openldap-software

openldap-software@openldap.org

2719 discussions

openldap+TLS 'works', but slapd.log reports "err=13 text=TLS confidentiality required" @ slapd start
by Ben Wailea, openldap-software 22 Aug '08

22 Aug '08

i've set up openldap for use with TLS. it launches ok, ps ax | grep slapd 27182 pts/1 S<+ 0:00 tail -f slapd.log 31441 ? S<sl 0:00 /usr/lib/openldap/slapd -h ldap://ldap.domain.com:389 -f /etc/openldap/slapd.conf -u ldap -g ldap -4 -o slp=on ldapadd & ldapsearch seem to work over TLS as well, ldapadd -ZZ -x -D "cn=admin,dc=domain,dc=com" -f /etc/openldap/admin.ldif -w 'secret' adding new entry "dc=domain,dc=com" adding new entry "cn=admin,dc=domain,dc=com" ldapsearch -v -ZZ -x -D 'cn=admin,dc=domain,dc=com' -b 'dc=domain,dc=com' '(objectclass=*)' -w 'secret' ldap_initialize( <DEFAULT> ) filter: (objectclass=*) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <dc=domain,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # domain.com dn: dc=domain,dc=com objectClass: dcObject objectClass: organization o: DOMAIN dc: domain # admin, domain.com dn: cn=admin,dc=domain,dc=com objectClass: organizationalRole cn: admin # search result search: 3 result: 0 Success # numResponses: 3 # numEntries: 2 with slapd.log showing, Aug 22 11:17:07 ldap slapd[31441]: conn=12 fd=12 ACCEPT from IP=192.168.1.17:34861 (IP=192.168.1.17:389) Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=0 STARTTLS Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=0 RESULT oid= err=0 text= Aug 22 11:17:07 ldap slapd[31441]: conn=12 fd=12 TLS established tls_ssf=256 ssf=256 Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=1 BIND dn="cn=admin,dc=domain,dc=com" method=128 Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=1 BIND dn="cn=admin,dc=domain,dc=com" mech=SIMPLE ssf=0 Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=1 RESULT tag=97 err=0 text= Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=2 SRCH base="dc=domain,dc=com" scope=2 deref=0 filter="(objectClass=*)" Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=2 SEARCH RESULT tag=101 err=0 nentries=2 text= Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=3 UNBIND Aug 22 11:17:07 ldap slapd[31441]: conn=12 fd=12 closed but, on slapd service (re)start, i see in slapd.log, Aug 22 11:02:47 ldap slapd[31441]: slapd starting Aug 22 11:02:48 ldap slapd[31441]: conn=0 fd=12 ACCEPT from IP=192.168.1.17:42320 (IP=192.168.1.17:389) Aug 22 11:02:48 ldap slapd[31441]: conn=0 op=0 BIND dn="" method=128 Aug 22 11:02:48 ldap slapd[31441]: conn=0 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:48 ldap slapd[31441]: conn=0 fd=12 closed (connection lost) Aug 22 11:02:49 ldap slapd[31441]: conn=1 fd=12 ACCEPT from IP=192.168.1.17:42321 (IP=192.168.1.17:389) Aug 22 11:02:49 ldap slapd[31441]: conn=1 op=0 BIND dn="" method=128 Aug 22 11:02:49 ldap slapd[31441]: conn=1 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:49 ldap slapd[31441]: conn=1 fd=12 closed (connection lost) Aug 22 11:02:50 ldap slapd[31441]: conn=2 fd=12 ACCEPT from IP=192.168.1.17:42322 (IP=192.168.1.17:389) Aug 22 11:02:50 ldap slapd[31441]: conn=2 op=0 BIND dn="" method=128 Aug 22 11:02:50 ldap slapd[31441]: conn=2 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:50 ldap slapd[31441]: conn=2 fd=12 closed (connection lost) Aug 22 11:02:51 ldap slapd[31441]: conn=3 fd=12 ACCEPT from IP=192.168.1.17:42323 (IP=192.168.1.17:389) Aug 22 11:02:51 ldap slapd[31441]: conn=3 op=0 BIND dn="" method=128 Aug 22 11:02:51 ldap slapd[31441]: conn=3 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:51 ldap slapd[31441]: conn=3 fd=12 closed (connection lost) Aug 22 11:02:52 ldap slapd[31441]: conn=4 fd=12 ACCEPT from IP=192.168.1.17:42324 (IP=192.168.1.17:389) Aug 22 11:02:52 ldap slapd[31441]: conn=4 op=0 BIND dn="" method=128 Aug 22 11:02:52 ldap slapd[31441]: conn=4 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:52 ldap slapd[31441]: conn=4 fd=12 closed (connection lost) Aug 22 11:02:53 ldap slapd[31441]: conn=5 fd=12 ACCEPT from IP=192.168.1.17:42325 (IP=192.168.1.17:389) Aug 22 11:02:53 ldap slapd[31441]: conn=5 op=0 BIND dn="" method=128 Aug 22 11:02:53 ldap slapd[31441]: conn=5 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:53 ldap slapd[31441]: conn=5 fd=12 closed (connection lost) Aug 22 11:02:54 ldap slapd[31441]: conn=6 fd=12 ACCEPT from IP=192.168.1.17:42326 (IP=192.168.1.17:389) Aug 22 11:02:54 ldap slapd[31441]: conn=6 op=0 BIND dn="" method=128 Aug 22 11:02:54 ldap slapd[31441]: conn=6 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:54 ldap slapd[31441]: conn=6 fd=12 closed (connection lost) Aug 22 11:02:55 ldap slapd[31441]: conn=7 fd=12 ACCEPT from IP=192.168.1.17:42327 (IP=192.168.1.17:389) Aug 22 11:02:55 ldap slapd[31441]: conn=7 op=0 BIND dn="" method=128 Aug 22 11:02:55 ldap slapd[31441]: conn=7 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:55 ldap slapd[31441]: conn=7 fd=12 closed (connection lost) Aug 22 11:02:56 ldap slapd[31441]: conn=8 fd=12 ACCEPT from IP=192.168.1.17:42328 (IP=192.168.1.17:389) Aug 22 11:02:56 ldap slapd[31441]: conn=8 op=0 BIND dn="" method=128 Aug 22 11:02:56 ldap slapd[31441]: conn=8 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:56 ldap slapd[31441]: conn=8 fd=12 closed (connection lost) what are these multiple connection "text=TLS confidentiality required" errors due to? i'm guessing it has to do with security restrictions set in slapd.conf. reading @ http://www.openldap.org/doc/admin24/security.html, i've, ... security ssf=256 tls=256 update_tls=256 simple_bind=256 disallow tls_2_anon require bind LDAPv3 ... are these settings correct, and/or are they resposible for those slapd.log messages? something else?

3 4

Re: openldap+TLS 'works', but slapd.log reports "err=13 text=TLS confidentiality required" @ slapd start
by Quanah Gibson-Mount 22 Aug '08

22 Aug '08

--On Friday, August 22, 2008 1:52 PM -0700 "Ben Wailea, openldap-software" <bwailea+10(a)gmail.com> wrote: You're entirely missing my point. You've noted what your setup is, and the changes you made. Once you made those changes and restarted the server, some connections started failing. Your logs show what IP address those connections are coming from, but since they are being blocked by the changes you made, there's really no data on what client is making those connections. The only person who can track down what clients are trying to bind *without* TLS is you. You may not like that answer, but it isn't going to change. You're original question posed at the end of your email was is this the expected behavior for those settings, and the answer is yes. If you block clients that are not using TLS from binding, then they are going to fail to bind once the changes are in effect. Now, does your ldapsearch command with -ZZ continue to work after there restart? What other processes have you configured to access the LDAP server from the local host? nscd? nss_ldap? etc. Look at those things. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Error during ./configure
by Philip Gabrielsen 22 Aug '08

22 Aug '08

Hi I get an error i can't get away from, when running ./configure Error i get: philip@zimba:/usr/local/openldap-2.4.11$ ./configure Configuring OpenLDAP 2.4.11-Release ... checking build system type... i686-pc-linux-gnulibc1 checking host system type... i686-pc-linux-gnulibc1 checking target system type... i686-pc-linux-gnulibc1 checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... no checking for mawk... mawk checking whether make sets $(MAKE)... yes checking configure arguments... done checking for ar... ar checking for style of include used by make... GNU checking for gcc... /usr/lib/gcc/i486-linux-gnu/4.0.3/cc1 checking for C compiler default output file name... conftest.s checking whether the C compiler works... configure: error: cannot run C compiled programs. If you meant to cross compile, use `--host'. See `config.log' for more details. Config.log (interesting place) gives me: configure:4052: checking for style of include used by make configure:4080: result: GNU configure:4151: checking for gcc configure:4177: result: /usr/lib/gcc/i486-linux-gnu/4.0.3/cc1 configure:4421: checking for C compiler version configure:4424: /usr/lib/gcc/i486-linux-gnu/4.0.3/cc1 --version </dev/null >&5 GNU C version 4.0.3 (Ubuntu 4.0.3-1ubuntu5) (i486-linux-gnu) compiled by GNU C version 4.0.3 (Ubuntu 4.0.3-1ubuntu5). GGC heuristics: --param ggc-min-expand=64 --param ggc-min-heapsize=64440 configure:4427: $? = 0 configure:4429: /usr/lib/gcc/i486-linux-gnu/4.0.3/cc1 -v </dev/null >&5 ignoring nonexistent directory "/usr/local/include/i486-linux-gnu" ignoring nonexistent directory "/usr/include/i486-linux-gnu" #include "..." search starts here: #include <...> search starts here: /usr/local/include /usr/lib/gcc/i486-linux-gnu/4.0.3/include /usr/include End of search list. Execution times (seconds) TOTAL : 0.01 0.00 0.01 configure:4432: $? = 0 configure:4434: /usr/lib/gcc/i486-linux-gnu/4.0.3/cc1 -V </dev/null >&5 cc1: error: unrecognized command line option "-V" Execution times (seconds) TOTAL : 0.00 0.00 0.00 configure:4437: $? = 1 configure:4460: checking for C compiler default output file name configure:4463: /usr/lib/gcc/i486-linux-gnu/4.0.3/cc1 conftest.c >&5 main Execution times (seconds) TOTAL : 0.00 0.02 0.01 configure:4466: $? = 0 configure:4512: result: conftest.s configure:4517: checking whether the C compiler works configure:4523: ./conftest.s ./configure: line 4524: ./conftest.s: Permission denied configure:4526: $? = 126 configure:4535: error: cannot run C compiled programs. If you meant to cross compile, use `--host'. See `config.log' for more details. I run this as root.... Best Regards Philip Gabrielsen Mob: 99384335

