openldap-software

openldap-software@openldap.org

2719 discussions

password policy - alternate lockout mechanism
by Aravind Gottipati 17 Jul '09

17 Jul '09

Hi, The current password policy module can lock folks out after some configurable number of failed attempts. The module currently does not differentiate between a user failing with the same wrong password a bunch of times versus a crack attempt where someone tries multiple different wrong passwords. Are there any modules that take into account if the same password is being used a bunch of times or if multiple different passwords are failing? Could this be a useful feature worth requesting (if it doesn't exist already)? Thank you, Aravind.

6 24

fetching cookies with ldapsearch
by Dieter Kluenter 16 Jul '09

16 Jul '09

Hi, if I do a ldapsearch(1) with simple paged result control enabled I receive a cookie wich is printed to stdout. A ldapsearch(1) with sync request control should receive a syncCookie, which is obviously submitted, but somehow it is not printed to stdout. How can I add this syncCookie to ldapsearch? -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:8EF7B6C6 53°08'09,95"N 10°08'02,42"E

1 1

TLS secure connection problem
by Tamás Pisch 16 Jul '09

16 Jul '09

Hi, I installed Openldap 2.4.11-1 on two Debian Lenny servers (srv3, srv4), in mastrer-slave configuration. I wanted to create secure connection for syncrepl. srv3 is the master (provider) and srv4 is the slave (consumer). While I didn't use secure connection, the ldapsearch, and syncrepl worked. After I set up secure connection, syncrepl didn't work. I start slapd with -h ldap://127.0.0.1/ ldaps:/// on both servers. ldapsearch partially works: Works from srv3: ldapsearch -H ldaps://srv3.mydomain.site:636 -W -x -D "cn=adm,dc=mydomain,dc=site" -b "dc=mydomain,dc=site" "(ObjectClass=*)" ldapsearch -H ldaps://srv4.mydomain.site:636 -W -x -D "cn=adm,dc=mydomain,dc=site" -b "dc=mydomain,dc=site" "(ObjectClass=*)" ldapsearch -H ldap://127.0.0.1:389 -x -W -D "cn=adm,dc=mydomain,dc=site" -b "dc=mydomain,dc=site" "(ObjectClass=*)" Works from srv4: ldapsearch -H ldaps://srv4.mydomain.site:636/ -W -x -D "cn=adm,dc=mydomain,dc=site" -b "dc=mydomain,dc=site" "(ObjectClass=*)" ldapsearch -H ldap://127.0.0.1:389 -x -W -D "cn=adm,dc=mydomain,dc=site" -b "dc=mydomain,dc=site" "(ObjectClass=*)" *_Doesn't_work_from_srv4_:* ldapsearch -H ldaps://srv3.mydomain.site:636/ -W -x -D "cn=adm,dc=mydomain,dc=site" -b "dc=mydomain,dc=site" "(ObjectClass=*)" Enter LDAP Password: **(after i give the password, it waits 1-2 seconds)** ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) On srv3: /etc/ldap/ldap.conf: host 127.0.0.1 base dc=mydomain,dc=site logdir /var/lib/ldap/log TLS_REQCERT hard TLS_CACERT /etc/ssl/certs/cacert.pem slapd.conf: ######################################### # Global Directives: # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba3.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel conns stats filter idletimeout 30 modulepath /usr/lib/ldap moduleload back_hdb moduleload syncprov sizelimit unlimited tool-threads 1 TLSCertificateFile /etc/ssl/certs/srv3cert.pem TLSCertificateKeyFile /etc/ssl/private/srv3key.pem TLSCACertificateFile /etc/ssl/certs/cacert.pem TLSVerifyClient never ####################################################################### # Specific Backend Directives for hdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend hdb database hdb suffix "dc=mydomain,dc=site" rootdn "cn=adm,dc=mydomain,dc=site" rootpw {SSHA}....... directory "/var/lib/ldap" dbconfig set_cachesize 0 100000000 1 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 524288 dbconfig set_lg_dir /var/lib/ldap/log dbconfig set_flags DB_LOG_AUTOREMOVE index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uidNumber eq index gidNumber eq index memberUID eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub index sambaSIDList eq index sambaGroupType eq index entryCSN,entryUUID eq lastmod on checkpoint 512 30 access to * by dn.exact="cn=replicator,dc=mydomain,dc=site" tls_ssf=128 read by * break access to attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdLastSet,sambaPwdCanChange by dn="cn=admin,dc=mydomain,dc=site" write by dn="cn=replicator,dc=mydomain,dc=site" read by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=mydomain,dc=site" write by dn="cn=replicator,dc=mydomain,dc=site" read by self write by * read overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 On srv4: /etc/ldap/ldap.conf: host 127.0.0.1 logdir /var/lib/ldap/log TLS_REQCERT hard TLS_CACERT /etc/ssl/certs/cacert.pem Thanks, Tamas.

2 2

Re: saslmech=EXTERNAL
by Gavin Henry 15 Jul '09

15 Jul '09

Also, -stseug is wrong. It should be: [-s base|one|sub] -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

1 0

Re: saslmech=EXTERNAL
by Greek Ordono 15 Jul '09

15 Jul '09

I tried that following configuration: chain-idassert-bind bindmethod=sasl saslmech=EXTERNAL binddn="cn=whatever" starttls=critical tls_cert=/etc/ldap/ssl/replicator-cert.pem tls_key=/etc/ldap/ssl/replicator-key.pem tls_cacert=/etc/ssl/certs/mgoc-cacert.pem tls_reqcert=demand mode=self chain-idassert-authzFrom "*" but when I run $ ldappasswd -x -D 'uid=guest,ou=users,dc=server,dc=group' -wguest -stseug Result: Authentication method not supported (7) -- Greek Ordono myppa: launchpad.net/~grexk/+archive/ppa --- On Fri, 7/10/09, Gavin Henry <ghenry(a)suretecsystems.com> wrote: From: Gavin Henry <ghenry(a)suretecsystems.com> Subject: Re: saslmech=EXTERNAL To: "Greek Ordono" <grexk(a)yahoo.com> Cc: openldap-software(a)openldap.org Date: Friday, July 10, 2009, 4:02 AM -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > overlay chain > chain-uri "ldaps://server.group" > chain-rebind-as-user TRUE > chain-idassert-bind bindmethod=sasl > saslmech=EXTERNAL > binddn="cn=whatever" > tls_cert=/etc/ldap/ssl/replicator-cert.pem > tls_key=/etc/ldap/ssl/replicator-key.pem > tls_cacert=/etc/ssl/certs/mgoc-cacert.pem > tls_reqcert=demand > mode=self > chain-idassert-authzFrom "*" > chain-return-error TRUE Is slapd listening on ldaps? Why not starttls=yes/critical like below? > [2] > syncrepl rid=245 > provider=ldap://server.group > type=refreshAndPersist > searchbase="dc=server,dc=group" > filter="(objectClass=*)" > scope=sub > schemachecking=off > bindmethod=sasl > saslmech=EXTERNAL > starttls=yes > tls_cert=/etc/ldap/ssl/replicator-cert.pem > tls_key=/etc/ldap/ssl/replicator-key.pem > tls_reqcert=allow > retry="10 20 60 +" > logbase="cn=accesslog" > logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" > syncdata=accesslog > > -- > > Greek Ordono > > myppa: launchpad.net/~grexk/+archive/ppa > > > - -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkpWYfgACgkQoJwyzoTgQhTaIgCfU0vFRkoDrYCP8edFLJsERL26 hNcAoJN0JpnZHOmxQ3D6re/G1Ndr6A+s =caYf -----END PGP SIGNATURE-----

