[Samba] Weird statup probems TLS & SSL openldap and samba 3.0.23

Jose Gilberto Torres jogeedaklown at yahoo.com
Fri Jul 21 18:10:38 GMT 2006


Finally figured it out.  I have to startup nscd.  I guess nscd is 
required. 

Jose
> Hello,
> I am kind of confused with this situation.  I am attempting to build a 
> PDC using TLS/SSL with the following version of software.
>
> Samba 3.0.23
> OpenLDAP 2.3.19
> Fedora Core 5
>
> When I startup the Samba server via the "service" command (service smb 
> start) I get the following errors in my logs.
>
> Using SSL:
>
> Jul 13 09:52:34 prism smbd[23161]:   smbldap_search_suffix: Problem 
> during the LDAP search: error:14094410:SSL 
> routines:SSL3_READ_BYTES:sslv3 alert handshake failure (Time limit 
> exceeded)
> Jul 13 09:52:34 prism smbd[23161]: [2006/07/13 09:52:34, 0] 
> lib/smbldap.c:smb_ldap_start_tls(546)
> Jul 13 09:52:34 prism smbd[23161]:   Failed to issue the StartTLS 
> instruction: Can't contact LDAP server
>
> Using TLS
>
> Jul 18 10:32:09 prism smbd[7441]: [2006/07/18 10:32:09, 0] 
> lib/smbldap.c:smb_ldap_start_tls(612)
> Jul 18 10:32:09 prism smbd[7441]:   Failed to issue the StartTLS 
> instruction: Connect error
>
> But when I start up Samba issuing this command "/etc/init.d/smb start", 
> it works.  This this a bug in the "service" command.  Did I 
> mis-configured something?  Is there any thing I can try to debug this 
> problem?  I've included the configuration files for samba and ldap.  
> I've hid the actual hostname and DIT.  Thanks!
>
> /etc/openldap/ldap.conf
> **********************
> URI ldaps://yyyy.com <-
> BASE dc=xxxx,dc=xxxx,dc=com
> TLS_REQCERT demand
> TLS_CACERT /etc/openldap/ca.crt
> TLS_CERT /etc/openldap/server.crt
> TLS_KEY  /etc/openldap/server.key
>
> /etc/openldap/slap.conf
> ******************
> include         /etc/openldap/schema/core.schema
> include         /etc/openldap/schema/cosine.schema
> include         /etc/openldap/schema/inetorgperson.schema
> include         /etc/openldap/schema/nis.schema
> include         /etc/openldap/schema/samba.schema
> pidfile         /var/run/slapd/slapd.pid
> argsfile        /var/run/slapd/slapd.args
>
> database        bdb
> suffix          dc=xxxx,dc=xxxx,dc=com
> rootdn          "cn=Manager,dc=xxxx,dc=xxxx,dc=com"
> rootpw          {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> directory     /var/lib/ldap
>
> index cn                      pres,sub,eq
> index sn                      pres,sub,eq
> index uid                     pres,sub,eq
> index displayName             pres,sub,eq
> index uidNumber               eq
> index gidNumber               eq
> index objectClass          eq
> index memberUid               eq,subinitial
> index mail                 eq,subinitial
> index givenname               eq,subinitial
> index   sambaSID              eq
> index   sambaPrimaryGroupSID  eq
> index   sambaDomainName       eq
> index   default               sub
>
> #Access to read the root DSE (DSA [Directory System Agent] Specific 
> Entry)
> access to dn.base=""
>    by self write
>    by * auth
> access to attrs=userPassword,sambaLMPassword,sambaNTPassword
>         by self write
>    by anonymous auth
>    by * none
> access to *
>    by * read
>    by anonymous auth
>
> security tls=1
> TLSCACertificateFile /etc/openldap/ca.crt
> TLSCertificateFile /etc/openldap/server.crt
> TLSCertificateKeyFile /etc/openldap/server.key
> TLSVerifyClient demand
>
> /etc/ldap.conf
> ***********
> uri ldap://yyyy.com
> host yyyy.com
> port 389
> ssl start_tls
> tls_reqcert demand
> tls_checkpeer yes
> tls_cert /etc/openldap/server.crt
> tls_key /etc/openldap/server.key
> tls_cacertfile /etc/openldap/ca.crt
> base dc=xxxx,dc=xxxx,dc=com
> binddn cn=Manager,dc=xxxx,dc=xxxx,dc=com
> bindpw TTTTT
> nss_base_passwd   ou=Users,dc=xxxx,dc=xxxx,dc=com?one
> nss_base_passwd   ou=Computers,dc=xxxx,dc=xxxx,dc=com?one
> nss_base_shadow   ou=Users,dc=xxxx,dc=xxxx,dc=com?one
> nss_base_group    ou=Groups,dc=xxxx,dc=xxxx,dc=com?one
> nss_base_hosts    ou=Hosts,dc=xxxx,dc=xxxx,dc=com?one
> pam_password md5
>
> /etc/samba/smb.conf   - Just the global portion.
> ***********************************
> [global]
>         # Your Workgroup Name
>         workgroup = TEST-PURPLE
>         # Server name
>         netbios name = TEST-PURPLE
>         passdb backend = ldapsam:ldap://yyyy.com
>         username map = /etc/samba/smbusers
>         printcap name = cups
>         add user script = /usr/local/sbin/smbldap-useradd -m '%u'
>         delete user script = /usr/local/sbin/smbldap-userdel %u
>         add group script = /usr/local/sbin/smbldap-groupadd -p '%g'
>         delete group script = /usr/local/sbin/smbldap-groupdel '%g'
>         add user to group script = /usr/local/sbin/smbldap-groupmod -m 
> '%u' '%g'
>         delete user from group script = 
> /usr/local/sbin/smbldap-groupmod 
> -x '%u' '%g'
>         set primary group script = /usr/local/sbin/smbldap-usermod -g 
> '%g' '%u'
>         add machine script = /usr/local/sbin/smbldap-useradd -w '%u'
>         enable privileges = yes
> #Domain Controller setup
>         domain logons = Yes
>         os level = 44
>         preferred master = Yes
>         domain master = Yes
>         show add printer wizard = Yes
> #OpenLdap
>         ldap suffix = dc=xxxx,dc=xxxx,dc=com
>         ldap machine suffix = ou=Computers
>         ldap user suffix = ou=Users
>         ldap group suffix = ou=Groups
>         ldap idmap suffix = ou=Idmap
>         ldap admin dn = cn=Manager,dc=xxxx,dc=xxxx,dc=com
>         ldap passwd sync = Yes
>         ldap ssl = start_tls
> #        ldap ssl = on
>         idmap uid = 15000-20000
>         idmap gid = 15000-20000
>
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/listinfo/samba



More information about the samba mailing list