Bug 436536
| Summary: | can't connect to secure LDAP server for auth | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | cje |
| Component: | bugzilla | Assignee: | John Berninger <john> |
| Status: | CLOSED WONTFIX | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | 8 | CC: | mattdm, tuju |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-01-09 06:07:57 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Which version of bugzilla was this with? bugzilla-3.0.2-6.fc8 but the code's the same in bugzilla CVS. i probably shouldn't have that "verify => 'none'" in there. the key problem as i see it is that, according to http://search.cpan.org/~gbarr/perl-ldap-0.38/lib/Net/LDAP.pod#start_tls the default for ciphers is "ALL", which "permits all ciphers, even those that don't encrypt" whereas what we probably want is the default behaviour from Net::LDAPS which, according to http://search.cpan.org/~gbarr/perl-ldap/lib/Net/LDAP/Security.pod, will "by default use all the algorithms built into your copy of OpenSSL, except for ones considered to use "low" strength encryption, and those using export strength encryption" so, possibly, the change should be in perl-LDAP? my version of that is perl-LDAP-0.34-3.fc7. mind you, if we've specified something a bit stronger on our server then we'll want to override that too. i wonder why that start_tls can't auto-negotiate. *** pause to do some googling *** someone seems to have hit this problem elsewhere: http://www.dreamincode.net/forums/blog/nova_dragoon/index.php?showentry=396 FWIW pam, PHP, postfix, dovecot, evolution, ldapsearch and apache (mod_ldap) all talk to that LDAP server just fine without any cipher configuration - so fingers should probably be pointed at perl-LDAP. Hmmm. So this is probably best addressed upstream in bugzilla's own bugzilla. As an alternate workaround: can you point at ldaps (port 636) instead of using starttls? maybe, or it should be addressed to the perl-LDAP people. or we could figure out a better fix here and submit a patch upstream? John, any comment on this? for now i'm okay adding my ciphers mod each time bugzilla gets upgraded so i don't need the ldaps alternative - thanks for the suggestion though. This message is a reminder that Fedora 8 is nearing its end of life. Approximately 30 (thirty) days from now Fedora will stop maintaining and issuing updates for Fedora 8. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '8'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 8's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 8 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora please change the 'version' of this bug to the applicable version. If you are unable to change the version, please add a comment here and someone will do it for you. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping Fedora 8 changed to end-of-life (EOL) status on 2009-01-07. Fedora 8 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. Thank you for reporting this bug and we are sorry it could not be fixed. |
Description of problem: my LDAP server supports TLS for encrypted connections and demands a certain level of encryption before it will authorise. bugzilla's LDAP auth module does start_tls with defaults which doesn't force the required level of encryption. so the connection fails. i've modified the line to: my $mesg = $self->{ldap}->start_tls(verify => 'none', ciphers => 'DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC2-CBC-MD5:DHE-DSS-RC4-SHA:EXP-KRB5-RC4-MD5:EXP-KRB5-RC4-SHA:KRB5-RC4-MD5:KRB5-RC4-SHA:RC4-SHA:RC4-MD5:RC4-MD5:KRB5-DES-CBC3-MD5:KRB5-DES-CBC3-SHA:EXP1024-DHE-DSS-DES-CBC-SHA:EXP1024-DES-CBC-SHA:KRB5-DES-CBC-MD5:KRB5-DES-CBC-SHA:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:DES-CBC-MD5:EXP1024-DHE-DSS-RC4-SHA:EXP1024-RC4-SHA:EXP-KRB5-RC2-CBC-MD5:EXP-KRB5-DES-CBC-MD5:EXP-KRB5-RC2-CBC-SHA:EXP-KRB5-DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC2-CBC-MD5:EXP-RC4-MD5:EXP-RC4-MD5'); at the end of /usr/share/bugzilla/Bugzilla/Auth/Verify/LDAP.pm by copying the string of all supported encryptions from openssl. there must be a better way but this works. Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info: