1

I downloaded a TurnKey Linux OpenLDAP vm instance. It now runs in a vm. I am using this for user account authentication over a network. The client machine is a stock CentOS 7 machine. Everything on both machines is being implemented by OpenLDAP and OpenSSL.

The configuration of everything server-side AFAIK seems to be ok right out of the box (which is the entire concept of the TurnKey Linux distros). I can access its web admin interface over the network, everything seems to be fine except for the fact that I cannot authenticate from the client machine.

I believe I have everything set up properly on the client machine save for one fact: the SSL details on the client aren't set up properly and I'm not very knowledgable when it comes to that. I want to use my own certification and my own authority

Trying to su username from the client machine makes the shell hang for several seconds (as if it were waiting for something). Then the user authentication fails, as opposed to it just quitting immediately when I type in a nonsense user.

Upon investigation, I find the following entries within my system journal:

Nov 15 22:51:03 localhost.localdomain nslcd[16976]: [a5ee64] <group/member="root"> ldap_start_tls_s() failed (uri=ldap://192.168.254.104): Connect error: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.
Nov 15 22:51:03 localhost.localdomain nslcd[16976]: [a5ee64] <group/member="root"> failed to bind to LDAP server ldap://192.168.254.104: Connect error: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.
Nov 15 22:51:03 localhost.localdomain nslcd[16976]: [a5ee64] <group/member="root"> no available LDAP server found: Connect error
Nov 15 22:51:03 localhost.localdomain nslcd[16976]: [a5ee64] <group/member="root"> no available LDAP server found: Server is unavailable

How do I make the issuer of the certificate "trusted" on the client machine? What steps do I need to take to accomplish this? I am a complete noob with SSL and honestly after reading a bunch of things online I'm still quite confused as how to remedy the situation.

Improve this question
4
  • @steelmoneky what kind of authentication software you using? sssd?
    – c4f4t0r
    Nov 15, 2015 at 16:15
  • @c4f4t0r I'm not quite sure. TLS and auth-related errors appear from both sssd and nslcd in my journalctl output. I'm not knowledgable enough to know how to properly configure either one.
    – steelmonkey
    Nov 16, 2015 at 5:31
  • try to use "ldap_tls_reqcert = never" in sssd.conf source: fedorahosted.org/sssd/wiki/FAQ
    – c4f4t0r
    Nov 16, 2015 at 9:45
  • why don't you install freeipa? You are using centos 7 so it is in the standard repositories (ipa-server). Then install ipa-client in the clients and join them to the domain, everything will be in place (ldap+tls+kerberos). Here is the doc by Red Hat: access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/…
    – natxo asenjo
    Dec 4, 2015 at 12:36

1 Answer 1

Reset to default
1

You need to add the certificate file to your trusted certificate store. I don't have a CentOS VM on hand at the moment, but if I recall, it uses a normal directory containing plain-text X509 certs with .crt file extension.

It is likely somewhere under /etc/ssl. Just browse around there or use find until you find where all of the other trusted certs are located. There should be quite a few of them. If you have the certificate, just copy it to that location and make sure the permissions are the same as the other trusted certs.

Improve this answer
1
  • Likely you would need then a c_rehash run, to create symlinks used as indexes.
    – 473183469
    Nov 18, 2015 at 12:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .