[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: OpenLDAP-2.1.29 Replication over SSL

jmorin@dominiondiagnostics.com wrote:

I know this question has been posed previously, but I haven't been able to configure replication via SSL successfully.

Here's my environment:

One Master server
One Slave server
Both running OpenLDAP 2.1.29

Master configuration:

I followed the "OpenLDAP SSL/TLS How-To" (http://www.openldap.org/pub/ksoper/OpenLDAP_TLS_howto.html#3.0)
instructions to create my own CA Issued Certificate and server cert and server key.
I also created a client cert and key.
...

At this point the Master is set up to receive LDAP traffic over port 636, the client ( in this case the slave machine) can connect just fine using ldapsearch, ldapmodify, etc.

I then set up the SLAVE server to accept ldap traffic via SSL is the same manner.

Create the ca on the SLAVE
Create the SLAVE-cacert.pem, SLAVE-servercrt.pem, and SLAVE-serverkey.pem.

Create a client cert and key. ldap.master.client.cert.pem and ldap.master.client.key.pem

Add the following to the SLAVE servers slapd.conf file
TLSCACertificateFile /usr/var/openldap-data/SLAVE-cacert.pem
TLSCertificateFile /usr/var/openldap-data/SLAVE-servercrt.pem
TLSCertificateKeyFile /usr/var/openldap-data/SLAVE-serverkey.pem

then add the following to the ldap.conf file on the master
TLS_CACERT /usr/var/openldap-data/SLAVE-cacert.pem
TLS_REQCERT demand
add the following to the ldaprc file
TLS_CERT /usr/var/openldap-data/ldap.master.client.cert.pem
TLS_KEY /usr/var/openldap-data/ldap.master.client.key.pem

Again, the master can connect to the slave (via SSL) using ldapsearch, etc.

I set up the MASTER slapd.conf for replication

replogfile      /var/lib/ldap/master-slapd.replog
replica uri=ldaps://slave.domain.com
       binddn="uid=Replicator,ou=someOU,dc=domain,dc=com"
       bindmethod=simple
       credentials=password

configure the SLAVE slapd.conf for replication/referrals

updatedn "uid=Replicator,ou=someOU,dc=domiain,dc=com"
updateref ldaps://master.domain.com

At this point I restarted both LDAP servers and was able to connect to each one using ldapsearch from some client via SSL.
Referrals work fine (although NOT over port 636), but replication does NOT.
If I switch the 'replica uri=ldap://servername' is works fine, on port 389.

I read in the list by Howard Chu:
"Since you have two different self-signed certs, one for master and one for
slave,
you should cat them both into a single file. Then, in slapd.conf of both the
master and slave you should specify TLSCACertificateFile with the file you
just created."


I should also have said "this is a stupid thing to do."

So I concatenated both the slave and master cacert.pem files into ONE file (/usr/var/openldap-data/cacert.pem) and changed BOTH the master and slave slapd.conf files to use

TLSCACertificateFile /usr/var/openldap-data/cacert.pem

it's the same file on both machines, it's the two cacert.pem files concatentated together into one file. everything else remains the same.

Restart ldap on both servers.

I can connect from slave to master via ssl using ldapsearch.
I can connect from mast to slave via ssl using ldapsearch (ex. ldapsearch -LLL -H ldaps://master.domain.com .......)

referrals still work, but replication does not.

I'm receiving these messages on the master server in the /var/log/messages file

slurpd: Initializing session to ldaps://slave.domain.com
slurpd: bind to slave.domain.com:636 as uid=Replicator,ou=someOU,dc=domain,dc=com (simple)
slurpd: TLS: can't connect.
slurpd: Error: ldap_simple_bind_s for slave.domain.com:636 failed: Can't contact LDAP server

On the slave I'm receiving (in the ldap.log file)
slapd[7478]: conn=45 fd=8 ACCEPT from IP=192.168.100.1:35608 (IP=0.0.0.0:636)
slapd[7478]: connection_get(8)
slapd[7478]: connection_get(8)
slapd[7478]: conn=45 fd=8 closed

using ethereal on the slave server I see the master trying to initiate an SSL connection, but it's getting a TLS handshake failure.

Can someone tell me where I'm going wrong?
I'm guessing it's my SSL configuration, but I'm not sure where to start.
Do I need to issue ALL the certificates and keys from ONE ca? If so which certs/keys go where?



This is a basic question about how SSL and PKI works. You need to already understand these topics before trying to use SSL with any particular system (such as OpenLDAP). It is not the job of the OpenLDAP Project to teach you how SSL works. Nevertheless, the 2.2 Admin Guide spells out quite clearly where all of the certs need to go.

Thank you for your anticipated help!

Joe Morin


CONFIDENTIALITY NOTICE: This e-mail, including attachments, is for the sole use of the individual to whom it is addressed. This message is confidential and may contain information that is privileged, confidential and is exempt from disclosure under applicable law. Any unauthorized review, use, disclosure or distribution is prohibited. If you have received this e-mail in error, please notify the sender by reply e-mail and destroy this message and its attachments.

Alas, this email has been disclosed and distributed.

--
 -- Howard Chu
 Chief Architect, Symas Corp.       Director, Highland Sun
 http://www.symas.com               http://highlandsun.com/hyc
 Symas: Premier OpenSource Development and Support