Hi,<div>I am using openldap-2.4.26 on one machine, and pam_ldap-186 and nss_ldap-265 on another machine, both machines running Fedora-10.</div><div><br></div><div>I am trying for a secure communication using TLS/SSL. when I try to connect to the LDAP client machine using SSH, after authentication success the shell prompt is returned after 3 min or 4 mins. I don't know why it is taking so much time. This is happening for the users which are present only in LDAP database i.e. this user is not created on the client machine.</div><div><br></div><div>At the server side I am getting following errors.</div><div><br></div><div><div>TLS: can't accept: (unknown).</div><div>connection_read(18): TLS accept failure error=-1 id=1068, closing</div><div>connection_closing: readying conn=1068 sd=18 for close</div><div>connection_close: conn=1068 sd=18</div><div>daemon: removing 18</div><div>conn=1068 fd=18 closed (TLS negotiation failure)</div><div>daemon: epoll: listen=7 active_threads=0 tvp=NULL</div><div>daemon: activity on 1 descriptor</div><div>daemon: activity on:</div><div>daemon: epoll: listen=7 active_threads=0 tvp=NULL</div></div><div><br></div><div>I have created the CA certificate with CA.sh script. I followed the procedure given below.</div><div><a href="http://octaldream.com/~scottm/talks/ssl/opensslca.html">http://octaldream.com/~scottm/talks/ssl/opensslca.html</a></div><div><br></div><div>I copied the same cacert.pem file from server to the client machine afte running the above procedure on server machine.</div><div><br></div><div>The configuration files are as follows.</div><div>slapd.conf</div><div><br></div><div><div>include &nbsp; &nbsp; &nbsp; &nbsp; /usr/local/etc/openldap/schema/core.schema</div><div>include &nbsp; &nbsp; &nbsp; &nbsp; /usr/local/etc/openldap/schema/cosine.schema</div><div>include &nbsp; &nbsp; &nbsp; &nbsp; /usr/local/etc/openldap/schema/inetorgperson.schema</div><div>include &nbsp; &nbsp; &nbsp; &nbsp; /usr/local/etc/openldap/schema/nis.schema</div></div><div><br></div><div><div>LSCipherSuite &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;HIGH:MEDIUM:+SSLv2:+SSLv3:RSA</div><div>TLSCACertificateFile &nbsp; &nbsp;/etc/pki/CA/cacert.pem</div><div>TLSCertificateFile &nbsp; &nbsp; &nbsp;/etc/pki/tls/misc/newcert.pem</div><div>TLSCertificateKeyFile &nbsp; /etc/pki/tls/misc/newkey.pem</div><div>TLSVerifyClient &nbsp; &nbsp; &nbsp; &nbsp; allow</div></div><div><br></div><div><div>pidfile &nbsp; &nbsp; &nbsp; &nbsp; /usr/local/var/run/slapd.pid</div><div>argsfile &nbsp; &nbsp; &nbsp; &nbsp;/usr/local/var/run/slapd.args</div></div><div><br></div><div><div>access to attrs=userPassword</div><div>&nbsp;by self &nbsp; &nbsp; &nbsp; write</div><div>&nbsp;by anonymous &nbsp;auth</div><div>&nbsp;by * &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;none</div><div>&nbsp;</div><div>access to *</div><div>&nbsp;by * &nbsp; &nbsp; &nbsp; &nbsp; read</div></div><div><div>#######################################################################</div><div># BDB database definitions</div><div>#######################################################################</div><div>&nbsp;</div><div>database &nbsp; &nbsp; &nbsp; &nbsp;bdb</div><div>suffix &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"dc=samsung,dc=com"</div><div>rootdn &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"cn=Manager,dc=samsung,dc=com"</div><div># Cleartext passwords, especially for the rootdn, should</div><div># be avoid. &nbsp;See slappasswd(8) and slapd.conf(5) for details.</div><div># Use of strong authentication encouraged.</div><div>rootpw &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;123qwe</div><div># The database directory MUST exist prior to running slapd AND</div><div># should only be accessible by the slapd and slap tools.</div><div># Mode 700 recommended.</div><div>directory &nbsp; &nbsp; &nbsp; /usr/local/var/openldap-data</div><div># Indices to maintain</div><div>#unique id so equality match only</div><div>index &nbsp; uid &nbsp; &nbsp; eq</div><div>index &nbsp; userPassword &nbsp; &nbsp;eq</div><div>#allows general searching on commonname,givenname and mail</div><div>index &nbsp; cn,gn,sn,ou,o,mail eq,sub</div><div>index &nbsp; objectClass &nbsp; &nbsp; eq</div></div><div><br></div><div><br></div><div><br></div><div>and ldap.conf has the following configuration</div><div><br></div><div>base dc=samsung,dc=com</div><div>uri ldaps://localhost.localdomain/</div><div>tls_cacertfile &nbsp;/etc/pki/CA/cacert.pem</div><div>pam_password md5</div><div>nss_map_attribute gecos description</div><div><br></div><div><br></div><div>Please let me know where I am making mistake? how to fix this problem.</div><div><br></div><div>Warm Regards</div><div>Vijay S.</div><br><A HREF="http://sigads.rediff.com/RealMedia/ads/click_nx.ads/www.rediffmail.com/signatureline.htm@Middle?" target="_blank"><IMG SRC="http://sigads.rediff.com/RealMedia/ads/adstream_nx.ads/www.rediffmail.com/signatureline.htm@Middle"></A><br><table width="578" border="0" cellspacing="0" cellpadding="0"><tr><td><span style="font-family:Arial, Helvetica, sans-serif; font-size:12px; color:#393939;">Follow&nbsp;<span style="color:#0000CC;"><b><u><a href="http://track.rediff.com/click?url=___http://dealhojaye.rediff.com?sc_cid=rediffmailsignature___&cmp=signature&lnk=rediffmailsignature&newservice=deals" target="_blank">Rediff Deal ho jaye!</a></u></b></span>&nbsp;to get exciting offers in your city everyday.</span></td></tr></table>