openldap-technical September 2009

openldap-technical@openldap.org

70 participants
72 discussions

Forced password change not allowed
by mlb＠imparisystems.com 20 Sep '09

20 Sep '09

I've got openLDAP running and installed the pam and nss libraries so it would also control the Linux passwords. I'm trying to sign onto my server using ssh - but once I enter my username and password, I get WARNING: Your password has expired. You must change your password now and login again! Enter login(LDAP) password: Now being a bad security person, I always use the exact same username / password combination and they don't work. If a use either nothing (just hit Enter) or if I put in the standard password I get passwd: Authentication information cannot be recovered passwd: password unchanged Connection to ubuntu closed. If I enter in some nonsensical string I get LDAP Password incorrect: try again Enter login(LDAP) password: However, that is the only root level user on the machine and I have TONS of stuff on it. How do I fix? Is this an openLDAP issue or something else? Thanks

3 2

userCertificate question
by Michael Luich 18 Sep '09

18 Sep '09

Does userCertificate, userSMIMECertificate, and userPKCS12 store the users public or private key? -- Michael Luich Stone's Rose mluich(a)stonesrose.com P: (207) 956-0003 THE MESSAGES AND DOCUMENTS TRANSMITTED WITH THIS NOTICE CONTAIN CONFIDENTIAL INFORMATION BELONGING TO THE SENDER. IF YOU ARE NOT THE INTENDED RECIPIENT OF THIS INFORMATION YOU ARE HEREBY NOTIFIED THAT ANY DISCLOSURE, COPYING, DISTRIBUTION, OR USE OF THE INFORMATION IS STRICTLY PROHIBITED. IF YOU HAVE RECIEVED THIS TRANSMISSION IN ERROR PLEASE NOTIFY THE SENDER IMMEDIATELY.

2 1

Re: ldapsearch hangs
by Tihomir Culjaga 18 Sep '09

18 Sep '09

the search: ldapsearch -h localhost -x -b ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr -D cn=admin,dc=ot,dc=hr -w passwd objectClass=originatorPrefixID slapd.conf: # Indices to maintain index objectClass eq index uniqueID eq index bestMatchPrefix eq index originatorPrefixID eq according to schema i have ou=ou=sipDirektor | --------- ou=bestMatchPrefixList | ----------- bestMatchPrefix=<PREFIX> | ------------------carrierPrefixID=<CARRIER_ID> | ----------------originatorPrefixID=<ORIGIN_CARRIER_PREFIX> here is an example of returned data: # 041020, 078120.100.10000.90, 1251, bestMatchPrefixList, sipDirektor, ot.hr dn: originatorPrefixID=041020,carrierPrefixID=078120.100.10000.90,bestMatchPre fix=1251,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr originatorPrefix: 041020 priority: 100 originator: 041020 originatorPrefixID: 041020 objectClass: top objectClass: originatorPrefixID # 049010, 078120.100.10000.90, 1251, bestMatchPrefixList, sipDirektor, ot.hr dn: originatorPrefixID=049010,carrierPrefixID=078120.100.10000.90,bestMatchPre fix=1251,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr originatorPrefix: 049010 priority: 100 originator: 049010 originatorPrefixID: 049010 objectClass: top objectClass: originatorPrefixID # 046010, 078120.100.10000.90, 1251, bestMatchPrefixList, sipDirektor, ot.hr dn: originatorPrefixID=046010,carrierPrefixID=078120.100.10000.90,bestMatchPre fix=1251,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr originatorPrefix: 046010 priority: 100 originator: 046010 originatorPrefixID: 046010 objectClass: top objectClass: originatorPrefixID # 049020, 078120.100.10000.90, 1251, bestMatchPrefixList, sipDirektor, ot.hr dn: originatorPrefixID=049020,carrierPrefixID=078120.100.10000.90,bestMatchPre fix=1251,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr originatorPrefix: 049020 priority: 100 originator: 049020 originatorPrefixID: 049020 objectClass: top objectClass: originatorPrefixID # 078120, 078120.100.10000.90, 1251, bestMatchPrefixList, sipDirektor, ot.hr dn: originatorPrefixID=078120,carrierPrefixID=078120.100.10000.90,bestMatchPre fix=1251,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr originatorPrefix: 078120 priority: 100 originator: 078120 originatorPrefixID: 078120 objectClass: top objectClass: originatorPrefixID # 043010, 078120.100.10000.90, 1251, bestMatchPrefixList, sipDirektor, ot.hr dn: originatorPrefixID=043010,carrierPrefixID=078120.100.10000.90,bestMatchPre fix=1251,ou=bestMatchPrefixList,ou=sipDirektor,dc=ot,dc=hr originatorPrefix: 043010 priority: 100 originator: 043010 originatorPrefixID: 043010 objectClass: top objectClass: originatorPrefixID Tihomir. On Fri, Sep 18, 2009 at 12:33 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, September 17, 2009 12:26 PM -0700 Quanah Gibson-Mount < > quanah(a)zimbra.com> wrote: > > --On Thursday, September 17, 2009 9:23 PM +0200 Tihomir Culjaga >> <tculjaga(a)gmail.com> wrote: >> >> so, can anyone help here ? >>> >>> >>> On Tue, Sep 15, 2009 at 8:34 PM, Tihomir Culjaga <tculjaga(a)gmail.com> >>> wrote: >>> >>> ok .. but the basic issue is still there ... >>> >>> i do a complete search and it hangs right on the 1st entry i added with >>> LDAP search ... it watis for 1 minute ...and at the end returns all 4 >>> remaining entries... >>> >> > > Can you better define the search you are running? Is it a search for > particular attr=value string? If so, is that attribute indexed? > > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 2

Re: ldapsearch hangs
by Tihomir Culjaga 17 Sep '09

17 Sep '09

ok .. but the basic issue is still there ... i do a complete search and it hangs right on the 1st entry i added with LDAP search ... it watids for 1 minute ...and at the end returns all 4 remaining entries... Well this is not sometihg very nice. I playes with cache as ell .. and i used 5 GB jus to be sure ... and it is the same ... search hangs fro a while ... and after a minute it pops the remaining 4 entries. these 4 entries i've aded after the DB was recreated from ldiff ... this cannot be normal what do you think ? On Tue, Sep 15, 2009 at 8:13 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > > --On Tuesday, September 15, 2009 5:22 PM +0200 Tihomir Culjaga < > tculjaga(a)gmail.com> wrote: > > can anyone help ? >> >> > Since you reduced the number of your entries to where you DB is only 3.4 GB > in size, there is no need to use a 7GB DB cache in DB_CONFIG anymore. I'd > suggest you drop it to 4GB, use the unlimited dncachesize setting > (dncachesize 0), and then add back in some tuning for cachesize and > idlcachesize settings. > > You need to run one ldapsearch through the entire database to let it seed > the dncache and entry cache, and to pull the data into the BDB DB cache. > > Once that is done, do your test. > > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 3

LTSP + LDAP Failover
by Maxime Gaudreault 17 Sep '09

17 Sep '09

Hi Lists I have 2 LTSP servers (failover) running Ubuntu. I have to setup a highly available LDAP authentication system. LTSP's users must authenticate using a LDAP server. Both LDAP servers must replicate between them. I don't really know where to start.. I found those websites: http://www.linuxjournal.com/article/5505 http://www.ltsp.org/twiki/bin/view/Ltsp/LDAP Can you give me some hint or others websites that could help me. Thanks (and sorry for my bad English)

