Hi all,
Apologies for not grasping some rudimentary TLS/SSL concepts with the LDAP protocol, but I have a basic question.
I've configured my OpenLDAP server and have successfully been able to use the posixAccount objectClass to have a user login with pam_ldap over SSH on a client server. However, on the same token, when I try from the client server below to conduct and ldap search, I receive an error:
[root@bar cacerts]# ldapsearch -x -h "ldap.domain.com" -p 636 -v ldap_start_tls: Can't contact LDAP server (-1) ldap_bind: Can't contact LDAP server (-1)
On the server's log file:
Feb 18 23:03:11 firewall slapd[4775]: conn=3 fd=12 ACCEPT from IP=10.0.0.5:1072 (IP=0.0.0.0:636) Feb 18 23:03:11 firewall slapd[4775]: conn=3 fd=12 closed (TLS negotiation failure)
Clearly SSL/TLS is not properly negotiating here, but that's something I need to figure out in a few. My real question here is, when I established an ssh connection with my client server and the client server grabbed the credentials from LDAP server, does the above inadvertently imply that the packets were not negotiated via SSL/TLS? I was only testing ldapsearch to ensure that I have anonymous searches disabled, but the concern that I'm working without encryption spiked my curiosity if my logins are going unencrypted also because that's something I'd ultimately need to address.
Thanks much for any knowledge anyone can pass along!
- Steve
Steve Finkelstein writes:
[root@bar cacerts]# ldapsearch -x -h "ldap.domain.com" -p 636 -v
You are trying to use the LDAP protocol against the LDAPS port, which expects the TLS protocol. That does not work.
The clients do not deduce the protocol from the port number. They deduce the _default_ port number (which you can override) from the protocol.
There are two ways to use TLS:
1. ldapsearch -x -ZZ -h "ldap.domain.com" ...
This uses the LDAP protocol (on port 389), and -ZZ tells the client to use the StartTLS LDAP. This switches to the TLS protocol and then resumes LDAP "inside" that protocol.
2. ldapsearch -x -H "ldaps://ldap.domain.com/" ...
This uses the LDAPS protocol (on port 636). This port listens for TLS as if StartTLS had already been done.
BTW, don't combine -ZZ and ldaps://. You can't start TLS when TLS is already started.
I wrote:
- ldapsearch -x -ZZ -h "ldap.domain.com" ...
This uses the LDAP protocol (on port 389), and -ZZ tells the client to use the StartTLS LDAP
Er, the StartTLS LDAP _operation_.
This switches to the TLS protocol and then resumes LDAP "inside" that protocol.
openldap-software@openldap.org
-
Hallvard B Furuseth -
Steve Finkelstein