Autofs + LDAP + STARTTLS

Autofs + LDAP + STARTTLS

[Krishnakumar B]

Hi,

Is there any configuration option that I can use to make autofs execute a
STARTTLS request before it tries to search the LDAP directory?  I have
enabled searching the RootDSE in my access control list.  So it should be
possible for a DUA to get information about

supportedExtension: 1.3.6.1.4.1.1466.20037

and then STARTTLS.  But I am unable to get
/usr/lib/autofs/autofs-ldap-auto-master to talk to my LDAP server at all if
I enable

security ssf=1

in /etc/openldap/slapd.conf (openldap-2.2.13, RHEL 3, autofs-4.1.3-47).  Is
this a known problem?  Is there some configuration setting, patch or fixed
version of autofs that supports STARTTLS?

-kitty.

-- 
Krishnakumar B <kitty at dre dot vanderbilt dot edu>
Institute for Software Integrated Systems, Dept. of EECS, Vanderbilt University

Re: Autofs + LDAP + STARTTLS

[elijah wright]

haven't tinkered with it.  we do our automounts here via a script that 
talks to LDAP (via ssl, of course) and returns the appropriate mountpoint 
for a given user.  that might be an easier strategy for you.....




On Mon, 31 Jan 2005, Krishnakumar B wrote:

> Date: Mon, 31 Jan 2005 13:34:50 -0600
> From: Krishnakumar B <kitty@dre.vanderbilt.edu>
> To: autofs@linux.kernel.org
> Subject: [autofs] Autofs + LDAP + STARTTLS
> 
> Hi,
>
> Is there any configuration option that I can use to make autofs execute a
> STARTTLS request before it tries to search the LDAP directory?  I have
> enabled searching the RootDSE in my access control list.  So it should be
> possible for a DUA to get information about
>
> supportedExtension: 1.3.6.1.4.1.1466.20037
>
> and then STARTTLS.  But I am unable to get
> /usr/lib/autofs/autofs-ldap-auto-master to talk to my LDAP server at all if
> I enable
>
> security ssf=1
>
> in /etc/openldap/slapd.conf (openldap-2.2.13, RHEL 3, autofs-4.1.3-47).  Is
> this a known problem?  Is there some configuration setting, patch or fixed
> version of autofs that supports STARTTLS?
>
> -kitty.
>
>

Re: Autofs + LDAP + STARTTLS

[jehan.procaccia]

Krishnakumar B wrote:

>Hi,
>
>Is there any configuration option that I can use to make autofs execute a
>STARTTLS request before it tries to search the LDAP directory?  I have
>enabled searching the RootDSE in my access control list.  So it should be
>possible for a DUA to get information about
>
>supportedExtension: 1.3.6.1.4.1.1466.20037
>
>and then STARTTLS.  But I am unable to get
>/usr/lib/autofs/autofs-ldap-auto-master to talk to my LDAP server at all if
>I enable
>
>security ssf=1
>
>in /etc/openldap/slapd.conf (openldap-2.2.13, RHEL 3, autofs-4.1.3-47).  Is
>this a known problem?  Is there some configuration setting, patch or fixed
>version of autofs that supports STARTTLS?
>
>-kitty.
>
>  
>
I didn't tried it (autofs with TLS) but I know that autofs reads ldap 
configuration in /etc/openldap/ldap.conf on redhat config! not 
/etc/ldap.conf , did you put a TLS_CACERT directive in 
/etc/openldap/ldap.conf ?

Re: Autofs + LDAP + STARTTLS

[Krishnakumar B]

On Monday, 31 January 2005, jehan.procaccia wrote:
> Krishnakumar B wrote:
>

[...]

> I didn't tried it (autofs with TLS) but I know that autofs reads ldap 
> configuration in /etc/openldap/ldap.conf on redhat config! not 
> /etc/ldap.conf , did you put a TLS_CACERT directive in 
> /etc/openldap/ldap.conf ?

Here's what I have in /etc/openldap/ldap.conf:

BASE dc=dre,dc=vanderbilt,dc=edu
HOST ldap.dre.vanderbilt.edu
TLS_CERT        /usr/share/ssl/certs/valhalla.crt
TLS_KEY         /usr/share/ssl/certs/valhalla.pem
TLS_CACERT      /usr/share/ssl/certs/DRE-CA-CERT
TLS_REQCERT     demand

And it works:

[root@valhalla root]# ldapsearch -LLL -ZZ -x -s base -b "" "(objectClass=*)" +
dn:
structuralObjectClass: OpenLDAProotDSE
namingContexts: dc=dre,dc=vanderbilt,dc=edu
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 1.3.6.1.4.1.4203.1.10.1
supportedControl: 1.2.840.113556.1.4.1413
supportedControl: 1.2.840.113556.1.4.1339
supportedControl: 1.2.840.113556.1.4.319
supportedControl: 1.2.826.0.1.334810.2.3
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedFeatures: 1.3.6.1.4.1.4203.1.5.1
supportedFeatures: 1.3.6.1.4.1.4203.1.5.2
supportedFeatures: 1.3.6.1.4.1.4203.1.5.3
supportedFeatures: 1.3.6.1.4.1.4203.1.5.4
supportedFeatures: 1.3.6.1.4.1.4203.1.5.5
supportedLDAPVersion: 3
supportedSASLMechanisms: PLAIN
supportedSASLMechanisms: LOGIN
supportedSASLMechanisms: GSSAPI
supportedSASLMechanisms: DIGEST-MD5
supportedSASLMechanisms: CRAM-MD5
subschemaSubentry: cn=Subschema

[root@valhalla root]#

-kitty.

-- 
Krishnakumar B <kitty at dre dot vanderbilt dot edu>
Institute for Software Integrated Systems, Dept. of EECS, Vanderbilt University

Re: Autofs + LDAP + STARTTLS

[Ian Kent]

On Mon, 31 Jan 2005, Krishnakumar B wrote:

> Hi,
> 
> Is there any configuration option that I can use to make autofs execute a
> STARTTLS request before it tries to search the LDAP directory?  I have
> enabled searching the RootDSE in my access control list.  So it should be
> possible for a DUA to get information about

No.

There is no code to do STARTTLS in autofs atm.

Ian