openldap-software March 2008

openldap-software@openldap.org

65 participants
66 discussions

ACIs problem when allowing "read" but restricting "updates" in specific entries
by Antonio Alonso 15 Mar '08

15 Mar '08

Hi ! I need some help with a pair of ACIs I have prepared (using openldap 2.4.7 in a SuSE9 server) I have created a DIT where several subscribers were provisioned. Under each subscriber entry there are two different entries ("application=data1" and "application=data2"): application=data1,subscriberId=<xxx>,ou=subscribers,dc=company,dc=com application=data2,subscriberId=<xxx>,ou=subscribers,dc=company,dc=com And I have defined four different users (to bind to the system .. apart from the "rootdn", of course) - uid=data1owner,ou=users,dc=company,dc=com Can read and modify attribute values in "application=data1, ..." entries - uid=data2owner,ou=users,dc=company,dc=com Can read and modify attribute values in "application=data2, ..." entries - uid=data1checker,ou=users,dc=company,dc=com Can read attribute values in "application=data1, ..." entries but can NOT modify them - uid=admin,ou=users,dc=company,dc=com Can read and modify attribute values in "application=data1, ..." and "application=data2, ..." entries I have included the following ACIs in "slapd.conf" file (to get the behaviour explained above) ## ## Policy Rule [1] ## Access to "application=data1,,..." entries ## access to dn.regex="appName=data1,.+$" by dn.exact="uid=data1owner,ou=users,dc=company,dc=com" write stop by dn.exact="uid=data1checker,ou=users,dc=company,dc=com" read stop by dn.exact="uid=admin,ou=users,dc=company,dc=com" manage stop ## ## Policy Rule [2] ## Access to "application=data2,..." entries ## access to dn.regex="application=data2,.+$" by dn.exact="uid=data2owner,ou=users,dc=company,dc=com" write stop by dn.exact="uid=admin,ou=users,dc=company,dc=com" manage stop I am getting the desired behaviour except for the "uid=data1checker" user. He only see "application=data1" entries ("application=data2" are not visible for him) but he can ALSO modify attribute values in "application=data1" entries (i.e. it is exactely the same behaviour as "uid=data1owner" in spite of the first one having ONLY "read" access privileges and the second one "write" access privileges for the "application=data1, ..." entries (????) Please, could you any of you help me with this issue. Thanks in advance BR / Antonio > Antonio Alonso Alarcón CUDB System Engineer/Technical Product Manager > Ericsson España, S.A. Phone: +34 91339 3085 Via de los Poblados 13 Mobile: +34 609640579 (66215) 28033 Madrid, Spain Fax: +34 91339 1636 E-mail: Antonio.Alonso(a)ericsson.com

4 5

Re: slurpd does not sync master and slave
by юрка олейников 14 Mar '08

14 Mar '08

another question: can slurpd sync openldap 2.3.x (master) with 2.2 (slave)? 2008/3/15, Quanah Gibson-Mount <quanah(a)zimbra.com>: > > --On Saturday, March 15, 2008 3:47 AM +0200 юрка олейников > <yurkao(a)gmail.com> wrote: > > > > > which scenario are you talking about? > > running 'slurpd -d 1 ' or 'non-empty master DB vs empty slave DB'? > > trying to fill an empty slaves DB using slurpd when the master already has > a DB. > > slurpd is deprecated and was removed from 2.4 for many reasons. It was > really a fairly poor replication mechanism, and syncrepl is its > replacement. There's really no reason to use slurpd anymore as long as > you > use a current openldap release. > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Be Secure, Stay Open - live w/ OpenBSD

2 1

Re: slurpd does not sync master and slave
by юрка олейников 14 Mar '08

14 Mar '08

which scenario are you talking about? running 'slurpd -d 1 ' or 'non-empty master DB vs empty slave DB'? 2008/3/14, Quanah Gibson-Mount <quanah(a)zimbra.com>: > > --On Friday, March 14, 2008 3:29 PM +0200 юрка олейников > <yurkao(a)gmail.com> wrote: > > > > > i have a problem running slurp. > > there're tw ldap servers master (which has already DB) and slave (with > > empty DB). > > i'm running slurp: /path/to/slurd -d 1 > > This is not a supported scenario with slurpd. If you want this type of > thing to work, you need to use OpenLDAP 2.3 or OpenLDAP 2.4 with syncrepl. > Otherwise, you must fill the replica DB before enabling slurpd with a dump > from the master. > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > -- Be Secure, Stay Open - live w/ OpenBSD

