Configuring Open Directory with SSL and signed certificate causing slapd crashes

[mledford]

Hello,

I am new to admin’ing Mac OS X server and am trying to setup an Xserve as an open directory master. Once finished this master will replicate to another Xserve (not setup yet) and provide LDAP authentication to various services including services hosted on the machine that is the Open Directory master. I have read as much as I could and I believe I am doing things correctly but I’m having major problems. Here are the steps I have taken so far, while this email is long, I hope someone will be able to take time to read and assist or point out what I’m doing wrong.

First I installed OS X server (10.4.8) on our Intel Xserve from the CD that came with the Xserve. During the setup process I assigned the machine its IP addresses. One interface is its public internet address. At time of installation the xserve’s IP address reverse resolved, and still does, to the machine’s name. The machine’s name also resolved to the IP address. The other interface is connected to a switch with non-routable IPs. The only other machines on that switch are some other Xserves to allow us to transfer information between them without hitting some bandwidth monitoring at the data center and to speed up transfer. During installation setup I set the machine as the Open Directory master. I left the data center and went to remotely finish the configuring once I saw the machine was up and accessible.

Once connected remotely via Server Admin I updated to OS X Server 10.4.10. After that I proceeded to install the server’s wildcard certificate. We have a chained wildcard certificate from a non-root vender. I created the cert using Server Admin, once I received the signed certificate I added it though Server Admin. However, the server needed the intermediate certificate so I opened Keychain Access and added it by dragging and dropping into the system keychain. Keychain Access then showed the wildcard certificate as valid since it now had a path back to the root cert.

Now that I had a valid certificate I could then finish configuring Open Directory. The first thing I did was open Directory Access and disabled all the plugins beside Bonjour which you can’t disable. I then proceeded to configure LDAPv3. I selected the automatically added item from setup (LDAP Mappings is set to Open Directory Server) and chose edit. In this window I changed the IP (127.0.0.1) to its name xserve.domain.org. I enabled ‘Encrypt using SSL’. I then selected the Security tab, I enabled ‘Disable clear text password’ and ‘Encrypt all packets (requires SSL or Kerberos)’. I saved everything and quit Directory Access.

Back to Server Admin I selected ‘Open Directory’. In the overview it lists Open Directory as the master. Lookup Server is ‘Running’. NetInfo Server is ‘Local Only’. LDAP Server is ‘Running’. Password Server is ‘Running’. Kerberos is ‘Running’. I then chose ‘Settings’. Selecting ‘Protocols’ I enabled SSL and chose the wildcard certificate added prior. I then moved on to ‘Policy’ and ‘Binding’. I enable ‘Disable clear text password’ and ‘Encrypt all packets (requires SSL or Kerberos)’. I then clicked save. Everything appeared to be fine…until Server Admin refreshed.

When it did the following occurred in the system log, the IPs and domain has been changed to protect the innocent. 🙂 I was unable to login via ssh and Server Admin hung until a save to disable SSL finally went through. Below the system log is the last entry from the slapd.crash.log. It only occurs when I turn on SSL with the wildcard certificate. I can enable the default certificate with out a problem. So either 1.) There is a bug. 2.) I am importing my chained wildcard certificate incorrectly. 3.) ???

Any insight is appreciated.

Sincerely,
Michael

—————————————————————————

/var/log/system.log

Aug 11 13:22:42 xserve /System/Library/CoreServices/mcxd.app/Contents/MacOS/mcxd: DSOpenNode(): dsOpenDirNode(“/LDAPv3/xserve.domain.org”) == -14002
Aug 11 13:24:58 xserve servermgrd: servermgr_dns: hostname and DNS entries for this server are synchronized
Aug 11 13:25:47 xserve crashdump[1510]: slapd crashed
Aug 11 13:25:47 xserve crashdump[1510]: crash report written to: /Library/Logs/CrashReporter/slapd.crash.log
Aug 11 13:25:48 xserve DirectoryService[85]: Search connection failure: During an attempt to bind to [1.1.1.1] LDAP server.
Aug 11 13:25:48 xserve DirectoryService[85]: Search connection failure: Disabled future attempts to bind to [1.1.1.1] LDAP
server for next 45 seconds.
Aug 11 13:25:48 xserve launchd: org.openldap.slapd: exited abnormally: Segmentation fault
Aug 11 13:25:48 xserve launchd: org.openldap.slapd: 9 more failures without living at least 60 seconds will cause job removal
Aug 11 13:26:19 xserve crashdump[1517]: slapd crashed
Aug 11 13:26:19 xserve crashdump[1517]: crash report written to: /Library/Logs/CrashReporter/slapd.crash.log
Aug 11 13:26:20 xserve DirectoryService[85]: Search connection failure: During an attempt to bind to [1.1.1.1] LDAP server.
Aug 11 13:26:20 xserve DirectoryService[85]: Search connection failure: Disabled future attempts to bind to [1.1.1.1] LDAP
server for next 45 seconds.
Aug 11 13:26:20 xserve launchd: org.openldap.slapd: exited abnormally: Segmentation fault
Aug 11 13:26:20 xserve launchd: org.openldap.slapd: 8 more failures without living at least 60 seconds will cause job removal
Aug 11 13:26:35 xserve crashdump[1519]: slapd crashed
Aug 11 13:26:36 xserve crashdump[1519]: crash report written to: /Library/Logs/CrashReporter/slapd.crash.log
Aug 11 13:26:36 xserve DirectoryService[85]: Search connection failure: During an attempt to bind to [1.1.1.1] LDAP server.
Aug 11 13:26:36 xserve DirectoryService[85]: Search connection failure: Disabled future attempts to bind to [1.1.1.1] LDAP
server for next 45 seconds.
Aug 11 13:26:36 xserve launchd: org.openldap.slapd: exited abnormally: Segmentation fault
Aug 11 13:26:36 xserve launchd: org.openldap.slapd: 7 more failures without living at least 60 seconds will cause job removal
Aug 11 13:27:07 xserve crashdump[1521]: slapd crashed
Aug 11 13:27:07 xserve crashdump[1521]: crash report written to: /Library/Logs/CrashReporter/slapd.crash.log
Aug 11 13:27:08 xserve DirectoryService[85]: Search connection failure: During an attempt to bind to [1.1.1.1] LDAP server.
Aug 11 13:27:08 xserve DirectoryService[85]: Search connection failure: Disabled future attempts to bind to [1.1.1.1] LDAP
server for next 45 seconds.
Aug 11 13:27:08 xserve launchd: org.openldap.slapd: exited abnormally: Segmentation fault
Aug 11 13:27:08 xserve launchd: org.openldap.slapd: 6 more failures without living at least 60 seconds will cause job removal
Aug 11 13:27:38 xserve crashdump[1523]: slapd crashed
Aug 11 13:27:39 xserve crashdump[1523]: crash report written to: /Library/Logs/CrashReporter/slapd.crash.log
Aug 11 13:27:39 xserve DirectoryService[85]: Search connection failure: During an attempt to bind to [1.1.1.1] LDAP server.
Aug 11 13:27:39 xserve DirectoryService[85]: Search connection failure: Disabled future attempts to bind to [1.1.1.1] LDAP
server for next 45 seconds.
Aug 11 13:27:39 xserve launchd: org.openldap.slapd: exited abnormally: Segmentation fault
Aug 11 13:27:39 xserve launchd: org.openldap.slapd: 5 more failures without living at least 60 seconds will cause job removal
Aug 11 13:27:55 xserve crashdump[1525]: slapd crashed
Aug 11 13:27:55 xserve crashdump[1525]: crash report written to: /Library/Logs/CrashReporter/slapd.crash.log
Aug 11 13:27:56 xserve DirectoryService[85]: Search connection failure: During an attempt to bind to [1.1.1.1] LDAP server.
Aug 11 13:27:56 xserve DirectoryService[85]: Search connection failure: Disabled future attempts to bind to [1.1.1.1] LDAP
server for next 45 seconds.
Aug 11 13:27:56 xserve launchd: org.openldap.slapd: exited abnormally: Segmentation fault
Aug 11 13:27:56 xserve launchd: org.openldap.slapd: 4 more failures without living at least 60 seconds will cause job removal
Aug 11 13:28:18 xserve servermgrd: [67] error in getAndLockContext: flock(servermgr_info) FATAL time out
Aug 11 13:28:18 xserve servermgrd: [67] process will force-quit to avoid deadlock
Aug 11 13:28:18 xserve launchd: com.apple.servermgrd: exited with exit code: 1
Aug 11 13:28:18 xserve launchd: com.apple.servermgrd: 9 more failures without living at least 60 seconds will cause job removal
Aug 11 13:28:18 xserve servermgrd: servermgr_dns: hostname and DNS entries for this server are synchronized
Aug 11 13:28:27 xserve crashdump[1534]: slapd crashed
Aug 11 13:28:27 xserve crashdump[1534]: crash report written to: /Library/Logs/CrashReporter/slapd.crash.log
Aug 11 13:28:28 xserve DirectoryService[85]: Search connection failure: During an attempt to bind to [1.1.1.1] LDAP server.
Aug 11 13:28:28 xserve DirectoryService[85]: Search connection failure: Disabled future attempts to bind to [1.1.1.1] LDAP
server for next 45 seconds.
Aug 11 13:28:28 xserve launchd: org.openldap.slapd: exited abnormally: Segmentation fault
Aug 11 13:28:28 xserve launchd: org.openldap.slapd: 3 more failures without living at least 60 seconds will cause job removal
Aug 11 13:28:30 xserve crashdump[1540]: slapd crashed
Aug 11 13:28:30 xserve crashdump[1540]: crash report written to: /Library/Logs/CrashReporter/slapd.crash.log
Aug 11 13:28:43 xserve /System/Library/CoreServices/mcxd.app/Contents/MacOS/mcxd: DSOpenNode(): dsOpenDirNode(“/LDAPv3/xserve.domain.org”) == -14002

—————————————————————————

Last entry in /Library/Logs/CrashReporter/slapd.crash.log

**********

Host Name: xserve
Date/Time: 2007-08-11 13:28:30.353 -0400
OS Version: 10.4.10 (Build 8R2218b)
Report Version: 4

Command: slapd
Path: /usr/libexec/slapd
Parent: launchd [1]

Version: ??? (???)

PID: 1536
Thread: 0

Exception: EXC_BAD_ACCESS (0x0001)
Codes: KERN_INVALID_ADDRESS (0x0001) at 0x6163696e

Thread 0 Crashed:
0 slapd 0x00063684 0x1000 + 403076
1 slapd 0x000636a0 0x1000 + 403104
2 slapd 0x000636bf 0x1000 + 403135
3 slapd 0x000636bf 0x1000 + 403135
4 slapd 0x000636bf 0x1000 + 403135
5 slapd 0x000636bf 0x1000 + 403135
6 slapd 0x00086051 0x1000 + 544849
7 slapd 0x00069327 0x1000 + 426791
8 slapd 0x0001a427 0x1000 + 103463
9 slapd 0x0000302d 0x1000 + 8237
10 slapd 0x0000224e 0x1000 + 4686
11 slapd 0x00002175 0x1000 + 4469

Thread 0 crashed with X86 Thread State (32-bit):
eax: 0x61636966 ebx: 0x0008603c ecx: 0x00000001 edx: 0x00000001
edi: 0x00025519 esi: 0x61636966 ebp: 0xbffffc58 esp: 0xbffffc30
ss: 0x0000001f efl: 0x00010206 eip: 0x00063684 cs: 0x00000017
ds: 0x0000001f es: 0x0000001f fs: 0x00000000 gs: 0x00000037

