Robert LeBlanc wrote:
>> I have a strange situation where I can successfully query an LDAP
>> server with one client, but other clients don't work.
>>
>> Despite the recent changes and postings to the contrary, I can still
>> anonymously query BYU's LDAP from off campus, using Thunderbird. Here
>> are the settings I use:
>>
>> Name: BYU LDAP
>> Hostname: ldap.byu.edu
>> Base DN: ou=people,o=byu.edu
>> Port number: 636
>> Don't return more than: 100 results
>> Scope: Subtree
>> Search filter: (objectclass=*)
>>
>> LDAP works great with Thunderbird. Very handy for addressing emails.
>> LDAP Admin Tool ("lat") seems to work as well. But oddly enough, I
>> can't get it to work in Evolution (which is what I want), nor
>> KAddressBook, nor GQ, nor ldapsearch, nor any other client.
>>
>> I pulled out Wireshark to watch the packets dance around. Although I
>> am clueless when it comes to SSL/TLS, the handshaking appears to be
>> different between some clients. My guess is that these clients are
>> trying TLS when they should really be using SSLv3.
>>
>> Can anyone guess what's going on? Has anyone had any luck getting
>> this to work with your email client of choice?
>>
>
> Only unencrypted traffic/any traffic on port 389 is blocked from the
> outside world. Encrypted traffic on 636 is allowed. Now, there are two
> ways to do secure LDAP traffic, the first and older way is TLS, which
> usually starts an unencrypted session on 389, then early on negotiates a
> secure channel on the same port. You can also have TLS on an alternative
> port like 636. The other option is to use LDAP over SSL. This is an LDAP
> communication where all the data is encrypted from start to finish. From
> my understanding, they are very different technologies and neither one
> is "better" than the other, it's just provided more confusion in the
> world of LDAP and made the differing camps more entrenched and less
> likely to converge on a single technology.
>
TLS is actually newer and is slightly better since you can use the same
port (389) for both encrypted and unecrypted LDAP traffic. Clients can
also negotiate to decide whether they can or can't use encryption. Also,
to answer the original poster's question, typically port 636 is pure
SSL, no TLS, so make sure you LDAP clients are configured for SSL, not
TLS, when connecting to port 636.
--Dave
--------------------
BYU Unix Users Group
http://uug.byu.edu/
The opinions expressed in this message are the responsibility of their
author. They are not endorsed by BYU, the BYU CS Department or BYU-UUG.
___________________________________________________________________
List Info (unsubscribe here): http://uug.byu.edu/mailman/listinfo/uug-list
