openldap-software

openldap-software@openldap.org

2719 discussions

How to now if smbk5pwd is working?
by Newzenca 16 Jul '07

16 Jul '07

Hi all, im trying to get password sync with smbk5pwd, but is not working there is my config: [root@ldapsrv ~]# cat /etc/openldap/slapd.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/lmc.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/mail.schema # acl's include /etc/openldap/AclsLdap.acl # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath /usr/lib/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la moduleload /usr/lib/openldap/smbk5pwd.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=venap,dc=com" rootdn "cn=admin,dc=XXXX,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg rootpw {SSHA}+u59b3iW+lYALN9x6IKmm7OnqU6y709G # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap overlay smbk5pwd smbk5pwd-enable samba # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM loglevel 4 [root@ldapsrv ~]# passwd emma Changing password for user emma. Enter login(LDAP) password: New UNIX password: BAD PASSWORD: it is based on a dictionary word Retype new UNIX password: LDAP password information changed for emma passwd: all authentication tokens updated successfully. [root@ldapsrv ~]# cat /var/log/openldap Jul 15 17:24:46 ldapsrv slapd[14318]: connection_get(12) Jul 15 17:24:46 ldapsrv slapd[14318]: send_ldap_result: err=0 matched="" text="" Jul 15 17:24:46 ldapsrv slapd[14318]: connection_get(12) Jul 15 17:24:46 ldapsrv slapd[14318]: SRCH "dc=venap,dc=com" 2 0 Jul 15 17:24:46 ldapsrv slapd[14318]: 1 120 0 Jul 15 17:24:46 ldapsrv slapd[14318]: filter: (&(objectClass=posixAccount)(uid=emma)) Jul 15 17:24:46 ldapsrv slapd[14318]: attrs: Jul 15 17:24:46 ldapsrv slapd[14318]: uid Jul 15 17:24:46 ldapsrv slapd[14318]: userPassword Jul 15 17:24:46 ldapsrv slapd[14318]: uidNumber Jul 15 17:24:46 ldapsrv slapd[14318]: gidNumber Jul 15 17:24:46 ldapsrv slapd[14318]: cn Jul 15 17:24:46 ldapsrv slapd[14318]: homeDirectory Jul 15 17:24:46 ldapsrv slapd[14318]: loginShell Jul 15 17:24:46 ldapsrv slapd[14318]: gecos Jul 15 17:24:46 ldapsrv slapd[14318]: description Jul 15 17:24:46 ldapsrv slapd[14318]: objectClass Jul 15 17:24:46 ldapsrv slapd[14318]: Jul 15 17:24:46 ldapsrv slapd[14318]: bdb_idl_fetch_key: [b49d1940] Jul 15 17:24:46 ldapsrv slapd[14318]: bdb_idl_fetch_key: [5941c014] Jul 15 17:24:46 ldapsrv slapd[14318]: bdb_idl_fetch_key: [d1726a87] Jul 15 17:24:46 ldapsrv slapd[14318]: send_ldap_result: err=0 matched="" text="" Jul 15 17:24:46 ldapsrv slapd[14318]: connection_get(12) Jul 15 17:24:46 ldapsrv slapd[14318]: SRCH "dc=venap,dc=com" 2 0 Jul 15 17:24:46 ldapsrv slapd[14318]: 1 120 0 Jul 15 17:24:46 ldapsrv slapd[14318]: filter: (&(objectClass=posixAccount)(uid=emma)) Jul 15 17:24:46 ldapsrv slapd[14318]: attrs: Jul 15 17:24:46 ldapsrv slapd[14318]: uid Jul 15 17:24:46 ldapsrv slapd[14318]: userPassword Jul 15 17:24:46 ldapsrv slapd[14318]: uidNumber Jul 15 17:24:46 ldapsrv slapd[14318]: gidNumber Jul 15 17:24:46 ldapsrv slapd[14318]: cn Jul 15 17:24:46 ldapsrv slapd[14318]: homeDirectory Jul 15 17:24:46 ldapsrv slapd[14318]: loginShell Jul 15 17:24:46 ldapsrv slapd[14318]: gecos Jul 15 17:24:46 ldapsrv slapd[14318]: description Jul 15 17:24:46 ldapsrv slapd[14318]: objectClass Jul 15 17:24:46 ldapsrv slapd[14318]: Jul 15 17:24:46 ldapsrv slapd[14318]: bdb_idl_fetch_key: [b49d1940] Jul 15 17:24:46 ldapsrv slapd[14318]: bdb_idl_fetch_key: [5941c014] Jul 15 17:24:46 ldapsrv slapd[14318]: bdb_idl_fetch_key: [d1726a87] Jul 15 17:24:46 ldapsrv