[SSSD] sssd/ssh authentication problem

Stephen Gallagher sgallagh at redhat.com
Tue Apr 2 19:23:48 UTC 2013


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue 02 Apr 2013 02:40:45 PM EDT, Wes Modes wrote:
>> See options ldap_tls_cacert, ldap_tls_cacertdir etc in man
>> sssd-ldap.
> 
> Oh no, that's bad news for me, as I never could get TLS working on
> my OpenLDAP server!
> 

Based on the error you're seeing there, it sounds like TLS *is*
working, but you don't have a proper trust relationship. Most likely,
this means the server certificate is self-signed. There are two ways
to solve this: the correct way and the easy way.

The correct way:
Get a copy of the public key for the self-signed server certificate
and drop it on the client machine(s) then point the ldap_cacert at the
file.

The easy way:
Set the option 'ldap_tls_reqcert = allow' in the domain section of
sssd.conf. This will tell SSSD to blindly accept the certificate and
use it for encryption. This will provide you with encryption
protecting your authentications, but unlike the correct way it will
leave you open to a man-in-the-middle attack (if someone managed to
get you to connect to a different LDAP server, the client would
blindly trust it and send the password along.


The reason we do not allow non-TLS/SSL connections for authentication
is because the LDAP protocol requires that the passwords are sent in
plaintext within the protocol message, making it absolutely trivial to
steal passwords with a simple network sniffer like tcpdump or
wireshark/ethereal.

I'd suggest trying out the easy way above first so you can finish
testing out SSSD, then go back and implement the correct way once
you're comfortable with the rest of the system.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlFbMEQACgkQeiVVYja6o6MotACfcnqBg59IIj9JqKXyJPwH6qnz
6sUAniOW+Sin2RjdY9BB5rcy984CVhhx
=7c2U
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list