openldap-technical December 2010

openldap-technical@openldap.org

82 participants
96 discussions

Rebuild openldap so all modules/overlays are separate
by Chris Jacobs 02 Dec '10

02 Dec '10

Main question: how to build openldap with all overlays as dynamically loaded modules (ie: optional). Why? These problems have been covered before, recently even. I'm trying to get Solaris 9/10 clients talking to openldap server. I can do getent passwd <user> but getent passwd or getent group or even ldaplist all fail. I haven't had any success with Benjamin's acl fix/work around, or configuring the overlay for sssvlv in slapd.conf. So, I thought I'd recompile openldap - without sssvlv support, but then I thought why have to do this again in the future if I find another incompatibility? I'd prefer to simply have all overlays/modules as separate loadable modules. When I compiled OpenLDAP, I configured it with: ./configure --with-tls=openssl \ --enable-crypt \ --enable-dynamic \ --enable-ldap \ --enable-lmpasswd \ --enable-modules \ --enable-overlays \ --enable-spasswd \ --sysconfdir=/etc The enable-overlays option builds in a number of overlays I use and am interested in using in the future - however, it also enables sss/vlv. I supposed I could try to build it again with that option followed by --disable-sssvlv but what I'd really prefer is a way to build openldap with the overlays as separate modules that I can load/unload when/as I need them. I've searched the documentation, but I can't figure out how. It's quite likely I haven't looked in the right spot. I'm currently trying to make my way through the configure script... Blech. Thanks for any pointers, - chris Chris Jacobs, Systems Administrator, Information Technology & Operations Apollo Group | Apollo Marketing | Aptimus, Inc. 2001 6th Ave | Ste 3200 | Seattle, WA 98121 phone: 206.839-8245 | cell: 206.601.3256 | Fax: 208.441.9661 email: chris.jacobs(a)apollogrp.edu This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

4 4

Re: Want interesting restrictions to ldap auth on different servers to different users
by c0re 01 Dec '10

01 Dec '10

2010/11/19 Phuong Marie VUONG <mangocphung(a)gmail.com>: > Hello, > > First, im sorry about my English. I share here my experience which worked > for limit acces host/group of host for user... > > In the configuration of ldap client /etc/ldap.conf , i have activate the > host attribute and a filter in nss_base_passwd > pam_check_host_attr yes > nss_base_passwd > ou=People,dc=xxxxx,dc=xxxx?one?|(host=hostname.domain)(host=PatternofHostGroup)(host=*) > > In the user entry, add the host attribute > And in the host set, you can put the pattern value correpond of the level > that you want to authorize to connect , for exe : > hostname.domain > or > PatternofHostGroup > or > * > > Hope that can help > > > 2010/11/19 c0re <nr1c0re(a)gmail.com> >> >> can you give an example of usage pam_check_host_attr? >> >> And how can I use group of hosts and assign user to this group to >> permit access user to this group avoiding enumerating hosts in users >> dn each time I add new user? >> >> What should I set in "host:"? Hostname of server? How host attr are >> sent to pam_ldap? >> >> 2010/11/18 Aaron Richton <richton(a)nbcs.rutgers.edu>: >> > On Thu, 18 Nov 2010, c0re wrote: >> > >> >> I mean user user1 can must login only on server1,server2 and server3. >> >> And user2 can login only on server5 and server2. >> > >> > You could probably overload almost anything (dyngroups, OpenLDAP ACLs, >> > search filters, who knows) to accomplish this, but the cleanest way to >> > do >> > this in pam_ldap would utilize pam_check_host_attr. I assume pam_ldap >> > because you mentioned "pam_groupdn" which is not an OpenLDAP >> > configuration >> > directive. >> > > > > > -- > Milan&Phuong > 06.17.34.09.77 > 09.53.57.04.94 > http://www.phuong.fr/photos/ > > > I moved a bit different way. I used pam_groupdn in ldap.conf and created a group for each server. Now if I add user to ldap, I need to add to groups "memberUid: `userdn`". And user will be able to login to those servers in which groups is user as a member. But if I got 100-200 servers and want to give access to new user to all this servers, I should add user to all groups. Of course it's a waste of time and it's possible to be done via some external shell/perl script, but may be there another way in openldap? pam_check_host_attr do almost same. If I add user - I need to add all hosts to user attr "host:". So it's same work I think.

2 2

ssf settings on server restart
by Christian Bösch 01 Dec '10

01 Dec '10

hi, i have an acl set to allow only some ips to connect unencrypted: {0}to dn.children="dc=abc,dc=net" by peername.ip=10.10.40.100 read break by peername.ip=10.10.8.49 read break by ssf=128 read break by * none olcSecurity: ssf=0 tls=0 simple_bind=0 update_ssf=0 this works in general, but if i restart slapd i get from the defined ips from above 'confidentially required'. then i have to set ssf=1 then back to ssf=0 to make it work again? anyone an idea why? /thx.chris

2 6

ACL based on superior entry
by Michael Ströder 01 Dec '10

01 Dec '10

HI! Is it possible to grant access in an ACL by a certain attribute value of the superior entry? I'd like to be able to disable bind for users based on a status flag in the container entry under which all user entries reside. Ciao, Michael.

2 2

RE: ldap crashing once under load
by Francis, Steve (IHG) 30 Nov '10

30 Nov '10

I see this in the config via : ldapsearch -Y external -H ldapi:/// -b cn=config olcRootDN: cn=Admin,o=SAH olcRootPW: {SSHA}VIYAj8/mu1iPhyrClvWqRUKJFrhZRFdKSQ== olcDbCacheSize: 10000 olcDbCheckpoint: 1024 5 olcDbConfig: {0}set_cachesize 0 15000000 1 olcDbConfig: {1}set_lg_regionmax 262144 olcDbConfig: {2}set_lg_bsize 2097152 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbIDLcacheSize: 30000 Do these need to be adjusted? Thanks, Steve Francis Technical Advisor - zSeries, zLinux, z/OS IHG Alpharetta Data Center Ph: 770-442-7157 Cell: 770-906-3122 IM: francisihg "Life's tough...It's even tougher if you're stupid!!" John Wayne ________________________________ From: Francis, Steve (IHG) Sent: Wednesday, December 01, 2010 12:57 AM To: openldap-technical(a)openldap.org Subject: ldap crashing once under load hello, I just recently migrated an exsiting app that uses an LDAP server on z/OS with no issues, to a SLES 11.1 server on a z10 processor using OpenLdap, and get the following error. Nov 30 23:15:50 adczlnxldapp1 slapd[15854]: slapd starting Nov 30 23:25:39 adczlnxldapp1 slapd[15854]: ch_malloc of 16777216 bytes failed I have at least 1gb memory assigned to the linux instance. Is there something I can do to correct this. I have temporarily pointed the app to use the z/OS LDAP server and all is fine....Our intent is to completely move this to zLinux and get off the z/OS LDAP server. Steve Francis Technical Advisor - zSeries, zLinux, z/OS IHG Alpharetta Data Center Ph: 770-442-7157 Cell: 770-906-3122 IM: francisihg "Life's tough...It's even tougher if you're stupid!!" John Wayne

1 0

ldap crashing once under load
by Francis, Steve (IHG) 30 Nov '10

30 Nov '10

hello, I just recently migrated an exsiting app that uses an LDAP server on z/OS with no issues, to a SLES 11.1 server on a z10 processor using OpenLdap, and get the following error. Nov 30 23:15:50 adczlnxldapp1 slapd[15854]: slapd starting Nov 30 23:25:39 adczlnxldapp1 slapd[15854]: ch_malloc of 16777216 bytes failed I have at least 1gb memory assigned to the linux instance. Is there something I can do to correct this. I have temporarily pointed the app to use the z/OS LDAP server and all is fine....Our intent is to completely move this to zLinux and get off the z/OS LDAP server. Steve Francis Technical Advisor - zSeries, zLinux, z/OS IHG Alpharetta Data Center Ph: 770-442-7157 Cell: 770-906-3122 IM: francisihg "Life's tough...It's even tougher if you're stupid!!" John Wayne

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical December 2010