![ldapmodify 无法实施 TLS 证书](https://linux22.com/image/756429/ldapmodify%20%E6%97%A0%E6%B3%95%E5%AE%9E%E6%96%BD%20TLS%20%E8%AF%81%E4%B9%A6.png)
我可能忽略了一个拼写错误,但我找不到它。
~$ /usr/bin/ldapmodify -H ldapi:// -Y EXTERNAL -f /tmp/certs.ldif
SASL/EXTERNAL authentication started
SASL username:
gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)
~$ cat /tmp/certs.ldif
dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/ldap.crt
grep -R olcTLS /etc/openldap/slapd.d
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCACertificatePa th: /etc/openldap/certs
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCertificateFile: "OpenLDAP Server"
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCertificateKeyFile: /etc/openldap/certs/password
ls -la /etc/openldap/certs/ldap.crt
-rw-r--r--. 1 root root 2282 Aug 20 17:42 /etc/openldap/certs/ldap.crt
答案1
更改文件夹所有权后,ldapmodify 能够成功。我不太清楚为什么,因为我确定其他能够读取和执行文件夹,并且证书和密钥可被读取其他也一样。
~$ sudo chown ldap:ldap ./certs/ ./private/ ./cacerts/
~$ sudo chown -R ldap:ldap ./private/ ./cacerts/
~$ ls -la
total 24
drwxr-xr-x. 7 root root 122 Aug 20 17:42 .
drwxr-xr-x. 78 root root 8192 Aug 20 18:07 ..
drwxr-xr-x. 2 ldap ldap 20 Aug 20 17:42 cacerts
drwxr-xr-x. 2 ldap ldap 106 Aug 20 17:42 certs
-rw-r--r--. 1 root root 121 Jan 29 2019 check_password.conf
-rw-r--r--. 1 root root 363 Jan 29 2019 ldap.conf
drwxr-xr-x. 2 ldap ldap 22 Aug 20 17:42 private
drwxr-xr-x. 2 root root 4096 Aug 20 17:42 schema
drwxr-x---. 3 ldap ldap 45 Aug 20 17:42 slapd.d
~$ /usr/bin/ldapmodify -Y EXTERNAL -H ldapi:// -f /tmp/certs.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
~$ grep -R olcTLS /etc/openldap/slapd.d
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCACertificatePath: /etc/openldap/certs
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCertificateKeyFile: /etc/openldap/private/ldap.key
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCertificateFile: /etc/openldap/certs/ldap.crt
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCACertificateFile: /etc/openldap/cacerts/ca.crt