From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Message-ID: <3EA3C67B.4030200@altlinux.ru> Date: Mon, 21 Apr 2003 14:22:51 +0400 From: Igor Muratov User-Agent: Mozilla/5.0 (X11; U; Linux i686; ru-RU; rv:1.2.1) Gecko/20030210 X-Accept-Language: ru-ru, en MIME-Version: 1.0 To: community@altlinux.ru Subject: Re: [Comm] OpenLDAP =?KOI8-R?Q?=C9_SSL?= References: <200304191453.48391.alexey_borovskoy@pochtamt.ru> In-Reply-To: <200304191453.48391.alexey_borovskoy@pochtamt.ru> X-Enigmail-Version: 0.70.0.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=KOI8-R; format=flowed Content-Transfer-Encoding: 8bit Sender: community-admin@altlinux.ru Errors-To: community-admin@altlinux.ru X-BeenThere: community@altlinux.ru X-Mailman-Version: 2.0.9 Precedence: bulk Reply-To: community@altlinux.ru List-Unsubscribe: , List-Id: List-Post: List-Help: List-Subscribe: , List-Archive: Archived-At: List-Archive: List-Post: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Alexey Borovskoy пишет: | Добрый день. | | Не получается подружить openldap с openssl. | Без ssl ldap работает нормально. | | Дано: | openldap-servers-2.0.27-alt5 | openldap-2.0.27-alt5 | openssl-0.9.6i-alt3 | | 1. Генерю сертификат с помощью | openssl req -new -x509 -nodes -out ldap.pem -keyout ldap.pem | | cn прописываю как server.intranet. В DNS все нормально. | | 2. Получившийся сертификат кладу в /etc/openldap/ | | 3. В /etc/openldap/slapd.conf раскоментирую строчки | TLSCipherSuite HIGH:MEDIUM:+SSLv2 | TLSCertificateFile /etc/openldap/ldap.pem | TLSCertificateKeyFile /etc/openldap/ldap.pem | TLSCACertificateFile /etc/openldap/ldap.pem | | 4. Делаю service ldap start | | 5. Делаю netstat -tl | tcp 0 0 server.intranet:ldaps *:* LISTEN | | 6. Коннекчусь GQ, прописываю пароль rootdn и получаю ошибку | Can't contact LDAP server | | 7. Беру ldapsearch -ZZ -D "cn=ldapadmin,dc=intranet" -w secret -h | server.intranet -p 636 -n -v -d 9 | | получаю Есть еще подозрение что сервер не подхватил сертификат а на 636 порт законнектился без всякого ssl. Попрбуйте зайти туда telnet'ом | | ldap_init( server.intranet, 636 ) | ldap_create | ldap_extended_operation_s | ldap_extended_operation | ldap_send_initial_request | ldap_new_connection | ldap_int_open_connection | ldap_connect_to_host: server.intranet | ldap_new_socket: 3 | ldap_prepare_socket: 3 | ldap_connect_to_host: Trying 10.1.1.7:636 | ldap_connect_timeout: fd: 3 tm: -1 async: 0 | ldap_ndelay_on: 3 | ldap_is_sock_ready: 3 | ldap_ndelay_off: 3 | ldap_open_defconn: successful | ldap_send_server_request | ber_flush: 31 bytes to sd 3 | ldap_result msgid 1 | ldap_chkResponseList for msgid=1, all=1 | ldap_chkResponseList returns NULL | wait4msg (infinite timeout), msgid 1 | wait4msg continue, msgid 1, all 1 | ** Connections: | * host: server.intranet port: 636 (default) | refcnt: 2 status: Connected | last used: Sat Apr 19 14:05:27 2003 | | ** Outstanding Requests: | * msgid 1, origid 1, status InProgress | outstanding referrals 0, parent count 0 | ** Response Queue: | Empty | ldap_chkResponseList for msgid=1, all=1 | ldap_chkResponseList returns NULL | do_ldap_select | read1msg: msgid 1, all 1 | ber_get_next | ber_get_next failed. | ldap_perror | ldap_start_tls: Can't contact LDAP server | | В логах сервера: | | Apr 19 14:18:18 server slapd[21284]: slapd startup: initiated. | Apr 19 14:18:18 server slapd[21284]: slapd starting | Apr 19 14:18:18 server slapd[21294]: daemon: added 6r | Apr 19 14:18:18 server slapd[21294]: daemon: select: listen=6 | active_threads=0 tvp=NULL | Apr 19 14:18:41 server slapd[21294]: daemon: activity on 1 | descriptors | Apr 19 14:18:41 server slapd[21294]: daemon: new connection on 9 | Apr 19 14:18:41 server slapd[21294]: daemon: conn=0 fd=9 | connection from IP=10.1.1.10:32987 (IP=10.1.1.7:636) accepted. | Apr 19 14:18:41 server slapd[21294]: daemon: added 9r | Apr 19 14:18:41 server slapd[21294]: daemon: activity on: | Apr 19 14:18:41 server slapd[21294]: | Apr 19 14:18:41 server slapd[21294]: daemon: select: listen=6 | active_threads=0 tvp=NULL | Apr 19 14:18:41 server slapd[21294]: daemon: activity on 1 | descriptors | Apr 19 14:18:41 server slapd[21294]: daemon: activity on: | Apr 19 14:18:41 server slapd[21294]: 9r | Apr 19 14:18:41 server slapd[21294]: | Apr 19 14:18:41 server slapd[21294]: daemon: read activity on 9 | Apr 19 14:18:41 server slapd[21294]: connection_get(9) | Apr 19 14:18:41 server slapd[21294]: connection_get(9): got | connid=0 | Apr 19 14:18:41 server slapd[21294]: connection_read(9): checking | for input on id=0 | Apr 19 14:18:41 server slapd[21294]: connection_read(9): TLS | accept error error=-1 id=0, closing | Apr 19 14:18:41 server slapd[21294]: connection_closing: readying | conn=0 sd=9 for close | Apr 19 14:18:41 server slapd[21294]: connection_close: conn=0 | sd=9 | Apr 19 14:18:41 server slapd[21294]: daemon: removing 9 | Apr 19 14:18:41 server slapd[21294]: conn=-1 fd=9 closed | Apr 19 14:18:41 server slapd[21294]: daemon: select: listen=6 | active_threads=0 tvp=NULL | Apr 19 14:18:41 server slapd[21294]: daemon: activity on 1 | descriptors | Apr 19 14:18:41 server slapd[21294]: daemon: select: listen=6 | active_threads=0 tvp=NULL | | Что я делаю не так? | | ---- | Алексей. | _______________________________________________ | Community mailing list | Community@altlinux.ru | http://www.altlinux.ru/mailman/listinfo/community - -- With best regards System administrator Igor Muratov mailto:migor at altlinux.ru -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQE+o8Z7qjgjB/MK76QRAq3HAKCgxsRK8fV0+LqEPByIGc/Hm9Id0gCgrUSi yzNRPb/kqF/xG+iFxsYJQog= =MGWg -----END PGP SIGNATURE-----