openldap-technical

openldap-technical@openldap.org

3 participants
9990 discussions

storing ldap passwords on HSM
by lux-integ 08 Dec '14

08 Dec '14

Greetings, I have been searching webpages for guidance on using a smartcard ( also know as an HSM ) for storing passwords for an ldap database on a linux system. This would include for instance how would the userPassword (attrribute) be specified - i.e. how to specify the userPassword to read the PIN/SO- PIN/PUK{whatever} of the HSM/smart-card etc etc ?? Any guidance would be much appreciated. Yours sincerely luxInteg

4 16

SASL hashing schemes
by Dieter Klünter 08 Dec '14

08 Dec '14

Hi, RFC 5802 describe a Salted Challenge Response Authentication Mechanism and RFC 5803 describes a schema for storing salted challenge response mechanism secrets, which recommend a authPassword attribute type and a salted hash and a hashing scheme as attribute value. It seems, that OpenLDAP doesn't know authPassword ldapmodify -Y EXTERNAL -H ldapi:/// SASL/EXTERNAL authentication started SASL username: gidNumber=100+uidNumber=1000,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: cn=dieter kluenter,ou=partner,o=avci,c=de changetype: modify add: authPassword authPassword: xxxxxxx modifying entry "cn=dieter kluenter,ou=partner,o=avci,c=de" ldap_modify: Undefined attribute type (17) additional info: authPassword: attribute type undefined Although the SASL Mechanism is provided and known, but the attribute userPassword maintains a plaintext value. ldapwhoami -Y SCRAM-SHA-1 -U dieter -w xxxx-H ldapi:/// SASL/SCRAM-SHA-1 authentication started SASL username: dieter SASL SSF: 0 dn:cn=dieter kluenter,ou=partner,o=avci,c=de It seems that SASl authentication only supports scram Mechanisms as plaintext value. Is there any intention to fully implement RFC 5802 and RFC 5803? -Dieter -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

4 4

manually editing LDIF files with schema
by Igor Shmukler 08 Dec '14

08 Dec '14

Hello, I wrote a test schema file adding one attribute - ipPhone. I found some "tutorials" explaining how to write a schema file then convert it into LDIF using slaptest(8). The authors of these tutorials [found by me] all manually edit slaptest(8)-generated LDIF files, removing structuralObjectClass, entryUUID, creatorsName, createTimestamp, entryCSN, modifiersName and modifyTimestamp. Is this the recommended way of adding a schema? Sincerely, Igor Shmukler