Binary Images Description:
0x1000 – 0x17efff slapd /usr/libexec/slapd
0x1b0000 – 0x1b2fff apop.so /usr/lib/sasl2/apop.so
0x1b6000 – 0x1befff digestmd5WebDAV.so /usr/lib/sasl2/digestmd5WebDAV.so
0x1c2000 – 0x1c3fff libanonymous.2.so /usr/lib/sasl2/libanonymous.2.so
0x1c7000 – 0x1c9fff libcrammd5.2.so /usr/lib/sasl2/libcrammd5.2.so
0x1cd000 – 0x1d5fff libdigestmd5.2.so /usr/lib/sasl2/libdigestmd5.2.so
0x1d9000 – 0x1dcfff libgssapiv2.2.so /usr/lib/sasl2/libgssapiv2.2.so
0x1e0000 – 0x1e2fff login.so /usr/lib/sasl2/login.so
0x1e6000 – 0x1ebfff libntlm.so /usr/lib/sasl2/libntlm.so
0x1ef000 – 0x1f1fff libplain.2.so /usr/lib/sasl2/libplain.2.so
0x1f5000 – 0x1f8fff mschapv2.so /usr/lib/sasl2/mschapv2.so
0x305000 – 0x341fff dhx.so /usr/lib/sasl2/dhx.so
0x362000 – 0x36afff libotp.2.so /usr/lib/sasl2/libotp.2.so
0x374000 – 0x376fff pwauxprop.so /usr/lib/sasl2/pwauxprop.so
0x37b000 – 0x37dfff shadow_auxprop.so /usr/lib/sasl2/shadow_auxprop.so
0x381000 – 0x383fff smb_lm.so /usr/lib/sasl2/smb_lm.so
0x387000 – 0x389fff smb_nt.so /usr/lib/sasl2/smb_nt.so
0x38d000 – 0x390fff smb_ntlmv2.so /usr/lib/sasl2/smb_ntlmv2.so
0x394000 – 0x397fff libpscrammd5.2.so /usr/lib/sasl2/openldap/libpscrammd5.2.so
0x8fe00000 – 0x8fe4afff dyld 46.12 /usr/lib/dyld
0x90000000 – 0x90171fff libSystem.B.dylib /usr/lib/libSystem.B.dylib
0x901c1000 – 0x901c3fff libmathCommon.A.dylib /usr/lib/system/libmathCommon.A.dylib
0x9080b000 – 0x908d3fff com.apple.CoreFoundation 6.4.7 (368.28) /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
0x90911000 – 0x90911fff com.apple.CoreServices 10.4 (???) /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
0x90913000 – 0x90a07fff libicucore.A.dylib /usr/lib/libicucore.A.dylib
0x90a57000 – 0x90ad6fff libobjc.A.dylib /usr/lib/libobjc.A.dylib
0x90aff000 – 0x90b63fff libstdc++.6.dylib /usr/lib/libstdc++.6.dylib
0x90bd2000 – 0x90bd9fff libgcc_s.1.dylib /usr/lib/libgcc_s.1.dylib
0x90bde000 – 0x90c51fff com.apple.framework.IOKit 1.4.8 (???) /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
0x90c66000 – 0x90c78fff libauto.dylib /usr/lib/libauto.dylib
0x90c7e000 – 0x90f24fff com.apple.CoreServices.CarbonCore 682.26 /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore
0x90f67000 – 0x90fcffff com.apple.CoreServices.OSServices 4.1 /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices
0x91008000 – 0x91047fff com.apple.CFNetwork 129.21 /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
0x9105a000 – 0x9106afff com.apple.WebServices 1.1.3 (1.1.0) /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/WebServicesCore.framework/Versions/A/WebServicesCore
0x91075000 – 0x910f4fff com.apple.SearchKit 1.0.5 /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit
0x9112e000 – 0x9114cfff com.apple.Metadata 10.4.4 (121.36) /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata
0x91158000 – 0x91166fff libz.1.dylib /usr/lib/libz.1.dylib
0x91169000 – 0x91308fff com.apple.security 4.5.2 (29774) /System/Library/Frameworks/Security.framework/Versions/A/Security
0x91406000 – 0x9140efff com.apple.DiskArbitration 2.1.1 /System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration
0x91415000 – 0x9141cfff libbsm.dylib /usr/lib/libbsm.dylib
0x91420000 – 0x91446fff com.apple.SystemConfiguration 1.8.6 /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
0x91948000 – 0x919fafff libcrypto.0.9.7.dylib /usr/lib/libcrypto.0.9.7.dylib
0x91be5000 – 0x91cc3fff libxml2.2.dylib /usr/lib/libxml2.2.dylib
0x9262b000 – 0x92718fff libiconv.2.dylib /usr/lib/libiconv.2.dylib
0x927d8000 – 0x92a08fff com.apple.Foundation 6.4.8 (567.29) /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
0x931ef000 – 0x9320afff com.apple.DirectoryService.Framework 3.3 /System/Library/Frameworks/DirectoryService.framework/Versions/A/DirectoryService
0x946af000 – 0x946cafff com.apple.NetInfo 1.0.0 (???) /System/Library/PrivateFrameworks/NetInfo.framework/Versions/A/NetInfo
0x949ae000 – 0x949bdfff libsasl2.2.dylib /usr/lib/libsasl2.2.dylib
0x949c1000 – 0x949e6fff libssl.0.9.7.dylib /usr/lib/libssl.0.9.7.dylib
0x949f2000 – 0x94a0ffff libresolv.9.dylib /usr/lib/libresolv.9.dylib
0x94bba000 – 0x94c92fff edu.mit.Kerberos 5.5.25 /System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos
0x955f9000 – 0x95617fff com.apple.DirectoryService.PasswordServerFramework 2.1.2 /System/Library/PrivateFrameworks/PasswordServer.framework/Versions/A/PasswordServer

[mledford]

The SSL cert I am using doesn’t have a passphrase.

Michael

[mledford]

After taking a day to cool off and step back from the problem I seemed to have found the bug and a solution to the problem. Thanks to MacTroll, while you didn’t answer correctly you gave me inpiration on something to try.

It seems to be that even if the SSL certificate doesn’t have an passphrase associated with it that slapconfig (the tool used to configure slapd) will place a TLSCertificatePassphraseTool line into /etc/openldap/slapd_macosxserver.conf. Somehow either not having a passphrase or the whole thing not working causes sldapd to crash in a blaze of glory. What I have done is commented out the line and everything is working great now!

Thanks,
Michael

[sparrowhawk]

I have been learning how to secure an OD server, and have worked through the ‘Roll your own CA in Tiger’ article Joel posted on afp548. However, I didn’t notice the gotcha regarding password protecting the key file, so slapd choked and died. I have fixed this by using Michael’s suggestion above, but is this the correct way to do things? Should I really be unwrapping the key file as suggested in Joel’s afp548 article ‘The great big Panther SSL article’?

[Author]

Posts