openldap-software

openldap-software@openldap.org

2719 discussions

Problem with replica. (SLURP).
by Paul Shevtsov 14 Nov '06

14 Nov '06

I have 3 ldap server's. One master and two slave. From master to one slave replica passes successeful, but to another slave replica not pass. Config slapd on both slave the same, but version openldap different. (2.3.19 and 2.3.27). Version master openldap - 2.3.11. Problem with version? P.S. During replica i have next error message: "ERROR: Constraint violation: entryCNS: no user modification allowed" -- Paul Shevtsov <> 380-62-3327312 <Dongorbank> <> paul(a)dongorbank.com

2 5

Re: syncrepl & OpenLDAP 2.3.27 & Backend Issue
by Howard Chu 13 Nov '06

13 Nov '06

Doug Goldstein wrote: > Howard Chu wrote: >> The examples in the Admin Guide are just that - examples. The doc states >> that it will work with any backend type, and uses a different backend >> type merely to illustrate that the backend type on the consumer does not >> need to agree with the type on the producer. > > The Admin Guide says that only hdb and bdb will work due to the indexing > and other data needs. It says no such thing: 15.3.2. Set up the consumer slapd The syncrepl replication is specified in the database section of slapd.conf (5) for the replica context. The syncrepl engine is backend independent and the directive can be defined with any database type. > The example it gives is a master with "bdb" and > the consumers with "hdb" and my issue is that the example provided does > not work as such. The example works perfectly well for me. There is no way that just changing the database type would affect it. You must have changed something else as well. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

2 1

cross compiling client tools
by Robert Carter 13 Nov '06

13 Nov '06

Hi list, I wish to use the openldap client tools in an embedded environment where I cross compile openldap package against uclibc. These are tools such as ldapsearch, ldapdelete. Because I don't need any of the server software i'm using a configure line like this: ./configure \ --target=$(GNU_TARGET_NAME) \ --host=$(GNU_TARGET_NAME) \ --build=$(GNU_HOST_NAME) \ --prefix=/ \ --with-tls \ --disable-slapd \ --disable-slurpd \ --without-yielding-select \ --without-rewrite \ --without-overlays \ --with-gnu-ld make depend make CC=$(TARGET_CC) -C $(OPENLDAP_DIR) Assume that the GNU_ type variables have reasonable values. The complilation proceeds normally, util the linking phase. At this point libtool fails with: /bin/sh ../..//libtool --mode=link /home/imageuser/buildroot/buildroot/trunk/build_i686/staging_dir/bin/i686-linux-uclibc-gcc -static -Os -pipe -o rewrite rewrite.o parse.o librewrite.a ../../libraries/liblutil/liblutil.a ../../libraries/libldap_r/libldap_r.la ../../libraries/liblber/liblber.la -lssl -lcrypto -pthread /home/imageuser/buildroot/buildroot/trunk/build_i686/staging_dir/bin/i686-linux-uclibc-gcc -Os -pipe -o rewrite rewrite.o parse.o -pthread librewrite.a ../../libraries/liblutil/liblutil.a ../../libraries/libldap_r/.libs/libldap_r.a /home/imageuser/buildroot/buildroot/trunk/build_i686/openldap-2.3.28/libraries/liblber/.libs/liblber.a ../../libraries/liblber/.libs/liblber.a -lssl -lcrypto -pthread ../../libraries/libldap_r/.libs/libldap_r.a(tls.o): In function `ldap_pvt_tls_check_hostname': tls.c:(.text+0x9ca): undefined reference to `lutil_memcmp' collect2: ld returned 1 exit status Can anyone throw any light on this problem? Rob

1 0

syncrepl & OpenLDAP 2.3.27 & Backend Issue
by Doug Goldstein 13 Nov '06

13 Nov '06

I have been attempting to setup OpenLDAP for the past couple of days with syncrepl and have been able to get it to work. The configs work resolve find with "slaptest -d config" and the master would work but the consumers would never have any data in them. After spending some time and reconfiguring a bunch of times with the help of the guys in #ldap on Freenode. I switched by consumers from "hdb" to "bdb" and it just started to work. My master had always been "bdb". No idea why this happens like this but the guys from #ldap told me to e-mail this info out. I was just following the guide from OpenLDAP Administrator's Guide which said to set it up with bdb on the master and hdb on the consumers. If anyone wants any more info to track this down let me know and I'll provide it. -- Doug Goldstein cardoe(a)gentoo.org

2 1

hdb stops checkpointing....
by johan.jonemo＠hep.lu.se 13 Nov '06

13 Nov '06

I try to modify a hdb periodically (often). After a while the underlying database seems to be swamped down. If I look in the directory log files are piling up. I run db_archive periodically to clean up the log files and I also run db_deadlock in parallel. I do not run db_checkpoint as this as far as I understand is done by the backend. Strangely the problem seems to start after about 2 h if I start from a clean database. When I try to lower the frequency of the updates it still seems to happen after 2 h. I use openLDAP v2.3.24 with Sleepycat Software: Berkeley DB 4.4.20 Johan Jönemo

3 3

LDAP+TLS
by Net Warrior 13 Nov '06

13 Nov '06

Hi there guys. Well, I'm making some progress securing my ldap server by reading the list and the oficial how-to, but I'm facing a new problem. So, I've created the certificates using this link. http://www.openldap.org/faq/index.cgi?_highlightWords=self%20signed&file=185 Then in my slapd.conf I've got. (server side ) #security ssf=128 update_ssf=128 simple_bind=128 #TLSCipherSuite HIGH:MEDIUM:+SSLv3:+SSLv2:+RSA:+TLSv1 security ssf=1 update_ssf=112 simple_bind=64 TLSCipherSuite HIGH:MEDIUM:+SSLv3 TLSCACertificateFile /etc/ssl/cacert.pem TLSCertificateFile /etc/ssl/servercrt.pem TLSCertificateKeyFile /etc/ssl/serverkey.pem TLSVerifyClient never ldap.conf (server side ) /etc/openldap/ldap.conf BASE dc=netwarrior,dc=com URI ldaps://linux:636 HOST linux:636 #BINDDN dc=netwarrior,dc=netwarrior #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never TLS_CACERT /etc/ssl/cacert.pem TLS_REQCERT never With this configuration everything seems to work fine, but now, what I want to do is to force my clients to use a certificate to connect, so, if I did not misundestrand it wrong, the demand options is a must. So, when I change TLSVerifyClient never to demand. I've get the following ( alway on my server ) linux:/etc/ssl # openssl s_client -connect localhost:636 -state -showcerts -CAfile cacert.pem CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL_connect:SSLv3 read server hello A depth=1 /C=AU/ST=Some State/L=City/O=Internet Widgits Pty Ltd/OU=Section/CN=localhost/emailAddress= test(a)company.com verify return:1 depth=0 /C=AU/ST=Some Even State/L=City/O=Internet Widgits Pty Ltd/OU=Section/CN=localhost/emailAddress=test(a)company.com verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL3 alert read:fatal:handshake failure SSL_connect:failed in SSLv3 read finished A 6274:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1052:SSL alert number 40 6274:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:226: Making some searches in the mailing list I found a guy who had the same problem, and he was told that with the demand option we force slapd to ask for a client certificate, and that the client certificate is a must. Well, now, I do not get it, cuz I'm authenticating against myself, with teh certificates I generated before, maybe ai have to generate a separate pair of certificates, do not know. With never, and always it works as suggested by someone in the list, who said that first we need try a lower option (never, allow ) to test if the server works ) my problem is with the demand option. What am I mising here? Sorry for my stupidity, I do not get it yet. Thanks in advance and or your valuable time. Greets.

2 2

slapo-accesslog configuration puzzle
by 王鹏辉 13 Nov '06

13 Nov '06

Hello, list. I have enabled accesslog feature in my openldap server 2.3.27 in a gentoo box. During the configuration, i found something unclearly to me. I found that if the accesslog database definiation section located in any place except the first one in the slapd.conf file. When i want to start the openldap deamon. the follow error will come out: Nov 13 10:10:13 (none) slapd[2141]: @(#) $OpenLDAP: slapd 2.3.27 (Sep 20 2006 17:09:57) $ ^Iroot@monster:/tmp/buildd/openldap2.3-2.3 .27/debian/build/servers/slapd Nov 13 10:10:13 (none) slapd[2142]: backend_startup_one: bi_db_open failed! (32768) Nov 13 10:10:13 (none) slapd[2142]: slapd stopped. Nov 13 10:10:13 (none) slapd[2142]: connections_destroy: nothing to destroy. If i put the accesslog database definiation section is the first database section, the openldap daemon could start correctly. Does some one know the details of this condition? Every response is appreciated. Wang Penghui -- Wang Penghui +86 592 8389 650

1 0

Lock table is out of available locks
by vadim 12 Nov '06

12 Nov '06

Hi all, I have tried to add some entries to OpenLDAP server 2.3.29. Everything crashes with following error message: bdb(o=bla): Lock table is out of available locks => bdb_idl_insert_key: c_get failed: Not enough space(12) Do you know what am I doing wrong? thanx a lot and best regards, vadim tarassov

3 2

Duplicated username in Local users and LDAP
by Phillip 09 Nov '06

09 Nov '06

Hi all, I meet some trouble when there are duplicated username in both local users list and LDAP users list, and I think it may cause security problems, for example, in my case, "root" and "admin" account from LDAP could even control the whole system. I do not want this happens. Would you please give me some advices on how to dare with this duplicated username issue? Kind regards, Phillip

3 2

open ldap with SASL & GSSAPI
by Maxwell Bottiger 09 Nov '06

09 Nov '06

Hello all, I've found lots of information about problems related to mine in the FAQ and around the net, but I don't have a solution yet. Here's my setup: Open Ldap 2.2 MIT Kerberos SASL 2.1.20 I'm using ldap to provide directory services and user info to some linux workstations. This was working, but after upgrading a test machine to Fedora 6 I've started having some serious problems. [sleepylight@minitop ~]$ ldapsearch -H ldap://ns.jive-turkey.net -Y GSSAPI SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context I figure this is one of three possible problems. 1 - saslauthd isn't working right 2 - ldap isn't talking to sasl correctly 3 - I've done something wrong with my ldap quires. Kerberos seems to work fine. I can get my credentials with kinit, and the GSSAPI credentials are working for ssh logins. Also, I can use testsaslauthd and get a success from the authd server. [sleepylight@ns ~]$ /usr/sbin/testsaslauthd -r JIVE-TURKEY.NET -s ldap -u sleepylight -p ********* 0: OK "Success." So I think my problem is #2 or #3. I'm not sure which, so if anyone has some feedback I'm happy to try it out. I'll include some possibly relevant material at the end of this email. Thanks for reading! Some stuff from slapd.conf: sasl-host ns.jive-turkey.net sasl-secprops noanonymous,noplain,noactive saslRegexp uid=([^/]*),cn=GSSAPI,cn=auth uid=$1,ou=People,dc=jive-turkey,dc=net # Default read access for everything else access to * by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by * read Messages from slapd after an attempted login slapd startup: initiated. backend_startup: starting "dc=jive-turkey,dc=net" bdb_db_open: dbenv_open(/var/lib/ldap) slapd starting connection_get(10): got connid=0 connection_read(10): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 12 contents: ber_get_next ber_get_next on fd 10 failed errno=11 (Resource temporarily unavailable) do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> do_bind: version=3 dn="" method=128 send_ldap_result: conn=0 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush: 14 bytes to sd 10 do_bind: v3 anonymous bind connection_get(10): got connid=0 connection_read(10): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 201 contents: ber_get_next ber_get_next on fd 10 failed errno=11 (Resource temporarily unavailable) do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <dc=jive-tukey,dc=net> ldap_err2string <= ldap_bv2dn(dc=jive-tukey,dc=net)=0 Success => ldap_dn2bv(272) ldap_err2string <= ldap_dn2bv(dc=jive-tukey,dc=net)=0 Success => ldap_dn2bv(272) ldap_err2string <= ldap_dn2bv(dc=jive-tukey,dc=net)=0 Success <<< dnPrettyNormal: <dc=jive-tukey,dc=net>, <dc=jive-tukey,dc=net> ber_scanf fmt ({mm}) ber: ber_scanf fmt ({mm}) ber: ber_scanf fmt ({M}}) ber: send_ldap_result: conn=0 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=32 ber_flush: 14 bytes to sd 10 connection_get(10): got connid=0 connection_read(10): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 201 contents: ber_get_next do_search

8 14

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software