[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: OpenLDAP-2.1.29 Replication over SSL
jmorin@dominiondiagnostics.com wrote:
I know this question has been posed previously, but I haven't been able to
configure replication via SSL successfully.
Here's my environment:
One Master server
One Slave server
Both running OpenLDAP 2.1.29
Master configuration:
I followed the "OpenLDAP SSL/TLS How-To"
(http://www.openldap.org/pub/ksoper/OpenLDAP_TLS_howto.html#3.0)
instructions to create my own CA Issued Certificate and server cert and
server key.
I also created a client cert and key.
...
At this point the Master is set up to receive LDAP traffic over port 636,
the client ( in this case the slave machine) can connect just fine using
ldapsearch, ldapmodify, etc.
I then set up the SLAVE server to accept ldap traffic via SSL is the same
manner.
Create the ca on the SLAVE
Create the SLAVE-cacert.pem, SLAVE-servercrt.pem, and SLAVE-serverkey.pem.
Create a client cert and key. ldap.master.client.cert.pem and
ldap.master.client.key.pem
Add the following to the SLAVE servers slapd.conf file
TLSCACertificateFile /usr/var/openldap-data/SLAVE-cacert.pem
TLSCertificateFile /usr/var/openldap-data/SLAVE-servercrt.pem
TLSCertificateKeyFile /usr/var/openldap-data/SLAVE-serverkey.pem
then add the following to the ldap.conf file on the master
TLS_CACERT /usr/var/openldap-data/SLAVE-cacert.pem
TLS_REQCERT demand
add the following to the ldaprc file
TLS_CERT /usr/var/openldap-data/ldap.master.client.cert.pem
TLS_KEY /usr/var/openldap-data/ldap.master.client.key.pem
Again, the master can connect to the slave (via SSL) using ldapsearch,
etc.
I set up the MASTER slapd.conf for replication
replogfile /var/lib/ldap/master-slapd.replog
replica uri=ldaps://slave.domain.com
binddn="uid=Replicator,ou=someOU,dc=domain,dc=com"
bindmethod=simple
credentials=password
configure the SLAVE slapd.conf for replication/referrals
updatedn "uid=Replicator,ou=someOU,dc=domiain,dc=com"
updateref ldaps://master.domain.com
At this point I restarted both LDAP servers and was able to connect to
each one using ldapsearch from some client via SSL.
Referrals work fine (although NOT over port 636), but replication does
NOT.
If I switch the 'replica uri=ldap://servername' is works fine, on port
389.
I read in the list by Howard Chu:
"Since you have two different self-signed certs, one for master and one
for
slave,
you should cat them both into a single file. Then, in slapd.conf of both
the
master and slave you should specify TLSCACertificateFile with the file you
just created."
I should also have said "this is a stupid thing to do."
So I concatenated both the slave and master cacert.pem files into ONE file
(/usr/var/openldap-data/cacert.pem) and changed BOTH the master and slave
slapd.conf files to use
TLSCACertificateFile /usr/var/openldap-data/cacert.pem
it's the same file on both machines, it's the two cacert.pem files
concatentated together into one file. everything else remains the same.
Restart ldap on both servers.
I can connect from slave to master via ssl using ldapsearch.
I can connect from mast to slave via ssl using ldapsearch
(ex. ldapsearch -LLL -H ldaps://master.domain.com .......)
referrals still work, but replication does not.
I'm receiving these messages on the master server in the /var/log/messages
file
slurpd: Initializing session to ldaps://slave.domain.com
slurpd: bind to slave.domain.com:636 as
uid=Replicator,ou=someOU,dc=domain,dc=com (simple)
slurpd: TLS: can't connect.
slurpd: Error: ldap_simple_bind_s for slave.domain.com:636 failed: Can't
contact LDAP server
On the slave I'm receiving (in the ldap.log file)
slapd[7478]: conn=45 fd=8 ACCEPT from IP=192.168.100.1:35608
(IP=0.0.0.0:636)
slapd[7478]: connection_get(8)
slapd[7478]: connection_get(8)
slapd[7478]: conn=45 fd=8 closed
using ethereal on the slave server I see the master trying to initiate an
SSL connection, but it's getting a TLS handshake failure.
Can someone tell me where I'm going wrong?
I'm guessing it's my SSL configuration, but I'm not sure where to start.
Do I need to issue ALL the certificates and keys from ONE ca? If so which
certs/keys go where?
This is a basic question about how SSL and PKI works. You need to
already understand these topics before trying to use SSL with any
particular system (such as OpenLDAP). It is not the job of the OpenLDAP
Project to teach you how SSL works. Nevertheless, the 2.2 Admin Guide
spells out quite clearly where all of the certs need to go.
Thank you for your anticipated help!
Joe Morin
CONFIDENTIALITY NOTICE: This e-mail, including attachments, is for the sole use of the individual to whom it is addressed. This message is confidential and may contain information that is privileged, confidential and is exempt from disclosure under applicable law. Any unauthorized review, use, disclosure or distribution is prohibited. If you have received this e-mail in error, please notify the sender by reply e-mail and destroy this message and its attachments.
Alas, this email has been disclosed and distributed.
--
-- Howard Chu
Chief Architect, Symas Corp. Director, Highland Sun
http://www.symas.com http://highlandsun.com/hyc
Symas: Premier OpenSource Development and Support