openldap-software February 2008

openldap-software@openldap.org

86 participants
94 discussions

ssf=0 for localhost
by Nathan Huesken 21 Feb '08

21 Feb '08

Hello together, I have setup ldap with tls. To disallow users to authenticate without security form differenct computers, I added security ssf=64 to slapd.conf. Now I want local users (connections from localhost) to allow authenticating without any tls or SASL. I added: localSSF 0 But it does not work :(. I get the "Confidentiality required (13)" error. How can it be done? Thanks! nathan

2 1

slapd does not answer in time
by Hans Moser 21 Feb '08

21 Feb '08

Hi! I have a 4 cpu machine with SLES 9 and OpenLDAP 2.3.35. This is master to about 65 slaves via syncreplication. These slave were set up subsequently without any problem. In the last time every now and then the master cannot answer searches in time. Clients time out - i.e. Postfix doing address verification. This may have to do with writes to the master and the replication. The worst time was, when I had to reinitialize about 15 to 20 slaves and these slave checked the master to get in sync.* Other clients got no answer for a long long time. :( The iron is idle. Load average is 0.00. There were limiting factors like file number etc, which limited process numbers, but this was solved in the mean time. Which number of connections to the master does a replication slave open? How can I find out, what is limiting slapd and keep him from responding in time? Log files does not give me a hint, but I don't really know what to search for. * I take a "top level" ldif file to start the server up - ou=bla,o=foo, ou=log,ou=bla,o=foo and ou=humans,ou=bla,o=foo - and the latest hourly branch dump (these slave only replicate one branch from the master server) - ou=humans,ou=bla,o=foo - from the master to fill the server. In this case the slave contains all the data, but checks ALL entries to be "up to date". Is there a way to prevent this? The slave does only have to check for changes that happened in the last hour (since the dump). Hans

5 5

Re: Write changed immediately to disk
by Buchan Milne 21 Feb '08

21 Feb '08

On Thursday 21 February 2008 17:20:41 ml(a)bortal.de wrote: > Hello List, > > i was busy the last few days so i could not investigate in this thread. > > My System: > - Ubuntu Dapper 6.06 > - OpenLdap 2.2.26 > - Database: dbd > > Problem: > --------- > I need to restart slapd each time after i make a change. If i do not > restart slapd and reset my server the changes are not beeing saved. > > Example: > ----------- > - Add Samba user to Database > - I Wait 5mins > - Execute "sync" > - reset the box > - The Added user disapears or is not there anymore. > > > It would be no problem is slapd or my OS need like 10 or 20 secs to write > to disk. But after 5 mins i would expect the changed to be saved! This can be solved with a checkpoint statement, and running db_checkpoint -h /path/to/database as the user that runs slapd from cron (2.3 and onwards do checkpoints automatically according to the configuration). However, you should also ensure that db_recover is called before slapd is started. > If i run the example with restarting slapd before the reset then my > database looks fine! Most likely during shutdown, slapd hasn't exited by the time the shutdown script kills all processes. > Any idea how i could fix this? Any workarounds or tips? > There are no OpenLdap Backports for Dapper and i really need to stay with > Dapper. Honestly, bite the bullet and upgrade. You're wasting your time working around issues that are now taken care of for you, and then you're still on a release not supported by the developers. Regards, Buchan

1 0

when to checkpoint?
by Thomas Ledbetter 21 Feb '08

21 Feb '08

So.. Ive been reading up hardcore on Berkeley database administration regarding how to do archival and recovery, and its pretty cool stuff. Yet I have the following questions: Database archival will be done on one of our master servers, so its not necessary to keep alot of old transaction logfiles on the replicas, but in order to clean out them out, a periodic checkpoint is necessary. Initially, I was thinking that we should do this once per day, off hours, but would it make more sense to do this more frequently over the course of the day to keep the checkpoint process less expensive per iteration? What kinds of metrics should be used to determine how frequently this should be done? Second, would there be that great of a performance gain when disabling transaction logging altogether? If I have two master servers keeping, say, a week's worth of transaction logs, a sound archival process, and a backup LDIF, would it make sense to just disable transaction logging altogether across the replicas? Third, I now understand how to do archival and recovery using the Berkeley tools, but is there a 'best practice' document out there anywhere from someone who utilizes this method that I could take a look at to make sure Im not missing anything?

3 2

Restoring with SLAPADD
by Dave Horsfall 21 Feb '08

21 Feb '08

OpenLDAP 2.3.40 and 2.4.7. Testing disaster recovery, such as a bulk update gone wrong, so need to restore from last night's "slapcat" dump (we hardly ever write to the directory, so it's no big deal losing a morning's work). Delete an entry. Oops, I need it back. Stop the master (and slave), "rm *.bdb __*", "slapadd -nX < slap.out", start the master and slave, check the slave, and the deleted entry has reappeared. Is this guaranteed behaviour i.e. the slave will always resynchronise in this case, or was I just lucky? If it makes a difference, we use SyncRepl in "refreshAndPersist" mode. -- Dave Horsfall DTM VK2KFU Ph: +61 2 9552-5509 (direct) +61 2 9552-5500 (switch) Corinthian Eng'ng P/L, Ste 54 Jones Bay Whf, 26-32 Pirrama Rd, Pyrmont 2009, AU

3 4

BDB upgrade from 2.3 to 2.4
by Marcin Giedz 21 Feb '08

21 Feb '08

Hi, I'm preparing for an upgrade to 2.4 release but I've been looking for some documents related to: if it's needed to "dump" and "restore" the whole LDAP database (BDB actually) when changing openldap from 2.3 do 2.4? or perhaps it is irrelevant whether I use 2.3/2.4 BDB remains the same? Regards, Marcin

5 5

account locking strategy
by Guillaume Rousse 21 Feb '08

21 Feb '08

Hello list. I have to handle account locking on our directory, so as to keep accounts from people not working here anymore. On Buchan's suggestion, I used ppolicy sofar, with pwdAccountLockedTime attribute set to 000001010000Z to lock unused account. This is really handy to handle unix account and web applications account at once. However, they are also some drawbacks: - this is an operational account, thus a bit difficult to retrieve/edit (additional search options needed) - its locking value seems to be quite cryptic (but I maybe missed the semantic description somewhere) - it seems to be a binary field only (locked/unlocked), by opposition to shadowMax which allows to set an expiration date in advance. Even a purely cosmetic contract expiration date would be helpful here, but i didn't found anything similar in standard schemas - it doesn't handle easily use case where you just need to extract valid account list (such as scan-to-emails features from copiers), excepted by filtering on this attribute value, which isn't always possible (broken copiers firmware, for instance) Last issue could be workarounded by filtering on ldap side using dynamic group I think. So, does anyone have suggestion on how to handle this better ? -- Guillaume Rousse Moyens Informatiques - INRIA Futurs Tel: 01 69 35 69 62

4 4

translucent overlay to add local entries if they don't exist remotely?
by Andrew Cobaugh 21 Feb '08

21 Feb '08

Question regarding the translucent overlay. Say I wanted to create some entries locally that don't have corresponding remote entries. For example, if the base suffix is dc=foo,dc=bar, and the remote ldap server has, let's call them user entries at uid=myuser,dc=foo,dc=bar, and I wanted to locally create ou=group,dc=foo,dc=bar and put my own group entries in that, is this possible with translucent? Or maybe with a combination of overlays? Ok, I know I can create local-only entries, but any search requests for them fail. Is this what ITS#5283 is supposed to accomplish, without going through the hassle of trying to build HEAD? -- Andy Cobaugh phalenor(a)gmail.com

4 4

Help with 2.4 ACLs
by Duncan Brannen 21 Feb '08

21 Feb '08

An upgrade from 2.3.38 to 2.4.7 seems to have caused my acls to stop working in that anonymous users can no longer search the tree to find their entry to authenticate. With an acl of access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to dn.subtree="ou=People,dc=st-andrews,dc=ac,dc=uk" by * read access to * by users read by anonymous auth All anonymous searches get insufficient access returned Logging of ACls shows => slap_access_allowed: search access denied by auth(=xd) Any thoughts on what extra I need for this to work in 2.4? Cheers, Duncan

3 5

ldap_result error
by Fabio Ubaldi 21 Feb '08

21 Feb '08

Hi all, I have one process that needs to communicate with two different LDAP servers. For this reason, the process creates two threads (each thread manages the connection with one server). For tests, the process launch several "search" requests for the two threads at a fixed rate (about 100 searches/s). Each thread polls the server responses using the API "ldap_result" in asynchronous mod using LDAP_RES_ANY and LDAP_MSG_ONE macros. In this scenario, the "ldap_result" system call of one thread return with error (-1) and the error is "Can't contact the LDAP server". I tried to launch one single thread and it works fine (the maximum measured rate is 800 searches/s). Also I launch the two threads alternating the search requestes (so that only one of them is running) and it works fine. It seems that the error happens only if the two process runs simultaneously. Thinking of a race condition error, I lead the same tests using the libldap_r library to build the process but the error still remains. Have anyone encountered a similar error? The used openldap version is 2.3.27 both for LDAP servers ("slapd") and the libraries. Thanks in advance for the reply.

2 2

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software February 2008