openldap-software

openldap-software@openldap.org

2719 discussions

SSL/TLS
by Greg Martin 09 Mar '07

09 Mar '07

I know there are a lot of question on this topic and ask for your patience. I'm trying to figure out how to discern if slapd is properly configured for SSL/TLS. Reading through the slapd strace output shows that the cacert & certfile are being opened & read slapd v2.3.27 When I look at netstat -an ports 389 & 636 are listening: tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN slapd.conf: TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLS_CACertificateFile /var/data/ca/cacert.pem TLS_CertificateFile /var/data/ca/newcerts/ldap1cert.pem TLS_CertificateKeyFile /etc/openldap/ldap1keyclear.txt TLSVerifyClient never Reading through the strace output shows that the cacert & certfile are being opened. ldap.conf BASE dc=gmartin, dc=org URI ldap://linux2.gmartin.org TLS_CACERT /var/data/ca/cacert.pem ldaprc: TLS_CACERT /var/data/ca/cacert.pem When I try ldapsearch or openssl s_client, I receive: sslv3 alert handshake failure And using slapd debug I see: TLS: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher s3_srvr.c:97 I checked the FAQ and I think I've looked at everything there. Not sure where to look next. \\Greg

1 2

*****SPAM***** openLDAP replication and trigger a script or exec binary
by Ivan R. Sy Jr. 09 Mar '07

09 Mar '07

Hi list! I seem can't find a way to allow OpenLDAP to execute a shell script or exec binary whenever it gets modified by slurpd. My agenda is to have master->slave LDAP replication and when the slave is modified via slurpd, it will then execute something (shell script/binary/anything) from the system and then resumes normal operation (returning success code to slurpd) Here's what i understand with openLDAP replication: Step 1: An LDAP client starts up and connects to a master /slapd/. Step 2: The LDAP client submits an LDAP modify operation to the master /slapd/. Step 4: The master /slapd/ performs the modify operation, writes out the change to its replication log file and returns a success code to the client. Step 5: The /slurpd/ process notices that a new entry has been appended to the replication log file, reads the replication log entry, and sends the change to the slave /slapd/ via LDAP. Step 6: The slave /slapd/ performs the modify operation and returns a success code to the /slurpd/ process. in step6, is there a way that slapd performs the modify operation... and "execute a shell script or binary and when it exists", it returns a success code to slurpd process? maybe a patch somewhere? or a clue where to set this hook? or any light on this? Thanks Ivan

3 2

accesslog overlay and 'logops all', Can't get get cn=Monitor running and problem with ppolicy (pwdAttribute)
by Turbo Fredriksson 09 Mar '07

09 Mar '07

Sorry for trying to kill three birds with one stone, but... I've been playing with 2.4 this weekend and disovered the accesslog and ppolicy overlays... But I found a 'bug' (I'm quite certain of it any way :) with the accesslog overlay. The 'logops all' config statement does not seem to log ADDS! Neither does 'logops writes' or 'logops add'... ----- s n i p ----- # ------- DB: 'cn=LOG1' database bdb suffix cn=LOG1 directory "/var/lib/ldap/cn=log1" index reqStart eq rootdn "uid=turbo,ou=People,o=Fredriksson,c=SE" # ------- DB: 'c=SE' (Bayour.COM) database hdb suffix "c=SE" directory "/var/lib/ldap/c=se" readonly off lastmod on [...] overlay accesslog logdb cn=LOG1 logops all logold (objectclass=person) ----- s n i p ----- Full config can be found at http://www.bayour.com/problems/ERROR-slapd_v2.4.conf Also, I have a problem getting 'cn=Monitor' running. See strace log at 'http://www.bayour.com/problems/ERROR-slapd_v2.4.monitor'. And how do you actually use the 'pwdAttribute' of the 'pwdPolicy' objectclass? I get 'value #0 invalid per syntax' when I try to use it as 'pwdattribute: userPassword'... See http://www.bayour.com/problems/ERROR-slapd_v2.4.ppolicy for example LDIF an full log output.

2 5

Inherited password policy?
by Turbo Fredriksson 09 Mar '07

09 Mar '07

How does this work in HEAD? Can I put a ppolicy in a branch, and have all users _below_ that using it (without setting a ppolicy in each user object)? Also, what is the format of the pwdAttribute attribute? I can't seem to get it (slapd) to accept: pwdAttribute: userPassword I get something like 'invalid format' or something (don't have my LDIF at hand right now so I can tripple check, but...).

1 0

masking LDAP_SIZELIMIT_EXCEEDED
by Aaron Richton 08 Mar '07

08 Mar '07

I've found a situation similar to what I believe inspired "disclose" ACLs, in which giving out the return value of LDAP_SIZELIMIT_EXCEEDED is telling clients something that I don't want them to know (i.e. "keep digging.") I'd like to just throw away the code and change it to LDAP_SUCCESS. Can anybody think of a way to do this (slapo-retcode comes to mind, but I can't see how it would work on these very non-dynamic entries) or should I just write an eight line overlay? Is this something that enough people want that there should be, say, a "silent" option to the limits directive?

2 4

Ldap_set_option problem
by Philip Bellino 08 Mar '07

08 Mar '07

Hello, I am running OpenLDAP-2.3.32 on both a Linux server (using SLAPD) and a Linux client. On the client, I am doing the following: ldap_initialize(&ldap, ldapuri); - works fine. ldap_set_option(ldap, LDAP_OPT_PTOTOVOL_VERSION, &ldapver); - ldapver =3 - works fine. Err = ldap_set_option(ldap, LDAP_OPT_X_TLS_CACERTFILE, "/usr/local/etc/openldap/cacert.pem"); Err comes back as a -1. If I replace ldap with NULL, I do not get the error. Has anyone seen this error? Thanks, Phil Bellino ============================ Phil Bellino MRV Communications, Inc. Boston Product Division 295 Foster St. Littleton,MA 01460 Tel: (978)952-4807 Email: pbellino(a)mrv.com ============================

2 1

RE: Ldap_set_option problem
by Philip Bellino 08 Mar '07

08 Mar '07

Please excuse the typo in the last email. > Hello, > I am running OpenLDAP-2.3.32 on both a Linux server (using SLAPD) and > a Linux client. > > On the client, I am doing the following: > > ldap_initialize(&ldap, ldapuri); - works fine. > ldap_set_option(ldap, LDAP_OPT_PROTOCOL_VERSION, &ldapver); - ldapver > =3 - works fine. > > Err = ldap_set_option(ldap, LDAP_OPT_X_TLS_CACERTFILE, > "/usr/local/etc/openldap/cacert.pem"); > > Err comes back as a -1. If I replace ldap with NULL, I do not get the > error. > > Has anyone seen this error? > > Thanks, > Phil Bellino > ============================ > Phil Bellino > MRV Communications, Inc. > Boston Product Division > 295 Foster St. > Littleton,MA 01460 > Tel: (978)952-4807 > Email: pbellino(a)mrv.com > ============================ >

1 0

Re: slapd-sql with unixodbc - userCertificate retrieval problem
by Pierangelo Masarati 08 Mar '07

08 Mar '07

Kevin Vargo wrote: > 3) another guy gave you the code in #3386 (a) -- sure, not as a > submitted patch, maybe? -- and if it were pulled into the codebase > this would work? Exactly, that should be the way to go. Unfortunately, that guy didn't submit a patch, but rather some hint (which, IMHO, would break other functionalities). Since storing certificates in back-sql for me doesn't even have a place in my todo list, and I'm the one developer that cares most about back-sql, either a solid patch comes in, or binary data will likely never be implemented. If you feel like preparing and submitting that patch, I'll be happy (time permitting) to review, test and eventually apply it to back-sql. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

debugging my problem
by Craig White 08 Mar '07

08 Mar '07

I am having a problem with an application and when I save, I am given this error in the logs... Mar 7 20:57:22 srv slapd[14570]: conn=1109156 op=4 MOD attr=sambaLogonScript sambaProfilePath cn uidNumber sambaPrimaryGroupSID sambaAcctFlags gecos userPassword sambaLMPassword uid sambaHomePath homeDirectory description objectClass gidNumber sambaDomainName gn sambaSID sambaNTPassword sambaHomeDrive sn mailLocalAddress calFBURL loginShell Mar 7 20:57:22 srv slapd[14570]: conn=1109156 op=4 RESULT tag=103 err=21 text=objectClass: value #7 invalid per syntax Does 'value #7' mean the 7th item in the MOD attr list in the line above... 1 sambaLogonScript 2 sambaProfilePath 3 cn 4 uidNumber 5 sambaPrimaryGroupSID 6 sambaAcctFlags 7 gecos Does this mean that there is something invalid in the gecos attribute? If not, I am logging at level 256, is there a logging level that would make this obvious to me? Craig

2 1

Re: slapd-sql with unixodbc - userCertificate retrieval problem
by Pierangelo Masarati 07 Mar '07

07 Mar '07

Kevin Vargo wrote: >> You don't need to tell back-sql if data is binary or not: it already >> knows how to deal with data based on their syntax. You need to tell the >> RDBMS that its' storing binary data, and store the certificate in the >> RDBMS as binary. If you store the certificate in base64, then back-sql >> (actually, the certificate's validator, back-sql yous passes octet >> strings around) doesn't know what to do with it. > > Right; I am storing it DER(BER) in a BLOB field now: > > > mysql> desc user_certificates; > +------------------+---------+------+-----+---------+----------------+ > | Field | Type | Null | Key | Default | Extra | > +------------------+---------+------+-----+---------+----------------+ > | id | int(11) | NO | PRI | NULL | auto_increment | > | person_id | int(11) | NO | | | | > | certificate_data | blob | YES | | NULL | | > +------------------+---------+------+-----+---------+----------------+ > 3 rows in set (0.16 sec) > > > Still yields: > > ==>backsql_get_attr_vals(): oc="inetOrgPerson" attr="userCertificate" keyval=4 > backsql_get_attr_vals(): number of values in query: 1 > backsql_get_attr_vals(): query="SELECT user_certificates.certificate_data AS userCertificate FROM persons,user_certificates WHERE persons.id=? AND persons.id=user_certificates.person_id ORDER BY userCertificate" keyval=4 > ================>>> certificateValidate > ================>>> certificateValidate: error:(218529960) > error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag > ================>>> certificateValidate: error:(218595386) > error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error > ================>>> certificateValidate: error:(0) > error:00000000:lib(0):func(0):reason(0) > > > pulling the data directly out of the database via Perl, the file verifies just fine with: > openssl x509 -noout -text -inform der -in ../tmp/tmpfile.tmp > > pulling it out with SELECT ... INTO OUTFILE yeilds the same SSL errors; diff'ing shows \s in the file that's bad...? > > based on what TIS#3113 indicated, it seemed like the guy had issues with how slapd was pulling it out of the database? > > It also seemed like the following note was consistent with that interpretation? > > [servers/slapd/back-sql/entry-id.c:744] > /* > * FIXME: what if a binary > * is fetched? > */ > ber_str2bv( row.cols[ i ], 0, 0, &bv ); This is surely part of the problem. In this sense, back-sql knowns nothing about BLOBs, and a patch for this would be welcome. >>> Note that this is the OpenSSL invoked by the X.509 validator >>> (assuming TLS was turned on), even though the certificate in question >>> is not being used for TLS. However, the normalization still fails, >>> even (as mentioned) if validation is disabled. I'm assuming the >>> normalization failure would be related, although I haven't gotten >>> there yet. >> >> TLS has nothing to do with this. OpenLDAP just needs to be compiled >> with ssl to have certificate handling routines around. > > It appears to choose the validator via TLS settings? I could certainly be missing something, but: > > [servers/slapd/schema_init.c] > #ifdef HAVE_TLS > static int certificateValidate( Syntax *syntax, struct berval *in ) > { > ...... > #else > #define certificateValidate sequenceValidate > #endif > > > or are you saying that HAVE_TLS is driven off of ssl compilation switches? From your previous message, I inferred you said that TLS had to be __configured__ in slapd.conf to enable certificate validation. I understand you meant it had to be configured at compile time. The latter is correct, so if that's what you meant then you were right. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software