2 1

Grace period for inactive accounts?
by John Maki 14 Mar '08

14 Mar '08

Hi, I'm using Openldap 2.3.38 with the ppolicy overlay on a Fedora 7 x86-64 server. Is there any functionality built in to provide account locking after a certain length of time after a password expires? Similiar to pwdGraceAuthnLimit but based on time rather than number of login attempts? I'd like to be able to lock accounts after a period of inactivity. Or am I missing some other way of doing this? Thanks, John ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

5 5

slurpd does not sync master and slave
by юрка олейников 14 Mar '08

14 Mar '08

i have a problem running slurp. there're tw ldap servers master (which has already DB) and slave (with empty DB). i'm running slurp: /path/to/slurd -d 1 and it terminates immidiately with: > Config: ** configuration file successfully read and parsed > Processing in one-shot mode: > 0 total replication records in file, > 0 replication records to process. > begin replication thread for 147.161.2.132:389 > end replication thread for 147.161.2.132:389 > slurpd: terminated. slave DB remains empty. my master's slapd.conf contains: > database bdb > suffix "dc=domain" > rootdn "cn=admin,dc=domain" > rootpw {SSHA}plaplapla > replica host=147.161.2.132:389 binddn="cn=admin,dc=domain" bindmethod=simple credentials=PlaPlaPla > replogfile /usr/var/openldap-slurp/rep.log > directory /var/lib/ldap/ slave is identical except: > database bdb > suffix "dc=domain" > rootdn "cn=admin,dc=domain" > rootpw {SSHA}plaplapla > updatedn "cn=admin,dc=domain" > directory /var/lib/ldap/ both slapd (on master and slave) are running as root priveleges master's version is 2.3.25 (slackware) and slave's - 2.3.37(OpenSuse 10.3). can anybody explain why it does not sync servers? PS: slaptest: "config file testing succeeded" on both servers. -- Be Secure, Stay Open - live w/ OpenBSD

2 1

acl to read dn only
by Ron Peterson 14 Mar '08

14 Mar '08

I'm trying to create an acl which allow a particular use to search my DIT and retrieve dn values only. Perhaps a (broken) attempt at an acl will help explain what I mean: access to dn.children="dc=mtholyoke,dc=edu" attrs=distinguishedName by dn="cn=proxysearchdn,dc=mtholyoke,dc=edu" read by * break access to dn.children="dc=mtholyoke,dc=edu" by dn="cn=proxysearchdn,dc=mtholyoke,dc=edu" search by * break I want to use my proxysearchdn user to do the first step of a search and bind operation, without giving that user any more access to objects than necessary. BTW, I can indicate attrs=distinguishedName, but attrs=dn gives me an error. Correct behaviour, I'm sure, but I'm not sure then how to say what I mean. TIA. -- Ron Peterson Network & Systems Manager Mount Holyoke College http://www.mtholyoke.edu/~rpeterso

2 2

Constraint violation: structuralObjectClass: no user modification allow
by openldap 14 Mar '08

14 Mar '08

Hi listers, i have a master LDAP with version openldap-servers-2.3.39-1.fc8, a slave LDAP with version openldap-servers-2.3.34-0.fc7 a slave LDAP with version openldap-server-2.3.33p1-bdb the versions are close enough to one another in order to be compatible. the first two are on fedore 8 and fedora 7, the third on openBSD. from the master to the two slaves, slurpd replication is installed. as the slurpd replication will no longer be available, i started testing syncrepl from the third LDAP server onto a fourth one. i wanted to test, if i can configure them for refreshAndPersist replication. to do that i first configured the third to act as a syncrepl provider for the fourth one and then added a new entry in a test subtree on the master server. the following happened: the second server immediately got the changes via slurpd and accepted them. the third server also got the changes but rejected them: Mar 14 13:33:33 thirdhost slapd[18518]: conn=6 fd=20 ACCEPT from IP=xx.xx.xx.xx:45565 (IP=0.0.0.0:3 89) Mar 14 13:33:33 thirdhost slapd[18518]: conn=6 op=0 BIND dn="cn=manager,dc=mydom,dc=com" method=128 Mar 14 13:33:33 thirdhost slapd[18518]: conn=6 op=0 BIND dn="cn=Manager,dc=mydom,dc=com" mech=SIMPLE ssf =0 Mar 14 13:33:33 thirdhost slapd[18518]: conn=6 op=0 RESULT tag=97 err=0 text= Mar 14 13:33:33 thirdhost slapd[18518]: conn=6 op=1 ADD dn="cn=wurguri,ou=LDIF-Test,dc=mydom,dc=com" Mar 14 13:33:33 thirdhost slapd[18518]: conn=6 op=1 RESULT tag=105 err=19 text=structuralObjectClass: n o user modification allowed on the master if found the following in the slurpd-log: ERROR: Constraint violation: structuralObjectClass: no user modification allow ed replica: thirdhost.mydom.com:389 time: 1205498012.0 dn: cn=wurguri,ou=LDIF-Test,dc=mydom,dc=com changetype: add sn: wurguri cn: wurguri objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson structuralObjectClass: inetOrgPerson entryUUID: 9a3fdcd8-860e-102c-9ead-03486d6a2d35 creatorsName: cn=myuser,ou=pam-ldap,dc=mydom,dc=com createTimestamp: 20080314123332Z entryCSN: 20080314123332Z#000000#00#000000 modifiersName: cn=myuser,ou=pam-ldap,dc=mydom,dc=com modifyTimestamp: 20080314123332Z as far as i understand, the third LDAP server did not like the structuralObjectClass specs. when googling around i found "that it is very easy with sed to extract the structuralObjectClass specs" from the ldif file. what do i need to change either on the master, not to let it create ldif files which are unaceptable for the other(s), or on the slave to make it accept the structuralObjectClass specs? suomi

2 1

syncrepl not syncing [ CSN older or equal to ctx ]
by Duncan Brannen 14 Mar '08

14 Mar '08

Hi, I've got a slave that I think I missed out the -w on the slapadd when I rebuilt it recently and it's not picking up changes from the master. What I'm seeing in the log is slapd[11886]: [ID 502419 local4.debug] Entry reqStart=20080311204629.000002Z,cn=accesslog CSN 20080311204629.095387Z#000000#000#000000 older or equal to ctx 20080311204629.095387Z#000000#000#000000 Every 60 seconds or so. (My retry interval) type is RefreshAndPersist Is there an easy way to reset the timestamp on the slave / master so this fires into life or do I need to reload it? Slave is 2.4.7 and the master is 2.4.8 so it's due another upgrade soon anyway but I'd rather get then synced now and upgrade out of hours. Thansk, Duncan

2 6

Operational attribute pwdFailureTime not being added to entries
by Ryan Steele 14 Mar '08

14 Mar '08

Hello, First let me thank the gracious folks on this list who have lent their advice to me on my path towards implementing ppolicy. I'm making progress; I can reject new passwords based on password history, and reject weak passwords. However, I'm having a bit of a time trying to get the lockouts to work. My policy is defined as: 56 cn=Password Policy,ou=Policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: Password Policy pwdAttribute: userPassword pwdMaxAge: 3888000 pwdMinLength: 6 pwdExpireWarning: 432000 pwdFailureCountInterval: 0 pwdMustChange: FALSE pwdAllowUserChange: TRUE pwdSafeModify: TRUE pwdLockout: TRUE pwdCheckQuality: 1 pwdGraceAuthNLimit: 0 pwdInHistory: 6 pwdLockoutDuration: 60 pwdMaxFailure: 3 However, even after many failure attempts, I see no pwdFailureTime attributes in the offending user's entry: dn: uid=testuser,ou=Users,dc=example,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSamAccount cn: testuser sn: testuser givenName: testuser uid: testuser uidNumber: 1009 gidNumber: 513 homeDirectory: /home/testuser loginShell: /bin/bash gecos: System User structuralObjectClass: inetOrgPerson entryUUID: 42d5971e-7b49-102c-8aae-af676a6dbed9 creatorsName: cn=admin,dc=example,dc=com createTimestamp: 20080229193543Z sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 displayName: System User sambaSID: S-1-5-21-1484159386-3942804292-94657008-3018 sambaPrimaryGroupSID: S-1-5-21-1484159386-3942804292-94657008-513 sambaLogonScript: logon.bat sambaProfilePath: \\masterldap.example.com\profiles\testuser sambaHomePath: \\masterldap.example.com\testuser sambaHomeDrive: H: pwdHistory: 20080313194326Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}C2DOwhgHFTc XmGxRdqlpBUz12eZpRXI4 pwdHistory: 20080313194602Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}AboL9Sp7678 X2KsPv8sMPE5CC2i6c6LY pwdHistory: 20080313194626Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}7hUqCecYGvd g5bx1ybw71YQcZShicmFk pwdHistory: 20080313194852Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}E920Fe1PlYV Bwjn+rpiOFO8UaiRzZnB6 pwdHistory: 20080313200637Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}hFfD2xFwG/T s5PVg3CAIf4i6rkpaZnNM pwdHistory: 20080313200941Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}/GpzR2wV7dy XITeU+5nBpFyTKdgxQzk4 sambaLMPassword: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX sambaAcctFlags: [U] sambaNTPassword: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX sambaPwdLastSet: 1205438797 sambaPwdMustChange: 1209326797 userPassword:: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX pwdChangedTime: 20080313200941Z entryCSN: 20080313200941Z#000000#00#000000 modifiersName: cn=admin,dc=example,dc=com modifyTimestamp: 20080313200941Z Is the shadowAccount attribute killing me? I'm not really sure. Just for completeness, the slapd.conf (abridged) looks like: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/ppolicy.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib/openldap database bdb suffix "dc=example,dc=com" directory /var/lib/ldap rootdn "cn=admin,dc=example,dc=com" rootpw {SSHA}tFEA391Y3ZLHXkQDDk6f0t1ZkJEuMwIj overlay ppolicy ppolicy_default "cn=Password Policy,ou=Policies,dc=example,dc=com" ppolicy_use_lockout access to attrs=userPassword,sambaNTPassword,sambaLMPassword,shadowLastChange,shadowMax,sambaPwdLastSet,sambaPwdMustChange by self write by * auth access to * by * read moduleload smbk5pwd.la index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub loglevel -1 sasl-secprops none As always, thank you for your help. Best Regards, Ryan

