10:57 p.m.
Hi
I tried to use ciphers that bring PFS for OpenLDAP, but it did not work.
I used this cipher specification:
TLSCipherSuite ECDH:DH:!SHA:!MD5:!aNULL:!eNULL
I test it this way:
for i in `openssl ciphers ALL|tr ':' '\n'` ; do
echo ''|openssl s_client -cipher $i -connect server:636 \
2>/dev/null |awk '/ Cipher/{print }' ;
done
I get nothing. I understand ECDH needs some support code, but why aren't
DH ciphers available?
--
Emmanuel Dreyfus
http://hcpnet.free.fr/pubz
manu(a)netbsd.org
11:19 p.m.
Emmanuel Dreyfus wrote:
Hi
I tried to use ciphers that bring PFS for OpenLDAP, but it did not work.
I used this cipher specification:
TLSCipherSuite ECDH:DH:!SHA:!MD5:!aNULL:!eNULL
I test it this way:
for i in `openssl ciphers ALL|tr ':' '\n'` ; do
echo ''|openssl s_client -cipher $i -connect server:636 \
2>/dev/null |awk '/ Cipher/{print }' ;
done
I get nothing. I understand ECDH needs some support code, but why aren't
DH ciphers available?
Read the slapd.conf(5) or slapd-config(5) manpage. You must configure the
TLSDHParamFile.
Your ciphersuite is wrong anyway. You want DHE, not DH, for PFS.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
12:32 a.m.
On Wed, Sep 18, 2013 at 11:19:27PM -0700, Howard Chu wrote:
Read the slapd.conf(5) or slapd-config(5) manpage. You must
configure the TLSDHParamFile.
Thanks.
Your ciphersuite is wrong anyway. You want DHE, not DH, for PFS.
Either I miss something subbtle, or I am right:
$ openssl ciphers DH:!SHA:!aNULL|tr ':' '\n'
DHE-DSS-AES256-GCM-SHA384
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-SHA256
DHE-DSS-AES256-SHA256
DHE-DSS-AES128-GCM-SHA256
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
DHE-DSS-AES128-SHA256
$ openssl ciphers DHE:!SHA:!aNULL|tr ':' '\n'
Error in cipher list
--
Emmanuel Dreyfus
manu(a)netbsd.org
9:56 a.m.
Emmanuel Dreyfus <manu(a)netbsd.org> wrote:
> Read the slapd.conf(5) or slapd-config(5) manpage. You must
> configure the TLSDHParamFile.
Thanks.
It works fine. I thought I had a problem with MacOS X machines causing
"TLS negotiation faied" messages, but they also do it without the
change. It seems each time I type "id some_user" in MacOS X's shell, it
will always attempt a first TCP connexion to the LDAP server, fail TLS
without sending anything, and then attempt a second TCP connexion with
TLS.
Weird. I don't ask for an answer on this question but just post it for
future reference in case someone has the same behavior: this TLS
negotiation failure is not a failure.
--
Emmanuel Dreyfus
http://hcpnet.free.fr/pubz
manu(a)netbsd.org
11:32 p.m.
On Thu, 19 Sep 2013, Emmanuel Dreyfus wrote:
I tried to use ciphers that bring PFS for OpenLDAP, but it did not
work.
I used this cipher specification:
...
I get nothing. I understand ECDH needs some support code, but why
aren't
DH ciphers available?
To point to my answer on the thread 12 days ago:
http://www.openldap.org/lists/openldap-technical/201309/msg00091.html
Philip Guenther
3732
days inactive
3732
days old
openldap-technical@openldap.org
4 comments
4 participants
participants (4)
-
Emmanuel Dreyfus -
Howard Chu -
manu＠netbsd.org
-
Philip Guenther