Re: Replication issue during performance test with MMR configuration and LastBind enabled
by Falgon
Hello,
I'm working on the same project as Meheni.
Thanks for your answer, we'll try version 2.6 OpenLDAP using the
lastbind-precision.
However we have several questions for the current version we're using.
Is this a known problem and referenced somewhere? (we haven't found it)
Is it normal to find no replication error logs even in stats + sync mode?
We ran some tests in sequential mode (300,000 accounts one after the other)
and managed to reproduce the problem.
-Denis
Le mer. 11 oct. 2023 à 14:11, Quanah Gibson-Mount <quanah(a)fast-mail.org> a
écrit :
>
>
> --On Tuesday, October 10, 2023 9:30 PM +0200 Ziani Meheni
> <mehani06(a)gmail.com> wrote:
>
> >
> >
> > Hello, we are working on a project and we've come across a problem with
> > the replication after performance testing :
>
> You need to use OpenLDAP 2.6 and then set the:
>
> lastbind-precision
>
> value. I use 5 minutes.
>
> --Quanah
>
12 hours, 43 minutes
syncrepl between 2.4.57.0.1 and 2.6.2-3
by Frank, Michael
Airbus Amber
Dear all,
basically I trying to establish a syncrepl/refreshAndpersist Setup between:
OpenLDAP: 2.4.57.0.1 @ Solaris < - > OpenLDAP: 2.6.2-3 @ Rhel 9.latest
(don`t ask)
An intial syncrepl activation does works properly (replication of ou`s content in both directions), but when I afterwards restart one of the replication Partners, the
sync failes and in consequence on one of replication Partner the ou`s are deleted.
From logging point of view there are somekind of issues to identify the remote object via the UUID which leads then to the deletion:
##schnipp
6538d3db.38892890 0x7f9fe65fe640 nonpresent_callback: rid=044 nonpresent UUID 25a0c72c-0364-103e-83af-fb52f2a7ef64, dn ou=permissions,dc=xxx,dc=xxxx,dc=xxxxxx
6538d3db.388983a6 0x7f9fe65fe640 nonpresent_callback: rid=044 adding entry ou=permissions,dc=xxxx,dc=xxxxx,dc=xxxx to non-present list
###schnapp
Unfortunately I cannot find any Information which says something useful about the basic backward compatibility of the synrepl/refreshAndPersist implementation from 2.6 to 2.4.
Can someone state why this mission is hopeless in detail or should the setup work basically ?
(I know the best practice : everywhere same versions...)
Best regards and thanks in advance,
michael
This Item has been reviewed and was determined as not listed under German regulation, nor EU export controls, nor U.S. export controls. However, in the case of the item has to be resold, transferred, or otherwise disposed of to an embargoed country, to an end user of concern or in support of a prohibited end use, you may be required to obtain an export license.
The information in this e-mail is confidential. The contents may not be disclosed or used by anyone other than the addressee. Access to this e-mail by anyone else is unauthorised.
If you are not the intended recipient, please notify Airbus immediately and delete this e-mail.
Airbus cannot accept any responsibility for the accuracy or completeness of this e-mail as it has been sent over public networks. If you have any concerns over the content of this message or its Accuracy or Integrity, please contact Airbus immediately.
All outgoing e-mails from Airbus are checked using regularly updated virus scanning software but you should take whatever measures you deem to be appropriate to ensure that this message and any attachments are virus free.
1 week, 5 days
Issue with refint and rwm overlay
by Maksim Saroka
Hello,
We have a strange situation with refint and rwm overlays on ldap replica.
Looks like those overlays depend on each other and on position in the
slapd.conf file regarding database section. However refint overlay is
working in any position if rwm overlay is not specified. Here are the
examples with positions in the file:
Refint overlay work if:
1.
rwm overlay section
database section
refint overlay section
Refint overlay does not work if:
1.
database section
refint overlay section
rwm overlay section
2.
rwm overlay section
refint overlay section
database section
Could you please explain to us the root cause of that as I can't find any
explanation in the docs.
--------
Maksim Saroka
DevOps/System Administrator
Exadel.com <https://exadel.com/>
Follow Us on LinkedIn <https://www.linkedin.com/company/exadel/>
--
CONFIDENTIALITY
NOTICE: This email and files attached to it are
confidential. If you
are not the intended recipient you are hereby notified
that using,
copying, distributing or taking any action in reliance on the
contents of this information is strictly prohibited. If you have
received
this email in error please notify the sender and delete this
email.
3 weeks
Scaling slapd nodes in Kubernetes with the MDB Backend
by Alejandro Imass
Hi there!
We are working on a new installation and decided to try something new..
In the past I would have gone with multi-master with ldap balancer but
after reading and researching more and more on MDB, we decided to try to
integrate OpenLDAP into our current CI/CD pipelines using K8s.
What we tried so far and it seems to work is initialize a common
persistence storage and then an auto scaling group that shares that common
drive. Ech pod has as many threads as virtual CPU it may have, and none of
the pods can write, except a dedicated write pod (single instance) with
multiple threads for writing.
Is there anything else we are missing here? Any experience scaling OpenLDAP
with Kubernetes or other container technology.
Thank you in advance for any comments, pointers or recommendations!
--
Alex
3 weeks, 1 day
Problem with "force user to password reset at first login
by Rajagopal Rc
Hi,
I am trying to force users to change their password at first login or
after
password reset by administrator.
Tried following:
1)Password policy 'pwdMustChange TRUE' doesn't seems to be working as non
of the
users get prompt to change their password at first login.
2) used the 'pwdReset TRUE' attribute in users attributes, and it won't
prompt
to change the password and didn't allow to login
i observe below messages in log
"slapd[12684]: connection restricted to password changing only
slapd[12684]: send_ldap_result: err=50 matched="" text="Operations are
restricted to bind/unbind/abandon/StartTLS/modify password"
slapd[12684]: conn=1053 op=1 SEARCH RESULT tag=101 err=50 nentries=0
text=Operations are restricted to bind/unbind/abandon/StartTLS/modify
password"
Please help me configure the option to force all users to change their
password
at first login or after pwd reset by administrator.
Thanks & Regards
Raj
Tata Consultancy Services
Mailto: rajagopal.rc(a)tcs.com
Website: http://www.tcs.com
____________________________________________
Experience certainty. IT Services
Business Solutions
Consulting
____________________________________________
=====-----=====-----=====
Notice: The information contained in this e-mail
message and/or attachments to it may contain
confidential or privileged information. If you are
not the intended recipient, any dissemination, use,
review, distribution, printing or copying of the
information contained in this e-mail message
and/or attachments to it are strictly prohibited. If
you have received this communication in error,
please notify us by reply e-mail or telephone and
immediately and permanently delete the message
and any attachments. Thank you
4 weeks, 1 day
Re: No matter what I try I get: ldap_modify: Insufficient access (50)
by Alejandro Imass
On Fri, Oct 27, 2023 at 5:58 PM Quanah Gibson-Mount <quanah(a)fast-mail.org>
wrote:
>
>
> --On Friday, October 27, 2023 10:51 AM +0200 Alejandro Imass
> <aimass(a)yabarana.com> wrote:
>
> > Again for future people reading this, if you encounter ACL issues and you
> > want to modify the LDIF database in /etc/openldap/slapd.d don't do it
> > manually.
>
> Your advice here is generally wrong.
>
>
You mean they SHOULD edit them manually ?
I'm actually suggesting to use slapadd and slapmodify directly on the
filesystem if everything else fails.
What's wrong with that suggestion?
>
1 month
No matter what I try I get: ldap_modify: Insufficient access (50)
by Alejandro Imass
OpenLDAP 2.6.6r1 on Apline Linux aarch64
Not sure what I am doing wrong but I am unable to change the
rootDN's password.