slapd[14318]: send_ldap_result: err=0 matched="" text="" Jul 15 17:24:46 ldapsrv slapd[14318]: connection_get(15) Jul 15 17:24:46 ldapsrv slapd[14318]: send_ldap_result: err=0 matched="" text="" Jul 15 17:24:46 ldapsrv slapd[14318]: connection_get(15) Jul 15 17:24:46 ldapsrv slapd[14318]: SRCH "dc=venap,dc=com" 2 0 Jul 15 17:24:46 ldapsrv slapd[14318]: 1 120 0 Jul 15 17:24:46 ldapsrv slapd[14318]: filter: (uid=emma) Jul 15 17:24:46 ldapsrv slapd[14318]: attrs: Jul 15 17:24:46 ldapsrv slapd[14318]: Jul 15 17:24:46 ldapsrv slapd[14318]: bdb_idl_fetch_key: [b49d1940] Jul 15 17:24:46 ldapsrv slapd[14318]: bdb_idl_fetch_key: [d1726a87] Jul 15 17:24:46 ldapsrv slapd[14318]: send_ldap_result: err=0 matched="" text="" Jul 15 17:24:49 ldapsrv slapd[14318]: connection_get(15) Jul 15 17:24:49 ldapsrv slapd[14318]: ==> bdb_bind: dn: uid=emma,ou=Users,dc=venap,dc=com Jul 15 17:24:49 ldapsrv slapd[14318]: send_ldap_result: err=0 matched="" text="" Jul 15 17:24:49 ldapsrv slapd[14318]: connection_get(15) Jul 15 17:24:49 ldapsrv slapd[14318]: send_ldap_result: err=0 matched="" text="" Jul 15 17:24:56 ldapsrv slapd[14318]: connection_get(15) Jul 15 17:24:56 ldapsrv slapd[14318]: ==> bdb_bind: dn: uid=emma,ou=Users,dc=venap,dc=com Jul 15 17:24:56 ldapsrv slapd[14318]: send_ldap_result: err=0 matched="" text="" Jul 15 17:24:56 ldapsrv slapd[14318]: connection_get(15) Jul 15 17:24:56 ldapsrv slapd[14318]: do_modify: dn (uid=emma,ou=Users,dc=venap,dc=com) Jul 15 17:24:56 ldapsrv slapd[14318]: modifications: Jul 15 17:24:56 ldapsrv slapd[14318]: replace: userPassword Jul 15 17:24:56 ldapsrv slapd[14318]: one value, length 41 Jul 15 17:24:56 ldapsrv slapd[14318]: bdb_modify: uid=emma,ou=Users,dc=venap,dc=com Jul 15 17:24:56 ldapsrv slapd[14318]: bdb_modify_internal: replace userPassword Jul 15 17:24:56 ldapsrv slapd[14318]: bdb_modify_internal: replace entryCSN Jul 15 17:24:56 ldapsrv slapd[14318]: bdb_modify_internal: replace modifiersName Jul 15 17:24:56 ldapsrv slapd[14318]: bdb_modify_internal: replace modifyTimestamp Jul 15 17:24:56 ldapsrv slapd[14318]: send_ldap_result: err=0 matched="" text="" Jul 15 17:24:56 ldapsrv slapd[14318]: connection_get(15) Jul 15 17:24:56 ldapsrv slapd[14318]: do_modify: dn (uid=emma,ou=Users,dc=venap,dc=com) Jul 15 17:24:56 ldapsrv slapd[14318]: modifications: Jul 15 17:24:56 ldapsrv slapd[14318]: replace: shadowLastChange Jul 15 17:24:56 ldapsrv slapd[14318]: one value, length 5 Jul 15 17:24:56 ldapsrv slapd[14318]: bdb_modify: uid=emma,ou=Users,dc=venap,dc=com Jul 15 17:24:56 ldapsrv slapd[14318]: bdb_modify_internal: replace shadowLastChange Jul 15 17:24:56 ldapsrv slapd[14318]: bdb_modify_internal: replace entryCSN Jul 15 17:24:56 ldapsrv slapd[14318]: bdb_modify_internal: replace modifiersName Jul 15 17:24:56 ldapsrv slapd[14318]: bdb_modify_internal: replace modifyTimestamp Jul 15 17:24:56 ldapsrv slapd[14318]: send_ldap_result: err=0 matched="" text="" Jul 15 17:24:56 ldapsrv slapd[14318]: connection_get(15) Jul 15 17:24:56 ldapsrv slapd[14318]: connection_get(12) [root@ldapsrv ~]# smbclient //192.168.0.234/partage -U emma Password: session setup failed: NT_STATUS_LOGON_FAILURE with the new password What could be missing or this overlay smbk5pwd dont have to do that work?? Im running in CentOS 5 [root@ldapsrv ~]# rpm -qa | grep ldap python-ldap-2.2.0-2.1 smbldap-tools-0.9.2-1 openldap-debuginfo-2.3.34-6 php-ldap-5.1.6-12.el5 openldap-2.3.34-6 openldap-clients-2.3.34-6 openldap-devel-2.3.34-6 nss_ldap-253-3 openldap-servers-2.3.34-6 Thanks for your help, around this problem. New Zen.

2 1

Autoappending a static postfix to homedirectory-field
by Christian Rost 16 Jul '07

16 Jul '07

Hello, I'm already running an openldap server (2.3.27) and it works very well. Now i need some kind of a "virtual" account/posixAccount/shadowAccount-subtree which should be adressed as: ... ou=people ou=testing ... To the homeDirectory-field the static postfix "/testing" should be appended. All other fields should have the same values as in ou=people. Can you tell me how to achieve this with minimum changes to my actual server-config? Regards Christian

2 1

printer and schema trouble
by Joshua M. Miller 16 Jul '07

16 Jul '07

I'm using OpenLDAP 2.3.34 on CentOS 4.4. I'm trying to get some printer information stored in OpenLDAP and I'm having trouble getting the schema to work. I've obtained the ldap-printer.schema and ldap-slp.schema from http://www.kalamazoolinux.org/projects/awilliam/ldap.html. The problem seems to be with ldap-slp.schema. There error that I get is as follows: [:user@ldap-server:] /etc/init.d/ldap restart Checking config file /etc/openldap/slapd.conf: [FAILED] /usr/share/openldap/schema/ldap-slp.schema: line 38: Syntax not found: "1.3.6.1.4.1.6252.2.27.6.2.2" slaptest: bad configuration file! The part of the schema where the error occurs has the following entry: attributetype ( 1.3.6.1.4.1.6252.2.27.6.1.4 NAME 'service-advert-service-type' DESC 'The service type of the service advertisement, including the "service:" prefix.' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.6252.2.27.6.2.2 SINGLE-VALUE ) ...and the "syntax not found" error appears to reference an entry at the very top of the schema file: ( 1.3.6.1.4.1.6252.2.27.6.2.2 DESC 'SLP Service Type' ) The odd thing about this entry (to me) is that they don't have an attributetype or objectclass in the description. Does anybody have a working printer schema configuration that they would be willing to share or know why mine is not working? TIA, -- Joshua M. Miller - RHCE,VCP

4 3

slapcat and mirrormode in CVS HEAD
by Dave Holland 16 Jul '07

16 Jul '07

I've just been looking at mirrormode in CVS HEAD. It seems to break slapcat: ldapsrv2:~# /ldap/sbin/slapcat > /tmp/x /ldap/etc/slapd.conf: line 122: <mirrormode> database is not a shadow slapcat: bad configuration file! I *think* this is because in tool mode, the database doesn't get flagged as a shadow (whereas obviously it does in server mode). Does that sound plausible? The sync-related bits of my slapd.conf are: serverID 123 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=123 provider=ldap://other-server:389 type=refreshAndPersist interval=01:00:00:00 retry="10 10 120 +" searchbase="dc=sanger,dc=ac,dc=uk" scope=sub filter="(objectClass=*)" bindmethod=simple binddn="elided" credentials=elided mirrormode on lastmod on thanks, Dave -- ** Dave Holland ** Systems Support -- Special Projects Team ** ** 01223 496923 ** Sanger Institute, Hinxton, Cambridge, UK ** -- The Wellcome Trust Sanger Institute is operated by Genome Research Limited, a charity registered in England with number 1021457 and a company registered in England with number 2742969, whose registered office is 215 Euston Road, London, NW1 2BE.

2 2

re: Invalid Credentials (49)
by Ron Parker 16 Jul '07

16 Jul '07

the FAQ will put you in the right direction http://www.openldap.org/faq/data/cache/344.html I tried both of these: perl -e 'print("userPassword: {CRYPT}".crypt("secret","salt")."\n");' which gives me: userPassword: {CRYPT}saHW9GdxihkGQ perl -e 'use Crypt::PasswdMD5;print("userPassword: {CRYPT}".unix_md5_crypt("password","salt")."\n");' which gives me: userPassword: {CRYPT}$1$salt$qJH7.N4xYta3aEG/dfqo/0 I modifified "cn=Ron,ou=Zimbra,dc=example,dc=com" with each. Example: # Ron, Zimbra, example.com dn: cn=Ron,ou=Zimbra,dc=example,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson cn: Ron givenName: Ron sn: Jones mail: ron(a)example.com postalAddress: PO Box 1000 l: El Segundo st: California ou: Zimbra postalCode: 90222 telephoneNumber: +1-310.323.7033 mobile: +1-310.323.7033 homePhone: +1-310.323.7033 userPassword: {CRYPT}saHW9GdxihkGQ and tried to login as "Ron" using each: ldapsearch -v -H "ldap://example.com" -D 'cn=Ron,ou=Zimbra,dc=example,dc=com' -W -x -b 'ou=Zimbra,dc=example,dc=com' When prompted for the password, I enter either "secret" or "password" (depending upon the userPassword I modified user with) and still get "Invalid Credentials (49)". The rootdn password works just fine. Why won't any of the user passwords work? -- Ron Parker Software Creations http://www.scbbs.com Self-Administration Web Site http://saw.scbbs.com SDSS Subscription Mgmt Service http://sdss.scbbs.com Central Ave Dance Ensemble http://www.centralavedance.com R & B Salsa http://www.randbsalsa.com

