[From nobody Wed Nov 4 16:00:04 2026 Received: (at maintonly) by bugs.debian.org; 31 Jan 2008 03:35:28 +0000 X-Spam-Checker-Version: SpamAssassin 3.1.4-bugs.debian.org_2005_01_02 (2006-07-26) on rietz.debian.org X-Spam-Level: ** X-Spam-Status: No, score=2.8 required=4.0 tests=BAYES_00,CNSITESPRON, DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_HOTMAIL_RCVD,FOURLA, HAS_PACKAGE,HTML_20_30,HTML_MESSAGE,MONEY,STOCKLIKE autolearn=no version=3.1.4-bugs.debian.org_2005_01_02 Return-path: <ratness@hotmail.com> Received: from bay0-omc3-s24.bay0.hotmail.com ([65.54.246.224]) by rietz.debian.org with esmtp (Exim 4.63) (envelope-from <ratness@hotmail.com>) id 1JKQD2-0003qR-6n for maintonly@bugs.debian.org; Thu, 31 Jan 2008 03:35:28 +0000 Received: from BAY101-W22 ([64.4.56.122]) by bay0-omc3-s24.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Wed, 30 Jan 2008 19:35:22 -0800 Message-ID: <BAY101-W22EDDB7D605066E03DED4BA3370@phx.gbl> Content-Type: multipart/alternative; boundary="_567d5895-91e2-4aa6-b26c-5dd2d8049a9c_" X-Originating-IP: [71.65.249.65] From: Greg Cox <ratness@hotmail.com> To: <maintonly@bugs.debian.org> Subject: check_ldap with starttls requires hostname to match cert name Date: Thu, 31 Jan 2008 03:35:22 +0000 Importance: Normal MIME-Version: 1.0 X-OriginalArrivalTime: 31 Jan 2008 03:35:22.0791 (UTC) FILETIME=[4F70AB70:01C863BA] Delivered-To: maintonly@bugs.debian.org --_567d5895-91e2-4aa6-b26c-5dd2d8049a9c_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Package: nagios-plugins-standard Version: 1.4.10-1 Severity: wishlist This is probably something to kick upstream. Serverside: slapd 2.4.7-3 with TLS (not ldaps) enabled. It's running on a = VM with a hostname of 'utilserver.domain.org', and its SSL cert has a CN of= 'utilserver', since usually only internal users interact with it. $ /usr/lib/nagios/plugins/check_ldap -T -H utilserver -b `grep BASE /etc/ld= ap/ldap.conf| awk '{print $2}'` LDAP OK - 0.041 seconds response time|time=3D0.040605s;;;0.000000 $ host utilserver utilserver.domain.org has address 192.168.20.20 $ /usr/lib/nagios/plugins/check_ldap -T -H 192.168.20.20 -b `grep BASE /etc= /ldap/ldap.conf| awk '{print $2}'` =0A= Could not init startTLS at port 389! =0A= $ /usr/lib/nagios/plugins/check_ldap -T -H utilserver.domain.org -b `grep B= ASE /etc/ldap/ldap.conf| awk '{print $2}'` =0A= Could not init startTLS at port 389! =0A= It appears (though I haven't confirmed since my C-fu is weak) that the -T f= lag co-opts the hostname as specified in the -H and uses that in its TLS ha= ndshake. But that overload is not always good: my nagios checks, which use= the FQDN, fail. Suggestion: -T is currently a boolean flag. How about -T [optional hostname for certif= icate handshake if -H isn't good enough]? I can't think of anything else y= ou might want after -T, myself. Thanks! _________________________________________________________________ Connect and share in new ways with Windows Live. http://www.windowslive.com/share.html?ocid=3DTXT_TAGHM_Wave2_sharelife_0120= 08= --_567d5895-91e2-4aa6-b26c-5dd2d8049a9c_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html> <head> <style> .hmmessage P { margin:0px; padding:0px } body.hmmessage { FONT-SIZE: 10pt; FONT-FAMILY:Tahoma } </style> </head> <body class=3D'hmmessage'><div style=3D"text-align: left;">Package: nagios-= plugins-standard<br>Version: 1.4.10-1<br>Severity: wishlist<br><br>This is = probably something to kick upstream.<br><br>Serverside: slapd 2.4.7-3 with = TLS (not ldaps) enabled.  It's running on a VM with a hostname of 'uti= lserver.domain.org', and its SSL cert has a CN of 'utilserver', since usual= ly only internal users interact with it.<br><br>$ /usr/lib/nagios/plugins/c= heck_ldap -T -H utilserver -b `grep BASE /etc/ldap/ldap.conf| awk '{print $= 2}'`<br>LDAP OK - 0.041 seconds response time|time=3D0.040605s;;;0.000000<b= r>$ host utilserver<br>utilserver.domain.org has address 192.168.20.20<br>$= /usr/lib/nagios/plugins/check_ldap -T -H 192.168.20.20 -b `grep BASE /etc/= ldap/ldap.conf| awk '{print $2}'`<br>=0A= Could not init startTLS at port 389!<br>=0A= $ /usr/lib/nagios/plugins/check_ldap -T -H utilserver.domain.org -b `grep B= ASE /etc/ldap/ldap.conf| awk '{print $2}'`<br>=0A= Could not init startTLS at port 389!<br>=0A= <br>It appears (though I haven't confirmed since my C-fu is weak) that the = -T flag co-opts the hostname as specified in the -H and uses that in its TL= S handshake.  But that overload is not always good: my nagios checks, = which use the FQDN, fail.<br><br>Suggestion:<br>-T is currently a boolean f= lag.  How about -T [optional hostname for certificate handshake if -H = isn't good enough]?  I can't think of anything else you might want aft= er -T, myself.<br><br>Thanks!<br></div><br /><hr />Connect and share in new= ways with Windows Live. <a href=3D'http://www.windowslive.com/share.html?o= cid=3DTXT_TAGHM_Wave2_sharelife_012008' target=3D'_new'>Get it now!</a></bo= dy> </html>= --_567d5895-91e2-4aa6-b26c-5dd2d8049a9c_-- ]