Authentication failed with ldaps configuration

2 Dec 2009

    smainklh@free.fr wrote:
    > ----- Mail Original -----
    > De: "Zdenek Styblik" <stybla@turnovfree.net>
    > À: smainklh@free.fr
    > Cc: openldap-technical@openldap.org
    > Envoyé: Mercredi 2 Décembre 2009 16h37:01 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne
    > Objet: Re: Authentication failed with ldaps configuration
    > 
    > smainklh@free.fr wrote:
    >> Hi everyone,
    >>
    >> I configured my ldap server (debian lenny) to listen on port 636 (ldaps) but it doesn't seems to work when issuing a remote connexion.
    >> Perhaps i did a mistake when generating the certificates ?....
    >>
    >> When i try to browse the ldap server from a remote server i get the following message :
    >> ----------
    >> root@vmtest:~# ldapsearch -d 1 -Wx -H ldaps://ldapserver.domain.tld -D cn=admin,dc=domain,dc=tld
    >> ldap_url_parse_ext(ldaps://ldapserver.domain.tld)
    >> ldap_create
    >> ldap_url_parse_ext(ldaps://ldapserver.domain.tld:636/??base)
    >> Enter LDAP Password:
    >> ldap_sasl_bind
    >> ldap_send_initial_request
    >> ldap_new_connection 1 1 0
    >> ldap_int_open_connection
    >> ldap_connect_to_host: TCP ldapserver.domain.tld:636
    >> ldap_new_socket: 3
    >> ldap_prepare_socket: 3
    >> ldap_connect_to_host: Trying 10.10.48.40:636
    >> ldap_pvt_connect: fd: 3 tm: -1 async: 0
    >> TLS: peer cert untrusted or revoked (0x42)
    >> ldap_err2string
    >> ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
    >> -----------
    >>
    >> I generated the certificates with the following command :
    >> # openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout server.pem -days 3650
    >>
    >> -----------
    >>
    >> Then i tried the connexion :
    >> openssl s_client -connect ldapserver.domain.tld:636 -showcerts
    >> CONNECTED(00000003)
    >> depth=0 /C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld
    >> verify error:num=18:self signed certificate
    >> verify return:1
    >> depth=0 /C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld
    >> verify return:1
    >> ---
    >> Certificate chain
    >>  0 s:/C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld
    >>    i:/C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld
    >> -----BEGIN CERTIFICATE-----
    >> MIIDDTCCAnagAwIBAgIJAM7IwuTIzhwqMA0GCSqGSIb3DQEBBQUAMGMxCzAJBgNV
    >> BAYTAkZSMRMwEQYDVQQIEwpTb21lLVN0YXRlMQ4wDAYDVQQHEwVQYXJpczELMAkG
    >> A1UEChMCQlQxIjAgBgNVBAMTGWlwb2MwMS5pcG9jLmJ0c2VydmljZXMuZnIwHhcN
    >> MDkxMTI0MTUwMTUxWhcNMTkxMTIyMTUwMTUxWjBjMQswCQYDVQQGEwJGUjETMBEG
    >> A1UECBMKU29tZS1TdGF0ZTEOMAwGA1UEBxMFUGFyaXMxCzAJBgNVBAoTAkJUMSIw
    >> IAYDVQQDExlpcG9jMDEuaXBvYy5idHNlcnZpY2VzLmZyMIGfMA0GCSqGSIb3DQEB
    >> AQUAA4GNADCBiQKBgQCm5FrQ3dN1Jkxj2SZsPr+vkYDlwVnvqDCxnAs3O5NJ/1uY
    >> F9/mwsCVdAnp04Eywo3BCbvP6tlzsF3JbAlqMLTb85ZTHOqRQncXGfVZ7bMnR071
    >> tQ70/b3vF/TuMYiOU7vXf2h863aRi11tT9xHD17wFfFaXBtRIIOioc3UpJWWPwID
    >> AQABo4HIMIHFMB0GA1UdDgQWBBREqX/HQEzU5TCDrBsbttUxa44fnDCBlQYDVR0j
    >> BIGNMIGKgBREqX/HQEzU5TCDrBsbttUxa44fnKFnpGUwYzELMAkGA1UEBhMCRlIx
    >> EzARBgNVBAgTClNvbWUtU3RhdGUxDjAMBgNVBAcTBVBhcmlzMQswCQYDVQQKEwJC
    >> VDEiMCAGA1UEAxMZaXBvYzAxLmlwb2MuYnRzZXJ2aWNlcy5mcoIJAM7IwuTIzhwq
    >> MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAd0Le1JyJF8zBs0RYvEn7
    >> c1nhVbsdD8FDBTa4IaNvkbIt8al6G7bBpfyDxcMVtgFc8zHt/+sYfTxWuHh7m+b1
    >> yjJtD9vMjIigbaZq4VJOz11JEWsQHc8wo3So+G+CelTz4HXPoGh5vqRtTkupjedz
    >> 0DDsA1jd9F4KpYSOkzxosdc=
    >> -----END CERTIFICATE-----
    >> ---
    >> Server certificate
    >> subject=/C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld
    >> issuer=/C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld
    >> ---
    >> No client certificate CA names sent
    >> ---
    >> SSL handshake has read 1107 bytes and written 316 bytes
    >> ---
    >> New, TLSv1/SSLv3, Cipher is AES256-SHA
    >> Server public key is 1024 bit
    >> Compression: NONE
    >> Expansion: NONE
    >> SSL-Session:
    >>     Protocol  : TLSv1
    >>     Cipher    : AES256-SHA
    >>     Session-ID: 9EF5F2D4FD72A0D1161C8334537F1ADF60C8B790A3F699B6DC52557E3C95D427
    >>     Session-ID-ctx:
    >>     Master-Key: 015D50D6D93F502E37EDB577691F05D157E80A439A2B129B370EEA24E651E828A172E43B3F6D29174BF33B96193202F0
    >>     Key-Arg   : None
    >>     Start Time: 1259761586
    >>     Timeout   : 300 (sec)
    >>     Verify return code: 18 (self signed certificate)
    >> ---
    >>
    >> ------------------
    >>
    >> My ldap.conf
    >> -----------------
    >> BASE    dc=domain,dc=tld
    >> URI     ldaps://ldapserver.domain.tld/
    >> TLS_REQCERT allow
    >>
    >>
    >> My slapd.conf :
    >> ----------------
    >> ...
    >> TLSCACertificateFile /etc/ldap/ssl/server.pem
    >> TLSCertificateFile /etc/ldap/ssl/server.pem
    >> TLSCertificateKeyFile /etc/ldap/ssl/server.pem
    >> ...
    >>
    >> ------------------
    >> My /etc/default/slapd.conf
    >> ...
    >> SLAPD_SERVICES="ldaps://ldapserver.domain.tld"
    >> ...
    >>
    >> Could you please help me ? 
    >>
    > 
    > Hello,
    > 
    > are you sure the server is listetning at 636?
    > 
    > --- SNIP ---
    > ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
    > ------------
    > 
    > It seems more like a network problem to me.
    > Please, verify it by % netstat -nlp | grep 636; or eventually by %
    > netstat -nlp | grep 389; at the server.
    > 
    > Regards,
    > Zdenek
    > 
    > Hi Zdenek,
    > 
    > Yes i'm.
    > 
    > netstat -nlp | grep 636
    > tcp        0      0 10.10.48.40:636         0.0.0.0:*               LISTEN 
    > netstat -nlp | grep 389
    > 
    > Logs from the ldap server
    > -----------
    > Dec  3 10:10:04 ldapserver slapd[20754]: slap_listener_activate(8):
    > Dec  3 10:10:04 ldapserver slapd[20754]: >>> slap_listener(ldaps://ldapserver.domain.tld)
    > Dec  3 10:10:04 ldapserver slapd[20754]: connection_get(14): got connid=42
    > Dec  3 10:10:04 ldapserver slapd[20754]: connection_read(14): checking for input on id=42
    > Dec  3 10:10:04 ldapserver slapd[20754]: connection_get(14): got connid=42
    > Dec  3 10:10:04 ldapserver slapd[20754]: connection_read(14): checking for input on id=42
    > Dec  3 10:10:04 ldapserver slapd[20754]: connection_read(14): unable to get TLS client DN, error=49 id=42
    > Dec  3 10:10:04 ldapserver slapd[20754]: connection_get(14): got connid=42
    > Dec  3 10:10:04 ldapserver slapd[20754]: connection_read(14): checking for input on id=42
    > Dec  3 10:10:04 ldapserver slapd[20754]: ber_get_next on fd 14 failed errno=0 (Success)
    > Dec  3 10:10:04 ldapserver slapd[20754]: connection_closing: readying conn=42 sd=14 for close
    > Dec  3 10:10:04 ldapserver slapd[20754]: connection_close: conn=42 sd=14
    > 
    > It seems to be a certificate problem.
    > -----
    > TLS: peer cert untrusted or revoked
    > -----
    > 
    > Do you have any idea ?
    > Grifith