3 2

how to migrate openldap from one server to another
by Naveen.X1.Sarabu＠chase.com 22 Aug '08

22 Aug '08

Hi I am very new to linux and openLDAP. Can any one please let me know how can I migrate openLDAP from one server to another. here is the description: currently we have a master LDAP and a slave. we are in the process of building 2 new servers to migrate the existing LDAP to the new servers. so can any one please let me know the steps need be taken to achieve this task. OS ( New server ) : RHEL AS 4 open ldap version ( on old server ) : 2.2.13-6.4E open ldap version ( on new server ) : 2.2.13-8.el4_6.4 please let me know if you need any conf information. Thanks in advance. -NS ----------------------------------------- This transmission may contain information that is privileged, confidential, legally privileged, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. Although this transmission and any attachments are believed to be free of any virus or other defect that might affect any computer system into which it is received and opened, it is the responsibility of the recipient to ensure that it is virus free and no responsibility is accepted by JPMorgan Chase & Co., its subsidiaries and affiliates, as applicable, for any loss or damage arising in any way from its use. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you.

3 2

OpenLDAP on Windows XP possible?
by Administrator 22 Aug '08

22 Aug '08

I have an assignment to get OpenLDAP up and running on WindowsXP for a demo. The only thing I can find is a tar.gz which I unpacked, so now how do I get it installed on XP? I mostly see documentation for Unix/Linux systems but nothing as far as "Getting Started on XP" or anything windows related. thanks JavaTek

6 5

slapd hangs
by Curt Blank 21 Aug '08

21 Aug '08

Version 2.2.28 Periodically the slapd daemon hangs. I did a gstack (attached) which doesn't contain a lot of information but the one thing that stands out is at the top it says "Thread 18" and I have threads set to 16, is it somehow trying to create more then it is suppose to thus causing a problem? -- Curt Blank Systems Administrator Technical Services Specialist University Information Technology Services University of Wisconsin-Milwaukee e-mail: curt(a)uwm.edu phone : (414) 229-3814

3 3

Multimaster SASL/EXTERNAL (TLS client cert) error
by Gémes Géza 18 Aug '08

18 Aug '08

Hi everyone! I've set up two test ldap servers (2.4.10) with multimaster replication. With simple binds it is working well. I've set up a client certificate (everything CA signed, no self-signing ;-) ) to use with SASL/EXTERNAL authentication. Using olcAuthzRegexp I've mapped it to the rootdn of the cn=config backend, set up an .ldaprc file and with: su -c '/usr/bin/ldapwhoami' openldap -s /bin/sh (I'm running slapd as openldap user and group) I get: SASL/EXTERNAL authentication started SASL username: cn=LDAP Syncrepl Client,ou=LDAP Server,o=Kossuth Zsuzsanna SZKI,l=Dabas,st=Pest,c=HU SASL SSF: 0 dn:cn=config just like expected (ldapsearch and friends are also working on both sides and cross). Just to be sure I've exported the LDAPCONF variable in the slapd startup script. But syncrepl doesn't work! On the logs (olcLogLevel=-1): slap_client_connect: URI=ldaps://first-or-second-ldap-server ldap_sasl_interactive_bind_s failed (-6) connection_read(20): unable to get TLS client DN, error=49 id=23 Many thanks! Geza

4 6

Re: syncrepl binds with no password
by Bill Whiting 18 Aug '08

18 Aug '08

Gavin Henry wrote: > ----- "Bill Whiting" <textux(a)bellsouth.net> wrote: > > >> I'm trying to setup a simple replication. >> I configured syncrepl in the consumer to use the user syncuser to >> access >> the master ldap but when it connects to the master it does not send >> the >> password for syncuser, so the master errors with: >> >> unauthenticated bind (DN with no password) disallowed >> >> >> Here's the replication definition in the consumer: >> >> syncprov-checkpoint 100 10 >> syncrepl rid=000 >> provider=ldap://192.168.77.218 >> type=refreshOnly >> interval=00:00:02:00 >> retry="5 5 300 +" >> searchbase="dc=idi-test,dc=com" >> attrs=* >> bindmethod=simple >> binddn="uid=syncuser,ou=People,dc=idi-test,dc=com" >> credentials={SHA}jHXtTHIeoSUGGge0YOB5dJQeXf4= >> > > credentials contains the unencrypted password. > Thanks, that corrected the no password problem. The consumer is replicating. //Bill

1 0

syncrepl binds with no password
by Bill Whiting 18 Aug '08

18 Aug '08

I'm trying to setup a simple replication. I configured syncrepl in the consumer to use the user syncuser to access the master ldap but when it connects to the master it does not send the password for syncuser, so the master errors with: unauthenticated bind (DN with no password) disallowed Here's the replication definition in the consumer: syncprov-checkpoint 100 10 syncrepl rid=000 provider=ldap://192.168.77.218 type=refreshOnly interval=00:00:02:00 retry="5 5 300 +" searchbase="dc=idi-test,dc=com" attrs=* bindmethod=simple binddn="uid=syncuser,ou=People,dc=idi-test,dc=com" credentials={SHA}jHXtTHIeoSUGGge0YOB5dJQeXf4= What am I missing? //Bill Whiting

2 1

Re: LDAP Replication +TLS +Self-signed certificate.
by k bah 18 Aug '08

18 Aug '08

> ----- Original Message ----- > From: "Howard Chu" <hyc(a)symas.com> > To: "k bah" <kbah(a)linuxmail.org> > Subject: Re: LDAP Replication +TLS +Self-signed certificate. > Date: Fri, 15 Aug 2008 03:34:19 -0700 > > > k bah wrote: > > Hi, > > > > I have LDAP replication setup (slurpd), works fine. Until a while ago I had a > CA certificate, and with that one I signed other two certificates, for two > different hosts. So I had 3 "hosts", one is the CA, another one is LDAP Master > and the last the ldap slave. Configuration on both master and slave slapd.conf > had: > > > TLSCertificateFile /etc/openldap/"this"-machine-certificate.crt > > TLSCertificateKeyFile /etc/openldap/"this"-machine-key.key > > TLSCACertificateFile /etc/openldap/"the-ca"-machine-cert.crt > > That sounds like a correct configuration. > > > Now I changed the certificates, both the Master and Slave machines use self > > signed certificates, I changed the certificates/tls config on several > > services that used it, they work fine, but LDAP replication stopped > > working. > > That is a bad configuration. The old saying applies - "if it ain't > broke, don't fix it." Your original config was fine... I tried this (and I guess it makes sense): LDAP Master slapd.conf: TLSCertificateFile /etc/openldap/ldap-master-cert.crt (self-signed certificate) TLSCertificateKeyFile /etc/openldap/ldap-master-key.key TLSCACertificateFile /etc/openldap/ldap-master-cert.crt LDAP Slave slapd.conf: TLSCertificateFile /etc/openldap/ldap-slave-cert.crt (self-signed certificate) TLSCertificateKeyFile /etc/openldap/ldap-slave-key.key TLSCACertificateFile /etc/openldap/ldap-slave-cert.crt LDAP Master ldap.conf: TLS_CACERT /etc/openldap/ldap-slave-cert.crt (Since when replicating, the master server acts as a client to the ldap slave server, right?) Quoting the slurpd man page: "Note that slurpd reads replication directive from slapd.conf(5), but uses ldap.conf(5) to obtain other configuration settings (such as TLS settings)." LDAP Slave ldap.conf: TLS_CACERT /etc/openldap/ldap-master-cert.crt (I can't figure out now why, does the LDAP slave server act as a client to the ldap master server? When?) > > If you're replacing certs because they expired or some other > reason, just duplicate the structure you had originally. Create one > self-signed CA cert, then create your server certs and use your CA > cert to sign all the other certs. Then distribute your CA cert to > all the client machines as usual. = Don't Just See Alaska, Experience It Active, Informative, Fun! Alaska Adventure Tours. Live Large. http://a8-asy.a8ww.net/a8-ads/adftrclick?redirectid=3fac59fd070fca088e31eea… -- Powered by Outblaze

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software