openldap-software May 2010

openldap-software@openldap.org

32 participants
27 discussions

Cannot search usercertificate binary data with raw data
by Luis Neves 08 May '10

08 May '10

Hi I ve imported to my openldap directory a x509 user certificate to the usercertificate;binary attribute (using and ldif and also using the import option from the GC ldap browser) if i make a simple query like this ldapsearch -x -h 10.15.254.148 -p 389 -D "cn=root,dc=cm-lisboa,dc=pt" -w ***** -s sub -b "ou=AuthzLDAPCertmap,dc=cm-lisboa,dc=pt" '(&(userCertificate;binary=*)(objectClass=strongAuthenticationUser))' i get all the data ok: dn: uid=luisneves,ou=AuthzLDAPCertmap,dc=cm-lisboa,dc=pt objectClass: authzLDAPmap objectClass: top objectClass: account objectClass: strongAuthenticationUser uid: luisneves serialNumber: 1234567890 issuerDN: /C=Country/ST=Locality/L=Locality/O=COMPANY/OU=Department/CN=Compani es Root Certification Authority/emailAddress=mail(a)Company.com subjectDN: /C=Country/ST=Locality/L=Locality/O=Company/OU=Department/CN=uid@Co mpany.com/emailAddress=UID@Company.com owner: uid=luisneves,ou=people,dc=cm-lisboa,dc=pt userCertificate;binary:: MIIHODCCBiCgAwIBAgIIX9kz4PL5XQ8wDQYJKoZIhvcNAQEFBQAwf DELMAkGA1UEBhMCUFQxHDAaBgNVBAoME0NhcnTDo28gZGUgQ2lkYWTDo28xFDASBgNVBAsMC3N1Yk VDRXN0YWRvMTkwNwYDVQQDDDBFQyBkZSBBdXRlbnRpY2HDp8OjbyBkbyBDYXJ0w6NvIGRlIENpZGF etc etc but i want to specifie a raw filter to the userCertificate atribute: Ive uuencoded the original DER certificate and used the result as a search filter ldapsearch -x -h 10.15.254.148 -p 389 -D "cn=root,dc=cm-lisboa,dc=pt" -w ***** -s sub -b "ou=AuthzLDAPCertmap,dc=cm-lisboa,dc=pt" '(&(userCertificate;binary=\\30\\82\\07\\38\\30\\82\\06\\20\\a0\\03\\02\\01\\02\\02\\08\\d9\\33\\e0\\f2\\f9\\5d\\0f\\30\\0d\\06\\09\\2a\\86\\48\\86 etc etc etc )(objectClass=strongAuthenticationUser))' and nothing is returned, never Ive tryied also to swap first and second bytes (eg, instead of \\30\\82 use instead \\82\\30) and still nothing returns..... Why? Why a cant get any result on this query?... Best regards, Luis _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

3 8

Significant logging change(regression?) between 2.4.21 and 2.4.22?
by Buchan Milne 07 May '10

07 May '10

I was playing with back-config on my laptop, and trying to get something working that required some investigation of what was happening server-side. I noticed that my usual logging (of "stats sync") seemed to have stopped working. After changing olcLogLevel a few times, I couldn't get behaviour consistent with the slapd-config man page. So, I switched back to my previous slapd.conf, and had the same problem. Investigating, it looks like my last logging of "stats" was around: Apr 27 14:36:42 tiger slapd[13031]: conn=185639 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= .... Apr 27 14:37:03 tiger slapd[13031]: conn=81471 fd=79 closed (slapd shutdown) Apr 27 14:37:04 tiger slapd[13031]: slapd shutdown: waiting for 0 operations/tasks to finish Apr 27 14:37:05 tiger slapd[13031]: slapd stopped. Apr 27 14:37:23 tiger slapd[30234]: @(#) $OpenLDAP: slapd 2.4.22 (Apr 27 2010 13:36:26) $ ^Ibgmilne@tiger.ranger.dnsalias.com:/home/bgmilne/rpm/BUILD/openldap-2.4.22/servers/slapd Apr 27 14:37:24 tiger slapd[30236]: slapd starting May 6 21:01:01 tiger slapd[15103]: slapd starting [root@tiger ~]# date -d@`rpm -q --qf "%{INSTALLTIME}\n" openldap-servers` Tue Apr 27 14:37:15 WAT 2010 [root@tiger ~]# zgrep openldap-servers /var/log/rpmpkgs* /var/log/rpmpkgs:openldap-servers-2.4.22-0mdv2010.0.x86_64.rpm /var/log/rpmpkgs.1.gz:openldap-servers-2.4.22-0mdv2010.0.x86_64.rpm /var/log/rpmpkgs.2.gz:openldap-servers-2.4.21-1mdv2010.0.x86_64.rpm /var/log/rpmpkgs.3.gz:openldap-servers-2.4.21-1mdv2010.0.x86_64.rpm /var/log/rpmpkgs.4.gz:openldap-servers-2.4.21-1mdv2010.0.x86_64.rpm [root@tiger ~]# ls -lrt /var/log/rpmpkgs* -rw-r--r-- 1 root root 29461 2010-04-11 04:02 /var/log/rpmpkgs.4.gz -rw-r--r-- 1 root root 29443 2010-04-18 04:02 /var/log/rpmpkgs.3.gz -rw-r--r-- 1 root root 29507 2010-04-25 07:24 /var/log/rpmpkgs.2.gz -rw-r--r-- 1 root root 29512 2010-05-03 20:18 /var/log/rpmpkgs.1.gz -rw-r--r-- 1 root root 148518 2010-05-06 04:06 /var/log/rpmpkgs [root@tiger ~]# It looks pretty clear that 2.4.21 was working, 2.4.22 isn't. Regards, Buchan

