[Samba] Samba, LDAP und TLS

Fri Jun 4 13:47:38 GMT 2004

hey !

Then, i managed to do samba+ldap+tls but I have no client certificate..
maybe it's will help you...
I use samba 3.0.2a with openldap 2.1.23 on debian woody

my /etc/ld.so.conf
$ cat /etc/ld.so.conf
/usr/X11R6/lib
/usr/local/openldap/lib
/usr/local/openssl/lib
# end file#

I had a very big problem.. I had a old ldap library in /usR/lib. so ldap 
compilation find this one only and not the good library which is 
in/usr/local/openldap/lib :)
so I add /usr/local/openldap/lib and /usr/local/openssl/lib in my ld.so.conf

$ ldconfig
to reload librairies

$ export CPPFLAGS =  « -I/usr/local/openldap/include 
–I/usr/local/openssl/include » LDFLAGS=  “-L/usr/local/openldap/lib 
–L/usr/local/openldap/lib”
$ ./configure –with-ldap –prefix=/usr/local/samba –enable-shared
$ make
$ ldd /bin/smbd
good libssl and libcrypto must be here!!!!!
$ make install

in my smb.conf i just add :
ldap ssl = start tls

restart samba

then some tests :
terminal 1 :
$ /usr/local/openldap/libexec/slapd –h ‘ldap://svrldap.tzm.fr:389’ –d127
enter the phras pass :

terminal 2 :
$ ssldump –i lo ‘host svrldap.tzm.fr and port 389’

terminal 3 :
$tethereal –i lo ‘host svrldap.tzm.fr and port 389’

try to connect on Windows 98 (I dont use Xp) with my ldap-samba user
you must see some " tls read" on the terminal 1

something like this on terminal 2:
[its just an extract]
New TCP connection #1: svrldap.tzm.fr(32790) <-> svrldap.tzm.fr(389)
1 1  0.0114 (0.0114)  C>S SSLv2 compatible client hello
  Version 3.1
  cipher suites
  Unknown value 0x35
  TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
1 2  0.0136 (0.0022)  S>C  Handshake
      ServerHello
        Version 3.1
        session_id[32]=
          16 5d 80 db ac 80 31 54 b7 1b f0 31 9b 8d f1 10
        cipherSuite         Unknown value 0x35
        compressionMethod                   NULL
1 3  0.0136 (0.0000)  S>C  Handshake
      Certificate
1 4  0.0136 (0.0000)  S>C  Handshake
      ServerHelloDone
1 5  0.0181 (0.0044)  C>S  Handshake
      ClientKeyExchange
1 6  0.0181 (0.0000)  C>S  ChangeCipherSpec
1 7  0.0181 (0.0000)  C>S  Handshake
1 8  0.0262 (0.0080)  S>C  ChangeCipherSpec
1 9  0.0262 (0.0000)  S>C  Handshake
1 10 0.0272 (0.0010)  C>S  application_data
1 12 0.0296 (0.0024)  S>C  application_data

and something like this on terminal 3 :

0.000000 svrldap.tzm.fr -> svrldap.tzm.fr TCP 32785 > ldap [SYN] 
Seq=1477336127 Ack=0 Win=32767 Len=0
  0.000045 svrldap.tzm.fr -> svrldap.tzm.fr TCP ldap > 32785 [SYN, ACK] 
Seq=1478002505 Ack=1477336128 Win=32767 Len=0
  0.000075 svrldap.tzm.fr -> svrldap.tzm.fr TCP 32785 > ldap [ACK] 
Seq=1477336128 Ack=1478002506 Win=32767 Len=0
  0.003345 svrldap.tzm.fr -> svrldap.tzm.fr LDAP MsgId=1 MsgType=Bind 
Request
  0.005050 svrldap.tzm.fr -> svrldap.tzm.fr LDAP MsgId=1 MsgType=Bind Result
  0.005083 svrldap.tzm.fr -> svrldap.tzm.fr TCP 32785 > ldap [ACK] 
Seq=1477336166 Ack=1478002520 Win=32767 Len=0
  0.006036 svrldap.tzm.fr -> svrldap.tzm.fr LDAP MsgId=2 MsgType=Search 
Request
  0.009912 svrldap.tzm.fr -> svrldap.tzm.fr LDAP MsgId=2 MsgType=Search 
Entry
  0.010997 svrldap.tzm.fr -> svrldap.tzm.fr LDAP MsgId=2 MsgType=Search 
Result
  0.030515 svrldap.tzm.fr -> svrldap.tzm.fr TCP 32786 > ldap [ACK] 
Seq=1472687491 Ack=1464059373 Win=32767 Len=0
  0.032474 svrldap.tzm.fr -> svrldap.tzm.fr LDAP MsgId=1 MsgType=Extended 
Request
  0.032516 svrldap.tzm.fr -> svrldap.tzm.fr TCP ldap > 32786 [ACK] 
Seq=1464059373 Ack=1472687522 Win=32767 Len=0
  0.033563 svrldap.tzm.fr -> svrldap.tzm.fr LDAP MsgId=1 MsgType=Unknown 
message type (24)

hope it's help :D
Gabrielle

>From: El-nino <el-nino at gmx.li>
>Reply-To: el-nino at gmx.li
>To: <samba at lists.samba.org>
>Subject: [Samba] Samba, LDAP und TLS
>Date: Fri, 4 Jun 2004 15:02:34 +0200
>
>Hi List ;-)
>I consider my question to be rather simple one ... nevertheless I could not
>find an answer to it up to now.
>I have an OpenLDAP-server which is the user-db for an samba3-server. I want 
>to
>use TLS for secure communication, so I created a ca for this as well as
>keys/certificates for my LDAP and samba-server. Informing the LDAP-server
>about its certificate/key is easy ... but how do I let samba know about its
>key and certificate? As far as I can see, samba doesn't use the
>client-configuration in ldap.conf and therefore cannot know about the
>key/cert defined there.
>So the question is: Is samba capable of talking to the LDAP-server using a
>client-certificate?
>Hope somebody knows the answer since I am currently runnig out of ideas ;-)
>
>Thilo
>--
>To unsubscribe from this list go to the following URL and read the
>instructions:  http://lists.samba.org/mailman/listinfo/samba

_________________________________________________________________
Hotmail : un compte GRATUIT qui vous suit partout et tout le temps ! 
http://g.msn.fr/FR1000/9493