[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: OpenLDAP-2.1.29 Replication over SSL

In the usual case any company/organization/whatever should only have one CA. You shouldn't create a separate CA cert for each server, just use one CA and create separate server certs for each server. Your setup makes no sense.

jmorin@dominiondiagnostics.com wrote:

I know this question has been posed previously, but I haven't been able to configure replication via SSL successfully.

Here's my environment:

One Master server
One Slave server
Both running OpenLDAP 2.1.29

Master configuration:

I followed the "OpenLDAP SSL/TLS How-To" (http://www.openldap.org/pub/ksoper/OpenLDAP_TLS_howto.html#3.0)
instructions to create my own CA Issued Certificate and server cert and server key.
I also created a client cert and key.

For Master:
cp demoCA/cacert.pem /usr/var/openldap-data/MASTER-cacert.pem
mv newcert.pem /usr/var/openldap-data/MASTER-servercrt.pem
mv newreq.pem /usr/var/openldap-data/MASTER-serverkey.pem

For client: ( after creating client certificate)
mv newcert.pem ldap.slave.client.cert.pem
mv newreq.pem ldap.slave.client.key.pem

then added the following to my slapd.conf on the master

TLSCACertificateFile /usr/var/openldap-data/MASTER-cacert.pem
TLSCertificateFile /usr/var/openldap-data/MASTER-servercrt.pem
TLSCertificateKeyFile /usr/var/openldap-data/MASTER-serverkey.pem

then added the following to the ldap.conf file on the client (slave)
TLS_CACERT /usr/var/openldap-data/MASTER.cacert.pem
added the following to the ldaprc file
TLS_CERT /usr/var/openldap-data/ldap.slave.client.cert.pem
TLS_KEY /usr/var/openldap-data/ldap.slave.client.key.pem

At this point the Master is set up to receive LDAP traffic over port 636, the client ( in this case the slave machine) can connect just fine using ldapsearch, ldapmodify, etc.

I then set up the SLAVE server to accept ldap traffic via SSL is the same manner.

Create the ca on the SLAVE
Create the SLAVE-cacert.pem, SLAVE-servercrt.pem, and SLAVE-serverkey.pem.

Create a client cert and key. ldap.master.client.cert.pem and ldap.master.client.key.pem

Add the following to the SLAVE servers slapd.conf file
TLSCACertificateFile /usr/var/openldap-data/SLAVE-cacert.pem
TLSCertificateFile /usr/var/openldap-data/SLAVE-servercrt.pem
TLSCertificateKeyFile /usr/var/openldap-data/SLAVE-serverkey.pem

then add the following to the ldap.conf file on the master
TLS_CACERT /usr/var/openldap-data/SLAVE-cacert.pem
add the following to the ldaprc file
TLS_CERT /usr/var/openldap-data/ldap.master.client.cert.pem
TLS_KEY /usr/var/openldap-data/ldap.master.client.key.pem

Again, the master can connect to the slave (via SSL) using ldapsearch, etc.

I set up the MASTER slapd.conf for replication

replogfile      /var/lib/ldap/master-slapd.replog
replica uri=ldaps://slave.domain.com

configure the SLAVE slapd.conf for replication/referrals

updatedn "uid=Replicator,ou=someOU,dc=domiain,dc=com"
updateref ldaps://master.domain.com

At this point I restarted both LDAP servers and was able to connect to each one using ldapsearch from some client via SSL.
Referrals work fine (although NOT over port 636), but replication does NOT.
If I switch the 'replica uri=ldap://servername' is works fine, on port 389.

I read in the list by Howard Chu:
"Since you have two different self-signed certs, one for master and one for
you should cat them both into a single file. Then, in slapd.conf of both the
master and slave you should specify TLSCACertificateFile with the file you
just created."

So I concatenated both the slave and master cacert.pem files into ONE file (/usr/var/openldap-data/cacert.pem) and changed BOTH the master and slave slapd.conf files to use

TLSCACertificateFile /usr/var/openldap-data/cacert.pem

it's the same file on both machines, it's the two cacert.pem files concatentated together into one file. everything else remains the same.

Restart ldap on both servers.

I can connect from slave to master via ssl using ldapsearch.
I can connect from mast to slave via ssl using ldapsearch (ex. ldapsearch -LLL -H ldaps://master.domain.com .......)

referrals still work, but replication does not.

I'm receiving these messages on the master server in the /var/log/messages file

slurpd: Initializing session to ldaps://slave.domain.com
slurpd: bind to slave.domain.com:636 as uid=Replicator,ou=someOU,dc=domain,dc=com (simple)
slurpd: TLS: can't connect.
slurpd: Error: ldap_simple_bind_s for slave.domain.com:636 failed: Can't contact LDAP server

On the slave I'm receiving (in the ldap.log file)
slapd[7478]: conn=45 fd=8 ACCEPT from IP= (IP=
slapd[7478]: connection_get(8)
slapd[7478]: connection_get(8)
slapd[7478]: conn=45 fd=8 closed

using ethereal on the slave server I see the master trying to initiate an SSL connection, but it's getting a TLS handshake failure.

Can someone tell me where I'm going wrong?

I'm guessing it's my SSL configuration, but I'm not sure where to start.
Do I need to issue ALL the certificates and keys from ONE ca? If so which certs/keys go where?

Thank you for your anticipated help!

Joe Morin

CONFIDENTIALITY NOTICE: This e-mail, including attachments, is for the sole use of the individual to whom it is addressed. This message is confidential and may contain information that is privileged, confidential and is exempt from disclosure under applicable law. Any unauthorized review, use, disclosure or distribution is prohibited. If you have received this e-mail in error, please notify the sender by reply e-mail and destroy this message and its attachments.

 -- Howard Chu
 Chief Architect, Symas Corp.       Director, Highland Sun
 http://www.symas.com               http://highlandsun.com/hyc
 Symas: Premier OpenSource Development and Support