2 1

Invalid Credentials (49)
by Ron Parker 14 Jul '07

14 Jul '07

I have created a bdb database using openldap on a RH Linux server with basically the default configuration. I'm able to log in with an LDAP client using the root dn and password: "cn=Manager, dc=example, dc=com" (using "example.com" here instead of my actual domain) I've created an Organizational Unit called "Zimbra", and under Zimbra, I have inetOrgPerson "Ron" com example organizationalUnit = Zimbra inetOrgPerson = Ron Using ldapmodify (logging in as rootdn) I gave inetOrgPerson Ron a password (userPassword) In slapd.conf, I've given Ron access to write to the Zimbra ou: access to dn.base="ou=Zimbra,dc=example,dc=com" by dn="cn=Ron,ou=Zimbra,dc=example,dc=com" write When I then use the following settings to log in as Ron using an LDAP client, I get "Invalid Credentials (49)" error: Host: example.com Port: 389 Protocol: LDAP v3 DSML Service: Base DN: ou=Zimbra,dc=example,dc=com Level: User+Password User DN: cn=Ron,ou=Zimbra,dc=example,dc=com Password: <the password I set for inetOrgPerson Ron in userPassword field> I thought this might have been an issue with my LDAP client, so I also tried logging in locally on the server, using only ldapsearch: ldapsearch -v -H "ldap://example.com" -D 'cn=Ron,ou=Zimbra,dc=example,dc=com' -W -x -b 'ou=Zimbra,dc=example,dc=com' And still get same error. Again, I can log in using rootdn (i.e., "Manger"), but not as any other user. Can someone point out to me what I'm missing? Thanks so much for any assistance. -ron -- Ron Parker Software Creations http://www.scbbs.com Self-Administration Web Site http://saw.scbbs.com SDSS Subscription Mgmt Service http://sdss.scbbs.com Central Ave Dance Ensemble http://www.centralavedance.com R & B Salsa http://www.randbsalsa.com

3 3

Serving multiple suffixes
by Dave Horsfall 13 Jul '07

13 Jul '07

Just curious; are we the only ones on the planet (or at least, this mailing list) using a single instance of SLAPD to serve multiple disparate suffixes? To clarify, we serve (as separate physical directories in the Unix file system etc) suffixes such as (redacted): dc=a,dc=b,dc=c, dc=x,dc=y,dc=z etc. To make matters worse, for political i.e. managerial reasons, some suffixes must be completely unaware of the existance of others. Or is this more common than I thought? -- Dave Horsfall DTM VK2KFU Ph: +61 2 9552-5509 (direct) +61 2 9552-5500 (switch) Corinthian Eng'ng P/L, Ste 54 Jones Bay Whf, 26-32 Pirrama Rd, Pyrmont 2009, AU

4 3

Schema change in master-slave setup
by Andre Nathan 13 Jul '07

13 Jul '07

Hello I have an openldap master-slave setup, and I need to make a simple schema change to add an attribute to an objectclass which is defined as below: objectclass ( dgMail:1.2.2 NAME 'dgMailAuth' DESC 'SASL Authentication for mail' SUP top STRUCTURAL MUST dgDBID MAY ( uid $ userPassword $ mail ) ) I just need to add an attribute called mailDrop, which is already defined in the schema, but only used in other objectclasses, so the last line would become MAY ( uid $ userPassword $ mail $ mailDrop ) ) My question is: is it safe to do this one server at a time, editing the schema file and restarting the daemon, or will I have problems with the temporary schema mismatch? I would like to minimize the downtime of the operation, since the system is heavily used in production. Thanks in advance, Andre

4 4

Automatic Account Deactivation?
by Aharon Verno 13 Jul '07

13 Jul '07

I was wondering if there was a way to automatically disable an account that hasn't been logged into for a period of time? We use OpenLDAP to give entitlements for our email system and we would love a way to automatically shutdown accounts that haven't been authenticated to in X days. Thanks for any help with this.

4 5

pwdCheckQuality
by Andy Loughran 13 Jul '07

13 Jul '07

Hi, I'm trying to setup pwdCheckQuality in ppolicy and have noticed that it needs an extra script to run. The only quality check I want to happen is that it checks that the password is alphanumeric. Does anyone have an example tip on where to put the module script and possibly even an example of their pwdCheckQuality script if they use one? Regards, -------- Andy Loughran www.zrmt.com m: 07921076319

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software