openldap-technical July 2010

openldap-technical@openldap.org

103 participants
126 discussions

2.4.21 delta syncrepl : do_syncrep2: rid=000 (4096) Content Sync Refresh Required
by Arjan Filius 07 Jul '10

07 Jul '10

Hello openldap-technical, new on the list, Arjan Filius is my Name. Having setup openldap 2.4.21, with one master, and six slaves/consumers in delta syncrepl configuration and testing an upgrade from an older openldap version. exporting (slapcat > export-file), importing (slapadd -l `export-file`) on the (empty/pristine) master, and attaching empty/pristine slaves works just fine except for taking more than one hour to complete. To speed up migration i decided to import the export on master _and_ 6 slaves which finishes under 15 minutes. and now my problem starts. Starting the master and slaves results in a situation which doesn't "go away" and causes load on master, unneeded network traffic, all slaves/consumers complain with: 2010-07-06 07:00:58.797739500 do_syncrep2: rid=000 (4096) Content Sync Refresh Required 2010-07-06 07:00:58.801662500 do_syncrep2: rid=000 (4096) Content Sync Refresh Required 2010-07-06 07:00:58.804550500 do_syncrep2: rid=000 (4096) Content Sync Refresh Required at a fast rate. and the master complains about stale cookies (all slave connections ): 2010-07-06 07:08:44.470077500 conn=1003 op=40499239 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN 2010-07-06 07:08:44.470079500 conn=1003 op=40499239 SEARCH RESULT tag=101 err=4096 nentries=0 text=sync cookie is stale 2010-07-06 07:08:44.470760500 conn=1003 op=40499240 SRCH base="dc=com" scope=2 deref=0 filter="(objectClass=*)" 2010-07-06 07:08:44.470762500 conn=1003 op=40499240 SRCH attr=* + 2010-07-06 07:08:44.470764500 conn=1003 op=40499240 SEARCH RESULT tag=101 err=0 nentries=0 text= 2010-07-06 07:08:44.471582500 conn=1003 op=40499241 SRCH base="cn=accesslog" scope=2 deref=0 filter="(&(objectClass=auditWriteObject)(reqResult=0))" 2010-07-06 07:08:44.471585500 conn=1003 op=40499241 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN 2010-07-06 07:08:44.471587500 conn=1003 op=40499241 SEARCH RESULT tag=101 err=4096 nentries=0 text=sync cookie is stale 2010-07-06 07:08:44.472298500 conn=1003 op=40499242 SRCH base="dc=com" scope=2 deref=0 filter="(objectClass=*)" 2010-07-06 07:08:44.472301500 conn=1003 op=40499242 SRCH attr=* + 2010-07-06 07:08:44.472302500 conn=1003 op=40499242 SEARCH RESULT tag=101 err=0 nentries=0 text= 2010-07-06 07:08:44.473006500 conn=1003 op=40499243 SRCH base="cn=accesslog" scope=2 deref=0 filter="(&(objectClass=auditWriteObject)(reqResult=0))" 2010-07-06 07:08:44.473008500 conn=1003 op=40499243 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN 2010-07-06 07:08:44.473010500 conn=1003 op=40499243 SEARCH RESULT tag=101 err=4096 nentries=0 text=sync cookie is stale The slave has a rid config of: syncrepl rid=4 provider=ldap://X.X.X.X:389 bindmethod=simple binddn="cn=XXXXX,dc=XXX,dc=com" credentials=XXXX searchbase="dc=com" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="1 10 2 +" sizelimit=unlimited timelimit=unlimited syncdata=accesslog Has anyone an idea what is/might be going on, and how to fix/prevent this? or how to migrate/replicate in a fast way? Regards, and thanks in advance. -- Arjan Filius mailto:iafilius@xs4all.nl