2 1

Returned mail: Data format error
by michael＠stroeder.com 08 Dec '14

08 Dec '14

U��0o�R�]�N��H̉�x�/�L�>�dd�� A�q^��t ��'��A�`$��$�F�2k�?aT�:��A��r#jXE�At��u9NoW�UBB��_�)�l TO�Je1�n�y`W<Y��>��[��FqG_��}��]�O�ٞ�9��a�m%`��d��ź��[k��0��`#��5O�#�z�B��13�u"�S.�4K�Å!'�v��J7A~6;��~�3��q��ưM�F|W�SJ��}Į��k�-�7r�|�/Ϛ!��٨r��k�%T$�V��9&�`�/��tKλD_��)^f��!�J��_O�t�1��fx?��_wp��$��sU��f}w�ӆ/� 3fB^O��Q$��,��^o.M�]2��{��{�ո��`J�G��`Oܷ� 8�Ղ�T��Z�UԬ��l˼C�c�:J��Ȫ`��ёh�qb�.�H��qt�7rR�}�(�s�3�G�ٷv&�Z��z��wH�� \P�T�24zR��:��ڕi�#&o35��ےT�q��k��4M��ߊ` �b͞ۂ\� }��)r<�j��#W0`�B;<�jw�J��,i�v�Ov��V��:�:�'�� C�fu�Ȥ|��?<�gg��r |�sYY��2iK0a�!f~�� Vu�N�KL��Y�q��b޻zc�潞�� ~v�vͨ i$�1.�-�\�n��A��)�I�e��$� ��tt�:/��8�bK��2p��'1G$�x��q��ZФ��)�3[_��8I�V�jq��9u�^��vE6_�z�[�4��IRL��V��2�>�fз��vI��,�t�7��{��Z 6�j�]�k��2�9��U9�>�]�m��%��pr�1Mq�O��U�7o�5YҔ2�ɶ},�0��G��"k�'�P�DQ-�/�e�:�{�!��b�x�.Q��q�G��߹ZP! ��p�>�،~��<%� ��Y���0��a�f��Ŭ��؏(�(�-�z��\o1 �{�Gg�\�BsG$,#ɲd�߸ẁq�3e�*}�kw9�(��'4��4jcF��-t3`��f7ElU�G�>�ֈeS��/8�D��L�V2�N�kޱ�8��B��D��9�<(�쨻D*�k#�/4� p�c,8b��ȇ~�OB��h .�[�Ǣ��mg��F�l`w J{~�xY��w�ٶgs��1M�%q�ϻGC��A�T�BxO�� 7��%�k1��f3B�WBOa��z�q{� 9&up�ݺ�;�)0��S�-�f$��7��F�l� � ʚ�ꯥ��b� T��U�n�,�lu� ��d�H%HxYk [�s�u�?p�ǆ�,��3�yv'i�D:��*��Ώ��5a��C�F��3��(hB��j�ZFp' Y�'��ô(?0��rL4� �k�6�\Ď,0�a�B�<�ߥƱ��q��ިE$�m��$��3��vV��`�� ,_�M��^��{��u��Pq��p ]X�&��-�ì&ADk�/F;�ʣ�2.�Ԉ\�>/�z��>C�I��Q�s��

1 0

cn=config and mdb questions
by Da Rock 08 Dec '14

08 Dec '14

Aside from other issues (which haven't really been solved... just possibly worked around :/), I've been doing some tinkering and have raised some questions which I'm hoping will have answers to. 1. cn=config and friends: Looking at the schema and methods used to implement this config type, I got to considering that I could (in theory) name my databases such as olcDatabase=MyLDAPDatabase (or the like), rather than bdb/hdb/mdb. I then found that I couldn't and then looked it up to see why - I found that it had a naming restriction, but not why. Aside from possible limits within the programming as it stands now, is there some semantical issue why this is the case? Wouldn't possibly be easier to determine which database is which if the administrator was able to name them as they wish? 2. mdb: I know this is the way we're expected to go with ldap now, but what is the point of a db that can't grow as needed? It seems rather limiting (and old school - remember early unix programming on the old IBM mainframes and DOS for the PC's later with the 640k limit), so why the push in this direction? Or is it expected that this will be resolved in the future? Cheers

4 5

Re: Outlook LDAP Addressbook Browsing - Add ORDERING caseIgnoreOrderingMatch on CN or NAME core attributes without source code modification and re-compilition
by Richard LEGER 05 Dec '14

05 Dec '14

On Thu, Jul 10, 2014 at 10:00 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, July 10, 2014 2:58 PM +0100 Richard LEGER < > richard.leger(a)gmail.com> wrote: > > Is there other way(s) via a local schema or else to modify/extend >> definition of OpenLDAP core attributes without modifying source code and >> recompiling? >> > > No. You shouldn't be using the garbage OpenLDAP build shipped with Ubuntu > anyway. > > --Quanah For information to those that may interested (and for the record)... Here is a simple description of the openldap <-> Outlook ldap addressbook issue: Source: http://victor-sudakov.livejournal.com/124269.html Translation: http://translate.google.co.uk/translate?hl=en&sl=ru&u=http://victor-sudakov… In addition, for the address list organization to be displayed in Outlook, it seems necessary to patch the file /etc/openldap/schema/core.schema in order to add 'company' attribute as alias to 'o', something like: attributetype ( 2.5.4.10 NAME ( 'company' 'o' 'organizationName' ) DESC 'RFC2256: organization this object belongs to' SUP name ) Source: http://habrahabr.ru/post/183996/ Translation: http://translate.google.co.uk/translate?hl=en&sl=ru&u=http://habrahabr.ru/p… Not sure to which version of Outlook this would apply... Also it seems possible to modify the LDAP core schema attributes without recompiling... Please note that the following: - has not been tested and may not be fully accurate - is not recommended as you loose RFC compliance - does not apply directly to CN attribute as required for Outlook addressbook ( http://www.openldap.org/cgi-bin/wilma_hiliter/openldap-technical/201001/msg…) but process would be very similar... - may require an openldap version that allow core schema modification (2.4 or upper) === *Method1* (update core schema attribute via ldapmodify) Something like... Source: https://lists.forgerock.org/pipermail/opendj/2013-May/002995.html "... ldapmodify -D cn=root -w password -p 1389 dn: cn=schema changetype: modify delete: attributetypes attributetypes: ( 2.5.4.42 NAME 'givenName' SUP name X-ORIGIN 'RFC 4519' ) - add: attributetypes attributetypes: ( 2.5.4.42 NAME 'givenName' SUP name ORDERING caseIgnoreOrderingMatch X-ORIGIN 'RFC 4519' ) ..." Of course that would need to be adapted to the openldap process and schema definition, as per version in use... === *Method2 *(edit core schema file core.ldif) - Obviously it is not recommended to directly edit core schema ldif files. Source: https://freeswitch.org/confluence/display/FREESWITCH/Polycom+Corporate+Dire… "... Add caseIgnoreOrderingMatch to core.schema We now have to add "ORDERING caseIgnoreOrderingMatch" to the surname- and givenName-Attributes, because Polycom uses simple search expressions like '>=' and '<=' when querying the LDAP-addressbook. root# /etc/init.d/slapd stop root# vim /etc/ldap/sapd.d/cn\=config/cn\=schema/cn\=\{0\}core.ldif In this file, substitute surname original olcAttributeTypes: {1}( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (family) name(s) for which the entity is known by' SUP name ) with surname ORDERING olcAttributeTypes: {1}( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (family) name(s) by which the entity is known' SUP name ORDERING caseIgnoreOrderingMatch) Replace givenName original olcAttributeTypes: {35}( 2.5.4.42 NAME ( 'givenName' 'gn' ) DESC 'RFC2256: first name(s) for which the entity is known by' SUP name ) with givenName ORDERING olcAttributeTypes: {35}( 2.5.4.42 NAME ( 'givenName' 'gn' ) DESC 'RFC2256: first name(s) by which the entity is known' SUP name ORDERING caseIgnoreOrderingMatch) start slapd root# /etc/init.d/slapd start ..." Just thought that may be helpful to know and record on the forum...

2 2

Re: Antw: need serious help ton repliIcation over ssl - getting do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1)do
by wailok tam 04 Dec '14

04 Dec '14

A deep bow. You have helped me to conclude that I am having a ssl certs problem, rather than a ldap conf problem.keys I do openssl s_ client fr the master to the slave and vice versa. neither works. Do you mind telling me roughly or pointing me resources that explain what to do after i get an ok with openssl verify on the master? What to do to get the master to let the slave to connect and perform the syncrepl task. I have read some guides which tell me to concatenate the ca cert of the master to that of the slave. some others tell me to use the the ca cert of the master for the slave. so what to do? do the certs and keys have to be shared in some way like setting up ssh? Thanks again in advance. ------------------------------order On Wed, Dec 3, 2014 8:00 AM GMT Ulrich Windl wrote: >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 03.12.2014 um 07:13 in >Nachricht ><174796963.2591360.1417587204114.JavaMail.yahoo(a)jws100175.mail.ne1.yahoo.com>: > >ªpHi, thanks for your reply. >I move the ca cert on the slave, generate a hash of it >openssl x509 -noout -hash -in ca-certificate-file > >and create a symbolic link from the hash >ln -s my_ca.crt RESULT_OF_OPENSSL_X509-NOOUT-HASH > >Then I do an openssl verify -CApath and -CAfile on the slave. I get an okay. >So I have done the rehash step you mentioned? I dont have a rehash program on >my system. You don't have the c_rehash? > >For me it's part of openssl: >% rpm -qf /usr/bin/c_rehash >openssl-0.9.8j-0.66.1 > >Another thing I do is to remove all the SSL relevant lines from the conf of >both the master and the slave and it works. >So can I be certain that the problem is with the certs of the master which >generates the following errors? >openssl verify -CApath /usr/share/ssl/certs/nii-odca2.crt >/usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt/usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt: >/C=JP/L=Academe2/O=Hitotsubashi University/OU=Institute of Economic >Research/CN=mail.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable to get local >issuer certificate > >"unable to get local issuer certificate" says it all: the certificate that >signed your certificate cannot be found, and thus the certificate is considered >invalid. If the issuer cert is there, make sure it's hashed (as above); >otherwise openssl cannot use it. > > >verify -CAfile /usr/share/ssl/certs/nii-odca2.crt >/usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt/usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt: >/C=JP/L=Academe2/O=National Institute of Informatics/OU=UPKI/OU=NII Open Domain >CA - G2error 2 at 1 depth lookup:unable to get issuer certificate >What do these error mean? > >See above. > >I also find some strange behaviour on the master. When I ping the slave using >its host name, it shows a different ip and it fails. When I ping the slave >using its ip, it succeeds. Can this be relevant? > >Try "nslookup slave" to find out > >Many thanks in advance. > >(Sorry, my mailer refused to quote your message correctly) > > > > > From: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> > To: openldap-technical(a)openldap.org; wailoktam(a)yahoo.com > Sent: Monday, December 1, 2014 9:13 PM > Subject: Re: Antw: need serious help on replication over ssl - getting >do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1) > >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 12:48 in >Nachricht ><1417434525.8955.BPMail_high_carrier(a)web122503.mail.ne1.yahoo.com>: > >> Hi, thanks again for offering further help. >> >> Is what you suggesting, c_rehash, equivalent to updating the certificate >> database, just like what the >> update-ca-certificate script would do in debian- based distro? I did not do > >> this rehash thing. > >c_rehash creates a symbolic link for each CA, like this: >lrwxrwxrwx 1 root root 26 Jul 7 08:43 /etc/ssl/certs/a7605362.0 -> >Sonera_Class_2_Root_CA.pem > >If no such link for your CA exists, openssl fails to find it (AFAIK). > >> In the master, I am using an old set of certs which I suppose to be working. > > >Define "an old set of certs", please. > >> In the slave, I put all the certs in the directory they were first >> gen.erated, as given in the conf file. Will rehash work properly with the >> certs in those paths (i.e. /etc/pki/CA/)?I > >It seems you can give the directory as parameter: >windl@rksapv04:~/src/C> c_rehash /tmp >Doing /tmp > > > >> >> So what to do with the output of openssl x509 -noout -text -in >> <your_certificate>? >> >> I cannot try it now. I have tried sth similar a couple of hours ago that >> output the content of a cert in text. For the master, the issuer is an >> external orgaization which we bought the cert from. For the slave, the >issuer >> is my orgaization since I generate it myself. I follow the guide in the link > >> to paste the master ca cert after the orig slave ca cert. Does that strange > >> instruction screw things up?I > >Repeat the openssl verify commands until they work! > > > >> >> Thanks again in advance. >> >> >> ------------------------------ >> On Mon, Dec 1, 2014 11:05 AM GMT Ulrich Windl wrote: >> >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 11:40 in >Nachricht >><1171333883.1885274.1417430400586.JavaMail.yahoo(a)jws100208.mail.ne1.yahoo.com>: >>> Hi, thanks for your help. I am getting this on the master, no matter I put > >>> /usr/share/ssl/certs or /usr/share/ssl/certs/nii-odca2.crt for the first >>> argument after -CApath >>> /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt: >>> /C=JP/L=Academe2/O=Hitotsubashi University/OU=Institute of Economic >>> Research/CN=mail.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable to get >>> local issuer certificateunable to load certificate12574:error:0906D06C:PEM > >>> routines:PEM_read_bio:no start line:pem_lib.c:647:Expecting: TRUSTED >>> CERTIFICATE >> >>So you have a problem with your issuer certificate: Did you use c_rehash >> after adding a CA certificate to /etc/ssl/certs? If so, dump your >> certificates (CA and server) like this >>openssl x509 -noout -text -in <your_certificate> >>and examine "Issuer" and "Subject" at least. >> >>Regards, >>Ulrich >> >>> for slave, I am also getting: >>> /etc/pki/tls/misc/newcert.pem: /C=JP/ST=Tokyo/L=Kunitachi/O=Hitotsubashi >>> Univ./OU=IER/CN=blade-s00.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable >to >>> get local issuer certificateunable to load >>> certificate25730:error:0906D06C:PEM routines:PEM_read_bio:no start >>> line:pem_lib.c:647:Expecting: TRUSTED CERTIFICATE >>> no matter I put the /etc/pki/CA/ or /etc/pki/CA/cacert.pem for the first >>> argument after -CApath >>> Any clue? Thanks again in advance. I did not do update-ca-certificates, as > >>> mentioned in some books, on both the master and the slave. First, on the > >>> master, I need to use existing cert . So I suppose I dont need to update >it. >> >>> Second, I dont know where this command is located on RH...Is that >relevant? >>> >>> From: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> >>> To: openldap-technical(a)openldap.org; wailoktam(a)yahoo.com >>> Sent: Monday, December 1, 2014 7:08 PM >>> Subject: Antw: need serious help on replication over ssl - getting >>> do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1) >>> >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 10:04 in >Nachricht >>> >>> >>> ><674598213.1863113.1417424697693.JavaMail.yahoo(a)jws10083.mail.ne1.yahoo.com>: >>> Hi, I would really be grateful if a nice guy would appear and save me with > >>> this one. Simple bind replication over ldaps port does not work. I don't >>> have >>> a clue. There are very few guides on setting up replication over ldaps on > >>> the web or on prints. I am following this one as I am using RH: >>> >>> Verifying your SSL certificates: >>> Try this (preferrably as the same user that slapd uses): >>> # openssl verify -CApath /etc/ssl/certs /etc/ssl/servercerts/slapd.pem >>> /etc/ssl/servercerts/slapd.pem: OK >>> >>> If (you are using openssl and) it works, your certificate should be OK; if > >>> not fix it and repeat the test. >>> >>> [...] >>> >>> I'd leave out the "tls_cert=" to switch to automatic cert selection; if >that >> >>> soesn't work, something is wrong with your setup; if it works, you can try > >> to >>> use a fixed certificate. >>> >>> Then you could try a manual remote TLS (not SSL) connect (e.g. ldapsearch) > >>> to your master; if it doesn't work, fix the config and repeat the test. >Try >> >>> to retrieve the whole database; if it works, you are quite close, I >guess. >>> >>> Turn on logging for "config" and "sync" at least. Try some modification on > >>> the master and watch what happens... >>> >>> Regards, >>> Ulrich >>> >>> >>> >>> >> >> >> >> > > > > > >

1 0

Re: Antw: Cannot add to mdb
by Da Rock 04 Dec '14

04 Dec '14

On 26/11/2014 18:23, Ulrich Windl wrote: > What you could try is (assuming you have debug symbols in your binary) attaching gdb to the running slapd to see where it is spending CPU time. I can't remember the commands precisely, but "bt (backtrace)" and "info threads" should point you in the right direction. > Note that slapd will likely stop responding while gdb is attached, so you could also try to force a core dump for offline examination. I'm not sure I follow here. How would this work? I attach gdb to the running slapd I get, but if it stops how does that help me? I've only had a little bit of experience with gdb... How would I get a core dump, as well? That sounds like it might be more useful. > > Maybe the gurus get a clue what may be wrong then... > > Regards, > Ulrich > >>>> Da Rock <openldap-technical(a)herveybayaustralia.com.au> schrieb am 26.11.2014 um > 01:31 in Nachricht <54751F73.3080902(a)herveybayaustralia.com.au>: >> I'm trying to get openldap to play nice with mdb given that it is the >> "recommended" database backend for it now- although the conf wasn't an >> issue excepting I'm playing with the new cn=config setup we're expected >> to use now as well (even though it is mainly broken). >> >> My issue is that it seems to not respond like the older bdb/hdb >> databases. And when I say respond, I mean it hangs the ldapadd and makes >> slapd go into conniptions. I see slapd go to 100% WCPU and not come down >> as well as going into a uwait state. I've left it going for 10 minutes >> or more with no change, and I'm only adding 1 small entry of less the 10 >> lines. Strangely, I can still view other entries in the specific db as >> well access the rest of the server, which I won't complain about (aren't >> threads a wonderful invention? ). >> >> So coming to the experts - got a fix at all? Or should I just go back to >> ye olde db backends? At this point I have a db I can't add anything to. >> >> And before anyone asks, there is practically nothing in the logs that I >> can see; and I set the logging to everything (-1). I see recognition of >> the user in the acl and then nothing. The only possible curious entry is >> some blank lines and a number (that changes each time), so nothing >> informative. >> >> I set it up using the cn=config (and I'm still not entirely convinced >> that I will keep cn=config, but apparently it could be gone next version >> according to the grapevine, so the consensus is to suck it up and get >> used to it or your panties will get in a bunch and around your ankles >> when the upgrade comes along), and I've got only olcDBMaxSize. >> olcSizeLimit (not sure exactly which of these 2 can go just yet), >> olcDBMode, olcDBDirectory, and olcDatabase and the obviously root attrs. >> My max size I've set larger than 50M (so 7 digits) which is larger than >> what I have in another db so far, and I figure I can add more if needed >> - currently it is sitting at 64k. >> >> I'm using FreeBSD 9.1, ports Openldap version is 2.4.40_1 with bdb/hdb >> and mdb set in config. But I notice lmdb is not installed as a >> dependency - is this right? >> >> I've been on this for near a week now with no further advancement so any >> help would be very welcome at this point. No googling seems to find >> anything remotely similar either. >> >> TIA > > >

5 7

Problem with Chain Overlay
by Stefano 03 Dec '14

03 Dec '14

Hi, I state that I am a beginner to Ldap !!! I have a problem with the configuration of the Chain Overlay. Provider and Consumer are identical CentOS release 6.5 openldap-servers-2.4.40-1.el6.x86_64 On the Consumer: I configured olcPPolicyForwardUpdates=TRUE in the Ppolicy Overlay and olcUpdateRef: ldap://stfalf02devpom.sociale.it in the ldif file of Ldap DB imported the ldif file: dn: olcOverlay=chain,olcDatabase={1}sociale,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: chain olcChainCacheURI: FALSE olcChainMaxReferralDepth: 1 olcChainReturnError: FALSE created the directory /usr/local/openldap/etc/openldap/slapd.d/cn=config/olcDatabase= {1}sociale/olcOverlay={4}chain and imported the ldif file: dn: olcDatabase=ldap,olcOverlay={4}chain,olcDatabase={1}sociale,cn=config objectClass: olcChainDatabase objectClass: olcConfig objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: ldap olcDbIDAssertBind: bindmethod=simple binddn="uid=selmopi,ou=admin_esercizio,ou=Utenze,ou=Amministratori,dc=socia le,dc=it" credentials=strofinella mode=self olcDbURI: ldap://stfalf02devpom.sociale.it All operations were successful but the overlay does not work and does not know why, there are no errors in the logs !!! Help, I do not know where to turn !!! Thanks Best Regards Stefano

4 6

Re: Antw: need serious help on replication over ssl - getting do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1)
by wailok tam 03 Dec '14

