Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have just setup Openldap using the following instructions

http://www.computerglitch.net/bin/texts/CentOS6_LDAP.php

The normal connection returns what is expected but the tls test just hangs.

Any idea what I done wrong here. I spent a day and a half searching the web for answers but I have yet to find anyone with a similar problem.

Here's a list of debug output.

[root@alderaan openldap]# ldapsearch -v -d1023 -x -b "dc=alderaan,dc=com" -ZZ
ldap_initialize( <DEFAULT> )
ldap_create
ldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP localhost:389
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying ::1 389
ldap_pvt_connect: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_dump: buf=0x227a9b0 ptr=0x227a9b0 end=0x227a9cf len=31
  0000:  30 1d 02 01 01 77 18 80  16 31 2e 33 2e 36 2e 31   0....w...1.3.6.1
  0010:  2e 34 2e 31 2e 31 34 36  36 2e 32 30 30 33 37      .4.1.1466.20037
ber_scanf fmt ({) ber:
ber_dump: buf=0x227a9b0 ptr=0x227a9b5 end=0x227a9cf len=26
  0000:  77 18 80 16 31 2e 33 2e  36 2e 31 2e 34 2e 31 2e   w...1.3.6.1.4.1.
  0010:  31 34 36 36 2e 32 30 30  33 37                     1466.20037
ber_flush2: 31 bytes to sd 3
  0000:  30 1d 02 01 01 77 18 80  16 31 2e 33 2e 36 2e 31   0....w...1.3.6.1
  0010:  2e 34 2e 31 2e 31 34 36  36 2e 32 30 30 33 37      .4.1.1466.20037
ldap_write: want=31, written=31
  0000:  30 1d 02 01 01 77 18 80  16 31 2e 33 2e 36 2e 31   0....w...1.3.6.1
  0010:  2e 34 2e 31 2e 31 34 36  36 2e 32 30 30 33 37      .4.1.1466.20037
ldap_result ld 0x2271170 msgid 1
wait4msg ld 0x2271170 msgid 1 (infinite timeout)
wait4msg continue ld 0x2271170 msgid 1 all 1
** ld 0x2271170 Connections:
* host: localhost  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Mon Feb 11 03:52:44 2013


** ld 0x2271170 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x2271170 request count 1 (abandoned 0)
** ld 0x2271170 Response Queue:
   Empty
  ld 0x2271170 response count 0
ldap_chkResponseList ld 0x2271170 msgid 1 all 1
ldap_chkResponseList returns ld 0x2271170 NULL
ldap_int_select
read1msg: ld 0x2271170 msgid 1 all 1
ber_get_next
ldap_read: want=8, got=8
  0000:  30 0c 02 01 01 78 07 0a                            0....x..
ldap_read: want=6, got=6
  0000:  01 00 04 00 04 00                                  ......
ber_get_next: tag 0x30 len 12 contents:
ber_dump: buf=0x227be60 ptr=0x227be60 end=0x227be6c len=12
  0000:  02 01 01 78 07 0a 01 00  04 00 04 00               ...x........
read1msg: ld 0x2271170 msgid 1 message type extended-result
ber_scanf fmt ({eAA) ber:
ber_dump: buf=0x227be60 ptr=0x227be63 end=0x227be6c len=9
  0000:  78 07 0a 01 00 04 00 04  00                        x........
read1msg: ld 0x2271170 0 new referrals
read1msg:  mark request completed, ld 0x2271170 msgid 1
request done: ld 0x2271170 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_parse_extended_result
ber_scanf fmt ({eAA) ber:
ber_dump: buf=0x227be60 ptr=0x227be63 end=0x227be6c len=9
  0000:  78 07 0a 01 00 04 00 04  00                        x........
ldap_parse_result
ber_scanf fmt ({iAA) ber:
ber_dump: buf=0x227be60 ptr=0x227be63 end=0x227be6c len=9
  0000:  78 07 0a 01 00 04 00 04  00                        x........
ber_scanf fmt (}) ber:
ber_dump: buf=0x227be60 ptr=0x227be6c end=0x227be6c len=0

ldap_msgfree
TLS: using moznss security dir /etc/openldap/certs prefix .
TLS: loaded CA certificate file /etc/pki/tls/certs/slapdcert.pem.
tls_write: want=70, written=70
  0000:  16 03 01 00 41 01 00 00  3d 03 01 51 18 b1 5c a5   ....A...=..Q..\.
  0010:  86 c7 5f 91 80 97 ca 40  fc a8 6a 63 34 b5 f0 7b   .._....@..jc4..{
  0020:  ad 95 f3 c7 4c 45 d1 c8  57 60 da 00 00 16 00 ff   ....LE..W`......
  0030:  00 35 00 04 00 05 00 2f  00 0a 00 09 00 64 00 62   .5...../.....d.b
  0040:  00 03 00 06 01 00                                  ......

After running.

 ln -s /etc/pki/tls/certs/slapdcert.pem  `openssl x509 -noout -hash -in /etc/pki/tls/certs/slapdcert.pem`

I now get the following output.

 ldapsearch -x -d1023  -b "dc=alderaan,dc=com" -ZZ
ldap_create
ldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP localhost:389
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying ::1 389
ldap_pvt_connect: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_dump: buf=0x11009e0 ptr=0x11009e0 end=0x11009ff len=31
  0000:  30 1d 02 01 01 77 18 80  16 31 2e 33 2e 36 2e 31   0....w...1.3.6.1
  0010:  2e 34 2e 31 2e 31 34 36  36 2e 32 30 30 33 37      .4.1.1466.20037
ber_scanf fmt ({) ber:
ber_dump: buf=0x11009e0 ptr=0x11009e5 end=0x11009ff len=26
  0000:  77 18 80 16 31 2e 33 2e  36 2e 31 2e 34 2e 31 2e   w...1.3.6.1.4.1.
  0010:  31 34 36 36 2e 32 30 30  33 37                     1466.20037
ber_flush2: 31 bytes to sd 3
  0000:  30 1d 02 01 01 77 18 80  16 31 2e 33 2e 36 2e 31   0....w...1.3.6.1
  0010:  2e 34 2e 31 2e 31 34 36  36 2e 32 30 30 33 37      .4.1.1466.20037
ldap_write: want=31, written=31
  0000:  30 1d 02 01 01 77 18 80  16 31 2e 33 2e 36 2e 31   0....w...1.3.6.1
  0010:  2e 34 2e 31 2e 31 34 36  36 2e 32 30 30 33 37      .4.1.1466.20037
ldap_result ld 0x10f7170 msgid 1
wait4msg ld 0x10f7170 msgid 1 (infinite timeout)
wait4msg continue ld 0x10f7170 msgid 1 all 1
** ld 0x10f7170 Connections:
* host: localhost  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Mon Feb 11 06:06:00 2013


** ld 0x10f7170 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x10f7170 request count 1 (abandoned 0)
** ld 0x10f7170 Response Queue:
   Empty
  ld 0x10f7170 response count 0
ldap_chkResponseList ld 0x10f7170 msgid 1 all 1
ldap_chkResponseList returns ld 0x10f7170 NULL
ldap_int_select

with -H ldaps://192.168.1.25:636

ldapsearch -x -d1023 -H ldaps://192.168.1.25:636 -b "dc=alderaan,dc=com" objective=*
ldap_url_parse_ext(ldaps://192.168.1.25:636)
ldap_create
ldap_url_parse_ext(ldaps://192.168.1.25:636/??base)
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 192.168.1.25:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 192.168.1.25:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
TLS: loaded CA certificate file /etc/pki/tls/certs/slapdcert.pem.
tls_write: want=70, written=70
  0000:  16 03 01 00 41 01 00 00  3d 03 01 51 18 d3 e6 56   ....A...=..Q...V
  0010:  13 d6 44 8b 38 50 c3 8f  07 b3 4f fc e4 c2 81 1a   ..D.8P....O.....
  0020:  a9 71 8b 94 2e 32 a9 82  fa 4b f2 00 00 16 00 ff   .q...2...K......
  0030:  00 35 00 04 00 05 00 2f  00 0a 00 09 00 64 00 62   .5...../.....d.b
  0040:  00 03 00 06 01 00                                  ......
share|improve this question
    
Can you try your query like this: ldapsearch -x -d 1023 -H ldaps://<ip_or_DNS_Name>:636 -b "dc=alderaan,dc=com" objectclass=* –  Jason Tan Feb 11 '13 at 16:08

2 Answers 2

Have you symlinked the cert to it's hashed value? i.e.:

ln -s /etc/ssl/certs/server.pem `openssl x509 -noout -hash -in /etc/ssl/certs/server.pem` 

If you have intermediate cert(s) you'll need to do it for that/them too.

If you have an your are still getting problems could you run:

openssl s_client -connect <ldapserver_name_or_ip>:636

and paste in the output (assuming openldap is listening on port 636).

Assuming your cert is:

/etc/pki/tls/certs/slapdcert.pem

Then you would run:

ln -s /etc/pki/tls/certs/slapdcert.pem `openssl x509 -noout -hash -in /etc/pki/tls/certs/slapdcert.pem`

Note the openssl command is in backticks (the ones on the ~ key) not single quotes.

share|improve this answer
    
Okay but what directory would I be in to run this symlink? –  Codeguy007 Feb 11 '13 at 15:42
    
It does not matter.The symlink has to end up in the same dir as your cert(s). –  Jason Tan Feb 11 '13 at 15:46
    
Take the above example command and where ever you see "/etc/ssl/certs/server.pem" replace it with the absolute (full) path to your cert. –  Jason Tan Feb 11 '13 at 15:48
    
I've edited my answer to include an example that I think uses your cert path. You can run that from any dir. –  Jason Tan Feb 11 '13 at 15:51
    
I get a difference response now I will put it in the question as it too long for a comment. –  Codeguy007 Feb 11 '13 at 15:59

If you run with strace -e file,network ldapsearch ... do you see that is reading the certificates? Make also a Network capture with WireShark and see if the TLS tunnel is established.

share|improve this answer
    
strace -e file, network ldapsearch .... is invalid. It seems to think network is the command to run the strace on. –  Codeguy007 Feb 11 '13 at 15:48
    
I've corrected. It must not be a space 'file,network' expression. –  Mircea Vutcovici Feb 11 '13 at 15:56
    
I think the strace command should be: strace -e trace=file,network ldapsearch... –  Jason Tan Feb 11 '13 at 16:01
    
The trace doesn't tell me anything it just stops like the ldapsearch itself. –  Codeguy007 Feb 11 '13 at 16:03
    
This is in the trace. socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3 connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3 connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) –  Codeguy007 Feb 11 '13 at 16:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.