2 4

TLS problem
by Cedric Jeanneret 07 Jul '10

07 Jul '10

Hello, I'm trying to configure an openldap with TLS so that all connections are encrypted. Here's the revelent part of my slapd.conf: TLSCipherSuite HIGH:MEDIUM:+SSLv3 TLSVerifyClient never TLSCertificateFile /etc/ldap/ssl/server.crt TLSCertificateKeyFile /etc/ldap/ssl/server.key Here's my ldap.conf: URI ldaps://my.server.ltd BASE dc=my,dc=server,dc=ltd LDAP_VERSION 3 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never ssl start_tls ssl on TLS_CIPHER_SUITE HIGH:MEDIUM:+SSLv3 While starting slapd with: slapd -h 'ldaps:///' -g openldap -u openldap -d 16383 and trying to connect to it with: ldapsearch -Z -d 16383 -LLL -b cn=admin,dc=my,dc=server,dc=ltd -w "foo.bar" -S cn -h my.server.ltd -p 636 cn I have these logs : [slapd] daemon: activity on 1 descriptor >>> slap_listener(ldaps:///)daemon: listen=7, new connection on 11 ldap_pvt_gethostbyname_a: host=my, r=0 daemon: added 11r (active) listener=(nil) conn=0 fd=11 ACCEPT from IP=xx.yy.zz.aa:38806 (IP=0.0.0.0:636) daemon: select: listen=6 active_threads=0 tvp=NULL daemon: select: listen=7 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 11r daemon: read activity on 11 connection_get(11) connection_get(11): got connid=0 connection_read(11): checking for input on id=0 TLS trace: SSL_accept:before/accept initialization tls_read: want=11, got=11 0000: 30 3e 02 01 01 63 39 04 00 0a 01 0>...c9.... TLS trace: SSL_accept:error in SSLv2/v3 read client hello A TLS: can't accept. TLS: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol s23_srvr.c:562 connection_read(11): TLS accept failure error=-1 id=0, closing connection_closing: readying conn=0 sd=11 for close connection_close: conn=0 sd=11 daemon: removing 11 conn=0 fd=11 closed (TLS negotiation failure) daemon: select: listen=6 active_threads=0 tvp=NULL daemon: select: listen=7 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: waked daemon: select: listen=6 active_threads=0 tvp=NULL daemon: select: listen=7 active_threads=0 tvp=NULL [ldapsearch] ldap_create ldap_url_parse_ext(ldap://my.server.ltd:636) ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_build_search_req ATTRS: supportedSASLMechanisms ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP my.server.ltd:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying xx.yy.zz.aa:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0xb92b6d68 ptr=0xb92b6d68 end=0xb92b6da8 len=64 0000: 30 3e 02 01 01 63 39 04 00 0a 01 00 0a 01 00 02 0>...c9......... 0010: 01 00 02 01 00 01 01 00 87 0b 6f 62 6a 65 63 74 ..........object 0020: 63 6c 61 73 73 30 19 04 17 73 75 70 70 6f 72 74 class0...support 0030: 65 64 53 41 53 4c 4d 65 63 68 61 6e 69 73 6d 73 edSASLMechanisms ber_scanf fmt ({) ber: ber_dump: buf=0xb92b6d68 ptr=0xb92b6d6d end=0xb92b6da8 len=59 0000: 63 39 04 00 0a 01 00 0a 01 00 02 01 00 02 01 00 c9.............. 0010: 01 01 00 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 .....objectclass 0020: 30 19 04 17 73 75 70 70 6f 72 74 65 64 53 41 53 0...supportedSAS 0030: 4c 4d 65 63 68 61 6e 69 73 6d 73 LMechanisms ber_flush2: 64 bytes to sd 3 0000: 30 3e 02 01 01 63 39 04 00 0a 01 00 0a 01 00 02 0>...c9......... 0010: 01 00 02 01 00 01 01 00 87 0b 6f 62 6a 65 63 74 ..........object 0020: 63 6c 61 73 73 30 19 04 17 73 75 70 70 6f 72 74 class0...support 0030: 65 64 53 41 53 4c 4d 65 63 68 61 6e 69 73 6d 73 edSASLMechanisms ldap_write: want=64, written=64 0000: 30 3e 02 01 01 63 39 04 00 0a 01 00 0a 01 00 02 0>...c9......... 0010: 01 00 02 01 00 01 01 00 87 0b 6f 62 6a 65 63 74 ..........object 0020: 63 6c 61 73 73 30 19 04 17 73 75 70 70 6f 72 74 class0...support 0030: 65 64 53 41 53 4c 4d 65 63 68 61 6e 69 73 6d 73 edSASLMechanisms ldap_result ld 0xb92ae158 msgid 1 wait4msg ld 0xb92ae158 msgid 1 (infinite timeout) wait4msg continue ld 0xb92ae158 msgid 1 all 1 ** ld 0xb92ae158 Connections: * host: my.server.ltd port: 636 (default) refcnt: 2 status: Connected last used: Wed Jul 7 12:11:03 2010 ** ld 0xb92ae158 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0xb92ae158 request count 1 (abandoned 0) ** ld 0xb92ae158 Response Queue: Empty ld 0xb92ae158 response count 0 ldap_chkResponseList ld 0xb92ae158 msgid 1 all 1 ldap_chkResponseList returns ld 0xb92ae158 NULL ldap_int_select read1msg: ld 0xb92ae158 msgid 1 all 1 ber_get_next ldap_read: want=8, got=0 ber_get_next failed. ldap_err2string ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) I really don't know what to do. My certificates are correct I guess, as we're using them in apache for https... For information, they are self-signed. Any help would be great. Thank you! Best regards, C. -- Cédric Jeanneret | System Administrator 021 619 10 32 | Camptocamp SA cedric.jeanneret(a)camptocamp.com | PSE-A / EPFL

3 2

OpenLDAP, PADL and querying multiple ADs
by Markus 07 Jul '10

07 Jul '10

Hello list, I'm on SLES 11 and the mission is to allow Active Directory (AD) users to log in to Linux. The difficulty is that those users are stored in two separate ADs which have no connection to each other. Both ADs are running on Windows 2003 R2 (or later) and I'm using the LDAP PADL NSS (/etc/ldap.conf) implementation to map the UNIX attributes that are stored in the AD to local values (homedir, shell, UID/GID etc.). So far so good, everything works fine (getent passwd, PAM logins). Now, when searching for a solution on how to query two ADs via LDAP at the same time it seems like OpenLDAP supports multiple LDAP search bases, and there was also a mentioning of the translucent overlay feature, so I suppose using OpenLDAP I could fetch the UNIX attributes from both ADs simultaneously. What completely puzzles me is the NSS/PAM configuration and how PADL NSS and OpenLDAP interact respectively not interact: - If I configure OpenLDAP (/etc/openldap/ldap.conf) instead of PADL NSS (/etc/ldap.conf) how do I configure NSS/PAM for OpenLDAP? I need "getent passwd" and "getent group" and of course PAM logins to work. E.g. getent passwd has to give me back all users from BOTH ADs that have UNIX attributes stored. But since there seems to be only the PADL NSS module in existance (/lib/libnss_ldap.so.2), I am clueless on how to integrate the OpenLDAP variant. Shouldn't there be something like /lib/libnss_openldap.so and shouldn't I be able to add something like "passwd: compat openldap" to /etc/nsswitch.conf? I guess not, but I don't understand why. - So that leaves me with the idea of *somehow* fetching the UNIX attributes from both ADs via OpenLDAP, set up a local OpenLDAP server to store this information in, and then using the PADL NSS module to query it. I'm not sure if this is the right approach or if this is even technically feasible. Is there maybe a easier way with less overhead (e.g. no OpenLDAP server required). Thank you very much for any hints or pointers that you might share with me! I'm really lost... Best regards Markus

4 6

How to batch modify large amount of entries without increasing replication latency
by Mark Bishop 07 Jul '10

07 Jul '10

We are currently using the following: OpenLDAP 2.3.43 standard syncprov overlay configuration below 1 master and 3 replicas each on 15k RAID 10. Problem is batch modifications (perl ldapmod) consisting of modifying a large number of entries ( > 50k ) will cause major replication delays after a few hours. The entry updates tend to be small eg adding a new non-indexed attribute and we throttle down the update to only 3 entries per second. What is the recommended way to batch modify large amounts of entries without taking the directory (master or replica) offline. Furthermore what is the expected replication throughput eg mods/sec that will sustain no replication delay. Any and all advice greatly appreciated. Thank you, Mark MASTER replication config == overlay syncprov syncprov-checkpoint 50 10 syncprov-sessionlog 100 REPLICA replication config == syncrepl rid=RID provider=MASTER_URI type=refreshAndPersist searchbase=SEARCH_BASE binddn=BINDDN credentials=BINDPASSWORD retry="30 +"

2 1

syncrepl only database ACLs?
by Chris 07 Jul '10

07 Jul '10

I've been trying to see if I can synchronize the ACLs for a database from one master to several other slaves. If I align the database in the config so it has the same name/index, it tries to synchronize, but so far I've only been able to manage either LDAP_NOT_ALLOWED_ON_RDN or a segfault. Here is the config on the slave when it segfaults: database config rootdn blah blah blah syncrepl rid=203 provider=ldaps://ldap.domain.com type=refreshOnly interval=00:00:10:00 retry="15 10 300 3" binddn="cn=replicator,dc=domain,dc=com" bindmethod=simple credentials=secret searchbase="olcDatabase={1}bdb,cn=config" scope=base attrs="olcAccess" attrsonly schemachecking=off Is this possible to do, or am I fighting a losing battle?

2 1

Re: Question about password storage.
by Dan White 07 Jul '10

07 Jul '10

On 06/07/10 15:44 -0700, Bryan Boone wrote: >Hi Dan thanks for the information. Let me see if I understand now. > >#1. If I write an application that uses plain LDAP for authentication. >First I will need to make sure that the openLDAP server has a userPassword >that uses lets say {crypt} hash. Then, in my application I will need to >hash the clear text password using {crypt}, then bind (transmitt over the >network) using the hashed password. Is that correct? No. If you hash the password within the userPassword attribute, then you will need to submit the cleartext password to the server for hashing verification. This process is akin to the Unix crypt process for password verification. See the man pages for crypt, or http://en.wikipedia.org/wiki/Crypt_(Unix). It offers no network protection in itself. >#2. For better security I would use ldap_start_tls. But the same >password limitations would exist as in #1. Is that correct? > >#3. If a customer has a special environment and has clear text passwords >stored in openLDAP. Then the chances are that they will have a special >front-end software (SASL binding) that is more robust and is able to >perform better authentication methods that do not transmitt the password >across the network (ie Digest-MD5). Is this correct? DIGEST-MD5 does not transmit the password across the network, that part is correct. If you're writing your own application, then you have the opportunity to develop your SASL logic up front. Fortunately the OpenLDAP client libraries do the bulk of the work for you. Many (but not all) clients already support SASL. Either way, you should consider making TLS a requirement for your users. >________________________________ >From: Dan White <dwhite(a)olp.net> >To: Bryan Boone <v_1bboon(a)yahoo.com> >Cc: openldap-technical(a)openldap.org >Sent: Tue, July 6, 2010 3:12:00 PM >Subject: Re: Question about password storage. > >On 06/07/10 14:44 -0700, Bryan Boone wrote: >>If it is not typical to store passwords in LDAP in hashed form. Then how >>are you supposed to bind to LDAP without transmitting the clear text >>password across the network? I understand that SSL and Kerberos will fix >>this problem, but what if a user just wants to use plain LDAP? Would I >>need to dictate to a customer that they must use a hash alg. in the >>userPassword in this case? > >I believe your question is based on a misinterpretation of the above. >Storing the password in clear text within the userPassword attribute opens >up several SASL based authentication mechanisms which do not transmit the >password over the network, such as with DIGEST-MD5 (See RFC 2831). -- Dan White

1 0

Question about password storage.
by Bryan Boone 07 Jul '10

07 Jul '10

Hi everyone. I just read this information. 14.4. Password Storage LDAP passwords are normally stored in the userPassword attribute. RFC4519 specifies that passwords are not stored in encrypted (or hashed) form. This allows a wide range of password-based authentication mechanisms, such as DIGEST-MD5 to be used. This is also the most interoperable storage scheme. However, it may be desirable to store a hash of password instead. slapd(8) supports a variety of storage schemes for the administrator to choose from. If it is not typical to store passwords in LDAP in hashed form. Then how are you supposed to bind to LDAP without transmitting the clear text password across the network? I understand that SSL and Kerberos will fix this problem, but what if a user just wants to use plain LDAP? Would I need to dictate to a customer that they must use a hash alg. in the userPassword in this case? thanks

3 2

How to modify a single attribute from multiple list of attributes
by Tom Leach 06 Jul '10

06 Jul '10

How do I modify/delete a single attribute from the directory when I have multiple attributes of the same name. For example, given the following ldif: dn: cn=config,o=dhcp cn: config objectClass: top objectClass: dhcpService objectClass: dhcpOptions dhcpPrimaryDN: cn=server1,o=dhcp dhcpStatements: default-lease-time 600 dhcpStatements: max-lease-time 1200 dhcpStatements: ddns-update-style none dhcpStatements: boot-unknown-clients on dhcpStatements: log-facility local7 How would I modify just one of the dhcpStatements: attributes, for example, change 'dhcpStatements: log-facility local7' to 'dhcpStatements: log-facility local3'? I've tried an ldif with: dn: cn=config,o=dhcp changetype: modify replace: dhcpStatements log-facility local7 dhcpStatements: log-facility local3 But that just gave me an error: ldapmodify: Undefined attribute type (17) additional info: dhcpStatements log-facility local7: AttributeDescription contains inappropriate characters. I've also tried: dn: cn=config,o=dhcp changetype: modify replace: dhcpStatements dhcpStatements: log-facility local3 But that just gave me an error: replace modify: dhcpStatements replace dhcpStatements: log-facility local3 modifying entry "cn=config,o=dhcp" modify complete ldapmodify: Undefined attribute type (17) additional info: modify: attribute type undefined I can use 'delete: dhcpStatements' but that deletes all of the dhcpStatements and then I have to add all of them back with the modification to the one that's needed. So, what ldapmodify/ldif syntax is needed to specify which of multiple attributes should be modified? Thanks! Tom Leach

4 4

nssov overlay socket and chrooted software
by btb＠bitrate.net 06 Jul '10

06 Jul '10

hi- i'm using the nssov overlay, which is hard coded (i believe?) to present it's socket at /var/run/nslcd/socket. this presents a problem for software (in this particular case, postfix) that is chrooted and can't see the socket. can i configure the overlay to create multiple sockets (sort of along the same lines as rsyslog, for example)? regards -ben

2 1

ldap_bind: Can't contact LDAP server (-1)
by Aldo 06 Jul '10

06 Jul '10

Greetings, Any pointers about this question will be greatly appreciated. Thanks in advanced. I've searched all over and tried all suggestions I found so far without success. I've setup a VMWare virtual machine. It's CentOS 5.4 with a static ip address --HostOnly. My initial setup was with default, no TLS. This worked cleanly. I could login with a configured LDAP account. Then I configured TLS and I cannot login with any regular user account, be it LDAP account or local user account. I can only login as root. The /var/log/messages says: Jul 2 17:55:53 ldapServer xfs: nss_ldap: failed to bind to LDAP server ldaps://192.168.150.133/: Can't contact LDAP server Jul 2 17:55:53 ldapServer xfs: nss_ldap: could not search LDAP server - Server is unavailable A QUICK TEST AT THE CLI SAYS: [root@ldapServer]# ldapsearch -x ldap_bind: Can't contact LDAP server (-1) [root@ldapServer]# slapindex bdb_db_open: database already in use backend_startup_one: bi_db_open failed! (-1) slap_startup failed =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- I DID A SERVICE AND CONFIGURATION CHECK [root@ldapServer]# chkconfig --list | grep ldap ldap 0:off 1:off 2:off 3:on 4:off 5:on 6:off [root@ldapServer]# /etc/init.d/ldap stop Stopping slapd: [ OK ] [root@ldapServer openldap]# /etc/init.d/ldap start Checking configuration files for slapd: config file testing succeeded [ OK ] Starting slapd: [ OK ] [root@ldapServerp]# /usr/sbin/slaptest -v -f /etc/openldap/slapd.conf -u config file testing succeeded [root@ldapServer]# service ldap configtest Checking configuration files for slapd: config file testing succeeded [ OK ] THE SERVICE IS RUNNING [root@ldapServer]# ps -ef | grep ldap ldap 7027 1 0 17:12 ? 00:00:00 /usr/sbin/slapd -h ldaps:/// -u ldap THE REQUIRED PORT 636 IS LISTENING. [root@ldapServer]# fuser -n tcp 636 636/tcp: 7027 [root@ldapServer ~]# telnet localhost 636 Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. Connection closed by foreign host. [root@ldapServer ~]# netstat -a | grep ldap tcp 0 0 *:ldaps *:* LISTEN tcp 0 0 *:ldaps *:* LISTEN =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- THE CONFIG FILES [root@ldapServer]# cat /etc/openldap/ldap.conf HOST 127.0.0.1 BASE dc=ldapServer,dc=lan URI ldap://127.0.0.1/ TLS_CACERTDIR /etc/openldap/cacerts [root@ldapServer]# cat /etc/openldap/slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args TLSCACertificateFile /etc/openldap/cacerts/server.pem TLSCertificateFile /etc/openldap/cacerts/server.pem TLSCertificateKeyFile /etc/openldap/cacerts/server.pem database bdb suffix "dc=ldapServer,dc=lan" rootdn "cn=Manager,dc=ldapServer,dc=lan" rootpw xxxxxxxxxxxxxxxxxxxxxxxx directory /var/lib/ldap =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- ~af

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical July 2010