On Fri, 2009-06-05 at 12:50 -0300, Rodrigo Campos wrote: > So /etc/pam_ldap.conf is not checked. And /root/ldaprc, /root/.ldaprc, > ldaprc does not exist, /etc/ldap/ldap.conf is all commented, and > in /etc/nss-ldapd.conf is not turned on. The others does not have > anything either... > > Looking in the man of nss-ldapd.conf 0.6.7.1, it says: > > tls_checkpeer > Specifies whether to require and verify the server certificate or > not, when using SSL/TLS with the OpenLDAP client library. The > default is to use the default behaviour of the client library; for > OpenLDAP 2.0 and earlier it is "no", for OpenLDAP 2.1 and later it is > "yes". At least one of tls_cacertdir and tls_cacertfile is required if > peer verification is enabled. > > In the man of nss-ldapd.conf 0.6.10 says: > > tls_reqcert > Specifies what checks to perform on a server-supplied > certificate. The meaning of the values is described in the ldap.conf(5) > manual page. At least one of tls_cacertdir and tls_cacertfile is > required if peer verification is enabled. > > and it the man of ldapd.conf it does not say anything about the default. So if > I'm not wrong the default have changed ?
Only the option checking has been renamed. Before you could chose between yes (is now demand) or no (is now never). If the option was not supplied the default that OpenLDAP was using was used. The only remaining explanation must be that if LDAPNOINIT is set (done in 0.6.8) the built-in defaults are different. I think adding the debconf question about certificate verification is the best solution for this. -- -- arthur - [email protected] - http://people.debian.org/~adejong --
signature.asc
Description: This is a digitally signed message part
