{"id":3635,"date":"2023-12-29T22:12:00","date_gmt":"2023-12-29T13:12:00","guid":{"rendered":"http:\/\/192.168.20.1\/?p=3635"},"modified":"2024-01-01T11:40:53","modified_gmt":"2024-01-01T02:40:53","slug":"openldap-ldaptls-and-ldaps","status":"publish","type":"post","link":"https:\/\/rlab.cavtime.net\/?p=3635","title":{"rendered":"OpenLDAP LDAP+TLS and LDAPS"},"content":{"rendered":"

Overview<\/h2>\n

OpenLDAP\u3067LDAP(389)+SSL\/TLS\u3068LDAPS\u306e\u901a\u4fe1\u3092\u78ba\u8a8d\u3068\u6bd4\u8f03\u3092\u3059\u308b\u3002<\/p>\n

Reference<\/h2>\n

Environment<\/h2>\n

LDAP Server<\/h3>\n
ctadmin@svr-ldap02:~$ slapd -V\r\n@(#) $OpenLDAP: slapd 2.5.16+dfsg-0ubuntu0.22.04.1 (Jul 31 2023 22:13:10) $\r\n\tUbuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>\r\n\r\nctadmin@svr-ldap02:~$ \r\n<\/pre>\n
LDAP Client<\/h3>\n
ctadmin@client:~$ ldapsearch -V\r\nldapsearch: @(#) $OpenLDAP: ldapsearch 2.5.16+dfsg-0ubuntu0.22.04.1 (Jul 31 2023 22:13:10) $\r\n\tUbuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>\r\n\t(LDAP library: OpenLDAP 20516)\r\nldap_sasl_interactive_bind: Can't contact LDAP server (-1)\r\nctadmin@client:~$ \r\n<\/pre>\n
LDAP(389)<\/h2>\n
Command and Result<\/h3>\n
ctadmin@client:~$ ldapsearch -H ldap:\/\/ldap.cavtime.com -D \"cn=admin,dc=cavtime,dc=com\" -b \"cn=User01,ou=people,dc=cavtime,dc=com\" -W\r\nEnter LDAP Password: \r\n# extended LDIF\r\n#\r\n# LDAPv3\r\n# base <cn=User01,ou=people,dc=cavtime,dc=com> with scope subtree\r\n# filter: (objectclass=*)\r\n# requesting: ALL\r\n#\r\n\r\n# User01, people, cavtime.com\r\ndn: cn=User01,ou=people,dc=cavtime,dc=com\r\nobjectClass: posixAccount\r\nobjectClass: inetOrgPerson\r\nobjectClass: organizationalPerson\r\nobjectClass: person\r\nloginShell: \/bin\/bash\r\nhomeDirectory: \/home\/user01\r\nuid: user01\r\ncn: User01\r\nuserPassword:: e1NTSEF9SWlwRzZvZC9vUW45NndNclJXblRIN2pENUpaNVlYb3c=\r\nuidNumber: 10001\r\ngidNumber: 10000\r\nsn: User01\r\n\r\n# search result\r\nsearch: 2\r\nresult: 0 Success\r\n\r\n# numResponses: 2\r\n# numEntries: 1\r\nctadmin@client:~$<\/pre>\n
Packet List<\/h3>\n
No. Time Source Destination Protocol Length Info\r\n42 11.051863 192.168.1.58 192.168.1.13 TCP 74 50602 \u2192 389 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=318079163 TSecr=0 WS=128\r\n43 11.051888 192.168.1.13 192.168.1.58 TCP 74 389 \u2192 50602 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM TSval=1122417641 TSecr=318079163 WS=128\r\n44 11.052097 192.168.1.58 192.168.1.13 TCP 66 50602 \u2192 389 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=318079163 TSecr=1122417641\r\n45 11.052213 192.168.1.58 192.168.1.13 LDAP 116 bindRequest(1) \"cn=admin,dc=cavtime,dc=com\" simple<\/span> \r\n46 11.052221 192.168.1.13 192.168.1.58 TCP 66 389 \u2192 50602 [ACK] Seq=1 Ack=51 Win=65152 Len=0 TSval=1122417642 TSecr=318079163\r\n47 11.052477 192.168.1.13 192.168.1.58 LDAP 80 bindResponse(1) success<\/span> \r\n48 11.052811 192.168.1.58 192.168.1.13 TCP 66 50602 \u2192 389 [ACK] Seq=51 Ack=15 Win=64256 Len=0 TSval=318079164 TSecr=1122417642\r\n49 11.052999 192.168.1.58 192.168.1.13 LDAP 142 searchRequest(2) \"cn=User01,ou=people,dc=cavtime,dc=com\" wholeSubtree \r\n50 11.053487 192.168.1.13 192.168.1.58 LDAP 407 searchResEntry(2) \"cn=User01,ou=people,dc=cavtime,dc=com\" \r\n51 