[Nagiosplug-devel] [ nagiosplug-Bugs-2550254 ] check_ldap with starttls requires hostname to match cert nam

[SourceForge.net]

Bugs item #2550254, was opened at 2009-01-30 21:54
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=397597&aid=2550254&group_id=29880

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: General plugin execution
Group: Release (specify)
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Jan Wagner (cyco_dd)
Assigned to: Nobody/Anonymous (nobody)
Summary: check_ldap with starttls requires hostname to match cert nam

Initial Comment:
Version: 1.4.10-1

The following Bugreport we got against our debian package:

Serverside: slapd 2.4.7-3 with TLS (not ldaps) enabled.  It's running on a VM with a hostname of 'utilserver.domain.org', and its SSL cert has a CN of 'utilserver', since usually only internal users interact with it.

$ /usr/lib/nagios/plugins/check_ldap -T -H utilserver -b `grep BASE /etc/ldap/ldap.conf| awk '{print $2}'`
LDAP OK - 0.041 seconds response time|time=0.040605s;;;0.000000
$ host utilserver
utilserver.domain.org has address 192.168.20.20
$ /usr/lib/nagios/plugins/check_ldap -T -H 192.168.20.20 -b `grep BASE /etc/ldap/ldap.conf| awk '{print $2}'`

Could not init startTLS at port 389!

$ /usr/lib/nagios/plugins/check_ldap -T -H utilserver.domain.org -b `grep BASE /etc/ldap/ldap.conf| awk '{print $2}'`

Could not init startTLS at port 389!


It appears (though I haven't confirmed since my C-fu is weak) that the -T flag co-opts the hostname as specified in the -H and uses that in its TLS handshake.  But that overload is not always good: my nagios checks, which use the FQDN, fail.

Suggestion:
-T is currently a boolean flag.  How about -T [optional hostname for certificate handshake if -H isn't good enough]?  I can't think of anything else you might want after -T, myself.

Thanks!

You can track the bugreport via http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=463355

Thanks and kind regards, Jan.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=397597&aid=2550254&group_id=29880