1

I downloaded a TurnKey Linux OpenLDAP vm instance. It now runs in a vm. I am using this for user account authentication over a network. The client machine is a stock CentOS 7 machine. Everything on both machines is being implemented by OpenLDAP and OpenSSL.

The configuration of everything server-side AFAIK seems to be ok right out of the box (which is the entire concept of the TurnKey Linux distros). I can access its web admin interface over the network, everything seems to be fine except for the fact that I cannot authenticate from the client machine.

I believe I have everything set up properly on the client machine save for one fact: the SSL details on the client aren't set up properly and I'm not very knowledgable when it comes to that. I want to use my own certification and my own authority

Trying to su username from the client machine makes the shell hang for several seconds (as if it were waiting for something). Then the user authentication fails, as opposed to it just quitting immediately when I type in a nonsense user.

Upon investigation, I find the following entries within my system journal:

Nov 15 22:51:03 localhost.localdomain nslcd[16976]: [a5ee64] <group/member="root"> ldap_start_tls_s() failed (uri=ldap://192.168.254.104): Connect error: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.
Nov 15 22:51:03 localhost.localdomain nslcd[16976]: [a5ee64] <group/member="root"> failed to bind to LDAP server ldap://192.168.254.104: Connect error: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.
Nov 15 22:51:03 localhost.localdomain nslcd[16976]: [a5ee64] <group/member="root"> no available LDAP server found: Connect error
Nov 15 22:51:03 localhost.localdomain nslcd[16976]: [a5ee64] <group/member="root"> no available LDAP server found: Server is unavailable

How do I make the issuer of the certificate "trusted" on the client machine? What steps do I need to take to accomplish this? I am a complete noob with SSL and honestly after reading a bunch of things online I'm still quite confused as how to remedy the situation.

4
  • @steelmoneky what kind of authentication software you using? sssd? – c4f4t0r Nov 15 '15 at 16:15
  • @c4f4t0r I'm not quite sure. TLS and auth-related errors appear from both sssd and nslcd in my journalctl output. I'm not knowledgable enough to know how to properly configure either one. – steelmonkey Nov 16 '15 at 5:31
  • try to use "ldap_tls_reqcert = never" in sssd.conf source: fedorahosted.org/sssd/wiki/FAQ – c4f4t0r Nov 16 '15 at 9:45
  • why don't you install freeipa? You are using centos 7 so it is in the standard repositories (ipa-server). Then install ipa-client in the clients and join them to the domain, everything will be in place (ldap+tls+kerberos). Here is the doc by Red Hat: access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/… – natxo asenjo Dec 4 '15 at 12:36
1

You need to add the certificate file to your trusted certificate store. I don't have a CentOS VM on hand at the moment, but if I recall, it uses a normal directory containing plain-text X509 certs with .crt file extension.

It is likely somewhere under /etc/ssl. Just browse around there or use find until you find where all of the other trusted certs are located. There should be quite a few of them. If you have the certificate, just copy it to that location and make sure the permissions are the same as the other trusted certs.

1
  • Likely you would need then a c_rehash run, to create symlinks used as indexes. – 473183469 Nov 18 '15 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.