URL: https://linuxfr.org/forums/linux-general/posts/ldap-over-tls-unsupported-extended-operation Title: LDAP over TLS - unsupported extended operation Authors: Nono Date: 2014年09月10日T19:24:34+02:00 License: CC By-SA Tags: ldap, tls, certificat, ldaps et debian Score: 0 Bonjour, J'ai suivi la création du certificat depuis la page d'openldap (ici: http://www.openldap.org/faq/data/cache/185.html ) J'ai aussi générer un certificat cacert et j'obtient le même résultat. Lorsque je fais un ```bash root@DB:/etc/ldap# ldapsearch -ZZ ldap_start_tls: Protocol error (2) additional info: unsupported extended operation ``` alors qu'un : ```bash root@DB:~# ldapsearch SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 # extended LDIF # # LDAPv3 # base (default) with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 ``` Quelques logs additionnel : ```bash root@DB:~# netstat -tan Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN tcp6 0 0 :::636 :::* LISTEN tcp6 0 0 :::389 :::* LISTEN ``` ```bash root@DB:~# cgrep /etc/default/slapd SLAPD_CONF= SLAPD_USER="openldap" SLAPD_GROUP="openldap" SLAPD_PIDFILE= SLAPD_SERVICES="ldap:/// ldaps:/// ldapi:///" SLAPD_SENTINEL_FILE=/etc/ldap/noslapd SLAPD_OPTIONS="" ``` ```bash root@DB:/etc/ldap# l total 48K -rw-r--r-- 1 root root 4.4K Sep 10 17:20 cacert.pem drwxr-xr-x 2 root root 4.0K Sep 10 17:19 cert_old -rw-r--r-- 1 root root 0 Sep 10 17:17 db_crt.pem -rw------- 1 root root 2.7K Sep 10 17:17 db_key.pem -rw-r--r-- 1 root root 183 Sep 4 15:49 init.ldif -rw-r--r-- 1 root root 178 Sep 4 16:14 olcAccess.ldif -rw-r--r-- 1 root root 463 Sep 4 16:12 olcDbIndex.ldif -rw-r--r-- 1 root root 250 Sep 4 17:16 olcSSL.ldif drwxr-xr-x 2 root root 4.0K Apr 23 2013 sasl2 drwxr-xr-x 2 root root 4.0K Sep 4 15:27 schema drwxr-xr-x 3 openldap openldap 4.0K Sep 5 16:33 slapd.d -rw-r--r-- 1 root root 88 Sep 4 15:50 ssl.ldif ``` Premier signe d'erreur, mais que je n'arrive pas à comprendre/debugger : ```bash root@DB:/etc/ldap# openssl s_client -connect db.m0le.net:389 -state -showcerts -CAfile /etc/ldap/cacert.pem CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:unknown state 139821511227048:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 308 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE --- ``` ```bash root@DB:/etc/ldap/cert_old# gnutls-cli --x509cafile /etc/ldap/cacert.pem --x509keyfile /etc/ldap/db_key.pem --x509certfile /etc/ldap/db_crt.pem -d 5 -p 636 db.m0le.net Processed 1 CA certificate(s). Processed 1 client certificates... |<2>| ASSERT: x509_b64.c:453 |<2>| Could not find '-----BEGIN RSA PRIVATE KEY' |<2>| ASSERT: x509_b64.c:453 |<2>| Could not find '-----BEGIN DSA PRIVATE KEY' |<2>| ASSERT: privkey.c:387 |<2>| Falling back to PKCS #8 key decoding Processed 1 client X.509 certificates... Resolving 'db.m0le.net'... Connecting to '10.0.0.4:636'... |<4>| REC[0xc65a70]: Allocating epoch #0 |<2>| ASSERT: gnutls_constate.c:695 |<4>| REC[0xc65a70]: Allocating epoch #1 |<3>| HSK[0xc65a70]: Keeping ciphersuite: DHE_RSA_AES_128_CBC_SHA1 |<3>| HSK[0xc65a70]: Keeping ciphersuite: DHE_RSA_AES_128_CBC_SHA256 |<3>| HSK[0xc65a70]: Keeping ciphersuite: DHE_RSA_CAMELLIA_128_CBC_SHA1 |<3>| HSK[0xc65a70]: Keeping ciphersuite: DHE_RSA_AES_256_CBC_SHA1 |<3>| HSK[0xc65a70]: Keeping ciphersuite: DHE_RSA_AES_256_CBC_SHA256 |<3>| HSK[0xc65a70]: Keeping ciphersuite: DHE_RSA_CAMELLIA_256_CBC_SHA1 |<3>| HSK[0xc65a70]: Keeping ciphersuite: DHE_RSA_3DES_EDE_CBC_SHA1 |<3>| HSK[0xc65a70]: Keeping ciphersuite: DHE_DSS_AES_128_CBC_SHA1 |<3>| HSK[0xc65a70]: Keeping ciphersuite: DHE_DSS_AES_128_CBC_SHA256 |<3>| HSK[0xc65a70]: Keeping ciphersuite: DHE_DSS_CAMELLIA_256_CBC_SHA1 |<3>| HSK[0xc65a70]: Keeping ciphersuite: DHE_DSS_3DES_EDE_CBC_SHA1 |<3>| HSK[0xc65a70]: Keeping ciphersuite: DHE_DSS_ARCFOUR_SHA1 |<3>| HSK[0xc65a70]: Keeping ciphersuite: RSA_AES_128_CBC_SHA1 |<3>| HSK[0xc65a70]: Keeping ciphersuite: RSA_AES_128_CBC_SHA256 |<3>| HSK[0xc65a70]: Keeping ciphersuite: RSA_CAMELLIA_128_CBC_SHA1 |<3>| HSK[0xc65a70]: Keeping ciphersuite: RSA_AES_256_CBC_SHA1 |<3>| HSK[0xc65a70]: Keeping ciphersuite: RSA_AES_256_CBC_SHA256 |<3>| HSK[0xc65a70]: Keeping ciphersuite: RSA_CAMELLIA_256_CBC_SHA1 |<3>| HSK[0xc65a70]: Keeping ciphersuite: RSA_3DES_EDE_CBC_SHA1 |<3>| HSK[0xc65a70]: Keeping ciphersuite: RSA_ARCFOUR_SHA1 |<3>| HSK[0xc65a70]: Keeping ciphersuite: RSA_ARCFOUR_MD5 |<2>| EXT[0xc65a70]: Sending extension SERVER NAME (16 bytes) |<2>| EXT[0xc65a70]: Sending extension SAFE RENEGOTIATION (1 bytes) |<2>| EXT[0xc65a70]: Sending extension SESSION TICKET (0 bytes) |<2>| EXT[SIGA]: sent signature algo (4.2) DSA-SHA256 |<2>| EXT[SIGA]: sent signature algo (4.1) RSA-SHA256 |<2>| EXT[SIGA]: sent signature algo (2.1) RSA-SHA1 |<2>| EXT[SIGA]: sent signature algo (2.2) DSA-SHA1 |<2>| EXT[0xc65a70]: Sending extension SIGNATURE ALGORITHMS (10 bytes) |<3>| HSK[0xc65a70]: CLIENT HELLO was sent [136 bytes] |<4>| REC[0xc65a70]: Sending Packet[0] Handshake(22) with length: 136 |<4>| REC[0xc65a70]: Sent Packet[1] Handshake(22) with length: 141 |<2>| ASSERT: gnutls_buffers.c:640 |<2>| ASSERT: gnutls_record.c:969 |<2>| ASSERT: gnutls_handshake.c:2762 *** Fatal error: A TLS packet with unexpected length was received. |<4>| REC: Sending Alert[2|22] - Record overflow |<4>| REC[0xc65a70]: Sending Packet[1] Alert(21) with length: 2 |<2>| errno: 32 |<2>| ASSERT: gnutls_buffers.c:431 |<2>| ASSERT: gnutls_buffers.c:755 |<2>| ASSERT: gnutls_record.c:491 *** Handshake has failed GnuTLS error: A TLS packet with unexpected length was received. |<4>| REC[0xc65a70]: Epoch #0 freed |<4>| REC[0xc65a70]: Epoch #1 freed ``` Si il faut d'autres informations, n'hésitez pas, moi, je suis perdu :(

AltStyle によって変換されたページ (->オリジナル) / アドレス: モード: