openldap-technical

openldap-technical@openldap.org

22 participants
9803 discussions

ssl negotiation and openldap
by Brett ＠Google 01 Mar '12

01 Mar '12

Hello, I've recently had issues with a 3rd party java client using jdk 1.4.x, trying to connect with ldaps:// to openldap 2.4.26, compiled with OpenSSL 1.0.0d It would appear that the client's jdk 1.4.x has a few harsh restrictions with regard to modulus size in certiicates, even with all unrestricted "export" policies installed. So i was wondering a few things : 1. does openldap do anything with the CA certs, other than verify local or remote certiticates, such as sending them over the ssl connection ? 2. it's my understanding that in SSL negotiation, only server or client certiticates are exchanged, and ca certs's are not sent over the wire (as IMHO it would literally bet a "trust" issue to do otherwise :). 3. other than providing certificates / keys to the openssl API, is there anything special that happens other than hand off to stock openssl negotiation ? Trying to work out what is being sent to the client to trigger a "modulus size" error on the client, other than clients inherent badness which i cannot control :) If 3. is no, then i'm open to any suggestions with regard to interesting or useful SSL negotiation documents out there, that might shed some light. Cheers Brett -- *The only thing that interferes with my learning is my education.* * Albert Einstein*

2 1

ssh group membership access
by Daniel Bahena 29 Feb '12

29 Feb '12

Hi, I have a set of servers in which I want to configure ssh access based on the users group membership. I'm using CentOS 5 and this version of openldap [root@centos5 ldifs]# rpm -qa | grep ldap openldap-servers-2.3.43-12.el5_7.10 php-ldap-5.1.6-27.el5_7.5 openldap-servers-overlays-2.3.43-12.el5_7.10 openldap-2.3.43-12.el5_7.10 nss_ldap-253-42.el5_7.4 openldap-2.3.43-12.el5_7.10 nss_ldap-253-42.el5_7.4 openldap-clients-2.3.43-12.el5_7.10 [root@centos5 ldifs]# And this is my ldap.conf base dc=homelinux,dc=net timelimit 120 bind_timelimit 120 idle_timelimit 3600 pam_groupdn cn=access,ou=Group,dc=homelinux,dc=net pam_member_attribute member nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm uri ldap://127.0.0.1/ ssl no tls_cacertdir /etc/openldap/cacerts pam_password md5 And this is the contents of cn=access [root@centos5 ldifs]# ldapsearch -x -W -D 'cn=Manager,dc=homelinux,dc=net' -h 127.0.0.1 "cn=access" # access, Group, homelinux.net dn: cn=access,ou=Group,dc=homelinux,dc=net cn: access objectClass: top objectClass: groupOfNames objectClass: labeledURIObject member: uid=nobody,ou=People,dc=homelinux,dc=net labeledURI: ldap:///ou=People,dc=homelinux,dc=net??one?(gidNumber=10060) labeledURI: ldap:///ou=People,dc=homelinux,dc=net??one?(host=jumpbox) [root@centos5 ldifs]# And this is the contents of the gid 10060 (unixsa) [root@centos5 ldifs]# ldapsearch -x -W -D 'cn=Manager,dc=homelinux,dc=net' -h 127.0.0.1 "cn=unixsa" # unixsa, Group, homelinux.net dn: cn=unixsa,ou=Group,dc=homelinux,dc=net gidNumber: 10060 description: unixsa objectClass: top objectClass: posixGroup cn: unixsa memberUid: uid=dan,ou=People,dc=homelinux,dc=net memberUid: dan [root@centos5 ldifs]# And when I try to ssh into this box I get the following: [kwame@vader ~]$ ssh dan@centos5 dan@centos5's password: You must be a member of cn=access,ou=Group,dc=homelinux,dc=net to login. Connection closed by 192.168.122.225 [kwame@vader ~]$ This is the info for the user dan [root@centos5 ldifs]# id dan uid=10051(uid=dan,ou=People,dc=homelinux,dc=net) gid=10051(dan) groups=10051(dan),10060(unixsa) Comments? Thoughts? Words of wisdom? Best regards

1 0

SSL handshake failure
by Bryce Powell 29 Feb '12

29 Feb '12

Hi, I can't get slapd to respond successfully to TLS or SSL connections using an RSA 2048-bit PEM certificate: $ ldapsearch -x -ZZ -d1 -H ldap://FQDNhostname TLS: loaded CA certificate file /etc/openldap/cacerts/FQDNhostname.cacert.pem. TLS: error: tlsm_PR_Recv returned 0 - error 21:Is a directory TLS: error: connect - force handshake failure: errno 21 - moznss error -5938 TLS: can't connect: TLS error -5938:Encountered end of file. ldap_err2string ldap_start_tls: Connect error (-11) additional info: TLS error -5938:Encountered end of file $ openssl s_client -connect FQDNhostname:636 -CAfile /etc/openldap/cacerts/FQDNhostname.cacert.pem CONNECTED(00000003) 140457427965768:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:184: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 113 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE --- The following packages are installed on CentOS 6.2: openldap-servers-2.4.23-20.el6.x86_64 openldap-2.4.23-20.el6.x86_64 openldap-clients-2.4.23-20.el6.x86_64 openssl-1.0.0-20.el6_2.1.x86_64 openssl-devel-1.0.0-20.el6_2.1.x86_64 gnutls-2.8.5-4.el6.x86_64 gnutls-devel-2.8.5-4.el6.x86_64 nss-pam-ldapd-0.7.5-14.el6_2.1.x86_64 The /etc/openldap/ldap.conf file contains: TLS_CACERT /etc/openldap/cacerts/FQDNhostname.cacert.pem , which contains a chain of three certificates (root CA, intermediate/functional, and issuing). The /etc/openldap/slapd.conf file contains: TLSCipherSuite HIGH:+SSLv3 TLSCertificateFile /etc/openldap/FQDNhostname.cert.pem TLSCertificateKeyFile /etc/openldap/FQDNhostname.key.pem The server is acting as a proxy to an Active Directory, and therefore I only have one LDAP database defined. My intention is to use LDAPS for communication between the client and LDAP proxy servers: database ldap suffix "dc=abc,dc=local" rebind-as-user uri "ldap://IPaddress1/ ldap://IPaddress2/ ldap://IPaddress3/ ldap://IPaddress4/" chase-referrals yes noundeffilter yes use-temporary-conn yes The certificate and private key are located in /etc/openldap/, with the following permissions : -r--r-----. 1 ldap ldap 2076 Feb 21 15:30 FQDNhostname.cert.pem -r--r-----. 1 ldap ldap 1675 Feb 21 15:35 FQDNhostname.sdi.key.pem The CN of the certificate matches the FQDN host name of the LDAP server. The private key is not password protected. Everything checks out OK by testing the certificate using openssl: $ openssl verify -purpose sslserver -CAfile /etc/openldap/cacerts/FQDNhostname.cacert.pem /etc/openldap/FQDNhostname.cert.pem /etc/openldap/FQDNhostname.cert.pem: OK OpenSSL client/server connections work fine too: openssl s_server -cert /etc/openldap/FQDNhostname.cert.pem -key /etc/openldap/FQDNhostname.key.pem -cipher 'HIGH:+SSLv3 openssl s_client -connect FQDNhostname:4433 -CAfile /etc/openldap/cacerts/FQDNhostname.cacert.pem Bryce Powell

3 6

slapd-meta and LDAPS/SSL problem.
by Jim Vanes 29 Feb '12

29 Feb '12

Hello, Sorry, I tried posting this yesterday but it didn't seem to make it on the list - trying again. I currently have OpenLDAP (2.4.28) running on a Linux box with a local database and a meta backend which represents the local database along with a remote Active Directory server (2008 R2). Below is a snapshot of my slapd.conf. #------------------------------------------------------------ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema loglevel -1 modulepath /usr/lib/openldap/ allow bind_v2 database bdb suffix "dc=local,dc=example,dc=com" directory /var/lib/ldap rootdn "cn=root,dc=local,dc=example,dc=com" rootpw secret database meta suffix "dc=example,dc=com" rootdn "cn=root,dc=example,dc=com" rootpw secret ## Local uri ldap://localhost/ou=Users,dc=local,dc=example,dc=com idassert-bind bindmethod=simple binddn="cn=root,dc=local,dc=example,dc=com" credentials=secret ##Remote Active Directory uri ldap://ad.example.com/cn=Users,dc=example,dc=com idassert-bind bindmethod=simple binddn="cn=sync,cn=users,dc=example,dc=com" credentials=secret # tls_cacert=/etc/openldap/cacerts/ad-ca.cer # tls_cert=/etc/openldap/local.pem # tls_key=/etc/openldap/local.key #----------------------------------------------------------- When I run the following command: ldapsearch -x -D "cn=root, dc=example,dc=com" -w secret -b " dc=example,dc=com " -H ldap://localhost Everything works as expected with the above config , meaning I see the local and remote/proxied entries on AD with the root credentials specified above. Logs on AD indicate that a user sync preformed a search. As I understand, id-assertion is working?? Now if I change the remote entry to the following (enable ssl): ##Remote Active Directory uri ldaps://ad.example.com/cn=Users,dc=example,dc=com idassert-bind bindmethod=simple binddn="cn=sync,cn=users,dc=example,dc=com" credentials=secret tls_cacert=/etc/openldap/cacerts/ad-ca.cer tls_cert=/etc/openldap/local.pem tls_key=/etc/openldap/local.key The same command (ldapsearch -x -D "cn=root, dc=example,dc=com" -w secret -b " dc=example,dc=com " -H ldap://localhost) binds locally successfully but does not list any remote attributes from AD. Verbose logging enabled on Active Directory indicates an anonymous bind and subsequent failure. This is what I'm trying to understand. However, if I search using an account that resides on the AD server (-D " cn=sync,cn=users,dc=example,dc=com" -w secret) it works and the traffic is encrypted. The root account "seems" to be ignored when it comes to the assertion butonly when ssl is enabled. Now, if I use TLS instead, ##Remote Active Directory uri ldap://ad.example.com/cn=Users,dc=example,dc=com tls start idassert-bind bindmethod=simple binddn="cn=sync,cn=users,dc=example,dc=com" credentials=secret tls_cacert=/etc/openldap/cacerts/ad-ca.cer tls_cert=/etc/openldap/local.pem tls_key=/etc/openldap/local.key Everything works, and I see the remote entries in AD using the meta root credentials. I've verified the network traffic to ensure it was indeed encrypted. I've also verified that using ldapsearch directly (ex: -H ldaps://ad.exmaple.com) to AD and it also functions as intended. I did play around with slapd-ldap and it seemed behave the same as meta regarding ldaps. In my eyes, something in my configuration makes the proxy seemingly ignore ldaps entries. Hopefully I didn't miss anything painfully obvious in the docs :) Thanks,

