openldap-software

openldap-software@openldap.org

2719 discussions

failover config: servers with same DNS address and TLS, subjectAltName extension
by Emmanuel Dreyfus 27 Jul '07

27 Jul '07

For future reference, here is what I had to do to get multiple LDAP servers answering on the same DNS address and using TLS. The DNS contains this records: srv1 IN A 192.0.2.4 srv2 IN A 192.0.2.5 ldap 1 IN A 192.0.2.4 ldap 1 IN A 192.0.2.5 The clients have this in ldap.conf: BASE dc=example,dc=net TLS_CACERT /etc/openssl/certs/ca.crt URI ldaps://ldap.example.net:636 TLS_REQCERT demand # Cannot get this working! #TLS_CRLCHECK peer # For login/password over TLS SASL_MECH PLAIN SASL_SECPROPS none In order to have this working, we need x509 certificate that have the subjectAltName extension. This is not an OpenLDAP-specific problem, but the information about how to do it seems difficult to find, hence, here is the result of my experiments. 1) Creating a CSR On the LDAP servers, we need to setup OpenSSL for generating the certificate request (CSR). We need this in the [ req ] section of /etc/openssl/openssl.cnf: req_extensions = v3_req The, we need a [ v3_req ] section: [ v3_req ] basicConstraints = CA:FALSE subjectAltName = "DNS:ldap.example.net, DNS:srv1.example.net" It seems the subjectAltName has to be set in the config file. I found no way to have it prompted by the openssl command. If you don't have a private key yet, generate it: # ( umask 077; openssl genrsa > /etc/openssl/private/srv1.key ) Next, make the CSR: # openssl req -new -key /etc/openssl/private/srv1.key -out srv1.csr Answers to the questions openssl ask. The common name is srv1.example.net Of course the same must be done on srv2 2) Signing the certificate On the machine that holds your certificate authority, some setup is also needed in openssl.cnf: In the [ CA_default ] section (or in [ ca ]), copy_extensions = copy Note that this will copy any extensions, so you have to be careful about what you are signing. See the WARNINGS section of openssl_ca. Sign it (I assume your CA setup already work, here) # openssl ca -key /etc/openssl/private/ca.crt -in srv1.csr -out src1.crt # openssl ca -key /etc/openssl/private/ca.crt -in srv2.csr -out src2.crt 3) Configuring slapd Install ca.crt and srv1.crt (srv2.crt) on srv1 (srv2), and configure slapd, with this in slapd.conf: TLSCertificateFile /etc/openssl/certs/srv1.crt TLSCertificateKeyFile /etc/openssl/private/srv1.key TLSCACertificateFile /etc/openssl/certs/ca.crt TLSVerifyClient allow sasl-secprops none Then, restart slapd, and the thing should work. 4) Having this working with syncrepl An add-on: now let's imagine srv1 and srv2 are syncrepl-powered replica. The master is ldap0.example.net. In order to avoid pushing sensitive data to a rogue machine that would claim being a replica, we want to use client and server TLS certificate authentication for syncrepl exchange. Note that on the consumer, the same certificate must be used for syncrepl and for the ldaps:// service. This is alimitation in OpenLDAP 2.3.x 4.1) On the syncrepl consumer (srv1 and srv2), in slapd.conf: syncrepl rid=24 type=refreshAndPersist searchbase="dc=example,dc=net" starttls=critical bindmethod=sasl saslmech=EXTERNAL retry=3,1,10,2,60,+ Make sure rid is different on srv1 and srv2. Don't forget to add entryUUID and entryCSN to the index of your databases (see http://www.openldap.org/doc/admin23/syncrepl.html#Configuring%20Syncrepl) 4.2) On the syncrepl producer (ldap0), in slapd.conf: TLSCertificateFile /etc/openssl/certs/ldao0.crt TLSCertificateKeyFile /etc/openssl/private/ldap0.crt TLSCACertificateFile /etc/openssl/certs/ca.crt TLSVerifyClient allow # This allows login/password protected by TLS (for users) sasl-secprops none overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # ACL to allow syncrepl consumer to get userPassword through TLS session # while regular users will not be able to see them access to attrs=userPassword by anonymous auth by self write by dn.regex="cn=srv1.example.net" read by dn.regex="cn=srv2.example.net" read by * none access to * by * read -- Emmanue Dreyfus manu(a)netbsd.org

10 29

Recovery after system shutdown
by Arunachalam Parthasarathy 27 Jul '07

27 Jul '07

Hello, When I started adding some entries to openldap server (2.3.36), suddenly my system powered off, When I started my sytem after rebooting, my slapd with BDB as backend , is unable to recover , I am getting an error as below, Please say , what am I doing wrong Thanks, Arunachalam. config_build_entry: "olcDatabase={1}bdb" backend_startup_one: starting "dc=huawei,dc=com" bdb_db_open: dc=huawei,dc=com bdb_db_open: dbenv_open(/home/Arunachalam/Res/openldapdb_36) bdb(dc=huawei,dc=com): file id2entry.bdb (meta pgno = 0) has LSN [32][3600584]. bdb(dc=huawei,dc=com): end of log is [31][937891] bdb(dc=huawei,dc=com): /home/Arunachalam/Res/openldapdb_36/id2entry.bdb: unexpected file type or format bdb_db_open: db_open(/home/Arunachalam/Res/openldapdb_36/id2entry.bdb) failed: Invalid argument (22) ====> bdb_cache_release_all bdb(dc=huawei,dc=com): Unknown locker ID: 0 backend_startup_one: bi_db_open failed! (22) slapd shutdown: initiated ====> bdb_cache_release_all bdb_db_close: alock_close failed slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. **************************************************************************** **************************** This e-mail and attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient's) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

3 4

Help needed to analyze the output of ldapwhoami - reg.
by Aviator LDap 26 Jul '07

26 Jul '07

Hi Friends, I have built OpenLDAP2.3.33 with my customized security libraries. I executed ldapwhoami to check the validity and i got the following output. Can anybody help me to interpret this output. bash-2.05$ ./ldapwhoami -x -D "cn=Manager,dc=example,dc=com" -H ldaps://172.16.151.11 -w secret -d1 ldap_create ldap_url_parse_ext(ldaps://172.16.151.11) ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 172.16.151.11:636 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 172.16.151.11:636 ldap_connect_timeout: fd: 4 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read change cipher spec A TLS trace: SSL_connect:SSLv3 read finished A TLS trace: SSL3 alert write:warning:bad certificate TLS: unable to get peer certificate. ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({i) ber: ber_flush: 48 bytes to sd 4 ldap_result ld 1002ede20 msgid 1 ldap_chkResponseList ld 1002ede20 msgid 1 all 1 ldap_chkResponseList returns ld 1002ede20 NULL wait4msg ld 1002ede20 msgid 1 (infinite timeout) wait4msg continue ld 1002ede20 msgid 1 all 1 ** ld 1002ede20 Connections: * host: 172.16.151.11 port: 636 (default) refcnt: 2 status: Connected last used: Thu Jul 26 11:00:04 2007 ** ld 1002ede20 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 1002ede20 Response Queue: Empty ldap_chkResponseList ld 1002ede20 msgid 1 all 1 ldap_chkResponseList returns ld 1002ede20 NULL ldap_int_select read1msg: ld 1002ede20 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 1002ede20 msgid 1 message type bind ber_scanf fmt ({eaa) ber: read1msg: ld 1002ede20 0 new referrals read1msg: mark request completed, ld 1002ede20 msgid 1 request done: ld 1002ede20 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_extended_operation ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush: 32 bytes to sd 4 ldap_result ld 1002ede20 msgid -1 ldap_chkResponseList ld 1002ede20 msgid -1 all 1 ldap_chkResponseList returns ld 1002ede20 NULL wait4msg ld 1002ede20 msgid -1 (timeout 100000 usec) wait4msg continue ld 1002ede20 msgid -1 all 1 ** ld 1002ede20 Connections: * host: 172.16.151.11 port: 636 (default) refcnt: 2 status: Connected last used: Thu Jul 26 11:00:04 2007 ** ld 1002ede20 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ** ld 1002ede20 Response Queue: Empty ldap_chkResponseList ld 1002ede20 msgid -1 all 1 ldap_chkResponseList returns ld 1002ede20 NULL ldap_int_select read1msg: ld 1002ede20 msgid -1 all 1 ber_get_next ber_get_next: tag 0x30 len 45 contents: read1msg: ld 1002ede20 msgid 2 message type extended-result ber_scanf fmt ({eaa) ber: read1msg: ld 1002ede20 0 new referrals read1msg: mark request completed, ld 1002ede20 msgid 2 request done: ld 1002ede20 msgid 2 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (x) ber: ber_scanf fmt (}) ber: ldap_parse_extended_result ber_scanf fmt ({eaa) ber: ber_scanf fmt (O) ber: ldap_msgfree dn:cn=Manager,dc=example,dc=com ldap_err2string Result: Success (0) ldap_free_connection 1 1 ldap_send_unbind ber_flush: 7 bytes to sd 4 ldap_free_connection: actually freed TLS trace: SSL3 alert write:warning:close notify TLS trace: SSL3 alert read:warning:close notify bash-2.05$ Thanks in Advance, regards, dinesh V

1 0

Expiring user passwords fails after first expiry
by Gatne, Vikrant (Vikrant) 26 Jul '07

26 Jul '07

Hi I am using openLDAP 2.3.32 on RHEL 4.0. I have configured openLDAP for password expiration. The system is still under testing phase. Created the basic password policy with dn: cn=basicPwdPolicy,dc=avaya,dc=com cn: basicPwdPolicy objectClass: device objectClass: pwdPolicy objectClass: top pwdAttribute: 2.5.4.35 pwdMaxAge: 180 pwdMaxAge is set to 3 minutes just for testing. And set the above policy as the default policy in slapd.conf file. Whenever I create a new user, it is prompted for a password change after first 3 minutes are expired. and when the user changes his password, he is never prompted for a password change ever again. It stays there forever. Not sure why it fails to do it again. If anyone can guide me, it would be indeed of great help. Thanks, Vikrant

2 2

Re: Configuring TLS
by Jay Chandler 26 Jul '07

26 Jul '07

James Hartley wrote: > I am working this issue myself... see the following 3 references. > > http://www.openldap.org/faq/data/cache/185.html > > Followed this to the letter, yet when I attempt to restart slapd, I get: > slapd[34145]: main: TLS init def ctx failed: -1 > slapd[34145]: slapd stopped. in my logs. Googling sheds no light. Thoughts? OS is FreeBSD, for reference, so a lot of Solaris advice is probably applicable. -- Jay

5 6

Configuring TLS
by Jay Chandler 25 Jul '07

25 Jul '07

Howdy. We run an OpenLDAP environment that I'm attempting to lock down. Right now all LDAP communication takes place in cleartext-- obviously this isn't optimal. I'm attempting to configure TLS, and hitting a few snags. On the server I've generated a PEM that includes both the key and the certificate. I've also broken them down into component files. Given that this isn't a signed certificate, what are the options I need in slapd.conf? If anyone can shed some light, or point me towards a tutorial, I'd be most grateful. Regards, Jay Chandler

2 1

openldap server startup delay
by openldap 24 Jul '07

24 Jul '07

Hi listers version on the main server: openldap-2.2.17 on this site, we use openldap to manage the entire mail system. we do a backup of the directory each night at 1 o'clock. the ldap service is distributed on three servers, which are kept synced by the slurp daemon. Before doing the backup, we restart the main openldap server with a configuration with "readonly on" set for the directory database: /etc/init.d/ldap.readonly restart Then we do /usr/local/openldap/sbin/slapcat -f /usr/local/openldap/etc/openldap/slapd.conf -l $HOME/backup/backup_file After having done that, we restart the openldap server with a configuration with "readonly off" set for the directory database: /etc/init.d/ldap restart This means: we are using the normal restart procedure from the /etc/init.d directory, because the openldap server may not have (?) a reload feature via the SIGHUP signal to make it reread the config-file. Every now and then, we get a message from the postfix server, that the ldap server has not been accessible, when it tried to retrieve mail-parameters in the time between 1.00 and 1.09 in the night ("temporary lookup failure"), which means that the openldap server during this time cannot be accessed. This seems a very long time (9 minutes). my questions: can i set and clear the readonly flag for the directory using a direct command to the server, in order not to have to restart the server twice? can i omit to set the readonly flag altogether before doing the slapcat? is there another method to restart the openldap server much faster than via this method? e.g. can i send the openldap server a SIGHUP flag directly and not go through the /etc/init.d/ldap restart procedure? any reply will be appreciated, thanks in adwance. suomi

2 2

OPENLDAP ein Active/Passive
by Zouhair BOUNOUALA 24 Jul '07

24 Jul '07

Hi, It's my fisrt post in this list.I hope that will not be the last. I want t o implement openldap in a cluster active/passive. Which directory must I share between the two machines of cluster? If they are document or link to follow, I will be grateful. PS : It's urgent. Thanks in advance

3 2

Connection timeout
by Dave Horsfall 22 Jul '07

22 Jul '07

OpenLDAP 2.3.35 I know about the time limit on the search, but is there a user-specified one on the connect? I ask because when our primary LDAP server went down for maintenance, the various applications took around 2-3 minutes before trying the secondary server (accompanied by much wailing and gnashing of teeth). I would've thought that the fail-over would have been practically instantaneous (which it is if the server in question is also the client's host); perhaps we have an errant packet filter in the way, but that's beyond the scope of this list. -- Dave Horsfall DTM VK2KFU Ph: +61 2 9552-5509 (direct) +61 2 9552-5500 (switch) Corinthian Eng'ng P/L, Ste 54 Jones Bay Whf, 26-32 Pirrama Rd, Pyrmont 2009, AU

8 15

dn="" and anonymous
by Thierry Lacoste 22 Jul '07

22 Jul '07

What is the difference between dn="" and anonymous? conn=4069 op=3 BIND dn="" method=128 conn=10515 op=4 BIND anonymous mech=implicit ssf=0 Regards, Thierry.

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software