openldap-bugs

openldap-bugs@openldap.org

1 participants
20962 discussions

Re: (ITS#7398) Retrieve LDAP server cert
by michael＠stroeder.com 22 Sep '12

22 Sep '12

This is a cryptographically signed message in MIME format. --------------ms000108080605020401040901 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Kurt Zeilenga wrote: > Why not just get it from TLS?=20 What exactly do you mean? Ciao, Michael. --------------ms000108080605020401040901 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILHzCC BT8wggQnoAMCAQICDwCmSwABAAIAivjZQ8SBvzANBgkqhkiG9w0BAQUFADB8MQswCQYDVQQG EwJERTEcMBoGA1UEChMTVEMgVHJ1c3RDZW50ZXIgR21iSDElMCMGA1UECxMcVEMgVHJ1c3RD ZW50ZXIgQ2xhc3MgMSBMMSBDQTEoMCYGA1UEAxMfVEMgVHJ1c3RDZW50ZXIgQ2xhc3MgMSBM MSBDQSBJWDAeFw0xMjA2MDYxOTAyMTZaFw0xMzA2MDcxOTAyMTZaMCgxCzAJBgNVBAYTAkRF MRkwFwYDVQQDDBBNaWNoYWVsIFN0csO2ZGVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAxXZGav40rnGNLxEggBW94MILWHlfC8a23Jew5U1gPlfRTXOjjzmoaZ1uCyGdgF6M VvuO9T1aTQNGH+OdeGe3P7Tfc/NsLJFJ2wtd8blvhmodUgse2eypiWjNOd4gZuhalBhgsQ0K b5D6/1foghII4E264iZlJ7AJ+UYcO+GxvFWT0YMTbLckgDkZk7c3qwTozdhYvXarvqx+8Ou/ kuxpQQhac/ebzxpu0N+RHSf2KIUS0g0tEGnPtGv6iL+9QNHc4JKo9Y9KKVw3tQy+Re+FQLxB 1fPE5F+qxuD3AUENpOwkMsqWLM94ohtx3CFqLpxfUPrnKFLAHOhHEbByYGvFPwIDAQABo4IC EDCCAgwwgaUGCCsGAQUFBwEBBIGYMIGVMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnRydXN0 Y2VudGVyLmRlL2NlcnRzZXJ2aWNlcy9jYWNlcnRzL3RjX2NsYXNzMV9MMV9DQV9JWC5jcnQw QAYIKwYBBQUHMAGGNGh0dHA6Ly9vY3NwLml4LnRjY2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1 c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAU6bgoHUbP/M34TpvF7ktg69g7P9EwDAYDVR0TAQH/ BAIwADBKBgNVHSAEQzBBMD8GCSqCFAAsAQEBATAyMDAGCCsGAQUFBwIBFiRodHRwOi8vd3d3 LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwDgYDVR0PAQH/BAQDAgTwMB0GA1UdDgQWBBS2 KAWfTfgJ/JQ63qLGwTXYLnI+LzBiBgNVHR8EWzBZMFegVaBThlFodHRwOi8vY3JsLml4LnRj Y2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1c3RjZW50ZXIuZGUvY3JsL3YyL3RjX0NsYXNzMV9M MV9DQV9JWC5jcmwwMwYDVR0lBCwwKgYIKwYBBQUHAwIGCCsGAQUFBwMEBggrBgEFBQcDBwYK KwYBBAGCNxQCAjAfBgNVHREEGDAWgRRtaWNoYWVsQHN0cm9lZGVyLmNvbTANBgkqhkiG9w0B AQUFAAOCAQEAQ3bvVUpEq+cQrLpcogyt5BJNk/WvUvOHqhzyj28M9pg9hcDl1+MYl5qqj6tR GSTLPQZyf287pcmbMwbcTGZO/gbW9v7RYcut6RauWdwKMCUmKC3J4fVfDq9ZETA2WOV68ef4 B3Gzdhghsbp3Rhp5dDmrCVKAHlafm6ZwJrEQ9P76fxnQZzRLgeKpZep5ePH5YHUB3+YaOQvJ FG0bOXvfHhRiRG7/HW2G+yDgjHSxDz8AFzMWL/RFePqZ4pn6T/SM/qU6WEpW39MWyJNoH/Kx QDYK8gGYuesn1ciMCTnjrvZQj0fonGTO4SfWekJRkuGrJ7dYSZRjYbDcWBBkdFLWzzCCBdgw ggTAoAMCAQICDgboAAEAAkqWLSQM/sXJMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNVBAYTAkRF MRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSQwIgYDVQQLExtUQyBUcnVzdENlbnRl ciBVbml2ZXJzYWwgQ0ExJjAkBgNVBAMTHVRDIFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQSBJ MB4XDTA5MTEwMzE0MDgxOVoXDTI1MTIzMTIxNTk1OVowfDELMAkGA1UEBhMCREUxHDAaBgNV BAoTE1RDIFRydXN0Q2VudGVyIEdtYkgxJTAjBgNVBAsTHFRDIFRydXN0Q2VudGVyIENsYXNz IDEgTDEgQ0ExKDAmBgNVBAMTH1RDIFRydXN0Q2VudGVyIENsYXNzIDEgTDEgQ0EgSVgwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC75pBuz2Lp6QuqthDVR+V8XSsncZpozVVt 5KLv5P7yemMRwleKyH3PjmYfZUVL64Biab1GjovFblqVGCrep/EfdRonq20yU+P7TVhiLP8Z 5cegDZotIYhZhM0d8cPIij6w5d4IJM/8QCy6QSOUu4ASiTVItoYE4AFPjLqpmPwcie0fiqHH hpgmHnJla/7PZdkMZEsaCfVDEWBmJuMzVprJPT40anjG5VBLyM2I5DlsUCaeQCy2O3w3sqf1 3dyzUcv03IICuNc63towXA31Qt0TaVNU6YAmQjMepdfMbspmCZ+G8D2+xophEPPR/1vkstst smUMqX0XrLonTUJczglPAgMBAAGjggJZMIICVTCBmgYIKwYBBQUHAQEEgY0wgYowUgYIKwYB BQUHMAKGRmh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvY2VydHNlcnZpY2VzL2NhY2VydHMv dGNfdW5pdmVyc2FsX3Jvb3RfSS5jcnQwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLnRjdW5p dmVyc2FsLUkudHJ1c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAUkqR1LKSevoFE63n8isWVpesQ dXMwEgYDVR0TAQH/BAgwBgEB/wIBADBSBgNVHSAESzBJMAYGBFUdIAAwPwYJKoIUACwBAQEB MDIwMAYIKwYBBQUHAgEWJGh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lczAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFOm4KB1Gz/zN+E6bxe5LYOvYOz/RMIH9BgNVHR8E gfUwgfIwge+ggeyggemGRmh0dHA6Ly9jcmwudGN1bml2ZXJzYWwtSS50cnVzdGNlbnRlci5k ZS9jcmwvdjIvdGNfdW5pdmVyc2FsX3Jvb3RfSS5jcmyGgZ5sZGFwOi8vd3d3LnRydXN0Y2Vu dGVyLmRlL0NOPVRDJTIwVHJ1c3RDZW50ZXIlMjBVbml2ZXJzYWwlMjBDQSUyMEksTz1UQyUy MFRydXN0Q2VudGVyJTIwR21iSCxPVT1yb290Y2VydHMsREM9dHJ1c3RjZW50ZXIsREM9ZGU/ Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlPzANBgkqhkiG9w0BAQUFAAOCAQEAOcjE m+6+mO5Icm+N53G2DpCM07LBFSGoRpBoX0oE8TrJaIQh2KXmBHVdn9LU8kt3QzLclctgvwJV 0KwcsMUUl5tlCsMPpR3s2Ek5lbWpvvr0HqtW56blAQiINV9nBd1EJFASIkRjefGbV2nOq9Yz UU+N8HA7jq1ROhd/NZZraGhjthwKyfjfHV7PKxGlY+3M0MbTIG+q/GhIfm0euDpFqhKG88e9 ALXr/uoSn3MzeOcoOWjTpW3adtFO4VWVgKbgG7jNrFbvRVlHmFLbOm4msjE5aXWxLiTwpJ2X iF4zKca1vAdAOgw9us90jEtOeiH6GzjNxEMvb7TfeO6Zkuc6HDGCA84wggPKAgEBMIGPMHwx CzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQLExxU QyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRlciBD bGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wCQYFKw4DAhoFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIwOTIyMTE0NDE1WjAjBgkq hkiG9w0BCQQxFgQURaD6VwBCA23yunm+7WIzNVeHwy4wbAYJKoZIhvcNAQkPMV8wXTALBglg hkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggq hkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBoAYJKwYBBAGCNxAEMYGSMIGP MHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQL ExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRl ciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wgaIGCyqGSIb3DQEJEAILMYGS oIGPMHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYD VQQLExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENl bnRlciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wDQYJKoZIhvcNAQEBBQAE ggEAVLqeOPOWTaONCtPgeSsDnNeEDd3Wm+5GnNHIeQoyKHVQOrRFiSJrdeaAAv1xqOZK/1F4 4npTnQiIEPtSAU6iMJcutUc2MSlpuGRen3tIsYKi+Ku+KYRLUjaQoN/nqaej0HuLhOUfQwmw vftzkmCz465NABCJXdY4mUttnITa3dE2aVZ7lTgaXqNnjxk1IF709FTnA4+dQUxB94QfjDLU GIphLSYjU/KMJr/hcfWouBPX08MLEOllmx19gs8ynLwLK4sFuJyL9J0+Om/VfRNWTikgngUf VbQE9ovQDNDWO4qU+VEA9uJJ/v9iKNPuh00YBNAgRnBNnraWlkpmER83+gAAAAAAAA== --------------ms000108080605020401040901--

1 0

Re: (ITS#7398) Retrieve LDAP server cert
by Kurt＠OpenLDAP.org 22 Sep '12

22 Sep '12

Why not just get it from TLS? -- Kurt

1 0

Re: (ITS#7398) Retrieve LDAP server cert
by michael＠stroeder.com 21 Sep '12

21 Sep '12

On Fri, 21 Sep 2012 10:43:42 -0700 Howard Chu <hyc(a)symas.com> wrote > michael(a)stroeder.com wrote: > > Feature request: > > When using LDAPS or StartTLS it would be sometimes handy to retrieve the > > LDAP server certificate over the LDAP client API. > > > > Opinions? > > And then what? I think it'd be straightforward for us to return a copy of it > in DER binary format. What do clients need to do with it? In my case (web2ldap): Simply display it to the user. If it's not too much work this would be a handy feature. Ciao, Michael.

1 0

Re: (ITS#7398) Retrieve LDAP server cert
by hyc＠symas.com 21 Sep '12

21 Sep '12

michael(a)stroeder.com wrote: > Full_Name: Michael Ströder > Version: > OS: > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (2001:8d8:1fe:1:d6be:d9ff:fe06:a14f) > > > Feature request: > When using LDAPS or StartTLS it would be sometimes handy to retrieve the LDAP > server certificate over the LDAP client API. > > Opinions? And then what? I think it'd be straightforward for us to return a copy of it in DER binary format. What do clients need to do with it? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7393) slapd crash when changing an attribute name to an existing name
by hyc＠symas.com 21 Sep '12

21 Sep '12

ddick(a)cpan.org wrote: > Full_Name: David Dick > Version: 2.4.26 > OS: Fedora 16 > URL: > Submission from: (NULL) (124.148.129.18) > > > When changing the NAME of an attribute to the name of an existing attribute, the > slapd process crashes. Unable to reproduce this in current OpenLDAP. (2.4.32 is latest.) You need to upgrade, closing this ITS. > The following set of statements in ldif format will crash the server; > The cn={12} was chosen as the next available schema index and may need to be > adjusted appropriately. > > dn: cn={12}crashme,cn=schema,cn=config > changetype: add > objectClass: olcSchemaConfig > cn: {12}crashme > olcAttributeTypes: {0}( 1.3.6.1.4.1.70001.2.1 NAME 'SmtpHost' EQUALITY > caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) > > dn: cn={12}crashme,cn=schema,cn=config > changetype: modify > replace: olcAttributeTypes > olcAttributeTypes: {0}( 1.3.6.1.4.1.70001.2.1 NAME 'MailHost' EQUALITY > caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7398) Retrieve LDAP server cert
by michael＠stroeder.com 21 Sep '12

21 Sep '12

Full_Name: Michael Ströder Version: OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2001:8d8:1fe:1:d6be:d9ff:fe06:a14f) Feature request: When using LDAPS or StartTLS it would be sometimes handy to retrieve the LDAP server certificate over the LDAP client API. Opinions?

1 0

Re: (ITS#7388) [PATCH] MozNSS: ignore certdb 'sql:' prefix when checking directory existence
by jvcelak＠redhat.com 20 Sep '12

20 Sep '12

Hello, > I do not think that any other backend except the legacy and this one > is supported. Otherwise, I would write the patch more generally. I will > check with MozNSS people and let you know. Not sure if more types are supported, but at least sql: and dbm: (default) types work. I have uploaded an updated patch. Please, drop the old one. Jan ftp://ftp.openldap.org/incoming/jvcelak-20120920-moznss-ignore-certdb-type- prefix.patch The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat. Red Hat has not assigned rights and/or interest in this work to any party. I, Jan Vcelak am authorized by Red Hat, my employer, to release this work under the following terms. Red Hat hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

ITS#7396 published: SECURITY: ssl problem
by openldap-its＠OpenLDAP.org 20 Sep '12

20 Sep '12

Private ITS#7396 is now publicly readable URL: http://www.OpenLDAP.org/its/?findid=7396

1 0

ITS#7395 published: SECURITY: ssl problem
by openldap-its＠OpenLDAP.org 20 Sep '12

20 Sep '12

Private ITS#7395 is now publicly readable URL: http://www.OpenLDAP.org/its/?findid=7395

1 0

(ITS#7397) SSL　problem
by bjfanzh＠cn.ibm.com 20 Sep '12

20 Sep '12

Full_Name: zhang fan Version: 2.3.43 OS: RHEL5 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (202.108.130.138) Hi Jon I am an FVT member of CSTL system Z LDAP team . Now I　was configuring openldap with SSL support . But one problem came out and now I asked for your help .Thank you very much. My ldap server can work well before setting SSL . the ssl related option in slapd.conf is TLSCipherSuite ALL TLSCACertificateFile /etc/pki/tls/certs/slapd.pem TLSCertificateFile /etc/pki/tls/certs/slapd.pem TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem TLSVerifyClient never and I　use openssl to test connection . [root@zosmf07 ~]# openssl s_client -connect zosmf07.cn.ibm.com:636 -showcerts -s tate -CAfile /etc/pki/tls/certs/slapd.pem CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL3 alert read:fatal:handshake failure SSL_connect:error in SSLv2/v3 read server hello A 7587:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake fa ilure:s23_clnt.c:583: the server debug log look like this TLS trace: SSL3 alert write:fatal:handshake failure TLS trace: SSL_accept:error in SSLv3 read client hello B TLS trace: SSL_accept:error in SSLv3 read client hello B TLS: can't accept. TLS: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher s3_srvr.c:1009 But when I　issue openssl s_server to start the 636 port ,the ssl handshake can get success. [root@zosmf07 ~]# openssl s_server -accept 636 -cert /etc/pki/tls/certs/slapd.pem -key /etc/pki/tls/certs/slapd.pem -state Using default temp DH parameters ACCEPT SSL_accept:before/accept initialization SSL_accept:SSLv3 read client hello A SSL_accept:SSLv3 write server hello A SSL_accept:SSLv3 write certificate A SSL_accept:SSLv3 write key exchange A SSL_accept:SSLv3 write server done A SSL_accept:SSLv3 flush data SSL_accept:SSLv3 read client key exchange A SSL_accept:SSLv3 read finished A SSL_accept:SSLv3 write change cipher spec A SSL_accept:SSLv3 write finished A SSL_accept:SSLv3 flush data -----BEGIN SSL SESSION PARAMETERS----- MHUCAQECAgMBBAIAOQQgwtPmka9K2vuA3Eg6Vu8ZBGOIGiq2RVQBAR7/U//dIf4E MDXZOmotMZFmCsIV+5448cYBMN5zTGe6FJeVHxdu9KuEe0BYnZ69LW/GbLmNyemk 4KEGAgRQWUytogQCAgEspAYEBAEAAAA= -----END SSL SESSION PARAMETERS----- Shared ciphers:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC4-SHA:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5 CIPHER is DHE-RSA-AES256-SHA Secure Renegotiation IS supported Thank you very much for your help .This problem botherred me for two weeks .I tried many method but can't deal it .Thank you. ps: the above is a self-signed certificate . I tried CA , the same problem came out

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs