openldap-software August 2008

openldap-software@openldap.org

70 participants
81 discussions

Multimaster SASL/EXTERNAL (TLS client cert) error
by Gémes Géza 18 Aug '08

18 Aug '08

Hi everyone! I've set up two test ldap servers (2.4.10) with multimaster replication. With simple binds it is working well. I've set up a client certificate (everything CA signed, no self-signing ;-) ) to use with SASL/EXTERNAL authentication. Using olcAuthzRegexp I've mapped it to the rootdn of the cn=config backend, set up an .ldaprc file and with: su -c '/usr/bin/ldapwhoami' openldap -s /bin/sh (I'm running slapd as openldap user and group) I get: SASL/EXTERNAL authentication started SASL username: cn=LDAP Syncrepl Client,ou=LDAP Server,o=Kossuth Zsuzsanna SZKI,l=Dabas,st=Pest,c=HU SASL SSF: 0 dn:cn=config just like expected (ldapsearch and friends are also working on both sides and cross). Just to be sure I've exported the LDAPCONF variable in the slapd startup script. But syncrepl doesn't work! On the logs (olcLogLevel=-1): slap_client_connect: URI=ldaps://first-or-second-ldap-server ldap_sasl_interactive_bind_s failed (-6) connection_read(20): unable to get TLS client DN, error=49 id=23 Many thanks! Geza

4 6

Re: syncrepl binds with no password
by Bill Whiting 18 Aug '08

18 Aug '08

Gavin Henry wrote: > ----- "Bill Whiting" <textux(a)bellsouth.net> wrote: > > >> I'm trying to setup a simple replication. >> I configured syncrepl in the consumer to use the user syncuser to >> access >> the master ldap but when it connects to the master it does not send >> the >> password for syncuser, so the master errors with: >> >> unauthenticated bind (DN with no password) disallowed >> >> >> Here's the replication definition in the consumer: >> >> syncprov-checkpoint 100 10 >> syncrepl rid=000 >> provider=ldap://192.168.77.218 >> type=refreshOnly >> interval=00:00:02:00 >> retry="5 5 300 +" >> searchbase="dc=idi-test,dc=com" >> attrs=* >> bindmethod=simple >> binddn="uid=syncuser,ou=People,dc=idi-test,dc=com" >> credentials={SHA}jHXtTHIeoSUGGge0YOB5dJQeXf4= >> > > credentials contains the unencrypted password. > Thanks, that corrected the no password problem. The consumer is replicating. //Bill

1 0

syncrepl binds with no password
by Bill Whiting 18 Aug '08

18 Aug '08

I'm trying to setup a simple replication. I configured syncrepl in the consumer to use the user syncuser to access the master ldap but when it connects to the master it does not send the password for syncuser, so the master errors with: unauthenticated bind (DN with no password) disallowed Here's the replication definition in the consumer: syncprov-checkpoint 100 10 syncrepl rid=000 provider=ldap://192.168.77.218 type=refreshOnly interval=00:00:02:00 retry="5 5 300 +" searchbase="dc=idi-test,dc=com" attrs=* bindmethod=simple binddn="uid=syncuser,ou=People,dc=idi-test,dc=com" credentials={SHA}jHXtTHIeoSUGGge0YOB5dJQeXf4= What am I missing? //Bill Whiting

2 1

Re: LDAP Replication +TLS +Self-signed certificate.
by k bah 18 Aug '08

18 Aug '08

> ----- Original Message ----- > From: "Howard Chu" <hyc(a)symas.com> > To: "k bah" <kbah(a)linuxmail.org> > Subject: Re: LDAP Replication +TLS +Self-signed certificate. > Date: Fri, 15 Aug 2008 03:34:19 -0700 > > > k bah wrote: > > Hi, > > > > I have LDAP replication setup (slurpd), works fine. Until a while ago I had a > CA certificate, and with that one I signed other two certificates, for two > different hosts. So I had 3 "hosts", one is the CA, another one is LDAP Master > and the last the ldap slave. Configuration on both master and slave slapd.conf > had: > > > TLSCertificateFile /etc/openldap/"this"-machine-certificate.crt > > TLSCertificateKeyFile /etc/openldap/"this"-machine-key.key > > TLSCACertificateFile /etc/openldap/"the-ca"-machine-cert.crt > > That sounds like a correct configuration. > > > Now I changed the certificates, both the Master and Slave machines use self > > signed certificates, I changed the certificates/tls config on several > > services that used it, they work fine, but LDAP replication stopped > > working. > > That is a bad configuration. The old saying applies - "if it ain't > broke, don't fix it." Your original config was fine... I tried this (and I guess it makes sense): LDAP Master slapd.conf: TLSCertificateFile /etc/openldap/ldap-master-cert.crt (self-signed certificate) TLSCertificateKeyFile /etc/openldap/ldap-master-key.key TLSCACertificateFile /etc/openldap/ldap-master-cert.crt LDAP Slave slapd.conf: TLSCertificateFile /etc/openldap/ldap-slave-cert.crt (self-signed certificate) TLSCertificateKeyFile /etc/openldap/ldap-slave-key.key TLSCACertificateFile /etc/openldap/ldap-slave-cert.crt LDAP Master ldap.conf: TLS_CACERT /etc/openldap/ldap-slave-cert.crt (Since when replicating, the master server acts as a client to the ldap slave server, right?) Quoting the slurpd man page: "Note that slurpd reads replication directive from slapd.conf(5), but uses ldap.conf(5) to obtain other configuration settings (such as TLS settings)." LDAP Slave ldap.conf: TLS_CACERT /etc/openldap/ldap-master-cert.crt (I can't figure out now why, does the LDAP slave server act as a client to the ldap master server? When?) > > If you're replacing certs because they expired or some other > reason, just duplicate the structure you had originally. Create one > self-signed CA cert, then create your server certs and use your CA > cert to sign all the other certs. Then distribute your CA cert to > all the client machines as usual. = Don't Just See Alaska, Experience It Active, Informative, Fun! Alaska Adventure Tours. Live Large. http://a8-asy.a8ww.net/a8-ads/adftrclick?redirectid=3fac59fd070fca088e31eea… -- Powered by Outblaze

2 1

slapcat and BDB transaction-logs
by tamarin p 18 Aug '08

18 Aug '08

Hello, I'm trying to migrate a directory from OpenLDAP 2.3.x to an OpenLDAP 2.4.11 test installation. My LDAP-experience is less than extensive, but I've run slapcat on the old base, and am now trying to import it back into 2.4.11 with slapadd. The base is large enough that the import will take several days at the current rate (3gb LDIF/approx 4 million entries), and so I can't monitor the process at all times. My problem is with the backend transaction logs, though. These are chucked out at a rate of approximately one per minute until the disk runs out of space. I did a quick google on the issue and found that you should be able to remove logs not currently involved in any transactions by running db_archive -d ( http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/…). I've also tried adding a set_flags DB_LOG_AUTOREMOVE in my DB_CONFIG with no luck. Then I figured I could set up a cronjob to run db_archive hourly, but when I run db_archive -d (or more to the point, slapd_db_archive2.4 -d, as I've installed using Buchan Milne's RPMs), not a single log-file is removed. Moreover, none of the *.bdb files are increasing in size while slapadd is running, only additional log-files and __db.001 etc.Does slapadd basically do all adds in one huge transaction before committing at the end, or am I doing something wrong? Can I simply erase log-files with rm on the fly instead? The checkpointing in slapd.conf is set to 256k/5min as per default. Anything else I'm missing?

4 4

openldap failing to launch if SSL/TLS enabled. error "main: TLS init def ctx failed: -1" ?
by Ben Wailea, openldap-software 16 Aug '08

16 Aug '08

i've installed openldap. starts fine without SSL/TLS. if SSL/TLS is enabled, slapd fails to launch @ error: "main: TLS init def ctx failed: -1". googling the issue, suggestions are cert problems. mine, i believe are OK. any ideas as to what the problem is? here's what i've done/checks so far: i've installed openldap from rpm's, rpm -qa | grep openldap openldap2-back-perl-2.4.11-5.1 openldap2-client-2.4.11-6.1 openldap2-2.4.11-5.1 openldap2-back-meta-2.4.11-5.1 without TLS/SSL, the service starts, service ldap start Starting ldap-server done ps ax | grep slapd 6062 ? S<sl 0:00 /usr/lib/openldap/slapd -h ldap:// -f /etc/openldap/slapd.conf -u ldap -g ldap -4 -o slp=on if i add TLS/SSL config to /etc/openldap/slapd.conf, ... TLSCertificateFile /etc/apache2/ssl.crt/svr.crt TLSCertificateKeyFile /etc/apache2/ssl.key/svr.key TLSCACertificateFile /etc/apache2/ssl.crt/ca.crt TLSCipherSuite TLSv1+HIGH:!aNULL:@STRENGTH TLSVerifyClient never ... service fails to start, service ldap start Starting ldap-server failed and log reports, Aug 15 10:02:01 auth slapd[6139]: main: TLS init def ctx failed: -1 Aug 15 10:02:01 auth slapd[6139]: slapd destroy: freeing system resources. Aug 15 10:02:01 auth slapd[6139]: slapd stopped. Aug 15 10:02:01 auth slapd[6139]: connections_destroy: nothing to destroy. Aug 15 10:02:01 auth slapd[6139]: daemon: SLPDereg(ldap://) failed with -20, cookie = 0 the certs/keys i'm, using are used in my apache server, SSLCertificateFile /etc/apache2/ssl.crt/svr.crt SSLCertificateKeyFile /etc/apache2/ssl.key/svr.key SSLCACertificateFile /etc/apache2/ssl.crt/ca.crt SSLCipherSuite TLSv1+HIGH:!aNULL:@STRENGTH SSLVerifyClient none SSLVerifyDepth 1 and SSL works there without problem. the keys & certs check out ok, ------ openssl rsa -noout -text -in "/etc/apache2/ssl.key/svr.key" Private-Key: (2048 bit) modulus: 00:d2:3e:45:1c:09:10:d2:a1:c6:61:c2:fa:ad:35: ... 23:97 publicExponent: 65537 (0x10001) privateExponent: 00:b0:82:00:e9:69:9f:0b:07:30:93:30:eb:dd:f1: ... 48:01 prime1: 00:ea:8e:ea:13:2c:71:be:3c:68:8b:5e:7a:c8:1e: ... cf:ea:b4:92:2a:e5:14:1c:01 prime2: 00:e5:76:57:25:91:72:eb:ac:19:74:9a:2d:85:65: ... a9:81:b0:7f:b4:f3:f1:9f:97 exponent1: 06:2b:94:44:c4:da:89:22:95:ad:74:e2:cd:f8:dd: ... 62:95:35:73:23:6b:90:01 exponent2: 1a:a4:1f:c0:1b:e0:04:de:c9:61:d1:58:c1:a9:2c: ... 44:e6:72:1d:57:49:51:67 coefficient: 12:11:93:09:34:3e:ae:41:2d:dc:78:f3:11:e0:da: ... 73:80:99:ec:78:b3:4c:90 openssl x509 -noout -text -in "/etc/apache2/ssl.crt/ca.crt" Certificate: Data: Version: 3 (0x2) Serial Number: 12...21 (0x...5d) Signature Algorithm: sha512WithRSAEncryption Issuer: C=US, ST=ST, L=CITY, O=TEST, OU=TEST, CN=TEST_CA Validity Not Before: Aug 15 02:43:41 2008 GMT Not After : Aug 15 02:43:41 2009 GMT Subject: C=US, ST=ST, L=CITY, O=TEST, OU=TEST, CN=TEST_CA Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (4096 bit) Modulus (4096 bit): 00:f3:ee:cf:21:bc:49:59:1a:e0:62:5b:df:87:9e: ... 9b:fb:1d Exponent: 65537 (0x10001) X509v3 extensions: Netscape Comment: SS ROOT CA CERT X509v3 Basic Constraints: critical CA:TRUE, pathlen:0 Netscape Cert Type: SSL CA, S/MIME CA X509v3 Key Usage: critical Certificate Sign, CRL Sign X509v3 Subject Key Identifier: 3B:...:32 X509v3 Authority Key Identifier: keyid:3B:...:32 DirName:/C=US/ST=ST/L=CITY/O=TEST/OU=TEST/CN=TEST_CA serial:48:...:5D Signature Algorithm: sha512WithRSAEncryption da:02:bb:96:3a:72:83:73:15:8c:c9:1d:1d:41:47:2c:9e:7b: ... 70:d0:ac:96:09:7d:28:e2 openssl x509 -noout -text -in "/etc/apache2/ssl.crt/svr.crt" Certificate: Data: Version: 3 (0x2) Serial Number: 2 (0x2) Signature Algorithm: sha512WithRSAEncryption Issuer: C=US, ST=ST, L=CITY, O=TEST, OU=TEST, CN=TEST_CA Validity Not Before: Aug 15 02:49:19 2008 GMT Not After : Aug 15 02:49:19 2009 GMT Subject: C=US, ST=ST, L=CITY, O=TEST, OU=TEST, CN=*.testdomain.net/emailAddress=postmaster@testdomain.net Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:d2:3e:45:1c:09:10:d2:a1:c6:61:c2:fa:ad:35: ... 23:97 Exponent: 65537 (0x10001) X509v3 extensions: Netscape Comment: OpenSSL Generated Certificate X509v3 Basic Constraints: CA:FALSE Netscape Cert Type: SSL Client, S/MIME, Object Signing X509v3 Key Usage: critical Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement X509v3 Extended Key Usage: critical Code Signing, Time Stamping, TLS Web Server Authentication, TLS Web Client Authentication X509v3 Subject Key Identifier: 00:...:1B X509v3 Authority Key Identifier: keyid:3B:...:32 Signature Algorithm: sha512WithRSAEncryption 5b:56:cb:38:40:62:ae:13:9a:e7:c3:d8:a9:2f:e6:04:fc:32: ... ff:29:74:52:73:28:fa:ca ------

5 10

ldap client crypto question
by Gregory K. Ruiz-Ade 16 Aug '08

16 Aug '08

I'm using a custom perl script, using perl-ldap (Net::LDAP). I'm trying to connect to my server via ldaps://. On RHEL4 (and CentOS4) this works without problem. On RHEL5, I keep getting "stronger confidentiality required" error messages. Connecting from an RHEL4 client gives me: Aug 15 16:51:52 csenet slapd2.3[4105]: conn=1318 fd=15 TLS established tls_ssf=256 ssf=256 Aug 15 16:51:54 csenet slapd2.3[4105]: conn=1318 op=0 BIND dn="<binddn>" method=128 Aug 15 16:51:54 csenet slapd2.3[4105]: conn=1318 op=0 BIND dn="<binddn>" mech=SIMPLE ssf=0 Aug 15 16:51:54 csenet slapd2.3[4105]: conn=1318 op=0 RESULT tag=97 err=0 text= Connecting from an RHEL5 client gives me: Aug 15 16:57:14 csenet slapd2.3[4105]: conn=1326 fd=15 TLS established tls_ssf=56 ssf=56 Aug 15 16:57:14 csenet slapd2.3[4105]: conn=1326 op=0 BIND dn="<binddn>" method=128 Aug 15 16:57:14 csenet slapd2.3[4105]: conn=1326 op=0 RESULT tag=97 err=13 text=stronger confidentiality required I've got the same client configs on both systems, and TLS_REQCERT = allow. The truly confusing part is when I do an ldapsearch (instead of trying the perl script) it works correctly: Aug 15 17:00:08 csenet slapd2.3[4105]: conn=1331 fd=15 TLS established tls_ssf=256 ssf=256 Aug 15 17:00:08 csenet slapd2.3[4105]: conn=1331 op=0 BIND dn="<binddn>" method=128 Aug 15 17:00:08 csenet slapd2.3[4105]: conn=1331 op=0 BIND dn="<binddn>" mech=SIMPLE ssf=0 Aug 15 17:00:08 csenet slapd2.3[4105]: conn=1331 op=0 RESULT tag=97 err=0 text= Anyone have any ideas why perl-ldap/Net::LDAP would be using such weaker encryption? Thanks, Gregory -- Gregory K. Ruiz-Ade Sr. Systems Administrator Computer Science and Engineering University of California, San Diego Office: EBU3b 1216 Phone: (858) 822-2625 E-mail: gkra(a)cs.ucsd.edu

2 1

LDAP Replication +TLS +Self-signed certificate.
by k bah 15 Aug '08

15 Aug '08

Hi, I have LDAP replication setup (slurpd), works fine. Until a while ago I had a CA certificate, and with that one I signed other two certificates, for two different hosts. So I had 3 "hosts", one is the CA, another one is LDAP Master and the last the ldap slave. Configuration on both master and slave slapd.conf had: TLSCertificateFile /etc/openldap/"this"-machine-certificate.crt TLSCertificateKeyFile /etc/openldap/"this"-machine-key.key TLSCACertificateFile /etc/openldap/"the-ca"-machine-cert.crt Now I changed the certificates, both the Master and Slave machines use self signed certificates, I changed the certificates/tls config on several services that used it, they work fine, but LDAP replication stopped working. 1) To be clear (in order to have LDAP replication working with self signed certs + TLS on): Master machine slapd.conf: TLSCertificateFile /etc/openldap/master-machine-certificate.crt TLSCertificateKeyFile /etc/openldap/master-machine-key.key TLSCACertificateFile /etc/openldap/master-machine-certificate.crt Master machine ldap.conf: TLS_REQCERT allow TLS_CACERT /etc/openldap/master-machine-certificate.crt (DOES IT MATTER IF THIS MACHINE ONLY ACTS AS SERVER?) Slave machine slapd.conf: TLSCertificateFile /etc/openldap/slave-machine-certificate.crt TLSCertificateKeyFile /etc/openldap/slave-machine-key.key TLSCACertificateFile /etc/openldap/slave-machine-certificate.crt (as this option on slapd.conf is for the -server- part of the slave, right?) Slave machine ldap.conf: TLS_REQCERT allow TLS_CACERT ????? 2) Second question, on other machines that run LDAP clients, I should put what in ldap.conf (/etc/openldap/ldap.conf) for the TLS_CACERT option? Leave it blank, use the ldap master machine certificate or, if that machine queries the slave ldap machine, the slave ldap machine certificate for the ldap.conf TLS_CACERT option? thanks a lot! = Search for products and services at: http://search.mail.com -- Powered by Outblaze

2 1

Building OpenLDAP for Windows
by Craig Worgan 14 Aug '08

14 Aug '08

Is there any 'official' documentation describing how to build OpenLDAP for Windows? I can't find anything on the OpenLDAP site or on the mailing lists. Craig Worgan

3 3

translucent overlay and binding
by Mateusz Kijowski 14 Aug '08

14 Aug '08

Hi, I am trying to create an OpenLDAP instance for our programming team's test environment. They want to have all data coherent with our production systems except for some of the passwords, so I figured I need to use the translucent overlay and override some userPassword attributes. I managed to do so, and I can tell that the local value of password attribute is being compared, not the one from the remote (production) server. The probem is when users want to bind to the test server - their requests are being proxied to the production server. I would like them to bind using the overriden (local) credentials. Is it possible? I am using OpenLDAP 2.3.43 Thanks in advance. -- Mateusz

3 3

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software August 2008