diff options
Diffstat (limited to 'zarb-ml/mageia-sysadm/2012-February/004213.html')
| -rw-r--r-- | zarb-ml/mageia-sysadm/2012-February/004213.html | 127 |
1 files changed, 127 insertions, 0 deletions
diff --git a/zarb-ml/mageia-sysadm/2012-February/004213.html b/zarb-ml/mageia-sysadm/2012-February/004213.html new file mode 100644 index 000000000..286e06b39 --- /dev/null +++ b/zarb-ml/mageia-sysadm/2012-February/004213.html @@ -0,0 +1,127 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> +<HTML> + <HEAD> + <TITLE> [Mageia-sysadm] ldap server certificate (was: Re: [Mageia-discuss] Fosdem report) + </TITLE> + <LINK REL="Index" HREF="index.html" > + <LINK REL="made" HREF="mailto:mageia-sysadm%40mageia.org?Subject=Re%3A%20%5BMageia-sysadm%5D%20ldap%20server%20certificate%20%28was%3A%20Re%3A%0A%09%5BMageia-discuss%5D%20Fosdem%20report%29&In-Reply-To=%3C201202150925.23822.bgmilne%40zarb.org%3E"> + <META NAME="robots" CONTENT="index,nofollow"> + <META http-equiv="Content-Type" content="text/html; charset=us-ascii"> + <LINK REL="Previous" HREF="004218.html"> + <LINK REL="Next" HREF="004214.html"> + </HEAD> + <BODY BGCOLOR="#ffffff"> + <H1>[Mageia-sysadm] ldap server certificate (was: Re: [Mageia-discuss] Fosdem report)</H1> + <B>Buchan Milne</B> + <A HREF="mailto:mageia-sysadm%40mageia.org?Subject=Re%3A%20%5BMageia-sysadm%5D%20ldap%20server%20certificate%20%28was%3A%20Re%3A%0A%09%5BMageia-discuss%5D%20Fosdem%20report%29&In-Reply-To=%3C201202150925.23822.bgmilne%40zarb.org%3E" + TITLE="[Mageia-sysadm] ldap server certificate (was: Re: [Mageia-discuss] Fosdem report)">bgmilne at zarb.org + </A><BR> + <I>Wed Feb 15 08:25:22 CET 2012</I> + <P><UL> + <LI>Previous message: <A HREF="004218.html">[Mageia-sysadm] ldap server certificate (was: Re: [Mageia-discuss] Fosdem report) +</A></li> + <LI>Next message: <A HREF="004214.html">[Mageia-sysadm] [URGENT] SVN down for ~30minutes +</A></li> + <LI> <B>Messages sorted by:</B> + <a href="date.html#4213">[ date ]</a> + <a href="thread.html#4213">[ thread ]</a> + <a href="subject.html#4213">[ subject ]</a> + <a href="author.html#4213">[ author ]</a> + </LI> + </UL> + <HR> +<!--beginarticle--> +<PRE>On Tuesday, 14 February 2012 17:36:14 nicolas vigier wrote: +><i> On Tue, 14 Feb 2012, Oliver Burger wrote: +</I>><i> > But shall we write that command line into the wiki? Aside from not +</I>><i> > working: [<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">oli at beteigeuze</A> avfs]$ ldapsearch -W -Z -h ldap.mageia.org -D +</I>><i> > uid=obgr_seneca,ou=People,dc=mageia,dc=org -b ou=Group,dc=mageia,dc=org +</I>><i> > ldap_start_tls: Connect error (-11) +</I>><i> > Enter LDAP Password: +</I>><i> > ldap_result: Can't contact LDAP server (-1) +</I>><i> +</I>><i> It looks like we are still using a self-signed certificate on the ldap +</I>><i> server. +</I> +Yes. + +><i> So it's required to have "TLS_REQCERT allow" in +</I>><i> /etc/openldap/ldap.conf to be able to connect to the ldap server. +</I> +There are a few issues. If the self-signed cert and key were separate files +(new installs of openldap-server will do it this way as of current cauldron), +then the self-signed cert would not be too much of an issue if the self-signed +cert were distributed to all nodes and set as the TLS_CACERT, e.g.: + +# grep ^TLS_CACERT /etc/openldap/ldap.conf +TLS_CACERT /etc/ssl/openldap/ldap.mageia.org.pem + + +The next issue is: +# openssl x509 -noout -subject -in /etc/ssl/openldap/ldap.mageia.org.pem +subject= /C=FR/ST=France/L=Marseille/O=Mageia/OU=Ldap +server/CN=valstar.mageia.org/emailAddress=<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">root at mageia.org</A> + +subjectCN does not match the hostname that was provided, and no Subject +Alternative Names provided, so: + + +# ldapsearch -LLL -x -h ldap.mageia.org -ZZ -s base -b '' +namingContextsldap_start_tls: Connect error (-11) + additional info: TLS: hostname does not match CN in peer certificate + +vs +# ldapsearch -LLL -x -h valstar.mageia.org -ZZ -s base -b '' namingContexts +dn: +namingContexts: dc=mageia,dc=org +namingContexts: dc=test_ldap + + +But, this doesn't scale. We already have 2 LDAP servers, we would now need to +have both of their certs in the TLS_CACERT, and update it if: +-a cert is updated for whatever reason +-we add more servers + +><i> Should we also use the *.mageia.org certificate on the ldap server ? +</I> +No, as you are distributing the key too widely, opening up easy avenues for +decrypting the traffic. + +><i> Or have our own CA +</I> +Yes. + +><i> with keys distributed by rpm packages in the +</I>><i> distribution ? +</I> +No. Possibly the CA cert distributed, if we intend for distribution users to +access our LDAP directory from the internet (which seems is currently +possible). But, then I am not sure if that is intended, or a mistake. + +Regards, +Buchan +</PRE> + + + + +<!--endarticle--> + <HR> + <P><UL> + <!--threads--> + <LI>Previous message: <A HREF="004218.html">[Mageia-sysadm] ldap server certificate (was: Re: [Mageia-discuss] Fosdem report) +</A></li> + <LI>Next message: <A HREF="004214.html">[Mageia-sysadm] [URGENT] SVN down for ~30minutes +</A></li> + <LI> <B>Messages sorted by:</B> + <a href="date.html#4213">[ date ]</a> + <a href="thread.html#4213">[ thread ]</a> + <a href="subject.html#4213">[ subject ]</a> + <a href="author.html#4213">[ author ]</a> + </LI> + </UL> + +<hr> +<a href="https://www.mageia.org/mailman/listinfo/mageia-sysadm">More information about the Mageia-sysadm +mailing list</a><br> +</body></html> |