openldap-software

openldap-software@openldap.org

2719 discussions

Best multi-password password changing setup
by Buchan Milne 12 Oct '07

12 Oct '07

(This email has been sitting in my drafts folder for a week ... if it seems incomplete, it was because I didn't want to wait till next week Tuesday when I am finally back in the office). I'm trying to complete a system which allows authentication by a number of means, for example: -Wifi authentication with WPA2 with MSCHAPv2 to FreeRADIUS against sambaNTPassword attribute in OpenLDAP -Samba domain -Kerberos with keys stored in OpenLDAP -Some hardware devices which read userPassword and compare the hash At the same time, I would like password policies applied, including: -Password expiry by default (but exempt some accounts from password expiry) -Password history checking -Password strength rules (at minimum length, preferably enforce variation of character types) It seems that Heimdal currently doesn't have password history support, and the password expiry available is quite limited (e.g. global via [kadmin]password_lifetime). However, Heimdal respects the sambaPwdMustChange attribute MIT has password history support, and support for multiple password expiry policies, but password history is not available with the LDAP backend (and I don't see mention of whether the password policies can be stored in LDAP either). Password changes via Heimdal will: -Change the password in the krb5key attributes -Change the password in sambaNTPassword -update krb5PasswordEnd -update sambaPwdMustChange (but not sambaPwdLastSet) -not change the password in userPassword -not update pwdChangedTime -not update passwords in pwdHistory Password changes via OpenLDAP (exop) with ppolicy and smbk5pwd overlays will: -Change the password in the krb5Key attributes -Change the password in the userPassword attribute -Change the password in the sambaNTPassword and sambaLMPassword attributes -update pwdChangedTime -update sambaPwdLastSet (but not sambaPwdMustChange) -update passwords in pwdHistory -Not update krb5PasswordEnd I would prefer not to rely on password changing via samba, since most users don't really know anything about samba (so, I'll probably have samba setup for 'ldap passwd sync = only' So, are there any solutions to this problem ? Or, will one of ppolicy or smbk5pwd need to be updated to take the other into account. Regards, Buchan

4 6

encrypt password by md5 twice?
by Zhang Weiwu 11 Oct '07

11 Oct '07

Dear everyone I am planing to migrate an Intranet info system to authenticate with OpenLDAP, so more of our business can be done with the same login. The old system uses their own SQL table to store user information, no problem, I can write a script to convert to LDIF format. But md5 was used to encrypt user password, and the developer of that system knows md5 is cracked, so he encrypted the md5 hash with md5 method again. clear text password --> md5 hash --> md5 hash of the md5 hash My question: 1. Have you ever heard this solution to avoid md5 crack? Now as I cannot reach the original system author, I wonder how this idea come to be (e.g. why not using SHA). 2. Does it work? (is md5 hashed md5 hash much safer with no side-effect?) 3. Now, how we can migrate this system to use openldap. AFAIK openldap have no direct support for such hash. There are a lot of users of the system and there will be problems if migration is done and everyone's password is reset.. Thanks in advance! -- Real Softservice Huateng Tower, Unit 1788 Jia 302 3rd area of Jinsong, Chao Yang Tel: +86 (10) 8773 0650 ext 603 Mobile: 135 9950 2413 http://www.realss.com

5 4

RE: userPassword attribute
by Marot Laurent 11 Oct '07

11 Oct '07

Sorry Isn't posixUser an objectClass implementing userPassword ? I just actually wanted to know where I can find attribute definition of userpassword as the definition is commented out in core.schema # system schema #attributetype ( 2.5.4.35 NAME 'userPassword' # DESC 'RFC2256/2307: password of user' # EQUALITY octetStringMatch # SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} ) De : Owen DeLong [mailto:owen@delong.com] Envoyé : jeudi 11 octobre 2007 18:21 À : Marot Laurent Objet : Re: userPassword attribute PosixUser Owen On Oct 11, 2007, at 7:27 AM, Marot Laurent wrote: Hello, Could you please tell me where userPassword attribute syntax is defined in openLdap because I only found it in core.schema but commented out. Thanks LM

2 1

userPassword attribute
by Marot Laurent 11 Oct '07

11 Oct '07

Hello, Could you please tell me where userPassword attribute syntax is defined in openLdap because I only found it in core.schema but commented out. Thanks LM

3 2

Client application connection pool and OpenLDAP
by Sylvain Belleau 11 Oct '07

11 Oct '07

Hi! I have a Java application (that works with Novell JLDAP) as a client to OpenLDAP. This application use a connection pool in which 5 connections are open when it is started and maintain until the application is stopped. That means, the application send search, compare, update command to OpenLDAP through each of the 5 connections without closing the connections between each command that is sent to OpenLDAP. Does OpenLDAP support application that use a connection pool ? In other words, does OpenLDAP release its memory after each command (search, ADD, ...) that is executed or it release its memory after the client application close the socket ? I'm asking this question because memory used by OpenLDAP keep growing until it exceed the capacity of Linux. I use RHEL v.4 with OpenLDAP v.2.2.13 Someone told me, I should not have any memory leak with this version and probably that OpenLDAP release its memory only when the socket with the client application is closed. he also said that I should not use a connection pool to send ldap command to OpenLDAP. Do you agree with that ? thanks for your help Sylvain

4 3

Re: empty db
by Gavin Henry 11 Oct '07

11 Oct '07

<quote who="Richard smith"> > Where are they logs ? Sigh. /var/log/ldap or /var/log/openldap.log Know your system ;-) What version and distro are you using? RPMs/source? > > Gavin Henry <ghenry(a)OpenLDAP.org> wrote: > What do your logs show? > > > > --------------------------------- > Be a better Globetrotter. Get better travel answers from someone who > knows. > Yahoo! Answers - Check it out.

4 3

RE: ldapsearch on local attributes with slapo-translucent
by Srilakshmanan, Kumuthiny 11 Oct '07

11 Oct '07

Are you missing a bracket? "(&(object Class=AsteriskSIPUser)(AstAccountName=600))" -----Original Message----- From: openldap-software-bounces+kumuthiny.srilakshmanan=auspost.com.au(a)OpenLDAP.or g [mailto:openldap-software-bounces+kumuthiny.srilakshmanan=auspost.com.au@Ope nLDAP.org] On Behalf Of Gavin Henry Sent: Friday, 20 July 2007 7:26 AM To: openldap-software(a)openldap.org Subject: ldapsearch on local attributes with slapo-translucent Dear All, I'm doing some work with Asterisk and translucent, trying to overlay some attributes to an existing remote account, locally. These attributes have been added by entries in the local database before being presented to me via ldapsearch, whilst searching for attributes present in the remote directory: objectClass: AsteriskExtension objectClass: AsteriskSIPUser AstAccountName: 600 AstAccountType: friend AstAccountSecret: 600 AstAccountQualify: yes AstAccountPort: 5060 AstAccountNAT: never AstAccountMailbox: 600@device AstAccountHost: dynamic AstAccountDTMFMode: rfc2833 AstAccountContext: from-internal AstAccountCanReinvite: no AstAccountCallerID: Gavin <502> Should I expect to be able to search for the above attributes and get a result? Currently I am not. A filter like: "(&(objectClass=AsteriskSIPUser)(AstAccountName=600)" returns: ldapsearch: ldap_search_ext: Bad search filter (-7) So I guess that answers my question. If slapo-translucent did return results for searches against the local attributes, would this be defeating the purpose/design of the overlay? Thanks, Gavin. Australia Post is committed to providing our customers with excellent service. If we can assist you in any way please telephone 13 13 18 or visit our website. The information contained in this e-mail communication may be proprietary, confidential or legally professionally privileged. It is intended exclusively for the individual or entity to which it is addressed. You should only read, disclose, re-transmit, copy, distribute, act in reliance on or commercialise the information if you are authorised to do so. Australia Post does not represent, warrant or guarantee the integrity of this e-mail communication has been maintained nor that the communication is free of errors, virus or interference. If you are not the addressee or intended recipient please notify us by replying direct to the sender and then destroy any electronic or paper copy of this message. Any views expressed in this e-mail communication are taken to be those of the individual sender, except where the sender specifically attributes those views to Australia Post and is authorised to do so.

4 4

Info on cn=Monitor items
by Maykel Moya 11 Oct '07

11 Oct '07

Is there any available documentation explaining the meanings (what is monitored) of every item under cn=Monitor. In particular, I'm not sure about the exact meaning of: * cn=Log,cn=Monitor * cn=Bytes,cn=Statistics,cn=Monitor (sent Bytes since started?) * cn=PDU,cn=Statistics,cn=Monitor (don't know what PDU means) * cn=Entries,cn=Statistics,cn=Monitor (in my system it shows very high, maybe because of my cn=accesslog and cn=config contexts. It's planned to have Entries per context basis?) * cn=Backload,cn=Threads,cn=Monitor * cn=Runqueue,cn=Threads,cn=Monitor (monitoredInfo always have value (), what are possible values for this attribute) * cn=Read,cn=Waiters,cn=Monitor (in my system it shows 15, did it mean that there was 15 threads waiting to query the DIT? if so, it's strange for me give that this system is only for testing with 2 o 3 clients and such a number of read waiters are very improbable) Had the OL developers considered adding a description attribute to *,cn=Monitor entries? Regards, maykel

4 3

Re: empty db
by Gavin Henry 10 Oct '07

10 Oct '07

Richard smith wrote: > Gavin, > Thanks for the reply. > I assume the data dir is /var/lib/ldap. > I deleted the newly created objectClass.bdb file and moved all the other > files from the /var/lib/ldap dir to some other dir, except for the > DB_CONFIG. > I left that file in /var/lib/ldap. > > service ldap start > says ok and ok, but status still reported as stopped. > > no files generated What do your logs show?

1 0

some questions about syncrepl
by Guillaume Rousse 10 Oct '07

10 Oct '07

Hello. I'm trying to follow change propagations errors using delta-synrepl in search & persist mode, by using an accesslog overlay both on master and on slaves. I've a few questions for which I didn't found answer in the documentationn. First, I noticed than changes on the slaves seems to be written from rootdn, not from the dn declared in the syncrepl directive, which seems to be only used on the master, meaning I don't need any specific ACL on the slave. Is this correct ? Second, I have several slaves synchronizing on the same master. From slapd.conf man page, rid is supposed to be unique in the consumer only, meaning all my slaves can safely use the same rid (easier for maintaining centralized configurations). Is this correct interpretation ? Third, I noticed a lot of errors correction for syncrepl in openldap changelog. As I can't easily change installed versions (our policy is to stick with our distribution provided package, meaning a mix of 2.3.27 and 2.3.34), am I correct assuming 'refresh only' mode is less fragile than 'refresh & persist' mode, and than total synchronisation is also less fragile than delta synchronisation, if I need to fallback on a safer mode ? -- Guillaume Rousse Moyens Informatiques - INRIA Futurs Tel: 01 69 35 69 62

4 14

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software