2 1

Re: connections falling short
by Amol Kulkarni 17 Sep '09

17 Sep '09

2 1

Back-perl errors
by Buschman, Marshall 17 Sep '09

17 Sep '09

Hello All: I'm trying to implement back-perl in OpenLDAP 2.3.43 on Debian Lenny. I compiled my own perl due to difficulties with Perl 5.10.x as provided by Debian. Perl is version 5.8.9, lives in /cnu/opt/openldap-perl, and was compiled with "-des -Dprefix=/cnu/opt/openldap-perl -Dusesitecustomize -Dusethreads -Duseshrplib". On starting openldap I get the following error: #slapd -h 'ldap:/// ldaps:/// ldapi:///' -f /etc/openldap/slapd.conf Error Can't load '/cnu/opt/openldap-perl/lib/5.8.9/i686-linux/auto/Fcntl/Fcntl.so' for module Fcntl: /cnu/opt/openldap-perl/lib/5.8.9/i686-linux/auto/Fcntl/Fcntl.so: undefined symbol: PL_curpad at /cnu/opt/openldap-perl/lib/5.8.9/i686-linux/XSLoader.pm line 70. at /cnu/opt/openldap-perl/lib/5.8.9/i686-linux/Fcntl.pm line 215 BEGIN failed--compilation aborted at /cnu/opt/openldap-perl/lib/5.8.9/i686-linux/Fcntl.pm line 216. Compilation failed in require at /cnu/opt/openldap-perl/lib/5.8.9/i686-linux/POSIX.pm line 21. BEGIN failed--compilation aborted at /cnu/opt/openldap-perl/lib/5.8.9/i686-linux/POSIX.pm line 21. Compilation failed in require at /etc/openldap/SampleLDAP.pm line 28. BEGIN failed--compilation aborted at /etc/openldap/SampleLDAP.pm line 28. Compilation failed in require at (eval 6) line 1. BEGIN failed--compilation aborted at (eval 6) line 1. Back-perl configuration is as follows: database perl suffix "dc=virtualcnu,dc=com" perlModulePath /etc/openldap perlModule SampleLDAP Adding more perlModulePath lines such as: perlModulePath /cnu/opt/openldap-perl/lib/5.8.9/i686-linux perlModulePath /cnu/opt/openldap-perl/lib/5.8.9 perlModulePath /cnu/opt/openldap-perl/lib/site_perl/5.8.9/i686-linux perlModulePath /cnu/opt/openldap-perl/lib/site_perl/5.8.9 Has no effect. I have verified that the files in question do exist. I've also tried compiling perl with only "-des -Dprefix=/cnu/opt/openldap-perl" I'm running the unmodified SampleLDAP.pm from the source distribution. The perl binary (/cnu/opt/openldap-perl/bin/perl) runs normally otherwise. Help? Thank you! -Marshall Buschman

1 0

Windwos 2003 Active Directory CentOS 5.3 OpenLDAP Server Sync
by MMoj＠timocom.com 16 Sep '09

16 Sep '09

Hello everyone, I´m having a hard time. I should enable the sync of an AD (W2K3) and an LDAP (CentOS 5.3) server based on the mentioned System. I realy don´t know how to establish a sync of user Account, Groups, etc. I have a test envirometn running with W2K3 AD and CentOS 5.3 LDAP witch Kerberos for SSO (Single-Sign-ON) but the Information are still located in the AD not in the LDAP and I want to Authenticate against the LDAP server. I realy don´t know how to configure the AD / LDAP so sync, or to replicate the AD into LDAP. Can someone help me out with a good "How-To" or maybe some config files, etc. Many thanks in advance. Mit freundlichen Grüßen / Kind regards Markus Moj IT Infrastructure & Services TimoCom Soft- und Hardware GmbH In der Steele 2 D-40599 Düsseldorf Tel: +49 211 88 26 80 14 Fax: +49 211 88 26 70 14 eMail: MMoj(a)TimoCom.com www.TimoCom.com Geschäftsführer: Jens Thiermann, Gunther Matzaitis Amtsgericht Düsseldorf, HRB 34489

6 5

Re: ldapsearch hangs
by Tihomir Culjaga 15 Sep '09

15 Sep '09

performing the search ... it returned everything (all data from the initial ldi) in very short time and stopped on the same place as before. After that it took ~10 minutes to finish... now, the process is taking 39.5% of memory and 15 - 20 % CPU when doing nothing.. USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND ldap 10597 15.6 39.5 8500816 4046688 ? Ssl 22:05 2:03 /usr/local/libexec/slapd -h ldap:/// -u ldap T. ldap 10597 21.9 39.5 8500816 4046688 ? Ssl 22:05 2:03 /usr/local/libexec/slapd -h ldap:/// -u ldap On Fri, Sep 11, 2009 at 10:09 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, September 11, 2009 10:04 PM +0200 Tihomir Culjaga < > tculjaga(a)gmail.com> wrote: > > >> What do you mean by: "And setting no cache or idlcachesize" >> >> >> you want me to comment this out ? >> >> >> # cachesize 2500000 >> # idlcachesize 7500000 >> cachefree 1000 >> dncachesize 0 >> > > For the moment, yes. See what size the slapd process is in real memory > with that setting first, after doing a query across the entire database. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 4

Re: connections falling short
by Amol Kulkarni 15 Sep '09

15 Sep '09

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical September 2009