2 1

Shell backend and cn=config
by Konovalov Andrey 15 Jul '09

15 Jul '09

Is the Shell backend compatible with the cn=config method of configuration data storage? I've converted this section from slapd.conf to cn=config: # Shell backend -> database shell suffix "dc=Shell" add "/tmp/bind.sh" modify "/tmp/bind.sh" bind "/tmp/bind.sh" # <- And in cn=config i can see olcDatabase={N}shell, but not add/modify/bind directives. At the same time in logs of slaptest -f slapd.conf -F slapd.d: WARNING: No dynamic config support for database shell. config_build_entry: "olcDatabase={1}shell" ldif_back_add: "olcDatabase={1}shell,cn=config" oc_check_required entry (olcDatabase={1}shell,cn=config), objectClass "olcDatabaseConfig" oc_check_allowed type "objectClass" oc_check_allowed type "olcDatabase" oc_check_allowed type "olcSuffix" oc_check_allowed type "olcAddContentAcl" oc_check_allowed type "olcLastMod" oc_check_allowed type "olcMaxDerefDepth" oc_check_allowed type "olcReadOnly" oc_check_allowed type "olcMonitoring" oc_check_allowed type "structuralObjectClass" oc_check_allowed type "entryUUID" oc_check_allowed type "creatorsName" oc_check_allowed type "createTimestamp" oc_check_allowed type "entryCSN" oc_check_allowed type "modifiersName" oc_check_allowed type "modifyTimestamp" ldif_write_entry: wrote entry "olcDatabase={1}shell,cn=config" It looks like Shell backend is deprecated and uncompatible with cn=config. Or what could i do wrong?

2 3

Supported RFC's and "features"
by Clowser, Jeff (Contractor) 13 Jul '09

13 Jul '09

I'm currently doing a review to see how OpenLDAP compares, *feature wise* ATM, to other directory servers and specifically to the Sun DS - i.e. to get a definitive list of features it's missing that Sun has and what it has that Sun doesn't have, etc. For brevity, I haven't included all the potentially useful features of OpenLDAP, but have just focused on those associated with 1) RFC compliance (of which Sun may or may not meet) and 2) features to match the Sun DS (which it would be replacing). So far, here's what I have for OpenLDAP: RFC 4510 (which includes 4511-4519). There was recent discussion on the list around this, such that in some cases, not everything that changed from 3377 (which includes 2251-2256, 2829, and 2830) to 4510 has been updated in OpenLDAP, but I think those issues are fairly minor. The following additional RFC's are supported in OpenLDAP: - RFC 2247 and RFC 3088 - RFC 2696 simple paged results - RFC 2849 ldif - RFC 3062 password mod op - RFC 3296 named referals, manageDSAit - RFC 3673 All Op attrs + feature - RFC 3687 Component matching rules - RFC 3866 Languange tag and range - RFC 3876 matched values control - RFC 4370 proxy auth - RFC 4522 binary encoding - RFC 4523 x.509 cert schema - RFC 4524 COSINE schema - RFC 4525 Mod-increment - RFC 4526 Absolute true/false filters - RFC 4527 pre/post read control - RFC 4528 assertion control - RFC 4529 request attrs by objectclass - RFC 4530 entryUUID - RFC 4532 whoamI - RFC 4533 Content Sync op (replication) RFC's NOT supported are: - RFC 2589 dds Seems with 2.4, this has gone from experimental to production quality? - RFC 2891 server side sorting - RFC 3671 collective attributes - RFC 3928 LCUP mainly for updating cached addressbooks, etc - not replication between servers - RFC 3384 looks like just reqs for replication, not an actual replication protocol - RFC 4533 is used instead Unknown: - RFC 3672 (subentries) - RFC 3698 and 3727 (additional matching rules) - RFC 3909 LDAP Cancel operation - RFC 5020 entryDN operational attribute (There are some other, often obscure, LDAP related RFC's that I didn't include, but this seems to be the major/useful ones) Other features not supported: - VLV browse indexes (per http://tools.ietf.org/html/draft-ietf-ldapext-ldapv3-vlv-09). Not an RFC, but supported by Sun and MS directories, and used by things like Outlook and Solaris. Other supported features: - dyngroup/dynlist/memberof overlay (A much more useful feature than Sun's groupOfURLs "dynamic" group and "roles" mechanism) - ppolicy overlay (matches Sun DS 5.x reasonably close, but is account lockout replicated to all servers? Sun DS 6.x claims to) - refint overlay (similar to Sun's referential integrity plugin) - unique overlay (similar to Sun's uniqueness plugin) - audit and accesslog overlays, syslog logging - much more useful/complete than Sun's access/audit/error logs. - live acl changes via LDAP Unknown features: - Per user resource limits (sizelimit, timelimit, idletimeout, etc). I think Howard Chu said OpenLDAP has some of this, but I haven't seen any reference to it or how to use it in the docs (does this functionality exist, and if so, is there any documentation?) - Tracking of last login (i.e. last successful ldap authentication) Is this still fairly accurate? The ones that are really problematic are the lack of: - VLV Browse indexes - RFC 2891 (server side sorting) - per user/entry resources limits (if they don't exist) Are there any unofficial updates/patches/overlays/plans for any of this functionality? Thanks, - Jeff

11 29

Is OpenLDAP RFC 3687-compliant?
by Hanz Akkerman 13 Jul '09

13 Jul '09

Hi4All! Dear Kurt Zeilenga, dear developers of OpenLDAP! Tell me please, does the RFC 3687 (Component Matching) supported in the current release or no? I know that OpenLDAP supported it in versions 2.3.x, but i am in doubt, why OpenLDAP-SNACC compilation failed with OpenLDAP-2.4.16? I think that OpenLDAP-SNACC is freazed and unsuppiorted now. Am i right? With Best Regards, DRVTiny (Konovalov Andrey Alexandrovitsch, Russian Federation)

2 1

Re: TLS/SSL and self-signed certificates
by Dieter Kluenter 10 Jul '09

10 Jul '09

Rick Stevens <rps2(a)socal.rr.com> writes: > Dieter Kluenter wrote: >> Rick Stevens <rps2(a)socal.rr.com> writes: >> >>> Dieter Kluenter wrote: [...] >> This is only the content of slapd.conf, the relevant content of >> ldap.conf(5) is still missing, ldapsearch requires at least the path >> to CA, further information on the level of certificate checks and the >> prefered cipher suits are recommended options. > > Terribly sorry, misread your message. I had posted my ldap.conf before, > but here it is again: > > host 192.168.1.53 > base dc=eqspeed,dc=com > rootbinddn uid=sysman,ou=people,dc=eqspeed,dc=com > timelimit 15 > bind_timelimit 10 > bind_policy soft > pam_lookup_policy yes > pam_password clear_remove_old > nss_base_passwd ou=People,dc=eqspeed,dc=com?one > nss_base_shadow ou=People,dc=eqspeed,dc=com?one > nss_base_group ou=Group,dc=eqspeed,dc=com?one > nss_base_hosts ou=Hosts,dc=eqspeed,dc=com?one > ssl start_tls > ssl on > #tls_cacertdir /etc/openldap/cacerts > tls_cacertfile /etc/openldap/cacerts/allcerts.pem > tls_reqcert never That's what I thought, this is the wrong ldap.conf, read man ldap.conf(5). -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:8EF7B6C6 53°08'09,95"N 10°08'02,42"E

1 0

Re: TLS/SSL and self-signed certificates
by Dieter Kluenter 10 Jul '09

10 Jul '09

Rick Stevens <rps2(a)socal.rr.com> writes: > Dieter Kluenter wrote: >> Hi, [...] >> OK, could you please provide the TLS related entries of slapd.conf >> and ldap.conf? It seems that the server is not providing a server >> certificate but a CA. > > Okey doke. Here they are: > > TLSCACertificateFile /usr/local/etc/openldap/gbsbilling-cert.pem > TLSCertificateFile /usr/local/etc/openldap/bigdog-cert.pem > TLSCertificateKeyFile /usr/local/etc/openldap/bigdog-key.pem This is only the content of slapd.conf, the relevant content of ldap.conf(5) is still missing, ldapsearch requires at least the path to CA, further information on the level of certificate checks and the prefered cipher suits are recommended options. -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:8EF7B6C6 53°08'09,95"N 10°08'02,42"E

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software