On Thu, 2014-08-28 at 11:47 +0200, Andreas B. Mundt wrote: > pynslcd fail to start here on debian-lan. I attach the debug log. > This problem does not happen with nslcd, where things work.
Thanks for reporting this. I've seen some issues in pynslcd in
combination with SSL/TLS. Sadly error messages are pretty obscure or
useless most of the time.
> Traceback (most recent call last):
> File "/usr/lib/python2.7/threading.py", line 810, in __bootstrap_inner
> self.run()
> File "/usr/lib/python2.7/threading.py", line 763, in run
> self.__target(*self.__args, **self.__kwargs)
> File "/usr/sbin/pynslcd", line 256, in worker
> session = search.Connection()
> File "/usr/share/pynslcd/search.py", line 62, in __init__
> self.start_tls_s()
> File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 836, in
> start_tls_s
> res = self._apply_method_s(SimpleLDAPObject.start_tls_s,*args,**kwargs)
> File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 819, in
> _apply_method_s
> return func(self,*args,**kwargs)
> File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 564, in
> start_tls_s
> return self._ldap_call(self._l.start_tls_s)
> File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 99, in
> _ldap_call
> result = func(*args,**kwargs)
> SERVER_DOWN: {'info': 'A TLS packet with unexpected length was received.',
> 'desc': "Can't contact LDAP server"}
The unexpected length issue seems to be somewhat common in GnuTLS and
could even be related to certificate checking failing.
Your nslcd.conf is basically the following?
uri ldap://ldap
ssl start_tls
tls_cacertfile /etc/ldap/slapd.crt
tls_reqcert demand
Thanks,
--
-- arthur - [email protected] - http://people.debian.org/~adejong --
signature.asc
Description: This is a digitally signed message part
