|
Hi Folks,
I have a openldap server version slapd 2.4.16 running on a Solaris-10 OS. I have generated the self signed CA certificate on the ldap server to use TLS and configured the slapd.conf with certificate information. I am looking to get LDAP authentication using TLS on the ldap client side. I was able to setup centos-6.3 linux as ldap client using openldap client to LDAP authentication using TLS but I am having issues to setup a Solaris-10 OS using native LDAP client software. Solaris-10 LDAP client is setup using 'ldapclient manaul' and certificate was added using certutil command. Here is error messages seeing when trying to authenticate when using LDAP-TLS in sladp.log file on the openldap server side, Jan 14 14:51:53 ldapsrv slapd[543]: [ID 848112 local4.debug] conn=1270 fd=25 ACCEPT from IP=10.90.180.236:41051 (IP=0.0.0.0:636) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 609413 local4.debug] daemon: waked Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 802679 local4.debug] daemon: activity on: Jan 14 14:51:53 ldapsrv slapd[543]: [ID 522297 local4.debug] 25r Jan 14 14:51:53 ldapsrv slapd[543]: [ID 100000 local4.debug] Jan 14 14:51:53 ldapsrv slapd[543]: [ID 694296 local4.debug] daemon: read activity on 25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 525477 local4.debug] connection_get(25) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 611214 local4.debug] connection_get(25): got connid=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 138202 local4.debug] connection_read(25): checking for input on id=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 609413 local4.debug] daemon: waked Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 802679 local4.debug] daemon: activity on: Jan 14 14:51:53 ldapsrv slapd[543]: [ID 522297 local4.debug] 25r Jan 14 14:51:53 ldapsrv slapd[543]: [ID 100000 local4.debug] Jan 14 14:51:53 ldapsrv slapd[543]: [ID 694296 local4.debug] daemon: read activity on 25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 525477 local4.debug] connection_get(25) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 611214 local4.debug] connection_get(25): got connid=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 138202 local4.debug] connection_read(25): checking for input on id=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 688457 local4.debug] connection_read(25): TLS accept failure error=-1 id=1270, closing Jan 14 14:51:53 ldapsrv slapd[543]: [ID 734893 local4.debug] connection_closing: readying conn=1270 sd=25 for close Jan 14 14:51:53 ldapsrv slapd[543]: [ID 330685 local4.debug] connection_close: conn=1270 sd=25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 609413 local4.debug] daemon: waked Jan 14 14:51:53 ldapsrv slapd[543]: [ID 423323 local4.debug] daemon: removing 25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 485650 local4.debug] conn=1270 fd=25 closed (TLS negotiation failure) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 802679 local4.debug] daemon: activity on: Jan 14 14:51:53 ldapsrv slapd[543]: [ID 522297 local4.debug] 23r Jan 14 14:51:53 ldapsrv slapd[543]: [ID 100000 local4.debug] On the ldap client side I have enabled pam debugging and I see the following error messages associated with it, Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 492885 auth.debug] PAM[6459]: pam_setcred(80c9bd8, 2) Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 931871 auth.debug] PAM[6459]: load_modules(80c9bd8, pam_sm_setcred)=/usr/lib/security/pam_authtok_get.s o.1 Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 962116 auth.debug] PAM[6459]: pam_setcred(80c9bd8, 2): error Permission denied Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 509612 auth.debug] PAM[6459]: pam_set_item(80c9bd8:authtok) Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 725776 auth.debug] PAM[6459]: pam_end(80c9bd8): status = Permission denied Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 826707 auth.debug] PAM[6820]: pam_set_item(80c9bd8:authtok) Jan 14 14:52:45 drac9ec2 last message repeated 1 time Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 887652 auth.debug] PAM[6820]: pam_authenticate(80c9bd8, 1): error Authentication failed Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 285619 auth.debug] ldap pam_sm_authenticate(sshd-kbdint ldapusr2), flags = 1 Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 293258 auth.warning] libsldap: Status: 81 Mesg: openConnection: simple bind failed - Can't contact LDA P server Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 887652 auth.debug] PAM[6820]: pam_authenticate(80c9bd8, 1): error Permission denied Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 826707 auth.debug] PAM[6820]: pam_set_item(80c9bd8:authtok) Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 800047 auth.info] Keyboard-interactive (PAM) userauth failed[9] while authenticating: Authentication fa iled Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 800047 auth.notice] Failed keyboard-interactive for ldapusr2 from 10.90.176.38 port 44078 ssh2 Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 826707 auth.debug] PAM[6820]: pam_set_item(80c9bd8:conv) Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 814791 auth.debug] PAM[6820]: pam_end(80c9bd8): status = Authentication failed Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 324150 auth.debug] PAM[6820]: pam_start(sshd-kbdint,ldapusr2,80a98a8:80c9bd8) - debug = 1 Here is the ldapclient I have ran to setup the ldapclient, ldapclient -v manual -a defaultServerList=10.90.177.2 -a credentialLevel=anonymous -a domainName=dvsg-ldap.com -a defaultSearchBase=dc=dvsg-ldap,dc=com -a authenticationMethod=tls:simple -a serviceAuthenticationMethod=pam_ldap:tls:simple -a proxyDN=cn=readonly,dc=dvsg-ldap,dc=com -a proxyPassword=secret -a certificatePath=/var/ldap Any guidance or help to resolve this issue would be most appreciated. thank you, Arvind. |