openldap-software

openldap-software@openldap.org

2719 discussions

Lock tuning
by matthew sporleder 03 Jan '07

03 Jan '07

After reading http://www.oracle.com/technology/documentation/berkeley-db/db/ref/lock/max.… I started to look at db_stat -c and noticed this: 5203 Total number of locks not immediately available due to conflicts. 15 Number of deadlocks. Now, these numbers of pretty low compared to all the other stuff with M's at the end, but the following would imply that there's plenty of capacity: 1000 Maximum number of locks possible. 1000 Maximum number of lockers possible. 1000 Maximum number of lock objects possible. 4 Number of current locks. 74 Maximum number of locks at any one time. 59 Number of current lockers. 71 Maximum number of lockers at any one time. 4 Number of current lock objects. 39 Maximum number of lock objects at any one time. Any hints as to why I would have deadlocks, or locks not available? Maybe I'm misreading what a conflict is vs just contention. Thanks, _Matt (.. if only I knew what the conflict matrix was trying to say ;)

2 2

OpenLDAP user credentials lifetime issue
by Alina Dubrovska 03 Jan '07

03 Jan '07

Hello, I need to implement directory users' credentials lifetime functionality on my OpenLDAP server (2.3.27). For each user lifetime can be set as "forever" or "number of days between 1 and 365". After lifetime expires user must be terminated (user entry still present in directory, but not able to authenticate). I have inspected slapo-ppolicy(5) overlay functionality, seems that: "pwdMaxAge=<lifetime>" + "pwdGraceAuthnLimit=0" would help, but then I need to setup separate policy for each user with different lifetime (not acceptable). I would like to ask if slapd(8) offers features (in addition to slapo-ppolicy) to control the lifetime of directory users' credentials? Is there a convenient way to implement such requirement? Any suggestions are very appreciated! Thanks in advance, Alina.

3 3

Porting to Sun Galaxy
by Girish Pal 02 Jan '07

02 Jan '07

Hi, We are currently using slapd version 1.8.8.7 for our inhouse product based on Sun Solaris 2.8.9 Sun Solaris sparc platform. We need to migrate our slapd to the newly ported system based on Sun Galaxy, Solaris version 10. Kindly suggest which version we should use for our requirements. -- Regards, Girish

4 5

slappasswd question
by Greg Martin 01 Jan '07

01 Jan '07

I have slapd configured with password-hash {SSHA}. I'm uusing slappasswd to generate passwords and notice that if I run it twice with the same secret that I get different results. I guess I don't understand this, but how does slapd verify a password if each time I generate it I get something different? Confused! \\Greg $OpenLDAP: slapd 2.3.27 (Oct 13 2006 09:16:43)

3 4

Question about DB_CONFIG (set_lg_bsize)
by TechnoSophos 29 Dec '06

29 Dec '06

If my directory routinely stores large chunks of data (like images) that are over two megs in size, should I raise the value for set_lg_bsize to reflect the max size of these files? Matt

2 1

Setting dbnosync: do I need to set a checkpoint?
by TechnoSophos 29 Dec '06

29 Dec '06

Using an HDB backend, if I set the dbnosync parameter in slapd.conf, how often will modifications be flushed to the underlying database? I did not find the Berkeley DB documentation to be terribly helpful in this case. It mentions that more frequent checkpointing can help: (http://www.oracle.com/technology/documentation/berkeley-db/db/api_c/env_set…) Should I be using the checkpoint parameter in slapd.conf? I was under the impression (based on threads I have seen in other mailing lists) that checkpoint didn't actually do anything anymore. (And I have not had much luck with using txn_checkpoint in the DB_CONFIG file -- it produces errors). I'm not asking for troubleshooting help on fixing checkpointing. I just want to know how risky it is to use dbnosync, and if checkpointing can help minimize risks. Matt

2 1

Re: cetificate issue with ldaps
by jerrrry＠voila.fr 29 Dec '06

29 Dec '06

thank you for your help. but i still don't understand why the ssl connection works without any CA in TLS_CACERT whereas i put TLS_REQCERT "demand" ? Thomas > Message du 29/12/06 à 18h28 > De : "Owen DeLong" > A : "Rafal (sxat)" > Copie à : openldap-software(a)openldap.org > Objet : Re: cetificate issue with ldaps > > Small correction: > > TLS_CACERT must be the certificate from a ROOT Certificate Authority or > a Certificate Authority certification signed by a known parent CA. CA > means "Certificate Authority". There can be multiple levels of > Certificate > authority. > > Every certificate has an Issuer (Certificate Authority) which signed the > certificate, and, a Subject whose public key and other data is signed > by the CA. If the certificate has the correct attributes, then, it > can be > used to sign subordinate certificates. > > A certificate which has the same issuer and subject is a ROOT > certificate > because there is no parent certificate. > > You might want to check if there is also a TLS_CACERTDIR directive > or similar which could still allow the client to locate the CA > Certificate. > > Owen > > On Dec 29, 2006, at 5:32 AM, Rafal ((sxat)) wrote: > > >> TLS_CACERT /usr/local/etc/raddb/RTFE/conca.pem > >> TLS_REQCERT demand > >> My issue is that the ssl connexion still works if i comment the > >> line with > >> TLS_CACERT /usr/local/etc/raddb/RTFE/conca.pem. > >> and it should not because without this certificate authority my > >> openldap > > proxy should not be able to >check the certificate sent by the > > backend ldap. > >> TLS certificate verification: Error, self signed certificate in > >> certificate > > chain > >> but it works with this error. > > > > You must have your root CA -> selfsigned after you create > > - CA and key for your LDAP server > > - CA anad key for client > > > > both CA(client,server) you must sign by your CA root certificate > > > > pozdr > > rafal > > > > > > [ smime.p7s (2.8 Ko) ]

1 0

cetificate issue with ldaps
by jerrrry＠voila.fr 29 Dec '06

29 Dec '06

Hi, i'm using openldap as a ldap proxy to an an other ldap server. I'd like to get a ldaps connexion between this 2 servers. so, i configured ldap.conf like this: TLS_CACERT /usr/local/etc/raddb/RTFE/conca.pem TLS_REQCERT demand My issue is that the ssl connexion still works if i comment the line with TLS_CACERT /usr/local/etc/raddb/RTFE/conca.pem. and it should not because without this certificate authority my openldap proxy should not be able to check the certificate sent by the backend ldap. the only difference that i see without this line is in debug mode (slapd -d 1): TLS certificate verification: Error, self signed certificate in certificate chain but it works with this error. so, do you have an idea to force the ssl connexion to fail if the certificate sent by the other ldap server is not signed by my certificate authority ? Thanks, Thomas

3 2

my LDAP crash with SASL authentication
by Rafal (sxat) 29 Dec '06

29 Dec '06

Hello I am compile last version of LDAP with SASL and TLS for use with SQL (without berkley DB) and when I running authentication with sasl is OK but if I success login to ldap with SASL - ldap always crashes (in file backend.c function select_backend) because ->bv-len is large numer (about 4564564321) how configure SASL for ldap? regard Rafal sxat

1 0

RE: Slapd fails to terminate
by Lesley Walker 28 Dec '06

28 Dec '06

Never mind, I eventually twigged that "connections_shutdown" was the name of a function and found the right line. > -----Original Message----- > I know just about enough C to be able to comment out the > line. How do I identify it?

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software