Replication with SSLCLIENTAUTH: server sent no certificate
by Eugen Lamers
I'm trying to setup a replication with a certificate based authentication between supplier and consumer. The certificates in the certdb at /etc/dirsrv/slapd-XXX contain the very same CA with which the respective server certificates in the certdbs have been signed. The certificates all have the 'u' flag, and the CA has the C and T flag.
The replication (on the supplier) has been setup such that TLS and certificate based authentication is used, see extract from the replication agreement object:
objectclass: nsds5ReplicationAgreement
nsds5replicahost: <consumer-hostname>
nsds5replicaport: 389
nsds5replicatransportinfo: TLS
nsds5replicabindmethod: SSLCLIENTAUTH
Trying to initialize the consumer raises this error in the error-log of the supplier (the host sending the starttls connection request):
Replication bind with EXTERNAL auth failed: LDAP error 48 (Inappropriate authentication) (missing client certificate)
The certificate that the server should have sent can, however, be used with the ldap commandline tools as ldapsearch. In this case a wireshark trace clearly shows that the client sends the certificate during the TLS handshake, while in the above case it doesn't.
The TLS handshake defines that the client has to send an "empty certificate" if it does not have a certificate that has been issued by a CA offered by the server during the handshake. I can't see a reason for the client to think the condition isn't met. The certificate with which the server (supplier) is setup is the only one available.
Is it possible that the server does not know which certificate it has to use for authentication with the consumer server? And if so, how do I make the server know?
The 389-ds in use is the version 1.4.1.6~git0.5ac5a8aad. The problem was the same with 1.4.0.3.
Thanks,
Eugen
2 years, 10 months
GSSAPI authentication w/ and w/o rDNS resolution
by Julien Rische
Hi all,
We are working on a FreeIPA infrastructure, but we are facing an issue regarding GSSAPI authentication against 389ds. Our infrastructure is currently moving from enabled to disabled reverse DNS resolution on Kerberos clients. We are also using load-balanced DNS aliases and, as a consequence, nodes of distributed services must provide keys for both a canonical service principal and a localhost service principal.
This setup is similar to the one commonly used for HA proxies, which is described in the 389ds' documentation[1].
We configured the keytab accordingly (ipa01.example.net is the FreeIPA node and ldap.example.net is the load-balanced alias):
KVNO Timestamp Principal
---- ------------------- ------------------------------------------------------
1 06/30/2020 10:24:28 ldap/ipa01.example.net(a)EXAMPLE.NET
1 06/30/2020 10:24:28 ldap/ipa01.example.net(a)EXAMPLE.NET
1 06/30/2020 11:18:43 ldap/ldap.example.net(a)EXAMPLE.NET
1 06/30/2020 11:18:43 ldap/ldap.example.net(a)EXAMPLE.NET
SASL/GSSAPI authentication works when connecting to ipa01.example.net, or ldap.example.net but only if [libdefaults].rdns=true in /etc/kbr5.conf. When rDNS resolution is disabled, authentication doesn't work any more:
$ ldapwhoami -QY GSSAPI -H ldaps://ldap.example.net
ldap_sasl_interactive_bind_s: Invalid credentials (49)
The ticket me(a)EXAMPLE.NET->ldap/ldap.example.net(a)EXAMPLE.NET is in the ccache, but 389ds rejects it even though the matching key is available in its keytab.
It seems 389ds is checking the incoming ticket against the "nsslapd-localhost" parameter, and rejects it if they are not matching:
dn: cn=config
nsslapd-localhost: ipa01.example.net
Setting "nsslapd-localhost" to "ldap.example.net" fixed this issue, but it causes authentication to ldap/ipa01.example.net(a)EXAMPLE.NET to stop working. Also it is not possible to have multiple "nsslapd-localhost" entries.
Is there a way to disable checking against "nsslapd-localhost" to allow authentication against any key from the configured keytab (we use 389ds version 1.3.10.2)?
Julien Rische
CERN
[1] https://directory.fedoraproject.org/docs/389ds/howto/howto-loadbalance-gs...
2 years, 10 months
LDAP: error code 12 - Unavailable Critical Extension
by Oleg Cohen
Greetings,
I run a Java application. From time to time I start seeing the following error in the logs:
LDAP: error code 12 - Unavailable Critical Extension
I have a three node 389-DS cluster and don't see any errors in the respective 389 DS logs.
The restart of the Java application seems to resolve the issue.
Wondering if anybody has seen this error before and how to debug/remediate.
Thanks!
Oleg
2 years, 11 months
PR_Bind() on All Interfaces port 389 failed: Netscape Portable Runtime error -5966 (Access Denied.)
by Oleg Cohen
Greetings,
I have a server that suddenly can be started due to the following error:
PR_Bind() on All Interfaces port 389 failed: Netscape Portable Runtime
error -5966 (Access Denied.)
I disabled selinux to try and also checked that the policy on the port set
during install is still there.
Wonder if anyone has encountered a similar issue and if there are any ways
to further troubleshoot and fix the problem.
Thank you!
Oleg
--
*Oleg Cohen | Principal | **A S S U R E B R I D G E*
*Office: +1 617 564 0737 | Mobile: +1 617 455 7927 | Fax: +1 888 409
6995*
*Email: Oleg.Cohen(a)assurebridge.com <Oleg.Cohen(a)assurebridge.com> **|
www.assurebridge.com <http://www.assurebridge.com>*
2 years, 11 months
ldap_modify: Invalid syntax (21)
by Dwijadas Dey
Hi I am trying to run ldapmodify using a ldif file but it results in ldap_modify: Invalid syntax (21) error
# ldapmodify -D "cn=Directory Manager" -W -f PWMacis.ldif
Enter LDAP Password:
modifying entry "cn=users,cn=accounts,dc=infodetics,dc=net"
ldap_modify: Invalid syntax (21)
additional info: targetattr "pwmGUID" does not exist in schema. Please add attributeTypes "pwmGUID" to schema if necessary. ACL Syntax Error(-5):(targetattr = \22pwmGUID || pwmLastPwdUpdate || userPassword || objectClass || pwmEventLog || krbPrincipalKey\22) (target = \22ldap:///cn=users,cn=accounts,dc=infodetics,dc=net\22) (version 3.0; acl \22PWM Proxy Reset Password\22; allow (write)(userdn = \22ldap:///uid=pwmproxy,cn=users,cn=accounts,dc=infodetics,dc=net\22);)
PWMacis.ldif
==========
dn: cn=users,cn=accounts,dc=infodetics,dc=net
changetype: modify
replace: aci
aci: (targetattr = "*") (target = "ldap:///cn=users,cn=accounts,dc=infodetics,dc=net") (version 3.0; acl "PWM Proxy Search"; allow (read,search)(userdn = "ldap:///uid=pwmproxy,cn=users,cn=accounts,dc=infodetics,dc=net");)
aci: (targetattr = "*") (target = "ldap:///cn=users,cn=accounts,dc=infodetics,dc=net") (version 3.0; acl "PWM Proxy Add Users"; allow (add)(userdn = "ldap:///uid=pwmproxy,cn=users,cn=accounts,dc=infodetics,dc=net");)
aci: (targetattr = "pwmGUID || pwmLastPwdUpdate || userPassword || objectClass || pwmEventLog || krbPrincipalKey") (target = "ldap:///cn=users,cn=accounts,dc=infodetics,dc=net") (version 3.0; acl "PWM Proxy Reset Password"; allow (write)(userdn = "ldap:///uid=pwmproxy,cn=users,cn=accounts,dc=infodetics,dc=net");)
aci: (targetattr ="userpassword || telephonenumber || facsimiletelephonenumber || pwmResponseSet || pwmOtpSecret")(version 3.0;acl "Allow self entry modification";allow (write)(userdn = "ldap:///self");)
From the error message it looks like the targetattr "pwmGUID" does not exist in schema.
However i have manually copied the schema definition for the said target attributes in /etc/dirsrv/slapd-INFODETICS-NET/schema folder and restarted the LDAP service.
The ldif file for schema definition:
=========================
dn: cn=schema
objectclass: top
objectclass: ldapSubentry
objectclass: subschema
cn: schema
aci: (target="ldap:///cn=schema")(targetattr !="aci")(version 3.0;acl "anonymous, no acis"; allow (read, search, compare) userdn = "ldap:///anyone";)
aci: (targetattr="*")(version 3.0; acl "Configuration Administrators Group"; allow (all) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=infodetics,dc=net";)
aci: (targetattr="*")(version 3.0; acl "Configuration Administrator"; allow (all) userdn="ldap:///uid=admin,cn=users,cn=accounts,dc=infodetics,dc=net";)
aci: (targetattr = "*")(version 3.0; acl "SIE Group"; allow (all) groupdn = "ldap:///fqdn=idm.infodetics.net,cn=computers,cn=accounts,dc=infodetics,dc=net";)
attributetypes: ( 1.3.6.1.4.1.35015.1.2.1 NAME 'pwmEventLog' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'user defined' )
attributetypes: ( 1.3.6.1.4.1.35015.1.2.2 NAME 'pwmResponseSet' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'user defined' )
attributetypes: ( 1.3.6.1.4.1.35015.1.2.3 NAME 'pwmLastPwdUpdate' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE X-ORIGIN 'user defined' )
attributetypes: ( 1.3.6.1.4.1.35015.1.2.4 NAME 'pwmGUID' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'user defined' )
attributetypes: ( 1.3.6.1.4.1.35015.1.2.6 NAME 'pwmOtpSecret' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'user defined' )
objectclasses: ( 1.3.6.1.4.1.35015.1.1.1 NAME 'pwmUser' DESC '' SUP top AUXILIARY MAY ( pwmEventLog $ pwmGUID $ pwmLastPwdUpdate $ pwmResponseSet $ pwmOtpSecret ) X-ORIGIN 'user defined' )
What could be the issue ?
