[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: RedHat 9's ldapsearch segfaults with SubjectAltName certificates



Frank Swasey wrote:

Maybe I'm just stupid, but with the impending upgrade of my production servers from 2.0.27 to 2.1.22, I've have bitten the bullet and generated SSL certificates for them that utilize the SubjectAltName construct. This is required because the master uses a private network to send the update traffic to the slave(s) so they have to be known by different names.

However, another member of my team is building a cluster that is using stock RedHat 9's openldap (2.0.27-8), nss_ldap (202-5), and nscd (2.3.2-27.9) and through the process of elimination we have discovered that the ldapsearch binary will segfault if the LDAP server's SSL certificate contains the SubjectAltName parameters.

I attempted to upgrade one of the systems to OpenLDAP 2.1.22, but then nscd refused to run and I had to reimage the system because there was no way in..... Ouch!

Far be it from me to lecture one so illustrious as you ... but just the following notes and suggestions:


Seg faults and RH 9 seem to abound - for various reasons. SuSE gives its own problems which neither you nor I want.. I've staked my reputation on RH9 and have yet to find out I'm wrong by the system actually dying on me.

What I've done: Production RH9 server that has to run as an Openldap server with Postfix 2.0.14 and Courier 2.0.0 IMAPD with LDAP support. LDAP support has to authenticate another (production, primary) RH9 LTSP server. All compiles from source. All installs into Linux (more or less) standard directories (so /usr/local is not used for any of this.) All installations with checkinstall 1.53 to generate rpms which replace the RH9 rpms and satisfy all dependencies (checkinstall rips out the old RH rpm and installs the new with what I've compiled.) checkinstall is a breeze for generating one's own rpms without any hassle.

Components: Openssl 0.9.7b (first,) Cyrus SASL 2.1.13 with LDAP-modified auxprop libraries for Postfix SASL support (o.k. there are newer, but they have bugs - all installs to /usr/lib/sasl2,) Berkeley BDB 4.1.25, Openldap 2.1.22. Everything is SSL/TLS apart from Postfix LDAP support (I haven't tried SubjectAltName, but nscd runs without problems and nothing's crashed yet.) Standard RH9 pam, libnss; PADL'S nss_ldap-203 and pam_ldap-164 (self-compiled, checkinstall.)

The most important point about all the above is that the RH9 Openssl libs and "other peoples' rpms" which have used their own libraries and dependencies lead to 'orrible segfaults under other conditions, too.

YMMV.

Tony

--
Tony Earnshaw

http://www.billy.demon.nl
Mail: tonni@billy.demon.nl