openldap-technical October 2010

openldap-technical@openldap.org

99 participants
93 discussions

Sometimes getent missing users
by Jocke M 20 Oct '10

20 Oct '10

Hello, We are running an OpenLDAP server on RHEL4 and I just found out that running getent on the RHEL clients sometimes missed users against the OpenLDAP server. Example: getent passwd | wc -l 1038 getent passwd | wc -l 1624 Does anyone know what can be faulty, either on the clients or the server? -- Thx Jocke

6 11

PPolicy error.
by Meghanand Acharekar 19 Oct '10

19 Oct '10

Hi, I am using ppolicy overlay to enforce password policies. Following is my ppolicy configuration/ldif. dn: cn=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: policies pwdAttribute: userPassword pwdMaxAge: 7516800 pwdExpireWarning: 432000 pwdInHistory: 6 pwdCheckQuality: 1 pwdMinLength: 8 pwdMaxFailure: 4 pwdLockout: TRUE pwdLockoutDuration: 1920 pwdGraceAuthNLimit: 0 pwdFailureCountInterval: 0 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: FALSE while changing password on first login I got following error. WARNING: Your password has expired. You must change your password now and login again! Changing password for user prasad. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Constraint violation Password is too young to change passwd: Permission denied Connection to myhost closed. Thanks in advance Meghanand N Acharekar.

3 7

Logging when an account is locked by ppolicy
by Mikalsen Remi 19 Oct '10

19 Oct '10

I have successfully configured ppolicy on a test server and everything works as it should; except one small detail that isn't strictly necessary, but very useful to monitor the "state of affairs". The slapd log doesn't seem to include any information to indicate that an account has just been locked due to password policies. This information would be very useful for automatic log monitoring, because a high number of accounts being locked in a short period of time could indicate some kind of problem or attack against our systems via some supposedly secure client. The only thing I use password policies for is locking down accounts temporarily after repeated authentication failures. The LDAP catalogue isn't the place where passwords are actually set or changed. I've tried configuring the auditlog overlay, imagining it would log the locking of an account somehow, but I haven't actually been able to make it work. There are no errors in the slapd log when loading the module, but the auditlog log file is always empty, even after running ldapmodify on a "cn" attribute for a random person. Snippets from the slapd.conf (for testing purposes I've enabled and disabled ppolicy_use_lockout to see if it also had an effect in the logs, but nothing): [...] loglevel stats config cons [...] database bdb [...] overlay auditlog auditlog /var/log/slapd_audit.log overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=uit,dc=no" ppolicy_use_lockout [...] This server is a test server, the production servers are slaves in a master-slave configuration using syncrepl. The server version is 2.4.23. Getting auditlog to work is not a priority, what I really want is to be able to monitor locking of accounts. Does anybody have ideas around these issues? Maybe a new approach? Regards, Remi Mikalsen

1 0

db stick in RAM ?
by Frank Bonnet 19 Oct '10

19 Oct '10

Hello I'm thinking to put db files in RAM instead of hard disk for performance reasons. FreeBSD ( and Linux thought ) provide some utility to build RAMDISK ( md ) I did some tests in rebuilding db files with the slapcat/slapadd commands with RAMDISK ldap3# time slapadd -l test.ldif /usr/local/etc/openldap/slapd.conf: line 110: rootdn is always granted unlimited privileges. #################### 100.00% eta none elapsed 20s spd 633.9 k/s WITH HARDDISK ldap3# time slapadd -l test.ldif /usr/local/etc/openldap/slapd.conf: line 110: rootdn is always granted unlimited privileges. #################### 100.00% eta none elapsed 04m22s spd 48.4 k/s Does anyone runs production servers with ramdisk ? I know it is risky but running rsyncd between ramdisk and a hardisk depot would be safe huh ? Thanks for any advices

4 8

Configuring OpenLDAP 2.2 with gdbm
by KALINOWSKI, Piotr (Piotr) 19 Oct '10

19 Oct '10

Hello, I am trying to build OpenLDAP version 2.2.17 with the gdbm back end. The platform is Solaris 10 on SPARC. However, the configure script fails with the following error: ./configure --enable-ldbm --with-ldbm-api=gdbm --enable-shell --enable-crypt --disable-bdb ... checking for GDBM library... checking for gdbm_open... no checking for gdbm_open in -lgdbm... no no checking for gdbm.h... yes checking for db... no configure: warning: could not find suitable LDBM backend configure: error: select appropriate LDBM options or disable Does anyone know how to fix it? Thanks in advance. Piotr

6 11

Possible bug in ldap_get_values_len?
by Edward Z. Yang 18 Oct '10

18 Oct '10

Hello all, I was mucking around with OpenLDAP and noticed that ldap_get_values_len was returning NULL without setting a corresponding error code. Intruiged by this behavior, I did some debugging, and found that it was doing so on nsslapd-referral as generated by a Fedora 1.2.5 or 1.2.6 directory server for the cn=config entry (I haven't checked anywhere else yet). Here is a fragment of the byte sequence in ber_buf that was causing this: 000<14><04><10>nsslapd-referral1<00>0<19><04><12>password I checked some other code, ldapvi works around this by checking if the return value of ldap_get_values_len is NULL before using it, but it doesn't seem to do so consistently, and an old version of the code had this to say: struct berval **values = ldap_get_values_len(ld, entry, ad); struct berval **ptr; if (!values) continue; /* weird server */ I've also posted to 389-users [1], in Fedora Directory Server spitting out malformed data. But in that case, OpenLDAP should give me an error code, or work around it, or something. Cheers, Edward [1] http://lists.fedoraproject.org/pipermail/389-users/2010-October/012320.html

3 6

How to apply default ppolicy with cn=config
by sophie ailin 18 Oct '10

18 Oct '10

Hello, I was new to openldap, I try to use the default ppolicy with openldap 2.4.21 on suse linux, I didn't find much info in detail about how to config it when using cn=config. Could you take a look what I am missing here. I created and include the ldif file I think equivalent to slapd.conf , (convert the default ppolicy.shcema to ppolicy.ldif) : : include: file:///etc/openldap/schema/ppolicy.ldif : : dn: olcOverlay={1}ppolicy,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {1}ppolicy olcPPolicyDefault: cn=default,ou=policies,dc=example,dc=com Also I added the container and the policies : : dn: ou=policies,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: policies dn: cn=default,ou=policies,dc=example,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: 2.5.4.35 #pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 0 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 8 pwdMustChange: FALSE pwdSafeModify: TRUE sn: dummy value the ppolicy.ldif look like this dn: cn=ppolicy,cn=schema,cn=config objectClass: olcSchemaConfig cn: ppolicy olcAttributeTypes: {0}( 1.3.6.1.4.1.42.2.27.8.1.1 NAME 'pwdAttribute' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) olcAttributeTypes: {1}( 1.3.6.1.4.1.42.2.27.8.1.2 NAME 'pwdMinAge' EQUALITY in tegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.4.1.42.2.27.8.1.3 NAME 'pwdMaxAge' EQUALITY in tegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.4.1.42.2.27.8.1.4 NAME 'pwdInHistory' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {16}( 1.3.6.1.4.1.42.2.27.8.1.5 NAME 'pwdCheckQuality' EQUAL ITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.4.1.42.2.27.8.1.6 NAME 'pwdMinLength' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.4.1.42.2.27.8.1.7 NAME 'pwdExpireWarning' EQUA LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.4.1.42.2.27.8.1.8 NAME 'pwdGraceAuthNLimit' EQ UALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.4.1.42.2.27.8.1.9 NAME 'pwdLockout' EQUALITY b ooleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {9}( 1.3.6.1.4.1.42.2.27.8.1.10 NAME 'pwdLockoutDuration' E QUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.4.1.42.2.27.8.1.11 NAME 'pwdMaxFailure' EQUAL ITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {11}( 1.3.6.1.4.1.42.2.27.8.1.12 NAME 'pwdFailureCountInter val' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {12}( 1.3.6.1.4.1.42.2.27.8.1.13 NAME 'pwdMustChange' EQUAL ITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {13}( 1.3.6.1.4.1.42.2.27.8.1.14 NAME 'pwdAllowUserChange' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.4.1.42.2.27.8.1.15 NAME 'pwdSafeModify' EQUAL ITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {15}( 1.3.6.1.4.1.4754.1.99.1 NAME 'pwdCheckModule' DESC 'L oadable module that instantiates "check_password() function' EQUALITY caseExa ctIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.4.1.4754.2.99.1 NAME 'pwdPolicyChecker' SUP top AUXILIARY MAY pwdCheckModule ) olcObjectClasses: {1}( 1.3.6.1.4.1.42.2.27.8.2.1 NAME 'pwdPolicy' SUP top AUXI LIARY MUST pwdAttribute MAY ( pwdMinAge $ pwdMaxAge $ pwdInHistory $ pwdCheck Quality $ pwdMinLength $ pwdExpireWarning $ pwdGraceAuthNLimit $ pwdLockout $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMustChange $ pwdAllowUserChange $ pwdSafeModify ) ) Somehow the policy didn't seems apply to my user entries, like the pwdMinLength or pwdExpireWarning not take effect at all. I tried with pwdCheckQuality 1 or 2 , both not working. I guess I am missing some config, the old way has a step to load the module, is there something similar I need to do the new way? Really appreciate your time and help! Sophie

3 2

SYntax for Proxy addresses and attribute to be defined for proxy addresess in LDIF file
by Meena Ram 17 Oct '10

17 Oct '10

Dear folks: If any one has the syntax for adding proxy addresses in the LDIF file along with the normal mail attribute that will be really appreciated if you can share the Syntax or the link and also the modifications to schema files with the details. Cheers!!!!!! Ram Req: Sample LDIF file with proxy addresses along with mail attribute Cheers!!!!!!!!!! RAM

1 0

Overlay chain
by Luiz M Oliveira 17 Oct '10

17 Oct '10

Hello everyone, I have a slave server and need to configure the module chain so that any user can change their password on the master server I am using the following configuration: overlay chain chain-uri ldap: / / domain.com.br chain-bind-idassert bindmethod = simple binddn = "cn = admin, dc = domain" credentials = "admin" mode = none chain-return-true error chain-rebind-as-user true This configuration only allows the identity cn = admin making connections as the master server. What I need is to configure the chain so that any identity is used in the connection. Thanks to all.

1 0

Excessively 'busy' slapd -- how to find out why.
by Robert Heller 16 Oct '10

16 Oct '10

We have a machine running slapd and serving as the authentifcation server for a small network (three Linux machines, a few MS-Windows machines (via Samba). For some reason, slapd is consuming lots of CPU cycles. There is nothing obviously wrong being recorded in the log files. This is on a CentOS 5.5 system (all three Linux machines are running CentOS 5.5): [heller@bach ~]$ rpm -qa openldap\* samba\* smbldap\* samba-3.0.33-3.29.el5_5.1 smbldap-tools-0.9.4-1.el5 openldap-2.3.43-12.el5_5.2 samba-common-3.0.33-3.29.el5_5.1 openldap-servers-2.3.43-12.el5_5.2 samba-client-3.0.33-3.29.el5_5.1 openldap-clients-2.3.43-12.el5_5.2 -- Robert Heller -- 978-544-6933 / heller(a)deepsoft.com Deepwoods Software -- http://www.deepsoft.com/ () ascii ribbon campaign -- against html e-mail /\ www.asciiribbon.org -- against proprietary attachments

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical October 2010