[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: fedora and openldap


On 04/11/2011 01:14 PM, harry.jede@arcor.de wrote:
Judith Flo Gaya wrote:
At least i could see that the password exop option in the
pam_ldap.conf lets the server to apply the security to the password,
so I think I can change it within the slapd.conf file.
Yes, and if you don't specify "password-hash" in slapd.conf, ssha is
used. It is the default.

do you suggest to use salt?
ssha use salt.

Thanks a lot for your help,

have you read rfc-3062 ?

If you configure your clients to use "password exop" you should be sure
that the clients use any kind of network protection, TLS or SSL.

TinyCA is a perl based GTK-GUI which may help you to generate certs and

Until you are ready to use TLS/SSL I sugggest that you let the client
encrypt the passwords local.
As I didn't manage to make both client and server hash passwords in the same way, I start creating certificates for clients and servers, but for some reason they aren't able to comunicate. I test the certificate connection and the server answers properly (using openssl_client) both from client to server and from the server to the server.
But when I do ldapsearch -x it says
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

In the logs of the server I can see this:
>>> slap_listener(ldaps:///)
connection_get(12): got connid=1077
connection_read(12): checking for input on id=1077
TLS trace: SSL_accept:before/accept initialization
TLS: can't accept: (unknown).
connection_read(12): TLS accept failure error=-1 id=1077, closing
connection_close: conn=1077 sd=12

Any idea?

I created the certificates like this:
# openssl genrsa 2048 > ca-key.pem
# openssl req -new -x509 -nodes -days 1000 -key ca-key.pem > ca-cert.pem
# openssl req -newkey rsa:2048 -days 1000 -nodes -keyout server-key.pem > server-req.pem # openssl x509 -req -in server-req.pem -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem

This on the server side, then I scp the ca-cert.pem file to the client (and to the /etc/openldap/cacerts in the same server).
For the client I created the certificate like this:
# openssl req -newkey rsa:2048 -days 1000 -nodes -keyout client-key.pem > client-req.pem # openssl x509 -req -in client-req.pem -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > client-cert.pem

And then copy those 3 files to the client.

I changed the slapd.conf to have the 3 tls variables with the generated files from the beginning and changed the configuration to connect to the ldaps://server and marked the tls option.

Any hint about the error?

Thanks in advance.