https://github.com/lldap/lldap logo
Powered by
przekichane - hey, just wanted a quick confirma...
# troubleshooting
p
hey, just wanted a quick confirmation - seems like Zabbix is using incorrect certs? 
ldapsearch
on the host itself works just fine, selinux is disabled, but when im trying to bind from Zabbix i can see the following message in 
lldap
logs:
Copy code
lldap-1  | 2024-10-04T12:02:14.211415550+00:00  DEBUG    🐛 [debug]: decided upon suite TLS13_AES_256_GCM_SHA384 | log.target: "rustls::server::hs" | log.module_path: "rustls::server::hs" | log.file: "/__w/lldap/lldap/${GITHUB_WORKSPACE}/.cargo/registry/src/index.crates.io-6f17d22bba15001f/rustls-0.20.8/src/server/hs.rs" | log.line: 382
lldap-1  | 2024-10-04T12:02:14.216196017+00:00  WARN     🚧 [warn]: Sending fatal alert BadRecordMac | log.target: "rustls::conn" | log.module_path: "rustls::conn" | log.file: "/__w/lldap/lldap/${GITHUB_WORKSPACE}/.cargo/registry/src/index.crates.io-6f17d22bba15001f/rustls-0.20.8/src/conn.rs" | log.line: 1332
lldap-1  | 2024-10-04T12:02:14.216257513+00:00  ERROR    🚨 [error]: [LDAPS] Service Error: cannot decrypt peer's message
The error im getting on Zabbix is simply 
Cannot bind to LDAP server.
mhm looks like i fucked up importing CA actually, uh
oh also yes - works over ldap, just not ldaps
n
It could be simply that their certificate is old/unsecure. Rustls (our TLS library) is rather opinionated on what it supports, forcing you to be secure
Yeah, certificate issue
p
yeah i just wasn't sure where the issue is exactly, but looks like importing only 
crt
is not enough for LDAPS to work?
yeah okay i thought it was an error from the other node (which doesn't have certs yet) but it's from the primary one
Copy code
TLS certificate verification: depth: 0, err: 20, subject: xxxxx
TLS certificate verification: Error, unable to get local issuer certificate
TLS trace: SSL3 alert write:fatal:unknown CA
TLS trace: SSL_connect:error in error
TLS: can't connect: error:0A000086:SSL routines::certificate verify failed (unable to get local issuer certificate).
n
It might be that the certificate uses an older/unsecure algorithm that's not supported by rustls
p
im actually generating a key the same way as in pam example: https://github.com/lldap/lldap/tree/main/example_configs/pam 
openssl req -x509 -nodes -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 36500 -nodes -subj "/CN=lldap.example.net" -addext "subjectAltName = DNS:lldap.example.net"
n
Hmm, that should be okay then
Then sorry, I'm not sure what's going on 😕
p
yep, that was my bad, missing CA key in systems trust
ldapsearch now works just fine
and so does ldaps in zabbix
thanks for your time anyways!
PreviousNext
Powered by