FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Redhat > Fedora Directory

 
 
LinkBack Thread Tools
 
Old 06-10-2011, 07:46 PM
Rich Megginson
 
Default SSL/TLS with a hardware load balancer

On 06/10/2011 01:20 PM, Beamon, John wrote:

Has anyone engineered a design to run 389-ds servers behind a hardware load balancer like an f5 LTM? I've found this question presented before, but never answered.

a) the openldap-clients ldap module will query the first host/uri in the list until the port goes down
b) the server can run out of file descriptors or memory and stop answering queries without closing the port





c) pointing clients at a virtualized name on a hardware LB will present a name conflict. The SSL cert on the directory server must match the v-name on the LB to answer queries, but it must match the local hostname for replication agreements.


http://directory.fedoraproject.org/wiki/Howto:SSL#Using_Subject_Alt_Name



I have not found an example where someone has started a second, replication-only listener on the database or configured an LTM to accept multiple v-names... This may be feasible with a robust SSL accelerator, but we don't have one on hand.


John Beamon




--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users





--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
 
Old 06-10-2011, 07:49 PM
 
Default SSL/TLS with a hardware load balancer

Hi Beamon,!

On Fri, 10 Jun 2011, Beamon, John wrote:

> Has anyone engineered a design to run 389-ds servers behind a hardware load balancer like an f5 LTM? I've found this question presented before, but never answered.
>
> a) the openldap-clients ldap module will query the first host/uri in the list until the port goes down

Not a problem here. Most load balancers (including F5s) can be set up
with an active/passive config.

> b) the server can run out of file descriptors or memory and stop answering queries without closing the port

Assuming you can run a health check that does an LDAP query, this should
be no problem. I've done this with LDAP on Foundry devices.

> c) pointing clients at a virtualized name on a hardware LB will present a name conflict. The SSL cert on the directory server must match the v-name on the LB to answer queries, but it must match the local hostname for replication agreements.

Not really a problem if you use Subject Alternate Names on your
certificates, or wildcard certs, depending on your network architecture
and other considerations.

This stuff's all pretty doable -- I've been doing it here for almost a
decade now.
--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
 
Old 06-10-2011, 08:27 PM
Angel Bosch Mora
 
Default SSL/TLS with a hardware load balancer

----- Missatge original -----
> Has anyone engineered a design to run 389-ds servers behind a hardware
> load balancer like an f5 LTM? I've found this question presented
> before, but never answered.
>
> a) the openldap-clients ldap module will query the first host/uri in
> the list until the port goes down
> b) the server can run out of file descriptors or memory and stop
> answering queries without closing the port
> c) pointing clients at a virtualized name on a hardware LB will
> present a name conflict. The SSL cert on the directory server must
> match the v-name on the LB to answer queries, but it must match the
> local hostname for replication agreements.
>


cd /etc/dirsrv/<instance>

certutil -R -s "CN=hostname,OU=example,O=example,L=example,ST=exa mple,C=example" -o example.csr -d . -a -8 hostname.example.com,ldap.example.com,repl.another .one


this is the only step that can't be done through gui, the rest is in the official docs.



abosch
--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
 

Thread Tools




All times are GMT. The time now is 08:18 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org