389-users December 2020

389-users@lists.fedoraproject.org

7 participants
7 discussions

Replication with SSLCLIENTAUTH: server sent no certificate
by Eugen Lamers 01 Feb '21

01 Feb '21

I'm trying to setup a replication with a certificate based authentication between supplier and consumer. The certificates in the certdb at /etc/dirsrv/slapd-XXX contain the very same CA with which the respective server certificates in the certdbs have been signed. The certificates all have the 'u' flag, and the CA has the C and T flag. The replication (on the supplier) has been setup such that TLS and certificate based authentication is used, see extract from the replication agreement object: objectclass: nsds5ReplicationAgreement nsds5replicahost: <consumer-hostname> nsds5replicaport: 389 nsds5replicatransportinfo: TLS nsds5replicabindmethod: SSLCLIENTAUTH Trying to initialize the consumer raises this error in the error-log of the supplier (the host sending the starttls connection request): Replication bind with EXTERNAL auth failed: LDAP error 48 (Inappropriate authentication) (missing client certificate) The certificate that the server should have sent can, however, be used with the ldap commandline tools as ldapsearch. In this case a wireshark trace clearly shows that the client sends the certificate during the TLS handshake, while in the above case it doesn't. The TLS handshake defines that the client has to send an "empty certificate" if it does not have a certificate that has been issued by a CA offered by the server during the handshake. I can't see a reason for the client to think the condition isn't met. The certificate with which the server (supplier) is setup is the only one available. Is it possible that the server does not know which certificate it has to use for authentication with the consumer server? And if so, how do I make the server know? The 389-ds in use is the version 1.4.1.6~git0.5ac5a8aad. The problem was the same with 1.4.0.3. Thanks, Eugen

3 11

GSSAPI authentication w/ and w/o rDNS resolution
by Julien Rische 12 Jan '21

12 Jan '21

Hi all, We are working on a FreeIPA infrastructure, but we are facing an issue regarding GSSAPI authentication against 389ds. Our infrastructure is currently moving from enabled to disabled reverse DNS resolution on Kerberos clients. We are also using load-balanced DNS aliases and, as a consequence, nodes of distributed services must provide keys for both a canonical service principal and a localhost service principal. This setup is similar to the one commonly used for HA proxies, which is described in the 389ds' documentation[1]. We configured the keytab accordingly (ipa01.example.net is the FreeIPA node and ldap.example.net is the load-balanced alias): KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 1 06/30/2020 10:24:28 ldap/ipa01.example.net(a)EXAMPLE.NET 1 06/30/2020 10:24:28 ldap/ipa01.example.net(a)EXAMPLE.NET 1 06/30/2020 11:18:43 ldap/ldap.example.net(a)EXAMPLE.NET 1 06/30/2020 11:18:43 ldap/ldap.example.net(a)EXAMPLE.NET SASL/GSSAPI authentication works when connecting to ipa01.example.net, or ldap.example.net but only if [libdefaults].rdns=true in /etc/kbr5.conf. When rDNS resolution is disabled, authentication doesn't work any more: $ ldapwhoami -QY GSSAPI -H ldaps://ldap.example.net ldap_sasl_interactive_bind_s: Invalid credentials (49) The ticket me(a)EXAMPLE.NET->ldap/ldap.example.net(a)EXAMPLE.NET is in the ccache, but 389ds rejects it even though the matching key is available in its keytab. It seems 389ds is checking the incoming ticket against the "nsslapd-localhost" parameter, and rejects it if they are not matching: dn: cn=config nsslapd-localhost: ipa01.example.net Setting "nsslapd-localhost" to "ldap.example.net" fixed this issue, but it causes authentication to ldap/ipa01.example.net(a)EXAMPLE.NET to stop working. Also it is not possible to have multiple "nsslapd-localhost" entries. Is there a way to disable checking against "nsslapd-localhost" to allow authentication against any key from the configured keytab (we use 389ds version 1.3.10.2)? Julien Rische CERN [1] https://directory.fedoraproject.org/docs/389ds/howto/howto-loadbalance-gssa…

3 4

LDAP: error code 12 - Unavailable Critical Extension
by Oleg Cohen 21 Dec '20

21 Dec '20

Greetings, I run a Java application. From time to time I start seeing the following error in the logs: LDAP: error code 12 - Unavailable Critical Extension I have a three node 389-DS cluster and don't see any errors in the respective 389 DS logs. The restart of the Java application seems to resolve the issue. Wondering if anybody has seen this error before and how to debug/remediate. Thanks! Oleg

3 2

PR_Bind() on All Interfaces port 389 failed: Netscape Portable Runtime error -5966 (Access Denied.)
by Oleg Cohen 21 Dec '20

21 Dec '20

Greetings, I have a server that suddenly can be started due to the following error: PR_Bind() on All Interfaces port 389 failed: Netscape Portable Runtime error -5966 (Access Denied.) I disabled selinux to try and also checked that the policy on the port set during install is still there. Wonder if anyone has encountered a similar issue and if there are any ways to further troubleshoot and fix the problem. Thank you! Oleg -- *Oleg Cohen | Principal | **A S S U R E B R I D G E* *Office: +1 617 564 0737 | Mobile: +1 617 455 7927 | Fax: +1 888 409 6995* *Email: Oleg.Cohen(a)assurebridge.com <Oleg.Cohen(a)assurebridge.com> **| www.assurebridge.com <http://www.assurebridge.com>*

2 3

ldap_modify: Invalid syntax (21)
by Dwijadas Dey 08 Dec '20

08 Dec '20

Hi I am trying to run ldapmodify using a ldif file but it results in ldap_modify: Invalid syntax (21) error # ldapmodify -D "cn=Directory Manager" -W -f PWMacis.ldif Enter LDAP Password: modifying entry "cn=users,cn=accounts,dc=infodetics,dc=net" ldap_modify: Invalid syntax (21) additional info: targetattr "pwmGUID" does not exist in schema. Please add attributeTypes "pwmGUID" to schema if necessary. ACL Syntax Error(-5):(targetattr = \22pwmGUID || pwmLastPwdUpdate || userPassword || objectClass || pwmEventLog || krbPrincipalKey\22) (target = \22ldap:///cn=users,cn=accounts,dc=infodetics,dc=net\22) (version 3.0; acl \22PWM Proxy Reset Password\22; allow (write)(userdn = \22ldap:///uid=pwmproxy,cn=users,cn=accounts,dc=infodetics,dc=net\22);) PWMacis.ldif ========== dn: cn=users,cn=accounts,dc=infodetics,dc=net changetype: modify replace: aci aci: (targetattr = "*") (target = "ldap:///cn=users,cn=accounts,dc=infodetics,dc=net") (version 3.0; acl "PWM Proxy Search"; allow (read,search)(userdn = "ldap:///uid=pwmproxy,cn=users,cn=accounts,dc=infodetics,dc=net");) aci: (targetattr = "*") (target = "ldap:///cn=users,cn=accounts,dc=infodetics,dc=net") (version 3.0; acl "PWM Proxy Add Users"; allow (add)(userdn = "ldap:///uid=pwmproxy,cn=users,cn=accounts,dc=infodetics,dc=net");) aci: (targetattr = "pwmGUID || pwmLastPwdUpdate || userPassword || objectClass || pwmEventLog || krbPrincipalKey") (target = "ldap:///cn=users,cn=accounts,dc=infodetics,dc=net") (version 3.0; acl "PWM Proxy Reset Password"; allow (write)(userdn = "ldap:///uid=pwmproxy,cn=users,cn=accounts,dc=infodetics,dc=net");) aci: (targetattr ="userpassword || telephonenumber || facsimiletelephonenumber || pwmResponseSet || pwmOtpSecret")(version 3.0;acl "Allow self entry modification";allow (write)(userdn = "ldap:///self");) From the error message it looks like the targetattr "pwmGUID" does not exist in schema. However i have manually copied the schema definition for the said target attributes in /etc/dirsrv/slapd-INFODETICS-NET/schema folder and restarted the LDAP service. The ldif file for schema definition: ========================= dn: cn=schema objectclass: top objectclass: ldapSubentry objectclass: subschema cn: schema aci: (target="ldap:///cn=schema")(targetattr !="aci")(version 3.0;acl "anonymous, no acis"; allow (read, search, compare) userdn = "ldap:///anyone";) aci: (targetattr="*")(version 3.0; acl "Configuration Administrators Group"; allow (all) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=infodetics,dc=net";) aci: (targetattr="*")(version 3.0; acl "Configuration Administrator"; allow (all) userdn="ldap:///uid=admin,cn=users,cn=accounts,dc=infodetics,dc=net";) aci: (targetattr = "*")(version 3.0; acl "SIE Group"; allow (all) groupdn = "ldap:///fqdn=idm.infodetics.net,cn=computers,cn=accounts,dc=infodetics,dc=net";) attributetypes: ( 1.3.6.1.4.1.35015.1.2.1 NAME 'pwmEventLog' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'user defined' ) attributetypes: ( 1.3.6.1.4.1.35015.1.2.2 NAME 'pwmResponseSet' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'user defined' ) attributetypes: ( 1.3.6.1.4.1.35015.1.2.3 NAME 'pwmLastPwdUpdate' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE X-ORIGIN 'user defined' ) attributetypes: ( 1.3.6.1.4.1.35015.1.2.4 NAME 'pwmGUID' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'user defined' ) attributetypes: ( 1.3.6.1.4.1.35015.1.2.6 NAME 'pwmOtpSecret' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'user defined' ) objectclasses: ( 1.3.6.1.4.1.35015.1.1.1 NAME 'pwmUser' DESC '' SUP top AUXILIARY MAY ( pwmEventLog $ pwmGUID $ pwmLastPwdUpdate $ pwmResponseSet $ pwmOtpSecret ) X-ORIGIN 'user defined' ) What could be the issue ? Regards

1 0

unattended request cert process
by Angel Bosch Mora 02 Dec '20

02 Dec '20

hi, some time ago I asked for a scriptable way of creating a certificate request, here's the thread: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject… I didn't have the time to write anything and I would like to invest some time now. the goal is to create an unattended script for node creation INCLUDING certification with an external CA. I'm thinking about having several precreated certificate databases and download them to nodes. something like: openssl rand -base64 16 > pwfile.txt && certutil -N -d . -f pwfile.txt in several nodes and then scp/wget them to each node. also, do all CSR beforehand and already signed with our CA so I will have a repo of cert databases like: nss/ca_root.crt nss/ldap10 nss/ldap10/cert9.db nss/ldap10/key4.db nss/ldap10/ldap10.example.com.crt nss/ldap10/pkcs11.txt nss/ldap10/pwfile.txt nss/ldap11 nss/ldap11/cert9.db nss/ldap11/key4.db nss/ldap11/ldap11.example.com.crt nss/ldap11/pkcs11.txt nss/ldap11/pwfile.txt nss/ldap12 nss/ldap12/cert9.db nss/ldap12/key4.db nss/ldap12/ldap12.example.com.crt nss/ldap12/pkcs11.txt nss/ldap12/pwfile.txt nss/ldap13 nss/ldap13/cert9.db nss/ldap13/key4.db nss/ldap13/ldap13.example.com.crt nss/ldap13/pkcs11.txt nss/ldap13/pwfile.txt nss/ldap14 nss/ldap14/cert9.db nss/ldap14/key4.db nss/ldap14/ldap14.example.com.crt nss/ldap14/pkcs11.txt nss/ldap14/pwfile.txt nss/ldap15 nss/ldap15/cert9.db nss/ldap15/key4.db nss/ldap15/ldap15.example.com.crt nss/ldap15/pkcs11.txt nss/ldap15/pwfile.txt this step is the only one remaining on my recipe of unattended container creation, so any help will be really appreciated. best regards, abosch -- Institut Mallorqui d'Afers Socials. Aquest missatge, i si escau, qualsevol fitxer annex, es dirigeix exclusivament a la persona que n'es destinataria i pot contenir informacio confidencial. En cap cas no heu de copiar aquest missatge ni lliurar-lo a terceres persones sense permis expres de l'IMAS. Si no sou la persona destinataria que s'hi indica (o la responsable de lliurar-l'hi) us demanam que ho notifiqueu immediatament a l'adreca electronica de la persona remitent. Abans d'imprimir aquest missatge, pensau si es realment necessari.

2 3

Re: unattended request cert process
by Fong, Trevor 02 Dec '20

02 Dec '20

Hi abosch, Have you looked at preconfiguring the cert db's with a wildcard cert from a CA to avoid the request/sign dance? Trev On 2020-12-02, 1:04 AM, "Angel Bosch Mora" <abosch(a)imasmallorca.net> wrote: [CAUTION: Non-UBC Email] > depending on your version of 389, look at "dsctl <instance name> tls > import-ca" > > {william@ldapkdc 9:12} ~/development $ dsctl localhost tls import-ca > --help > usage: dsctl [instance] tls import-ca [-h] cert_path nickname > > positional arguments: > cert_path The path to the x509 cert to import as a server CA > nickname The name of the certificate once imported > > optional arguments: > -h, --help show this help message and exit > > This allows you to import a PEM CA file. There are a number of other > helpers under the tls subcommand to make cert management easier. > all this is pretty new, right? I can't recall reading this last time I checked docs. anyway, my main problem is that to deploy a node in a truly unattended mode It shouldn't pause at CSR request and continue when CA sign certificates, so I'm trying to have some preconfigured cert databases and signed certs. If there's no way to do that, I can't dynamically create and destroy nodes. the other option is letting the loadbalancer handle encryption, but official docs are very aggressive against that option, but I wonder if I should ignore that recommendation and encrypt at LB level. any hints? abosch -- Institut Mallorqui d'Afers Socials. Aquest missatge, i si escau, qualsevol fitxer annex, es dirigeix exclusivament a la persona que n'es destinataria i pot contenir informacio confidencial. En cap cas no heu de copiar aquest missatge ni lliurar-lo a terceres persones sense permis expres de l'IMAS. Si no sou la persona destinataria que s'hi indica (o la responsable de lliurar-l'hi) us demanam que ho notifiqueu immediatament a l'adreca electronica de la persona remitent. Abans d'imprimir aquest missatge, pensau si es realment necessari. _______________________________________________ 389-users mailing list -- 389-users(a)lists.fedoraproject.org To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject…

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users December 2020