1:20 p.m.
On 05/09/2018 05:56 AM, Michal Medvecky wrote:
> Under cn=config, what is "nsslapd-ssl-check-hostname"
set to? Try
> setting it to "off" to see if it makes a difference.
Ok, this “helped”, but I have no idea why?
The server uses the openldap client
libraries for replication
connections. Setting nsslapd-ssl-check-hostname sets these flags on the
connection as follows:
For server authentication it sets this flag:
LDAPSSL_AUTH_CNCHECK --> This checks the hostname in the
certificate subject to that of the host
For SSL client auth it sets this flag:
LDAP_OPT_X_TLS_HARD
So the issue here is either openldap is not finding the correct
hostname, or the hostname in the certificate subject is wrong.
To check the subject of the certificate use certutil. Here is an example:
Get the names of the certificates in the in the security database:
# certutil -L -d /etc/dirsrv/slapd-localhost
Find the server's certificate name (server-cert in this example) and run
the command below:
# certutil -L -d /etc/dirsrv/slapd-localhost -n server-cert | grep Subject
The subject should start with "CN=<FQDN>, ...". Is this host name
complete and correct?
When googling for ‘nsslapd-ssl-check-hostname’, I found this:
> nsslapd-ssl-check-hostname (Verify Hostname for
OutboundConnections)Specifies whether an SSL-enabled Directory Server
(with certificate based client authentication turned on) should verify
authenticity of a request by matching the hostname against the value
assigned to the Common Name (CN) attributeof the subject name in the
certificate being presented.
Two arguments:
- I’m _not_ using certificate based client authentications
- my hostnames are valid
What I’m confused with is the error log on ldap-master-b01:
[09/May/2018:11:27:21 +0200] NSMMReplicationPlugin -
agmt="cn=rw-to-ldap-master-b02.example.com
<http://rw-to-ldap-master-b02.example.com>" (ldap-master-b02:636):
Replication bind with SIMPLE auth resumed
[09/May/2018:11:27:21 +0200] NSMMReplicationPlugin -
agmt="cn=rw-to-ldap-master-b02.example.com
<http://rw-to-ldap-master-b02.example.com>" (ldap-master-b02:636):
Unable to acquire replica: there is no replicated area
“dc=example,dc=com" on the consumer server. Replication is aborting.
This means you do not have replication setup for that suffix on the
consumer. Replication will not work until this is done.
[09/May/2018:11:27:21 +0200] NSMMReplicationPlugin -
agmt="cn=rw-to-ldap-master-b02.example.com
<http://rw-to-ldap-master-b02.example.com>" (ldap-master-b02:636):
Incremental update failed and requires administrator action
[09/May/2018:11:36:07 +0200] NSMMReplicationPlugin - agmt_delete: begin
[09/May/2018:11:36:11 +0200] NSMMReplicationPlugin - Beginning total
update of replica "agmt="cn=rw-to-ldap-master-b02.example.com
<http://rw-to-ldap-master-b02.example.com>" (ldap-master-b02:636)".
[09/May/2018:11:36:11 +0200] NSMMReplicationPlugin - Need to create
replication keep alive entry <cn=repl keep alive 37642,dc=example,dc=com>
[09/May/2018:11:36:11 +0200] NSMMReplicationPlugin - add dn: cn=repl
keep alive 37642,dc=example,dc=com
On the fifth line of the log, you can see “ldap-master-b02:636”
instead of the full hostname “ldap-master-b02.example.com
<http://ldap-master-b02.example.com>”, but, as seen in my previous
e-mail, the nsDS5ReplicaHost points to the full hostname.
This is a red herring,
the server prints the hostname not the FQDN just
in the logging.
Mark
Michal
2:37 p.m.
New subject: SSL replication error
>
The server uses the openldap client libraries for replication connections. Setting
nsslapd-ssl-check-hostname sets these flags on the connection as follows:
For server authentication it sets this flag:
LDAPSSL_AUTH_CNCHECK --> This checks the hostname in the certificate subject to
that of the host
For SSL client auth it sets this flag:
LDAP_OPT_X_TLS_HARD
Okay so it does more than is documented, now I get it.
So the issue here is either openldap is not finding the correct
hostname, or the hostname in the certificate subject is wrong.
As I stated previously, my domain name and cert is good. Even the reverse dns record is
correct.
I tried replacing the certificate with an incorrect one (with invalid CN) and the error
displayed in log is the very same. So yes, it looks like “something” does not match (but
what?)
Connecting to ldap server itself works, even openssl s_client verifies the server cert ok
(including the chain, what was a nice surprise to me).
Just to be clear: I’m using my own root CA, with an intermediate CA which issued cert for
CN=ldap-master-b01.example.com and CN=ldap-master-b02.example.com
<http://ldap-master-b02.example.com/>;. Both are imported into certstore with
nickname “CN=ldap-master-b0[12]” (including the “CN=“).
In cn=RSA,cn=encryption,cn=config, I use
nsSSLPersonalitySSL='CN=ldap-master-b[01].example.com’.
I tried changing the errorlog-level as you suggested, but I got no better message than...
[09/May/2018:21:13:25 +0200] NSMMReplicationPlugin -
agmt="cn=rw-to-ldap-master-b02.example.com" (ldap-master-b02:636): binddn =
cn=MasterMasterReplicationManager,cn=config, passwd =
{AES-TUhNR0NTcUdTSWIzRFFFRkRUQm1NRVVHQ1NxR1NJYjNEUUVGRERBNEJDUXhZamN5WXpNeVppMDNPR00zTXpOaA0KTUMxaE1XTmtabUl5WmkwMVpUVmtOR1l5TlFBQ0FRSUNBU0F3Q2dZSUtvWklodmNOQWdjd0hRWUpZSVpJQVdVRA0KQkFFcUJCRDBuaTFJaDRXMmZDcnlqWUtXQmlMRw==}yFb3FVwDwpWKupgUWiS4wg==
[09/May/2018:21:13:26 +0200] slapi_ldap_bind - Error: could not send bind request for id
[cn=MasterMasterReplicationManager,cn=config] authentication mechanism [SIMPLE]: error -1
(Can't contact LDAP server), system error -5987 (Invalid function argument.), network
error 115 (Operation now in progress, host "ldap-master-b02.example.com:636”)
root@ldap-master-b01:~# host ldap-master-b02.example.com
ldap-master-b02.example.com has address 100.127.177.145
root@ldap-master-b01:~# host 100.127.177.145
145.177.127.100.in-addr.arpa domain name pointer ldap-master-b02.example.com.
root@ldap-master-b02:~# certutil -L -d /etc/dirsrv/nss/ -n
"CN=ldap-master-b02.example.com"|grep Subje
Subject: "CN=ldap-master-b02.example.com"
3:19 p.m.
New subject: SSL replication error
On 05/09/2018 03:37 PM, Michal Medvecky wrote:
>>
> The server uses the openldap client libraries for replication
> connections. Setting nsslapd-ssl-check-hostname sets these flags on
> the connection as follows:
>
> For server authentication it sets this flag:
>
> LDAPSSL_AUTH_CNCHECK --> This checks the hostname in the
> certificate subject to that of the host
>
> For SSL client auth it sets this flag:
>
> LDAP_OPT_X_TLS_HARD
Okay so it does more than is documented, now I get it.
I'll file a doc bug for
this...
> So the issue here is either openldap is not finding the correct
> hostname, or the hostname in the certificate subject is wrong.
As I stated previously, my domain name and cert is good. Even the
reverse dns record is correct.
I tried replacing the certificate with an incorrect one (with invalid
CN) and the error displayed in log is the very same. So yes, it looks
like “something” does not match (but what?)
I'm not sure what is
wrong/mismatched as it's failing inside of the
openldap client library. I wonder if the cert nickname having the "CN="
in it is a problem? It shouldn't be, but who knows.
openldap just describes the flag as:
| ||LDAPSSL_AUTH_CNCHECK |indicates that you accept the server's
certificate only if you trust the CA who issued the certificate and if
the value of the cn attribute is the DNS hostname of the server.
Under cn=config what is nsslapd-localhost set to? Is it the correct FQDN?
What is in /etc/openldap/ldap.conf?
Connecting to ldap server itself works, even openssl s_client verifies
the server cert ok (including the chain, what was a nice surprise to me).
Just to be clear: I’m using my own root CA, with an intermediate CA
which issued cert for CN=ldap-master-b01.example.com
<http://ldap-master-b01.example.com> and
CN=ldap-master-b02.example.com <http://ldap-master-b02.example.com>;.
Both are imported into certstore with nickname “CN=ldap-master-b0[12]”
(including the “CN=“).
In cn=RSA,cn=encryption,cn=config, I use
nsSSLPersonalitySSL='CN=ldap-master-b[01].example.com
<http://example.com>’.
I tried changing the errorlog-level as you suggested, but I got no
better message than...
[09/May/2018:21:13:25 +0200] NSMMReplicationPlugin -
agmt="cn=rw-to-ldap-master-b02.example.com
<http://rw-to-ldap-master-b02.example.com>" (ldap-master-b02:636):
binddn = cn=MasterMasterReplicationManager,cn=config, passwd =
{AES-TUhNR0NTcUdTSWIzRFFFRkRUQm1NRVVHQ1NxR1NJYjNEUUVGRERBNEJDUXhZamN5WXpNeVppMDNPR00zTXpOaA0KTUMxaE1XTmtabUl5WmkwMVpUVmtOR1l5TlFBQ0FRSUNBU0F3Q2dZSUtvWklodmNOQWdjd0hRWUpZSVpJQVdVRA0KQkFFcUJCRDBuaTFJaDRXMmZDcnlqWUtXQmlMRw==}yFb3FVwDwpWKupgUWiS4wg==
[09/May/2018:21:13:26 +0200] slapi_ldap_bind - Error: could not send
bind request for id [cn=MasterMasterReplicationManager,cn=config]
authentication mechanism [SIMPLE]: error -1 (Can't contact LDAP
server), system error -5987 (Invalid function argument.), network
error 115 (Operation now in progress, host
"ldap-master-b02.example.com:636
<http://ldap-master-b02.example.com:636>”)
There are no messages containing
"conn_connect"?
root@ldap-master-b01:~# host ldap-master-b02.example.com
<http://ldap-master-b02.example.com>
ldap-master-b02.example.com <http://ldap-master-b02.example.com> has
address 100.127.177.145
root@ldap-master-b01:~# host 100.127.177.145
145.177.127.100.in-addr.arpa domain name pointer
ldap-master-b02.example.com <http://ldap-master-b02.example.com>;.
root@ldap-master-b02:~# certutil -L -d /etc/dirsrv/nss/ -n
"CN=ldap-master-b02.example.com
<http://ldap-master-b02.example.com>"|grep Subje
Subject: "CN=ldap-master-b02.example.com
<http://ldap-master-b02.example.com>"
_______________________________________________
389-users mailing list -- 389-users(a)lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
3:59 p.m.
New subject: SSL replication error
I'm not sure what is wrong/mismatched as it's failing inside
of the openldap client library. I wonder if the cert nickname having the "CN="
in it is a problem? It shouldn't be, but who knows.
I tried changing it to “server-cert”, did not help.
openldap just describes the flag as:
LDAPSSL_AUTH_CNCHECK indicates that you accept the server's certificate only if
you trust the CA who issued the certificate and if the value of the cn attribute is the
DNS hostname of the server. <>
Under cn=config what is nsslapd-localhost set to? Is it the correct FQDN?
yes.
What is in /etc/openldap/ldap.conf?
?
There are no messages containing "conn_connect”?
not a single one.
4:21 p.m.
New subject: SSL replication error
On 05/09/2018 04:59 PM, Michal Medvecky wrote:
> I'm not sure what is wrong/mismatched as it's failing inside of the
> openldap client library. I wonder if the cert nickname having the
> "CN=" in it is a problem? It shouldn't be, but who knows.
>
I tried changing it to “server-cert”, did not help.
> openldap just describes the flag as:
>
> | ||LDAPSSL_AUTH_CNCHECK |indicates that you accept the server's
> certificate only if you trust the CA who issued the certificate and
> if the value of the cn attribute is the DNS hostname of the server.
>
> Under cn=config what is nsslapd-localhost set to? Is it the correct
> FQDN?
yes.
> What is in /etc/openldap/ldap.conf?
?
Do you have this file? What platform are you running on? And what
version of 389-ds-base are you using (rpm -qa | grep 389-ds-base)
> There are no messages containing "conn_connect”?
not a single one.
_______________________________________________
389-users mailing list -- 389-users(a)lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
2172
days inactive
2172
days old
389-users@lists.fedoraproject.org
4 comments
2 participants
participants (2)
-
Mark Reynolds -
Michal Medvecky