openldap-technical December 2010

openldap-technical@openldap.org

82 participants
96 discussions

Re: Drives me crazy .. openLDAP 2.4 - migrate config from 2.3
by Götz Reinicke - IT-Koordinator 09 Dec '10

09 Dec '10

Hey Victor, thanks four your long helpful answer. Yes, it is the Redhat provided openldap-servers-2.4.22-7.el6.i386, because compiling from source (on RH 5!) did not work for me :-( (s. other discussion) For me I'd like to stay with the RH Packages, as compiling is not yet part of my daily business ;-) But things may change.... Before I started to try your suggestions, I restarted my testsystem and 'just' launched slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d and adjusted the file permissions. And voila, my slapd config is build and the server starts without errors. All I did was restarting the system, no change to the config. So something had a hick-up. Regards . Götz Am 08.12.10 18:30, schrieb Gattegno, Victor (GCC - Software): > Hello Götz, > > Which OpenLDAP 2.4 version do you use? > The one of RHEL 6? > > Or the one (OpenLDAP 2.4.23) from http://www.openldap.org? > Then slapd.conf is : /usr/local/etc/openldap/slapd.conf > > I would recommend you OpenLDAP 2.4.23 from http://www.openldap.org > associated with BDB recommended-version: > http://www.openldap.org/doc/admin24/appendix-recommended-versions.html > > Check with: > locate slapd > slapd -V > >> db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2). > It seems that slaptest saw that your configuration expects a LDAP database in /var/lib/ldap, which doesn't exist... I guess that you have "directory /var/lib/ldap" in your slapd.conf, then you should have a database associated... > > So, first, check your slapd.conf content. > > After that, test it through: > slaptest -f /etc/openldap/slapd.conf > > Once your slapd.conf is ok, you can convert it through: > slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d > Or (if OpenLDAP 2.4.23) through: > slaptest -f /usr/local/etc/openldap/slapd.conf -F /usr/local/etc/openldap/slapd.d > > Rgds, > Victor > > -----Original Message----- > From: openldap-technical-bounces(a)OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Götz Reinicke - IT-Koordinator > Sent: mercredi 8 décembre 2010 16:53 > To: openldap-technical(a)openldap.org > Subject: Drives me crazy .. openLDAP 2.4 - migrate config from 2.3 > > Hey, > > I recently started to get used to Red Hat Enterprise 6 with openldap 2.4 > and the main migration point is the 'new' config style. > > I removed my test-database (I have a ldif-backup) files and the default > config from my testsystem. > > I followed the RH guide [1], but now get an error with my testsystem > while lauching this command: > > slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d > > bdb_db_open: database "dc=filmakademie,dc=de": > db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2). > > backend_startup_one (type=bdb, suffix="dc=filmakademie,dc=de"): > bi_db_open failed! (2) > > > > What may I have missed? Any suggestions? Thanks a lot for pointing me > into the right direction! > > /Götz > > > [1] > http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html-single/Mi… -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

1 1

Host Best Authentication
by Anton Chu 08 Dec '10

08 Dec '10

Anyone have a great solution on setting up host base filtering? I've tried the ldapns.schema and then setup pam using this site: https://help.ubuntu.com/community/LDAPClientAuthentication Ddin't work. Regards

1 0

Drives me crazy .. openLDAP 2.4 - migrate config from 2.3
by Götz Reinicke - IT-Koordinator 08 Dec '10

08 Dec '10

Hey, I recently started to get used to Red Hat Enterprise 6 with openldap 2.4 and the main migration point is the 'new' config style. I removed my test-database (I have a ldif-backup) files and the default config from my testsystem. I followed the RH guide [1], but now get an error with my testsystem while lauching this command: slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d bdb_db_open: database "dc=filmakademie,dc=de": db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2). backend_startup_one (type=bdb, suffix="dc=filmakademie,dc=de"): bi_db_open failed! (2) What may I have missed? Any suggestions? Thanks a lot for pointing me into the right direction! /Götz [1] http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html-single/Mi… -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

1 0

how to compile recent openldap on Centos 5.5
by Götz Reinicke - IT-Koordinator 06 Dec '10

06 Dec '10

Hello, I tried to compile the Release 2.4.23 of openldap on my centos 5.5 server. It fails with: checking db.h usability... yes checking db.h presence... yes checking for db.h... yes checking for Berkeley DB major version in db.h... 4 checking for Berkeley DB minor version in db.h... 3 checking if Berkeley DB version supported by BDB/HDB backends... no configure: error: BerkeleyDB version incompatible with BDB/HDB backends I do have db4 installed: db4-4.3.29-10.el5_5.2 db4-devel-4.3.29-10.el5_5.2 db4-utils-4.3.29-10.el5_5.2 What may I do wrong? Any sugesstions? Thanks and regards . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

8 12

Re: Want interesting restrictions to ldap auth on different servers to different users
by c0re 06 Dec '10

06 Dec '10

2010/12/6 Dan White <dwhite(a)olp.net>: > On 06/12/10 15:34 +0300, c0re wrote: >> >> 2010/12/1 Dan White <dwhite(a)olp.net>: >> Thanks for example! >> >> But it still requires to edit clients.conf when adding device. And not >> restricts by groups. > > That's true, unless you have some of your clients coming from behind > one NAT address. I'm not aware of any way around that. > >> As per http://wiki.freeradius.org/Rlm_ldap I can use >> >> groupmembership_filter = >> >> "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" >> >> If there any other variables that can be used? I mean not only >> Ldap-userDn, but something like Ldap-clientIP, or Ldap-clientHostname >> or anything else to unique identify remote device. So I can use >> dynamic groups in OpenLdap and restrict access to device by group >> membership. > > As for the client IP, or other identifying information of the > authenticating device, I've always tried to use huntgroups to identify the > device rather than trying to perform a match in the LDAP filter, but that > approach might work just fine. > > Keep in mind that different types of devices will send more or less > information in its RADIUS request. Running freeradius in '-X' mode, and > sending a sample request will show you the information that you might be > able to match on. > > -- > Dan White > Thanks for tip about -X mode, will do it if get troubles. Found very interesting message in mailists here: http://lists.freeradius.org/pipermail/freeradius-users/2010-October/msg0005… Even more interesting - storing NAS secret in ldap! And using variable Packet-Src-IP-Address to differ source devices. Will try to get it work at this week.

1 0

help for tuning slapd
by Stéphane PURNELLE 06 Dec '10

06 Dec '10

Hi all, Sometimes my sladd process take more than 100% CPU and I don't know why. Searching on google I foud nsome tips about tunning but I don't understand some part of the article (set_cachesize chapter) ( http://www.openldap.org/doc/admin23/tuning.html) openldap 2.3.43 with BDB db-4.2.52 on Redhat Enterprise Linux 5.3 Some output : db_stat -d dn2id.bdb 53162 Btree magic number. 9 Btree version number. Flags: duplicates, little-endian 2 Minimum keys per-page. 4096 Underlying database page size. 2 Number of levels in the tree. 1588 Number of unique keys in the tree. 3159 Number of data items in the tree. 5 Number of tree internal pages. 19000 Number of bytes free in tree internal pages (7% ff). 51 Number of tree leaf pages. 113150 Number of bytes free in tree leaf pages (46% ff). 10 Number of tree duplicate pages. 18790 Number of bytes free in tree duplicate pages (54% ff). 0 Number of tree overflow pages. 0 Number of bytes free in tree overflow pages (0% ff). 0 Number of pages on the free list. db_stat -d id2entry.bdb 53162 Btree magic number. 9 Btree version number. Flags: little-endian 2 Minimum keys per-page. 16384 Underlying database page size. 2 Number of levels in the tree. 792 Number of unique keys in the tree. 792 Number of data items in the tree. 1 Number of tree internal pages. 13792 Number of bytes free in tree internal pages (16% ff). 117 Number of tree leaf pages. 717074 Number of bytes free in tree leaf pages (63% ff). 0 Number of tree duplicate pages. 0 Number of bytes free in tree duplicate pages (0% ff). 25 Number of tree overflow pages. 276539 Number of bytes free in tree overflow pages (32% ff). 4 Number of pages on the free list. anyone can help me for tuning mu openldap DB ? thanks Stéphane Purnelle ----------------------------------- Stéphane PURNELLE Admin. Systèmes et Réseaux Service Informatique Corman S.A. Tel : 00 32 (0)87/342467

1 0

ldap_result returns LDAP_TIMEOUT even after getting search response
by Shankar Anand R 06 Dec '10

06 Dec '10

Hi, I am seeing very slow responses while using ldap_search_ext() and ldap_result(). I have explained my application below. Kindly let me know if you see any problems/clues. I have written a simple application which reads a file and does LDAP search for all entities in the file. I am doing a simple bind with the LDAP server. I have 2 threads and 2 queues namely, LDAP Search queue and LDAP result queue. - Thread 1 reads all the entities from LDAP Search queue, sends out LDAP search requests for those entities and puts them into LDAP result queue. - Thread 2 reads all the entities from LDAP Result queue and checks for search results for those entities. These 2 threads do these tasks every 1 second. Since I don't want to overload the LDAP server I have programmed a constraint of a maximum of 20 outstanding LDAP searches that haven't got a result yet. Successful ldap_result() seems to be taking a long time. I keep getting LDAP_TIMEOUT errors. But i do get the result eventually without any retransmissions. But after a long time. When I capture the LDAP packets, the results seems to coming in pretty quick. But still ldap_result returns a LDAP_TIMEOUT error. Why should ldap_result() return a timeout in this case? Note that I am using LDAP_MSG_ONE in ldap_result. And I am using a timeout of 0 - I want to poll for the result and not actually block. I have turned OFF LDAP_OPT_REFERRALS on client side. (But still not able to figure out how to prevent Active Directory 2008 from sending out referrals). My test file contains 25 entities and I want to query the LDAP server for these 25 entities. This is a simplified form of my log: At 0 seconds: LDAP Search thread: 25 more LDAP searches pending. 0 LDAP Search waiting for results Sent out 20 LDAP Search Requests. Trigger to start LDAP Result thread after 1 second. 5 more LDAP searches pending. Wait for 1 second before sending these out. At 1 seconds: LDAP Result thread: 20 LDAP Search results pending. Got 1 LDAP results. 19 LDAP Search results still pending. Try again after 1 second. LDAP Search Thread: 5 more LDAP Searches pending. 19 LDAP Search waiting for results. Sent out 1 LDAP Search Requests. 4 more LDAP searches pending. Wait for 1 second before sending these out. At 2 seconds: LDAP Result thread: 20 LDAP Search results pending. Got 5 LDAP results. 15 LDAP Search results still pending. Try again after 1 second. LDAP Search Thread: 4 more LDAP Searches pending. 15 LDAP Search waiting for results. Sent out 4 LDAP Search Requests. 0 LDAP Search pending. Stopping LDAP Search thread. At 3 seconds: LDAP Result thread: 19 LDAP Search results pending. Got 4 LDAP results. 15 LDAP Search results still pending. Try again after 1 second. At 4 seconds: LDAP Result thread: 15 LDAP Search results pending. Got 4 LDAP results. 11 LDAP Search results still pending. Try again after 1 second. At 5 seconds: LDAP Result thread: 11 LDAP Search results pending. Got 3 LDAP results. 8 LDAP Search results still pending. Try again after 1 second. At 6 seconds: LDAP Result thread: 8 LDAP Search results pending. Got 2 LDAP results. 6 LDAP Search results still pending. Try again after 1 second. At 7 seconds: LDAP Result thread: 6 LDAP Search results pending. Got 1 LDAP results. 5 LDAP Search results still pending. Try again after 1 second. At 8 seconds: LDAP Result thread: 5 LDAP Search results pending. Got 2 LDAP results. 3 LDAP Search results still pending. Try again after 1 second. At 8 seconds: LDAP Result thread: 3 LDAP Search results pending. Got 1 LDAP results. 2 LDAP Search results still pending. Try again after 1 second. At 9 seconds: LDAP Result thread: 2 LDAP Search results pending. Got 0 LDAP results. 2 LDAP Search results still pending. Try again after 1 second. At 10 seconds: LDAP Result thread: 2 LDAP Search results pending. Got 1 LDAP results. 1 LDAP Search results still pending. Try again after 1 second. At 11 seconds: LDAP Result thread: 1 LDAP Search results pending. Got 0 LDAP results. 1 LDAP Search results still pending. Try again after 1 second. At 12 seconds: LDAP Result thread: 1 LDAP Search results pending. Got 1 LDAP results. 0 LDAP Search Results pending. Stopping LDAP Result thread. Any help/clues is much appreciated. Regards, Shankar

1 0

Re: Want interesting restrictions to ldap auth on different servers to different users
by c0re 06 Dec '10

06 Dec '10

2010/12/1 Dan White <dwhite(a)olp.net>: > On 01/12/10 18:27 +0300, c0re wrote: >> >> Can't understand about how to use nssov overlay in my case, but >> understood about dynamic groups overlay and it should fit to my needs. >> >> Also I've got freeradius that authenticate users by looking in ldap. >> Works good. But can't understand about how to restrict users to login >> to some devices. At that moment all users has access to all devices >> via radius. Same requests - this must be controlled via openldap. >> >> May be someone uses freeradius and has already made such restritions >> and can give me some tips. > > Here's one approach: > > Given a huntgroups file of: > > device1 NAS-IP-Address == 192.168.1.1 > cisco1 NAS-IP-Address == 192.168.1.2 > > and corresponding entries in your clients.conf, you can add something like > this in your users file: > > DEFAULT Huntgroup-Name == "device1", ldap-customattr-Ldap-Group == "device1" > Fall-Through = no > > DEFAULT Huntgroup-Name == "device1", Auth-Type := Reject > > DEFAULT Huntgroup-Name == "cisco1", ldap-customattr-Ldap-Group == > "cisco1/admin", User-Profile := "cn=ciscoadmin,ou=radius,dc=example,dc=net" > Fall-Through = no > > DEFAULT Huntgroup-Name == "cisco1", Auth-Type := Reject > > then create /etc/freeradius/modules/ldap-customattr with: > > ldap ldap-customattr { > > server = "ldap://ldap.example.net" > ldap_debug = 0x0028 > identity = "$dn" > password = $pass > ldap_connections_number = 5 > basedn = "dc=example,dc=net" > filter = "(uid=%u)" > start_tls = no > tls_mode = no > password_attribute = "userPassword" > groupname_attribute = "customattr" > groupmembership_filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > groupmembership_attribute = "customattr" > > } > > Add 'ldap-customattr' inside the 'instantiate' section within > /etc/freeradius/radiusd.conf. > > Add this to your tree: > > dn: cn=ciscoadmin,ou=radius,dc=example,dc=net > objectClass: radiusObjectProfile > objectClass: radiusprofile > cn: ciscoadmin > radiusReplyItem: cisco-avpair = "shell:priv-lvl=15" > > > Then within your user entries, any user with: > > customattr: device1 > > will be authorized to authenticate to device1, and > > customattr: cisco1/admin > > will authenticate to cisco1, and will also drop directly into enable mode, > assuming the cisco device is configured to do so. > > -- > Dan White > Thanks for example! But it still requires to edit clients.conf when adding device. And not restricts by groups. As per http://wiki.freeradius.org/Rlm_ldap I can use groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" If there any other variables that can be used? I mean not only Ldap-userDn, but something like Ldap-clientIP, or Ldap-clientHostname or anything else to unique identify remote device. So I can use dynamic groups in OpenLdap and restrict access to device by group membership.

1 0

Multiple LDAP server IPs to ldap_init, server is busy and failover question.
by Jorgen Lundman 06 Dec '10

06 Dec '10

Solaris 10 x86 u8 openldap-2.4.23 db-4.8.30.NC dovecot-1.2.7 Can I have some clarification on how failover works when using OpenLDAP library as a client. If a piece of software is passing multiple space-separated hosts to ldap_init() (or initialize) calls, but receives "Server is busy" error during a search request, should the LDAP library not handle that for the caller automatically/transparently? Ie, switch to next working LDAP server, and perform the ldap_search. Or is it closer to that ldap_init will find the first working IP (the failover is early in the flow), but if an already started search later fails, it is up to the software to retry/reconnect? It only guarantees that the initial connection is valid. What is the general practise here? Thanks, Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

1 0

OpenLDAP 2.4 authentication methods
by Josh Spranger 04 Dec '10

04 Dec '10

I have OpenLDAP version 2.4 installed on an OpenSUSE box. I am using it as an LDAP Proxy to Windows AD domain. It works perfectly using standard LDAP logon credentials (cn=user,DC=domain,DC=com). But I have some applications that use user(a)domain.com<mailto:user@domain.com> logon credentials. Is there a way to configure OpenLDAP to authenticate in this way? Slapd config file available on request. Thanks! Josh Spranger Sr. Network Engineer

2 3

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical December 2010