From: Alexey Borovskoy <alexey_borovskoy@pochtamt.ru> To: community@altlinux.ru Subject: Re: [Comm] OpenLDAP и SSL Date: Mon, 21 Apr 2003 16:11:46 +1300 Message-ID: <200304211611.47313.alexey_borovskoy@pochtamt.ru> (raw) In-Reply-To: <20030419103729.GA11727@mrkooll.tdr.pibhe.com> * 19 Апрель 2003 23:37 Maxim Tyurin <mrkooll@tdr.pibhe.com> > On Sat, Apr 19, 2003 at 02:53:48PM +1300, Alexey Borovskoy wrote: > > Добрый день. > > > > Не получается подружить openldap с openssl. > > Без ssl ldap работает нормально. > > > > Дано: > > openldap-servers-2.0.27-alt5 > > openldap-2.0.27-alt5 > > openssl-0.9.6i-alt3 > > > > 1. Генерю сертификат с помощью > > openssl req -new -x509 -nodes -out ldap.pem -keyout ldap.pem > > Есть у меня подозрения что сертификат криво сгенерировался > (нет в нем самого ключа, а только сертификат). В pem 2 секции В файле две секции сертификат и ключ. Я их даже по отдельности генерил с подписью ключем сертификатора. Т.е ca.cert, ldap.private, ldap.cert В логах проскакивала какая-то 40 ошибка. Я просто не могу понять где это все дохнет и почему. Рядом стоит NUT с SSL и работает. Вот что говорит тестилка от openssl [root@server openldap]# openssl s_client -connect server.intranet:636 -state CONNECTED(00000004) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL3 alert read:fatal:handshake failure SSL_connect:error in SSLv2/v3 read server hello A 24884:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:465: [root@server openldap]# openssl ciphers -v ALL DHE-DSS-RC4-SHA SSLv3 Kx=DH Au=DSS Enc=RC4(128) Mac=SHA1 EXP1024-DHE-DSS-RC4-SHA SSLv3 Kx=DH(1024) Au=DSS Enc=RC4(56) Mac=SHA1 export EXP1024-RC4-SHA SSLv3 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export EXP1024-DHE-DSS-DES-CBC-SHA SSLv3 Kx=DH(1024) Au=DSS Enc=DES(56) Mac=SHA1 export EXP1024-DES-CBC-SHA SSLv3 Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export EXP1024-RC2-CBC-MD5 SSLv3 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export EXP1024-RC4-MD5 SSLv3 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH Au=RSA Enc=DES(56) Mac=SHA1 EXP-EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1 EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH Au=DSS Enc=DES(56) Mac=SHA1 EXP-EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH(512) Au=DSS Enc=DES(40) Mac=SHA1 export DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 DES-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export IDEA-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=IDEA(128) Mac=SHA1 EXP-RC2-CBC-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export ADH-DES-CBC3-SHA SSLv3 Kx=DH Au=None Enc=3DES(168) Mac=SHA1 ADH-DES-CBC-SHA SSLv3 Kx=DH Au=None Enc=DES(56) Mac=SHA1 EXP-ADH-DES-CBC-SHA SSLv3 Kx=DH(512) Au=None Enc=DES(40) Mac=SHA1 export ADH-RC4-MD5 SSLv3 Kx=DH Au=None Enc=RC4(128) Mac=MD5 EXP-ADH-RC4-MD5 SSLv3 Kx=DH(512) Au=None Enc=RC4(40) Mac=MD5 export RC4-64-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5 DES-CBC3-MD5 SSLv2 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 DES-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 IDEA-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=IDEA(128) Mac=MD5 RC2-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 EXP-RC2-CBC-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export RC4-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 EXP-RC4-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export Это на клиенте [alb@alb alb]$ cat /etc/openldap/ldap.conf # $OpenLDAP: pkg/ldap/libraries/libldap/ldap.conf,v 1.4.8.6 2000/09/05 17:54:38 kurt Exp $ # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. base dc=intranet host server.intranet:636 uri ldaps://server.intranet/ tls_ciphers TLSv1 ssl start_tls ssl on #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never Может какие либы не стоят? ---- Алексей.
next prev parent reply other threads:[~2003-04-21 3:11 UTC|newest] Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top 2003-04-19 1:53 Alexey Borovskoy 2003-04-19 10:37 ` Maxim Tyurin 2003-04-21 3:11 ` Alexey Borovskoy [this message] 2003-04-21 10:22 ` Igor Muratov 2003-04-22 6:14 ` Alexey Borovskoy 2003-04-22 10:43 ` Igor Muratov 2003-04-22 22:18 ` Alexey Borovskoy 2003-05-05 16:17 ` Igor Muratov 2003-04-22 22:30 ` Dmitry Lebkov 2003-04-23 2:06 ` Alexey Borovskoy 2003-04-23 2:17 ` Alexey Borovskoy 2003-04-23 2:33 ` Dmitry Lebkov 2003-04-23 3:28 ` Alexey Borovskoy
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=200304211611.47313.alexey_borovskoy@pochtamt.ru \ --to=alexey_borovskoy@pochtamt.ru \ --cc=community@altlinux.ru \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
ALT Linux Community general discussions This inbox may be cloned and mirrored by anyone: git clone --mirror http://lore.altlinux.org/community/0 community/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 community community/ http://lore.altlinux.org/community \ mandrake-russian@linuxteam.iplabs.ru community@lists.altlinux.org community@lists.altlinux.ru community@lists.altlinux.com public-inbox-index community Example config snippet for mirrors. Newsgroup available over NNTP: nntp://lore.altlinux.org/org.altlinux.lists.community AGPL code for this site: git clone https://public-inbox.org/public-inbox.git