11.053735 192.168.1.13 192.168.1.58 LDAP 80 searchResDone(2) success [1 result]<\/span>\r\n52 11.054151 192.168.1.58 192.168.1.13 TCP 66 50602 \u2192 389 [ACK] Seq=127 Ack=370 Win=64128 Len=0 TSval=318079165 TSecr=1122417643\r\n53 11.054256 192.168.1.58 192.168.1.13 LDAP 73 unbindRequest(3)<\/span> \r\n54 11.054256 192.168.1.58 192.168.1.13 TCP 66 50602 \u2192 389 [FIN, ACK] Seq=134 Ack=370 Win=64128 Len=0 TSval=318079165 TSecr=1122417643\r\n55 11.054401 192.168.1.13 192.168.1.58 TCP 66 389 \u2192 50602 [FIN, ACK] Seq=370 Ack=135 Win=65152 Len=0 TSval=1122417644 TSecr=318079165\r\n56 11.054633 192.168.1.58 192.168.1.13 TCP 66 50602 \u2192 389 [ACK] Seq=135 Ack=371 Win=64128 Len=0 TSval=318079166 TSecr=1122417644<\/pre>\n
Packet Detail<\/h3>\n
No.     Time           Source                Destination           Protocol Length Info\r\n     42 11.051863      192.168.1.58          192.168.1.13          TCP      74     50602 \u2192 389 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=318079163 TSecr=0 WS=128\r\n\r\nFrame 42: 74 bytes on wire (592 bits), 74 bytes captured (592 bits)\r\nEthernet II, Src: PcsCompu_93:da:1e (08:00:27:93:da:1e), Dst: PcsCompu_32:ce:1a (08:00:27:32:ce:1a)\r\nInternet Protocol Version 4, Src: 192.168.1.58, Dst: 192.168.1.13\r\nTransmission Control Protocol, Src Port: 50602, Dst Port: 389, Seq: 0, Len: 0\r\n\r\nNo.     Time           Source                Destination           Protocol Length Info\r\n     43 11.051888      192.168.1.13          192.168.1.58          TCP      74     389 \u2192 50602 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM TSval=1122417641 TSecr=318079163 WS=128\r\n\r\nFrame 43: 74 bytes on wire (592 bits), 74 bytes captured (592 bits)\r\nEthernet II, Src: PcsCompu_32:ce:1a (08:00:27:32:ce:1a), Dst: PcsCompu_93:da:1e (08:00:27:93:da:1e)\r\nInternet Protocol Version 4, Src: 192.168.1.13, Dst: 192.168.1.58\r\nTransmission Control Protocol, Src Port: 389, Dst Port: 50602, Seq: 0, Ack: 1, Len: 0\r\n\r\nNo.     Time           Source                Destination           Protocol Length Info\r\n     44 11.052097      192.168.1.58          192.168.1.13          TCP      66     50602 \u2192 389 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=318079163 TSecr=1122417641\r\n\r\nFrame 44: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)\r\nEthernet II, Src: PcsCompu_93:da:1e (08:00:27:93:da:1e), Dst: PcsCompu_32:ce:1a (08:00:27:32:ce:1a)\r\nInternet Protocol Version 4, Src: 192.168.1.58, Dst: 192.168.1.13\r\nTransmission Control Protocol, Src Port: 50602, Dst Port: 389, Seq: 1, Ack: 1, Len: 0\r\n\r\nNo.     Time           Source                Destination           Protocol Length Info\r\n     45 11.052213      192.168.1.58          192.168.1.13          LDAP     116    bindRequest(1) \"cn=admin,dc=cavtime,dc=com\" simple \r\n\r\nFrame 45: 116 bytes on wire (928 bits), 116 bytes captured (928 bits)\r\nEthernet II, Src: PcsCompu_93:da:1e (08:00:27:93:da:1e), Dst: PcsCompu_32:ce:1a (08:00:27:32:ce:1a)\r\nInternet Protocol Version 4, Src: 192.168.1.58, Dst: 192.168.1.13\r\nTransmission Control Protocol, Src Port: 50602, Dst Port: 389, Seq: 1, Ack: 1, Len: 50\r\nLightweight Directory Access Protocol\r\n    LDAPMessage bindRequest(1) \"cn=admin,dc=cavtime,dc=com\" simple\r\n        messageID: 1\r\n        protocolOp: bindRequest (0)\r\n            bindRequest\r\n                version: 3\r\n                name: cn=admin,dc=cavtime,dc=com\r\n                authentication: simple (0)\r\n                    simple: Media#0479\r\n        [Response In: 47]\r\n\r\nNo.     Time           Source                Destination           Protocol Length Info\r\n     46 11.052221      192.168.1.13          192.168.1.58          TCP      66     389 \u2192 50602 [ACK] Seq=1 Ack=51 Win=65152 Len=0 TSval=1122417642 TSecr=318079163\r\n\r\nFrame 46: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)\r\nEthernet II, Src: PcsCompu_32:ce:1a (08:00:27:32:ce:1a), Dst: PcsCompu_93:da:1e (08:00:27:93:da:1e)\r\nInternet Protocol Version 4, Src: 192.168.1.13, Dst: 192.168.1.58\r\nTransmission Control Protocol, Src Port: 389, Dst Port: 50602, Seq: 1, Ack: 51, Len: 0\r\n\r\nNo.     Time           Source                Destination           Protocol Length Info\r\n     47 11.052477      192.168.1.13          192.168.1.58          LDAP     80     bindResponse(1) success \r\n\r\nFrame 47: 80 bytes on wire (640 bits), 80 bytes captured (640 bits)\r\nEthernet II, Src: PcsCompu_32:ce:1a (08:00:27:32:ce:1a), Dst: PcsCompu_93:da:1e (08:00:27:93:da:1e)\r\nInternet Protocol Version 4, Src: 192.168.1.13, Dst: 192.168.1.58\r\nTransmission Control Protocol, Src Port: 389, Dst Port: 50602, Seq: 1, Ack: 51, Len: 14\r\nLightweight Directory Access Protocol\r\n    LDAPMessage bindResponse(1) success\r\n        messageID: 1\r\n        protocolOp: bindResponse (1)\r\n            bindResponse\r\n                resultCode: success (0)\r\n                matchedDN: \r\n                errorMessage: \r\n        [Response To: 45]\r\n        [Time: 0.000264000 seconds]\r\n\r\nNo.     Time           Source                Destination           Protocol Length Info\r\n     48 11.052811      192.168.1.58          192.168.1.13          TCP      66     50602 \u2192 389 [ACK] Seq=51 Ack=15 Win=64256 Len=0 TSval=318079164 TSecr=1122417642\r\n\r\nFrame 48: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)\r\nEthernet II, Src: PcsCompu_93:da:1e (08:00:27:93:da:1e), Dst: PcsCompu_32:ce:1a (08:00:27:32:ce:1a)\r\nInternet Protocol Version 4, Src: 192.168.1.58, Dst: 192.168.1.13\r\nTransmission Control Protocol, Src Port: 50602, Dst Port: 389, Seq: 51, Ack: 15, Len: 0\r\n\r\nNo.     Time           Source                Destination           Protocol Length Info\r\n     49 11.052999      192.168.1.58          192.168.1.13          LDAP     142    searchRequest(2) \"cn=User01,ou=people,dc=cavtime,dc=com\" wholeSubtree \r\n\r\nFrame 49: 142 bytes on wire (1136 bits), 142 bytes captured (1136 bits)\r\nEthernet II, Src: PcsCompu_93:da:1e (08:00:27:93:da:1e), Dst: PcsCompu_32:ce:1a (08:00:27:32:ce:1a)\r\nInternet Protocol Version 4, Src: 192.168.1.58, Dst: 192.168.1.13\r\nTransmission Control Protocol, Src Port: 50602, Dst Port: 389, Seq: 51, Ack: 15, Len: 76\r\nLightweight Directory Access Protocol\r\n    LDAPMessage searchRequest(2) \"cn=User01,ou=people,dc=cavtime,dc=com\" wholeSubtree\r\n        messageID: 2\r\n        protocolOp: searchRequest (3)\r\n            searchRequest\r\n                baseObject: cn=User01,ou=people,dc=cavtime,dc=com\r\n                scope: wholeSubtree (2)\r\n                derefAliases: neverDerefAliases (0)\r\n                sizeLimit: 0\r\n                timeLimit: 0\r\n                typesOnly: False\r\n                Filter: (objectclass=*)\r\n                    filter: present (7)\r\n                        present: objectclass\r\n                attributes: 0 items\r\n        [Response In: 50]\r\n\r\nNo.     Time           Source                Destination           Protocol Length Info\r\n     50 11.053487      192.168.1.13          192.168.1.58          LDAP     407    searchResEntry(2) \"cn=User01,ou=people,dc=cavtime,dc=com\" \r\n\r\nFrame 50: 407 bytes on wire (3256 bits), 407 bytes captured (3256 bits)\r\nEthernet II, Src: PcsCompu_32:ce:1a (08:00:27:32:ce:1a), Dst: PcsCompu_93:da:1e (08:00:27:93:da:1e)\r\nInternet Protocol Version 4, Src: 192.168.1.13, Dst: 192.168.1.58\r\nTransmission Control Protocol, Src Port: 389, Dst Port: 50602, Seq: 15, Ack: 127, Len: 341\r\nLightweight Directory Access Protocol\r\n    LDAPMessage searchResEntry(2) \"cn=User01,ou=people,dc=cavtime,dc=com\" [1 result]\r\n        messageID: 2\r\n        protocolOp: searchResEntry (4)\r\n            searchResEntry\r\n                objectName: cn=User01,ou=people,dc=cavtime,dc=com\r\n                attributes: 9 items\r\n                    PartialAttributeList item objectClass\r\n                        type: objectClass\r\n                        vals: 4 items\r\n                            AttributeValue: posixAccount\r\n                            AttributeValue: inetOrgPerson\r\n                            AttributeValue: organizationalPerson\r\n                            AttributeValue: person\r\n                    PartialAttributeList item loginShell\r\n                        type: loginShell\r\n                        vals: 1 item\r\n                            AttributeValue: \/bin\/bash\r\n                    PartialAttributeList item homeDirectory\r\n                        type: homeDirectory\r\n                        vals: 1 item\r\n                            AttributeValue: \/home\/user01\r\n                    PartialAttributeList item uid\r\n                        type: uid\r\n                        vals: 1 item\r\n                            AttributeValue: user01\r\n                    PartialAttributeList item cn\r\n                        type: cn\r\n                        vals: 1 item\r\n                            AttributeValue: User01\r\n                    PartialAttributeList item userPassword\r\n                        type: userPassword\r\n                        vals: 1 item\r\n                            AttributeValue: {SSHA}IipG6od\/oQn96wMrRWnTH7jD5JZ5YXow\r\n                    PartialAttributeList item uidNumber\r\n                        type: uidNumber\r\n                        vals: 1 item\r\n                            AttributeValue: 10001\r\n                    PartialAttributeList item gidNumber\r\n                        type: gidNumber\r\n                        vals: 1 item\r\n                            AttributeValue: 10000\r\n                    PartialAttributeList item sn\r\n                        type: sn\r\n                        vals: 1 item\r\n                            AttributeValue: User01\r\n        [Response To: 49]\r\n        [Time: 0.000488000 seconds]\r\n\r\nNo.     Time           Source                Destination           Protocol Length Info\r\n     51 11.053735      192.168.1.13          192.168.1.58          LDAP     80     searchResDone(2) success  [1 result]\r\n\r\nFrame 51: 80 bytes on wire (640 bits), 80 bytes captured (640 bits)\r\nEthernet II, Src: PcsCompu_32:ce:1a (08:00:27:32:ce:1a), Dst: PcsCompu_93:da:1e (08:00:27:93:da:1e)\r\nInternet Protocol Version 4, Src: 192.168.1.13, Dst: 192.168.1.58\r\nTransmission Control Protocol, Src Port: 389, Dst Port: 50602, Seq: 356, Ack: 127, Len: 14\r\nLightweight Directory Access Protocol\r\n    LDAPMessage searchResDone(2) success [1 result]\r\n        messageID: 2\r\n        protocolOp: searchResDone (5)\r\n            searchResDone\r\n                resultCode: success (0)\r\n                matchedDN: \r\n                errorMessage: \r\n        [Response To: 49]\r\n        [Time: 0.000736000 seconds]\r\n\r\nNo.     Time           Source                Destination           Protocol Length Info\r\n     52 11.054151      192.168.1.58          192.168.1.13          TCP      66     50602 \u2192 389 [ACK] Seq=127 Ack=370 Win=64128 Len=0 TSval=318079165 TSecr=1122417643\r\n\r\nFrame 52: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)\r\nEthernet II, Src: PcsCompu_93:da:1e (08:00:27:93:da:1e), Dst: PcsCompu_32:ce:1a (08:00:27:32:ce:1a)\r\nInternet Protocol Version 4, Src: 192.168.1.58, Dst: 192.168.1.13\r\nTransmission Control Protocol, Src Port: 50602, Dst Port: 389, Seq: 127, Ack: 370, Len: 0\r\n\r\nNo.     Time           Source                Destination           Protocol Length Info\r\n     53 11.054256      192.168.1.58          192.168.1.13          LDAP     73     unbindRequest(3) \r\n\r\nFrame 53: 73 bytes on wire (584 bits), 73 bytes captured (584 bits)\r\nEthernet II, Src: PcsCompu_93:da:1e (08:00:27:93:da:1e), Dst: PcsCompu_32:ce:1a (08:00:27:32:ce:1a)\r\nInternet Protocol Version 4, Src: 192.168.1.58, Dst: 192.168.1.13\r\nTransmission Control Protocol, Src Port: 50602, Dst Port: 389, Seq: 127, Ack: 370, Len: 7\r\nLightweight Directory Access Protocol\r\n    LDAPMessage unbindRequest(3)\r\n        messageID: 3\r\n        protocolOp: unbindRequest (2)\r\n            unbindRequest\r\n\r\nNo.     Time           Source                Destination           Protocol Length Info\r\n     54 11.054256      192.168.1.58          192.168.1.13          TCP      66     50602 \u2192 389 [FIN, ACK] Seq=134 Ack=370 Win=64128 Len=0 TSval=318079165 TSecr=1122417643\r\n\r\nFrame 54: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)\r\nEthernet II, Src: PcsCompu_93:da:1e (08:00:27:93:da:1e), Dst: PcsCompu_32:ce:1a (08:00:27:32:ce:1a)\r\nInternet Protocol Version 4, Src: 192.168.1.58, Dst: 192.168.1.13\r\nTransmission Control Protocol, Src Port: 50602, Dst Port: 389, Seq: 134, Ack: 370, Len: 0\r\n\r\nNo.     Time           Source                Destination           Protocol Length Info\r\n     55 11.054401      192.168.1.13          192.168.1.58          TCP      66     389 \u2192 50602 [FIN, ACK] Seq=370 Ack=135 Win=65152 Len=0 TSval=1122417644 TSecr=318079165\r\n\r\nFrame 55: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)\r\nEthernet II, Src: PcsCompu_32:ce:1a (08:00:27:32:ce:1a), Dst: PcsCompu_93:da:1e (08:00:27:93:da:1e)\r\nInternet Protocol Version 4, Src: 192.168.1.13, Dst: 192.168.1.58\r\nTransmission Control Protocol, Src Port: 389, Dst Port: 50602, Seq: 370, Ack: 135, Len: 0\r\n\r\nNo.     Time           Source                Destination           Protocol Length Info\r\n     56 11.054633      192.168.1.58          192.168.1.13          TCP      66     50602 \u2192 389 [ACK] Seq=135 Ack=371 Win=64128 Len=0 TSval=318079166 TSecr=1122417644\r\n\r\nFrame 56: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)\r\nEthernet II, Src: PcsCompu_93:da:1e (08:00:27:93:da:1e), Dst: PcsCompu_32:ce:1a (08:00:27:32:ce:1a)\r\nInternet Protocol Version 4, Src: 192.168.1.58, Dst: 192.168.1.13\r\nTransmission Control Protocol, Src Port: 50602, Dst Port: 389, Seq: 135, Ack: 371, Len: 0\r\n<\/pre>\n
LDAP(389) + TLS<\/h2>\n
Command and Result<\/h3>\n
ctadmin@client:~$ ldapsearch -Z -H ldap:\/\/ldap.cavtime.com -D \"cn=admin,dc=cavtime,dc=com\" -b \"cn=User01,ou=people,dc=cavtime,dc=com\" -W\r\nEnter LDAP Password: \r\n# extended LDIF\r\n#\r\n# LDAPv3\r\n# base <cn=User01,ou=people,dc=cavtime,dc=com> with scope subtree\r\n# filter: (objectclass=*)\r\n# requesting: ALL\r\n#\r\n\r\n# User01, people, cavtime.com\r\ndn: cn=User01,ou=people,dc=cavtime,dc=com\r\nobjectClass: posixAccount\r\nobjectClass: inetOrgPerson\r\nobjectClass: organizationalPerson\r\nobjectClass: person\r\nloginShell: \/bin\/bash\r\nhomeDirectory: \/home\/user01\r\nuid: user01\r\ncn: User01\r\nuserPassword:: e1NTSEF9SWlwRzZvZC9vUW45NndNclJXblRIN2pENUpaNVlYb3c=\r\nuidNumber: 10001\r\ngidNumber: 10000\r\nsn: User01\r\n\r\n# search result\r\nsearch: 3\r\nresult: 0 Success\r\n\r\n# numResponses: 2\r\n# numEntries: 1\r\nctadmin@client:~$\r\n<\/pre>\n
Packet List<\/h3>\n
No. Time Source Destination Protocol Length Info\r\n9 2.919991 192.168.1.58 192.168.1.13 TCP 74 42486 \u2192 389 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=318101219 TSecr=0 WS=128\r\n10 2.920076 192.168.1.13 192.168.1.58 TCP 74 389 \u2192 42486 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM TSval=1122439697 TSecr=318101219 WS=128\r\n11 2.920674 192.168.1.58 192.168.1.13 TCP 66 42486 \u2192 389 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=318101219 TSecr=1122439697\r\n12 2.920937 192.168.1.58 192.168.1.13 LDAP 97 extendedReq(1) LDAP_START_TLS_OID<\/span> \r\n13 2.921023 192.168.1.13 192.168.1.58 TCP 66 389 \u2192 42486 [ACK] Seq=1 Ack=32 Win=65152 Len=0 TSval=1122439698 TSecr=318101220\r\n14 2.921478 192.168.1.13 192.168.1.58 LDAP 80 extendedResp(1)<\/span> \r\n15 2.922174 192.168.1.58 192.168.1.13 TCP 66 42486 \u2192 389 [ACK] Seq=32 Ack=15 Win=64256 Len=0 TSval=318101221 TSecr=1122439699\r\n16 2.950315 192.168.1.58 192.168.1.13 TLSv1.3 464 Client Hello\r\n17 2.950811 192.168.1.13 192.168.1.58 TLSv1.3 226 Server Hello\r\n18 2.951052 192.168.1.13 192.168.1.58 TLSv1.3 72 Change Cipher Spec\r\n19 2.951757 192.168.1.58 192.168.1.13 TLSv1.3 72 Change Cipher Spec\r\n20 2.953972 192.168.1.13 192.168.1.58 TLSv1.3 100 Application Data\r\n21 2.954022 192.168.1.13 192.168.1.58 TLSv1.3 2651 Application Data\r\n22 2.954165 192.168.1.13 192.168.1.58 TLSv1.3 426 Application Data, Application Data\r\n23 2.954476 192.168.1.58 192.168.1.13 TCP 66 42486 \u2192 389 [ACK] Seq=436 Ack=3160 Win=62336 Len=0 TSval=318101253 TSecr=1122439731\r\n24 2.954878 192.168.1.58 192.168.1.13 TLSv1.3 140 Application Data\r\n25 2.996808 192.168.1.13 192.168.1.58 TCP 66 389 \u2192 42486 [ACK] Seq=3160 Ack=510 Win=64768 Len=0 TSval=1122439774 TSecr=318101254\r\n30 7.422045 192.168.1.58 192.168.1.13 TLSv1.3 138 Application Data\r\n31 7.422113 192.168.1.13 192.168.1.58 TCP 66 389 \u2192 42486 [ACK] Seq=3160 Ack=582 Win=64768 Len=0 TSval=1122444199 TSecr=318105720\r\n32 7.422577 192.168.1.13 192.168.1.58 TLSv1.3 102 Application Data\r\n33 7.423863 192.168.1.58 192.168.1.13 TLSv1.3 164 Application Data\r\n34 7.424352 192.168.1.13 192.168.1.58 TLSv1.3 429 Application Data\r\n35 7.424744 192.168.1.13 192.168.1.58 TLSv1.3 102 Application Data\r\n36 7.426520 192.168.1.58 192.168.1.13 TCP 66 42486 \u2192 389 [ACK] Seq=680 Ack=3595 Win=64128 Len=0 TSval=318105725 TSecr=1122444202\r\n37 7.427127 192.168.1.58 192.168.1.13 TLSv1.3 95 Application Data\r\n38 7.427128 192.168.1.58 192.168.1.13 TLSv1.3 90 Application Data\r\n39 7.427612 192.168.1.13 192.168.1.58 TCP 66 389 \u2192 42486 [ACK] Seq=3595 Ack=734 Win=64768 Len=0 TSval=1122444205 TSecr=318105726\r\n40 7.427826 192.168.1.13 192.168.1.58 TLSv1.3 90 Application Data\r\n41 7.427872 192.168.1.13 192.168.1.58 TCP 66 389 \u2192 42486 [FIN, ACK] Seq=3619 Ack=734 Win=64768 Len=0 TSval=1122444205 TSecr=318105726\r\n42 7.428418 192.168.1.58 192.168.1.13 TCP 60 42486 \u2192 389 [RST] Seq=734 Win=0 Len=0\r\n43 7.428418 192.168.1.58 192.168.1.13 TCP 60 42486 \u2192 389 [RST] Seq=734 Win=0 Len=0\r\n<\/pre>\n
LDAPS<\/h2>\n
Command and Result<\/h3>\n
ctadmin@client:~$ ldapsearch -H ldaps:\/\/ldap.cavtime.com -D \"cn=admin,dc=cavtime,dc=com\" -b \"cn=User01,ou=people,dc=cavtime,dc=com\" -W\r\nEnter LDAP Password: \r\n# extended LDIF\r\n#\r\n# LDAPv3\r\n# base <cn=User01,ou=people,dc=cavtime,dc=com> with scope subtree\r\n# filter: (objectclass=*)\r\n# requesting: ALL\r\n#\r\n\r\n# User01, people, cavtime.com\r\ndn: cn=User01,ou=people,dc=cavtime,dc=com\r\nobjectClass: posixAccount\r\nobjectClass: inetOrgPerson\r\nobjectClass: organizationalPerson\r\nobjectClass: person\r\nloginShell: \/bin\/bash\r\nhomeDirectory: \/home\/user01\r\nuid: user01\r\ncn: User01\r\nuserPassword:: e1NTSEF9SWlwRzZvZC9vUW45NndNclJXblRIN2pENUpaNVlYb3c=\r\nuidNumber: 10001\r\ngidNumber: 10000\r\nsn: User01\r\n\r\n# search result\r\nsearch: 2\r\nresult: 0 Success\r\n\r\n# numResponses: 2\r\n# numEntries: 1\r\nctadmin@client:~$ \r\n<\/pre>\n
Packet List<\/h3>\n
No. Time Source Destination Protocol Length Info\r\n51 9.216323 192.168.1.58 192.168.1.13 TCP 74 42674 \u2192 636 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=318126417 TSecr=0 WS=128\r\n52 9.216377 192.168.1.13 192.168.1.58 TCP 74 636 \u2192 42674 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM TSval=1122464896 TSecr=318126417 WS=128\r\n53 9.216937 192.168.1.58 192.168.1.13 TCP 66 42674 \u2192 636 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=318126418 TSecr=1122464896\r\n54 9.239473 192.168.1.58 192.168.1.13 TLSv1.3 464 Client Hello\r\n55 9.239537 192.168.1.13 192.168.1.58 TCP 66 636 \u2192 42674 [ACK] Seq=1 Ack=399 Win=64768 Len=0 TSval=1122464919 TSecr=318126440\r\n56 9.240399 192.168.1.13 192.168.1.58 TLSv1.3 226 Server Hello\r\n57 9.240682 192.168.1.13 192.168.1.58 TLSv1.3 72 Change Cipher Spec\r\n58 9.240918 192.168.1.58 192.168.1.13 TCP 66 42674 \u2192 636 [ACK] Seq=399 Ack=161 Win=64128 Len=0 TSval=318126442 TSecr=1122464920\r\n59 9.241115 192.168.1.58 192.168.1.13 TCP 66 42674 \u2192 636 [ACK] Seq=399 Ack=167 Win=64128 Len=0 TSval=318126442 TSecr=1122464920\r\n60 9.241889 192.168.1.58 192.168.1.13 TLSv1.3 72 Change Cipher Spec\r\n61 9.245916 192.168.1.13 192.168.1.58 TLSv1.3 100 Application Data\r\n62 9.246313 192.168.1.13 192.168.1.58 TLSv1.3 2651 Application Data\r\n63 9.246439 192.168.1.13 192.168.1.58 TLSv1.3 426 Application Data, Application Data\r\n64 9.246858 192.168.1.58 192.168.1.13 TCP 66 42674 \u2192 636 [ACK] Seq=405 Ack=2786 Win=63232 Len=0 TSval=318126448 TSecr=1122464925\r\n65 9.247334 192.168.1.58 192.168.1.13 TLSv1.3 140 Application Data\r\n66 9.248551 192.168.1.58 192.168.1.13 TLSv1.3 138 Application Data\r\n67 9.248707 192.168.1.13 192.168.1.58 TCP 66 636 \u2192 42674 [ACK] Seq=3146 Ack=551 Win=64640 Len=0 TSval=1122464928 TSecr=318126448\r\n68 9.248812 192.168.1.13 192.168.1.58 TLSv1.3 102 Application Data\r\n69 9.249678 192.168.1.58 192.168.1.13 TLSv1.3 164 Application Data\r\n70 9.249888 192.168.1.13 192.168.1.58 TLSv1.3 429 Application Data\r\n71 9.250036 192.168.1.13 192.168.1.58 TLSv1.3 102 Application Data\r\n72 9.250701 192.168.1.58 192.168.1.13 TCP 66 42674 \u2192 636 [ACK] Seq=649 Ack=3581 Win=64128 Len=0 TSval=318126452 TSecr=1122464929\r\n73 9.250858 192.168.1.58 192.168.1.13 TLSv1.3 95 Application Data\r\n74 9.250858 192.168.1.58 192.168.1.13 TLSv1.3 90 Application Data\r\n75 9.250858 192.168.1.58 192.168.1.13 TCP 66 42674 \u2192 636 [FIN, ACK] Seq=702 Ack=3581 Win=64128 Len=0 TSval=318126452 TSecr=1122464929\r\n76 9.251006 192.168.1.13 192.168.1.58 TCP 66 636 \u2192 42674 [ACK] Seq=3581 Ack=703 Win=64640 Len=0 TSval=1122464931 TSecr=318126452\r\n77 9.251069 192.168.1.13 192.168.1.58 TLSv1.3 90 Application Data\r\n78 9.251104 192.168.1.13 192.168.1.58 TCP 66 636 \u2192 42674 [FIN, ACK] Seq=3605 Ack=703 Win=64640 Len=0 TSval=1122464931 TSecr=318126452\r\n79 9.251282 192.168.1.58 192.168.1.13 TCP 60 42674 \u2192 636 [RST] Seq=703 Win=0 Len=0\r\n80 9.251283 192.168.1.58 192.168.1.13 TCP 60 42674 \u2192 636 [RST] Seq=703 Win=0 Len=0\r\n<\/pre>\n
Result<\/h2>\n","protected":false},"excerpt":{"rendered":"
Overview OpenLDAP\u3067LDAP(389)+SSL\/TLS\u3068LDAPS\u306e\u901a\u4fe1\u3092\u78ba\u8a8d\u3068\u6bd4\u8f03\u3092\u3059\u308b\u3002 Reference Environment LDAP Server ctadmin@svr-ldap02:~$ […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[],"class_list":["post-3635","post","type-post","status-publish","format-standard","hentry","category-ldap"],"_links":{"self":[{"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/posts\/3635","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3635"}],"version-history":[{"count":8,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/posts\/3635\/revisions"}],"predecessor-version":[{"id":3660,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/posts\/3635\/revisions\/3660"}],"wp:attachment":[{"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3635"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3635"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3635"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}