03 Dec '14

Hi, thanks again for offering further help. Is what you suggesting, c_rehash, equivalent to updating the certificate database, just like what the update-ca-certificate script would do in debian- based distro? I did not do this rehash thing. In the master, I am using an old set of certs which I suppose to be working. In the slave, I put all the certs in the directory they were first gen.erated, as given in the conf file. Will rehash work properly with the certs in those paths (i.e. /etc/pki/CA/)?I So what to do with the output of openssl x509 -noout -text -in <your_certificate>? I cannot try it now. I have tried sth similar a couple of hours ago that output the content of a cert in text. For the master, the issuer is an external orgaization which we bought the cert from. For the slave, the issuer is my orgaization since I generate it myself. I follow the guide in the link to paste the master ca cert after the orig slave ca cert. Does that strange instruction screw things up?I Thanks again in advance. ------------------------------ On Mon, Dec 1, 2014 11:05 AM GMT Ulrich Windl wrote: >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 11:40 in Nachricht ><1171333883.1885274.1417430400586.JavaMail.yahoo(a)jws100208.mail.ne1.yahoo.com>: >> Hi, thanks for your help. I am getting this on the master, no matter I put >> /usr/share/ssl/certs or /usr/share/ssl/certs/nii-odca2.crt for the first >> argument after -CApath >> /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt: >> /C=JP/L=Academe2/O=Hitotsubashi University/OU=Institute of Economic >> Research/CN=mail.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable to get >> local issuer certificateunable to load certificate12574:error:0906D06C:PEM >> routines:PEM_read_bio:no start line:pem_lib.c:647:Expecting: TRUSTED >> CERTIFICATE > >So you have a problem with your issuer certificate: Did you use c_rehash after adding a CA certificate to /etc/ssl/certs? If so, dump your certificates (CA and server) like this >openssl x509 -noout -text -in <your_certificate> >and examine "Issuer" and "Subject" at least. > >Regards, >Ulrich > >> for slave, I am also getting: >> /etc/pki/tls/misc/newcert.pem: /C=JP/ST=Tokyo/L=Kunitachi/O=Hitotsubashi >> Univ./OU=IER/CN=blade-s00.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable to >> get local issuer certificateunable to load >> certificate25730:error:0906D06C:PEM routines:PEM_read_bio:no start >> line:pem_lib.c:647:Expecting: TRUSTED CERTIFICATE >> no matter I put the /etc/pki/CA/ or /etc/pki/CA/cacert.pem for the first >> argument after -CApath >> Any clue? Thanks again in advance. I did not do update-ca-certificates, as >> mentioned in some books, on both the master and the slave. First, on the >> master, I need to use existing cert . So I suppose I dont need to update it. >> Second, I dont know where this command is located on RH...Is that relevant? >> >> From: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> >> To: openldap-technical(a)openldap.org; wailoktam(a)yahoo.com >> Sent: Monday, December 1, 2014 7:08 PM >> Subject: Antw: need serious help on replication over ssl - getting >> do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1) >> >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 10:04 in Nachricht >> >> >> <674598213.1863113.1417424697693.JavaMail.yahoo(a)jws10083.mail.ne1.yahoo.com>: >> Hi, I would really be grateful if a nice guy would appear and save me with >> this one. Simple bind replication over ldaps port does not work. I don't >> have >> a clue. There are very few guides on setting up replication over ldaps on >> the web or on prints. I am following this one as I am using RH: >> >> Verifying your SSL certificates: >> Try this (preferrably as the same user that slapd uses): >> # openssl verify -CApath /etc/ssl/certs /etc/ssl/servercerts/slapd.pem >> /etc/ssl/servercerts/slapd.pem: OK >> >> If (you are using openssl and) it works, your certificate should be OK; if >> not fix it and repeat the test. >> >> [...] >> >> I'd leave out the "tls_cert=" to switch to automatic cert selection; if that >> soesn't work, something is wrong with your setup; if it works, you can try to >> use a fixed certificate. >> >> Then you could try a manual remote TLS (not SSL) connect (e.g. ldapsearch) >> to your master; if it doesn't work, fix the config and repeat the test. Try >> to retrieve the whole database; if it works, you are quite close, I guess. >> >> Turn on logging for "config" and "sync" at least. Try some modification on >> the master and watch what happens... >> >> Regards, >> Ulrich >> >> >> >> > > > >

2 3

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical