On Wed, 2005-08-03 at 13:21 -0400, Kevin Kovach wrote: > Thanks for the help. I've added that object and was able to modify > the configuration without further issues. > > Unfortunately, I've run into another problem now. Now when I try to > start the directory it's complaining about one of the ciphers. I get > the following error when I attempt to start the server ... > > [03/Aug/2005:13:19:35 -0400] - SSL alert: Security Initialization: > Failed to set SSL cipher preference information: unknown cipher fo > (Netscape Portable Runtime error -5950 - File not found.) > [03/Aug/2005:13:19:35 -0400] - ERROR: SSL Initialization Failed. > > It looks like it's complaining about the 'fo cipher' that was added in > the same configuration modifications? The change I'm talking about is > the following ... > > add: nsSSL3Ciphers > nsSSL3Ciphers: -rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5,+rsa_des_sha,+rsa_fips_des_sha, > +rsa_3des_sha,+rsa_fips_3des_sha,+fortezza,+fo > > I looked at the dse.ldif file and it looks like it was added correctly > (as it's presented in the SSL HOWTO) Any advice? Thanks. > > - Kevin > > > On 8/3/05, Adam Stokes <astokes at redhat.com> wrote: > > On Wed, 2005-08-03 at 10:35 -0400, Kevin Kovach wrote: > > > Hello, > > > > > > I've worked through the SSL howto on the FDS site and everything went > > > well until I got to the part where I modified the schema. > > > > > > The /tmp/ssl_enable.ldif modifications that are suggested work well up > > > to the point where it tries to modify cn=RSA,cn=encryption,cn=config > > > > > > To be specific, the recommended changes are as follows... > > > > > > dn: cn=encryption,cn=config > > > changetype: modify > > > replace: nsSSL3 > > > nsSSL3: on > > > - > > > replace: nsSSLClientAuth > > > nsSSLClientAuth: allowed > > > - > > > add: nsSSL3Ciphers > > > nsSSL3Ciphers: -rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5,+rsa_des_sha,+rsa_fips_des_sha, > > > +rsa_3des_sha,+rsa_fips_3des_sha,+fortezza,+fo > > > - > > > add: nsKeyfile > > > nsKeyfile: alias/slapd-directory-key3.db > > > - > > > add: nsCertfile > > > nsCertfile: alias/slapd-directory-cert8.db > > > > > > dn: cn=RSA,cn=encryption,cn=config > > > changetype: modify > > > add: nsSSLPersonalitySSL > > > nsSSLPersonalitySSL: Server-Cert > > > > > > dn: cn=config > > > changetype: modify > > > add: nsslapd-security > > > nsslapd-security: on > > > - > > > replace: nsslapd-ssl-check-hostname > > > nsslapd-ssl-check-hostname: off > > > > > > It seems as though when I get to the point where I want to add the > > > 'nsSSLPersonalitySSL' attribute my directory server complains that the > > > 'cn=RSA,cn=encryption,cn=config' object does not exist to be modified. > > > > > > I don't see anywhere in the HOWTO where I would have created this > > > object. Am I missing something? Thanks. > > > > > > - Kevin > > > > > > -- > > > Fedora-directory-users mailing list > > > Fedora-directory-users at redhat.com > > > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > > > Refresh the wiki page I have updated this problem. > > > > Thanks for pointing that out please create an ldif /tmp/addrsa.ldif and > > have the following : > > > > dn: cn=RSA,cn=encryption,cn=config > > objectclass: top > > objectclass: nsEncryptionModule > > cn: RSA > > nsSSLPersonalitySSL: Server-Cert > > nsSSLToken: internal (software) > > > > Use ldapadd to add the entry into the directory server.. Ill fix the > > how-to now as well :) > > > > > > > > -- > > Fedora-directory-users mailing list > > Fedora-directory-users at redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > > > The how-to may be confusing here as the ciphers need to be on one line so make sure there isnt a new line nsSSL3Ciphers: -rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5, +rsa_rc2_40_md5,+rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha, +rsa_fips_3des_sha,+fortezza,+fo
