server: trying server uri ldap://dc.example.com
do_bind: lookup(ldap): auth_required: 2, sasl_mech GSSAPI
sasl_do_kinit_ext_cc: using external credential cache for auth: client principal dc at EXAMPLE.COM
sasl_do_kinit_ext_cc: external credential cache default principal dc at EXAMPLE.COM
sasl_do_kinit_ext_cc: Kerberos authentication was successful!
sasl_bind_mech: Attempting sasl bind with mechanism GSSAPI
sasl_log_func: GSSAPI client step 1
getuser_func: called with context (nil), id 16385.
sasl_log_func: GSSAPI client step 1
getuser_func: called with context (nil), id 16385.
sasl_log_func: GSSAPI client step 2
sasl_bind_mech: sasl bind with mechanism GSSAPI succeeded
do_bind: lookup(ldap): autofs_sasl_bind returned 0
get_query_dn: lookup(ldap): check search base list
get_query_dn: lookup(ldap): query failed for search dn ou=automount,dc=example,dc=com: Operations error
get_query_dn: lookup(ldap): failed to find query dn under search base dns
do_connect: lookup(ldap): failed to get query dn
lookup(ldap): couldn't connect to server ldap://dc.example.com
do_reconnect: lookup(ldap): failed to find available server
lookup_nss_read_master: no map - continuing to next source
no mounts in table
Challenge here is the limited logging by autofs. Switching TLS off and
monitoring the traffic with wireshark the root cause can be retrieved:
Lightweight Directory Access Protocol
LDAPMessage bindResponse(3) strongAuthRequired (SASL:[GSSAPI]: Sign or Seal are required.)
messageID: 3
protocolOp: bindResponse (1)
bindResponse
resultCode: strongAuthRequired (8)
matchedDN:
errorMessage: SASL:[GSSAPI]: Sign or Seal are required.
serverSaslCreds: <MISSING>
[Response To: 26]
[Time: 0.000164267 seconds]
Samba AD DC rejects SASL bind as it relies on LDAP traffic encryption
using SASL GSSAPI data security layer.
/etc/autofs_ldap_auth.conf:
<?xml version="1.0" ?>
<!--
This files contains a single entry with multiple attributes tied to it.
See autofs_ldap_auth.conf(5) for more information.
-->
<autofs_ldap_sasl_conf
usetls="no"
tlsrequired="no"
authrequired="yes"
authtype="GSSAPI"
credentialcache="/tmp/krb5cc_0"
clientprinc="DC$@EXAMPLE.COM"
/>
--
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to autofs in Ubuntu.
https://bugs.launchpad.net/bugs/1984073
Title:
autofs: regression on focal->jammy upgrade: SASL binds to Samba AD
broken
Status in autofs package in Ubuntu:
Triaged
Bug description:
automounter version 5.1.8 does not support SASL security layer
encryption and only relies on TLS to protect (encrypt) LDAP traffic.
Since version 4.4 Samba AD domain controllers' default settings only allow
for simple SASL binds over TLS encrypted connections or SASL binds with
sign or seal, i. e. data security layer encryption, over unencrypted
connections. Therefore, current automounter cannot fetch autofs maps from
Samba AD DCs using SASL anymore without setting Samba configuration
parameter "ldap server require strong auth" to "no" or "allow_sasl_over_tls".
Cyrus SASL supports data encryption in GSSAPI (with Kerberos V) mode using
an SASL data security layer according to IETF RFC 2078. This security layer
provides for traffic encryption during authentication and authorization
towards an OpenLDAP based server and for subsequent encryption of data
traffic for the LDAP session. OpenLDAP libldap and OpenLDAP clients support
automatic installation of (Cyrus) SASL data security layer.
automounter version 5.1.8 uses its own interface to Cyrus SASL API and does
not rely on OpenLDAP libldap for SASL binds. This leads to security degradation
when using Samba AD or OpenLDAP directory services to store automount maps.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/autofs/+bug/1984073/+subscriptions