Приветствую уважаемое комюнити!
Прошу помочь разобраться где проблема..
Пытаюсь заставить Bacula работать через TLS.
ключи генерил так:
openssl req -new -newkey rsa:4096 -nodes -out pdc.csr -keyout pdc.key -subj «/C=DE/ST=NRW/L=City/O=firma/OU=BaculaPDC/CN=dus-pdc-01.nmedia.local-fd»
подписывал:
openssl ca -in pdc.csr -config /etc/ssl/openssl.cnf
Конфиг на серверной стороне:
bacula-dir:
Director { # define myself
16 Name = dus-backup-01-dir
17 DIRport = 9101 # where we listen for UA connections
18 QueryFile = «/etc/bacula/scripts/query.sql»
19 WorkingDirectory = «/var/lib/bacula»
20 PidDirectory = «/var/run/bacula»
21 Maximum Concurrent Jobs = 20
22 Password = «pass» # Console password
23 Messages = Daemon
24 #DirAddress = 192.168.5.6
25 DirAddress = dus-backup-01-dir
26 TLS Certificate = /etc/bacula/certs/bacula.backup.crt
27 TLS Key = /etc/bacula/certs/backup.key
28 TLS CA Certificate File = /etc/ssl/certs/cacert.pem
29 TLS Enable = yes
30 TLS Require = no
31 TLS Verify Peer = yes
32 TLS Allowed CN = «dus-pdc-01.nmedia.local-fd»
33 TLS Allowed CN = «dus-pdc-01.nmedia.local»
34 TLS Allowed CN = «dus-pdc-01»
35 TLS Allowed CN = «dus-backup-01-dir»
36 }
Client {
565 Name = dus-pdc-01.nmedia.local-fd
566 Address = dus-pdc-01.nmedia.local-fd
567 FDPort = 9102
568 Catalog = MyCatalog
569 Password = «pass»
570 File Retention = 1 month
571 Job Retention = 1 month
572 AutoPrune = yes
573 Maximum Concurrent Jobs = 20
574 TLS Certificate = /etc/bacula/certs/bacula.pdc.crt
575 TLS Key = /etc/bacula/certs/pdc.key
576 TLS CA Certificate File = /etc/ssl/certs/cacert.pem
577 TLS Enable = yes
578 TLS Require = yes
579 }
Storage {
583 Name = File
584 #Address = DUS-BACKUP-01 # N.B. Use a fully qualified name here
585 Address = dus-backup-01-dir # N.B. Use a fully qualified name here
586 SDPort = 9103
587 Password = «pass»
588 Device = localRaid
589 Media Type = File
590 Maximum Concurrent Jobs = 20
591 TLS Enable = yes
592 TLS Require = yes
593 TLS Certificate = /etc/bacula/certs/bacula.backup.crt
594 TLS Key = /etc/bacula/certs/backup.key
595 TLS CA Certificate File = /etc/ssl/certs/cacert.pem
596 }
bacula-sd:
Storage { # definition of myself
14 Name = dus-backup-01-sd
15 SDPort = 9103 # Director's port
16 WorkingDirectory = «/var/lib/bacula»
17 Pid Directory = «/var/run/bacula»
18 Maximum Concurrent Jobs = 20
19 #SDAddress = 192.168.5.6
20 SDAddress = dus-backup-01-dir
21 TLS Certificate = /etc/bacula/certs/bacula.backup.crt
22 TLS Key = /etc/bacula/certs/backup.key
23 TLS CA Certificate File = /etc/ssl/certs/cacert.pem
24 TLS Enable = yes
25 TLS Require = yes
26 #TLS Verify Peer = no
27 }
28
29 #
30 # List Directors who are permitted to contact Storage daemon
31 #
32 Director {
33 Name = dus-backup-01-dir
34 Password = «pass»
35 TLS Certificate = /etc/bacula/certs/bacula.backup.crt
36 TLS Key = /etc/bacula/certs/backup.key
37 TLS CA Certificate File = /etc/ssl/certs/cacert.pem
38 TLS Enable = yes
39 TLS Require = yes
40 }
bacula-fd:
Director {
14 Name = dus-backup-01-dir
15 Password = «pass»
16 TLS Certificate = /etc/bacula/certs/bacula.backup.crt
17 TLS Key = /etc/bacula/certs/backup.key
18 TLS CA Certificate File = /etc/ssl/certs/cacert.pem
19 TLS Enable = yes
20 TLS Require = yes
21 }
22
23
FileDaemon { # this is me
42 Name = dus-backup-01-fd
43 FDport = 9102 # where we listen for the director
44 WorkingDirectory = /var/lib/bacula
45 Pid Directory = /var/run/bacula
46 Maximum Concurrent Jobs = 20
47 #FDAddress = 192.168.5.6
48 FDAddress = dus-backup-01-dir
49 TLS Certificate = /etc/bacula/certs/bacula.backup.crt
50 TLS Key = /etc/bacula/certs/backup.key
51 TLS CA Certificate File = /etc/ssl/certs/cacert.pem
52 TLS Enable = yes
53 TLS Require = yes
54 }
Клиентская сторона
bacula-fd:
Director {
14 Name = dus-backup-01-dir
15 Password = «pass»
16 TLS Certificate = /etc/bacula/certs/bacula.backup.crt
17 TLS Key = /etc/bacula/certs/backup.key
18 TLS CA Certificate File = /etc/ssl/certs/cacert.pem
19 TLS Enable = yes
20 TLS Require = yes
21 TLS Allowed CN = «dus-pdc-01.nmedia.local-fd»
22 TLS Allowed CN = «dus-pdc-01.nmedia.local»
23 TLS Allowed CN = «dus-pdc-01»
24 TLS Allowed CN = «dus-backup-01-dir»
25 }
26
27
40 FileDaemon { # this is me
41 Name = dus-pdc-01.nmedia.local-fd
42 FDport = 9102 # where we listen for the director
43 WorkingDirectory = /var/lib/bacula
44 Pid Directory = /var/run/bacula
45 Maximum Concurrent Jobs = 20
46 FDAddress = dus-pdc-01.nmedia.local-fd
47 TLS Certificate = /etc/bacula/certs/bacula.pdc.crt
48 TLS Key = /etc/bacula/certs/pdc.key
49 TLS CA Certificate File = /etc/ssl/certs/cacert.pem
50 TLS Enable = yes
51 TLS Require = yes
52 }
При попытке запросить статус или выполнить задание получаю следующее:
27-Aug 16:43 dus-backup-01-dir JobId 0: Fatal error: bnet.c:343 TLS host certificate verification failed. Host name «dus-pdc-01.nmedia.local-fd» did not match presented certificate
27-Aug 16:43 dus-backup-01-dir JobId 0: Fatal error: TLS negotiation failed with FD at «dus-pdc-01.nmedia.local-fd:9102».
Пробовал генерить ключи с разными CN и при этом править конфиг под CN, ничего не помагает. Без tls все работает замечательно.
И еще одна странность tls для локального клиента работает.
Подскажите пожалуйста, что не так?