2 1

Struggling with ppolicy
by Ryan Steele 13 Mar '08

13 Mar '08

Hey folks, If this is the wrong list, please let me know and I'd be happy to send it to the right one. As I've mentioned in a previous post (which hasn't been posted yet, so I apologize if you've seen any of this information already) I've got a FC6 box, with OpenLDAP 2.3.30. I'm attempting to get ppolicy to work, and I can now successfully start OpenLDAP with the ppolicy directive in it: ### abridged slapd.conf ### include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/ppolicy.schema modulepath /usr/lib/openldap overlay ppolicy ppolicy_default "cn=Password Policy,ou=policies,ou=example,ou=com" access to attrs=userPassword,sambaNTPassword,sambaLMPassword,shadowLastChange,shadowMax,sambaPwdLastSet,sambaPwdMustChange by self write by * auth access to * by * read database bdb suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXX directory /var/lib/ldap index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub sasl-secprops none ### Password Policy entry via slapcat ### dn: cn=Password Policy,ou=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: Password Policy pwdAttribute: 2.5.4.35 pwdMaxAge: 3888000 pwdInHistory: 2 pwdCheckQuality: 1 pwdMinLength: 6 pwdExpireWarning: 432000 pwdGraceAuthNLimit: 5 pwdMaxFailure: 10 pwdFailureCountInterval: 0 pwdMustChange: FALSE pwdAllowUserChange: TRUE pwdSafeModify: TRUE pwdLockoutDuration: 7776000 pwdLockout: TRUE structuralObjectClass: device entryUUID: 2e1eee98-83ea-102c-9736-1d2794f3677b creatorsName: cn=admin,dc=example,dc=com createTimestamp: 20080311190746Z entryCSN: 20080311190746Z#000000#00#000000 modifiersName: cn=admin,dc=example,dc=com modifyTimestamp: 20080311190746Z [root@server openldap]# /etc/init.d/ldap start Checking configuration files for slapd: WARNING: No dynamic config support for overlay ppolicy. config file testing succeeded [ OK ] Starting slapd: [ OK ] >From what I gather, since I'm using a slapd.conf and not a back-bdb, that warning does not apply to me. However, when I add users, I see no special attributes that show they're being regulated by ppolicy (Googling turned up some ldif's that had pwdPolicySubentry attributes - should I have that?) Additionally, I can enter passwords such as 'a' - single characters, and it doesn't complain at all. In fact, none of the restrictions are being enforced, and I'm really scratching my head. The options I compiled with were: --enable-plugins \ --enable-ppolicy=yes \ --enable-slapd \ --enable-slurpd \ --enable-multimaster \ --enable-bdb \ --enable-hdb \ --enable-ldap \ --enable-ldbm \ --with-ldbm-api=%{ldbm_backend} \ --enable-meta \ --enable-monitor \ --enable-null \ --enable-shell \ --enable-sql=mod \ --disable-perl \ --disable-shared \ --disable-dynamic \ --enable-static \ --with-kerberos=k5only Thanks in advance for any help... Best Regards, Ryan

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software March 2008