# ldapmodify -H ldapi:/// -Y EXTERNAL -D 'cn=config' << EOF
> dn: olcDatabase={0}config,cn=config
> changetype: modify
> add: olcRootPW
> olcRootPW: {SSHA}cZbRoOhRew8MBiWGSEOiFX0XqbAQwXUr
> EOF
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={0}config,cn=config"
ldap_modify: Insufficient access (50)
I also tried remotely, and same thing.
I noticed *olcAccess: {0}to * by * none* in the config DB but I didn't put
that there, and not sure how to change it.
Here is the slapcat output:
(Also, at the end I copied the LDIF I use to initialize the LDAP)
/ # slapcat -n 0
dn: cn=config
objectClass: olcGlobal
cn: config
olcDisallows: bind_anon
olcRequires: authc
structuralObjectClass: olcGlobal
entryUUID: 3ebf1971-b32e-41eb-ac58-a0a30fe18734
creatorsName: cn=config
createTimestamp: 20231025213204Z
entryCSN: 20231025213204.508761Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20231025213204Z
dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module{0}
olcModulePath: /usr/lib/openldap
olcModuleLoad: {0}back_mdb.so
olcModuleLoad: {1}refint.so
olcModuleLoad: {2}memberof.so
olcModuleLoad: {3}argon2.so
structuralObjectClass: olcModuleList
entryUUID: 3b732d07-c664-4294-87ca-d5e29a32aa6c
creatorsName: cn=config
createTimestamp: 20231025213204Z
entryCSN: 20231025213204.509009Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20231025213204Z
dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema
structuralObjectClass: olcSchemaConfig
entryUUID: c38bf741-8d4a-4e36-b012-22a70577d429
creatorsName: cn=config
createTimestamp: 20231025213204Z
entryCSN: 20231025213204.509955Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20231025213204Z
dn: cn={0}core,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: {0}core
[snip]
...
dn: olcDatabase={-1}frontend,cn=config
objectClass: olcDatabaseConfig
objectClass: olcFrontendConfig
olcDatabase: {-1}frontend
olcPasswordHash: {ARGON2}
structuralObjectClass: olcDatabaseConfig
entryUUID: 4459a62b-80f9-449c-b4a6-20cd2108a486
creatorsName: cn=config
createTimestamp: 20231025213204Z
entryCSN: 20231025213204.512390Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20231025213204Z
dn: olcDatabase={0}config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
*olcAccess: {0}to * by * none*
olcAddContentAcl: TRUE
olcLastMod: TRUE
olcLastBind: FALSE
olcLastBindPrecision: 0
olcMaxDerefDepth: 15
olcReadOnly: FALSE
olcRootDN: cn=config
olcSyncUseSubentry: FALSE
olcMonitoring: FALSE
structuralObjectClass: olcDatabaseConfig
entryUUID: 08d3cdfa-b552-45ab-a183-fc5802e9c910
creatorsName: cn=config
createTimestamp: 20231025213204Z
entryCSN: 20231025213204.512505Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20231025213204Z
dn: olcDatabase={1}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {1}mdb
olcDbDirectory: /var/lib/openldap/openldap-data
olcSuffix: dc=foo,dc=bar
olcRootDN: cn=admin,dc=foo,dc=bar
olcRootPW::
e0FSR09OMn0kYXJnb24yaSR2PTE5JG09NDA5Nix0PTMscD0xJHVKeWYwVWZCMjVTUV
RmWDdvQ3lLMnckVTQ1REpxRUZ3RDB5RmFMdlRWeUFDSEx2R013ek5HZjE5ZHZ6UFI4WHZHYw==
olcDbIndex: objectClass eq
olcDbMaxSize: 1073741824
structuralObjectClass: olcMdbConfig
entryUUID: 169807ec-3bfc-4a20-b4ab-e60cddd777a2
creatorsName: cn=config
createTimestamp: 20231025213204Z
entryCSN: 20231025213204.512483Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20231025213204Z
dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: {0}memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf
structuralObjectClass: olcMemberOfConfig
entryUUID: f45b11d4-aba8-40ec-83b5-5688aa6c4c42
creatorsName: cn=config
createTimestamp: 20231025213204Z
entryCSN: 20231025213204.513061Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20231025213204Z
dn: olcOverlay={1}refint,olcDatabase={1}mdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: {1}refint
olcRefintAttribute: memberof
olcRefintAttribute: member
olcRefintAttribute: uniqueMember
olcRefintAttribute: manager
olcRefintAttribute: owner
olcRefintNothing: cn=admin,dc=foo,dc=bar
structuralObjectClass: olcRefintConfig
entryUUID: 498d5840-1ebf-43d9-ad16-264069969adc
creatorsName: cn=config
createTimestamp: 20231025213204Z
entryCSN: 20231025213204.513211Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20231025213204Z
dn: olcDatabase={2}monitor,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {2}monitor
olcRootDN: cn=config
olcMonitoring: FALSE
structuralObjectClass: olcDatabaseConfig
entryUUID: 82712ebd-5149-496a-bec8-a2853249d9f3
creatorsName: cn=config
createTimestamp: 20231025213204Z
entryCSN: 20231025213204.513336Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20231025213204Z
Here is the LDIF I am using to initialize the LDAP and populate slapd.d:
# config global
dn: cn=config
objectClass: olcGlobal
cn: config
#TODO: fine tune security rlevel estrictions
#olcSecurity: ssf=1 update_ssf=112 simple_bind=64
olcDisallows: bind_anon
olcRequires: authc
# dynamic backend modules:
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulepath: /usr/lib/openldap
olcModuleload: back_mdb.so
olcModuleLoad: refint.so
olcModuleLoad: memberof.so
olcModuleload: argon2.so
# schemas
dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema
include: file:///etc/openldap/schema/core.ldif
include: file:///etc/openldap/schema/cosine.ldif
include: file:///etc/openldap/schema/inetorgperson.ldif
include: file:///etc/openldap/schema/nis.ldif
include: file:///etc/openldap/schema/dynamodel.ldif
# frontend settings
dn: olcDatabase=frontend,cn=config
objectClass: olcDatabaseConfig
objectClass: olcFrontendConfig
olcDatabase: frontend
olcPasswordHash: {ARGON2}
# LMDB database definitions
dn: olcDatabase=mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: mdb
olcDbMaxSize: 1073741824
olcSuffix: dc=foo,dc=bar
olcRootDN: cn=admin,dc=foo,dc=bar
olcRootPW:
{ARGON2}$argon2i$v=19$m=4096,t=3,p=1$uJyf0UfB25SQTfX7oCyK2w$U45DJqEFwD0yFaLvTVyACHLvGMwzNGf19dvzPR8XvGc
olcDbDirectory: /var/lib/openldap/openldap-data
olcDbIndex: objectClass eq
# memberOf overlay
dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: {0}memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf
# refint overlay
dn: olcOverlay={1}refint,olcDatabase={1}mdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: {1}refint
olcRefintAttribute: memberof
olcRefintAttribute: member
olcRefintAttribute: uniqueMember
olcRefintAttribute: manager
olcRefintAttribute: owner
olcRefintNothing: cn=admin,dc=foo,dc=bar
dn: olcDatabase=monitor,cn=config
objectClass: olcDatabaseConfig
olcDatabase: monitor
olcRootDN: cn=config
olcMonitoring: FALSE
Thank you in advance for any pointers !
--
Alex
1 month
Re: No matter what I try I get: ldap_modify: Insufficient access (50)
by Alejandro Imass
On Thu, Oct 26, 2023 at 11:13 PM Quanah Gibson-Mount <quanah(a)fast-mail.org>
wrote:
>
>
> --On Thu> Try the following (and replace with the correct URL):
> >
> > $ ldifmodify -x -H ldap://localhost/ -D cn=config -W << EOF
> > > dn: olcDatabase={0}config,cn=config
> > > changetype: modify
> > > add: olcRootPW
> > > olcRootPW: {SSHA}cZbRoOhRew8MBiWGSEOiFX0XqbAQwXUr
> > > EOF
>
> There doesn't appear to be an old olcRootPW value either, so that wouldn't
> work.
>
>
Thanks for your response.
There actually is one in dn: olcDatabase={1}mdb,cn=config
Anyway I solved my issue and was able to modify the config DB using
slapadd and slapmodify directly on the filesystem as root and that is that.
Thanks again for your help!
--
Alex
1 month
Re: Replication issue during performance test with MMR configuration and LastBind enabled
by Quanah Gibson-Mount
--On Tuesday, October 24, 2023 10:01 AM +0200 Óscar Remírez de Ganuza
Satrústegui <oscarrdg(a)unav.edu> wrote:
> What architecture would you suggest for implementing lastbind?
> Is it better to use a Master-Slave with the chain overlay to send the
> lastbind writes from the slave to the master?
If you want the value to have general meaning for most deployments, yes.
Generally I'd go with Multi-provider replication in a active/passive
configuration, with some number of read only consumer nodes, where the read
only nodes forward their updates to the active provider.
--Quanah
1 month
We cannot connect to TLS/SSL ldaps using openldap's built-in tools
by 228844797＠qq.com
Hello developers,
Can you help me see how to solve this problem
We are working with the client that comes with openldap and cannot connect to TLS/SSL ldaps,But I was able to access it using ldap:389
The server configuration information is as follows:
Linux System version：Ubuntu 22.04.3 LTS
OpenLDAP version：2.6.6
openssl version：OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)
The slapd.ldif certificate is configured as follows:
olcTLSCACertificateFile: /usr/local/openldap-2.6.6/cert/demoCA/newcerts/cacert.pem
olcTLSCertificateFile: /usr/local/openldap-2.6.6/cert/demoCA/newcerts/slapd01-server.pem
olcTLSCertificateKeyFile: /usr/local/openldap-2.6.6/cert/demoCA/private/slapd01-server-key.pem
The server startup information is as follows:
slapd -4 -F /usr/local/openldap-2.6.6/etc/openldap/slapd.d -h ldap:/// ldaps:/// ldapi:///
Configure the ldap.conf certificate on the client as follows:
TLS_CACERT /usr/local/openldap-2.6.6/cert/demoCA/newcerts/
#######################################################################################################
Server local test failed:
ldapwhoami -H ldaps://slapd.zxactions.com -d 1
The failure information is as follows:
root@openldap-1:/usr/local/openldap-2.6.6/etc/openldap# ldapwhoami -H ldaps://slapd.zxactions.com -d 1
ldap_url_parse_ext(ldaps://slapd.zxactions.com)
ldap_create
ldap_url_parse_ext(ldaps://slapd.zxactions.com:636/??base)
ldap_pvt_sasl_getmech
ldap_search
put_filter: "(objectclass=*)"
put_filter: simple
put_simple_filter: "objectclass=*"
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP slapd.zxactions.com:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 192.168.174.128:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
attempting to connect:
connect success
TLS trace: SSL_connect:before SSL initialization
TLS trace: SSL_connect:SSLv3/TLS write client hello
TLS trace: SSL3 alert read:fatal:handshake failure
TLS trace: SSL_connect:error in error
TLS: can't connect: error:0A000410:SSL routines::sslv3 alert handshake failure.
ldap_err2string
ldap_sasl_interactive_bind: Can't contact LDAP server (-1)
additional info: error:0A000410:SSL routines::sslv3 alert handshake failure
#######################################################################################################
Failed to use the openssl tool:
openssl s_client -connect slapd.zxactions.com:636 -debug
The failure information is as follows:
root@openldap-1:/usr/local/openldap-2.6.6/etc/openldap# openssl s_client -connect slapd.zxactions.com:636 -debug
CONNECTED(00000003)
write to 0x556ccbdb5c40 [0x556ccbdc5b30] (321 bytes => 321 (0x141))
0000 - 16 03 01 01 3c 01 00 01-38 03 03 1a eb eb eb ad ....<...8.......
0010 - 52 f0 12 36 b2 cd ad 9c-6f c9 de 67 54 13 e3 47 R..6....o..gT..G
0020 - 23 ac 44 5c d9 51 2f d4-a5 0b cf 20 e6 f9 c1 6c #.D\.Q/.... ...l
0030 - e5 ce 18 9c ea f1 d6 67-a2 1f 71 3c 78 d4 c6 fb .......g..q<x...
0040 - 25 23 98 bd 38 90 1f 8c-13 94 b1 00 00 3e 13 02 %#..8........>..
0050 - 13 03 13 01 c0 2c c0 30-00 9f cc a9 cc a8 cc aa .....,.0........
0060 - c0 2b c0 2f 00 9e c0 24-c0 28 00 6b c0 23 c0 27 .+./...$.(.k.#.'
0070 - 00 67 c0 0a c0 14 00 39-c0 09 c0 13 00 33 00 9d .g.....9.....3..
0080 - 00 9c 00 3d 00 3c 00 35-00 2f 00 ff 01 00 00 b1 ...=.<.5./......
0090 - 00 00 00 18 00 16 00 00-13 73 6c 61 70 64 2e 7a .........slapd.z
00a0 - 78 61 63 74 69 6f 6e 73-2e 63 6f 6d 00 0b 00 04 xactions.com....
00b0 - 03 00 01 02 00 0a 00 16-00 14 00 1d 00 17 00 1e ................
00c0 - 00 19 00 18 01 00 01 01-01 02 01 03 01 04 00 23 ...............#
00d0 - 00 00 00 16 00 00 00 17-00 00 00 0d 00 2a 00 28 .............*.(
00e0 - 04 03 05 03 06 03 08 07-08 08 08 09 08 0a 08 0b ................
00f0 - 08 04 08 05 08 06 04 01-05 01 06 01 03 03 03 01 ................
0100 - 03 02 04 02 05 02 06 02-00 2b 00 05 04 03 04 03 .........+......
0110 - 03 00 2d 00 02 01 01 00-33 00 26 00 24 00 1d 00 ..-.....3.&.$...
0120 - 20 92 75 81 9c 09 28 95-68 b4 eb b1 9e 2c d5 9b .u...(.h....,..
0130 - e3 99 13 36 68 87 b5 72-4d d6 3e 60 0f 47 50 db ...6h..rM.>`.GP.
0140 - 15 .
read from 0x556ccbdb5c40 [0x556ccbdbc913] (5 bytes => 5 (0x5))
0000 - 15 03 03 00 02 .....
read from 0x556ccbdb5c40 [0x556ccbdbc918] (2 bytes => 2 (0x2))
0000 - 02 28 .(
800B77514E7F0000:error:0A000410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../ssl/record/rec_layer_s3.c:1584:SSL alert number 40
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 321 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
read from 0x556ccbdb5c40 [0x556ccbd0d650] (8192 bytes => 0)
*************************************************************************************************************************************
I can access it using ldap:389
root@openldap-1:/usr/local/openldap-2.6.6/etc/openldap# ldapsearch -x -D "cn=Manager,dc=my-domain,dc=com" -H ldap://slapd.zxactions.com -w 123456 -b "dc=my-domain,dc=com" -d 256
# extended LDIF
#
# LDAPv3
# base <dc=my-domain,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# my-domain.com
dn: dc=my-domain,dc=com
dc: my-domain
o: www.zxactions.com
objectClass: dcObject
objectClass: organization
# copy of my-domain, my-domain.com
dn: ou=copy of my-domain,dc=my-domain,dc=com
ou: copy of my-domain
objectClass: top
objectClass: organizationalUnit
# search result
search: 2
result: 0 Success
# numResponses: 3
# numEntries: 2
1 month
