[Date Prev][Date Next]
Re: how can make slave use tls to connect to master for syncrepl (solved)
- To: firstname.lastname@example.org
- Subject: Re: how can make slave use tls to connect to master for syncrepl (solved)
- From: zhong ming wu <email@example.com>
- Date: Mon, 28 May 2012 07:17:20 -0400
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type :content-transfer-encoding; bh=gzhORu9g5BEENg7n1WC2qnLZvoeW5IZpd5xx6pjafQ8=; b=NwqMIwl7RN0gTzfkzKqxRU0PnbUTWMWoSlIbm67jva7S+DI4oCDE6Cym+EWF8hnJjC IgEAx30kRZqmwONxam4XsOnQ4u+7hgHRnDLooXqRo1Uc79cOIYb99dIAVmwolGeBydby Gk+8FuEDEQhBpfG2vrRpxdXdxIV6HRinmSvMLOH1N4k01jVnatJuE5QpTLAuUwrT5CQo rib4WlNTQkYjxqB4hOmgYsApHZVZwnWsbHaGv6QHZFf/G2nb7AmDc4dxlmKI348LrKqz UiaZrzF3T3iIN+4s9Yw5taDxhOvoLNSajn7LzQ6QZ4kmHsiUlIQlTzfVplkrnAINmVoU Hekg==
I had to put this line in the sysrepl section of the slave
Sorry about the noise.
On Sun, May 27, 2012 at 10:29 PM, zhong ming wu <firstname.lastname@example.org> wrote:
> I am using version 2.4 and in the process of setting up a master/slave
> pair using syncrepl.
> This is working as expected if I don't have enforce security and
> confidentiality with "security ssf=128" global directive in the
> As soon as I turn it on, replication stops working.
> It seems that the slave consumer is not using TLS to connect to
> master. However I can use 'ldapsearch' with '-ZZ' option to connect
> to master from slave and get all records I want.
> On my slave machine, I also have the following directive
> TLS_CACERT /etc/pki/tls/certs/ca.crt.crl
> in ldap.conf
> Notice that without this line 'ldapXXX' commands with '-ZZ' fails from
> slave to master. This confirms that at least 'ldap.conf' is in the
> correct location at least as far as 'ldapXXX' commands are concerned.
> Can someone point me in the right direction? I have read many
> chapters on this page
> Both slave and master are on centos 6.2 and openldap software is
> standard centos rpm.
> Here are the log entries on the master when slave fails to bind with TLS
> May 27 22:14:53 cat slapd: conn=1000 fd=13 ACCEPT from
> IP=192.168.0.2:41083 (IP=0.0.0.0:389)
> May 27 22:14:53 cat slapd: conn=1000 op=0 BIND
> dn="cn=root,dc=example,dc=com" method=128
> May 27 22:14:53 cat slapd: conn=1000 op=0 RESULT tag=97 err=13
> text=confidentiality required
> May 27 22:14:53 cat slapd: conn=1000 op=1 UNBIND
> May 27 22:14:53 cat slapd: conn=1000 fd=13 closed
> Mr Wu