openldap-bugs

openldap-bugs@openldap.org

1 participants
20953 discussions

RE: (ITS#4756) IPv6 Addresses are not supported in ACL peername
by Damon.Groenveld＠ca.com 16 Nov '06

16 Nov '06

Given that the code (in aclparse.c) calls inet_addr() with the peername.ip parameter, I can't see how it could will work with IPv6. The only possible workaround is using a regex instead of ip type which by passes the inet_addr() call. I raised it as a bug since the latest version (as far as I can tell) is meant to support IPv6 and there is no way that peername.ip does and there isn't an alternative. I asked the question regarding other ways to restrict access since I noted that the documentation mentions TCP Wrappers and has a see also of host_options(5) -- which does not exist, so I was hoping that some advice might come while someone looked at the problem (if or when it was deemed important enough). Damon Groenveld CA Architect, Development tel: +61 3 9727 8920 fax: +61 3 9727 3491 mobile: +61 419 922 326 damon.groenveld(a)ca.com -----Original Message----- From: Howard Chu [mailto:hyc@symas.com] Sent: Friday, 17 November 2006 4:59 PM To: Groenveld, Damon Cc: openldap-its(a)openldap.org Subject: Re: (ITS#4756) IPv6 Addresses are not supported in ACL peername damon.groenveld(a)ca.com wrote: > Full_Name: Damon Groenveld > Version: LATEST > OS: Solaris, WinXP, Linux, AIX, HP-UX > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (60.224.6.218) > > > There does not seem to be the ability to specify an IPv6 address in the peername > part of the ACL. > > Is there any other way to restrict access to a host IP address when using only > IPv6 addresses? Software usage questions should be directed to the OpenLDAP-software mailing list. There is no indication of a bug here, most likely this report should be closed. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

1 0

Re: (ITS#4756) IPv6 Addresses are not supported in ACL peername
by hyc＠symas.com 16 Nov '06

16 Nov '06

damon.groenveld(a)ca.com wrote: > Full_Name: Damon Groenveld > Version: LATEST > OS: Solaris, WinXP, Linux, AIX, HP-UX > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (60.224.6.218) > > > There does not seem to be the ability to specify an IPv6 address in the peername > part of the ACL. > > Is there any other way to restrict access to a host IP address when using only > IPv6 addresses? Software usage questions should be directed to the OpenLDAP-software mailing list. There is no indication of a bug here, most likely this report should be closed. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

1 0

(ITS#4756) IPv6 Addresses are not supported in ACL peername
by damon.groenveld＠ca.com 16 Nov '06

16 Nov '06

Full_Name: Damon Groenveld Version: LATEST OS: Solaris, WinXP, Linux, AIX, HP-UX URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (60.224.6.218) There does not seem to be the ability to specify an IPv6 address in the peername part of the ACL. Is there any other way to restrict access to a host IP address when using only IPv6 addresses?

1 0

Re: (ITS#4755) Show peer's name when syncrepl fails
by daveh＠ci.com.au 16 Nov '06

16 Nov '06

On Thu, 16 Nov 2006, Howard Chu wrote: > Since the rid is supposed to be unique, would you settle for that? > Particularly since there may be multiple sessions to the same host... Yes, that will do nicely. In the meantime I was getting it to print si->si_bindconf.sb_uri.bv_val, as I sort of need it right now... -- Dave Horsfall DTM VK2KFU daveh(a)ci.com.au Ph: +61 2 9552-5509 (d) -5500 (sw) Corinthian Eng'ng P/L, Ste 54 Jones Bay Whf, 26-32 Pirrama Rd, Pyrmont 2009, AU

1 0

Re: (ITS#4755) Show peer's name when syncrepl fails
by hyc＠symas.com 16 Nov '06

16 Nov '06

daveh(a)ci.com.au wrote: > Full_Name: Dave Horsfall > Version: 2.3.27 > OS: FreeBSD 4.10 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (192.65.182.30) > > > We have a mesh of 10 OpenLDAP servers replicating to each other (don't ask). > Should a syncrepl fail, it would be good to know just which peer was causing the > trouble. Could this name (or IP address, or syncrepl host etc) be passed to the > Debug() call? Since the rid is supposed to be unique, would you settle for that? Particularly since there may be multiple sessions to the same host... -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

1 0

(ITS#4755) Show peer's name when syncrepl fails
by daveh＠ci.com.au 16 Nov '06

16 Nov '06

Full_Name: Dave Horsfall Version: 2.3.27 OS: FreeBSD 4.10 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (192.65.182.30) We have a mesh of 10 OpenLDAP servers replicating to each other (don't ask). Should a syncrepl fail, it would be good to know just which peer was causing the trouble. Could this name (or IP address, or syncrepl host etc) be passed to the Debug() call?

1 0

Re: (ITS#4754) Allow a Consumer Syncrepl credentials= to be encrypted liek rootpw
by hyc＠symas.com 16 Nov '06

16 Nov '06

ghenry(a)suretecsystems.com wrote: > Full_Name: Gavin Henry > Version: 2.4 > OS: FC6 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (212.159.59.85) > > > Dear All, > > In 2.4 would it be possible to let the "credentials" setting under "syncrepl" in > a consumer to be encrypted, and not plain text, like the rootpw can be? No, that is impossible. A syncrepl consumer is a client. A client must have the plaintext in order to authenticate. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

1 0

Re: (ITS#4754) Allow a Consumer Syncrepl credentials= to be encrypted liek rootpw
by ando＠sys-net.it 16 Nov '06

16 Nov '06

ghenry(a)suretecsystems.com wrote: > In 2.4 would it be possible to let the "credentials" setting under "syncrepl" in > a consumer to be encrypted, and not plain text, like the rootpw can be? > Please don't use the ITS to ask software usage (or development trends) questions. The syncrepl consumer acts as a client with respect to the producer DSA; as a consequence, to be able to perform simple bind, it needs to provide the credentials in cleartext. Either you use a bindmethod different from simple (e.g. SASL) which does not require cleartext credentials (e.g. GSSAPI) or you'll ever need to provide cleartext credentials. This ITS will be closed. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

(ITS#4754) Allow a Consumer Syncrepl credentials= to be encrypted liek rootpw
by ghenry＠suretecsystems.com 16 Nov '06

16 Nov '06

Full_Name: Gavin Henry Version: 2.4 OS: FC6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (212.159.59.85) Dear All, In 2.4 would it be possible to let the "credentials" setting under "syncrepl" in a consumer to be encrypted, and not plain text, like the rootpw can be? Many thanks, Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

ITS#3812 database config documentation
by hyc＠symas.com 16 Nov '06

16 Nov '06

I've committed a preliminary slapd-config.5 manpage to HEAD. In anticipation of deleting slurpd from RE24, I have commented out all of the slurpd-related keywords. Most of the text is the same as in slapd.conf(5) but I've changed the organization to better reflect the actual implementation. There may be options that I've missed. Please review and send patches / corrections / comments. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs