openldap-server 'TLSVerifyClient demand' fails on centos 6.2?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



ldapsearch -x -ZZ works fine on clients, when the server side slapd.conf has 'TLSVerifyClient' is set to 'try'. But after I changed that the 'demand' all clients'  "ldapsearch -x -ZZ" command fails immediately. I run the 'slapd -d3' at server side too.

It looks like maybe  'ldapsearch -x -zz' didn't send out client certificates, even though it should with '-ZZ' options -- from ldap.conf manual?

My client side /etc/openldap/ldap.conf is like below:

BASE dc=example,dc=com
URI ldap://ldapmaster.example.com

## working
TLS_CACERT /etc/openldap/myca.crt
TLS_CERT /etc/openldap/ldapclient01.crt
TLS_KEY /etc/openldap/ldapclient01.key


My server side setup is:

## now using my own CA
## and it works!
TLSCACertificateFile /etc/openldap/myca.crt
TLSCertificateFile /etc/openldap/ldapmaster.crt
TLSCertificateKeyFile /etc/openldap/ldapmaster.key


#TLSVerifyClient allow
TLSVerifyClient demand   ## testing client TLS keys and my own CA setup, 'demand' failed for ldapsearch
#TLSCipherSuite HIGH:MEDIUM:LOW:+SSLv2
TLSCipherSuite HIGH:MEDIUM:+SSLv2


The logs on server is attahed below as well, Thanks.
...
connection_get(14): got connid=1000
connection_read(14): checking for input on id=1000
TLS: loaded CA certificate file /etc/openldap/myca.crt.
TLS: certificate [E=admin@xxxxxxxxxxx,CN=ldapmaster.example.com,OU=techOps,O=Pegaclouds Inc.,L=San Mateo,ST=CA,C=US] is valid
tls_read: want=3, got=3
  0000:  16 03 01                                           ...
tls_read: want=2, got=2
  0000:  00 41                                              .A
tls_read: want=65, got=65
  0000:  01 00 00 3d 03 01 4f 95  c1 e0 a9 10 22 30 25 4b   ...=..O....."0%K
  0010:  f8 da a5 27 64 9e 25 60  35 d0 5c 28 30 74 a8 40   ...'d.%`5.\(0t.@
...

tls_read: want=5 error=Resource temporarily unavailable
connection_get(14): got connid=1000
connection_read(14): checking for input on id=1000
tls_read: want=5, got=5
  0000:  16 03 01 01 0d                                     .....
tls_read: want=269, got=269
  0000:  0b 00 00 03 00 00 00 10  00 01 02 01 00 ac 64 b8   ..............d.
  0010:  bd bf 20 46 b8 14 e7 38  9a a1 40 2c 36 3a 78 fa   .. F...8..@,6:x.
  0020:  8a 12 61 3d e3 5e bf 02  f2 f9 a1 70 4e 7f 4e 11   ..a=.^.....pN.N.
  0030:  cd e6 ba 6d ee 1e 91 95  c7 9f c7 b3 e0 21 ea bb   ...m.........!..
  0040:  11 78 cc 58 c1 b1 37 f4  d5 18 ff 59 ad df 48 52   .x.X..7....Y..HR
  0050:  a7 cd 26 0a fe d8 09 bb  7e 70 16 d2 b7 35 de 9f   ..&.....~p...5..
  0060:  b3 0a ee 1e aa 42 e4 20  ed 8d 2f 31 f2 5d e9 d7   .....B. ../1.]..
  0070:  82 4c 78 30 48 5d 54 5c  cf c2 cc c9 33 31 50 c5   .Lx0H]T\....31P.
  0080:  56 62 f8 ea dd 34 32 ff  a1 81 e3 2f f7 a4 0e 58   Vb...42..../...X
  0090:  ff 84 39 0a fe 74 20 18  a6 ac 18 00 dc 8c 0e fd   ..9..t .........
  00a0:  5d 2e a3 87 4e 0b e8 51  66 85 8a 60 2e b7 01 a2   ]...N..Qf..`....
  00b0:  4a 5c d9 74 9b 32 04 16  57 2e f2 60 2d 45 3d 30   J\.t.2..W..`-E=0
  00c0:  e3 39 c9 a3 af 7b 86 4b  f0 f0 7e 34 f8 bf cf 4c   .9...{.K..~4...L
  00d0:  73 57 df e5 11 0a 41 de  7f 78 ed f4 cf 9b e8 10   sW....A..x......
  00e0:  ce 1a b1 73 ff 76 ec ff  23 46 85 24 02 b9 aa 4b   ...s.v..#F.$...K
  00f0:  fe c9 2a c6 06 ff 54 94  25 5d cc 3d de 5b 1d 9f   ..*...T.%].=.[..
  0100:  03 a1 36 da 3b 69 95 67  21 b5 61 d7 e9            ..6.;i.g!.a..
tls_write: want=7, written=7
  0000:  15 03 01 00 02 02 2a                               ......*
TLS: error: accept - force handshake failure: errno 11 - moznss error -12285
TLS: can't accept: TLS error -12285:Unable to find the certificate or key necessary for authentication..
connection_read(14): TLS accept failure error=-1 id=1000, closing
connection_close: conn=1000 sd=14
...
--Robinson





________________________________
 From: Robinson Tiemuqinke <hahaha_30k@xxxxxxxxx>
To: CentOS mailing list <centos@xxxxxxxxxx> 
Sent: Wednesday, November 23, 2011 11:20 AM
Subject: Re:  Any ideas?? -- Re: EC2 compatible kernel for centos 6?
 

I've tried with cr kernel, not it moves much faster but still fails -- fails at the partition failure, this setup is S3 backed image.

root (hd0)
 Filesystem type is ext2fs, using whole disk
kernel /boot/vmlinuz-2.6.32-131.17.1.el6.x86_64 ro root=/dev/sda1 rd_NO_LUKS rd
_NO_LVM rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTY
PE=pc KEYTABLE=us crashkernel=auto crashkernel=auto
initrd /boot/initramfs-2.6.32-131.17.1.el6.x86_64.img

close blk: backend at /local/domain/0/backend/vbd/8/2049
close blk: backend at /local/domain/0/backend/vbd/8/2064
close blk: backend at /local/domain/0/backend/vbd/8/2080
close blk: backend at /local/domain/0/backend/vbd/8/2096
close blk: backend at
 /local/domain/0/backend/vbd/8/2112
Initializing cgroup subsys cpuset
Initializing cgroup subsys cpu
Linux version 2.6.32-131.17.1.el6.x86_64 (mockbuild@xxxxxxxxxxxxxxxxxxxxxxxx) (gcc version 4.4.5 20110214 (Red Hat 4.4.5-6) (GCC) ) #1 SMP Thu Oct 6 19:24:09 BST 2011
Command line: ro root=/dev/sda1 rd_NO_LUKS rd_NO_LVM rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=us crashkernel=auto crashkernel=auto
KERNEL supported cpus:
  Intel GenuineIntel
  AMD AuthenticAMD
  Centaur CentaurHauls
ACPI in unprivileged domain disabled
BIOS-provided physical RAM map:
 Xen: 0000000000000000 - 00000000000a0000 (usable)
 Xen: 00000000000a0000 - 0000000000100000 (reserved)
 Xen: 0000000000100000 - 00000001c0000000 (usable)
DMI not present or invalid.
last_pfn = 0x1c0000 max_arch_pfn = 0x400000000
last_pfn = 0x100000 max_arch_pfn =
 0x400000000
init_memory_mapping: 0000000000000000-0000000100000000
init_memory_mapping: 0000000100000000-00000001c0000000
RAMDISK: 02028000 - 0460c000
No NUMA configuration found
Faking a node at 0000000000000000-00000001c0000000
Bootmem setup node 0 0000000000000000-00000001c0000000
  NODE_DATA [0000000000008000 - 000000000003bfff]
  bootmap [000000000003c000 -  0000000000073fff] pages 38
(8 early reservations) ==> bootmem [0000000000 - 01c0000000]
  #0 [0000000000 - 0000001000]   BIOS data page ==> [0000000000 - 0000001000]
  #1 [000540f000 - 000543e000]   XEN PAGETABLES ==> [000540f000 - 000543e000]
  #2 [0000006000 - 0000008000]       TRAMPOLINE ==> [0000006000 - 0000008000]
  #3 [0001000000 - 0002007524]    TEXT DATA BSS ==> [0001000000 - 0002007524]
  #4 [0002028000 -
 000460c000]          RAMDISK ==> [0002028000 - 000460c000]
  #5 [000460c000 - 000540f000]   XEN START INFO ==> [000460c000 - 000540f000]
  #6 [0000100000 - 00008d3000]          PGTABLE ==> [0000100000 - 00008d3000]
  #7 [000543e000 - 0005a41000]          PGTABLE ==> [000543e000 - 0005a41000]
Reserving 129MB of memory at 96MB for crashkernel (System RAM: 7168MB)
Zone PFN ranges:
  DMA      0x00000001 -> 0x00001000
  DMA32    0x00001000 -> 0x00100000
  Normal   0x00100000 -> 0x001c0000
Movable zone start PFN for each node
early_node_map[2] active PFN ranges
    0: 0x00000001 -> 0x000000a0
    0: 0x00000100 -> 0x001c0000
SFI: Simple Firmware
 Interface v0.7 http://simplefirmware.org
SMP: Allowing 8 CPUs, 0 hotplug CPUs
No local APIC present
APIC: disable apic facility
PM: Registered nosave memory: 00000000000a0000 - 0000000000100000
PCI: Warning: Cannot find a gap in the 32bit address range
PCI: Unassigned devices with 32bit resource registers may break!
Allocating PCI resources starting at 1c0100000 (gap: 1c0100000:400000)
Booting paravirtualized kernel on Xen
Xen version: 3.4.3-2.6.18 (preserve-AD)
NR_CPUS:4096 nr_cpumask_bits:8 nr_cpu_ids:8 nr_node_ids:1
PERCPU: Embedded 30 pages/cpu @ffff88002804f000 s92504 r8192 d22184 u122880
pcpu-alloc: s92504 r8192 d22184 u122880 alloc=30*4096
pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 [0] 4 [0] 5 [0] 6 [0] 7 
Xen: using vcpu_info placement
Built 1 zonelists in Node order, mobility grouping on.  Total pages: 1807817
Policy zone: Normal
Kernel command line: ro root=/dev/sda1 rd_NO_LUKS rd_NO_LVM
 rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=us crashkernel=auto crashkernel=129M@0M
PID hash table entries: 4096 (order: 3, 32768 bytes)
Checking aperture...
No AGP bridge found
AMD-Vi disabled by default: pass amd_iommu=on to enable
PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
Placing 64MB software IO TLB between ffff880020000000 - ffff880024000000
software IO TLB at phys 0x20000000 - 0x24000000
Memory: 6955572k/7340032k available (5013k kernel code, 388k absent, 384072k reserved, 7291k data, 1232k init)
Hierarchical RCU implementation.
NR_IRQS:33024 nr_irqs:336
Console: colour dummy device 80x25
console [tty0] enabled
console [hvc0] enabled

...
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 17
registered taskstats version 1
XENBUS: Device with no driver:
 device/vbd/2049
XENBUS: Device with no driver: device/vbd/2064
XENBUS: Device with no driver: device/vbd/2080
XENBUS: Device with no driver: device/vbd/2096
XENBUS: Device with no driver: device/vbd/2112
XENBUS: Device with no driver: device/vif/0
XENBUS: Device with no driver: device/console/0
drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
Initalizing network drop monitor service
Freeing unused kernel memory: 1232k freed
Write protecting the kernel read-only data: 10240k
Freeing unused kernel memory: 1112k freed
Freeing unused kernel memory: 1796k freed
dracut: dracut-004-33.2.el6_0
dracut: rd_NO_LUKS: removing cryptoluks activation
dracut: rd_NO_LVM: removing LVM activation
device-mapper: uevent: version 1.0.3
device-mapper: ioctl: 4.20.6-ioctl (2011-02-02) initialised: dm-devel@xxxxxxxxxx
udev: starting version 147
dracut: Starting plymouth daemon
dracut: rd_NO_DM: removing DM RAID
 activation
dracut: rd_NO_MD: removing MD RAID activation
xlblk_init: register_blkdev major: 202 
blkfront: xvde1: barriers disabled
blkfront: xvdf: barriers disabled
 xvdf:
 unknown partition table
blkfront: xvdg: barriers disabled
 xvdg: unknown partition table
blkfront: xvdh: barriers disabled
 xvdh: unknown partition table
blkfront: xvdi: barriers disabled
 xvdi: unknown partition table

Boot has failed, sleeping forever.





________________________________
 From: Robinson Tiemuqinke <hahaha_30k@xxxxxxxxx>
To: Johnny Hughes <johnny@xxxxxxxxxx> 
Cc: CentOS mailing list <centos@xxxxxxxxxx> 
Sent: Wednesday, November 23, 2011 10:48 AM
Subject: Re:  Any ideas?? -- Re: EC2 compatible kernel for centos 6?
 
Hi Johnny,

 Thanks a lot. I'll upgrade kernel to the cr repository, and give it a try now.

--Guolin


________________________________
From: Johnny Hughes <johnny@xxxxxxxxxx>
To: centos@xxxxxxxxxx 
Sent: Wednesday, November 23, 2011 9:55 AM
Subject: Re:  Any ideas?? -- Re: EC2 compatible kernel for centos 6?

On 11/23/2011 11:40 AM, Robinson Tiemuqinke wrote:
> I tried several ways but still no help. The following are the output (stock Centos 6 2.6.32-71.29.1.el6.x86_64 kernel), grub works fine and it located kernel and initial ramdisk. but kernel booting faied at the very beginning...
> 
> Any suggestions are more than appreciated.
> 
> 
> --------------------------------------------------
> 
>
 2011-11-23T17:19:21+0000
> Xen Minimal OS!
>   start_info: 0x1890000(VA)
>     nr_pages: 0x1e0000
>   shared_inf: 0xb2cea000(MA)
>      pt_base: 0x1893000(VA)
> nr_pt_frames: 0x11
>     mfn_list: 0x990000(VA)
>    mod_start: 0x0(VA)
>      mod_len: 0
>        flags: 0x0
>     cmd_line: root=/dev/sda1 ro 4
>   stack:      0x94f860-0x96f860
> MM: Init
>       _text: 0x0(VA)
>      _etext: 0x6000d(VA)
>    _erodata: 0x78000(VA)
>      _edata: 0x80b00(VA)
> stack start: 0x94f860(VA)
>        _end: 0x98fe68(VA)
>   start_pfn: 18a7
>     max_pfn: 1e0000
> Mapping memory range
 0x1c00000 - 0x1e0000000
> setting 0x0-0x78000 readonly
> skipped 0x1000
> MM: Initialise page allocator for 27a0000(27a0000)-1e0000000(1e0000000)
> MM: done
> Demand map pfns at 1e0001000-21e0001000.
> Heap resides at 21e0002000-41e0002000.
> Initialising timer interface
> Initialising console ... done.
> gnttab_table mapped at 0x1e0001000.
> Initialising scheduler
> Thread "Idle": pointer: 0x21e0002010, stack: 0x36f0000
> Initialising xenbus
> Thread "xenstore": pointer: 0x21e00027c0, stack: 0x3700000
> Dummy main: start_info=0x96f960
> Thread "main": pointer: 0x21e0002f70, stack: 0x3710000
> "main" "root=/dev/sda1" "ro" "4" 
> vbd 2049 is hd0
> ******************* BLKFRONT for device/vbd/2049 **********
> 
> 
> backend at /local/domain/0/backend/vbd/162/2049
> Failed to read
 /local/domain/0/backend/vbd/162/2049/feature-barrier.
> Failed to read /local/domain/0/backend/vbd/162/2049/feature-flush-cache.
> 20971520 sectors of 512 bytes
> **************************
> vbd 2064 is hd1
> ******************* BLKFRONT for device/vbd/2064 **********
> 
> 
> backend at /local/domain/0/backend/vbd/162/2064
> Failed to read /local/domain/0/backend/vbd/162/2064/feature-barrier.
> Failed to read /local/domain/0/backend/vbd/162/2064/feature-flush-cache.
> 880732160 sectors of 512 bytes
> **************************
> vbd 2080 is hd2
> ******************* BLKFRONT for device/vbd/2080 **********
> 
> 
> backend at /local/domain/0/backend/vbd/162/2080
> Failed to read /local/domain/0/backend/vbd/162/2080/feature-barrier.
> Failed to read /local/domain/0/backend/vbd/162/2080/feature-flush-cache.
> 880732160 sectors of 512
 bytes
> **************************
> [H[J
>     GNU GRUB  version 0.97  (7864320K lower / 0K upper memory)
> 
> [m[4;2H+-------------------------------------------------------------------------+[5;2H|[5;76H|[6;2H|[6;76H|[7;2H|[7;76H|[8;2H|[8;76H|[9;2H|[9;76H|[10;2H|[10;76H|[11;2H|[11;76H|[12;2H|[12;76H|[13;2H|[13;76H|[14;2H|[14;76H|[15;2H|[15;76H|[16;2H|[16;76H|[17;2H+-------------------------------------------------------------------------+[m
>     Use the ^ and v keys to select which entry is highlighted.
>     Press enter to boot the selected OS, 'e' to edit the
>     commands before booting, or 'c' for a command-line.[5;78H [m[7m[5;3H CentOS (2.6.32-71.29.1.el6.x86_64)                                      [5;75H[m[m[6;3H     
                                                                    [6;75H[m[m[7;3H                                                                         [7;75H[m[m[8;3H                                                                         [8;75H[m[m[9;3H                                               
                         
>  [9;75H[m[m[10;3H                                                                         [10;75H[m[m[11;3H                                                                         [11;75H[m[m[12;3H                                                                         [12;75H[m[m[13;3H       
                                                                  [13;75H[m[m[14;3H                                                                        
>  [14;75H[m[m[15;3H                                                                         [15;75H[m[m[16;3H                                             
                            [16;75H[m[16;78H [5;75H[23;4H The highlighted entry will be booted automatically in 5 seconds.   [5;75H[23;4H The highlighted entry will be booted automatically in 4 seconds.   [5;75H[23;4H The highlighted entry will be booted automatically in 3 seconds.   [5;75H[23;4H The highlighted entry will be booted automatically in 2 seconds.   [5;75H[23;4H The highlighted entry will be booted automatically in 1 seconds.   [5;75H[H[J  Booting 'CentOS (2.6.32-71.29.1.el6.x86_64)'
> 
> root (hd0)
>  Filesystem type is ext2fs, using whole disk
> 
> kernel /boot/vmlinuz-2.6.32-71.29.1.el6.x86_64 ro root=/dev/sda1 rhgb quiet 
> initrd /boot/initramfs-2.6.32-71.29.1.el6.x86_64.img
> 
> close blk: backend at /local/domain/0/backend/vbd/162/2049
> close blk:
 backend at /local/domain/0/backend/vbd/162/2064
> close blk: backend at /local/domain/0/backend/vbd/162/2080
> PCI: Warning: Cannot find a gap in the 32bit address range
> PCI: Unassigned devices with 32bit resource registers may break!
> PCI: Fatal: No config space access function found
> 
> Boot has failed, sleeping forever.
> 
> 
> 
> 
> 
> 
> ________________________________
>  From: Robinson Tiemuqinke <hahaha_30k@xxxxxxxxx>
> To: CentOS mailing list <centos@xxxxxxxxxx> 
> Sent: Tuesday, November 22, 2011 3:35 PM
> Subject:  EC2 compatible kernel for centos 6?
>  
> Hi all,
> 
>  I'm just scrambling to collect clues to build an Amazon AWS
 AMI based on Centos 6. the AWS PV-GRUB kernel loads my kernel but failed immediately. I'm using stock Centos 6 kernel 2.6.32-71.29.1.el6. and the kernel seems have xen? support? My questions are:
> 
>  1, Are the centos 6 stock kernels, like kernel-2.6.32-71.29.1.el6.x86_64, EC2 compatible?
> 
>  2, If the answer to the above #1 question is NO, the are the centos plus kernels, like kernel-2.6.32-71.29.1.el6.centos.plus.x86_64, EC2 compatible?
> 
>  3, If the answers to both above are 'NO', then Are there any instructions to build a EC2 kernel based on kernel source RPMs? 
> 
> 
> Any help are greatly appreciated.
> 
> --Tie

I do not use amazon services, but does this help:

https://forums.aws.amazon.com/thread.jspa?threadID=78007



_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos



[Index of Archives]     [CentOS]     [CentOS Announce]     [CentOS Development]     [CentOS ARM Devel]     [CentOS Docs]     [CentOS Virtualization]     [Carrier Grade Linux]     [Linux Media]     [Asterisk]     [DCCP]     [Netdev]     [Xorg]     [Linux USB]
  Powered by Linux