openldap-software

openldap-software@openldap.org

2719 discussions

more questions regarding password hashes
by Brandon McCombs 23 Feb '07

23 Feb '07

I actually read the manpage this time on password-crypt-salt-format but still have some questions. It seems that only one salt format can be specified at a time but I'm wondering about the salt itself. A user can never specify what the salt string will be since the 2nd paragraph of that setting's description states the conversion will be substituted with a string of random characters, is that correct? And after reading the crypt(3) manpage it seems that the salt only applies to {CRYPT} passwords so that means it won't work (or be used) for SHA passwords (making them SSHA). Is that correct? I would guess it isn't correct based on the next paragraph. The manpage states the default hash is SSHA (although I recently found out that on Debian with OpenLDAP 2.2.30 cleartext is the default) so I guess the salts do work with SHA to make SSHA passwords. If that is the case how does one have control over whether a salted or unsalted password is created if programmatically modifying a password by using the LDAP password extension or some other API? Is it a matter of either having salted or unsalted passwords (but not both at the same time) depending on whether the password-crypt-salt-format setting is configured? One last question, if a salt is used with MD5 for example, is the password's hash prefixed with {SMD5} or is {MD5} still used? All these hashes are confusing so I'm trying to get things clear in my head. thanks

3 4

password hashes
by Brandon McCombs 23 Feb '07

23 Feb '07

I'm gathering from reading various sites that openldap doesn't allow a person to specify multiple hash algorithms in the slapd.conf file. Is this correct? If only one is able to be listed then when I specify a password in a custom client openldap will automatically hash the plaintext version of the password that I supply to it so that the password is stored in hashed form, is that correct? One last question, if multiple hashes can't be listed in the slapd.conf, would a user be able to specify which type of hash he/she wishes to use when they go to change their password using a client or would the hash specifier (e.g. {MD5} ) become part of the password when that is attempted? thanks

3 5

Creating a virtual DIT?
by Mads Orbesen Troest 22 Feb '07

22 Feb '07

Hi. I'm new to this list, but risk diving right in with a question: I am wondering whether the following scenario is possible to implement using OpenLDAP: We are a sub-organization within a larger organization and want to perform authentication against the central LDAP server yet augment query results with attributes from from the DIT of our own LDAP server. In effect, providing a virtual DIT hiding the details of which attributes comes from where to the applications using it. It is not just a matter of delegation, more of a selective merge of the attributes available in the 2 DITs. An example: Central DIT: cn: someone userPassword: something mail: someone(a)somewhere.org<mailto:someone@somewhere.org> irrelevantAttribute: whatever Our DIT: uid: someone inProjects: someProject, someOtherProject Virtual DIT (auth'ed against Central DIT): uid: someone mail: someone(a)somewhere.org<mailto:someone@somewhere.org> inProjects: someProject, someOtherProject Commercial products such as the Symlabs Directory Extender promise such capabilities but I'd like to stick with an open solution in at all possible. I guess it might possibly be implemented in a custom back_perl handler, but is it possible to achieve using fx back_meta or some other "native" OpenLDAP configuration? Thanks in advance, /\/\\ads Troest

2 2

entryDN attribute
by Brandon McCombs 22 Feb '07

22 Feb '07

I want to use the entryDN attribute as a unique identifier. Is there any particular reason why I can't read this attribute using openldap.org's server? It won't return in searches I do. thanks

4 5

Re: Using back-ldap as a dumb proxy
by Quanah Gibson-Mount 22 Feb '07

22 Feb '07

--On Wednesday, February 21, 2007 11:52 PM +0100 Pierangelo Masarati <ando(a)sys-net.it> wrote: > Quanah Gibson-Mount wrote: >> >> >> --On Wednesday, February 21, 2007 2:39 PM -0800 Quanah Gibson-Mount >> <quanah(a)stanford.edu> wrote: >> >>> I'm trying to set up a very simply slapd that takes incoming requests >>> locally, and forwards them on to a remote server using SASL/GSSAPI to >>> get the information, so that a internal app that doesn't understand >>> SASL/GSSAPI can get the information it needs. >> >> Never mind, I forgot to load the core schema. duh. :P > > The proxy was a bit too dumb ;) Heh. The problem I'm having now, is I can't get it to perform SASL/GSSAPI auth to the remote proxy. If I have: # /etc/ldap/slapd.conf -- LDAP proxy slapd configuration file. # $Id$ include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/krb5-kdc.schema include /etc/ldap/schema/suacct.schema # Global Options modulepath /usr/lib/ldap moduleload back_ldap.la readonly on access to * by * read # LDAP Proxy Options database ldap suffix "dc=stanford,dc=edu" uri "ldap://ldap-test1.stanford.edu" idassert-bind bindmethod=none It correctly talks to the remote server with an anonymous bind. However, if I change things around: idassert-bind bindmethod=sasl saslmech=gssapi realm=stanford.edu authcID=proxy credentials=proxy mode=self I get: ldapsearch -LLL -x -h localhost -b "dc=stanford,dc=edu" uid=quanah Inappropriate authentication (48) The KRB5CCNAME is set in slapd's environment, so it has access to the ticket cache it needs to use to perform SASL/GSSAPI. It is not talking to the remote server at all. Is there something here I'm missing? I've also tried: idassert-bind bindmethod=sasl saslmech=gssapi realm=stanford.edu authcID=service/mailrouter(a)stanford.edu authzID=dn:cn=mailrouter,cn=service,cn=applications,dc=stanford,dc=edu But then I get: Authentication method not supported (7) And again, it didn't talk to the remote server. Thanks, Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

3 7

multiple replog?
by Emmanuel Dreyfus 22 Feb '07

22 Feb '07

Hello Is it possible to have slapd outputing muliple replog for the same database? I'd like to use one for slurpd, and one to keep a log of all changes, but it seems only the first replog statement is honoured. Is there a trick? Or another way to get a change log? -- Emmanuel Dreyfus manu(a)netbsd.org

3 2

This is a new thread: Re: slapd stopping with no error message
by Tony Earnshaw 22 Feb '07

22 Feb '07

Howard Chu wrote, with irony, on 21. feb 2007 16:43: [...] > Unix has this cool thing called I/O redirection, perhaps you've heard > of it? [...] and > There's also this other cool thing called job control... [...] This has nothing to do with that thread, but has been worrying me: Our production RHAS4 site with 4 OpenLDAP 2.3 servers (1 delta syncrepl provider, 3 consumers) has been running exemplararily (new word?) since ~= 2.3.27. All servers were running 2.3.33 perfectly, then I built 2.3.34 and on just one of the servers (the master), after around 4 hours of it doing hard work, I see (top) the slapd process consuming 98-99% CPU. The CPU consumption is never relinquished, even if I wait for hours (ouch). If I reinstall 2.3.33 this goes away and all is back to normal. On my (discrete=nothing to do with the others) test rig, 2.3.34 from the same batch also functions perfectly. Where should I be looking? System and build details for all rigs: OS Red Hat RHAS4, completely up2date All, but all software built and installed as rpms My own-built db4-4.2.52 rpms with all patches (Red Hat's doesn't have all patches) For the OpenLDAP 2.3 rpms I'm using Buchan Milne's 2.4.24 srpm spec file, basically only modified each build for the version, so that all the %prep, %configure and %build stages are the same for all builds - irrespective of OL version. Ta in advance, --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl

2 2

Using back-ldap as a dumb proxy
by Quanah Gibson-Mount 21 Feb '07

21 Feb '07

I'm trying to set up a very simply slapd that takes incoming requests locally, and forwards them on to a remote server using SASL/GSSAPI to get the information, so that a internal app that doesn't understand SASL/GSSAPI can get the information it needs. I'm trying to configure back-ldap thusly: # /etc/ldap/slapd.conf -- LDAP proxy slapd configuration file. # $Id$ # Global Options modulepath /usr/lib/ldap moduleload back_ldap.la readonly on access to * by * read # LDAP Proxy Options database ldap suffix "dc=stanford,dc=edu" uri "ldap://ldap-test1.stanford.edu/" idassert-bind bindmethod=sasl saslmech=GSSAPI protocol-version 3 but it keeps complaining that the DN for the suffix is invalid. I see nothing wrong with this suffix. line 17 (suffix "dc=stanford,dc=edu") >>> dnPrettyNormal: <dc=stanford,dc=edu> => ldap_bv2dn(dc=stanford,dc=edu,0) <= ldap_bv2dn(dc=stanford,dc=edu)=0 ldap_err2string /etc/ldap/slapd.conf: line 17: <suffix> invalid DN 21 (Invalid syntax) slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. --Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

2 3

OpenLDAP 2.3 using ACI
by Eugenia Candida Oliveira de Moura 21 Feb '07

21 Feb '07

Hi, Is possible to use ACI to control the access in openLDAP 2.3? What the difference between ACI and ACL? Thanks. Eugênia Moura.

