[SSSD] sssd/ssh authentication problem

Wes Modes wmodes at ucsc.edu
Tue Apr 2 22:00:13 UTC 2013


On 4/2/2013 12:23 PM, Stephen Gallagher wrote:
> On Tue 02 Apr 2013 02:40:45 PM EDT, Wes Modes wrote:
> >> See options ldap_tls_cacert, ldap_tls_cacertdir etc in man
> >> sssd-ldap.
>
> > Oh no, that's bad news for me, as I never could get TLS working on
> > my OpenLDAP server!
>
>
> Based on the error you're seeing there, it sounds like TLS *is*
> working, but you don't have a proper trust relationship. Most likely,
> this means the server certificate is self-signed. There are two ways
> to solve this: the correct way and the easy way.

I've wanted my ldap server to use TLS since I set it up, but struggled
with getting it to work (and maybe also understanding just how it did work).

First I tried the easy way and was excited to find that I was able to
connect to ssh with an LDAP user.  Woot.
>
> The correct way:
> Get a copy of the public key for the self-signed server certificate
> and drop it on the client machine(s) then point the ldap_cacert at the
> file.

Next I tried the correct way.  I'm interpretting that to mean:  Get a
copy of the public key for the self-signed cert /on the LDAP server/ and
put it on the server running sssd, then point ldap_cacert in sssd.conf
to that cert, right?

Previously I was using an IPSCA-signed cert for *.mydomain.com.  But
just to simplify things and since I don't completely understand how
ssl/tls uses certs, I went back to the cert that was installed with
OpenLDAP (/etc/ssl/openldap2.4/ldap.pem) and copied it over to the sssd
server restarting both services.  After that I was able to connect.

Great. Now I can use ssh to disallow login and restrict LDAP users to sftp.

Thank you for the help.

>
> The easy way:
> Set the option 'ldap_tls_reqcert = allow' in the domain section of
> sssd.conf. This will tell SSSD to blindly accept the certificate and
> use it for encryption. This will provide you with encryption
> protecting your authentications, but unlike the correct way it will
> leave you open to a man-in-the-middle attack (if someone managed to
> get you to connect to a different LDAP server, the client would
> blindly trust it and send the password along.
>
>
> The reason we do not allow non-TLS/SSL connections for authentication
> is because the LDAP protocol requires that the passwords are sent in
> plaintext within the protocol message, making it absolutely trivial to
> steal passwords with a simple network sniffer like tcpdump or
> wireshark/ethereal.
>
> I'd suggest trying out the easy way above first so you can finish
> testing out SSSD, then go back and implement the correct way once
> you're comfortable with the rest of the system.

-- 
Wes Modes
Systems Designer, Developer, and Administrator
University Library ITS
University of California, Santa Cruz

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130402/22a496dd/attachment.html>


More information about the sssd-devel mailing list