openldap-bugs

openldap-bugs@openldap.org

1 participants
20959 discussions

Re: (ITS#6477) Clarify ambiguous TLS/SSL Errors in libldap/tls2c.
by tjoen＠dds.nl 08 Mar '10

08 Mar '10

On Mon, 2010-03-08 at 16:19 +0000, korvus(a)comcast.net wrote: > After some chatter on the mailing list, the problem is now understood: > - TLS error messages are indeed reported by OpenLDAP: > TLS: could not use key file `/usr/local/etc/openldap/certs/ldap.key.pem'. ... > - The only way to see these error messages is to start the daemon with > '-d stats' ... > My suggestions: print the TLS error messages out to syslog, or if that's > not possible, print them to stdout regardless of whether the daemon is > running in the foreground or not. Isn't it in local4.* ?

1 0

Re: (ITS#6477) Clarify ambiguous TLS/SSL Errors in libldap/tls2c.
by korvus＠comcast.net 08 Mar '10

08 Mar '10

After some chatter on the mailing list, the problem is now understood: - TLS error messages are indeed reported by OpenLDAP: TLS: could not use key file `/usr/local/etc/openldap/certs/ldap.key.pem'. TLS: error:0200100D:system library:fopen:Permission denied /usr/src/secure/lib/libcrypto/../../../crypto/openssl/crypto/bio/bss_file.c:356 TLS: error:20074002:BIO routines:FILE_CTRL:system lib /usr/src/secure/lib/libcrypto/../../../crypto/openssl/crypto/bio/bss_file.c:358 TLS: error:140B0002:SSL routines:SSL_CTX_use_PrivateKey_file:system lib /usr/src/secure/lib/libssl/../../../crypto/openssl/ssl/ssl_rsa.c:648 - The only way to see these error messages is to start the daemon with '-d stats' -- Setting 'loglevel stats' in slapd.conf will not cause these error messages to be printed. They only appear if the daemon is started in foreground mode with '-d stats'. My suggestions: print the TLS error messages out to syslog, or if that's not possible, print them to stdout regardless of whether the daemon is running in the foreground or not.

1 0

(ITS#6488) Nssov updates for new versions of nss-pam-ldapd
by crispy＠cluenet.org 07 Mar '10

07 Mar '10

Full_Name: Chris Breneman Version: 2.4.21 OS: Debian Lenny URL: http://scalar.cluenet.org/~crispy/nssov-nsspamldapd-update.patch Submission from: (NULL) (98.212.227.43) The nssov overlay currently includes a very old version of the nss-ldapd (now nss-pam-ldapd) source. It's not necessary to keep a source tree of nss-pam-ldapd within openldap now, as the patches for pam_ldap support in the stub library were integrated upstream. This patch removes the nss-ldapd source tree from nssov, except for a few files which are unlikely to change, and on which nssov depends. This patch also updates nssov to support the newer versions of nss-pam-ldapd. There were some organizational changes, header changes, and changes of the names of constants since the version of nss-ldapd that is currently in the source. This patch also removes the dependence on the configure script of nss-ldapd. Currently, the configure script has to be run in the nss-ldapd subdirectory to generate a few constants which are needed by the parts of nss-ldapd that nssov depends on. These same constants are generated by the openldap configure script, and this patch changes the include path to include the relevant header from the openldap configure script, instead of requiring a separate configure script from nss-ldapd. This patch also updates the nssov Makefile to use the new nss-pam-ldapd files location and to create an install target that is separate from the all target. The README and man page are updated to reflect that nss-ldapd is no longer included in the source, and point to where to get it. They are also changed to reflect the new name of nss-ldapd: nss-pam-ldapd The patch is at: http://scalar.cluenet.org/~crispy/nssov-nsspamldapd-update.patch It applies on the nssov directory.

1 0

Re: (ITS#6486) OpenLDAP Admin Guide Backends Documentation
by hyc＠symas.com 05 Mar '10

05 Mar '10

ghenry(a)OpenLDAP.org wrote: > Thanks Ryan. > > I'll make sure this gets updated when I work through updating everything for cn=config syntax. > > Gavin. I already committed a patch to HEAD... http://www.openldap.org/lists/openldap-commit/201003/msg00007.html -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6486) OpenLDAP Admin Guide Backends Documentation
by ghenry＠OpenLDAP.org 05 Mar '10

05 Mar '10

Thanks Ryan. I'll make sure this gets updated when I work through updating everything for cn=config syntax. Gavin. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

(ITS#6487) Nssov pam_authz authorizedUserService
by crispy＠cluenet.org 04 Mar '10

