Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a syncrepl set up in my slapd that was previously working.

I've checked the ssl connection using:

$openssl s_client -connect host.mydomain.com.au:636 -key /etc/ca/host.key -cert /etc/ca/host.crt 

CONNECTED(00000003)
depth=1 C = AU, ST = Victoria, O = <redacted>, OU = Network Admin, CN = admin, emailAddress = <redacted>
verify error:num=19:self signed certificate in certificate chain
verify return:0
---
Certificate chain
 0 s:/C=AU/ST=Victoria/L=Melbourne/O=<redacted>/OU=Network Admin/CN=host.mydomain.com.au/emailAddress=<redacted>
   i:/C=AU/ST=Victoria/O=<redacted>/OU=Network Admin/CN=admin/emailAddress=<redacted>
 1 s:/C=AU/ST=Victoria/O=<redacted>/OU=Network Admin/CN=admin/emailAddress=<redacted>
   i:/C=AU/ST=Victoria/O=<redacted>/OU=Network Admin/CN=admin/emailAddress=<redacted>
---
Server certificate
-----BEGIN CERTIFICATE-----
<redacted>
-----END CERTIFICATE-----
subject=/C=AU/ST=Victoria/L=Melbourne/O=<redacted>/OU=Network Admin/CN=host.mydomain.com.au/emailAddress=<redacted>
issuer=/C=AU/ST=Victoria/O=<redacted>/OU=Network Admin/CN=admin/emailAddress=<redacted>
---
Acceptable client certificate CA names
/C=AU/ST=Victoria/O=<redacted>/OU=Network Admin/CN=admin/emailAddress=<redacted>
---
SSL handshake has read 2050 bytes and written 1501 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 1024 bit
Secure Renegotiation IS NOT supported
Compression: zlib compression
Expansion: zlib compression
SSL-Session:
    Protocol  : TLSv1
    Cipher    : AES256-SHA
    Session-ID: 894D8BAD4C397F3596670CB527C08BB08EFDEF9A73FD2C106BC9525F0C90338B
    Session-ID-ctx: 
    Master-Key: F4231970CD8530FAE41EDD267B9B56761AF4095243720BC2E9DFF45D97EC2996A2F198CA7809F360AEF59C4455A0320D
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Compression: 1 (zlib compression)
    Start Time: 1367800850
    Timeout   : 300 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
---

And my configuration looks like this:

## ======================================================================
## proxy/remote DB 3
database        ldap
uri             ldaps://host.mydomain.com.au
acl-bind        bindmethod=simple
                binddn="cn=manager,dc=mydomain,dc=com,dc=au"
                credentials="<redacted>"
                tls_crlcheck=none
                tls_reqcert=demand
                tls_cacert=/etc/ca/cacert.pem
                tls_cert=/etc/ca/host.crt
                tls_key=/etc/ca/host.key

chase-referrals no
network-timeout 180
timeout         180
idletimeout     180
conn-ttl        180
idle-timeout    180
quarantine      60,+
use-temporary-conn yes
hidden          on
restrict        all
suffix          "dc=mydomain,dc=com,dc=au"
rootdn          "cn=whatever"
lastmod         on

## replication (consumer) for host
#index  entryUUID       eq
syncrepl        rid=203
        provider=ldaps://ldap.mydomain.com.au
        type=refreshAndPersist
        interval=00:00:00:05
        retry="60 +"
        searchbase="dc=mydomain,dc=com,dc=au"
        scope=sub
        schemachecking=off
        bindmethod=simple
        binddn="cn=syncuser,dc=mydomain,dc=com,dc=au"
        credentials="<redacted>"
        tls_crlcheck=none
        tls_reqcert=demand
        tls_cacert=/etc/ca/cacert.pem
        tls_cert=/etc/ca/host.crt
        tls_key=/etc/ca/host.key

overlay         syncprov

However, in my logs I get this:

May  6 10:56:41 ldap slapd[2210]: syncrepl_entry: rid=203 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD)
May  6 10:56:41 ldap slapd[2210]: syncrepl_entry: rid=203 inserted UUID 2e8ba3f8-af60-102b-925e-b14897e293cb
May  6 10:56:41 ldap slapd[2210]: send_ldap_result: conn=-1 op=0 p=3
May  6 10:56:41 ldap slapd[2210]: send_ldap_result: err=52 matched="" text="Target is quarantined"
May  6 10:56:41 ldap slapd[2210]: syncrepl_entry: rid=203 be_search (52)
May  6 10:56:41 ldap slapd[2210]: syncrepl_entry: rid=203 dc=mydomain,dc=com,dc=au
May  6 10:56:41 ldap slapd[2210]: ==> ldap_back_add("dc=mydomain,dc=com,dc=au")
May  6 10:56:41 ldap slapd[2210]: send_ldap_result: conn=-1 op=0 p=3
May  6 10:56:41 ldap slapd[2210]: send_ldap_result: err=52 matched="" text="Target is quarantined"
May  6 10:56:41 ldap slapd[2210]: null_callback : error code 0x34
May  6 10:56:41 ldap slapd[2210]: <== ldap_back_add("dc=mydomain,dc=com,dc=au"): 52
May  6 10:56:41 ldap slapd[2210]: syncrepl_entry: rid=203 be_add dc=pixeltech,dc=com,dc=au (52)
May  6 10:56:41 ldap slapd[2210]: syncrepl_entry: rid=203 be_add dc=pixeltech,dc=com,dc=au failed (52)
May  6 10:56:41 ldap slapd[2210]: do_syncrepl: rid=203 rc 52 retrying

I presume that conn=-1 means that connection failed, however I tested it and it works. What has quarantined the host and why?

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.