如何克服主要问题:slapd启动时TLS初始化def ctx失败:-1

huangapple go评论68阅读模式
英文:

How to overcome main: TLS init def ctx failed: -1 for slapd startup

问题

我正在尝试在我的CentOS 7节点上设置全新的OpenLDAP,该节点上曾经有一个未完成的OpenLDAP,我使用以下命令清理了它:

systemctl stop slapd
systemctl disable slapd
yum -y remove openldap-servers openldap-clients 
rm -rf /var/lib/ldap
userdel ldap
rm -rf /etc/openldap

然后,我再次使用yum安装了OpenLDAP包:

yum install openldap openldap-servers -y
yum install openldap-clients -y

rpm -qa | grep openldap
openldap-2.4.44-25.el7_9.x86_64
openldap-servers-2.4.44-25.el7_9.x86_64
openldap-devel-2.4.44-25.el7_9.x86_64
openldap-clients-2.4.44-25.el7_9.x86_64

之后,我尝试启动slapd,但启动失败,出现以下错误:

systemctl start slapd
Job for slapd.service failed because the control process exited with error code. See "systemctl status slapd.service" and "journalctl -xe" for details.

systemctl status -l slapd.service
● slapd.service - OpenLDAP Server Daemon
   Loaded: loaded (/usr/lib/systemd/system/slapd.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Sun 2023-05-14 15:52:24 UTC; 57s ago
     Docs: man:slapd
           man:slapd-config
           man:slapd-hdb
           man:slapd-mdb
           file:///usr/share/doc/openldap-servers/guide.html
  Process: 1037 ExecStart=/usr/sbin/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS (code=exited, status=1/FAILURE)
  Process: 1022 ExecStartPre=/usr/libexec/openldap/check-config.sh (code=exited, status=0/SUCCESS)

May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com runuser[1025]: pam_unix(runuser:session): session opened for user ldap by (uid=0)
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com runuser[1025]: pam_unix(runuser:session): session closed for user ldap
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com slapd[1037]: @(#) $OpenLDAP: slapd 2.4.44 (Feb 23 2022 17:11:27) $
                                                                                mockbuild@x86-01.bsys.centos.org:/builddir/build/BUILD/openldap-2.4.44/openldap-2.4.44/servers/slapd
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com slapd[1037]: main: TLS init def ctx failed: -1
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com slapd[1037]: slapd stopped.
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com slapd[1037]: connections_destroy: nothing to destroy.
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com systemd[1]: slapd.service: control process exited, code=exited status=1
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com systemd[1]: Failed to start OpenLDAP Server Daemon.
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com systemd[1]: Unit slapd.service entered failed state.
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com systemd[1]: slapd.service failed.

以下是一些疑似与TLS相关的配置信息:

ls -l /etc/openldap/certs/
total 12
-rw-r--r--. 1 ldap ldap 1371 May 14 15:27 myCA.pem
-rw-r--r--. 1 ldap ldap 1379 May 14 15:31 OpenLDAP Server
-rw-r--r--. 1 ldap ldap 1675 May 14 15:30 password

file /etc/openldap/certs/myCA.pem /etc/openldap/certs/OpenLDAP\ Server /etc/openldap/certs/password
/etc/openldap/certs/myCA.pem:        PEM certificate
/etc/openldap/certs/OpenLDAP Server: PEM certificate
/etc/openldap/certs/password:        PEM RSA private key

grep -R olcTLS /etc/openldap/slapd.d
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCACertificatePath: /etc/openldap/certs
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCertificateFile: "OpenLDAP Server"
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCertificateKeyFile: /etc/openldap/certs/password

我怀疑之前的OpenLDAP配置可能导致TLS错误 main: TLS init def ctx failed: -1,或者 olcTLSCACertificatePath: /etc/openldap/certs 未正确选择 /etc/openldap/certs/myCA.pem

英文:

I am trying to setup a fresh OpenLDAP on my centos7 node\

cat /etc/redhat-release
CentOS Linux release 7.8.2003 (Core)

The node had a half baked OpenLDAP, that I cleaned up using the below commands

systemctl stop slapd
systemctl disable slapd
yum -y remove openldap-servers openldap-clients 
rm -rf /var/lib/ldap
userdel ldap
rm -rf /etc/openldap

Then I have installed the OpenLDAP package again using yum

yum install openldap openldap-servers -y
yum install openldap-clients -y

rpm -qa | grep openldap
openldap-2.4.44-25.el7_9.x86_64
openldap-servers-2.4.44-25.el7_9.x86_64
openldap-devel-2.4.44-25.el7_9.x86_64
openldap-clients-2.4.44-25.el7_9.x86_64

After this; I am trying to start slapd which is failing

systemctl start slapd
Job for slapd.service failed because the control process exited with error code. See "systemctl status slapd.service" and "journalctl -xe" for details.

systemctl status -l slapd.service
● slapd.service - OpenLDAP Server Daemon
   Loaded: loaded (/usr/lib/systemd/system/slapd.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Sun 2023-05-14 15:52:24 UTC; 57s ago
     Docs: man:slapd
           man:slapd-config
           man:slapd-hdb
           man:slapd-mdb
           file:///usr/share/doc/openldap-servers/guide.html
  Process: 1037 ExecStart=/usr/sbin/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS (code=exited, status=1/FAILURE)
  Process: 1022 ExecStartPre=/usr/libexec/openldap/check-config.sh (code=exited, status=0/SUCCESS)

May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com runuser[1025]: pam_unix(runuser:session): session opened for user ldap by (uid=0)
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com runuser[1025]: pam_unix(runuser:session): session closed for user ldap
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com slapd[1037]: @(#) $OpenLDAP: slapd 2.4.44 (Feb 23 2022 17:11:27) $
                                                                                mockbuild@x86-01.bsys.centos.org:/builddir/build/BUILD/openldap-2.4.44/openldap-2.4.44/servers/slapd
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com slapd[1037]: main: TLS init def ctx failed: -1
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com slapd[1037]: slapd stopped.
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com slapd[1037]: connections_destroy: nothing to destroy.
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com systemd[1]: slapd.service: control process exited, code=exited status=1
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com systemd[1]: Failed to start OpenLDAP Server Daemon.
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com systemd[1]: Unit slapd.service entered failed state.
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com systemd[1]: slapd.service failed.

Here are some suspected TLS related configs

ls -l /etc/openldap/certs/
total 12
-rw-r--r--. 1 ldap ldap 1371 May 14 15:27 myCA.pem
-rw-r--r--. 1 ldap ldap 1379 May 14 15:31 OpenLDAP Server
-rw-r--r--. 1 ldap ldap 1675 May 14 15:30 password

file /etc/openldap/certs/myCA.pem /etc/openldap/certs/OpenLDAP\ Server /etc/openldap/certs/password
/etc/openldap/certs/myCA.pem:        PEM certificate
/etc/openldap/certs/OpenLDAP Server: PEM certificate
/etc/openldap/certs/password:        PEM RSA private key

grep -R olcTLS /etc/openldap/slapd.d
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCACertificatePath: /etc/openldap/certs
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCertificateFile: "OpenLDAP Server"
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCertificateKeyFile: /etc/openldap/certs/password

I suspect that either some previously half baked OpenLDAP settings are causing the TLS error main: TLS init def ctx failed: -1; or else olcTLSCACertificatePath: /etc/openldap/certs is not picking /etc/openldap/certs/myCA.pem

答案1

得分: 0

我决定使用vi在下面的行下面进行评论,这样做虽然有效,但我不认为这是最佳方式。

/etc/openldap/slapd.d/cn=config.ldif:olcTLSCACertificatePath: /etc/openldap/certs
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCertificateFile: "OpenLDAP Server"
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCertificateKeyFile: /etc/openldap/certs/password
英文:

I decided to comment below lines using vi and it works but I do not think this is the best way to do this.

/etc/openldap/slapd.d/cn=config.ldif:olcTLSCACertificatePath: /etc/openldap/certs
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCertificateFile: "OpenLDAP Server"
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCertificateKeyFile: /etc/openldap/certs/password

huangapple
  • 本文由 发表于 2023年5月15日 00:04:20
  • 转载请务必保留本文链接:https://go.coder-hub.com/76248445.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定