From: Xeno Campanoli Date: 2009-06-02T03:54:06+09:00 Subject: Re: Something Not going with my LDAP using SSL Can you tell me more specifically what I might be looking for? I don't want to splatter too much around and I feel a little lost here...? Sincerely, Xeno >> tcpdump -i eth0 -s0 -n -X tcp port 636 > > Sorry. Going too fast again. Here: > > telnet ihn 636 > Trying iipaddress... > Connected to ihn. > Escape character is '^]'. > ---snip--- > Had to hack out the real hostname of course but that is how it comes > out, which appears normal. > > the other ones I have: > > ~# tcpdump -i eth0 -s0 -n -X tcp port 636 > tcpdump: verbose output suppressed, use -v or -vv for full protocol decode > listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes > 11:11:51.693153 IP 192.168.141.130.44841 > 192.168.139.157.636: S > 3432003157:3432003157(0) win 5840 0,nop,wscale 6> > 0x0000: 4500 003c 64ae 4000 4006 3b9d c0a8 8d82 E.. 0x0010: c0a8 8b9d af29 027c cc90 3655 0000 0000 .....).|..6U.... > 0x0020: a002 16d0 8f35 0000 0204 05b4 0402 080a .....5.......... > 0x0030: 0004 52fb 0000 0000 0103 0306 ..R......... > 11:11:51.693644 IP 192.168.139.157.636 > 192.168.141.130.44841: S > 3906532269:3906532269(0) ack 3432003158 win 5792 11:11:51.716931 IP 192.168.139.157.636 > 192.168.141.130.44841: F > 2210:2210(0) ack 289 win 6432 > 0x0000: 4500 0034 2e4d 4000 3f06 7306 c0a8 8b9d E..4.M@.?.s..... > 0x0010: c0a8 8d82 027c af29 e8d8 fc4f cc90 3776 .....|.)...O..7v > 0x0020: 8011 1920 bdcc 0000 0101 080a 399b ddeb ............9... > 0x0030: 0004 52fe ..R. > 11:11:51.716936 IP 192.168.141.130.44841 > 192.168.139.157.636: R > 3432003446:3432003446(0) win 0 > 0x0000: 4500 0028 0000 4000 4006 a05f c0a8 8d82 E..(..@.@.._.... > 0x0010: c0a8 8b9d af29 027c cc90 3776 0000 0000 .....).|..7v.... > 0x0020: 5004 0000 5fc3 0000 P..._... > >> >> Then run the script on both boxes, and compare the output. (If it's >> actually establishing an encrypted SSL session then it will look like >> garbage, but I suspect that the connection is being rejected in one >> case, since that's what the error message says) > > I do not have direct access to the company LDAP server to do this on. > To do this on the redhat machines, I will need to make arrangements. As > you can see, the protocol appears to make some headway before the end. > The results look similar on the 8.04 box. > >