[sudo-users] compile sudo-1.8.9p4 on AIX7 with LDAP support

[ralph.meier at merckgroup.com]

Great! I added lines with tls_key and tls_keypw and it's working now.
But i had to add it to /etc/security/ldap/ldap.cfg as configured during
compilation. It completely ignores /etc/ldap.conf. 

Thanks
- Ralph



From:   "Todd C. Miller" <Todd.Miller at courtesan.com>
To:     ralph.meier at merckgroup.com, 
Cc:     sudo-users at sudo.ws
Date:   27.01.2014 17:20
Subject:        Re: [sudo-users] compile sudo-1.8.9p4 on AIX7 with LDAP 
support



On Mon, 27 Jan 2014 12:13:46 +0100, ralph.meier at merckgroup.com wrote:

> Thank you very much. The patch worked for me and sudo runs fine.
> But it only works without ssl. Switching to ssl results in this error:
> 
> sudo: ldap_sasl_bind_s(): Can't contact LDAP server
> sudo: no valid sudoers sources found, quitting
> sudo: unable to initialize policy plugin
> 
> The sudo section in /etc/security/ldap/ldap.cfg looks like this:
> 
> URI ldaps://ldap01.sample.de ldaps://ldap02.sample.de
> binddn cn=anonymous,dc=sample,dc=com
> sudoers_base ou=sudoers,dc=sample,dc=com
> ssl on
> TLS_CHECKPEER   no 

Sudo does not read /etc/security/ldap/ldap.cfg so you'll need to
create an /etc/ldap.conf file for it that contains those lines.
Unfortunately, the TLS_CHECKPEER setting is not supported using the
IBM ldap libraries so you will need to set TLS_KEY to a key database
that contains the certificate of the server.

In the sudoers.ldap manual, the parts that refer to the Tivoli LDAP
library also apply to IBM ldap (which is the same thing).
 
 - todd




This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith.

Click http://www.merckgroup.com/disclaimer to access the German, French, Spanish and Portuguese versions of this disclaimer.