Re: trouble with ldaps in ldap lookup map

2009-06-26 Thread Quanah Gibson-Mount
--On Friday, June 26, 2009 4:48 PM -0400 Victor Duchovni wrote: On Fri, Jun 26, 2009 at 01:32:42PM -0700, Quanah Gibson-Mount wrote: OpenLDAP 2.4.16 Release (2009/04/05) Fixed libldap GnuTLS with x509v1 CA certs (ITS#5992) Fixed libldap GnuTLS with CA chains (ITS#5991)

Re: trouble with ldaps in ldap lookup map

2009-06-26 Thread Victor Duchovni
On Fri, Jun 26, 2009 at 01:32:42PM -0700, Quanah Gibson-Mount wrote: > OpenLDAP 2.4.16 Release (2009/04/05) > Fixed libldap GnuTLS with x509v1 CA certs (ITS#5992) > Fixed libldap GnuTLS with CA chains (ITS#5991) > Fixed libldap GnuTLS TLSVerifyCilent try (ITS#5981) > > OpenLDAP 2

Re: trouble with ldaps in ldap lookup map

2009-06-26 Thread Quanah Gibson-Mount
--On Friday, June 26, 2009 4:23 PM -0400 Victor Duchovni wrote: On Fri, Jun 26, 2009 at 04:53:39PM -0300, jakjr wrote: Try to use smtp without chroot: master.cf: smtp inet n - n - - smtpd This is completely irrelevant. The OP's problem is reproducible with postmap(1) outs

Re: trouble with ldaps in ldap lookup map

2009-06-26 Thread Victor Duchovni
On Fri, Jun 26, 2009 at 04:53:39PM -0300, jakjr wrote: > Try to use smtp without chroot: > > master.cf: > smtp inet n - n - - smtpd This is completely irrelevant. The OP's problem is reproducible with postmap(1) outside any chroot jail. The OP's problem report shows an error in

Re: trouble with ldaps in ldap lookup map

2009-06-26 Thread btb
Victor Duchovni wrote: On Fri, Jun 26, 2009 at 02:12:12PM -0400, btb wrote: testing with postmap returns: postmap -q 'example.com' ldap:./virtual_mailbox_domains.cf postmap: warning: dict_ldap_set_tls_options: Unable to allocate new TLS context -1: Can't contact LDAP server Have you tried

Re: trouble with ldaps in ldap lookup map

2009-06-26 Thread jakjr
Try to use smtp without chroot: master.cf: smtp inet n - n - - smtpd On Fri, Jun 26, 2009 at 4:30 PM, Victor Duchovni < victor.ducho...@morganstanley.com> wrote: > On Fri, Jun 26, 2009 at 02:37:32PM -0400, Victor Duchovni wrote: > > > What exactly was working before and what did

Re: trouble with ldaps in ldap lookup map

2009-06-26 Thread Victor Duchovni
On Fri, Jun 26, 2009 at 02:37:32PM -0400, Victor Duchovni wrote: > What exactly was working before and what did you change? You need > a version of the LDAP library with debugging symbols. Then single-step > "gdb" (debugging "postmap") through ldap_int_tls_init_ctx() > > called from ldap_pvt_tl

Re: trouble with ldaps in ldap lookup map

2009-06-26 Thread Quanah Gibson-Mount
--On Friday, June 26, 2009 2:37 PM -0400 Victor Duchovni wrote: openldap appear to be using gnutls: > ldd /usr/sbin/slapd | egrep -i '(tls|ssl)' libgnutls.so.26 => /usr/lib/libgnutls.so.26 (0xb7d01000) Not sure it is a good idea to mix both in the same address space... I've only eve

Re: trouble with ldaps in ldap lookup map

2009-06-26 Thread Victor Duchovni
On Fri, Jun 26, 2009 at 02:12:12PM -0400, btb wrote: >>> testing with postmap returns: postmap -q 'example.com' ldap:./virtual_mailbox_domains.cf >>> postmap: warning: dict_ldap_set_tls_options: Unable to allocate new TLS >>> context -1: Can't contact LDAP server >> Have you tried with "star

Re: trouble with ldaps in ldap lookup map

2009-06-26 Thread btb
Victor Duchovni wrote: On Fri, Jun 26, 2009 at 11:50:12AM -0400, btb wrote: cat virtual_mailbox_domains.cf version = 3 tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt server_host = ldaps://ldap.example.com bind_dn = cn=postfix,ou=services,ou=accounts,dc=example,dc=com bind_pw = x

Re: trouble with ldaps in ldap lookup map

2009-06-26 Thread Victor Duchovni
On Fri, Jun 26, 2009 at 11:50:12AM -0400, btb wrote: > >cat virtual_mailbox_domains.cf > version = 3 > tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt > server_host = ldaps://ldap.example.com > bind_dn = cn=postfix,ou=services,ou=accounts,dc=example,dc=com > bind_pw = xx > search