[Fedora-directory-users] problem with SSL and load balance

[Ivan Ferreira]

You must have one certificate for each server, the problem here is the DNS
RR.

I don't like DNS load balancing because it cannot detect service failures,
for example, you have in your client configuration files:

URI             ldap://fds.mydomain.com

This works fine if both servers are up, but if one server goes down, some
clients won't be able to contact the LDAP server ramdomly.

It would be better to configure both ldap servers in the client
configuration files, and place in different order, or configure a LVS.

Cheers.




                                                                           
                                                                           
                                                                           
                                                                      Para 
                                          "General discussion list for the 
                                          Fedora Directory server          
       "Victor Hugo dos Santos"           project."                        
       <listas.vhs at gmail.com>             <fedora-directory-users at redhat.c 
       Enviado por:                       om>                              
       fedora-directory-users-b                                         cc 
       ounces at redhat.com                                                   
                                                                    Asunto 
       03/10/2007 11:20 a.m.              [Fedora-directory-users] problem 
                                          with SSL and load balance        
                                                             Clasificación 
                                         Uso Interno                       
        Por favor, responda a                                              
       "General discussion list                                            
       for the Fedora Directory                                            
           server project."                                                
       <fedora-directory-users@                                            
             redhat.com>                                                   
                                                                           
                                                                           




Hello List,

I have the same problem that Alex Aka in Apr 2006
http://www.redhat.com/archives/fedora-directory-users/2006-April/msg00022.html


I have two FDS (fds1 and fds2) in MMR

in the DNS I create this machines

fds1     IN     A     10.0.0.11
fds2     IN     A     10.0.0.12
fds      IN     A     10.0.0.11
fds      IN     A     10.0.0.12

in the clients, I configure the ldap.conf with this parameters:

BASE            dc=mydomain,dc=com
URI             ldap://fds.mydomain.com

this configuration work very,very fine !!!! exist replication between
servers and fault tolerance in the clients.. but i enable SSL in
server and in the clients (ldap.conf)


BASE            dc=mydomain,dc=com
URI             ldaps://fds.mydomain.com
TLS_CACERT      /etc/ssl/certs/cacert.org.pem
TLS_REQCERT     allow

and "no" work !!! :-( i receive this error:

ldap_bind: Can't contact LDAP server (-1)

additional info: TLS: hostname does not match CN in peer certificate

this problem, is derivate that i configured the servers with one
certificate and distinct CN for independent serves (fds1 and fds2)...

if I config one same certificate with same CN (fds) for both nodes
(fds1 and fds2).. work fine in the clients, but the replication dont
work !!! :-(

obs.: my certificates is sign in http://cacert.org

any idea or suggestion ???

thanks


--
--
Victor Hugo dos Santos
Linux Counter #224399

--
Fedora-directory-users mailing list
Fedora-directory-users at redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users


========================================================================================
AVISO LEGAL: Esta información es privada y confidencial y está dirigida
únicamente a su destinatario. Si usted no es el destinatario original de
este mensaje y por este medio pudo  acceder a dicha información por favor
elimine el mensaje. La distribución o copia de este mensaje está
estrictamente prohibida. Esta comunicación es sólo para  propósitos de
información y no debe ser considerada como propuesta, aceptación ni como
una declaración de voluntad oficial de NUCLEO S.A.  La transmisión de
e-mails no garantiza que el correo electrónico sea seguro o libre de error.
Por consiguiente, no manifestamos que esta información sea completa o
precisa.  Toda información está sujeta a alterarse sin previo aviso.

 This information is private and confidential and intended for the
recipient only. If you are not the intended recipient of this message you
are hereby notified that any review,  dissemination, distribution or
copying of this message is strictly prohibited. This communication is for
information purposes only and shall not be regarded neither as a proposal,
acceptance nor as a statement of will or official statement from NUCLEO
S.A. . Email transmission cannot be guaranteed to be secure or error-free.
Therefore,  we do not represent that this information is complete or
accurate and it should not be relied upon as such. All information is
subject to change without notice.