[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Syncrepl SSL fail

On 10/14/2011 07:10 AM, Hugo Deprez wrote:

Hello,

On the provider I have the following settings :

TLSCACertificateFile /etc/ssl/certs/ldap-cert.pem
TLSCertificateFile /etc/ssl/certs/ldap-cert.pem
TLSCertificateKeyFile /etc/ldap/ssl/ldap-key.pem

but no TLSCipherSuite defined.

That should be fine.  You don't need to define a TLSCipherSuite

I added the starttls=yes on the consumer :

Syncrepl  rid=003
              provider=ldaps://ldap.mydomain.fr:1024/
              type=refreshOnly
              retry="60 10 600 +"
              interval=00:00:00:10
              searchbase="dc=mydomain,dc=fr"
              scope=sub
              schemachecking=on
              bindmethod=simple
              starttls=yes
You should have starttls=critical or it will attempt to fallback to plain LDAP if it cannot establish TLS. 
              tls_cert=/etc/ssl/certs/ldap-cert.pem
You should not have tls_cert here, since you are trying to use dn/password auth. tls_cert is useless without tls_key anyway. 
              tls_cacert=/etc/ssl/certs/ldap-cert-ca.pem
              binddn="cn=syncrepluser,o=others,dc=mydomain,dc=fr"
              credentials=my_password


But still the same error.

Any idea ?

Hugo
On 14 October 2011 13:52, Olivier Guillard<olivier@guillard.nom.fr>  wrote:

Hi,

Have you set up the follwing appropriately :

TLSCertificateFile
TLSCertificateKeyFile
TLSCipherSuite

On the provider ?

You probably also want to set this up correctly in
your syncrepl section :

  starttls=yes
  tls_cacert=/path/to/certificate

I suspect better if TLS_CACERT is also properly
set up in both ldap server slapd config.

---
Olivier

On Thu, Oct 13, 2011 at 6:38 PM, Hugo Deprez<hugo.deprez@gmail.com>  wrote:

Dear community,

I setup a syncrepl between my master openldap server and a consumer.

I am trying to use SSL for this syncrepl
I got the following error in the log  when I start slapd on the consumer :

Oct 13 17:04:59 server slapd[16905]: slapd starting
Oct 13 17:04:59 server slapd[16905]: slap_client_connect:
URI=ldaps://ldap.mydomain.fr:1024/
DN="cn=syncrepluser,o=others,dc=mydomain,dc=fr" ldap_sasl_bind_s
failed (-1)
Oct 13 17:04:59 server slapd[16905]: do_syncrepl: rid=003 rc -1
retrying (9 retries left)


I don't understand why it is failing as a single ldapsearch from the
same server with the syncrepl user is working.

here is my syncrepl configuration :

Syncrepl  rid=003
               provider=ldaps://ldap.mydomain.fr:1024/
               type=refreshOnly
               retry="60 10 600 +"
               interval=00:00:00:10
               searchbase="dc=mydomain,dc=fr"
               scope=sub
               schemachecking=on
               bindmethod=simple
               binddn="cn=syncrepluser,o=others,dc=mydomain,dc=fr"
               credentials=my_password


Any idea ?

Regards,

Hugo