openldap-software

openldap-software@openldap.org

2719 discussions

Re: Upgrading 2.3.x -2.4.x
by FRLinux 17 Sep '08

17 Sep '08

On Tue, Sep 16, 2008 at 11:11 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > There isn't 4.7 support until OpenLDAP 2.4.12 is released. Sleepycat > considers 4.7 stable. Thanks for clarifying, I'll be starting some migration on 2.4 in the next week hence my anxiety :) Cheers, Steph

1 0

Re: Upgrading 2.3.x -2.4.x
by FRLinux 17 Sep '08

17 Sep '08

On Tue, Sep 16, 2008 at 9:00 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > Personally I'd go with 4.6 with 2.3, and 4.7 with 2.4. ;) But going from > 2.3 to 2.4 you pretty much want to do a slapcat/slapadd anyway. Hey Quanah, Your smiley at the end of the sentence scares me a bit, does it mean 4.7 wouldn't be quite stabilized just yet? Cheers, Steph

2 1

openldap tls problem
by Michael Fischer 16 Sep '08

16 Sep '08

hi, i hope this is the right list for my problem, if not sorry in advance. i want to configure slapd to use tls. i have a certifikate signed by globalsign and the following lines in my slapd.conf: <snip> TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /etc/postfix/certs/ldap.pem TLSCertificateKeyFile /etc/postfix/certs/ldap.key TLSCACertificateFile /etc/postfix/certs/globalsign-domainssl.pem </snip> but when issuing a ldapsearch on another machine i still get an error: <snip> # ldapsearch -bdc=xxx,dc=at -Dcn=admin,dc=xxx,dc=at -hldap.xxx.at -p389 -x -W -ZZ -d5 objectClass=* ... TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 2, err: 19, subject: /C=US/O=GTE Corporation/OU=GTE CyberTrust Solutions, Inc./CN=GTE CyberTrust Global Root, issuer: /C=US/O=GTE Corporation/OU=GTE CyberTrust Solutions, Inc./CN=GTE CyberTrust Global Root TLS certificate verification: Error, self signed certificate in certificate chain TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed </snip> the same globalsign-certificates work well with my apache. any hints? lg, Michael Fischer -- email: michi.fischer(a)gmx.net web: http://www.webfischer.at

4 4

Re: Upgrading 2.3.x -2.4.x
by FRLinux 16 Sep '08

16 Sep '08

On Tue, Sep 16, 2008 at 8:40 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > (although I would make sure to use a BDB later than 4.2, since the next OL > 2.4 release will only support BDB 4.4 and up). So, if we are currently running 4.2 (FreeBSD systems) with 2.3, you'd advise on dumping data via slapcat and just wipe out db4.2 and replace with 4.4? Cheers, Steph

2 1

Upgrading 2.3.x -2.4.x
by Peter Clark 16 Sep '08

16 Sep '08

Hello, We have an OpenLDAP 2.3.43 implementation. Right now the database is rather small but I am looking at populating it fully (soon) and moving it into production to replace an ancient OpenLDAP install. 2.3.43 works, it does what I need it to but I am at a point that if I was going to upgrade now would be the time to make the jump. Is there any clear cut upgrade process? Any help would be appreciated. Peter

3 2

Bizarre error while initializing a DIT
by Maykel Moya 16 Sep '08

16 Sep '08

I'm trying to initialize a DIT. This is the error I get: root@tpro:/var/lib/ldap# slapadd -v -n 2 -l tproca1st.ldif PROXIED attributeDescription "DC" inserted. hdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapadd: dn="DC=tpro,DC=ca" (line=1): (64) naming attribute 'DC' is obsolete root@tpro:/var/lib/ldap# cat tproca1st.ldif dn: dc=tpro,dc=ca objectClass: top objectClass: dcObject objectClass: organization o: My test Orga dc: tpro root@tpro:/var/lib/ldap# slapcat -b cn=config ... dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcSuffix: DC=tpro,DC=ca olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap/tproca olcDbCacheSize: 1000 olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 4194304 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbLinearIndex: FALSE olcDbMode: 384 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcHdbConfig entryUUID: 140c5ffc-f953-102c-9659-bb5cef3694ca creatorsName: cn=config createTimestamp: 20080808050326Z olcDbIndex: objectClass eq olcDbIndex: mail eq olcAccess: {0}to dn.subtree="ou=users,dc=tpro,dc=ca" filter="(objectClass=sldM ailRecipient)" attrs=mail,sldMailbox,userPassword by dn="cn=dovecot,dc=tpro,dc=ca" read by * break olcAccess: {1}to attrs=entry,uid,objectClass by dn.base="cn=dn-search,dc=tpro,dc=ca" read by * break olcAccess: {2}to attrs=userPassword,shadowLastChange by dn.base="cn=admin,dc= tpro,dc=ca" write by anonymous auth by self write by * none olcAccess: {3}to dn.base="" by * read olcAccess: {4}to * by dn.base="cn=admin,dc=tpro,dc=ca" write by * read entryCSN: 20080818145521.939111Z#000000#000#000000 modifiersName: cn=admin,DC=tpro,DC=ca modifyTimestamp: 20080820145521Z I'm using Ubuntu package for slapd 2.4.11. Any hints? Regards, maykel