2 3

what happens in between?
by Marc Patermann 06 May '10

06 May '10

Hi, on a (a little old) openldap 2.3 server there are 3 meta backends and local bdb backends glued together under one suffix ou=foo. meta: ou=allgv,ou=foo conn-ttl 30 idle-timeout 1m30s bdb: ou=humans,ou=foo When I ask the server for data exactly under one or the other suffix, the answer is there immediately. May 6 15:52:25 rzhs199 local4:debug slapd[4505742]: conn=321210 fd=73 ACCEPT from IP=127.0.0.1:43816 (IP=0.0.0.0:389) May 6 15:52:25 rzhs199 local4:debug slapd[4505742]: conn=321210 op=0 BIND dn="" method=128 May 6 15:52:25 rzhs199 local4:debug slapd[4505742]: conn=321210 op=0 RESULT tag=97 err=0 text= May 6 15:52:25 rzhs199 local4:debug slapd[4505742]: conn=321210 op=1 SRCH base="ou=allgv,ou=foo" scope=2 deref=0 filter="(&(&(objectClass=person)(|(mail=*@ofd-st.foo)(mail=*@ofd-z.foo)(mail=*@ofd-lbv.foo)(mail=*@ofd-bl.foo)))(|(mail=*franz*)(cn=*franz*)(givenName=*franz*)(sn=*franz*)))" May 6 15:52:25 rzhs199 local4:debug slapd[4505742]: conn=321210 op=1 ENTRY dn="cn=franziska.afffl,cn=nlbv,cn=migstand,cn=recipients,ou=inf,ou=allgv,ou=foo" May 6 15:52:25 rzhs199 local4:debug slapd[4505742]: conn=321210 op=1 ENTRY dn="cn=franziska.pfffr,cn=ofd-lba,cn=migstand,cn=recipients,ou=inf,ou=allgv,ou=foo" May 6 15:52:25 rzhs199 local4:debug slapd[4505742]: conn=321210 op=1 ENTRY dn="cn=fwfffand,cn=nlbv,cn=migstand,cn=recipients,ou=inf,ou=allgv,ou=foo" May 6 15:52:25 rzhs199 local4:debug slapd[4505742]: conn=321210 op=1 ENTRY dn="cn=cffffen.franz,cn=nlbv,cn=migstand,cn=recipients,ou=inf,ou=allgv,ou=foo" May 6 15:52:25 rzhs199 local4:debug slapd[4505742]: conn=321210 op=1 ENTRY dn="cn=jefffffer.franzen,cn=nlbv,cn=migstand,cn=recipients,ou=inf,ou=allgv,ou=foo" May 6 15:52:25 rzhs199 local4:debug slapd[4505742]: conn=321210 op=1 SEARCH RESULT tag=101 err=0 nentries=5 text= May 6 15:52:25 rzhs199 local4:debug slapd[4505742]: conn=321210 op=2 UNBIND May 6 15:52:25 rzhs199 local4:debug slapd[4505742]: conn=321210 fd=73 closed May 6 15:54:49 rzhs199 local4:debug slapd[4505742]: conn=321234 fd=17 ACCEPT from IP=127.0.0.1:43886 (IP=0.0.0.0:389) May 6 15:54:49 rzhs199 local4:debug slapd[4505742]: conn=321234 op=0 BIND dn="" method=128 May 6 15:54:49 rzhs199 local4:debug slapd[4505742]: conn=321234 op=0 RESULT tag=97 err=0 text= May 6 15:54:49 rzhs199 local4:debug slapd[4505742]: conn=321234 op=1 SRCH base="ou=humans,ou=foo" scope=2 deref=0 filter="(&(&(objectClass=person)(|(mail=*@ofd-st.foo)(mail=*@ofd-z.foo)(mail=*@ofd-lbv.foo)(mail=*@ofd-bl.foo)))(|(mail=*franz*)(cn=*franz*)(givenName=*franz*)(sn=*franz*)))" May 6 15:54:49 rzhs199 local4:debug slapd[4505742]: conn=321234 op=1 ENTRY dn="employeeNumber=10110,ou=humans,ou=foo" May 6 15:54:49 rzhs199 local4:debug slapd[4505742]: conn=321234 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 6 15:54:49 rzhs199 local4:debug slapd[4505742]: conn=321234 op=2 UNBIND May 6 15:54:49 rzhs199 local4:debug slapd[4505742]: conn=321234 fd=17 closed When I ask with base ou=foo, there is an exact 2:30 min break in between. May 6 15:27:54 rzhs199 local4:debug slapd[4505742]: conn=320932 fd=28 ACCEPT from IP=127.0.0.1:43052 (IP=0.0.0.0:389) May 6 15:27:54 rzhs199 local4:debug slapd[4505742]: conn=320932 op=0 BIND dn="" method=128 May 6 15:27:54 rzhs199 local4:debug slapd[4505742]: conn=320932 op=0 RESULT tag=97 err=0 text= May 6 15:27:54 rzhs199 local4:debug slapd[4505742]: conn=320932 op=1 SRCH base="ou=foo" scope=2 deref=0 filter="(&(&(objectClass=person)(|(mail=*@ofd-st.foo)(mail=*@ofd-z.foo)(mail=*@ofd-lbv.foo)(mail=*@ofd-bl.foo)))(|(mail=*franz*)(cn=*franz*)(givenName=*franz*)(sn=*franz*)))" May 6 15:27:54 rzhs199 local4:debug slapd[4505742]: conn=320932 op=1 ENTRY dn="cn=franziska.axxxl,cn=nlbv,cn=migstand,cn=recipients,ou=inf,ou=allgv,ou=foo" May 6 15:27:54 rzhs199 local4:debug slapd[4505742]: conn=320932 op=1 ENTRY dn="cn=franziska.pxxxer,cn=ofd-lba,cn=migstand,cn=recipients,ou=inf,ou=allgv,ou=foo" May 6 15:27:54 rzhs199 local4:debug slapd[4505742]: conn=320932 op=1 ENTRY dn="cn=fwexxxnd,cn=nlbv,cn=migstand,cn=recipients,ou=inf,ou=allgv,ou=foo" May 6 15:27:54 rzhs199 local4:debug slapd[4505742]: conn=320932 op=1 ENTRY dn="cn=cxxx.franz,cn=nlbv,cn=migstand,cn=recipients,ou=inf,ou=allgv,ou=foo" May 6 15:27:54 rzhs199 local4:debug slapd[4505742]: conn=320932 op=1 ENTRY dn="cn=jexxxxer.franzen,cn=nlbv,cn=migstand,cn=recipients,ou=inf,ou=allgv,ou=foo" May 6 15:30:24 rzhs199 local4:debug slapd[4505742]: conn=320932 op=1 ENTRY dn="employeeNumber=10110,ou=humans,ou=foo" May 6 15:30:24 rzhs199 local4:debug slapd[4505742]: conn=320932 op=1 SEARCH RESULT tag=101 err=0 nentries=6 text= May 6 15:30:24 rzhs199 local4:debug slapd[4505742]: conn=320932 op=2 UNBIND May 6 15:30:24 rzhs199 local4:debug slapd[4505742]: conn=320932 fd=28 closed What could cause this? Marc

1 0

Interesting delta-syncrepl failure
by Francis Swasey 05 May '10

05 May '10

Platform: Red Hat Enterprise Linux 5, update 5, 64-bit OpenLDAP: 2.4.22 (locally compiled), configured with delta-syncrepl. The following modify ldif successfully applies to the master: dn: uid=fcswasey,ou=People,dc=uvm,dc=edu changetype: modify replace: sn sn: Swasey - replace: sn sn: Swasey - In OpenLDAP 2.3 -- this modify ldif deck failed because the "sn" attribute is presented twice. In OpenLDAP 2.4 -- it works, but the delta-syncrepl replica pukes on it with this error: syncrepl_message_to_op: rid=100 mods check (sn: value #0 provided more than once) If the OpenLDAP 2.4.22 server accepts it, processes it, and feeds it out -- shouldn't the OpenLDAP 2.4.22 delta-syncrepl consumer eat it without complaining? -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

2 1

Re: Consumer bdb log explosion
by Mark.Hendricks＠humboldt.edu 04 May '10

04 May '10

Thank you Aaron and Quanah, At Quanah's recommendation, I added the DB_CONFIG flag to auto-remove inactive files. Essentially the ldap-hot-db-backup runs the db_archieve utility hourly! The archive utility is supposed to backup transaction logs to a different file-system and delete the inactive files. Hopefully this config change will reduce the excessive number of transaction logs and solve our problems. The database is backed up every night using slapcat, and I can also recover from the backup directory. I guess what I don't understand is why the transaction logs occasionally build up so fast. I don't have these problems on the provider (master). We've had these problems off and on since we went to syncrpl last summer. Thanks for your comments. Mark ----- Original Message ----- From: "Aaron Richton" Subject: Re: Consumer bdb log explosion On Tue, 4 May 2010, Mark.Hendricks wrote: > We are running slapd 2.3.43 (Using bdb db4-4.3.29-10.el5) with one provider and two consumers and syncrpl (kerberos/SASL based). > Occasionally when heavy changes to the provider are made, the consumer bdb logs go crazy and fill up the bdb volume. Remove unnecessary log files prior to volume fill, hopefully in conjunction with a sane backup procedure (I don't know what ldap-hot-backup is, but hopefully it eventually calls slapcat(8) and that output gets put somewhere safe). I assume "10MB file per second" refers to transaction log file size, which sounds like sufficient granularity to remove in a timely fashion in most installations. http://www.openldap.org/faq/data/cache/738.html -- Mark Hendricks Information Security Analyst Information Technology Services Humboldt State University

1 0

Consumer bdb log explosion
by Mark.Hendricks＠humboldt.edu 04 May '10

04 May '10

We are running slapd 2.3.43 (Using bdb db4-4.3.29-10.el5) with one provider and two consumers and syncrpl (kerberos/SASL based). Occasionally when heavy changes to the provider are made, the consumer bdb logs go crazy and fill up the bdb volume. When this occurs we see approximately 1 10MB file created per second until the 14GB of free space in the volume has been exhausted, often in around an hour. These packages are from the Buchan Milne repo. Any ideas would be greatly appreciated. Thanks! (I have ldap-hot-db-backup running hourly) DB Volume size = 14GB free. 1 10MB file per second DB_CONFIG set_lk_max_lockers 8000 set_lk_max_objects 8000 # one 0.25 GB cache set_cachesize 0 268435456 1 # Data Directory #set_data_dir db # Transaction Log settings set_lg_regionmax 262144 set_lg_bsize 2097152 #set_lg_dir logs -- Mark Hendricks Information Security Analyst Information Technology Services Humboldt State University

3 2

too many open files
by Hugo Monteiro 04 May '10

04 May '10

Hello list, Although the subject suggests a fairly know issue, i cannot seem to understand the cause. Log file presents Apr 22 12:57:36 proxyldap1 slapd[1511]: warning: cannot open /etc/hosts.allow: Too many open files Apr 22 12:57:36 proxyldap1 slapd[1511]: warning: cannot open /etc/hosts.deny: Too many open files , but proxyldap1:~# cat /proc/sys/fs/file-max 100000 proxyldap1:~# cat /proc/sys/fs/file-nr 1088 0 100000 proxyldap1:~# lsof -p `pidof slapd`| wc -l 460 proxyldap1:~# su -c "ulimit -n" openldap 8192 slapd is version 2.4.17-2 (Debian Unstable) and is running on a xen vm, using 64bit kernel 2.6.26-2-xen-amd64 in a Debian Lenny system. Have i overlooked any aspect? Thank you in advance, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

4 7

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software May 2010