Can authenticated / STARTTLS checks be done for LDAP, SMTP and FTP?

Short answer

Partially. In LDAP and LDAPS, LDAP Authentication is turned on and a session is opened with a user name and password (bind); LDAP has no STARTTLS, and LDAPS is used for an encrypted check. In SMTP, the connection is upgraded to TLS with Use STARTTLS, but SMTP authentication (AUTH) is not performed. The FTP and FTPS check always logs in with FTP User and FTP Password; if FTP Action loginAndList is selected, a directory is also listed.

Problem: The Port Is Open but the Service Cannot Serve Users

LDAP, SMTP and FTP servers may be unable to serve users even while their ports are open, because the authentication infrastructure or the TLS configuration is broken. In this case, the TCP check shows the server as healthy, and traffic continues to go to the broken server. A check that performs a real login or TLS connection catches these failures.

Solution: 4 Methods

Methods 1–3 are for different service types; Method 4 is the WEB-CLI equivalent of the same settings.

Your situation	Suitable method
Directory server (LDAP / LDAPS)	Method 1: LDAP authentication
Mail server (SMTP / SMTPS)	Method 2: SMTP and Use STARTTLS
File server (FTP / FTPS)	Method 3: FTP login and directory listing
I create the profile from WEB-CLI	Method 4: WEB-CLI

Method 1: LDAP Authentication Recommended

• How it works The check establishes an LDAP connection (in LDAPS, LDAP over TLS) to the address of the Backend Service; while LDAP Authentication is on, it binds with the entered user name and password, and if the bind fails, the check fails. While authentication is off (default), establishing the connection is sufficient.
• Where it is openedLoad Balancer → Profiles → Health Checks → Add → Check Type: LDAP / LDAPS → LDAP Authentication
• Requirement A check account that has only read permission; a Backend Service whose address is the LDAP server and port (389 or 636)
• vService type All

Step-by-Step Configuration

1

Adım 1 Open the Health Checks screen

The Configuration Menu is opened with the TR7 logo at the bottom left; the Load Balancer → Profiles → Health Checks path is followed and Add is clicked (How to add?).

2

Adım 2 Enter the name and type

Name is entered; LDAP or LDAPS is selected in the Check Type field. In LDAPS, the TLS fields (Verify Server Certificate, Virtual Domain (Host/SNI), Verification CA Profile, Client Certificate to Present (mTLS)) also appear.

3

Adım 3 Turn on authentication

LDAP Authentication is turned on; LDAP Username (e.g. cn=probe,dc=example,dc=com) and LDAP Password are entered.

4

Adım 4 Save the profile

The Add button is clicked.

5

Adım 5 Open the Backend Service form

On the Load Balancer → Backend Services screen, the Backend Service of the LDAP server is right-clicked and Edit is selected.

6

Adım 6 Select the profile

The profile is selected in the Health Check field.

7

Adım 7 Save

The Edit button is clicked.

Verification

1Health statusBackend Services list

The indicator in the Health column of the Backend Services list is checked; if the bind fails, the error text appears in the Health Check card in the preview (Health status indicator).

ExpectedOK (green)

Method 2: SMTP and Use STARTTLS

• How it works The check waits for the server's 220 greeting message, sends EHLO and waits for the 250 response; if Use STARTTLS is on, it switches to TLS with STARTTLS and sends EHLO again. In SMTPS, the connection is established with TLS from the start. Authentication (AUTH) is not performed.
• Where it is openedLoad Balancer → Profiles → Health Checks → Add → Check Type: SMTP / SMTPS
• Requirement A Backend Service whose address is the mail server and port
• vService type All

Step-by-Step Configuration

1

Adım 1 Open the Health Checks form

The Load Balancer → Profiles → Health Checks path is followed and Add is clicked.

2

Adım 2 Enter the name and type

Name is entered; in the Check Type field, SMTP is selected for a server that uses STARTTLS, and SMTPS for a server that uses TLS directly.

3

Adım 3 Enter the EHLO name

The name to be reported to the server is written in the EHLO Hostname field; if it is left empty, tr7-hc is sent.

4

Adım 4 Turn on STARTTLS

In the SMTP type, Use STARTTLS is turned on (off by default); the Verify Server Certificate, Virtual Domain (Host/SNI), Verification CA Profile and Client Certificate to Present (mTLS) fields appear and are filled in if needed (Can certificate verification be done in an HTTPS health check?). In the SMTPS type, these fields appear directly, and Use STARTTLS is not present.