1 0

Configure OpenLDAP with MySQL backend
by Bruce Wen 28 Feb '12

28 Feb '12

Hi Dears, Do you have experience in configuring OpenLDAP with MySQL backend? If true, could you please share the key points? Bruce Wen iSoftStone Information Technology ( Group ) Co. Ltd. Jiahua Plaza, Shangdi 3rd Rd, Haidian District / Phone: 86-10-58749844 / Mobile: 13466687621 地址：北京市海淀区上地三街9号嘉华大厦E座8层

1 0

JIS X 0213
by suzuka46 28 Feb '12

28 Feb '12

Hi, I would like to install Openldap in Japanese environment. Is "JIS X 0213" of a Japanese character code supported in OpenLDAP?

2 2

cert options in ssl/tls connections
by Qiang Xu 28 Feb '12

28 Feb '12

Hello All, Today I came across a strange problem. I wrote a program to test ldap ssl/tls connection with OpenLDAP library. Something like the code snippet as follows: int ret = LDAP_OPT_SUCCESS; int cert_flag = LDAP_OPT_X_TLS_NEVER; ... ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &cert_flag); if (ret != LDAP_OPT_SUCCESS) { fprintf(stderr, "unable to set require cert option (LDAP_OPT_X_TLS_REQUIRE_CERT): %s\n", ldap_err2string(ret)); } ... // bind to the server cert_flag = LDAP_OPT_X_TLS_DEMAND; ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &cert_flag); if (ret != LDAP_OPT_SUCCESS) { fprintf(stderr, "unable to set require cert option (LDAP_OPT_X_TLS_REQUIRE_CERT): %s\n", ldap_err2string(ret)); } ... // bind to the server The first binding is successful, as expected. However, the second binding is also successful, which is contrary to my expectation, because I didn't create any cert file yet. Another observation here is that if the first binding with LDAP_OPT_X_TLS_NEVER is removed, and the second binding with LDAP_OPT_X_TLS_DEMAND set is done right from the beginning, then it will fail, as expected. So, it seems the first value set to the option LDAP_OPT_X_TLS_REQUIRE_CERT will override the later values, isn't it? Is it possible to change this option's value on the fly (means different bindings use different values for this cert option)? Thanks, Qiang

1 0

Delta-syncrepl issue
by Abderamane Hamani 28 Feb '12

28 Feb '12

Good morning, Is it possible to use always delta-syncrepl even the replica consumer is too far from the provider ?? Many thanks in advance

2 3

Re: Delta-syncrepl issue
by Mauricio Tavares 28 Feb '12

28 Feb '12

On Tue, Feb 28, 2012 at 1:24 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, February 28, 2012 3:54 PM +0100 Abderamane Hamani > <ahamani(a)escpeurope.eu> wrote: > >> Good morning, >> Is it possible to use always delta-syncrepl even the replica consumer is >> too far from the provider ?? Many thanks in advance > > > Your question doesn't make sense as worded. Delta-syncrepl is not limited > by physical distance. > > --Quanah > Also, depending on the traffic and connection speed between both machines, you might experience some slowdown, but it will just catch up eventually. Unless you keep changing your ldap database all the time. ;) > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

olcMirrorMode attribute in N-way multimaster
by Christopher Jones 28 Feb '12

28 Feb '12

Hi all, I'm working on an multimaster setup using the LDIF configuration (as opposed to slapd.conf). From my understanding of the documentation, Mirror Mode is distinct from N-way Multimaster in that it is an 'active-active/hot swap' configuration, and writes need to go a single server. In the admin guide's example found here: http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master the N-way multimaster has this attribute set: add: olcMirrorMode olcMirrorMode: TRUE Could someone clarify what the olcMirrorMode attribute is for in the N-way multimaster configuration? Thanks for your help in advance, Chris

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical