openldap-software

openldap-software@openldap.org

2719 discussions

Re: AW: AW: slapcat hangs without error message
by Aaron Richton 14 Feb '07

14 Feb '07

Please keep replies on the list. In that case, you're completely out of luck unless you have some sort of filesystem dumps to restore. Count yourself fortunate that you've recovered small amount of data that you do have, and consider it a lesson for configuration next time. On Wed, 14 Feb 2007, Voigtlaender(a)hansenet.com wrote: > I have not a single logfile, we run our slapd without transaction logs > because the recovery routines never worked for us. But thanks anyway for > the advice. > >> -----Ursprüngliche Nachricht----- >> Von: Aaron Richton [mailto:richton@nbcs.rutgers.edu] >> Gesendet: Mittwoch, 14. Februar 2007 15:22 >> An: Voigtländer, Marcella HTK >> Cc: openldap-software(a)openldap.org >> Betreff: Re: AW: slapcat hangs without error message >> >> >> If you have enough log files lying around, you could try the >> catastrophic >> recovery mode of db_recover. But that's a long shot, to put it nicely. >> >> On Wed, 14 Feb 2007, Voigtlaender(a)hansenet.com wrote: >> >>> It seems you are right. I did try db_recover, after that >> slapcat runs, >>> but the data is not complete. Furthermore my slapd doesn't >> start anymore >>> after the recover. Is there anything else I could try to >> get my data ? >>> >>> Marcella >> >

1 0

slapcat hangs without error message
by Voigtlaender＠hansenet.com 14 Feb '07

14 Feb '07

Hi, I am running a slapd 2.2.23 (debian package) with a bdb Backend on a Debian Sarge system. I want to use slapcat for backing up my database, but it does never dump the complete data. After running a while it just stops and is doing nothing anymore. I am a bit nervous right now, is there another way to get a ldif dump, or some way of debugging to find the error ? I did try slapcat -d 256, but that did not show anything unnormal, it just stopped. Thank you, Marcella

4 6

Building OpenLDAP with MSVC 6
by Rajarshi Chaudhuri 14 Feb '07

14 Feb '07

Hi, I see a few references of building OpenLDAP in Windows using MSVC6 - but I don't see any updated and comprehensive document. Can somebody help? Regds, Rajarshi Chaudhuri Genesys Telecommunications Lab, Inc rajarshi(a)genesyslab.com <mailto:rajarshi@genesyslab.com>

5 12

Slapd config for heavy and medium load
by Rajarshi Chaudhuri 13 Feb '07

13 Feb '07

Hi, I would highly appreciate if someone can provide the following - a. A sample bdb section for slapd.conf that shows what parameters need to be configured and to what values [may be a range] for withstanding a relatively heavy load [about 50 - 150 concurrent users each pumping a lot of data]. Also if some parameters should be configured in a DB_CONFIG file. Also - the thread pool size is important. b. A sample bdb section for slapd.conf that shows what parameters need to be configured and to what values [may be a range] for withstanding a medium load [about 10 - 15 concurrent users each pumping some data]. Also if some parameters should be configured in a DB_CONFIG file. Also - the thread pool size is important. There are lots of material in the archive regarding this - but not with much specificity. So if someone summarizes this in one place that would be of great help. Rajarshi Chaudhuri Genesys Telecommunications Lab, Inc rajarshi(a)genesyslab.com <mailto:rajarshi@genesyslab.com> 650.466.4860

4 8

RE: Schema Replication
by Mark Mcdonald 13 Feb '07

13 Feb '07

> -----Original Message----- > From: Howard Chu [mailto:hyc@symas.com] > > In OpenLDAP 2.3 you can add new schema definitions on the fly, but you > cannot > modify existing definitions. In OpenLDAP 2.4 you can do full schema > modifications on the fly. Are they replicated from master to slaves in 2.3? > Read the Admin Guide. I think you'll be better off using OpenLDAP 2.4 for > this project. We should be pushing out a new 2.4 alpha release pretty > soon. Is version 2.4 likely to become stable in the near future? Does anyone have any stories from a production environment? We've just updated to 2.3 stable & HDB (from 2.1/LDBM) and would rather not repeat the process so soon! I'm playing around with cn=schema,cn=config now, and my changes are not preserved after slapd is restarted, is there a way around this? Any recommended methods to take (excluding minor revision increments)? My current thoughts are to push the schema updates as both LDIF and schema files so a restart will pick up the changes from disk, although an alternative I'd like would be to build the schema dynamically. I've noticed also that schema updates done dynamically don't pick up data already recorded, for example (the testTwo attribute is the only one defined through the dynamic schema): $ ldapsearch [blah] dn: cn=test,o=base cn: test objectClass: device objectClass: testObject testTwo: w00t [restart slapd] $ ldapsearch [blah] dn: cn=test,o=base cn: test objectClass: device objectClass: testObject $ ldapadd [blah] dn: cn=test,cn=schema,cn=config objectClass: olcSchemaConfig cn: test olcAttributeTypes: ( 1.1.1 NAME 'testAttr' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) olcAttributeTypes: ( 1.1.2 NAME 'testTwo' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 ) olcObjectClasses: ( 1.1.3 NAME 'testObject' MAY ( testAttr $ testTwo ) AUXILIARY ) adding new entry "cn=test,cn=schema,cn=config" $ ldapsearch [blah] dn: cn=test,o=base cn: test objectClass: device objectClass: testObject Does this mean the schema needs to be present before the database is loaded to pick up these attributes? And to pre-empt the inevitable response, I'm guessing this all works beautifully in 2.4?

4 6

sched_yield messages
by Sepp 13 Feb '07

13 Feb '07

Hello, one of our slapd daemons take 99.9% of CPU time (openldap 2.3.11, bdb 4.3.29, SuSE Linux SLES-8 (i386), Kernel 2.4.21-273-smp) With strace we detect: sched_yield() = 0 sched_yield() = 0 .. I found a lot about the sched_yield problem in openldap, but I'm still not sure what to do. Any suggestions ? Thanks ! Sepp

3 2

Re: ldap client can't contact server with SubjectAltName used
by Seed, Steven 13 Feb '07

13 Feb '07

OK, thanks. I'll try that. Unfortunately, I don't have control of the CA. Our corporate division manages that, and yes it is Entrust. I will ask them to regenerate the cert. Niels Frimodt Sørensen wrote: > Hi, > > It seems to me that you are using an Entrust PKI to generate the > certificate? If this is the case ensure that you set the > subjectAltName in SMA with "" surrounding it - if not SMA prepends the > e-mail qualifier... > > > Venlig hilsen/Kind regards > > Niels Frimodt Sørensen > > Signaturgruppen A/S > www.signaturgruppen.dk > +45 40207496 > > > > Howard Chu skrev: >> Seed, Steven wrote: >>> Sending again, because I'm not sure if the first message got through >>> since I had not acknowledged my membership... >>> >>> Steven Seed wrote: >>>> I have an ldap server set up with a SSL certificate such that the >>>> CN=hostname.fqdn. In the same certificate I have created a >>>> SubjectAltName with several DNS aliases. With everything configured >>>> properly in my ldap.conf file, I can make TLS connections to my >>>> ldap server as long as I use the hostname that matches the CN, but >>>> if I change my connection to use one of the aliases in the >>>> SubjectAltName I get: >>>> >>>> ldap_start_tls: Can't contact LDAP server (-1) >>>> additional info: TLS: hostname does not match CN in peer >>>> certificate >> >>>> An openssl dump of the certificate yields the following in the >>>> SubjectAltName section: >>>> >>>> Certificate: >>>> Data: >>>> CN=Proton.fas.fa.disney.com >>>> X509v3 Extended Key Usage: >>>> TLS Web Server Authentication >>>> X509v3 Subject Alternative Name: >>>> >>>> email:dns:faldap,dns:fatestldap,dns:faldap.fas.fa.disney.com,dns:fatestldap… >>>> >>>> X509v3 CRL Distribution Points: >>>> DirName:/DC=com/DC=disney/OU=PKI/CN=The Walt Disney >>>> Company Enterprise CA/CN=CRL27 >>>> URI:http://cdp.disney.pvt/CRL/EnterpriseCRL.crl >>>> URI:http://cdp.disney.com/CRL/EnterpriseCRL.crl >>>> >>>> Can anyone help me figure out what is going wrong? This is the same >>>> with both version 2.2.13 and 2.3.32 of openldap. Does the >>>> SubjectAltName format look correct? >> >> Your subjectAltName appears to have encoded an email extension with >> the string "dns:....." as its value, instead of an actual dns >> extension. So basically, your subjectAltName is wrong. >> -- Steven L. Seed Sr. Systems Administrator Walt Disney Feature Animation Steven.Seed(a)disney.com ================================================================= () __/\__ |\ .-"` `"-. /| I HAVE BEEN CHOSEN... | \.'( ') (' ) (. )`./ | FAREWELL MY FRIENDS... \_ _/ I GO ONTO A BETTER PLACE! \ `~"'=::='"~` / `-.__ __.-' ( `""~~""` ) [_____[##]_____] =================================================================

1 0

deferring operation: too many executing (2nd try)
by Sepp 13 Feb '07

13 Feb '07

Hello, sorry when this is a FAQ. What is the exact meaning of: connection_input: conn=4412677 deferring operation: too many executing and what could be done against it ? Thanks Sepp

2 1

Re: ldap client can't contact server with SubjectAltName used
by Seed, Steven 12 Feb '07

12 Feb '07

Sending again, because I'm not sure if the first message got through since I had not acknowledged my membership... Steven Seed wrote: > I have an ldap server set up with a SSL certificate such that the > CN=hostname.fqdn. In the same certificate I have created a > SubjectAltName with several DNS aliases. With everything configured > properly in my ldap.conf file, I can make TLS connections to my ldap > server as long as I use the hostname that matches the CN, but if I > change my connection to use one of the aliases in the SubjectAltName I > get: > > ldap_start_tls: Can't contact LDAP server (-1) > additional info: TLS: hostname does not match CN in peer > certificate > > Here is the end of the debug output...I can supply the full output, > but it's quite large: > > tls_read: want=5, got=5 > 0000: 16 03 01 00 30 ....0 > tls_read: want=48, got=48 > 0000: 43 2b a5 b7 12 ef 88 f7 76 30 63 78 4c 16 99 0b > C+......v0cxL... > 0010: 5f 26 f8 34 db 15 1b 24 e7 e2 bd 60 c4 25 b4 e4 > _&.4...$...`.%.. > 0020: 0b d4 e7 27 f0 93 1b 6e 40 2a 5c ce a2 69 cd 2d > ...'...n@*\..i.- > TLS: hostname (fatestldap.fas.fa.disney.com) does not match common > name in certificate (Proton.fas.fa.disney.com). > ldap_start_tls: Can't contact LDAP server (-1) > additional info: TLS: hostname does not match CN in peer > certificate > > An openssl dump of the certificate yields the following in the > SubjectAltName section: > > Certificate: > Data: > CN=Proton.fas.fa.disney.com > X509v3 Extended Key Usage: > TLS Web Server Authentication > X509v3 Subject Alternative Name: > > email:dns:faldap,dns:fatestldap,dns:faldap.fas.fa.disney.com,dns:fatestldap… > > X509v3 CRL Distribution Points: > DirName:/DC=com/DC=disney/OU=PKI/CN=The Walt Disney Company > Enterprise CA/CN=CRL27 > URI:http://cdp.disney.pvt/CRL/EnterpriseCRL.crl > URI:http://cdp.disney.com/CRL/EnterpriseCRL.crl > > Can anyone help me figure out what is going wrong? This is the same > with both version 2.2.13 and 2.3.32 of openldap. Does the > SubjectAltName format look correct? > -- Steven L. Seed Sr. Systems Administrator Walt Disney Feature Animation (818) 460-9453 (tl:8426-9453) Steven.Seed(a)disney.com ================================================================= () __/\__ |\ .-"` `"-. /| I HAVE BEEN CHOSEN... | \.'( ') (' ) (. )`./ | FAREWELL MY FRIENDS... \_ _/ I GO ONTO A BETTER PLACE! \ `~"'=::='"~` / `-.__ __.-' ( `""~~""` ) [_____[##]_____] =================================================================

2 1

cn=config && (ACI || ACL)
by Turbo Fredriksson 12 Feb '07

12 Feb '07

I managed to get cn=config working by following http://www.openldap.org/faq/index.cgi?_highlightWords=cn%20config&file=1365 to the letter (meaning: I had to setup a rootdn/rootpw pair to be able to do searches). How can this be used, _without_ using the rootdn/rootpw? I want ordinary users to be able to search/modify 'stuff' there (eventually, when I know exactly what it is and how to use it :). I tried 'access to * by * write' as only ACL, but I _still_ got 'Insufficient access' whether or not I authenticated... And running with '-d 128' shows NOTHING for anonymous access (and only 'auth access to userPassword' when using bind DN). Also (when on the subject of cn=config), in what way is 'cn=schema,cn=config' different from 'cn=Subschema'? The devil is in the details, but why wasn't 'cn=Subschema' enough? It have everything (?) that 'cn=schema,cn=config' have... ?

3 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software