openldap-technical November 2008

openldap-technical@openldap.org

53 participants
60 discussions

RE: Debugging a user authentication
by Adrian Marsh 20 Nov '08

20 Nov '08

All, I'm not sure if my questions here are getting through to the group (I don't see a copy to myself) I've diagnosed this issue. The user has a "£" (UK Pound) in his password. Remove it and everything authenticates OK. Are there settings in Apache/LDAP for controlling what characters can be used as passwords? Adrian ________________________________ From: Adrian Marsh Sent: 14 November 2008 11:49 To: 'openldap-technical(a)openldap.org' Subject: Debugging a user authentication Hi All, Using Apache 2.2, how do I debug the LDAP lookups being made to a 2003 Domain Controller. Ive one user whos failing to authenticate, but all my other users do and Im trying to see who. He authenticates ok, same password via other mechanisms to the DC, but just not via the Apache LDAP lookup. I'm an LDAP novice so am looking for names of debug tools/methods etc. Thanks, Adrian

5 11

Delta-sync symptom in 2.4.11
by William Jojo 20 Nov '08

20 Nov '08

Running 2.4.11 on AIX 5.3, I have setup a delta-syncrepl test with bdb (not hdb). Now the software passes test043, but when I setup the first copy from the master, the following happened: The master is populated with 62485 dn's. When the replica was started it sync'ed 29786 dn's. I had to stop the replica and restart it to make the sync move along (several times...). second sync pulls 15858 dn's third sync pulls 4428 dn's forth sync pulls nothing, but the replica has only 50072 dn's and does not sync further. Is does not appear to be an ACL issue since the replicator account has read access to * on the master. Otherwise this is just like test043, except or the missing dn's. :-) Any ideas? Cheers, Bill

2 1

import LDIF file from openldap to redhat directory server
by revathi ganesh 20 Nov '08

20 Nov '08

Dear gurus I have installed redhat directory server in a new server. The OS is RHEL V5. We already are running openldap in RHEL V4. Now how can I import the all the datas (user accounts) from openldap to RHDS. Please give me the procedure. Thanks Cholam20 From Chandigarh to Chennai - find friends all over India. Go to http://in.promos.yahoo.com/groups/citygroups/

2 1

RE: cont contact server since 3 days+please help
by Burton, Kris - Acision 20 Nov '08

20 Nov '08

>From the results below it looks like your server is not even coming up. This would explain why you are not able to search or add entries. Next thing to look at is to see if you are getting any useful information in the slapd.log. This should be in /var/log/slapd.log. If you don't know where it is located then try using the locate command I think ubuntu should have that or something equivalent. If you don't find one then you might need to enable the log in /etc/syslog.conf. I use RH so I assume something similar is available on ubuntu. I added the list back to the CC so others that might know more about ubuntu specifics can help and so they can assist you as well. --Kris ________________________________ From: Donny George [mailto:donny008@gmail.com] Sent: Wednesday, November 19, 2008 3:13 PM To: Burton, Kris - Acision Subject: Re: cont contact server since 3 days+please help hello kris this are the results that i get when i try to listen , guess this is not wat u were expecting root@ubuntu:/home/administrator# ps -eaf | grep slapd root 14183 14172 0 22:07 pts/0 00:00:00 grep slapd root@ubuntu:/home/administrator# netstat -na | grep 389 root@ubuntu:/home/administrator# telnet 10.4.139.5<http://10.4.139.5> 389 Trying 10.4.139.5... telnet: Unable to connect to remote host: Connection refused i tried the earlier steps like ldapsearch -d 255 after reading different forums of ldap but please dont misunderstand me to be an expert in openldap could you tell me how to establish the connectivity or where did i go wrong thanking you don On Wed, Nov 19, 2008 at 10:16 AM, Burton, Kris - Acision <kris.burton(a)acision.com<mailto:kris.burton@acision.com>> wrote: Have you on the server side verified that LDAP is up and listening on the proper port? ps -eaf | grep slapd netstat -na | grep 389 tcp 0 0 0.0.0.0:389<http://0.0.0.0:389> 0.0.0.0:* LISTEN If the above come back and indicate it is up and listening see if you can telnet to the <ip> 389 and get something back. Also you could check to see if you are getting errors on server startup by checking the slapd.log on the server side and see if it is reporting any errors. If you are using the command line search are you specifying the remote server using the -h option? Most of the errors seem to indicate there is nothing listening on the server to handle the search request. --Kris Burton ________________________________ From: openldap-technical-bounces+kris.burton=acision.com<http://acision.com>@OpenLDAP.org [mailto:openldap-technical-bounces+kris.burton<mailto:openldap-technical-bounces%2Bkris.burton>=acision.com<http://acision.com>@OpenLDAP.org] On Behalf Of Donny George Sent: Wednesday, November 19, 2008 8:47 AM To: openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org> Subject: cont contact server since 3 days+please help hello all i am a beginner with openldap and installed a server and a client with ldap(both machines ubuntu 8.04) but once i tried to populate the database at the server it gave the error that it couldnt contact the server. i cudnt connect to the server frmo the client either. i ran the command ldapsearch -d 255 to debug and heres the result ldap_create ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_build_search_req ATTRS: supportedSASLMechanisms ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 10.4.139.5:389<http://10.4.139.5:389> ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.4.139.5:389<http://10.4.139.5:389> ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_close_socket: 3 ldap_err2string ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) and if i run ldapsearch -x it gives the message ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) please someone help, i dont know where i cud start to solve this error. -- Donny George This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you. -- Donny George This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

3 3

Data sync tools
by Bad Guy 20 Nov '08

20 Nov '08

Dear all, We are running a multi-master openldap 2.4.11, we always get delay sync in some servers. Is there any way to do a periodic re-sync without restarting the openldap slapd daemon ? Thanks _________________________________________________________________ 5 GB 超大容量、創新便捷、安全防護垃圾郵件和病毒 — 立即升級 Windows Live Hotmail http://mail.live.com

1 0

Error on boot
by Ronni Feldt 19 Nov '08

19 Nov '08

Hi, I've installed and configured LDAP and Kerberos which works fine. The only problem is that when I start my computer, I get the following error: udevd[2282]: nss_ldap: failed to bind to LDAP Server ldap://ldap.one.com: Can't contact LDAP Server udevd[2282]: reconnecting to LDAP Server... udevd[2282]: could not connect to any LDAP Server as (null) - Can't contact LDAP Server udevd[2282]: could not search LDAP Server - Server is unavailable I then have restart and boot into another dist I have installed and edit the following files: nsswitch.conf pam.d/common-auth common-account common-password common-session And remove kerberos & ldap Restart and then I can login, but without Kerberos and LDAP. How do I solve this? Best Regards Ronni

3 2

Advise on tuning
by Maykel Moya 19 Nov '08

19 Nov '08

I have a box (Proliant DL560) with this features: - 4GB RAM - 3 x Xeon 2.8 GHz - 2 x HD SCSI 10k RPM (No RAID) I have the BDB in one of those HD and the logs in the other one. When I installed the server I wasn't enough sure about a correct value for cachesize so I decided to play safe. sldcu DB_CONFIG --------------- set_cachesize 0 1073741824 0 set_lk_max_objects 2500 set_lk_max_locks 2500 set_lk_max_lockers 2500 set_lg_dir /storage/bdb-log/sldcu set_flags DB_LOG_AUTOREMOVE accesslog DB_CONFIG ------------------- set_cachesize 0 715827883 0 set_lk_max_objects 2500 set_lk_max_locks 2500 set_lk_max_lockers 2500 set_lg_dir /storage/bdb-log/accesslog set_flags DB_LOG_AUTOREMOVE I was reading this[1] yesterday and found out that a I have a very large value. For my dc=sld,dc=cu DB I have a 6.2 MB dn2id.bdb and a 56 MB id2entry.bdb, the DIT contains about 60k entries. Normally I larger value is a Good Thing(TM) but I'm specially worried about slapd using around 40%-50% time of (one) CPU and eventually a message of 'deferring operation' gets logged. The server is attending 30 connections per second sustained during working hours. Read Waiters are about 100 sustained during this same period. Yesterday I sent a message to the list asking for opinions about that value for Read Waiters because it doesn't sound good to me, but well, I know that 'sounds good' is very subjective. I was running 2.3.38 yesterday morning and upgraded to 2.4.11. With the same setup (only the slapd changed) the mail service got deeply affected. Dovecot began to take several (+10) seconds to authenticate, in other cases, the POP3/IMAP connection was dropped due to timeout. While Dovecot was failing my slapd.log were solid filled by 'deferring operation' messages. I stopped Dovecot, the messages dissapears, I started Dovecot, the message began again to fill logs. So, I thank it could be some problem on Dovecot side (although it was playing nice with slapd 2.3.38). Thanks God I hit man slapd-hdb and learn about cache tuning values there. I then raised olcDbCacheSize / olcDbDNCacheSize / olcDbIDLCacheSize and things began to calm down. I wonder how slapd 2.3.38 were nicely serving Dovecot without the tuning I made. On the other hand I have the suspiction, based on benchmark data published on the list, that there is something wrong with that large cache plus 50% CPU for less than 30 connections per second. I very much appreciate any help/advise/hint someone could give me about this issue. Regards, maykel [1] http://www.openldap.org/faq/data/cache/1075.html

1 0

Re: Openldap and TLS issue
by Ivan Ordonez 19 Nov '08

19 Nov '08

Will do. I'm glad that there are community as such. This is a great place to learn and get help. -Ivan Gavin Henry wrote: > ----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > > >> Thanks very much Gavin for all your help. All is working as it should. >> > > No problem. Just make sure you pass on what you've learned :-) > >

1 0

Re: Openldap and TLS issue
by Ivan Ordonez 19 Nov '08

19 Nov '08

Thanks very much Gavin for all your help. All is working as it should. -Ivan Gavin Henry wrote: > ----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > > >> Few more questions Gavin. >> >> Our primary domain controller certificate is also expiring next month. >> What is the best way to handle this? Does the certificate and keys on >> the backup domain controller has any connection to the certs and keys >> of the primary domain controller and the other backup domain >> controller? >> > > Other than being signed by the Certificate Authority, none. As long as > you use the same FQDN for the certs as before and the CA doesn't change, > then all is good. > > >> I would be relieve to hear that I can make brand new certificate and >> keys for each machine and they have no connection with each other. >> >> Thanks for all your help. >> >> -Ivan >> >> >> ghenry(a)OpenLDAP.org wrote: >> >> ----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: >> >> Looking at the debug log, it is expired. It puzzle me because the >> certs on the other two machine are working correctly. Check their >> expiry dates with: >> >> openssl x509 -in /usr/local/etc/openldap/ldap-slave_cert.pem -text >> >> Since this is the case (certificate expires), is it safe to create a >> new one for this machine? Of course, then sign it with the cacert, >> something like: >> >> ./CA.sh -newreq >> ./CA.sh -sign >> > >

1 0

cont contact server since 3 days+please help
by Donny George 19 Nov '08

19 Nov '08

hello all i am a beginner with openldap and installed a server and a client with ldap(both machines ubuntu 8.04) but once i tried to populate the database at the server it gave the error that it couldnt contact the server. i cudnt connect to the server frmo the client either. i ran the command ldapsearch -d 255 to debug and heres the result ldap_create ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_build_search_req ATTRS: supportedSASLMechanisms ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 10.4.139.5:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.4.139.5:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_close_socket: 3 ldap_err2string ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) and if i run ldapsearch -x it gives the message ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) please someone help, i dont know where i cud start to solve this error. -- Donny George

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2008