openldap-software

openldap-software@openldap.org

2719 discussions

slapcat and BDB transaction-logs
by tamarin p 18 Aug '08

18 Aug '08

Hello, I'm trying to migrate a directory from OpenLDAP 2.3.x to an OpenLDAP 2.4.11 test installation. My LDAP-experience is less than extensive, but I've run slapcat on the old base, and am now trying to import it back into 2.4.11 with slapadd. The base is large enough that the import will take several days at the current rate (3gb LDIF/approx 4 million entries), and so I can't monitor the process at all times. My problem is with the backend transaction logs, though. These are chucked out at a rate of approximately one per minute until the disk runs out of space. I did a quick google on the issue and found that you should be able to remove logs not currently involved in any transactions by running db_archive -d ( http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/…). I've also tried adding a set_flags DB_LOG_AUTOREMOVE in my DB_CONFIG with no luck. Then I figured I could set up a cronjob to run db_archive hourly, but when I run db_archive -d (or more to the point, slapd_db_archive2.4 -d, as I've installed using Buchan Milne's RPMs), not a single log-file is removed. Moreover, none of the *.bdb files are increasing in size while slapadd is running, only additional log-files and __db.001 etc.Does slapadd basically do all adds in one huge transaction before committing at the end, or am I doing something wrong? Can I simply erase log-files with rm on the fly instead? The checkpointing in slapd.conf is set to 256k/5min as per default. Anything else I'm missing?

4 4

openldap failing to launch if SSL/TLS enabled. error "main: TLS init def ctx failed: -1" ?
by Ben Wailea, openldap-software 17 Aug '08

17 Aug '08

i've installed openldap. starts fine without SSL/TLS. if SSL/TLS is enabled, slapd fails to launch @ error: "main: TLS init def ctx failed: -1". googling the issue, suggestions are cert problems. mine, i believe are OK. any ideas as to what the problem is? here's what i've done/checks so far: i've installed openldap from rpm's, rpm -qa | grep openldap openldap2-back-perl-2.4.11-5.1 openldap2-client-2.4.11-6.1 openldap2-2.4.11-5.1 openldap2-back-meta-2.4.11-5.1 without TLS/SSL, the service starts, service ldap start Starting ldap-server done ps ax | grep slapd 6062 ? S<sl 0:00 /usr/lib/openldap/slapd -h ldap:// -f /etc/openldap/slapd.conf -u ldap -g ldap -4 -o slp=on if i add TLS/SSL config to /etc/openldap/slapd.conf, ... TLSCertificateFile /etc/apache2/ssl.crt/svr.crt TLSCertificateKeyFile /etc/apache2/ssl.key/svr.key TLSCACertificateFile /etc/apache2/ssl.crt/ca.crt TLSCipherSuite TLSv1+HIGH:!aNULL:@STRENGTH TLSVerifyClient never ... service fails to start, service ldap start Starting ldap-server failed and log reports, Aug 15 10:02:01 auth slapd[6139]: main: TLS init def ctx failed: -1 Aug 15 10:02:01 auth slapd[6139]: slapd destroy: freeing system resources. Aug 15 10:02:01 auth slapd[6139]: slapd stopped. Aug 15 10:02:01 auth slapd[6139]: connections_destroy: nothing to destroy. Aug 15 10:02:01 auth slapd[6139]: daemon: SLPDereg(ldap://) failed with -20, cookie = 0 the certs/keys i'm, using are used in my apache server, SSLCertificateFile /etc/apache2/ssl.crt/svr.crt SSLCertificateKeyFile /etc/apache2/ssl.key/svr.key SSLCACertificateFile /etc/apache2/ssl.crt/ca.crt SSLCipherSuite TLSv1+HIGH:!aNULL:@STRENGTH SSLVerifyClient none SSLVerifyDepth 1 and SSL works there without problem. the keys & certs check out ok, ------ openssl rsa -noout -text -in "/etc/apache2/ssl.key/svr.key" Private-Key: (2048 bit) modulus: 00:d2:3e:45:1c:09:10:d2:a1:c6:61:c2:fa:ad:35: ... 23:97 publicExponent: 65537 (0x10001) privateExponent: 00:b0:82:00:e9:69:9f:0b:07:30:93:30:eb:dd:f1: ... 48:01 prime1: 00:ea:8e:ea:13:2c:71:be:3c:68:8b:5e:7a:c8:1e: ... cf:ea:b4:92:2a:e5:14:1c:01 prime2: 00:e5:76:57:25:91:72:eb:ac:19:74:9a:2d:85:65: ... a9:81:b0:7f:b4:f3:f1:9f:97 exponent1: 06:2b:94:44:c4:da:89:22:95:ad:74:e2:cd:f8:dd: ... 62:95:35:73:23:6b:90:01 exponent2: 1a:a4:1f:c0:1b:e0:04:de:c9:61:d1:58:c1:a9:2c: ... 44:e6:72:1d:57:49:51:67 coefficient: 12:11:93:09:34:3e:ae:41:2d:dc:78:f3:11:e0:da: ... 73:80:99:ec:78:b3:4c:90 openssl x509 -noout -text -in "/etc/apache2/ssl.crt/ca.crt" Certificate: Data: Version: 3 (0x2) Serial Number: 12...21 (0x...5d) Signature Algorithm: sha512WithRSAEncryption Issuer: C=US, ST=ST, L=CITY, O=TEST, OU=TEST, CN=TEST_CA Validity Not Before: Aug 15 02:43:41 2008 GMT Not After : Aug 15 02:43:41 2009 GMT Subject: C=US, ST=ST, L=CITY, O=TEST, OU=TEST, CN=TEST_CA Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (4096 bit) Modulus (4096 bit): 00:f3:ee:cf:21:bc:49:59:1a:e0:62:5b:df:87:9e: ... 9b:fb:1d Exponent: 65537 (0x10001) X509v3 extensions: Netscape Comment: SS ROOT CA CERT X509v3 Basic Constraints: critical CA:TRUE, pathlen:0 Netscape Cert Type: SSL CA, S/MIME CA X509v3 Key Usage: critical Certificate Sign, CRL Sign X509v3 Subject Key Identifier: 3B:...:32 X509v3 Authority Key Identifier: keyid:3B:...:32 DirName:/C=US/ST=ST/L=CITY/O=TEST/OU=TEST/CN=TEST_CA serial:48:...:5D Signature Algorithm: sha512WithRSAEncryption da:02:bb:96:3a:72:83:73:15:8c:c9:1d:1d:41:47:2c:9e:7b: ... 70:d0:ac:96:09:7d:28:e2 openssl x509 -noout -text -in "/etc/apache2/ssl.crt/svr.crt" Certificate: Data: Version: 3 (0x2) Serial Number: 2 (0x2) Signature Algorithm: sha512WithRSAEncryption Issuer: C=US, ST=ST, L=CITY, O=TEST, OU=TEST, CN=TEST_CA Validity Not Before: Aug 15 02:49:19 2008 GMT Not After : Aug 15 02:49:19 2009 GMT Subject: C=US, ST=ST, L=CITY, O=TEST, OU=TEST, CN=*.testdomain.net/emailAddress=postmaster@testdomain.net Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:d2:3e:45:1c:09:10:d2:a1:c6:61:c2:fa:ad:35: ... 23:97 Exponent: 65537 (0x10001) X509v3 extensions: Netscape Comment: OpenSSL Generated Certificate X509v3 Basic Constraints: CA:FALSE Netscape Cert Type: SSL Client, S/MIME, Object Signing X509v3 Key Usage: critical Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement X509v3 Extended Key Usage: critical Code Signing, Time Stamping, TLS Web Server Authentication, TLS Web Client Authentication X509v3 Subject Key Identifier: 00:...:1B X509v3 Authority Key Identifier: keyid:3B:...:32 Signature Algorithm: sha512WithRSAEncryption 5b:56:cb:38:40:62:ae:13:9a:e7:c3:d8:a9:2f:e6:04:fc:32: ... ff:29:74:52:73:28:fa:ca ------

5 10

ldap client crypto question
by Gregory K. Ruiz-Ade 16 Aug '08

16 Aug '08

I'm using a custom perl script, using perl-ldap (Net::LDAP). I'm trying to connect to my server via ldaps://. On RHEL4 (and CentOS4) this works without problem. On RHEL5, I keep getting "stronger confidentiality required" error messages. Connecting from an RHEL4 client gives me: Aug 15 16:51:52 csenet slapd2.3[4105]: conn=1318 fd=15 TLS established tls_ssf=256 ssf=256 Aug 15 16:51:54 csenet slapd2.3[4105]: conn=1318 op=0 BIND dn="<binddn>" method=128 Aug 15 16:51:54 csenet slapd2.3[4105]: conn=1318 op=0 BIND dn="<binddn>" mech=SIMPLE ssf=0 Aug 15 16:51:54 csenet slapd2.3[4105]: conn=1318 op=0 RESULT tag=97 err=0 text= Connecting from an RHEL5 client gives me: Aug 15 16:57:14 csenet slapd2.3[4105]: conn=1326 fd=15 TLS established tls_ssf=56 ssf=56 Aug 15 16:57:14 csenet slapd2.3[4105]: conn=1326 op=0 BIND dn="<binddn>" method=128 Aug 15 16:57:14 csenet slapd2.3[4105]: conn=1326 op=0 RESULT tag=97 err=13 text=stronger confidentiality required I've got the same client configs on both systems, and TLS_REQCERT = allow. The truly confusing part is when I do an ldapsearch (instead of trying the perl script) it works correctly: Aug 15 17:00:08 csenet slapd2.3[4105]: conn=1331 fd=15 TLS established tls_ssf=256 ssf=256 Aug 15 17:00:08 csenet slapd2.3[4105]: conn=1331 op=0 BIND dn="<binddn>" method=128 Aug 15 17:00:08 csenet slapd2.3[4105]: conn=1331 op=0 BIND dn="<binddn>" mech=SIMPLE ssf=0 Aug 15 17:00:08 csenet slapd2.3[4105]: conn=1331 op=0 RESULT tag=97 err=0 text= Anyone have any ideas why perl-ldap/Net::LDAP would be using such weaker encryption? Thanks, Gregory -- Gregory K. Ruiz-Ade Sr. Systems Administrator Computer Science and Engineering University of California, San Diego Office: EBU3b 1216 Phone: (858) 822-2625 E-mail: gkra(a)cs.ucsd.edu

2 1

LDAP Replication +TLS +Self-signed certificate.
by k bah 15 Aug '08

15 Aug '08

Hi, I have LDAP replication setup (slurpd), works fine. Until a while ago I had a CA certificate, and with that one I signed other two certificates, for two different hosts. So I had 3 "hosts", one is the CA, another one is LDAP Master and the last the ldap slave. Configuration on both master and slave slapd.conf had: TLSCertificateFile /etc/openldap/"this"-machine-certificate.crt TLSCertificateKeyFile /etc/openldap/"this"-machine-key.key TLSCACertificateFile /etc/openldap/"the-ca"-machine-cert.crt Now I changed the certificates, both the Master and Slave machines use self signed certificates, I changed the certificates/tls config on several services that used it, they work fine, but LDAP replication stopped working. 1) To be clear (in order to have LDAP replication working with self signed certs + TLS on): Master machine slapd.conf: TLSCertificateFile /etc/openldap/master-machine-certificate.crt TLSCertificateKeyFile /etc/openldap/master-machine-key.key TLSCACertificateFile /etc/openldap/master-machine-certificate.crt Master machine ldap.conf: TLS_REQCERT allow TLS_CACERT /etc/openldap/master-machine-certificate.crt (DOES IT MATTER IF THIS MACHINE ONLY ACTS AS SERVER?) Slave machine slapd.conf: TLSCertificateFile /etc/openldap/slave-machine-certificate.crt TLSCertificateKeyFile /etc/openldap/slave-machine-key.key TLSCACertificateFile /etc/openldap/slave-machine-certificate.crt (as this option on slapd.conf is for the -server- part of the slave, right?) Slave machine ldap.conf: TLS_REQCERT allow TLS_CACERT ????? 2) Second question, on other machines that run LDAP clients, I should put what in ldap.conf (/etc/openldap/ldap.conf) for the TLS_CACERT option? Leave it blank, use the ldap master machine certificate or, if that machine queries the slave ldap machine, the slave ldap machine certificate for the ldap.conf TLS_CACERT option? thanks a lot! = Search for products and services at: http://search.mail.com -- Powered by Outblaze

2 1

Building OpenLDAP for Windows
by Craig Worgan 15 Aug '08

15 Aug '08

Is there any 'official' documentation describing how to build OpenLDAP for Windows? I can't find anything on the OpenLDAP site or on the mailing lists. Craig Worgan

3 3

translucent overlay and binding
by Mateusz Kijowski 14 Aug '08

14 Aug '08

Hi, I am trying to create an OpenLDAP instance for our programming team's test environment. They want to have all data coherent with our production systems except for some of the passwords, so I figured I need to use the translucent overlay and override some userPassword attributes. I managed to do so, and I can tell that the local value of password attribute is being compared, not the one from the remote (production) server. The probem is when users want to bind to the test server - their requests are being proxied to the production server. I would like them to bind using the overriden (local) credentials. Is it possible? I am using OpenLDAP 2.3.43 Thanks in advance. -- Mateusz

3 3

Syncrepl replication with a non-slapd master?
by Grant Gossett 14 Aug '08

14 Aug '08

Is it possible to use syncrepl replication with a non slapd master? Being more specific, I would like to have a copy of several different microsoft domains held on a slapd server. I've seen this question posed in the archives but I haven't been able to find much in the way of an answer anywhere. Assuming that slapd + syncrepl will work with non-slapd masters, is the next obstacle going to be making a schema that matches the active directory shema so that replication can actually occur? Are there any examples that anyone can point me to? Many thanks Grant