3 4

Unix socket auth(EXTERNAL) not working in netbsd
by David Markey 16 Sep '08

16 Sep '08

netbsd# /usr/pkg/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.11 (Sep 15 2008 00:03:54) $ root(a)netbsd.dmarkey.com: /usr/pkgsrc/databases/openldap-server/work/openldap-2.4.11/servers/slapd netbsd# ldapsearch -x -H ldapi:// -b '' -s base -LLL supportedSASLMechanisms dn: External isnt listed. I assume that the unix socket API is slightly different.: man unix The LOCAL_CREDS option may be enabled on a SOCK_DGRAM or a SOCK_STREAM socket. This option provides a mechanism for the receiver to receive the credentials of the process as a recvmsg(2) control message. The msg_con- trol field in the msghdr structure points to a buffer that contains a cmsghdr structure followed by a variable length sockcred structure, defined in <sys/socket.h> as follows: struct sockcred { uid_t sc_uid; /* real user id */ uid_t sc_euid; /* effective user id */ gid_t sc_gid; /* real group id */ gid_t sc_egid; /* effective group id */ int sc_ngroups; /* number of supplemental groups */ gid_t sc_groups[1]; /* variable length */ }; The LOCAL_PEEREID option may be used with getsockopt(2) to get the PID and effective user and group IDs of a SOCK_STREAM peer when it did connect(2) or bind(2). The returned structure is struct unpcbid { pid_t unp_pid; /* process id */ uid_t unp_euid; /* effective user id */ gid_t unp_egid; /* effective group id */ }; as defined in <sys/un.h>. The SOCKCREDSIZE() macro computes the size of the sockcred structure for a specified number of groups. The cmsghdr fields have the following val- ues: cmsg_len = sizeof(struct cmsghdr) + SOCKCREDSIZE(ngroups) cmsg_level = SOL_SOCKET cmsg_type = SCM_CREDS Any ideas? Howard i assume you would be an authority to answer this one. Thanks.

5 14

About the compatible version of openldap software for RHEL3
by sangeetha.ganesan＠wipro.com 16 Sep '08

16 Sep '08

Hi All, We are planning to implement Openldap in one of the RHEL 3 server. Could you please suggest me any version which works fine with RHEL 3. If there is no strict rule that only particular version of openldap has to be installed on RHEL3 or RHEL 4, Please let me know if anyone has idea on implementing a new openldap server in an existing environment of servers of all flavours. waiting for your inputs!! thanks!! regards, sangeetha. Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

slapd shuts itself down.
by Curt Blank 15 Sep '08

15 Sep '08

OpenLDAP 2.2.28 Found this: Sep 10 10:25:34 ldap03 slapd[2498]: conn=10878784 fd=57 ACCEPT from IP=nn.nn.nn.nn:63038 (IP=0.0.0.0:389) Sep 10 10:25:34 ldap03 slapd[2498]: connection_init(57, IP=nn.nn.nn.nn:63042): set nonblocking failed Sep 10 10:25:34 ldap03 slapd[2498]: conn=10878788 fd=57 ACCEPT from IP=nn.nn.nn.nn:63042 (IP=0.0.0.0:389) Sep 10 10:25:34 ldap03 slapd[2498]: slapd shutdown: waiting for 1 threads to terminate Sep 10 10:26:08 ldap03 slapd[2498]: slapd stopped. Is it shutting itself down because of the "set nonblocking failed"? Anything I can do about that to stop it? -- Curt Blank Systems Administrator Technical Services Specialist University Information Technology Services University of Wisconsin-Milwaukee e-mail: curt(a)uwm.edu phone : (414) 229-3814

2 1

Two samba related openldap overlays
by Joel Reed 15 Sep '08

15 Sep '08

Two openldap overlays that may be of interest to others. In the first, I've hacked up Howard Chu's smbk5pwd openldap overlay to include the automatic addition of sambaNTPassword, sambaLMPassword, and sambaPwdLastSet attributes to any sambaSamAccount entries that are being ADDED to the directory. WARNING: This overlay is ONLY useful with cleartext passwords. In the second, I've modified my automatic uidnumber generator overlay to also add sambaSID's to sambaSamAccount entries that are being added to the directory. The algorithm used to generate the SID is the same as employed by smbldap-tools (2*uidNumber+1000). Currently, the samba domain SID is hardcoded to "S-1-0-0-". If you want to use this overlay, change this variable accordingly or teach the overlay how to read from config. jr

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software