Regards
2 years, 12 months
unattended request cert process
by Angel Bosch Mora
hi,
some time ago I asked for a scriptable way of creating a certificate request, here's the thread:
https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...
I didn't have the time to write anything and I would like to invest some time now.
the goal is to create an unattended script for node creation INCLUDING certification with an external CA.
I'm thinking about having several precreated certificate databases and download them to nodes.
something like:
openssl rand -base64 16 > pwfile.txt && certutil -N -d . -f pwfile.txt
in several nodes and then scp/wget them to each node.
also, do all CSR beforehand and already signed with our CA so I will have a repo of cert databases like:
nss/ca_root.crt
nss/ldap10
nss/ldap10/cert9.db
nss/ldap10/key4.db
nss/ldap10/ldap10.example.com.crt
nss/ldap10/pkcs11.txt
nss/ldap10/pwfile.txt
nss/ldap11
nss/ldap11/cert9.db
nss/ldap11/key4.db
nss/ldap11/ldap11.example.com.crt
nss/ldap11/pkcs11.txt
nss/ldap11/pwfile.txt
nss/ldap12
nss/ldap12/cert9.db
nss/ldap12/key4.db
nss/ldap12/ldap12.example.com.crt
nss/ldap12/pkcs11.txt
nss/ldap12/pwfile.txt
nss/ldap13
nss/ldap13/cert9.db
nss/ldap13/key4.db
nss/ldap13/ldap13.example.com.crt
nss/ldap13/pkcs11.txt
nss/ldap13/pwfile.txt
nss/ldap14
nss/ldap14/cert9.db
nss/ldap14/key4.db
nss/ldap14/ldap14.example.com.crt
nss/ldap14/pkcs11.txt
nss/ldap14/pwfile.txt
nss/ldap15
nss/ldap15/cert9.db
nss/ldap15/key4.db
nss/ldap15/ldap15.example.com.crt
nss/ldap15/pkcs11.txt
nss/ldap15/pwfile.txt
this step is the only one remaining on my recipe of unattended container creation, so any help will be really appreciated.
best regards,
abosch
-- Institut Mallorqui d'Afers Socials. Aquest missatge, i si escau, qualsevol fitxer annex, es dirigeix exclusivament a la persona que n'es destinataria i pot contenir informacio confidencial. En cap cas no heu de copiar aquest missatge ni lliurar-lo a terceres persones sense permis expres de l'IMAS. Si no sou la persona destinataria que s'hi indica (o la responsable de lliurar-l'hi) us demanam que ho notifiqueu immediatament a l'adreca electronica de la persona remitent. Abans d'imprimir aquest missatge, pensau si es realment necessari.
3 years
Re: unattended request cert process
by Fong, Trevor
Hi abosch,
Have you looked at preconfiguring the cert db's with a wildcard cert from a CA to avoid the request/sign dance?
Trev
On 2020-12-02, 1:04 AM, "Angel Bosch Mora" <abosch(a)imasmallorca.net> wrote:
[CAUTION: Non-UBC Email]
> depending on your version of 389, look at "dsctl <instance name> tls
> import-ca"
>
> {william@ldapkdc 9:12} ~/development $ dsctl localhost tls import-ca
> --help
> usage: dsctl [instance] tls import-ca [-h] cert_path nickname
>
> positional arguments:
> cert_path The path to the x509 cert to import as a server CA
> nickname The name of the certificate once imported
>
> optional arguments:
> -h, --help show this help message and exit
>
> This allows you to import a PEM CA file. There are a number of other
> helpers under the tls subcommand to make cert management easier.
>
all this is pretty new, right?
I can't recall reading this last time I checked docs.
anyway, my main problem is that to deploy a node in a truly unattended mode It shouldn't pause at CSR request and continue when CA sign certificates, so I'm trying to have some preconfigured cert databases and signed certs.
If there's no way to do that, I can't dynamically create and destroy nodes.
the other option is letting the loadbalancer handle encryption, but official docs are very aggressive against that option, but I wonder if I should ignore that recommendation and encrypt at LB level.
any hints?
abosch
-- Institut Mallorqui d'Afers Socials. Aquest missatge, i si escau, qualsevol fitxer annex, es dirigeix exclusivament a la persona que n'es destinataria i pot contenir informacio confidencial. En cap cas no heu de copiar aquest missatge ni lliurar-lo a terceres persones sense permis expres de l'IMAS. Si no sou la persona destinataria que s'hi indica (o la responsable de lliurar-l'hi) us demanam que ho notifiqueu immediatament a l'adreca electronica de la persona remitent. Abans d'imprimir aquest missatge, pensau si es realment necessari.
_______________________________________________
389-users mailing list -- 389-users(a)lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...
3 years
