Hi there. I've have a problem when trying to set smbldap.conf to work
with ldapSSL. The SSL related options are set to:
# Slave LDAP server
# Ex: slaveLDAP=127.0.0.1
# If not defined, parameter is set to "127.0.0.1"
slaveLDAP="deb"
# Slave LDAP port
# If not defined, parameter is set to "389"
slavePort="636"
# Master LDAP server: needed for write operations
# Ex: masterLDAP=127.0.0.1
# If not defined, parameter is set to "127.0.0.1"
masterLDAP="deb"
# Master LDAP port
# If not defined, parameter is set to "389"
#masterPort="389"
masterPort="636"
# Use TLS for LDAP
# If set to 1, this option will use start_tls for connection
# (you should also used the port 389)
# If not defined, parameter is set to "0"
ldapTLS="0"
# Use SSL for LDAP
# If set to 1, this option will use SSL for connection
# (standard port for ldaps is 636)
# If not defined, parameter is set to "0"
ldapSSL="1"
# How to verify the server's certificate (none, optional or require)
# see "man Net::LDAP" in start_tls section for more details
verify="require"
# CA certificate
# see "man Net::LDAP" in start_tls section for more details
cafile="/etc/smbldap-tools/cacert.pem"
# certificate to use to connect to the ldap server
# see "man Net::LDAP" in start_tls section for more details
clientcert="/etc/smbldap-tools/cert.pem"
# key certificate to use to connect to the ldap server
# see "man Net::LDAP" in start_tls section for more details
clientkey="/etc/smbldap-tools/key.key"
but when I try to add users with smbldap-useradd I receive these errors:
From slapd:
TLS trace: SSL3 alert write:fatal:handshake failure
TLS trace: SSL_accept:error in SSLv3 read client certificate B
TLS: can't accept: error:140890C7:SSL
routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate.
From smbldap-useradd:
LDAP error: Can't contact master ldap server with SSL (IO::Socket::SSL:
SSL connect attempt failed because of handshake
problemserror:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert
handshake failure) at /usr/local/sbin//smbldap_tools.pm line 315.
The server slapd, works fine with SSL, ldapsearch works fine with SSL,
libnss_ldap works fine, and libpam_ldap works fine.
I've seen the code for smbldap_tools.pm at line 315 and there is this:
my $ldap_master;
if ( $config{ldapSSL} ) {
$ldap_master = Net::LDAP->new(
"ldaps://$config{masterLDAP}:$config{masterPort}",
verify => "$config{verify}",
cafile => "$config{cafile}",
) or die "LDAP error: Can't contact master ldap server with SSL
($@)";
}
but for ldapTLS there is also clientcert e clientkey:
if ( $config{ldapTLS} == 1 ) {
$mesg = $ldap_master->start_tls(
verify => "$config{verify}",
clientcert => "$config{clientcert}",
clientkey => "$config{clientkey}",
cafile => "$config{cafile}"
);
if ( $mesg->code ) {
die( "Could not start_tls: " . $mesg->error );
}
Then I've tried to add clientcert and clientkey and SSL communication
with slapd works fine. This is a bug?
_______________________________________________
Smbldap-tools-tech mailing list
[email protected]
https://mail.gna.org/listinfo/smbldap-tools-tech
