<html><head>
<meta name="Generator" content="Novell Groupwise Client (Version 14.0.2 Build: 120664)">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head>
<body style="font: 10pt/normal Segoe UI; font-size-adjust: none; font-stretch: normal;"><div class="GroupWiseMessageBody" id="GroupWiseSection_1445304569000_klarson@k12group.net_59511A0513870000BD1BF681F57056B0_"><div>Running on OpenSuSE. Thank you for the suggestions.<br></div><div class="GroupWiseMessageBody" id="GroupWiseSection_1445262497000_jpreston@redhat.com"><span class="GroupwiseReplyHeader">>>> Josh Preston <jpreston@redhat.com> 10/19/2015 9:48 AM >>><br></span><div><div>Keith,<br><br>SELinux? Check if you are running SELinux in Enforcing mode:<br><br> # getenforce<br><br>If you are, check what booleans have been enabled for Apache:<br><br> # getsebool -a | grep httpd<br><br>You're probably interested in:<br><br> * httpd_can_connect_ldap<br><br>Set httpd_can_connect_ldap appropriately:<br><br> # setsebool -P httpd_can_connect_ldap on<br><br>If you are running LDAP on a non-standard port, you might need to set the port appropriately for SELinux:<br><br> # semanage port -a -t ldap_port_t -p tcp 1389<br> # semanage port -a -t ldap_port_t -p udp 1389<br><br>Additionally, you could also try adding the CA and/or SSL certificate to your systems trusted store.<br><br>Josh Preston, RHCE<br>Cloud Infrastructure Solutions Architect<br>North America Central, Red Hat, Inc.<br>e jpreston@redhat.com<br>m 614-619-1959<br><a href="https://www.linkedin.com/in/mrjoshuap">https://www.linkedin.com/in/mrjoshuap</a><br><br><br>----- Original Message -----<br>From: "Tom Hanlon" <tom@functionalmedia.com><br>To: "Central OH Linux User Group - 432xx" <colug-432@colug.net><br>Sent: Saturday, October 17, 2015 12:14:51 AM<br>Subject: Re: [colug-432] secure ldap via php page<br><br>It has been a while since I have done PHP stuff, but here are some thoughts.. <br><br>Have you tried to run the script as the apache user. <br><br>Assuming the user is webuser <br><br>su - webuser <br><br>php yourphp.php <br><br>Also apache has logs, ldap has logs, see what those show you. <br><br>-- <br>Tom <br><br>On Wed, Oct 14, 2015 at 3:14 PM, Keith Larson < klarson@k12group.net > wrote: <br><br><br><br>I have a php script that works fine when I run it interactively at a bash prompt <br>php myscript.php <br>part of what it does is establish a secure ldap connection. the cert used for ldaps is self-signed. this doesn't present a problem running it manually. <br>when i execute that exact same command from a php web page it fails to establish the connection. <br>is this a permissions issue with the user that is running apache? or does apache need something to trust the self-signed cert? <br><br>_______________________________________________ <br>colug-432 mailing list <br>colug-432@colug.net <br><a href="http://lists.colug.net/mailman/listinfo/colug-432">http://lists.colug.net/mailman/listinfo/colug-432</a> <br><br><br><br>_______________________________________________<br>colug-432 mailing list<br>colug-432@colug.net<br><a href="http://lists.colug.net/mailman/listinfo/colug-432">http://lists.colug.net/mailman/listinfo/colug-432</a><br>_______________________________________________<br>colug-432 mailing list<br>colug-432@colug.net<br><a href="http://lists.colug.net/mailman/listinfo/colug-432">http://lists.colug.net/mailman/listinfo/colug-432</a><br></div></div></div></div></body></html>