[Fedora-directory-users] solaris 10 SSL connections

[George Holbert]

The ldapsearch command doesn't look in /var/ldap for the cert db.  It 
uses the current directory as the default cert db path.
You can run ldapsearch from /var/ldap, or give it a "-P /var/ldap" 
argument to use the cert db in /var/ldap.
Also, the -v arg might help you narrow down what's happening.

Note that the Solaris ldap_cachemgr (i.e., the ldap name service client) 
daemon DOES use /var/ldap as its default directory to find cert db files.

Also, Solaris 8 and 9 are very picky about which cert DB version they 
can use for ldap name service over SSL: it MUST be cert7.db as generated 
by earlier versions of the NSS tools.  Solaris 10 might be able to use 
cert8.db.


Susan wrote:
> Hi, all.  I've ssl enabled in FDS:
>
> # ldapsearch -D "cn=Directory Manager" -w adminpass -b "cn=encryption,cn=config"  -h cnyitlin02
> cn=*
> version: 1
> dn: cn=encryption,cn=config
> objectClass: top
> objectClass: nsEncryptionConfig
> cn: encryption
> nsSSLSessionTimeout: 0
> nsSSLClientAuth: allowed
> nsSSL2: off
> nsSSL3: on
> nsSSL3Ciphers: +rsa_rc4_128_md5,+rsa_3des_sha,+fortezza_null,-rsa_null_md5,+fo
>
> Currently, I have authenticationMethod: simple in my default profile.  I can ssh/telnet w/o
> problems, authenticating from FDS (thank you, Gary Tay!)
>
> I've been having a real hard time getting Solaris SSL to work, however.  I did the whole mozilla
> cert import thing, got the cert8.db (it's not 7), and key3.db, put them in /var/ldap
>
> However, even though this returns data:
>
> -bash-3.00# ldapsearch -b "dc=composers,dc=company,dc=com"  -h cnyitlin02 -L "objectclass=*" -p
> 636 -Z
> version: 1
> dn: dc=composers,dc=company,dc=com
> dn: cn=Directory Administrators, dc=composers,dc=company,dc=com
> dn: ou=Groups, dc=composers,dc=company,dc=com
> dn: ou=People, dc=composers,dc=company,dc=com
> dn: ou=profile,dc=composers,dc=company,dc=com
> dn: cn=proxyAgent,ou=profile,dc=composers,dc=company,dc=com
> dn: uid=test, ou=People, dc=composers,dc=company,dc=com
>
> It's not encrypted.  I can see the traffic clear text in ethereal.
>
> Any ideas what the problem is?  Has anybody gotten solaris ssl to work with FDS?
>
> Thank you.
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
>