[Fedora-directory-users] Unable to SSL with Windows Sync Agreement
by Groot, Mathijs de (IDT Competence Java)
I can use some help with setting up the Windows Sync.
Ill give some context first, im trying to sync user, groups and
passwords from a Windows 2003 server with Active Directory with a Red
Hat enterprise 5, Red Hat Directory Server 8.0.
It is a test environment with where I can access and configure the
But ive got some problems setting a new Windows Sync Agreement.
It comes down to the following:
I can't get an SSL connection with the a new Windows Sync Agreement,
from the Red Hat DS to the Windows AD server.
In the Windows Sync Server info screen I get the following message when
clicking on next:
"unable to contact Active Directory server, continue"
(Windows Sync Server info screen located In the Directory Server Console
-> Configuration tab -> Replication -> userRoot -> highlight the
database -> Object -> New Windows Sync Agreement -> The second screen
reads Windows Sync Server Info)
But when I uncheck the checkbox "Using encrypted SSL connection" the
connection works and the Windows AD server is reached.
So this concludes (and ive tested) that the Windows Server and domain is
reachable and the Bind DN is valid, and entered values are correct.
The SSL connection seems to be setup correctly, the checks (ldapsearch
query) described by the fedora manual outputs the correct result.
Testing your Configuration
Test to make sure you can talk SSL from Fedora Directory to AD
This is how you test to verify that the Windows side SSL is enabled
ldapsearch -Z -P <RHDS-cert8.db> -h <AD/NT Hostname> -p <AD SSL port> -D
"<sync manager user>" -w < sync manager password> -s <scope> -b "<AD
My ldapsearch query:
/usr/lib64/mozldap/dapsearch -Z -P /etc/dirsrv/slapd-<instance>/cert8.db
-h compute.domain.com -p 636 -D
"CN=Administrator,CN=Users,DC=domain,DC=com" -w <pwd> -s base -b
But strangely enough there is not network traffic at all when the SSL
connection is checked!
(when clicking on next and the message "unable to contact Active
Directory server, continue" appears)
Ive done the following actions to make to monitor it:
First I've disabled SELinux, in case that blocks something (just for
watch the tcp ip traffic with:
tcpdump -nn -p port not ssh and ip host <Red Hat IP number>
Here I can see that, when I don't use the SSL connection, there is
traffic towards my Widows AD, but when ive check the SSL option, there
is no traffic at all, nothing.
As well when I look at the iptables:
added an extra line: iptables -I OUTPUT 1 -d <Windows AD IP number> -j
watch -d iptables -L -nv
I see the same result, traffic when I don't use the SSL option and no
traffic at all when the SSL option is checked.
How can I get the message "unable to contact Active Directory server,
continue" when there is no outgoing request from my Red Hat server.
Ive made certificates at both sides (Windows and Red Hat) and exported
and imported these certificated to the other server.
Please advice on following steps I can take, what the problem can be and
how it is possible that there is no traffic at all.
Thanks in advanced.
Mathijs A. de Groot
Consultant - Software Engineer
Logica - Releasing your potential
George Hintzenweg 89
3068 AX Rotterdam
3009 AN Rotterdam
T: +31 (0) 10 253 7000
D: +31(0) 70 37 56627
E: math.de.groot(a)logica.com <mailto:email@example.com>
Logica Nederland B.V.
Registered office in Amstelveen, The Netherlands
Registration Number Chamber of Commerce: 33136004
This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.