openldap-software

openldap-software@openldap.org

2719 discussions

Re: changing userPassword from custom application
by Quanah Gibson-Mount 15 Dec '09

15 Dec '09

--On Tuesday, December 15, 2009 12:28 PM +0000 "J. Landamore" <jal(a)mcs.le.ac.uk> wrote: > Sorry to butt in on this, but how do you let the OpenLDAP server use its > default encryption? Since 2.4 whatever I have done stores the > userPassword attribute in clear text when using passwd(1) from our Linux > or Solaris boxes. ldappasswd states that is not a replacement for > passwd(1), what I'd like is to return to the state in OpenLDAP-2.2 and > previous where the passwords were stored encrypted in some fashion. > I've been banging my head about this for 3 months so any pointers would be > very much appreciated. If you have questions, please keep them on the list. Thanks. <http://www.openldap.org/software/man.cgi?query=slapd.conf&apropos=0&sektion…> password-hash <hash> [<hash>...] This option configures one or more hashes to be used in generation of user passwords stored in the userPassword attribute during processing of LDAP Password Modify Extended Operations (RFC 3062). The <hash> must be one of {SSHA}, {SHA}, {SMD5}, {MD5}, {CRYPT}, and {CLEARTEXT}. The default is {SSHA}. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

OpenLDAP syncrepl message: AttributeDescription contains inappropriate characters
by Jorgen Lundman 14 Dec '09

14 Dec '09

openldap-2.3.41 db-4.2.52.NC-PLUS_5_PATCHES SunOS ldapmaster01.unix 5.10 Generic_127128-11 Our LDAP setup has been running rather well for the last 2 years or so, but increasingly we have had to restart slapd more and more frequently. Occasional core-dumps and "very large" process footprints as well. I suspect that it is perhaps stuck on replication, this message show up on the clients fairly frequently: Dec 14 11:30:49 forward01.unix slapd[10494]: [ID 190661 local4.debug] <= entry_decode: slap_str2undef_ad( 20091027142315Z#000001#00#000000): AttributeDescription contains inappropriate characters Dec 14 11:30:49 forward01.unix slapd[10494]: [ID 818565 local4.debug] null_callback: error code 0x50 Dec 14 11:30:49 forward01.unix slapd[10494]: [ID 776556 local4.debug] syncrepl_entry: rid 405 be_add failed (80) Dec 14 11:30:49 forward01.unix slapd[10494]: [ID 747041 local4.debug] do_syncrepl: rid 405 retrying (9 retries left) Which makes me think that it has been stuck since 20091027. Is there a way for me to find out which entry 20091027142315Z#000001#00#000000 refers to, so I can just delete it? (or fix it). The pertinent lines in ldapmaster are: lastmod on checkpoint 128 15 directory /usr/local/var/openldap-data index objectClass eq index uid eq index uidNumber eq index mail eq index mailAlternateAddress pres,eq index deliveryMode eq index accountStatus eq index gecos eq index radiusGroupName eq index o pres,eq index entryCSN,entryUUID eq index gidNumber eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 And each slave has identical conf, except for the RID which is based on the last octet of the IP address: lastmod on checkpoint 128 15 directory /usr/local/var/openldap-data index objectClass eq index uid eq index uidNumber eq index mail eq index mailAlternateAddress pres,eq index deliveryMode eq index accountStatus eq index gecos eq index radiusGroupName eq index o pres,eq index entryCSN,entryUUID eq index gidNumber eq syncrepl rid=405 provider=ldap://172.20.12.113 type=refreshAndPersist interval=00:00:00:30 searchbase="ou=mail,dc=gmo,dc=jp" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off updatedn="cn=admin,dc=gmo,dc=jp" bindmethod=simple binddn="cn=admin,dc=gmo,dc=jp" credentials="*censored*" retry="60 10 300 +" updateref ldap://172.20.12.113 In general, do they seem reasonable? Everything has been appearing to be correct, except for the 20091027 entry. What is the recommended procedure? Reading the documentation makes me think I should also index "ContextCSN"? A recent ldapmaster core was triggered here: #0 0xce7948da in t_delete () from /lib/libc.so.1 #1 0xce79417f in _malloc_unlocked () from /lib/libc.so.1 #2 0xce794058 in malloc () from /lib/libc.so.1 #3 0x08133175 in ber_memalloc_x () #4 0x08133487 in ber_dupbv_x () #5 0x0813352b in ber_dupbv () #6 0x0807c22e in attr_dup () ... which I believe is replication-related due to a post made earlier in the list. Most likely also fixed in later versions. Thanks for any reply, Jorgen Lundman -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

1 1

no shared cipher error
by Josh.Mullis＠cox.com 12 Dec '09

12 Dec '09

Good day all, I am getting the following error on an openldap v2.3 server when attempting communication from an ldap client... ------------------------ TLS trace: SSL_accept:before/accept initialization TLS trace: SSL3 alert write:fatal:handshake failure TLS trace: SSL_accept:error in SSLv3 read client hello B TLS trace: SSL_accept:error in SSLv3 read client hello B TLS: can't accept. TLS: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher s3_srvr.c:974 ------------------------ I only get this when connecting to openldap server from a client. I do not get this error when I use the openssl client / server commands method. Output below.... Thanks for any help. -Josh ----------------------------------------------------- openssl s_server -accept 1982 -cert /etc/openldap/cacerts/servercrt.pem -key /etc/openldap/cacerts/serverkey.pem ACCEPT -----BEGIN SSL SESSION PARAMETERS----- --hidden-text-- --hidden-text-- --hidden-text-- -----END SSL SESSION PARAMETERS----- Shared ciphers:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:DHE-DSS-RC4-SHA:RC4-SHA:RC4-MD5:EXP1024-DHE-DSS-DES-CBC-SHA:EXP1024-DES-CBC-SHA:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP1024-DHE-DSS-RC4-SHA:EXP1024-RC4-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5 CIPHER is DHE-RSA-AES256-SHA ------------------------------------------------------ ------------------------------------------------------------------- openssl s_client -connect ldapurl.example.com:1982 -CAfile /path/to/cacert CONNECTED(00000003) depth=1 --hidden-text-- verify return:1 depth=0 --hidden-text-- verify return:1 --- Certificate chain 0 s:/--hidden-text-- i:/--hidden-text-- --- Server certificate -----BEGIN CERTIFICATE----- --hidden-text-- --hidden-text-- --hidden-text-- --hidden-text-- -----END CERTIFICATE----- subject=/--hidden-text-- issuer=/--hidden-text-- --- No client certificate CA names sent --- SSL handshake has read 1250 bytes and written 276 bytes --- New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA Server public key is 1024 bit SSL-Session: Protocol : TLSv1 Cipher : DHE-RSA-AES256-SHA Session-ID: --hidden-text-- Session-ID-ctx: Master-Key: --hidden-text-- Key-Arg : None Start Time: 1260195189 Timeout : 300 (sec) Verify return code: 0 (ok) --- ---------------------------------------------------------------------------------------------

2 1

Asyncronous, non blocking back- connector for Openldap
by hptf 11 Dec '09

11 Dec '09

Hello all, I would like to know if any of you have ever experiment a NONBLOCKING, socket based back-* for OpenLdap server. For obscure reasons, out of the scope of this mailing list, I must compile openldap slapd with non-threaded option activated. The data storage, we get data from, is accessed via standard TCP socket; but some read can take time. Thus we cannot wait in a blocking TCP read . We start our experiment with a modified version of back-sock ( using TCP ), but this back- use a blocking scheduling model. Thus, How can we put in slapd scheduling loop an alien socket managed by a back- library ? ( SLAPD_ADD.... ?) How can back- be scheduled on socket reception ( Listener* ?) How can we asynchrously send LDAP response, and set the context for them What should be answered at the first ldap request ( in the back_search() for example) to say 'will be answered later' ? Any help, or pointer to help, even for only one of this point, would be much appreciate! hp tf

2 1

custom auth
by Marten Lehmann 10 Dec '09

10 Dec '09

Hello, for a mail relay setup I need to check a login and password against ldap by trying to bind with authentication. In my slapd.conf I have these lines (among others): suffix "dc=mail" rootdn "cn=admin,ou=users,dc=mail" access to attrs=userPassword by anonymous auth by * none How do I tell OpenLDAP to authenticate against cn=<login>,ou=users,dc=mail and its userPassword attribute? Kind regards Marten

3 3

unexpected userPassword content
by Marten Lehmann 10 Dec '09

10 Dec '09

Hello, I am writing a MD5-password to openldap: cleartext: 654321 md5: c33367701511b4f6020ec61ded352059 hex2b64: wzNncBURtPYCDsYd7TUgWQ== So in my call, I am setting userPassword={MD5}wzNncBURtPYCDsYd7TUgWQ== But when I retrieve the userPassword content later, I get this value: e01ENX13ek5uY0JVUnRQWUNEc1lkN1RVZ1dRPT0= What has openldap done to it? What do I have to do with the cleartext password to get the same value? Kind regards Marten

4 4

ldap proxy resolution by rewriting in meta-backend
by yamina 09 Dec '09

09 Dec '09

Hello, I want to use the "LDAP Proxy resolution" mode related in the "slapd-meta" man but I don't manage to make it works. I wonder if it is implemented yet because I saw a message dated Fri, 16 Jan 2004 17:09:10 +0100 in which the same problem is not solved. My slapd.conf looks like: uri "ldap://127.0.0.1:390/ou=a,ou=mysociety,c=fr" ... rewriteRule '(.*-b\))' 'ldap://127.0.0.1:391/ou=b,ou=mysociety <ldap://ldap1.my.org/%0%27>,c=fr' <ldap://ldap1.my.org/%0%27> ':@' rewriteRule '(.*-c\))' 'ldap:// <ldap://ldap2.my.org/%0%27>127.0.0.1:392/ou=c,ou=mysociety,c=fr' <ldap://ldap1.my.org/%0%27> ':@' in order that when I search for example for uid=toto-b, it would do it through openldap running on port 391, if I search for uid=titi-c, it would do it through openldap running on port 392 and if I search anything not ending by "-b" or "-c", il would do it through openldap running on port 390(target). But the search nevers goes to the openldap running on ports 391 and 392. Any help would be mostly appreciated. Kind regards

2 2

ldapsearch with delay (on the same machine over TLS/SSL only)
by Pavel Lisy 08 Dec '09

08 Dec '09

Hello I've found one problem I have latest openldap release 2.4.3 (but it is similar on former versions too). There is small delay (1-2s) on beginning when I query ldap server from the same machine over TLS or SSL. Without SSL is no delay. Is it bug or is it normal? How can I debug it more? QUERY with delay: from ldap1 to ldap1 (the same machine) [root@ldap1 ~]# ldapsearch24 -Z -h ldap1.ldapnet.tmapy.cz -x -s sub -D "cn=Manager,dc=tmapy,dc=cz" -b 'dc=tmapy,dc=cz' -w p*****d QUERY without delay: from ldap1 to ldap1 (the same machine without TLS) [root@ldap1 ~]# ldapsearch24 -h ldap1.ldapnet.tmapy.cz -x -s sub -D "cn=Manager,dc=tmapy,dc=cz" -b 'dc=tmapy,dc=cz' -w p*****d from ldap1 to ldap2 [root@ldap1 ~]# ldapsearch24 -Z -h ldap2.ldapnet.tmapy.cz -x -s sub -D "cn=Manager,dc=tmapy,dc=cz" -b 'dc=tmapy,dc=cz' -w p*****d from ldap2 to ldap1 [root@ldap2 ~]# ldapsearch24 -Z -h ldap1.ldapnet.tmapy.cz -x -s sub -D "cn=Manager,dc=tmapy,dc=cz" -b 'dc=tmapy,dc=cz' -w p*****d I think my DNS/hosts settings are correct My testing environment: servers: ldap1.ldapnet.tmapy.cz ldap2.ldapnet.tmapy.cz ldap3.ldapnet.tmapy.cz from ldap1 config: slapd.conf TLSCACertificateFile /etc/pki/tls/cacert.pem TLSCertificateFile /etc/pki/tls/certs/ldap1.ldapnet.tmapy.cz-cert.pem TLSCertificateKeyFile /etc/pki/tls/private/ldap1.ldapnet.tmapy.cz-key.pem [root@ldap1 ~]# hostname ldap1.ldapnet.tmapy.cz [root@ldap1 ~]# grep ldap1 /etc/hosts 192.168.241.10 ldap1.ldapnet.tmapy.cz [root@ldap1 ~]# ifconfig eth0 eth0 inet adr:192.168.241.10 Všesměr:192.168.241.255 Maska:255.255.255.0 [root@ldap1 ~]# grep ldap1 /etc/pki/tls/certs/ldap1.ldapnet.tmapy.cz-cert.pem Subject: C=CS, ST=Kraj kralovehradecky, O=T-MAPY spol. s r.o.,OU=ldapnet, CN=ldap1.ldapnet.tmapy.cz Pavel Lisy -- Pavel Lisy <pali(a)tmapy.cz>

2 1

Re: syncrepl partial copy
by FRLinux 08 Dec '09

08 Dec '09

On Tue, Dec 8, 2009 at 6:58 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > What you are probably really after is the "limits" directive, so that you > only set these things to unlimited for your replication user, not every > user. You are right, i stand corrected. Steph

1 0

syncrepl partial copy
by FRLinux 08 Dec '09

08 Dec '09

Hello, I am now facing a new issue which could well be due to me but I need to be sure. I have set a new slave running 2.4.17 on Debian whilst the master is a 2.3.43 running on FreeBSD 6.4. I have observed a similar behavior on a slave running 2.3.43 also on FreeBSD. That behavior is that when you start an empty database, syncrepl starts copying the content but usually stops after a while (ie. copies only part of the database but far from all objects). Is it recommended to slapcat the objects when setting up a new slave or is syncrepl able to do that by itself? This is my syncrepl rules: syncrepl rid=124 \ provider=ldaps://masterldap.example.com:636 \ type=refreshAndPersist \ searchbase="dc=example,dc=com" \ scope=sub \ filter="(objectClass=*)" \ attrs="*" \ schemachecking=off \ tls_cacert=/etc/ldap/cert/cacert.pem \ binddn="cn=ldaprep,dc=example,dc=com" \ credentials=xxxxxx Cheers, Steph

5 5

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software