6:57 a.m.
Hi All,
I've been running slapd with "-h ldaps:///" so that it takes SSL/TLS
connections on port 636. This has worked with most clients (Outlook,
Seamonkey, Thunderbird) but does not work for Evolution. I don't know
why not, but Evolution seems to insist on using port 389 for secure
connections.
When I type
openssl s_client -connect my.server.com:389
It says connection refused. When I type the same command with :636 at
the end it connects fine.
Could somebody explain to me how to tell slapd to accept secure
connections on port 389? I am using the new version of slapd in Debian
Testing (2.4.7-1).
Sorry if this is a really stupid question, but according to the docs the
"startTLS" process should be automatic if a secure connection comes in
on port 389. Something is obviously not quite right.
Thanks in advance,
Chris
This e-mail may contain information which is confidential, legally privileged and/or
copyright protected. This e-mail is intended for the addressee only. If you receive this
in error, please contact the sender and delete the material from your computer
9 a.m.
--On Monday, January 28, 2008 2:57 PM +0000 Chris Carr
<chris.carr(a)Camden.gov.uk> wrote:
Hi All,
I've been running slapd with "-h ldaps:///" so that it takes SSL/TLS
connections on port 636. This has worked with most clients (Outlook,
Seamonkey, Thunderbird) but does not work for Evolution. I don't know
why not, but Evolution seems to insist on using port 389 for secure
connections.
When I type
openssl s_client -connect my.server.com:389
If you read the documentation on openssl, it clearly states it doesn't
support doing LDAP startTLS over port 389.
I suggest using ldapsearch -ZZ -H ldap://my.server.com:389/
or similar.
--Quanah
--
Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc
--------------------
Zimbra :: the leader in open source messaging and collaboration
9:10 a.m.
On Mon, 2008-01-28 at 09:00 -0800, Quanah Gibson-Mount wrote:
--On Monday, January 28, 2008 2:57 PM +0000 Chris Carr
> Hi All,
>
> I've been running slapd with "-h ldaps:///" so that it takes SSL/TLS
> connections on port 636. This has worked with most clients (Outlook,
> Seamonkey, Thunderbird) but does not work for Evolution. I don't know
> why not, but Evolution seems to insist on using port 389 for secure
> connections.
>
> When I type
>
> openssl s_client -connect my.server.com:389
If you read the documentation on openssl, it clearly states it doesn't
support doing LDAP startTLS over port 389.
I thought startTLS was supposed to be the replacement for ldaps, so that
only one port was needed for both secure and insecure connections.
Wasn't that discussed on this list quite recently? I have definitely
misunderstood something.
Still, at least I can now focus on why Evolution isn't connecting
properly on port 636.
I suggest using ldapsearch -ZZ -H ldap://my.server.com:389/
That gives me "Can't contact LDAP server (-1)". Same if I use :636 in
fact.
CC
This e-mail may contain information which is confidential, legally privileged and/or
copyright protected. This e-mail is intended for the addressee only. If you receive this
in error, please contact the sender and delete the material from your computer
9:33 a.m.
--On Monday, January 28, 2008 5:10 PM +0000 Chris Carr
<chris.carr(a)camden.gov.uk> wrote:
On Mon, 2008-01-28 at 09:00 -0800, Quanah Gibson-Mount wrote:
> --On Monday, January 28, 2008 2:57 PM +0000 Chris Carr
>
> > Hi All,
> >
> > I've been running slapd with "-h ldaps:///" so that it takes
SSL/TLS
> > connections on port 636. This has worked with most clients (Outlook,
> > Seamonkey, Thunderbird) but does not work for Evolution. I don't know
> > why not, but Evolution seems to insist on using port 389 for secure
> > connections.
> >
> > When I type
> >
> > openssl s_client -connect my.server.com:389
>
> If you read the documentation on openssl, it clearly states it doesn't
> support doing LDAP startTLS over port 389.
I thought startTLS was supposed to be the replacement for ldaps, so that
only one port was needed for both secure and insecure connections.
Wasn't that discussed on this list quite recently? I have definitely
misunderstood something.
You are correct, startTLS is the replacement for LDAPS. My point is, if
you read the documentation about the "openssl s_client" command, the
openssl folks have yet to add support for LDAP startTLS to it. Which is
why using that command in your case for testing it is pointless.
As for the debian 2.4.7 package, there's a bug already tracking this issue.
I'm not clear if it is a GnuTLS bug or an OpenLDAP bug or both. I don't
use OpenLDAP with GnuTLS myself. ;)
--Quanah
--
Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc
--------------------
Zimbra :: the leader in open source messaging and collaboration
7:05 p.m.
Chris Carr <chris.carr(a)Camden.gov.uk> writes:
Could somebody explain to me how to tell slapd to accept secure
connections on port 389? I am using the new version of slapd in Debian
Testing (2.4.7-1).
Just to mention, this may well be a problem with the Debian build. We're
still trying to sort that out.
--
Russ Allbery (rra(a)stanford.edu) <http://www.eyrie.org/~eagle/>
9:51 p.m.
Chris Carr skrev, on 28-01-2008 15:57:
I've been running slapd with "-h ldaps:///" so that it
takes SSL/TLS
connections on port 636. This has worked with most clients (Outlook,
Seamonkey, Thunderbird) but does not work for Evolution. I don't know
why not, but Evolution seems to insist on using port 389 for secure
connections.
Evo will connect to port 636 ok, *if* you specify 'the_host:636' in your
connection box. It works out that this is ssl for itself.
[...]
--Tonni
--
Tony Earnshaw
Email: tonni at hetnet dot nl
4:24 a.m.
> I've been running slapd with "-h ldaps:///" so
that it
> takes SSL/TLS connections on port 636. This has worked
> with most clients (Outlook, Seamonkey, Thunderbird) but
> does not work for Evolution. I don't know why not, but
> Evolution seems to insist on using port 389 for secure
> connections.
Evo will connect to port 636 ok, *if* you specify
'the_host:636' in your
connection box. It works out that this is ssl for itself.
But where do you put in your password? At the moment I'm getting
"Connection Refused" (from slapd's logs, not from Evo) - I've chosen
"Bind using distinguished name" but Evo does not ask me for a password,
and it just fails to connect (telling me the URI may be wrong!).
Thanks to Russ and Quanah for correcting me re Debian slapd and openssl.
CC
This e-mail may contain information which is confidential, legally privileged and/or
copyright protected. This e-mail is intended for the addressee only. If you receive this
in error, please contact the sender and delete the material from your computer
7:31 a.m.
Carr, Chris skrev, on 29-01-2008 13:24:
>> I've been running slapd with "-h ldaps:///" so
that it
>> takes SSL/TLS connections on port 636. This has worked
>> with most clients (Outlook, Seamonkey, Thunderbird) but
>> does not work for Evolution. I don't know why not, but
>> Evolution seems to insist on using port 389 for secure
>> connections.
> Evo will connect to port 636 ok, *if* you specify
> 'the_host:636' in your
> connection box. It works out that this is ssl for itself.
But where do you put in your password?
Darn it, you forced me to start up Evo and I'd rather not. The password
goes in my IMAP incoming mail tab under authentication types, tick off
remember password.
At the moment I'm getting
"Connection Refused" (from slapd's logs, not from Evo) - I've chosen
"Bind using distinguished name" but Evo does not ask me for a password,
and it just fails to connect (telling me the URI may be wrong!).
Oh. if you mean the password for LDAP, does this help? It's been so long
since I did it, that ... this is for Evo 2.8.3.
Best,
--Tonni
--
Tony Earnshaw
Email: tonni at hetnet dot nl
7:58 a.m.
>>> I've been running slapd with "-h
ldaps:///" so that it
>>> takes SSL/TLS connections on port 636. This has worked
>>> with most clients (Outlook, Seamonkey, Thunderbird) but
>>> does not work for Evolution. I don't know why not, but
>>> Evolution seems to insist on using port 389 for secure
>>> connections.
>> Evo will connect to port 636 ok, *if* you specify
>> 'the_host:636' in your
>> connection box. It works out that this is ssl for itself.
>
> But where do you put in your password?
Darn it, you forced me to start up Evo and I'd rather not.
The password goes in my IMAP incoming mail tab under
authentication types, tick off remember password.
[...]
Oh. if you mean the password for LDAP, does this help? It's
been so long since I did it, that ... this is for Evo 2.8.3.
Heh - yes, the LDAP server is distinct from the IMAP server, and
requires a different password. I can't find anywhere to enter it in the
"LDAP Address Book" config, nor does Evo ask me for it. I have filed a
Debian bug about this in the hope that someone will either fix it or
enlighten me.
Ho hum. Apologies for interrupting the discussion of unique UUIDs ...
CC
This e-mail may contain information which is confidential, legally privileged and/or
copyright protected. This e-mail is intended for the addressee only. If you receive this
in error, please contact the sender and delete the material from your computer
7:31 a.m.
Carr, Chris skrev, on 29-01-2008 13:24:
>> I've been running slapd with "-h ldaps:///" so
that it
>> takes SSL/TLS connections on port 636. This has worked
>> with most clients (Outlook, Seamonkey, Thunderbird) but
>> does not work for Evolution. I don't know why not, but
>> Evolution seems to insist on using port 389 for secure
>> connections.
> Evo will connect to port 636 ok, *if* you specify
> 'the_host:636' in your
> connection box. It works out that this is ssl for itself.
But where do you put in your password?
Darn it, you forced me to start up Evo and I'd rather not. The password
goes in my IMAP incoming mail tab under authentication types, tick off
remember password.
At the moment I'm getting
"Connection Refused" (from slapd's logs, not from Evo) - I've chosen
"Bind using distinguished name" but Evo does not ask me for a password,
and it just fails to connect (telling me the URI may be wrong!).
Oh. if you mean the password for LDAP, does this help?
http://safari.oreilly.com/0672329298/ch28lev1sec2 It's been so long
since I did it, that ... this is for Evo 2.8.3.
Best,
--Tonni
--
Tony Earnshaw
Email: tonni at hetnet dot nl
8:10 a.m.
On Monday 28 January 2008 16:57:28 Chris Carr wrote:
Hi All,
I've been running slapd with "-h ldaps:///" so that it takes SSL/TLS
connections on port 636. This has worked with most clients (Outlook,
Seamonkey, Thunderbird) but does not work for Evolution. I don't know
why not, but Evolution seems to insist on using port 389 for secure
connections.
Which version of Evolution? Mine has a "Use secure connection" drop-down box,
with "SSL encryption", "TLS encryption" and "No encryption"
options. Since
the port doesn't change based on your selection, I'll assume what they
actually mean is "ldaps", "STARTTLS", and "No encryption".
Naturally,
STARTTLS would run on the normal unencrypted port (389 by default),
and "upgrade" to SSL/TLS with a STARTTLS command.
It seems that no matter what you select here, if the port is 389, it does
STARTTLS:
Jan 29 17:59:16 seaknight slapd[840]: conn=0 fd=15 ACCEPT from
IP=127.0.0.1:53243 (IP=0.0.0.0:389)
Jan 29 17:59:16 seaknight slapd[840]: conn=0 op=0 STARTTLS
Jan 29 17:59:16 seaknight slapd[840]: conn=0 op=0 RESULT oid= err=0 text=
Jan 29 17:59:16 seaknight slapd[840]: conn=0 fd=15 TLS established tls_ssf=256
ssf=256
However, if you select 636 as the port, it greys out the "Use secure
connection" drop-down box, and does ldaps.
Jan 29 18:03:51 seaknight slapd[840]: conn=14 fd=27 ACCEPT from
IP=127.0.0.1:54153 (IP=0.0.0.0:636)
Jan 29 18:03:51 seaknight slapd[840]: conn=14 fd=27 closed (TLS negotiation
failure)
Jan 29 18:03:58 seaknight slapd[840]: conn=15 fd=27 ACCEPT from
IP=127.0.0.1:45074 (IP=0.0.0.0:389)
(Can't get it to work right right now with ldaps ...).
Note however that evo caches LDAP connections, it seems you need to restart it
for your config changes to take effect.
And, it will only prompt you for the password once the connection is up ...
When I type
openssl s_client -connect my.server.com:389
It says connection refused. When I type the same command with :636 at
the end it connects fine.
Could somebody explain to me how to tell slapd to accept secure
connections on port 389? I am using the new version of slapd in Debian
Testing (2.4.7-1).
start slapd with with no -h flag, or -h "ldaps:/// ldap:///" so it listens on
port 636 for ldaps connections, and 389 for ldap connections (which could use
START_TLS to upgrade).
Sorry if this is a really stupid question, but according to the docs
the
"startTLS" process should be automatic if a secure connection comes in
on port 389. Something is obviously not quite right.
Hmm, SSL/TLS isn't really automatic ...
Regards,
Buchan
9:18 a.m.
> I've been running slapd with "-h ldaps:///" so
that it
> takes SSL/TLS connections on port 636. This has worked
> with most clients (Outlook, Seamonkey, Thunderbird)
> but does not work for Evolution. I don't know why not,
> but Evolution seems to insist on using port 389 for
> secure connections.
Which version of Evolution?
I'm currently using 2.6.3 (Debian Etch), 2.8.2 (the Windoze port) and
2.12.3 (Debian Lenny), and have also tried 2.10.3 and 2.12.2 in between.
The LDAP connection functionality seems unchanged in all these versions.
Mine has a "Use secure connection" drop-down box, with
"SSL encryption", "TLS encryption" and "No encryption"
options. Since the port doesn't change based on your
selection, I'll assume what they actually mean is
"ldaps", "STARTTLS", and "No encryption". Naturally,
STARTTLS would run on the normal unencrypted port (389
by default), and "upgrade" to SSL/TLS with a STARTTLS
command.
I have the same, and I had (belatedly) come to the same assumption.
It seems that no matter what you select here, if the port is
389, it does STARTTLS:
Jan 29 17:59:16 seaknight slapd[840]: conn=0 fd=15 ACCEPT from
IP=127.0.0.1:53243 (IP=0.0.0.0:389)
Jan 29 17:59:16 seaknight slapd[840]: conn=0 op=0 STARTTLS
Jan 29 17:59:16 seaknight slapd[840]: conn=0 op=0 RESULT oid=
err=0 text= Jan 29 17:59:16 seaknight slapd[840]: conn=0
fd=15 TLS established tls_ssf=256 ssf=256
This is encouraging - I guess you are not using the same version of
slapd as I am? (I'm using 2.4.7, which apparently has a bug with
STARTTLS, at least in Debian it does).
What log level are you choosing to get this output? Is it just "conns"?
However, if you select 636 as the port, it greys out the "Use
secure
connection" drop-down box, and does ldaps.
Yes.
Jan 29 18:03:51 seaknight slapd[840]: conn=14 fd=27 ACCEPT from
IP=127.0.0.1:54153 (IP=0.0.0.0:636)
Jan 29 18:03:51 seaknight slapd[840]: conn=14 fd=27 closed
(TLS negotiation
failure)
Jan 29 18:03:58 seaknight slapd[840]: conn=15 fd=27 ACCEPT from
IP=127.0.0.1:45074 (IP=0.0.0.0:389)
(Can't get it to work right right now with ldaps ...).
Me neither, though I had assumed that was password-related.
Note however that evo caches LDAP connections, it seems you
need to restart it for your config changes to take effect.
Ah, I didn't know that - thanks.
And, it will only prompt you for the password once the
connection is up ...
Hmmm. If I understand the output correctly, it's rejecting the
connection before asking for a password. I will have to investigate this
again.
> Could somebody explain to me how to tell slapd to accept secure
> connections on port 389?
start slapd with with no -h flag, or -h "ldaps:/// ldap:///"
so it listens on port 636 for ldaps connections, and 389 for
ldap connections (which could use START_TLS to upgrade).
I just have -h "ldaps:///" - I presumed the ldap:/// was covered
automatically as the default.
> Sorry if this is a really stupid question, but according to
> the docs the "startTLS" process should be automatic if a
> secure connection comes in on port 389. Something is
> obviously not quite right.
Hmm, SSL/TLS isn't really automatic ...
Sorry, I meant that the connection is upgraded to SSL/TLS if the
STARTTLS command is sent by the client (which you have verified
Evolution does).
Thanks muchly for your help. I will do some more testing with Evolution
until I lose the will to live once again.
I am now even getting errors with Outlook. It seems to connect ok, but
whenever I do a search it says "The Properties dialog box could not be
displayed. To display the Properties dialog box, you must select exactly
one item." - I don't know what this is about, I get the same message
whether my search is gibberish (should return no matches), unique
(should return a single match) or general (should return multiple
matches). No results are returned. It seems to be a completely incorrect
error message.
CC
This e-mail may contain information which is confidential, legally privileged and/or
copyright protected. This e-mail is intended for the addressee only. If you receive this
in error, please contact the sender and delete the material from your computer
1:57 a.m.
On Tuesday 29 January 2008 19:18:15 Carr, Chris wrote:
> It seems that no matter what you select here, if the port is
> 389, it does STARTTLS:
>
> Jan 29 17:59:16 seaknight slapd[840]: conn=0 fd=15 ACCEPT from
> IP=127.0.0.1:53243 (IP=0.0.0.0:389)
> Jan 29 17:59:16 seaknight slapd[840]: conn=0 op=0 STARTTLS
> Jan 29 17:59:16 seaknight slapd[840]: conn=0 op=0 RESULT oid=
> err=0 text= Jan 29 17:59:16 seaknight slapd[840]: conn=0
> fd=15 TLS established tls_ssf=256 ssf=256
This is encouraging - I guess you are not using the same version of
slapd as I am? (I'm using 2.4.7, which apparently has a bug with
STARTTLS, at least in Debian it does).
I don't use Debian, and on production platforms I don't use the packages
supplied by the distro, but the rebuilds (which are available at
http://staff.telkomsa.net/packages/) of the Mandriva package, for which I am
the maintainer. The output in my reply was from my Mandriva 2008.0 x86_64,
running the 2.3.38 package supplied with the distro. I will try and test the
2.4.7 packages sometime later today.
What log level are you choosing to get this output? Is it just
"conns"?
stats (256).
> However, if you select 636 as the port, it greys out the
"Use secure
> connection" drop-down box, and does ldaps.
Yes.
> Jan 29 18:03:51 seaknight slapd[840]: conn=14 fd=27 ACCEPT from
> IP=127.0.0.1:54153 (IP=0.0.0.0:636)
> Jan 29 18:03:51 seaknight slapd[840]: conn=14 fd=27 closed
> (TLS negotiation
> failure)
> Jan 29 18:03:58 seaknight slapd[840]: conn=15 fd=27 ACCEPT from
> IP=127.0.0.1:45074 (IP=0.0.0.0:389)
>
> (Can't get it to work right right now with ldaps ...).
Note that this may simply be due to me using self-signed certs ...
Me neither, though I had assumed that was password-related.
> Note however that evo caches LDAP connections, it seems you
> need to restart it for your config changes to take effect.
Ah, I didn't know that - thanks.
> And, it will only prompt you for the password once the
> connection is up ...
Hmmm. If I understand the output correctly, it's rejecting the
connection before asking for a password. I will have to investigate this
again.
> > Could somebody explain to me how to tell slapd to accept secure
> > connections on port 389?
>
> start slapd with with no -h flag, or -h "ldaps:/// ldap:///"
> so it listens on port 636 for ldaps connections, and 389 for
> ldap connections (which could use START_TLS to upgrade).
I just have -h "ldaps:///" - I presumed the ldap:/// was covered
automatically as the default.
No, logically there should be a way to prevent the use of a port which could
be used by some other application ...
> > Sorry if this is a really stupid question, but according
to
> > the docs the "startTLS" process should be automatic if a
> > secure connection comes in on port 389. Something is
> > obviously not quite right.
>
> Hmm, SSL/TLS isn't really automatic ...
Sorry, I meant that the connection is upgraded to SSL/TLS if the
STARTTLS command is sent by the client (which you have verified
Evolution does).
Thanks muchly for your help. I will do some more testing with Evolution
until I lose the will to live once again.
I am now even getting errors with Outlook. It seems to connect ok, but
whenever I do a search it says "The Properties dialog box could not be
displayed. To display the Properties dialog box, you must select exactly
one item." - I don't know what this is about, I get the same message
whether my search is gibberish (should return no matches), unique
(should return a single match) or general (should return multiple
matches). No results are returned. It seems to be a completely incorrect
error message.
It seems Outlook doesn't like self-signed certs, so I'll look at this later
once I've had time to sort out certificates for these boxes.
Regards,
Buchan
3:02 a.m.
Buchan Milne skrev, on 30-01-2008 10:57:
>> It seems that no matter what you select here, if the port is
>> 389, it does STARTTLS:
>>
>> Jan 29 17:59:16 seaknight slapd[840]: conn=0 fd=15 ACCEPT from
>> IP=127.0.0.1:53243 (IP=0.0.0.0:389)
>> Jan 29 17:59:16 seaknight slapd[840]: conn=0 op=0 STARTTLS
>> Jan 29 17:59:16 seaknight slapd[840]: conn=0 op=0 RESULT oid=
>> err=0 text= Jan 29 17:59:16 seaknight slapd[840]: conn=0
>> fd=15 TLS established tls_ssf=256 ssf=256
> This is encouraging - I guess you are not using the same version of
> slapd as I am? (I'm using 2.4.7, which apparently has a bug with
> STARTTLS, at least in Debian it does).
I don't use Debian, and on production platforms I don't use the packages
supplied by the distro, but the rebuilds (which are available at
http://staff.telkomsa.net/packages/) of the Mandriva package, for which I am
the maintainer. The output in my reply was from my Mandriva 2008.0 x86_64,
running the 2.3.38 package supplied with the distro. I will try and test the
2.4.7 packages sometime later today.
FWIW your rhl5 src rpm rebuilt on Fedora FC6 has no problems with ldaps,
ldap starttls or ldapi; it does everything perfectly normally -
otherwise I'd have reacted negatively far sooner.
[...]
Best,
--Tonni
--
Tony Earnshaw
Email: tonni at hetnet dot nl
3:12 a.m.
Tony Earnshaw wrote:
Buchan Milne skrev, on 30-01-2008 10:57:
>> This is encouraging - I guess you are not using the same version of
>> slapd as I am? (I'm using 2.4.7, which apparently has a bug with
>> STARTTLS, at least in Debian it does).
> I don't use Debian, and on production platforms I don't use the packages
> supplied by the distro, but the rebuilds (which are available at
> http://staff.telkomsa.net/packages/) of the Mandriva package, for which I am
> the maintainer. The output in my reply was from my Mandriva 2008.0 x86_64,
> running the 2.3.38 package supplied with the distro. I will try and test the
> 2.4.7 packages sometime later today.
FWIW your rhl5 src rpm rebuilt on Fedora FC6 has no problems with ldaps,
ldap starttls or ldapi; it does everything perfectly normally -
otherwise I'd have reacted negatively far sooner.
Probably because it still uses OpenSSL, and not GnuTLS like Debian does.
--
-- Howard Chu
Chief Architect, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
3:31 a.m.
Howard Chu skrev, on 30-01-2008 12:12:
[...]
> FWIW your rhl5 src rpm rebuilt on Fedora FC6 has no problems with
ldaps,
> ldap starttls or ldapi; it does everything perfectly normally -
> otherwise I'd have reacted negatively far sooner.
Probably because it still uses OpenSSL, and not GnuTLS like Debian does.
Ah. Indeed. I just knew there had to be one more reason why I don't use
Debian if I can avoid it.
Then Buchan will have to redesign his spec and rpms to add GnuTLS to Red
Hat and use that, which should be fun. It's available from Red Hat for rhl5.
--Tonni
--
Tony Earnshaw
Email: tonni at hetnet dot nl
5794
days inactive
5796
days old
openldap-technical@openldap.org
15 comments
7 participants
participants (7)
-
Buchan Milne -
Carr, Chris -
Chris Carr
-
Howard Chu -
Quanah Gibson-Mount -
Russ Allbery -
Tony Earnshaw