3 2

overlay chain
by Ed Greenberg 14 Aug '08

14 Aug '08

Hi, folks, I have a slave running syncrepl (just fine) which is getting hit with update requests, which are, of course, failing. I'd like to have them succeed. I could not find anything in the docs that would allow the slave to issue a referral. That seems to be limited to slurpd, if I understand correctly. So I tried to implement chained updates. I put the following into my slaves slapd.conf: overlay chain chain-rebind-as-user FALSE chain-uri "ldap://master.mydomain.com" chain-rebind-as-user TRUE chain-idassert-bind bindmethod="simple" binddn="cn=Manager,dc=mydomain,dc=com" credentials="secret" mode="self" This does not seem to be sufficient, but I can't figure out from the slapo manpage what else is required. I get error 0x35, that the slave refuses to perform the operation. (I tried whipping and otherwise punishing the slave, but it did not improve it's attitude. :) There does not seem to be a good howto for this. Can somebody send me a pointer or an answer? Thanks, </edg> Ed Greenberg West Hollywood, CA

3 7

slapd crash with access_log overlay
by Alexander Kriventsov 14 Aug '08

14 Aug '08

Hello. I have crash slapd when I create new node in MirrorMode. After start slapd, it transfer database from master and after transfer all entires it crash by signal 6. In slapd.conf I have # log database database hdb suffix "cn=db-log" rootdn "cn=ldapadm,cn=db-log" rootpw {SSHA}PASS directory /var/db/openldap-data/db-log checkpoint 32 8 # main database database hdb suffix "o=company" rootdn "cn=ldapadm,o=company" rootpw {SSHA}PASS directory /var/db/openldap-data/company checkpoint 32 8 overlay unique unique_uri ldap:///ou=users,o=company?uidNumber?sub overlay smbk5pwd smbk5pwd-enable samba overlay accesslog logdb cn=db-log logops writes logold (objectClass=*) logsuccess false logpurge 182+00:00 1+00:00 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldaps://ldap1 bindmethod=simple binddn="uid=replication,ou=users,o=company" credentials=secret searchbase="o=company" schemachecking=on type=refreshAndPersist retry="60 +" syncrepl rid=002 provider=ldaps://ldap2 bindmethod=simple binddn="uid=replication,ou=users,o=company" credentials=secret searchbase="o=company" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on In logs I didn't find any information of crash. Only in messages ldap2 kernel: pid 5242 (slapd), uid 389: exited on signal 6 I didn't find any use full information in slapd.core #0 0x000000080163bfec in thr_kill () from /lib/libc.so.7 [New Thread 0x802605850 (LWP 100246)] [New Thread 0x8026056e0 (LWP 100244)] [New Thread 0x802605570 (LWP 100233)] [New Thread 0x802605400 (LWP 100225)] [New Thread 0x802605290 (LWP 100216)] [New Thread 0x802605120 (LWP 100096)] [New Thread 0x801901850 (LWP 100081)] [New Thread 0x801901120 (LWP 100240)] System: FreeBSD 7.0-amd64-20080719-RELENG_7_0 Openldap: 2.4.11 In log I have oc_check_allowed type "contextCSN" => entry_encode(0x00000001): hdb_modify: updated id=00000001 dn="o=company" send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=0 matched="" text="" slap_queue_csn: queing 0x8043ed160 20080812170512.000000Z#000000#000#000000 ==> hdb_add: reqStart=20080814112242.000033Z,cn=db-log Assertion failed: (a->a_vals[0].bv_val != NULL), function entry_schema_check, file schema_check.c, line 88. Abort trap: 6 (core dumped) Please advise. -- Best Regards, Alexander Kriventsov .masterhost

1 0

pwdCheckQuality doesn't work
by Zhang Weiwu 14 Aug '08

14 Aug '08

My checklist: 1. RTFM slapo-ppolicy: done, 3 times; 2. check openldap version: 2.4, newly installed on Gentoo Linux; 3. check ppolicy overlay successfully loaded and being used: must be, because operational attribute like pwdFailureTime was maintained; 4. pwdAttribute setting: correct, value is "userPassword"; 5. pwdCheckQuality: correct, value is 2 (server always check password syntax); 6. pwdMinLength: correct, value is 6, server do not accept password short than 6 character; 7. ppolicy_default: correctly set, because change pwdMaxFailure on default entry does have effect; 8. the entry being operated doesn't have pwdPolicySubentry, so default should be applied: correct; 9. slapd server was restarted after all above check; Test result: Still doesn't work: $ldappasswd -vD uid=admin,st=jiangxi,o=LGOP -x -w secret -s 13456 ou=吉安市,st=jiangxi,o=LGOP ldap_initialize( <DEFAULT> ) Result: Success (0) (expected not successful here because new password was too short) I am stuck here. Do I miss something on my checklist?

4 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software