04 Mar '10

Full_Name: Chris Breneman Version: 2.4.21 OS: Debian Lenny URL: http://paste.cluenet.org/pastebin.php?dl=2648 Submission from: (NULL) (98.212.227.43) My organization needs the capability of per-user (instead of per-group) access control with nssov. Using the method of modifying slapd ACLs to grant or revoke compare privileges on the authorizedService attribute of the host object is not scalable with large numbers of users, each of which have individual access. This patch adds an attribute "authorizedUserService" for use in a host entry. The attribute is in the form of "UID:SERVICE". If an attribute value for the user and service exists, access is granted. Otherwise access is denied. Wildcards in the form of "UID:*", "*:UID", and "*:*" are also supported. This patch also fixes a minor bug in the pam_authz function. Currently, one of the values read from NSCLD is used as a string in a Debug statement without initializing a NULL terminator. The patch extends the lengths of each buffer by 1 and initializes them to 0 so each buffer is always null-terminated and can be used as a string. The patch applies to the latest CVS HEAD as of this report, since several changes have been made in that region of code since 2.4.21. The patch is at http://paste.cluenet.org/pastebin.php?dl=2648 or http://paste.cluenet.org/2648

1 0

Re: (ITS#6485) nssov pam_authz fixes
by hyc＠symas.com 03 Mar '10

03 Mar '10

crispy(a)cluenet.org wrote: > Full_Name: Chris Breneman > Version: 2.4.21 > OS: Debian Lenny > URL: > Submission from: (NULL) (98.212.227.43) > > > In pam_authz(), in pam.c, in nssov, there are two problems: > > 1. Values in the service buffer are overwritten, and values in several other > buffers are never stored, preventing authorizedService checking from working. > 2. pam_authz() fails if nssov is not first used for authentication. Thanks for reporting these, fixes are in HEAD. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6433) patch for the sha2 module: hash methods for passwords generation
by hyc＠symas.com 03 Mar '10

03 Mar '10

cdelfosse(a)mandriva.com wrote: > Full_Name: Cédric Delfosse > Version: HEAD > OS: Mandriva Linux > URL: ftp://ftp.openldap.org/incoming/cedric-delfosse-091221.patch > Submission from: (NULL) (62.212.120.90) > > > Hello, > > this patch allows to use the {SHA256}, {SHA384} and {SHA512} password schemes > (provided by the sha2 module) with LDAP Password Modify Extended Operations. > This patch contains the required hash methods. > > This patch file is derived from OpenLDAP Software. All of the modifications to > OpenLDAP Software represented in the following patch(es) were developed by > Mandriva. Mandriva has not assigned rights and/or interest in this work to any > party. I, Cédric Delfosse am authorized by Mandriva, my employer, to release > this work under the following terms. > > Mandriva hereby place the following modifications to OpenLDAP Software (and only > these modifications) into the public domain. Hence, these modifications may be > freely used and/or redistributed for any purpose with or without attribution > and/or other notice. > > Regards, > > Cédric > Thanks, nice work. Committed in HEAD. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#6486) OpenLDAP Admin Guide Backends Documentation
by ryans＠aweber.com 03 Mar '10

03 Mar '10

Full_Name: Ryan Steele Version: 2.4.18 OS: Ubuntu Server URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (207.106.239.81) The Admin Guide section on backends is inconsistent in terms of specifying the moduleload statement, and whether or not it is required for any arbitrary backend. For example, the documentation on back-ldif explicitly states that it is not needed: >You'll notice that when compared to examples below, there is no: > > moduleload back_ldif.la > >directive. This is because back_ldif is always built in by default as it is used by >slapd-config(5), which again is built in by default. This is in contrast to the monitor backend configuration section where it is noted as being required: >You can however set a rootdn and rootpw. The following is all that is needed to >instantiate a monitor backend: > > include ./schema/core.schema > > modulepath /usr/local/libexec/openldap > moduleload back_monitor.la > > database monitor > rootdn "cn=monitoring,cn=Monitor" > rootpw monitoring Or, in the back-ldap configuration section, where mention is omitted entirely: > database ldap > suffix "dc=suretecsystems,dc=com" > rootdn "cn=slapd-ldap" > uri ldap://localhost/ ldap://remotehost ldap://remotehost2 I should note that this ITS is not referring sections in which the configuration section for a backend is missing entirely (such as back-meta), because IMHO the lack of information there precludes it from being subject to the aforementioned ambiguity. I made sure to check with #openldap on Freenode (2010-03-03, 14:05 EST) before submitting this ITS, and have made sure to obtain Howard's blessing: <hyc> go ahead and submit an ITS. I don't think you need to attach a patch. <hyc> probably we'll just add a bluurb at the top "if your installation uses dynamic modules, you may need to add the relevant moduleload directives to the following examples" <hyc> and leave it at that.

1 0

(ITS#6485) nssov pam_authz fixes
by crispy＠cluenet.org 03 Mar '10

03 Mar '10

Full_Name: Chris Breneman Version: 2.4.21 OS: Debian Lenny URL: Submission from: (NULL) (98.212.227.43) In pam_authz(), in pam.c, in nssov, there are two problems: 1. Values in the service buffer are overwritten, and values in several other buffers are never stored, preventing authorizedService checking from working. 2. pam_authz() fails if nssov is not first used for authentication.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs