<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1">
<title></title>
</head>
<body text="#000000" bgcolor="#ffffff">
Hi Alan.<br>
<br>
I made a little more debug on this matter and I discovered that the
error is that FR doesn't like the CA:<br>
<br>
TLS trace: SSL_connect:before/connect initialization<br>
TLS trace: SSL_connect:SSLv2/v3 write client hello A<br>
TLS trace: SSL_connect:SSLv3 read server hello A<br>
TLS certificate verification: depth: 0, err: 18, subject:
/C=PT/ST=Lisbon/L=Lisbon/O=UAL/OU=CI/CN=checkpoint2/emailAddress=ci@ual.pt,
issuer:
/C=PT/ST=Lisbon/L=Lisbon/O=UAL/OU=CI/CN=checkpoint2/emailAddress=ci@ual.pt<br>
TLS certificate verification: Error, self signed certificate<br>
TLS trace: SSL3 alert write:fatal:unknown CA<br>
TLS trace: SSL_connect:error in SSLv3 read server certificate B<br>
TLS trace: SSL_connect:error in SSLv3 read server certificate B<br>
TLS: can't connect.<br>
<br>
If I use only one LDAP server (the same that gave an error) I don't
have any problem with the TLS stuff. The problem is with the
combination of the two self signed certificate (one for each LDAP
server, of course).<br>
<br>
So, isolated the master and the slave work perfectly but in combination
with TLS, only one works...<br>
<br>
I don't know what to try more because I believe I have everything well
configured. :-(<br>
<br>
Here's the most important of my debug:<br>
(without ldap_debug = 0xFFFF)<br>
...<br>
ldap: server = "checkpoint2"<br>
ldap: port = 636<br>
ldap: net_timeout = 60<br>
ldap: timeout = 60<br>
ldap: timelimit = 60<br>
ldap: identity = ""<br>
ldap: tls_mode = no<br>
ldap: start_tls = no<br>
ldap: tls_cacertfile = "/usr/local/radius/etc/raddb/1x/checkpoint2.pem"<br>
ldap: tls_cacertdir = "(null)"<br>
ldap: tls_certfile = "/usr/local/radius/etc/raddb/1x/checkpoint2.pem"<br>
ldap: tls_keyfile = "/usr/local/radius/etc/raddb/1x/checkpoint2.pem"<br>
ldap: tls_randfile = "(null)"<br>
ldap: tls_require_cert = "allow"<br>
ldap: password = ""<br>
...<br>
Module: Instantiated ldap (ldapmaster)<br>
ldap: server = "checkpoint"<br>
ldap: port = 636<br>
ldap: net_timeout = 60<br>
ldap: timeout = 60<br>
ldap: timelimit = 60<br>
ldap: identity = ""<br>
ldap: tls_mode = no<br>
ldap: start_tls = no<br>
ldap: tls_cacertfile = "/usr/local/radius/etc/raddb/1x/checkpoint.pem"<br>
ldap: tls_cacertdir = "(null)"<br>
ldap: tls_certfile = "/usr/local/radius/etc/raddb/1x/checkpoint.pem"<br>
ldap: tls_keyfile = "/usr/local/radius/etc/raddb/1x/checkpoint.pem"<br>
ldap: tls_randfile = "(null)"<br>
ldap: tls_require_cert = "allow"<br>
ldap: password = ""<br>
...<br>
Module: Instantiated ldap (ldapslave)<br>
...<br>
radius_xlat: '(<a class="moz-txt-link-abbreviated" href="mailto:mail=ei20020280@students.ual.pt">mail=ei20020280@students.ual.pt</a>)'<br>
radius_xlat: 'ou=users,dc=ual,dc=pt'<br>
rlm_ldap: ldap_get_conn: Checking Id: 0<br>
rlm_ldap: ldap_get_conn: Got Id: 0<br>
rlm_ldap: attempting LDAP reconnection<br>
rlm_ldap: (re)connect to checkpoint:636, authentication 0<br>
rlm_ldap: setting TLS mode to 1<br>
rlm_ldap: setting TLS CACert File to
/usr/local/radius/etc/raddb/1x/checkpoint.pem<br>
rlm_ldap: setting TLS Cert File to
/usr/local/radius/etc/raddb/1x/checkpoint.pem<br>
rlm_ldap: setting TLS Key File to
/usr/local/radius/etc/raddb/1x/checkpoint.pem<br>
rlm_ldap: bind as / to checkpoint:636<br>
rlm_ldap: waiting for bind result ...<br>
rlm_ldap: Bind was successful<br>
...<br>
radius_xlat: '(<a class="moz-txt-link-abbreviated" href="mailto:mail=ei20010469@students.ual.pt">mail=ei20010469@students.ual.pt</a>)'<br>
radius_xlat: 'ou=users,dc=ual,dc=pt'<br>
rlm_ldap: ldap_get_conn: Checking Id: 0<br>
rlm_ldap: ldap_get_conn: Got Id: 0<br>
rlm_ldap: attempting LDAP reconnection<br>
rlm_ldap: (re)connect to checkpoint2:636, authentication 0<br>
rlm_ldap: setting TLS mode to 1<br>
rlm_ldap: setting TLS CACert File to
/usr/local/radius/etc/raddb/1x/checkpoint2.pem<br>
rlm_ldap: setting TLS Cert File to
/usr/local/radius/etc/raddb/1x/checkpoint2.pem<br>
rlm_ldap: setting TLS Key File to
/usr/local/radius/etc/raddb/1x/checkpoint2.pem<br>
rlm_ldap: bind as / to checkpoint2:636<br>
rlm_ldap: bind to checkpoint2:636 failed: Can't contact LDAP server<br>
rlm_ldap: (re)connection attempt failed<br>
rlm_ldap: search failed<br>
rlm_ldap: ldap_release_conn: Release Id: 0<br>
modcall[authorize]: module "ldapmaster" returns fail for request 5<br>
...<br>
<br>
<br>
<br>
Alan DeKok wrote:<br>
<blockquote type="cite"
cite="mid20060404162354.69AE016E14@mail.nitros9.org">
<pre wrap="">Paulo Cabrita <a class="moz-txt-link-rfc2396E" href="mailto:pjc@ual.pt"><pjc@ual.pt></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I have freeradius 1.1.0 working and I want to have a redundant/load
balancing mecanism but when I use TLS to secure the communication with
the ldaps, FR only works with one server (eg: ldapmaster). The log says
that it cannot contact the other server (eg: ldapslave). But if I use
one ldap in clear-text communication, it works perfectly, that is I have
redundant load balancing with one LDAP/TLS and another LDAP/clear. Of
course it's not what I want. :-)
</pre>
</blockquote>
<pre wrap=""><!---->
I don't see why using TLS or not would make any difference to the
load balancing.
Could you post the errors?
Alan DeKok.
-
List info/subscribe/unsubscribe? See <a class="moz-txt-link-freetext" href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Atentamente,
------------------------------------
|Paulo Cabrita, Msc |
|Director do Centro de Informática |
|da Universidade Autónoma de Lisboa|
|Tel: +351-213177635 |
|Fax: +351-213533702 |
|E-mail: <a class="moz-txt-link-abbreviated" href="mailto:pjc@ual.pt">pjc@ual.pt</a> |
------------------------------------
</pre>
</body>
</html>