openldap-software

openldap-software@openldap.org

2719 discussions

Grace period for inactive accounts?
by John Maki 14 Mar '08

14 Mar '08

Hi, I'm using Openldap 2.3.38 with the ppolicy overlay on a Fedora 7 x86-64 server. Is there any functionality built in to provide account locking after a certain length of time after a password expires? Similiar to pwdGraceAuthnLimit but based on time rather than number of login attempts? I'd like to be able to lock accounts after a period of inactivity. Or am I missing some other way of doing this? Thanks, John ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

5 5

slurpd does not sync master and slave
by юрка олейников 14 Mar '08

14 Mar '08

i have a problem running slurp. there're tw ldap servers master (which has already DB) and slave (with empty DB). i'm running slurp: /path/to/slurd -d 1 and it terminates immidiately with: > Config: ** configuration file successfully read and parsed > Processing in one-shot mode: > 0 total replication records in file, > 0 replication records to process. > begin replication thread for 147.161.2.132:389 > end replication thread for 147.161.2.132:389 > slurpd: terminated. slave DB remains empty. my master's slapd.conf contains: > database bdb > suffix "dc=domain" > rootdn "cn=admin,dc=domain" > rootpw {SSHA}plaplapla > replica host=147.161.2.132:389 binddn="cn=admin,dc=domain" bindmethod=simple credentials=PlaPlaPla > replogfile /usr/var/openldap-slurp/rep.log > directory /var/lib/ldap/ slave is identical except: > database bdb > suffix "dc=domain" > rootdn "cn=admin,dc=domain" > rootpw {SSHA}plaplapla > updatedn "cn=admin,dc=domain" > directory /var/lib/ldap/ both slapd (on master and slave) are running as root priveleges master's version is 2.3.25 (slackware) and slave's - 2.3.37(OpenSuse 10.3). can anybody explain why it does not sync servers? PS: slaptest: "config file testing succeeded" on both servers. -- Be Secure, Stay Open - live w/ OpenBSD

2 1

acl to read dn only
by Ron Peterson 14 Mar '08

14 Mar '08

I'm trying to create an acl which allow a particular use to search my DIT and retrieve dn values only. Perhaps a (broken) attempt at an acl will help explain what I mean: access to dn.children="dc=mtholyoke,dc=edu" attrs=distinguishedName by dn="cn=proxysearchdn,dc=mtholyoke,dc=edu" read by * break access to dn.children="dc=mtholyoke,dc=edu" by dn="cn=proxysearchdn,dc=mtholyoke,dc=edu" search by * break I want to use my proxysearchdn user to do the first step of a search and bind operation, without giving that user any more access to objects than necessary. BTW, I can indicate attrs=distinguishedName, but attrs=dn gives me an error. Correct behaviour, I'm sure, but I'm not sure then how to say what I mean. TIA. -- Ron Peterson Network & Systems Manager Mount Holyoke College http://www.mtholyoke.edu/~rpeterso

2 2

Constraint violation: structuralObjectClass: no user modification allow
by openldap 14 Mar '08

14 Mar '08

Hi listers, i have a master LDAP with version openldap-servers-2.3.39-1.fc8, a slave LDAP with version openldap-servers-2.3.34-0.fc7 a slave LDAP with version openldap-server-2.3.33p1-bdb the versions are close enough to one another in order to be compatible. the first two are on fedore 8 and fedora 7, the third on openBSD. from the master to the two slaves, slurpd replication is installed. as the slurpd replication will no longer be available, i started testing syncrepl from the third LDAP server onto a fourth one. i wanted to test, if i can configure them for refreshAndPersist replication. to do that i first configured the third to act as a syncrepl provider for the fourth one and then added a new entry in a test subtree on the master server. the following happened: the second server immediately got the changes via slurpd and accepted them. the third server also got the changes but rejected them: Mar 14 13:33:33 thirdhost slapd[18518]: conn=6 fd=20 ACCEPT from IP=xx.xx.xx.xx:45565 (IP=0.0.0.0:3 89) Mar 14 13:33:33 thirdhost slapd[18518]: conn=6 op=0 BIND dn="cn=manager,dc=mydom,dc=com" method=128 Mar 14 13:33:33 thirdhost slapd[18518]: conn=6 op=0 BIND dn="cn=Manager,dc=mydom,dc=com" mech=SIMPLE ssf =0 Mar 14 13:33:33 thirdhost slapd[18518]: conn=6 op=0 RESULT tag=97 err=0 text= Mar 14 13:33:33 thirdhost slapd[18518]: conn=6 op=1 ADD dn="cn=wurguri,ou=LDIF-Test,dc=mydom,dc=com" Mar 14 13:33:33 thirdhost slapd[18518]: conn=6 op=1 RESULT tag=105 err=19 text=structuralObjectClass: n o user modification allowed on the master if found the following in the slurpd-log: ERROR: Constraint violation: structuralObjectClass: no user modification allow ed replica: thirdhost.mydom.com:389 time: 1205498012.0 dn: cn=wurguri,ou=LDIF-Test,dc=mydom,dc=com changetype: add sn: wurguri cn: wurguri objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson structuralObjectClass: inetOrgPerson entryUUID: 9a3fdcd8-860e-102c-9ead-03486d6a2d35 creatorsName: cn=myuser,ou=pam-ldap,dc=mydom,dc=com createTimestamp: 20080314123332Z entryCSN: 20080314123332Z#000000#00#000000 modifiersName: cn=myuser,ou=pam-ldap,dc=mydom,dc=com modifyTimestamp: 20080314123332Z as far as i understand, the third LDAP server did not like the structuralObjectClass specs. when googling around i found "that it is very easy with sed to extract the structuralObjectClass specs" from the ldif file. what do i need to change either on the master, not to let it create ldif files which are unaceptable for the other(s), or on the slave to make it accept the structuralObjectClass specs? suomi

2 1

syncrepl not syncing [ CSN older or equal to ctx ]
by Duncan Brannen 14 Mar '08

14 Mar '08

Hi, I've got a slave that I think I missed out the -w on the slapadd when I rebuilt it recently and it's not picking up changes from the master. What I'm seeing in the log is slapd[11886]: [ID 502419 local4.debug] Entry reqStart=20080311204629.000002Z,cn=accesslog CSN 20080311204629.095387Z#000000#000#000000 older or equal to ctx 20080311204629.095387Z#000000#000#000000 Every 60 seconds or so. (My retry interval) type is RefreshAndPersist Is there an easy way to reset the timestamp on the slave / master so this fires into life or do I need to reload it? Slave is 2.4.7 and the master is 2.4.8 so it's due another upgrade soon anyway but I'd rather get then synced now and upgrade out of hours. Thansk, Duncan

2 6

Operational attribute pwdFailureTime not being added to entries
by Ryan Steele 14 Mar '08

14 Mar '08

Hello, First let me thank the gracious folks on this list who have lent their advice to me on my path towards implementing ppolicy. I'm making progress; I can reject new passwords based on password history, and reject weak passwords. However, I'm having a bit of a time trying to get the lockouts to work. My policy is defined as: 56 cn=Password Policy,ou=Policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: Password Policy pwdAttribute: userPassword pwdMaxAge: 3888000 pwdMinLength: 6 pwdExpireWarning: 432000 pwdFailureCountInterval: 0 pwdMustChange: FALSE pwdAllowUserChange: TRUE pwdSafeModify: TRUE pwdLockout: TRUE pwdCheckQuality: 1 pwdGraceAuthNLimit: 0 pwdInHistory: 6 pwdLockoutDuration: 60 pwdMaxFailure: 3 However, even after many failure attempts, I see no pwdFailureTime attributes in the offending user's entry: dn: uid=testuser,ou=Users,dc=example,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSamAccount cn: testuser sn: testuser givenName: testuser uid: testuser uidNumber: 1009 gidNumber: 513 homeDirectory: /home/testuser loginShell: /bin/bash gecos: System User structuralObjectClass: inetOrgPerson entryUUID: 42d5971e-7b49-102c-8aae-af676a6dbed9 creatorsName: cn=admin,dc=example,dc=com createTimestamp: 20080229193543Z sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 displayName: System User sambaSID: S-1-5-21-1484159386-3942804292-94657008-3018 sambaPrimaryGroupSID: S-1-5-21-1484159386-3942804292-94657008-513 sambaLogonScript: logon.bat sambaProfilePath: \\masterldap.example.com\profiles\testuser sambaHomePath: \\masterldap.example.com\testuser sambaHomeDrive: H: pwdHistory: 20080313194326Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}C2DOwhgHFTc XmGxRdqlpBUz12eZpRXI4 pwdHistory: 20080313194602Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}AboL9Sp7678 X2KsPv8sMPE5CC2i6c6LY pwdHistory: 20080313194626Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}7hUqCecYGvd g5bx1ybw71YQcZShicmFk pwdHistory: 20080313194852Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}E920Fe1PlYV Bwjn+rpiOFO8UaiRzZnB6 pwdHistory: 20080313200637Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}hFfD2xFwG/T s5PVg3CAIf4i6rkpaZnNM pwdHistory: 20080313200941Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}/GpzR2wV7dy XITeU+5nBpFyTKdgxQzk4 sambaLMPassword: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX sambaAcctFlags: [U] sambaNTPassword: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX sambaPwdLastSet: 1205438797 sambaPwdMustChange: 1209326797 userPassword:: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX pwdChangedTime: 20080313200941Z entryCSN: 20080313200941Z#000000#00#000000 modifiersName: cn=admin,dc=example,dc=com modifyTimestamp: 20080313200941Z Is the shadowAccount attribute killing me? I'm not really sure. Just for completeness, the slapd.conf (abridged) looks like: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/ppolicy.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib/openldap database bdb suffix "dc=example,dc=com" directory /var/lib/ldap rootdn "cn=admin,dc=example,dc=com" rootpw {SSHA}tFEA391Y3ZLHXkQDDk6f0t1ZkJEuMwIj overlay ppolicy ppolicy_default "cn=Password Policy,ou=Policies,dc=example,dc=com" ppolicy_use_lockout access to attrs=userPassword,sambaNTPassword,sambaLMPassword,shadowLastChange,shadowMax,sambaPwdLastSet,sambaPwdMustChange by self write by * auth access to * by * read moduleload smbk5pwd.la index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub loglevel -1 sasl-secprops none As always, thank you for your help. Best Regards, Ryan

2 1

Struggling with ppolicy
by Ryan Steele 13 Mar '08

13 Mar '08

Hey folks, If this is the wrong list, please let me know and I'd be happy to send it to the right one. As I've mentioned in a previous post (which hasn't been posted yet, so I apologize if you've seen any of this information already) I've got a FC6 box, with OpenLDAP 2.3.30. I'm attempting to get ppolicy to work, and I can now successfully start OpenLDAP with the ppolicy directive in it: ### abridged slapd.conf ### include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/ppolicy.schema modulepath /usr/lib/openldap overlay ppolicy ppolicy_default "cn=Password Policy,ou=policies,ou=example,ou=com" access to attrs=userPassword,sambaNTPassword,sambaLMPassword,shadowLastChange,shadowMax,sambaPwdLastSet,sambaPwdMustChange by self write by * auth access to * by * read database bdb suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXX directory /var/lib/ldap index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub sasl-secprops none ### Password Policy entry via slapcat ### dn: cn=Password Policy,ou=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: Password Policy pwdAttribute: 2.5.4.35 pwdMaxAge: 3888000 pwdInHistory: 2 pwdCheckQuality: 1 pwdMinLength: 6 pwdExpireWarning: 432000 pwdGraceAuthNLimit: 5 pwdMaxFailure: 10 pwdFailureCountInterval: 0 pwdMustChange: FALSE pwdAllowUserChange: TRUE pwdSafeModify: TRUE pwdLockoutDuration: 7776000 pwdLockout: TRUE structuralObjectClass: device entryUUID: 2e1eee98-83ea-102c-9736-1d2794f3677b creatorsName: cn=admin,dc=example,dc=com createTimestamp: 20080311190746Z entryCSN: 20080311190746Z#000000#00#000000 modifiersName: cn=admin,dc=example,dc=com modifyTimestamp: 20080311190746Z [root@server openldap]# /etc/init.d/ldap start Checking configuration files for slapd: WARNING: No dynamic config support for overlay ppolicy. config file testing succeeded [ OK ] Starting slapd: [ OK ] >From what I gather, since I'm using a slapd.conf and not a back-bdb, that warning does not apply to me. However, when I add users, I see no special attributes that show they're being regulated by ppolicy (Googling turned up some ldif's that had pwdPolicySubentry attributes - should I have that?) Additionally, I can enter passwords such as 'a' - single characters, and it doesn't complain at all. In fact, none of the restrictions are being enforced, and I'm really scratching my head. The options I compiled with were: --enable-plugins \ --enable-ppolicy=yes \ --enable-slapd \ --enable-slurpd \ --enable-multimaster \ --enable-bdb \ --enable-hdb \ --enable-ldap \ --enable-ldbm \ --with-ldbm-api=%{ldbm_backend} \ --enable-meta \ --enable-monitor \ --enable-null \ --enable-shell \ --enable-sql=mod \ --disable-perl \ --disable-shared \ --disable-dynamic \ --enable-static \ --with-kerberos=k5only Thanks in advance for any help... Best Regards, Ryan

3 2

Help with server hang
by Marantz, Roy 13 Mar '08

13 Mar '08

I'm running OpenLDAP 2.4.8 with Berkeley DB 2.4.6 on Solaris-10 compiled with Sun's compiler. If I start and stop slapd in short succession it will hang after the 2nd or 3rd time. Following are the syslog message, a pstack (backtrace), and sanitized copy of slapd.conf. Any help in debugging this would be appreciated. Thanks. Roy Mar 11 16:00:33 master.nyc.deshaw.com slapd[3991]: [ID 702911 local4.debug] @(#) $OpenLDAP: slapd 2.4.8 (Mar 10 2008 13:35:31) $ Mar 11 16:00:33 master.nyc.deshaw.com mselby@desab005.nyc.deshaw.com:/var/tmp/build/openldap-2.4.8/servers/sla pd Mar 11 16:00:33 master.nyc.deshaw.com slapd[3991]: [ID 991073 local4.error] nss_order: ldap: not a member of group: staff Mar 11 16:00:33 master.nyc.deshaw.com slapd[3991]: [ID 610730 local4.debug] pkcs11_softtoken: Cannot create keystore. Mar 11 16:00:33 master.nyc.deshaw.com slapd[3995]: [ID 100111 local4.debug] slapd starting Mar 11 16:00:39 master.nyc.deshaw.com slapd[3995]: [ID 543694 local4.debug] daemon: shutdown requested and initiated. Mar 11 16:00:39 master.nyc.deshaw.com slapd[3995]: [ID 542995 local4.debug] slapd shutdown: waiting for 0 threads to terminate 13476: /usr/local/openldap/libexec/slapd -u ldap -g ldap ----------------- lwp# 1 / thread# 1 -------------------- fe001117 lwp_wait (2, 80476f8) fdffd326 _thrp_join (2, 0, 0, 1) + 5a fdffd4a5 pthread_join (2, 0, 80871e0, 0) + 2b 08088b02 slapd_daemon () + 7a ----------------- lwp# 2 / thread# 2 -------------------- fe00040b lwp_park (0, 0, 0) fdffac7a cond_wait_queue (83114ac, 8311494, 0, 0) + 68 fdffb146 _cond_wait (83114ac, 8311494) + 66 fdffb188 cond_wait (83114ac, 8311494) + 21 fdffb1c1 pthread_cond_wait (83114ac, 8311494, a7, 821603c) + 1b 08196c6c ldap_pvt_thread_pool_destroy (fe000542, 0, 83114cc, fdee8ec0, fdc70000, 0) + e4 083114c8 ???????? () include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/desco.schema include /etc/openldap/schema/sendmail.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args password-hash {CRYPT} modulepath /usr/local/openldap/libexec/openldap moduleload syncprov.la moduleload rwm.la loglevel 256 sizelimit 512000 TLSCertificateFile /etc/openldap/ssl/server.crt TLSCertificateKeyFile /etc/openldap/ssl/server.key TLSCACertificateFile /etc/openldap/ssl/ca.crt TLSVerifyClient never access to * by dn="cn=ldapadm,dc=nyc,dc=example,dc=com" write by dn="cn=syncrepl,dc=nyc,dc=example,dc=com" write by * read database bdb suffix "dc=nyc,dc=example,dc=com" rootdn "cn=root,dc=nyc,dc=example,dc=com" rootpw secrete directory /var/openldap/nyc.example.com/data cachesize 15000 checkpoint 512 720 index objectClass eq index entryCSN eq index entryUUID eq index ou eq index uid eq index cn eq,sub index sn eq,sub index uidNumber eq index gidNumber eq index userPassword eq index memberUid eq index ipHostNumber eq index ipNetworkNumber eq index ipProtocolNumber eq index ipServiceProtocol eq index oncRpcNumber eq index macAddress eq index ipServicePort eq index automountKey eq index amdKey eq index desmailKey eq index desmiscKey eq index sendmailMTAAliasGrouping eq index sendmailMTAMapName eq index sendmailMTAKey eq serverID 1 database relay suffix "ou=sendmail,dc=example,dc=mail" overlay rwm suffixmassage "ou=sendmail,dc=nyc,dc=example,dc=com" database monitor database monitor

2 2

null_callbacks after initial sync
by Nick Geron 12 Mar '08

12 Mar '08

I'm working with a test mirror mode setup on 2.4.7 with db 4.5.20 and seeing issues with SyncRepl. Specifically, do_syncrepl fails with an initial error 0x10 and subsequent 0x14, though at least one modification is propagated. To put another way: *Systems using same ldif to populate and running nearly identical slapd.conf files (serverID is the only variance). 1) start server 1 2) start server 2 3) add host attribute to posixAccount entry on s-1 4) attribute seen on s-2 but results in the following log 5) no other updates successful until server process restarted. Mar 4 10:46:14 slapd[22999]: do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Mar 4 10:46:14 slapd[22999]: do_syncrep2: cookie=rid=001,sid=002,csn=20080304164630.523962Z#000000#001#000000 Mar 4 10:46:19 slapd[22999]: conn=0 fd=25 ACCEPT from IP=172.30.24.5:53140 (IP=0.0.0.0:389) Mar 4 10:46:19 slapd[22999]: conn=0 op=0 BIND dn="uid=syncrepl,ou=ldap,dc=example,dc=com" method=128 Mar 4 10:46:19 slapd[22999]: conn=0 op=0 BIND dn="uid=syncrepl,ou=ldap,dc=example,dc=com" mech=SIMPLE ssf=0 Mar 4 10:46:19 slapd[22999]: conn=0 op=0 RESULT tag=97 err=0 text= Mar 4 10:46:19 slapd[22999]: conn=0 op=1 SRCH base="cn=accesslog" scope=2 deref=0 filter="(reqResult=0)" Mar 4 10:46:19 slapd[22999]: conn=0 op=1 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Mar 4 10:46:45 slapd[22999]: conn=1 fd=26 ACCEPT from IP=172.16.71.134:65251 (IP=0.0.0.0:389) Mar 4 10:46:45 slapd[22999]: conn=1 op=0 BIND dn="cn=manager,dc=example,dc=com" method=128 Mar 4 10:46:45 slapd[22999]: conn=1 op=0 BIND dn="cn=manager,dc=example,dc=com" mech=SIMPLE ssf=0 Mar 4 10:46:45 slapd[22999]: conn=1 op=0 RESULT tag=97 err=0 text= Mar 4 10:46:45 slapd[22999]: conn=1 op=1 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Mar 4 10:46:45 slapd[22999]: conn=1 op=1 SEARCH RESULT tag=101 err=0 nentries=2 text= Mar 4 10:46:45 slapd[22999]: conn=1 op=2 UNBIND Mar 4 10:46:45 slapd[22999]: conn=1 fd=26 closed Mar 4 10:46:45 slapd[22999]: conn=2 fd=26 ACCEPT from IP=192.168.15.32:45137 (IP=0.0.0.0:389) Mar 4 10:46:45 slapd[22999]: conn=2 fd=26 closed (connection lost) Mar 4 10:47:07 slapd[22999]: do_syncrep2: cookie=rid=001,sid=002,csn=20080304164728.385080Z#000000#001#000000 Mar 4 10:47:07 slapd[22999]: syncrepl_message_to_op: rid=001 be_modify uid=tguy,ou=employees,ou=people,dc=example,dc=com (0) Mar 4 10:47:07 slapd[22999]: null_callback : error code 0x10 Mar 4 10:47:07 slapd[22999]: syncrepl_updateCookie: rid=001 be_modify failed (16) Mar 4 10:47:07 slapd[22999]: do_syncrepl: rid=001 retrying Mar 4 10:47:17 slapd[22999]: null_callback : error code 0x14 Mar 4 10:47:17 slapd[22999]: syncrepl_message_to_op: rid=001 be_modify uid=tguy,ou=employees,ou=people,dc=example,dc=com (20) **** LAST 3 LINES REPEATED THEREAFTER **** A little more verbose output on the consumer side shows some problem modifying the underlying DB, but I can't see an obvious where to go from here. Mar 4 10:57:10 slapd[23057]: =>do_syncrepl rid=001 Mar 4 10:57:10 slapd[23057]: =>do_syncrep2 rid=001 Mar 4 10:57:10 slapd[23057]: >>> dnPrettyNormal: <uid=tguy,ou=employees,ou=people,dc=example,dc=com> Mar 4 10:57:10 slapd[23057]: <<< dnPrettyNormal: <uid=tguy,ou=employees,ou=people,dc=example,dc=com>, <uid=tguy,ou=employees,ou=people,dc=example,dc=com> Mar 4 10:57:10 slapd[23057]: >>> dnPretty: <cn=Manager,dc=example,dc=com> Mar 4 10:57:10 slapd[23057]: <<< dnPretty: <cn=Manager,dc=example,dc=com> Mar 4 10:57:10 slapd[23057]: >>> dnNormalize: <cn=Manager,dc=example,dc=com> Mar 4 10:57:10 slapd[23057]: <<< dnNormalize: <cn=manager,dc=example,dc=com> Mar 4 10:57:10 slapd[23057]: => bdb_entry_get: ndn: "uid=tguy,ou=employees,ou=people,dc=example,dc=com" Mar 4 10:57:10 slapd[23057]: => bdb_entry_get: oc: "(null)", at: "(null)" Mar 4 10:57:10 slapd[23057]: bdb_dn2entry("uid=tguy,ou=employees,ou=people,dc=example,dc=com") Mar 4 10:57:10 slapd[23057]: => bdb_entry_get: found entry: "uid=tguy,ou=employees,ou=people,dc=example,dc=com" Mar 4 10:57:10 slapd[23057]: bdb_entry_get: rc=0 Mar 4 10:57:10 slapd[23057]: hdb_modify: uid=tguy,ou=employees,ou=people,dc=example,dc=com Mar 4 10:57:10 slapd[23057]: bdb_dn2entry("uid=tguy,ou=employees,ou=people,dc=example,dc=com") Mar 4 10:57:10 slapd[23057]: bdb_modify_internal: 0x00000a2b: uid=tguy,ou=employees,ou=people,dc=example,dc=com Mar 4 10:57:10 slapd[23057]: <= acl_access_allowed: granted to database root Mar 4 10:57:10 slapd[23057]: bdb_modify_internal: delete host Mar 4 10:57:10 slapd[23057]: bdb_modify_internal: 16 modify/delete: host: no such value Mar 4 10:57:10 slapd[23057]: hdb_modify: modify failed (16) Mar 4 10:57:10 slapd[23057]: send_ldap_result: conn=-1 op=0 p=0 Mar 4 10:57:10 slapd[23057]: send_ldap_result: err=16 matched="" text="modify/delete: host: no such value" Mar 4 10:57:10 slapd[23057]: null_callback : error code 0x10 Mar 4 10:57:10 slapd[23057]: syncrepl_message_to_op: rid=001 be_modify uid=tguy,ou=employees,ou=people,dc=example,dc=com (16) Again, if multiple, successful writes are made to the 'primary' server in the mirror, only the first makes it to the 'secondary.' If the second server is restarted, it retrieves all new edits as expected. Can someone elaborate on what bdb_modify_internal is trying to tell me? Please let me know if more information is required. Thanks. Slapd.conf # Global Settings ################# include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/sendmail.schema include /etc/openldap/schema/solaris.schema include /etc/openldap/schema/example.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args sizelimit unlimited # Loglevel ########## loglevel any moduleload /usr/local/libexec/openldap/back_hdb.la moduleload /usr/local/libexec/openldap/accesslog.la # TLS/SSL ######### TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /etc/openldap/certs/ldap.example.com.crt TLSCertificateKeyFile /etc/openldap/certs/ldap.example.com.key TLSCACertificateFile /etc/openldap/certs/ca.crt TLSVerifyClient never # Access log ############ database bdb suffix cn=accesslog directory /var/lib/openldap-data/accesslog rootdn cn=Manager,cn=accesslog rootpw secret index default eq index reqStart,objectClass,entryCSN,reqResult eq cachesize 3000 idlcachesize 9000 overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE # Primary DB Configuration ########################## database hdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret directory /var/lib/openldap-data/example.com cachesize 3000 idlcachesize 9000 # Primary DB Indexes #################### index objectClass,entryUUID,entryCSN eq index cn,sn,uid eq,sub,pres,approx index sendmailMTAMapName eq,pres index sendmailMTAMapValue eq index sendmailMTAKey eq,sub,pres index sendmailMTAAliasValue eq,pres index sendmailMTAClassName eq index sendmailMTAClassValue eq index exampleUserModifiable eq # Primary DB SyncRepl ##################### syncrepl rid=1 provider=ldap://ldap.example.com type=refreshAndPersist searchbase="dc=example,dc=com" bindmethod=simple binddn="uid=syncrepl,ou=ldap,dc=example,dc=com" credentials="syncpw" retry="10 +" schemachecking=off logbase="cn=accesslog" syncdata=accesslog logfilter="(reqResult=0)" mirrormode on serverID 2 # Primary DB Sync Provider ########################## overlay syncprov syncprov-checkpoint 10 1 syncprov-sessionlog 100 # Primary DB accesslog ###################### overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 # ACLs for Primary DB ##################### access to attrs=userPassword by anonymous auth by self write by dn="uid=syncrepl,ou=ldap,dc=example,dc=com" read by dn="uid=pam,ou=ldap,dc=example,dc=com" read by * none access to dn.subtree="ou=employees,ou=people,dc=example,dc=com" by anonymous auth by self write by dn.regex="uid=[^,]+,ou=employees,ou=people,dc=example,dc=com" read by dn="uid=syncrepl,ou=ldap,dc=example,dc=com" read by dn="uid=pam,ou=ldap,dc=example,dc=com" read by * none access to dn.subtree="ou=group,dc=example,dc=com" by dn.regex="uid=[^,]+,ou=employees,ou=people,dc=example,dc=com" read by dn="uid=syncrepl,ou=ldap,dc=example,dc=com" read by dn="uid=pam,ou=ldap,dc=example,dc=com" read access to dn.subtree="ou=ldap,dc=example,dc=com" by anonymous auth by dn="uid=syncrepl,ou=ldap,dc=example,dc=com" read by dn="uid=pam,ou=ldap,dc=example,dc=com" read access to dn="ou=sendmail,dc=example,dc=com" by ssf=112 dn.base="uid=sendmail,ou=ldap,dc=example,dc=com" read by dn.regex="uid=[^,]+,ou=employees,ou=people,dc=example,dc=com" read by dn="uid=syncrepl,ou=ldap,dc=example,dc=com" read access to dn.subtree="dc=example,dc=com" by dn="uid=syncrepl,ou=ldap,dc=example,dc=com" read by dn="uid=pam,ou=ldap,dc=example,dc=com" read by dn.regex="uid=[^,]+,ou=employees,ou=people,dc=example,dc=com" read access to dn.base="" by * read

4 14

bdb_locker_id: err Cannot allocate memory(12)
by Raphaël Ouazana-Sustowski 11 Mar '08

11 Mar '08

Hi, I have a problem with an OpenLDAP server version 2.3.30. It is configured with many databases (more than 100), and when I try a search I get this error message: bdb_locker_id: err Cannot allocate memory(12) I tried to play with different parameters of DB_CONFIG (locks, cache_size, etc.) and slapd.conf (threads in particular) but without any result. Looking at the code I found that the function ldap_pvt_thread_pool_setkey (where it seems the error is from) doesn't allocate memory, but uses a fixed size table ctx of length MAXKEYS. Do you think I need to increase the MAXKEYS value, or that the problem is from somewhere else? Thanks in advance for your help, Raphaël Ouazana.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software