    Evening Grifith,

    I'm sorry I've missed that one. I'm no expert, but I can give you my
    config-files.
    I've used 'easy-rsa' to generate all certificates. It comes with
    OpenVPN, but it might be as standalone package in Debian. It's set of
    scripts for certificate manipulation, and it surely eases up things.
    One thing that came to my mind, certificate "has" to bear same FQDN as
    IP eg. if 192.168.1.1 -eq server1.mydomain.tld then certificate should
    be generated and contain server1.mydomain.tld.
    Another thing is .key files should have chmod 400.

    --- client side ---
    cat /etc/openldap/ldap.conf

    BASE	dc=mydomain,dc=tld
    URI		ldaps://server1.mydomain.tld
    port	636
    ssl		yes
    #ssl             start_tls
    TLS_CACERT  /etc/openldap/ssl/ca.mydomain.crt
    TLS_CERT	/etc/ssl/certs/server2.mydomain.tld.crt
    TLS_KEY	/etc/ssl/private/server2.mydomain.tld.key
    TLS_REQCERT never
    TLS_CIPHER_SUITE  HIGH:MEDIUM:+SSLv3
    ------------------

    --- server ---
    cat /etc/openldap/slapd.conf
    ...
    TLSCipherSuite  HIGH:MEDIUM:+SSLv3
    TLSCACertificateFile    /etc/ssl/certs/ca.mydomain.crt
    TLSCertificateFile      /etc/ssl/certs/server1.mydomain.tld.crt
    TLSCertificateKeyFile   /etc/ssl/private/server1.mydomain.tld.key
    TLSVerifyClient never
    ...
    --------------

    I hope it helps, at least a bit.

    Have a nice evening,
    Zdenek

    PS: Thunderbird refused to accept the rest of the text for some reason,
    I had to c&p it inside.

When i try to browse the ldap server from a remote server i get the following message :

-----END CERTIFICATE-----

No client certificate CA names sent

SSL handshake has read 1107 bytes and written 316 bytes

My ldap.conf

My slapd.conf :

When i try to browse the ldap server from a remote server i get the following message :

-----END CERTIFICATE-----

No client certificate CA names sent

SSL handshake has read 1107 bytes and written 316 bytes

My ldap.conf

My slapd.conf :

When i try to browse the ldap server from a remote server i get the following message :

-----END CERTIFICATE-----

No client certificate CA names sent

SSL handshake has read 1107 bytes and written 316 bytes

My ldap.conf

My slapd.conf :

Logs from the ldap server

It seems to be a certificate problem.

TLS: peer cert untrusted or revoked

SERVER

My slapd.conf :

My ldap.conf :

CLIENT

SERVER

My slapd.conf :

My ldap.conf :

CLIENT