LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 11-02-2013, 05:49 PM   #1
LBM
Member
 
Registered: Aug 2010
Location: Denmark
Distribution: Debian
Posts: 96

Rep: Reputation: 0
NSS LDAPS (TLS) not working. LDAP (non-TLS) is working


I have setup an LDAP server, where i authenticate my users. This is working as intended.

Now I have added TLS to libpam-ldap and libnss-ldap!
libpam-ldap works fine, with TLS, but libnss-ldap does not!

If I run id, when uri is ldaps://example.com in the /etc/libnss-ldap.conf file I get this error, and I am unable to query userids, group ids etc..

Code:
Nov  2 22:46:22 testserver id: nss_ldap: could not connect to any LDAP server as (null) - Can't contact LDAP server
Nov  2 22:46:22 testserver id: nss_ldap: failed to bind to LDAP server ldaps://example.com: Can't contact LDAP server
Nov  2 22:46:22 testserver id: nss_ldap: reconnecting to LDAP server...
If I just uses ldap://example.com, everything is working as inteded.

Am I missing something for libnss-ldap to work with SSL/TLS ?
Kinda strange to me, since libpam-ldap is working with TLS, with "same" configuration.
 
Old 11-02-2013, 06:44 PM   #2
LBM
Member
 
Registered: Aug 2010
Location: Denmark
Distribution: Debian
Posts: 96

Original Poster
Rep: Reputation: 0
nscd must be running...
 
Old 11-03-2013, 04:58 AM   #3
LBM
Member
 
Registered: Aug 2010
Location: Denmark
Distribution: Debian
Posts: 96

Original Poster
Rep: Reputation: 0
Oh, this was not the cause...
Apperently there is a bug!
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=579647
Ref:a
https://wiki.debian.org/LDAP/NSS

Trying with nss-ldapd, but same issues. NON-TLS is working fine. With TLS I am unable to connect.
Code:
nslcd: [8b4567] <passwd(all)> DEBUG: myldap_search(base="dc=example,dc=com", filter="(objectClass=posixAccount)")
nslcd: [8b4567] <passwd(all)> DEBUG: ldap_initialize(ldaps://example.com)
nslcd: [8b4567] <passwd(all)> DEBUG: ldap_set_rebind_proc()
nslcd: [8b4567] <passwd(all)> DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3)
nslcd: [8b4567] <passwd(all)> DEBUG: ldap_set_option(LDAP_OPT_DEREF,0)
nslcd: [8b4567] <passwd(all)> DEBUG: ldap_set_option(LDAP_OPT_TIMELIMIT,0)
nslcd: [8b4567] <passwd(all)> DEBUG: ldap_set_option(LDAP_OPT_TIMEOUT,0)
nslcd: [8b4567] <passwd(all)> DEBUG: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT,0)
nslcd: [8b4567] <passwd(all)> DEBUG: ldap_set_option(LDAP_OPT_REFERRALS,LDAP_OPT_ON)
nslcd: [8b4567] <passwd(all)> DEBUG: ldap_set_option(LDAP_OPT_RESTART,LDAP_OPT_ON)
nslcd: [8b4567] <passwd(all)> DEBUG: ldap_set_option(LDAP_OPT_X_TLS,LDAP_OPT_X_TLS_HARD)
nslcd: [8b4567] <passwd(all)> DEBUG: ldap_simple_bind_s(NULL,NULL) (uri="ldaps://example.com")
nslcd: [8b4567] <passwd(all)> failed to bind to LDAP server ldaps://example.com: Can't contact LDAP server: Permission denied

Last edited by LBM; 11-03-2013 at 05:13 AM.
 
Old 11-03-2013, 06:32 AM   #4
LBM
Member
 
Registered: Aug 2010
Location: Denmark
Distribution: Debian
Posts: 96

Original Poster
Rep: Reputation: 0
CentOS have the same behaviour, and throws this error.
Code:
nslcd: [8b4567] failed to bind to LDAP server ldaps://test.local/: Can't contact LDAP server: Operation now in progress
But I found this bugreport...
https://bugzilla.redhat.com/show_bug.cgi?id=713371#c11
Setting tls_cacertdir solves the issue for CentOS..

This is working, on CentOS, but unfortunately, not on Debian.
/etc/nslcd.conf
Code:
ldap_version 3
tls_reqcert allow
tls_cacertdir /etc/openldap/certs
tls_cacertfile /root/ca.crt
uid nslcd
gid ldap
uri ldaps://example.com/
base dc=example,dc=com
 
Old 11-05-2013, 12:22 PM   #5
LBM
Member
 
Registered: Aug 2010
Location: Denmark
Distribution: Debian
Posts: 96

Original Poster
Rep: Reputation: 0
DOH! Solved!

ldapsearch -x (with TLS) was working, because I was root, and then had access to the ca.crt file! Moved the certificate to a place where everybody could read it. Now everything is working. Also with TLS_REQCERT demand. Testet with libnss-ldap and libnss-ldapd(nslcd) both together with libpam-ldap on debian, and libnss-ldapd (nslcd) on CentOS
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
PostgreSQL auth over LDAPS: "could not start LDAP TLS session: error code -1" lefty.crupps Linux - Server 3 10-07-2011 04:22 AM
LDAP TLS Replication not Working on Ubuntu 10.04 Server vijith.pa@gmail.com Linux - Server 3 06-30-2011 01:15 AM
Is TLS For SMTP Working carlosinfl Linux - Server 5 04-05-2010 03:57 PM
Postfix TLS working fine but SSL over port 25 not working bob808 Linux - Server 10 07-25-2009 10:20 PM
OpenLDAP SSL/TLS problem with pam/nss humbletech99 Linux - Server 0 06-12-2009 08:39 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 10:39 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration