<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Heikki,</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you for taking a look. The TLS setting is certainly suggestive -- and would explain why it works fine on CentOS 6 and not on Ubuntu 20. I actually got it working with Radiator 4.12 on CentOS 8 -- which is why the increased security stance on Ubuntu
20 looks like a promising avenue to investigate. Unfortunately, none of the suggestions at those links has gotten it working yet. </div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
-p</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-size:13px; font-family:Tahoma">
<div style="font-size:12px; color:rgb(18,48,84); font-family:Arial,Helvetica,sans-serif; background-color:rgb(255,255,255)">
<p class="MsoNormal"><span style="color:#1F497D">--<br>
</span><span style="color:rgb(31,73,125)">Pat Hirayama<br>
</span><span style="font-family:Arial,Helvetica,sans-serif; font-size:12px; color:rgb(31,73,125)">Systems Engineer | CIT / Systems Engineering | 206.667.4856 |
</span><a href="mailto:phirayam@fredhutch.org" style="font-family:Arial,Helvetica,sans-serif; font-size:12px">phirayam@fredhutch.org</a><span style="font-family:Arial,Helvetica,sans-serif; font-size:12px; color:rgb(31,73,125)"> | Fred Hutch | Cures Start Here</span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> radiator <radiator-bounces@lists.open.com.au> on behalf of Heikki Vatiainen <hvn@open.com.au><br>
<b>Sent:</b> Monday, January 18, 2021 05:07<br>
<b>To:</b> radiator@lists.open.com.au <radiator@lists.open.com.au><br>
<b>Subject:</b> Re: [RADIATOR] ERR: AuthLDAP2 Could not open LDAP connection to AD domain controllers</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">On 16.1.2021 1.55, Hirayama, Pat wrote:<br>
<br>
> I am currently trying to migrate an existing Radiator 4.12.1 running on <br>
> CentOS 6.10 to Radiator 4.25 running on Ubuntu 20.04.1 LTS. I am running <br>
> into an issue where Radiator 4.25 is unable to connect via LDAP to my <br>
> domain controllers. The log shows (DC names changed):<br>
> <br>
> 00000000 Fri Jan 15 15:26:35 2021 089445: INFO: AuthLDAP2 Connecting to <br>
> DC1.domain.tld port 3269<br>
> <br>
> 00000000 Fri Jan 15 15:26:35 2021 124694: ERR: AuthLDAP2 Could not open <br>
> LDAP connection to DC1.domain.tld port 3269. Backing off for 10 seconds.<br>
<br>
Ubuntu 20.04 uses OpenSSL with settings that may require additional <br>
configuration on Radiator side. See this for more:<br>
<br>
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__askubuntu.com_questions_1233186_ubuntu-2D20-2D04-2Dhow-2Dto-2Dset-2Dlower-2D&d=DwIF-g&c=eRAMFD45gAfqt84VtBcfhQ&r=lnQBMkNb1mBsioi6aP6ts4Sw0Ua5nVh4esYOAh4qTKU&m=P_PsEJGy2OCSSv-o70ULtptuzjtI3l6Ht4An17GQMBE&s=5VsLLOH8aeHHuiZZstOY6dhd-ktmCVCVFitwf_uMapA&e=">https://urldefense.proofpoint.com/v2/url?u=https-3A__askubuntu.com_questions_1233186_ubuntu-2D20-2D04-2Dhow-2Dto-2Dset-2Dlower-2D&d=DwIF-g&c=eRAMFD45gAfqt84VtBcfhQ&r=lnQBMkNb1mBsioi6aP6ts4Sw0Ua5nVh4esYOAh4qTKU&m=P_PsEJGy2OCSSv-o70ULtptuzjtI3l6Ht4An17GQMBE&s=5VsLLOH8aeHHuiZZstOY6dhd-ktmCVCVFitwf_uMapA&e=</a>
<br>
ssl-security-level<br>
<br>
I'll take a look at this in detail too, but you can see if something <br>
like this within AuthBY LDAP2 would help:<br>
<br>
SSLCiphers DEFAULT@SECLEVEL=1<br>
<br>
For more about Radiator parameters, see <br>
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__files.radiatorsoftware.com_radiator_ref.pdf&d=DwIF-g&c=eRAMFD45gAfqt84VtBcfhQ&r=lnQBMkNb1mBsioi6aP6ts4Sw0Ua5nVh4esYOAh4qTKU&m=P_PsEJGy2OCSSv-o70ULtptuzjtI3l6Ht4An17GQMBE&s=lw3CUKx7Xoxb94A6tWY5T_YUIMGxfITjRs9HU1XhMjo&e=">https://urldefense.proofpoint.com/v2/url?u=https-3A__files.radiatorsoftware.com_radiator_ref.pdf&d=DwIF-g&c=eRAMFD45gAfqt84VtBcfhQ&r=lnQBMkNb1mBsioi6aP6ts4Sw0Ua5nVh4esYOAh4qTKU&m=P_PsEJGy2OCSSv-o70ULtptuzjtI3l6Ht4An17GQMBE&s=lw3CUKx7Xoxb94A6tWY5T_YUIMGxfITjRs9HU1XhMjo&e=</a>
<br>
<br>
SSLCiphers is described in 3.9.17 in Radiator 4.25 manual.<br>
<br>
What you could also check is that what are the TLS versions and ciphers <br>
the server supports. It can be that what the server uses is not <br>
considered good enough on the client side.<br>
<br>
Thanks,<br>
Heikki<br>
<br>
-- <br>
Heikki Vatiainen <hvn@open.com.au><br>
<br>
Radiator: the most portable, flexible and configurable RADIUS server<br>
anywhere. SQL, proxy, DBM, files, LDAP, TACACS+, PAM, Active Directory,<br>
EAP, TLS, TTLS, PEAP, WiMAX, RSA, Vasco, Yubikey, HOTP, TOTP,<br>
DIAMETER etc. Full source on Unix, Windows, MacOSX, Solaris, VMS, etc.<br>
_______________________________________________<br>
radiator mailing list<br>
radiator@lists.open.com.au<br>
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.open.com.au_mailman_listinfo_radiator&d=DwIF-g&c=eRAMFD45gAfqt84VtBcfhQ&r=lnQBMkNb1mBsioi6aP6ts4Sw0Ua5nVh4esYOAh4qTKU&m=P_PsEJGy2OCSSv-o70ULtptuzjtI3l6Ht4An17GQMBE&s=MXgO7q6X-wzG5qE1aOlgKTX2xXg0q0PyIo5wqDvtweI&e=">https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.open.com.au_mailman_listinfo_radiator&d=DwIF-g&c=eRAMFD45gAfqt84VtBcfhQ&r=lnQBMkNb1mBsioi6aP6ts4Sw0Ua5nVh4esYOAh4qTKU&m=P_PsEJGy2OCSSv-o70ULtptuzjtI3l6Ht4An17GQMBE&s=MXgO7q6X-wzG5qE1aOlgKTX2xXg0q0PyIo5wqDvtweI&e=</a>
<br>
</div>
</span></font></div>
</div>
</body>
</html>