[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Samba 3.0.1 and OpenLDAP 2.2.4 with TLS
Hi all I know this may be more a Samba question but I'm hoping this is
something someone else has done.
I've been searching the lists and web for an answer but i'm stumped hope
some one here has an answer for me. As I'm new to this sysadmin role.
I have set up OpenLDAP to authenticate our linux users and exim MTAs.
This all works fine with OpenLDAP only providing a ldaps:/// connection
on 636.
However I cannot for the life of me get samba to speak tls to it. I've
seen numerous suggestions of simply putting
ldap ssl = start_tls or
ldap ssl = on
in the smb.conf file but neither do the trick my dev platform that
doesn't use tls works fine. However I get the following responses from
the above two options.
with start_tls I get a not supported option
[root@ki-14 source]# smbpasswd ritchiem
New SMB password:
Retype new SMB password:
Failed to issue the StartTLS instruction: Not Supported
Connection to LDAP Server failed for the 1 try!
smbldap_search_suffix: Problem during the LDAP search: (unknown) (Not
Supported)
Failed to issue the StartTLS instruction: Not Supported
Connection to LDAP Server failed for the 1 try!
smbldap_search_suffix: Problem during the LDAP search: (unknown) (Not
Supported)
Failed to find entry for user ritchiem.
Failed to modify password entry for user ritchiem
and with ldap ssl = on , the conection just dies
[root@ki-14 source]# smbpasswd ritchiem
New SMB password:
Retype new SMB password:
failed to bind to server with dn= cn=Manager,dc=kelvininstitute,dc=com
Error: Can't contact LDAP server
(unknown)
Connection to LDAP Server failed for the 1 try!
Broken pipe
Now I'm guessing that the reason I get "Not Supported" from the
start_tls is that my backeddb is a ldapam with a ldaps url and so all
comms should be secure. However when running strace over the above
command the reason that I get a broken pipe with ssl = on is that it is
trying to send the dn= cn=Manager,dc=kelvininstitute,dc=com and password
as plain text.
One final thing about the smb.conf file. Is the ldap port information
actually used as when running testparm it doesn't show up in the output
and the port to connect on seems to be determined by the backend passdb
uri; either ldap for 386 or ldaps for 636. Is this so or am I missing a
trick?
Any suggestions on how to make this go?
tia
--
Martin Ritchie
the Kelvin Institute
50, George Street
Glasgow
Scotland, UK
G1 1QE
www.kelvininstitute.com
+44 (0) 141 548 5719
--
To unsubscribe from this list go to the following URL and read the
instructions: http://lists.samba.org/mailman/listinfo/samba
--
Martin Ritchie
the Kelvin Institute
50, George Street
Glasgow
Scotland, UK
G1 1QE
www.kelvininstitute.com
+44 (0) 141 548 5719