Steven Jones wrote: > This is my pam_ldap.conf, > > I seem unable to get ssl to work....what am I missing? > > I also need to set ssl only so no plain text passwords are sent... > > #file copied from openldap syntax might have issues but seems to work. > #but not in ssl mode > # > # > # LDAP Defaults > # > > # See ldap.conf(5) for details > # This file should be world readable but not world writable. > host 130.195.87.249 > base dc=vuw,dc=ac,dc=nz > #ssl no > # this syntax does not work --> ssl on > ssl yes > ssl start_tls > pam_password exop > #pam_password md5 > HOST 130.195.87.249 > BASE dc=vuw,dc=ac,dc=nz > #nss_base_passwd ou=People,dc=vuw,dc=ac,dc=nz > #nss_base_shadow ou=People,dc=vuw,dc=ac,dc=nz > TLS_CACERTDIR /etc/openldap/cacerts/ > TLS_CACERT /etc/openldap/cacerts/cacert.asc > #TLS_CACERT /etc/openldap/cacerts/5be5959f.0 > TLS_REQCERT allow > #syntax not liked --> uri ldapi://130.195.87.249 > URI ldap://ldap.vuw.ac.nz > To rule out cert CA issues, set TLS_REQCERT to never. I don't think you can specify both TLS_CACERTDIR and TLS_CACERT - or maybe you can, but I always have problems when trying to use TLS_CACERTDIR > regards > > Steven Jones > Senior Linux/Unix/San/Vmware System Administrator > APG -Technology Integration Team > Victoria University of Wellington > Phone: +64 4 463 6272 > > -- > Fedora-directory-users mailing list > Fedora-directory-users at redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users > -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.fedoraproject.org/pipermail/389-users/attachments/20070917/9b21283b/attachment.bin
