You are currently browsing the daily archive for November 13, 2010.
--with-ssl option is used to setup SSL for replication. I have seen a couple of postings on various forums that the script hangs when using
--with-ssl option. That happened to me as well at first. I haven’t seen any answers on how to resolve this so I posting my patch to the script. (
Maybe someone will submit it to the script’s maintainer, I’m too lazy. Update 1/14/2011: the maintainer, Rich Megginson, accepted the patch so refer to his repository for the latest version.)
The problem is that in the current version of the script the
--with-ssl option also sets the port used for connections – port 636 by default. Just setting the port to 636 is not sufficient to inform the script’s underlying Net::LDAP perl library that SSL communication is expected. Specifying a
ldaps scheme with the host name triggers the required SSL support in Net::LDAP.
So, I prepended
ldaps:// to the server in each occurrence of
Net::LDAP->new(). For example,
(full source is provided below)
Note that the
--with-ssl servers two purposes. One is to tell the script to configure the directory to use SSL for all future replication transactions. That is, the communication between the two directory servers will be encrypted. The other action of
--with-ssl is to encrypt the communications the script makes to each directory server during the setup and querying (the Net::LDAP business we just resolved). So, you will also want to use both the
--with-ssl option for the script’s other subcommands, such as
--remove so those communications are consistently held over secure channels.