i've set up openldap for use with TLS.
it launches ok,
ps ax | grep slapd 27182 pts/1 S<+ 0:00 tail -f slapd.log 31441 ? S<sl 0:00 /usr/lib/openldap/slapd -h ldap://ldap.domain.com:389 -f /etc/openldap/slapd.conf -u ldap -g ldap -4 -o slp=on
ldapadd & ldapsearch seem to work over TLS as well,
ldapadd -ZZ -x -D "cn=admin,dc=domain,dc=com" -f /etc/openldap/admin.ldif -w 'secret' adding new entry "dc=domain,dc=com" adding new entry "cn=admin,dc=domain,dc=com"
ldapsearch -v -ZZ -x -D 'cn=admin,dc=domain,dc=com' -b 'dc=domain,dc=com' '(objectclass=*)' -w 'secret' ldap_initialize( <DEFAULT> ) filter: (objectclass=*) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <dc=domain,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # domain.com dn: dc=domain,dc=com objectClass: dcObject objectClass: organization o: DOMAIN dc: domain # admin, domain.com dn: cn=admin,dc=domain,dc=com objectClass: organizationalRole cn: admin # search result search: 3 result: 0 Success # numResponses: 3 # numEntries: 2
with slapd.log showing,
Aug 22 11:17:07 ldap slapd[31441]: conn=12 fd=12 ACCEPT from IP=192.168.1.17:34861 (IP=192.168.1.17:389) Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=0 STARTTLS Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=0 RESULT oid= err=0 text= Aug 22 11:17:07 ldap slapd[31441]: conn=12 fd=12 TLS established tls_ssf=256 ssf=256 Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=1 BIND dn="cn=admin,dc=domain,dc=com" method=128 Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=1 BIND dn="cn=admin,dc=domain,dc=com" mech=SIMPLE ssf=0 Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=1 RESULT tag=97 err=0 text= Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=2 SRCH base="dc=domain,dc=com" scope=2 deref=0 filter="(objectClass=*)" Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=2 SEARCH RESULT tag=101 err=0 nentries=2 text= Aug 22 11:17:07 ldap slapd[31441]: conn=12 op=3 UNBIND Aug 22 11:17:07 ldap slapd[31441]: conn=12 fd=12 closed
but, on slapd service (re)start, i see in slapd.log,
Aug 22 11:02:47 ldap slapd[31441]: slapd starting Aug 22 11:02:48 ldap slapd[31441]: conn=0 fd=12 ACCEPT from IP=192.168.1.17:42320 (IP=192.168.1.17:389) Aug 22 11:02:48 ldap slapd[31441]: conn=0 op=0 BIND dn="" method=128 Aug 22 11:02:48 ldap slapd[31441]: conn=0 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:48 ldap slapd[31441]: conn=0 fd=12 closed (connection lost) Aug 22 11:02:49 ldap slapd[31441]: conn=1 fd=12 ACCEPT from IP=192.168.1.17:42321 (IP=192.168.1.17:389) Aug 22 11:02:49 ldap slapd[31441]: conn=1 op=0 BIND dn="" method=128 Aug 22 11:02:49 ldap slapd[31441]: conn=1 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:49 ldap slapd[31441]: conn=1 fd=12 closed (connection lost) Aug 22 11:02:50 ldap slapd[31441]: conn=2 fd=12 ACCEPT from IP=192.168.1.17:42322 (IP=192.168.1.17:389) Aug 22 11:02:50 ldap slapd[31441]: conn=2 op=0 BIND dn="" method=128 Aug 22 11:02:50 ldap slapd[31441]: conn=2 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:50 ldap slapd[31441]: conn=2 fd=12 closed (connection lost) Aug 22 11:02:51 ldap slapd[31441]: conn=3 fd=12 ACCEPT from IP=192.168.1.17:42323 (IP=192.168.1.17:389) Aug 22 11:02:51 ldap slapd[31441]: conn=3 op=0 BIND dn="" method=128 Aug 22 11:02:51 ldap slapd[31441]: conn=3 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:51 ldap slapd[31441]: conn=3 fd=12 closed (connection lost) Aug 22 11:02:52 ldap slapd[31441]: conn=4 fd=12 ACCEPT from IP=192.168.1.17:42324 (IP=192.168.1.17:389) Aug 22 11:02:52 ldap slapd[31441]: conn=4 op=0 BIND dn="" method=128 Aug 22 11:02:52 ldap slapd[31441]: conn=4 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:52 ldap slapd[31441]: conn=4 fd=12 closed (connection lost) Aug 22 11:02:53 ldap slapd[31441]: conn=5 fd=12 ACCEPT from IP=192.168.1.17:42325 (IP=192.168.1.17:389) Aug 22 11:02:53 ldap slapd[31441]: conn=5 op=0 BIND dn="" method=128 Aug 22 11:02:53 ldap slapd[31441]: conn=5 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:53 ldap slapd[31441]: conn=5 fd=12 closed (connection lost) Aug 22 11:02:54 ldap slapd[31441]: conn=6 fd=12 ACCEPT from IP=192.168.1.17:42326 (IP=192.168.1.17:389) Aug 22 11:02:54 ldap slapd[31441]: conn=6 op=0 BIND dn="" method=128 Aug 22 11:02:54 ldap slapd[31441]: conn=6 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:54 ldap slapd[31441]: conn=6 fd=12 closed (connection lost) Aug 22 11:02:55 ldap slapd[31441]: conn=7 fd=12 ACCEPT from IP=192.168.1.17:42327 (IP=192.168.1.17:389) Aug 22 11:02:55 ldap slapd[31441]: conn=7 op=0 BIND dn="" method=128 Aug 22 11:02:55 ldap slapd[31441]: conn=7 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:55 ldap slapd[31441]: conn=7 fd=12 closed (connection lost) Aug 22 11:02:56 ldap slapd[31441]: conn=8 fd=12 ACCEPT from IP=192.168.1.17:42328 (IP=192.168.1.17:389) Aug 22 11:02:56 ldap slapd[31441]: conn=8 op=0 BIND dn="" method=128 Aug 22 11:02:56 ldap slapd[31441]: conn=8 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Aug 22 11:02:56 ldap slapd[31441]: conn=8 fd=12 closed (connection lost)
what are these multiple connection "text=TLS confidentiality required" errors due to?
i'm guessing it has to do with security restrictions set in slapd.conf.
reading @ http://www.openldap.org/doc/admin24/security.html, i've,
... security ssf=256 tls=256 update_tls=256 simple_bind=256 disallow tls_2_anon require bind LDAPv3 ...
are these settings correct, and/or are they resposible for those slapd.log messages? something else?