[Date Prev][Date Next]
how can make slave use tls to connect to master for syncrepl
- To: email@example.com
- Subject: how can make slave use tls to connect to master for syncrepl
- From: zhong ming wu <firstname.lastname@example.org>
- Date: Sun, 27 May 2012 22:29:25 -0400
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=jbCdcgA3O4YdEP8M49KYb5fzS/XYWX36jyqJcAHy6+g=; b=RezITTEcgzAAMgvBoXPVDP+6vv9E36m53R+RBfheBDCp7LjJku1O2FDL4UzGEWn0da CJ7slxfcz2lEb+p5Rr15CruAzHdSNM3zRMr4C2/8bg8BR9YTtSGu0WgR46YHctBHcPFB hP9LJ6nNeTDpIK58Oh9tFLT04L39muQmtbmR9GtUxVfJqJAFpO1FVrDFyoJia9XEqszM iCCo5vFUaxsO8rhZzlXSIadxJJZEXTdQCF169keIsvnbVI3IAlrGt0ze3BrTF0C7/qrx CkXGMdDF774VgC2iKYKi+ltQ7LMpmHcaKCgfGVdfHlBj086bsOFVmi46qDUofxrYArY9 EISQ==
I am using version 2.4 and in the process of setting up a master/slave
pair using syncrepl.
This is working as expected if I don't have enforce security and
confidentiality with "security ssf=128" global directive in the
As soon as I turn it on, replication stops working.
It seems that the slave consumer is not using TLS to connect to
master. However I can use 'ldapsearch' with '-ZZ' option to connect
to master from slave and get all records I want.
On my slave machine, I also have the following directive
Notice that without this line 'ldapXXX' commands with '-ZZ' fails from
slave to master. This confirms that at least 'ldap.conf' is in the
correct location at least as far as 'ldapXXX' commands are concerned.
Can someone point me in the right direction? I have read many
chapters on this page
Both slave and master are on centos 6.2 and openldap software is
standard centos rpm.
Here are the log entries on the master when slave fails to bind with TLS
May 27 22:14:53 cat slapd: conn=1000 fd=13 ACCEPT from
May 27 22:14:53 cat slapd: conn=1000 op=0 BIND
May 27 22:14:53 cat slapd: conn=1000 op=0 RESULT tag=97 err=13
May 27 22:14:53 cat slapd: conn=1000 op=1 UNBIND
May 27 22:14:53 cat slapd: conn=1000 fd=13 closed