[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: Openldap and sssd: getting slapd to do TLS negotiation or getting sssd to NOT do TLS negotiation
- To: Quanah Gibson-Mount <quanah@symas.com>
- Subject: Re: Openldap and sssd: getting slapd to do TLS negotiation or getting sssd to NOT do TLS negotiation
- From: Robert Heller <heller@deepsoft.com>
- Date: Thu, 28 Sep 2017 21:13:24 -0400 (EDT)
- Cc: Robert Heller <heller@deepsoft.com>, Openldap Technical <openldap-technical@openldap.org>
- Dkim-filter: OpenDKIM Filter v2.11.0 sharky3.deepsoft.com ADA7473236F
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=deepsoft.com; s=deepsoft.com; t=1506647604; bh=Ac22oPh/54RzQ274nB6iYGSZQ5Zye9HV3qFtw9VXsMw=; h=From:Subject:In-Reply-To:References:To:Cc:Date:From; b=VnCi5W3Ddm5vG7r1ETGlLN7RLCrd3xidiNcULv4Z9UdG/FbMAwgrhQScC9YAMeqY9 Zik3gHgobKccE6WzSuqHK4cUjeyN/8IUhMI1J+uDTMo2MfOy+CCq+vKmfyV+5rZyKS XxszwLQ/bt122+aTaikTPNdXWsfM9LuAV+Aqb+qg=
- In-reply-to: <BF48977FD2D24041BC5162B1@[192.168.1.30]>
- Organization: Deepwoods Software
- References: <20170928170817.DE268732A40@sharky3.deepsoft.com> <WM!3841d97ef9fe61874abde790669c89cda7491f751a8d1d42d6fedcad23ad03723369227f2cf988e1296a97f7d1455a45!@mailstronghold-2.zmailcloud.com> <3631C46B10C6A6D96C92A6CA@[192.168.1.30]> <20170928183434.C52377323F2@sharky3.deepsoft.com> <WM!d02d61414b21d1174b6888ab449c4269fa38d934004f76ade936b18cd00ea29eb903d4c22a82e75a76373bb72667b68d!@mailstronghold-3.zmailcloud.com> <5A6DACC51CF6F5156270C77F@[192.168.1.30]> <20170928222847.4DB0673214C@sharky3.deepsoft.com> <WM!e44771223f353f14c1fb1c1bfabc671035d32332b89f8fa0533164857a667d1dff2107e4e7324089965527c8f3a9e645!@mailstronghold-1.zmailcloud.com> <BF48977FD2D24041BC5162B1@[192.168.1.30]>
At Thu, 28 Sep 2017 16:08:42 -0700 Quanah Gibson-Mount <quanah@symas.com> wrote:
>
> --On Thursday, September 28, 2017 7:28 PM -0400 Robert Heller
> <heller@deepsoft.com> wrote:
>
> > At Thu, 28 Sep 2017 12:29:19 -0700 Quanah Gibson-Mount <quanah@symas.com>
> > wrote:
> >
> >>
> >> --On Thursday, September 28, 2017 3:34 PM -0400 Robert Heller
> >> <heller@deepsoft.com> wrote:
> >>
> >>
> >> > Slapd is reporting TLS Negotiation failure when SSSD tries to connect
> >> > to it. For both port 389 (ldap:///) and 636 (ldaps:///). So I guess
> >> > something is wrong with slapd's TLS configuration -- it is failing to
> >> > do TLS Negotiation, either it is just not doing it or it is doing it
> >> > wrong (somehow). Unless SSSD is not configured properly.
> >>
> >> You need to start with the following:
> >>
> >> >> ldapwhoami -x -ZZ -H ldap://myhost:389 -D binddn -w
> >>
> >> to test startTLS
> >>
> >> and
> >>
> >> ldapwhoami -x -H ldaps://myhost:636 -D binddn -w
> >>
> >> to test without startTLS
> >>
> >> If you can get those to work, then you can move on to SSSD.
> >
> > [heller@c764guest ~]$ ldapwhoami -x -ZZ -H ldap://c764guest:389 -D
> > cn=Manager,dc=deepsoft,dc=com -W ldap_start_tls: Connect error (-11)
> > additional info: TLS error -8157:Certificate extension not found.
>
> This may be of help:
> <https://serverfault.com/questions/640910/my-certificate-doesnt-work-on-all-machines>
>
> > [heller@c764guest ~]$ ldapwhoami -x -H ldaps://c764guest:636 -D
> > cn=Manager,dc=deepsoft,dc=com -W Enter LDAP Password:
> > ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
>
> This may mean slapd isn't listening on port 636 (With no -d -1 info, hard
> to know for sure). It may also simply be a different manifistation of the
> error above.
I added a -d option (picked 10), and discovered that it wanted the full name
as specificed in the certificate. That fixed ldapwhoami and I put that in
ldap.conf, smb.conf, and in sssd.conf, but sssd is still not behaving (samba
is though, mostly -- it might also be having issues since sssd is not
working)...
>
> --Quanah
>
>
> --
>
> Quanah Gibson-Mount
> Product Architect
> Symas Corporation
> Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
> <http://www.symas.com>
>
>
--
Robert Heller -- 978-544-6933
Deepwoods Software -- Custom Software Services
http://www.deepsoft.com/ -- Linux Administration Services
heller@deepsoft.com -- Webhosting Services