Problem Definition:
I have following sets of files on a linux host where my server is running.Again, I am trying ldapsearch command on same linux machine.
Certificate files on Server machine:ls -l /etc/openldap/CERTS/-rwxrwxrwx 1 root root 1265 Jan 16 18:04 cacert.pem-rwxrwxrwx 1 root root 3604 Jan 16 18:05 servercrt.pem-rwxrwxrwx 1 root root 1664 Jan 16 18:05 serverkey.pem--------------------------------------------------------------cat ldap.conf: /etc/openldap/ldap.confHOST 127.0.0.1PORT 636TLS_CACERTDIR /etc/openldap/CERTS/TLS_CACERT /etc/openldap/CERTS/cacert.pemTLS_REQCERT demandBASE dc=example,dc=com--------------------------------------------------------------cat slapd.conf : /etc/openldap/slapd.confinclude /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/redhat/rfc822-MailMember.schemainclude /etc/openldap/schema/redhat/autofs.schemainclude /etc/openldap/schema/redhat/kerberosobject.schema
access to *by self writeby users readby anonymous auth
TLSCipherSuite HIGH:MEDIUM:+SSLv2TLSCACertificateFile /etc/openldap/CERTS/cacert.pemTLSCertificateFile /etc/openldap/CERTS/servercrt.pemTLSCertificateKeyFile /etc/openldap/CERTS/serverkey.pem
database ldbmsuffix "dc=my-domain,dc=com"rootdn "cn=Manager,dc=my-domain,dc=com"directory /var/lib/ldapindex objectClass,uid,uidNumber,gidNumber,memberUid eqindex cn,mail,surname,givenname eq,subinitial--------------------------------------------------------------
Started ldap server with:1. /usr/sbin/slapd -f /etc/openldap/slapd.conf -d 127 -h ldaps:/// &
2. netstat shows that server is listening on port 636netstat -antp | grep slapd
When I executed follwing command on same server machine (linux host):ldapsearch -ZZ "CERTS/cacert.pem" -h 192.168.6.146 -p 636 -b "dc=my-domain,dc=com" -d 127
It gave error logs as below:
#ldapsearch -ZZ "CERTS/cacert.pem" -h 192.168.6.146 -p 636 -b "dc=my-domain,dc=com" -d 127ldap_createldap_extended_operation_sldap_extended_operationldap_send_initial_requestldap_new_connectionldap_int_open_connectionldap_connect_to_host: 192.168.6.146ldap_new_socket: 3ldap_prepare_socket: 3ldap_connect_to_host: Trying 192.168.6.146:636ldap_connect_timeout: fd: 3 tm: -1 async: 0ldap_ndelay_on: 3ldap_is_sock_ready: 3ldap_ndelay_off: 3ldap_open_defconn: successfulldap_send_server_requestber_flush: 31 bytes to sd 30000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.10010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037ldap_write: want=31, written=310000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.10010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037ldap_result msgid 1ldap_chkResponseList for msgid=1, all=1ldap_chkResponseList returns NULLwait4msg (infinite timeout), msgid 1wait4msg continue, msgid 1, all 1** Connections:refcnt: 2 status: Connectedlast used: Wed Jan 16 22:11:12 2008
** Outstanding Requests:* msgid 1, origid 1, status InProgressoutstanding referrals 0, parent count 0** Response Queue:Emptyldap_chkResponseList for msgid=1, all=1ldap_chkResponseList returns NULLdo_ldap_selectread1msg: msgid 1, all 1ber_get_nextldap_read: want=1, got=0
ber_get_next failed.ldap_perrorldap_start_tls: Can't contact LDAP server
TRIAL 2Start server with start_ssl1. /usr/sbin/slapd -f /etc/openldap/slapd.conf -d 127 start_ssl &
Here netstat shows that server is listening on 389 and not 636
# netstat -antp | grep slapd
When executed following command on same linux host (where server is running)
2. #ldapsearch -Z "CERTS/cacert.pem" -h 192.168.6.146 -p 389 -b "dc=my-domain,dc=com" -d 5It gave
ldap_msgfreeldap_interactive_sasl_bind_s: server supports: GSSAPI PLAIN LOGINldap_int_sasl_bind: GSSAPI PLAIN LOGINldap_perrorldap_sasl_interactive_bind_s: Local error[root@tb01-03-dp02 openldap]# ldaps
Thanks,DigambarOn Jan 16, 2008 7:09 PM, Chris G. Sellers <chris.sellers@nitle.org> wrote:
Run your openldap server with debugging turned on (-d option) and
check the output. Read the man slapd.conf for the different values of
the -d flag and then see if you see why your connection is failing.
Post those results here if you don't see the obvious root cause.
Sellers
______________________________________________
On Jan 16, 2008, at 1:37 AM, Digambar Sawant wrote:
> Hi,
>
> I want to establish secure ldap connection.
> I have tried following:
>
> 1. ldap_init
> 2. ldap_set_option( pLdapObj, LDAP_OPT_X_TLS_CACERTFILE, "/tmp/
> certficate.cert"
> 3. iRetCode = ldap_start_tls_s(pLdapObj, NULL, NULL);
>
> Here 3. ldap_start_tls_s failed with error: "Can't contact LDAP
> server".
>
> What is wrong here? Are there any more steps to make it work?
> Please help me.
>
> Thanks,
> Digambar
>
Chris G. Sellers | NITLE Technology
734.661.2318 | chris.sellers@nitle.org
AIM: imthewherd | GTalk: cgseller@gmail.com