Re: mandating SSL-only connections

[Richard Megginson <rmeggins@xxxxxxxxxx>]

the openldap ldapsearch -Z does startTLS, which tries to startup a 
secure connection using the non-secure port - basically, so you can have 
ldap listen only to 389 and have SSL/TLS on that port. So then you may 
ask "Ok, that's fine, but how do I disable non-secure connections on 
389?" I'm not sure how you can do that at the connection level, but at 
the entry level you can set ACIs to allow access only if using SSL/TLS.

Susan wrote:

> Hi, everybody.
>
> I turned ssl on the server and it seemed to be working OK, I was getting replies with
> ldapsearch -x -ZZ. (access log saying startTLS, aes256 SSL), tcpdump showing encrypted
> traffic (on port 389 tho, not 636 but OK) 
>
> However, ldapsearch -x was also working, transmitting in clear text (as seen on tcpdump).
> I went ahead and set the nsslapd-port to 0:
>
> [05/Jan/2006:11:50:59 -0500] - Information: Non-Secure Port Disabled, server only
> contactable via secure port
> [05/Jan/2006:11:50:59 -0500] - Fedora-Directory/1.0.1 B2005.342.161 starting up
> [05/Jan/2006:11:50:59 -0500] - Listening on All Interfaces port 636 for LDAPS requests
>
> OK, good.  Now, however, ldapsearch -x -ZZ doesn't work anymore:
>
> $>ldapsearch -x -ZZ
> ldap_start_tls: Can't contact LDAP server (-1)
>
> And ldapsearch -x -ZZ -p 636 -h cnyldap01 just hangs.. I get nothing back.
>
> What am I doing wrong???
>
>
> 		
> __________________________________________ 
> Yahoo! DSL – Something to write home about. 
> Just $16.99/mo. or less. 
> dsl.yahoo.com 
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users@xxxxxxxxxx
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

--
Fedora-directory-users mailing list
Fedora-directory-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-directory-users