openldap-technical June 2010

openldap-technical@openldap.org

104 participants
113 discussions

Textual LDIF backup strategies for busy LDAP clusters
by Nick Urbanik 30 Jun '10

30 Jun '10

Dear Folks, our old backup system for our LDAP clusters using slurpd is as follows: 1. A dedicated slave (we call it a "sync") has a replogfile configured. 2. A cron job moves the replog file to a backup directory every 15 minutes. 3. Another cron job runs every 24 hours, which: a. Stops slapd. b. slapcats to a file which is compressed with gzip. c. starts slapd. 4. Another system backs up the backup directory. Now we like text formatted backups, and I need to implement a similar or better system with syncrepl. Here are my questions: 1. Would the auditlog overlay be an appropriate replacement for the replogfile? 2. Can we run this on the master without stopping slapd? 3. Would we be able to accurately reconstruct the data using the slapcat and periodic copies of auditlog files? I will write software to fully automate whatever scheme we determine to be the most appropriate. -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

2 7

fails to start ldaps://
by owen nirvana 30 Jun '10

30 Jun '10

it's openldap-2.4.17 in debian testing I try to config slapd.conf to use ldap ssl. TLSCACertificateFile cacert.pem TLSCertificateFile ldapclient.pem TLSCertificateKeyFile ldapclientkey.pem TLSVerifyClient never I could not start slapd after I config TLS in slapd.conf, error info is "Main: TLS init def ctx failed: -69" the OpenLDAP Admin Guide only mentions CipherSuite in OpenSSL, not GnuTLS. Steve Langasek advice leave TLSCipherSuite blank( http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=462588), and I do config so. But if I config some specific CipherSuite or just "ALL", error info will be "TLS: could not set cipher list ALL. Main: TLS init def ctx failed: -1" gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com>

1 0

Question about openldap and RFC documents
by Bryan Boone 29 Jun '10

29 Jun '10

Hi everyone, I have a question about openldap and RFC documents. I see online the list of RFC documents that openldap conforms too. RFC documents are difficult to read and follow. I am working on a project that requires me to use. organizationalUnit groupOfNames inetOrgPerson Also I need to use the attributes. uid userpassword I need to document my work so that someone can setup their own LDAP server (maybe non-OpenLDAP) if they wish. I see that RFC2307 referes to the hashing of userpassword. Can anyone list to me the RFC documents that encompass the 3 object classes and the 2 attributes so that I can put that in my documentation? I know I just just list all of the RFC documents on the website for openldap, but I think that is a little redundant. Plus I would like to know exactly which RFC's I am using. thanks

1 0

Recover LDAP contents from binary files
by Pelle Nilsson 29 Jun '10

29 Jun '10

Hi! I need to recover the contents of my LDAP database from a crashed computer. I have all the configuration files and binary files, and the passwords of the LDAP users, but no working LDAP installation. Can this be done? /Pelle

1 0

OpenLDAP Issues
by Allgood, John 29 Jun '10

29 Jun '10

Hey All Does anyone know why when I change pam_password exop in /etc/ldap.conf my password history and check_password module that I built into ppolicy stop working. This is openldap 2.4.21 built from source running on Centos 5.5. It worked fine when I had pam_password md5. Thanks John Allgood Senior Systems Administrator OHL Transportation Services 2251 Jesse Jewell Pky. NE Gainesville, GA 30507 tel: (678) 989-3051 fax: (770) 531-7878 jallgood(a)ohl.com<mailto:jallgood@ohl.com> www.ohl.com<http://www.ohl.com> ______________________________________________________ This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you are not the intended recipient or their designee, please notify the sender immediately by return e-mail and delete all copies.

2 2

ldapsearch not returning namingContexts
by ben thielsen 28 Jun '10

28 Jun '10

i just happened to notice that the following search(es) don't return the expected results: >ldapsearch -xs base -b '' + # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: + # # search result search: 2 result: 0 Success # numResponses: 1 >ldapsearch -xs base -b '' namingContexts # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: namingContexts # # search result search: 2 result: 0 Success # numResponses: 1 below is the debug output from slapd for the first search - what am i doing wrong? i'm using 2.4.21, courtesy of ubuntu. thanks -ben daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(7): daemon: epoll: listen=7 busy >>> slap_listener(ldap:///) daemon: listen=7, new connection on 14 daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: added 14r (active) listener=(nil) daemon: activity on 1 descriptor daemon: activity on: 14r conn=1000 fd=14 ACCEPT from IP=192.168.1.1:51467 (IP=0.0.0.0:389) daemon: read active on 14 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_get(14) connection_get(14): got connid=1000 connection_read(14): checking for input on id=1000 ber_get_next ldap_read: want=8, got=8 0000: 30 0c 02 01 01 60 07 02 0....`.. ldap_read: want=6, got=6 0000: 01 03 04 00 80 00 ...... ber_get_next: tag 0x30 len 12 contents: ber_dump: buf=0x20cf3b90 ptr=0x20cf3b90 end=0x20cf3b9c len=12 0000: 02 01 01 60 07 02 01 03 04 00 80 00 ...`........ op tag 0x60, time 1277686599 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL conn=1000 op=0 do_bind ber_scanf fmt ({imt) ber: ber_dump: buf=0x20cf3b90 ptr=0x20cf3b93 end=0x20cf3b9c len=9 0000: 60 07 02 01 03 04 00 80 00 `........ ber_scanf fmt (m}) ber: ber_dump: buf=0x20cf3b90 ptr=0x20cf3b9a end=0x20cf3b9c len=2 0000: 00 00 .. >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> conn=1000 op=0 BIND dn="" method=128 do_bind: version=3 dn="" method=128 send_ldap_result: conn=1000 op=0 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 14 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ ldap_write: want=14, written=14 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ conn=1000 op=0 RESULT tag=97 err=0 text= daemon: activity on 1 descriptor daemon: activity on: 14r daemon: read active on 14 daemon: epoll: listen=7 active_threads=0 tvp=NULL connection_get(14) daemon: epoll: listen=8 active_threads=0 tvp=NULL do_bind: v3 anonymous bind connection_get(14): got connid=1000 connection_read(14): checking for input on id=1000 ber_get_next ldap_read: want=8, got=8 0000: 30 28 02 01 02 63 23 04 0(...c#. ldap_read: want=34, got=34 0000: 00 0a 01 00 0a 01 00 02 01 00 02 01 3c 01 01 00 ............<... 0010: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 03 04 ..objectclass0.. 0020: 01 2b .+ ber_get_next: tag 0x30 len 40 contents: ber_dump: buf=0x20cf43a8 ptr=0x20cf43a8 end=0x20cf43d0 len=40 0000: 02 01 02 63 23 04 00 0a 01 00 0a 01 00 02 01 00 ...c#........... 0010: 02 01 3c 01 01 00 87 0b 6f 62 6a 65 63 74 63 6c ..<.....objectcl 0020: 61 73 73 30 03 04 01 2b ass0...+ op tag 0x63, time 1277686599 connection_input: conn=1000 deferring operation: binding ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL conn=1000 op=1 do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x20cf43a8 ptr=0x20cf43ab end=0x20cf43d0 len=37 0000: 63 23 04 00 0a 01 00 0a 01 00 02 01 00 02 01 3c c#.............< 0010: 01 01 00 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 .....objectclass 0020: 30 03 04 01 2b 0...+ >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> SRCH "" 0 0 0 60 0 begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x20cf43a8 ptr=0x20cf43be end=0x20cf43d0 len=18 0000: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 03 04 ..objectclass0.. 0010: 01 2b .+ end get_filter 0 filter: (objectClass=*) ber_scanf fmt ({M}}) ber: ber_dump: buf=0x20cf43a8 ptr=0x20cf43cb end=0x20cf43d0 len=5 0000: 00 03 04 01 2b ....+ attrs: + conn=1000 op=1 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" conn=1000 op=1 SRCH attr=+ => test_filter PRESENT => access_allowed: search access to "" "objectClass" requested => acl_get: [1] attr objectClass => acl_mask: access to entry "", attr "objectClass" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth <= check a_dn_pat: * <= acl_mask: [2] applying +0 (break) <= acl_mask: [2] mask: =0 <= acl_get: done. => slap_access_allowed: no more rules => access_allowed: no more rules <= test_filter 50 send_ldap_result: conn=1000 op=1 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=2 tag=101 err=0 ber_flush2: 14 bytes to sd 14 0000: 30 0c 02 01 02 65 07 0a 01 00 04 00 04 00 0....e........ ldap_write: want=14, written=14 0000: 30 0c 02 01 02 65 07 0a 01 00 04 00 04 00 0....e........ conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= daemon: activity on 1 descriptor daemon: activity on: 14r daemon: read active on 14 daemon: epoll: listen=7 active_threads=0 tvp=NULL connection_get(14) daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_get(14): got connid=1000 connection_read(14): checking for input on id=1000 ber_get_next ldap_read: want=8, got=7 0000: 30 05 02 01 03 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x20cf3b90 ptr=0x20cf3b90 end=0x20cf3b95 len=5 0000: 02 01 03 42 00 ...B. op tag 0x42, time 1277686599 ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 14 failed errno=0 (Success) connection_read(14): input error=-2 id=1000, closing. connection_closing: readying conn=1000 sd=14 for close daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_close: deferring conn=1000 sd=14 conn=1000 op=2 do_unbind conn=1000 op=2 UNBIND connection_resched: attempting closing conn=1000 sd=14 connection_close: deferring conn=1000 sd=14 connection_resched: attempting closing conn=1000 sd=14 connection_close: conn=1000 sd=14 daemon: removing 14 conn=1000 fd=14 closed

4 6

Problem with 2.4.22 with FreeBSD
by Frank Bonnet 28 Jun '10

28 Jun '10

Hello I upgraded from 2.4.21 to 2.4.22 from the FreeBSD ports and the slapd daemon does not start anymore ... error message follows /libexec/ld-elf.so.1: /usr/local/libexec/slapd: Undefined symbol "ldap_pvt_csnstr" The configuration is the same and there is no compilation error. Thanks for any infos. F

4 3

Can password-hash be database specific? also, storing and verifying cleartext passwords
by Tom Leach 28 Jun '10

28 Jun '10

Is the 'password-hash' configuration function a server-wide setting only or can it be set to different values for separate databases? I'm trying to add MAC-auth RADIUS functionality to my LDAP server (openldap-2.4.21) and I need to store the password for the MAC addresses in cleartext. I also use the LDAP server for user login which I don't want to keep in cleartext. So, my thought was to have 'password-hash {SSHA}' for the users database, and 'password-hash {CLEARTEXT}' for the RADIUS database, but it appears that it's a global so I'm pretty sure this won't work. Also, how do I verify that the passwords are stored in cleartext? On a test server, I've created just the radius database with a global 'password-hash {CLEARTEXT}', I have the following ldif file that I add with: ldapadd -x -W -v -D 'cn=Manager,o=radius' -f mac.ldif -h ldap_server Contents of mac.ldif: dn:uid=001e68d08ff9,o=radius uid: 001e68d08ff9 cn: 001e68d08ff9 userPassword: {cleartext}001e68d08ff9 objectClass: top objectClass: radiusProfile objectClass: radiusObjectProfile but when I use ldapsearch or slapcat to dump the database, the userPassword line looks to be hashed. ldap_server# slapcat dn: o=radius o: radius objectClass: top objectClass: organization structuralObjectClass: organization entryUUID: 97ab4273-42ae-4b41-9100-a8106bf766bf creatorsName: cn=Manager,o=radius createTimestamp: 20100618220235Z entryCSN: 20100618220235.020635Z#000000#000#000000 modifiersName: cn=Manager,o=radius modifyTimestamp: 20100618220235Z dn: uid=001e68d08ff9,o=radius uid: 001e68d08ff9 cn: 001e68d08ff9 userPassword:: e2NsZWFydGV4dH0wMDFlNjhkMDhmZjk= objectClass: top objectClass: radiusprofile objectClass: radiusObjectProfile structuralObjectClass: radiusObjectProfile entryUUID: 591d40f2-a155-4b49-a827-5bfd92ee8c32 creatorsName: cn=Manager,o=radius createTimestamp: 20100619000726Z entryCSN: 20100619000726.747404Z#000000#000#000000 modifiersName: cn=Manager,o=radius modifyTimestamp: 20100619000726Z Here are the relevant lines from the slapd.conf file: include /usr/local/etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/radius.schema password-hash {CLEARTEXT} database bdb suffix "o=radius" rootdn "cn=Manager,o=radius" rootpw "secret" directory /var/lib/ldap/radius index objectClass eq index ou,cn,uid,memberUid eq,pres,sub index uniqueMember eq,pres index entryCSN,entryUUID eq

5 6

Openldap passwords synchronization
by Jean-Luc CHANDEZON 28 Jun '10

28 Jun '10

Hello, My demand is very simple : When I export user/password, there is 2 attributes (lmpassword,newpassword) How can I decrypt theses passwords, for importing in one other directory? Can I export some other keys for decrypting? Thanks, Jean-Luc

2 1

how can i add 2 Structural in the same record ?
by shyuejyh.tw 28 Jun '10

28 Jun '10

HI All : I have Big problem in replica account , when i add new account in old 2.0.2x to new 2.4.11 i find error log in 123.223.111.222:389.rej (at old server) ERROR: Object class violation replica: 123.223.111.222:389 time: 1233452016.0 dn: uid=poorman,ou=33-22,dc=somewhere,dc=com changetype: add objectClass: account // This is Structural 1 objectClass: pilotPerson // This is Structural 2 objectClass: posixAccount objectClass: top objectClass: shadowAccount than i check , account and pilotPerson are both Structural, if i remove any one of than , add is done. but, i really need to add 2 structural in a record, how can i config ? i have try edit cosine.schema , but doesn't work .. objectclass ( 0.9.2342.19200300.100.4.5 NAME 'account' SUP top STRUCTURAL //Change to SUP top AUXILIARY MUST userid MAY ( description $ seeAlso $ localityName $ organizationName $ organizationalUnitName $ host ) ) plz,help ... 3q ~

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical June 2010