5

Adım 5 Save the profile

The Add button is clicked.

6

Adım 6 Open the Backend Service form

On the Load Balancer → Backend Services screen, the Backend Service of the mail server is right-clicked and Edit is selected.

7

Adım 7 Select the profile

The profile is selected in the Health Check field.

8

Adım 8 Save

The Edit button is clicked.

Verification

1Health statusBackend Services list

The indicator in the Health column of the Backend Services list is checked; the check duration is seen in the Health Check Time panel on the Dashboard.

ExpectedOK (green)

Method 3: FTP Login and Directory Listing

• How it works The check always logs in with FTP User and FTP Password; if onlyLogin is selected in the FTP Action field, the login must succeed, and if loginAndList is selected, the FTP Path directory must also be listable.
• Where it is openedLoad Balancer → Profiles → Health Checks → Add → Check Type: FTP / FTPS
• Requirement A check account that has only read permission
• vService type All

Step-by-Step Configuration

1

Adım 1 Open the Health Checks form

The Load Balancer → Profiles → Health Checks path is followed and Add is clicked.

2

Adım 2 Enter the name and type

Name is entered; FTP or FTPS is selected in the Check Type field. In FTPS, the TLS fields also appear.

3

Adım 3 Enter the account

FTP User and FTP Password are entered; both are required.

4

Adım 4 Select the action

onlyLogin or loginAndList is selected in the FTP Action field; with loginAndList, the directory to be listed is written in the FTP Path field that appears (e.g. /).

5

Adım 5 Save the profile

The Add button is clicked.

6

Adım 6 Open the Backend Service form

On the Load Balancer → Backend Services screen, the Backend Service of the file server is right-clicked and Edit is selected.

7

Adım 7 Select the profile

The profile is selected in the Health Check field.

8

Adım 8 Save

The Edit button is clicked.

Verification

1Health statusBackend Services list

The indicator in the Health column of the Backend Services list is checked (Health status indicator).

ExpectedOK (green)

Method 4: WEB-CLI

• How it works The type-specific fields are written with lb hc add; ldapUsername, ldapPassword (ldap, ldaps) and ftpUser (ftp, ftps) are required and are written without a prefix; the FTP password is asked for hidden when the command is run.
• Where it is opened WEB-CLI → lb hc add (lb hc · The FTP, LDAP, SMTP and Oracle Fields)
• Requirement WEB-CLI access
• vService type All

Step-by-Step Configuration

1

Adım 1 Create the LDAP profile

lb hc add checkType ldap name ldap-denetimi ldapUsername cn=probe,dc=example,dc=com ldapPassword <password> --ldapAuth true

2

Adım 2 Create the SMTP profile

lb hc add checkType smtp name smtp-denetimi --smtpHelo tr7-hc --smtpStartTls true

3

Adım 3 Create the FTP profile

lb hc add checkType ftp name ftp-denetimi ftpUser probe --ftpAction loginAndList --ftpPath /

ftpPassword is asked for hidden when the command is run.

4

Adım 4 Assign the profile

The profile ID is taken from the lb hc list output, and the Backend Service ID from the lb backend list output:

lb backend update id <backend-id> --hc <profile-id>

Verification

1RecordWEB-CLI

The profile record is displayed.

Commandlb hc show <profile-id>

ExpectedldapAuth true

Common Mistakes

• Looking for STARTTLS in LDAP. The LDAP type has no STARTTLS; LDAPS is used for an encrypted check.
• Looking for a user name and password in SMTP. The SMTP check does not perform authentication; it verifies the greeting, EHLO and optional STARTTLS steps.
• Using a privileged account for the check. The password is stored in the profile; a separate account that has only read permission is used.
• Expecting the FTP path with onlyLogin. The FTP path field appears and is used only while loginAndList is selected.

How it is done in the documentation

• Health Checks · LDAP Authentication
• Health Checks · Use STARTTLS
• Health Checks · FTP Action
• WEB-CLI · lb hc · The FTP, LDAP, SMTP and Oracle Fields

Related questions

• Can I load balance LDAP / Active Directory queries?
• Can I load balance SMTP / mail servers?
• Which health check types are supported?