2 1

Re: LDAP+TLS
by Net Warrior 21 Feb '07

21 Feb '07

Hi. Never could make it work, and I gave up I tried everything they told me to do in the mailing list I followed the how-tos' ( official one and others ) but no way cannot force it to ask for a certificate, so I setted it up like. Try instead of Demand. Maybe I'm too lame, and do not understad it complexity, hope some day to make it work. Thank for your help, time, and interest. Greets. 2007/2/13, Brian A. Seklecki <lavalamp(a)spiritual-machines.org>: > > > Any resolution ? > > ~BAS > > On Mon, 13 Nov 2006, Net Warrior wrote: > > > Hi. > > > > Using the -cert or -key options returns the same > > error, this error arises only when I use > > the TLSClientVerify demand option as I explained before. > > > > Any clues? > > > > > > Thanks for your time. > > > > > > > > 2006/11/6, Howard Chu <hyc(a)symas.com>: > >> > >> Net Warrior wrote: > >> > >> > With this configuration everything seems to work fine, but now, what > I > >> > want to do is to force my clients to use a certificate to connect, > >> > so, if I did not misundestrand it wrong, the demand options is a > must. > >> > > >> > So, when I change TLSVerifyClient never to demand. I've get the > >> > following ( alway on my server ) > >> > > >> > linux:/etc/ssl # openssl s_client -connect localhost:636 -state > >> > -showcerts -CAfile cacert.pem > >> > >> This invocation of s_client didn't provide the -cert or -key options, > so > >> no client certificate was used. Naturally the handshake fails. > >> > >> Learn to use the OpenSSL tools. > >> > >> > CONNECTED(00000003) > >> > SSL_connect:before/connect initialization > >> > SSL_connect:SSLv2/v3 write client hello A > >> > SSL_connect:SSLv3 read server hello A > >> > depth=1 /C=AU/ST=Some State/L=City/O=Internet Widgits Pty > >> > Ltd/OU=Section/CN=localhost/emailAddress= test(a)company.com > >> > <mailto:test@company.com> > >> > verify return:1 > >> > depth=0 /C=AU/ST=Some Even State/L=City/O=Internet Widgits Pty > >> > Ltd/OU=Section/CN=localhost/emailAddress=test(a)company.com > >> > <mailto:test@company.com> > >> > verify return:1 > >> > SSL_connect:SSLv3 read server certificate A > >> > SSL_connect:SSLv3 read server certificate request A > >> > SSL_connect:SSLv3 read server done A > >> > SSL_connect:SSLv3 write client certificate A > >> > SSL_connect:SSLv3 write client key exchange A > >> > SSL_connect:SSLv3 write change cipher spec A > >> > SSL_connect:SSLv3 write finished A > >> > SSL_connect:SSLv3 flush data > >> > SSL3 alert read:fatal:handshake failure > >> > SSL_connect:failed in SSLv3 read finished A > >> > 6274:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert > handshake > >> > failure:s3_pkt.c:1052:SSL alert number 40 > >> > 6274:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake > >> > failure:s23_lib.c:226: > >> > > >> > > >> > Making some searches in the mailing list I found a guy who had the > same > >> > problem, and he was told that with the > >> > demand option we force slapd to ask for a client certificate, and > that > >> > the client certificate is a must. > >> > Well, now, I do not get it, cuz I'm authenticating against myself, > with > >> > teh certificates I generated before, > >> > maybe ai have to generate a separate pair of certificates, do not > know. > >> > > >> > With never, and always it works as suggested by someone in the list, > who > >> > said that first we need try a lower option (never, allow ) > >> > to test if the server works ) my problem is with the demand option. > >> > > >> > > >> > What am I mising here? > >> > Sorry for my stupidity, I do not get it yet. > >> > > >> > Thanks in advance and or your valuable time. > >> > > >> > Greets. > >> > > >> > >> -- > >> -- Howard Chu > >> Chief Architect, Symas Corp. http://www.symas.com > >> Director, Highland Sun http://highlandsun.com/hyc > >> OpenLDAP Core Team http://www.openldap.org/project/ > >> > > > > l8* > -lava (Brian A. Seklecki - Pittsburgh, PA, USA) > http://www.spiritual-machines.org/ > > "...from back in the heady days when "helpdesk" meant nothing, "diskquota" > meant everything, and lives could be bought and sold for a couple of pages > of laser printout - and frequently were." >

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software