openldap-technical July 2010

openldap-technical@openldap.org

103 participants
126 discussions

mechanism to disable nss_ldap per process in nss-pam-ldapd
by Arthur de Jong 19 Jul '10

19 Jul '10

With release 0.7.7 of nss-pam-ldapd there is a new mechanism available for a process to disable lookups using the nss_ldap module. The nslcd daemon uses this to avoid name lookup loops (e.g. when doing a host name lookup for an LDAP server which may result in an nslcd request, etc). The code to do this is in disable_nss_ldap() in nslcd/nslcd.c. This may be of interest for the nssov module. The chance of something like that happening is probably lower in nssov (because most information is looked up internally) but it is probably a good idea to avoid such loops anyway. -- -- arthur - arthur(a)arthurdejong.org - http://arthurdejong.org --

1 0

question about client certs
by Bryan Boone 19 Jul '10

19 Jul '10

Hi everyone. I am writting a small LDAP client. I am just learning LDAP. I need to provide LDAP over SSL. I assume that when I use the ldap_start_tls_s() function that there is a public key that is passed to my client. How do I find out where this cert is stored on the client machine? I tried to use the code... char *base; char *temp = base; if (ldap_get_option(ld, LDAP_OPT_X_TLS_CACERTFILE, (void **) (char *) &temp) != LDAP_SUCCESS) { ldap_perror(ld, "ldap_get_option"); return (1); } But that didn't seem to provide me the path. Perhaps I don't really know what this function does. thanks

1 0

Problems with slapd and access rules
by Licause, Al 19 Jul '10

19 Jul '10

I am having problems with access control in slapd.conf. If I leave all access control commented in slapd.conf, the ssh user can login and id works. But if the users password expires though the use of the ppolicy directives, they are prompted to change the password but cannot due to an Insufficient access error: # ssh -l ldap1 localhost ldap1@localhost's password: You are required to change your LDAP password immediately. Last login: Mon Jul 19 10:06:53 2010 from localhost WARNING: Your password has expired. You must change your password now and login again! Changing password for user ldap1. Enter login(LDAP) password: New password: Retype new password: LDAP password information update failed: Insufficient access passwd: Authentication token manipulation error Connection to localhost closed. These are the openldap components installed on the system: # rpm -qa | grep ldap compat-openldap-2.4.19_2.3.43-11.el6.i686 krb5-server-ldap-1.8.1-6.el6.i686 apr-util-ldap-1.3.9-3.el6.i686 mozldap-6.0.5-6.2.el6.i686 openldap-servers-2.4.19-11.el6.i686 python-ldap-2.3.10-1.el6.i686 openldap-clients-2.4.19-11.el6.i686 mozldap-devel-6.0.5-6.2.el6.i686 bind-dyndb-ldap-0.1.0-0.9.b.el6.i686 nss-pam-ldapd-0.7.5-3.el6.i686 pam_ldap-185-5.el6.i686 openldap-devel-2.4.19-11.el6.i686 openldap-2.4.19-11.el6.i686 This is a beta release of Red Hat Enterprise v6, but it would seem the Openldap components should work regardless of the OS components. I am working with this version of Red Hat to get some experience with the V2.4* Openldap stream, realizing that this is not the latest version of openldap. I have tried various access control in slapd.conf that worked quite well in V2.3* of openldap and released versions of Red Hat OS but any attempt to comment any of the follow lines from slapd.conf, results in a complete failure of the ldap client to talk to the server. #access to attrs=userPassword # by self write # by anonymous auth # by dn.base="cn=Manager,dc=osn,dc=cxo,dc=cpqcorp,dc=net" write # by * none # by * auth I would like to understand the rules comfortably before moving to interactive rulesets and slapd configuration so I am working with slapd.conf. I have read through the attribute section of the v2.4 Admin guide and believe I understand the concepts and syntax, but perhaps I am missing something. I donf't know if Red Hat may have added something unique to this mix. When you run their authconfig utility to get a base set of ldap configuration attributes, it no longer updates /etc/ldap.conf but instead it updates /etc/pam_ldap.conf. It also attempts to configure and start something called nslcd.conf and it's corresponding daemon, nslcd. nslcd - local LDAP name service daemon. This daemon has it's own configuration file which looks just like the contents of ldap.conf. If this daemon is not runing, it also appears that the ldap service does not exist and id and ssh both fail.....id can't find the user and ssh is denied login access as though the passwords are invalid. I copied the contents of pam_ldap.conf to /etc/ldap.conf to see if that makes a difference: /etc/ldap.conf: base dc=osn,dc=cxo,dc=cpqcorp,dc=net binddn cn=Manager,dc=osn,dc=cxo,dc=cpqcorp,dc=net bindpw secret ssl no pam_lookup_policy yes pam_password exop uri ldap://16.112.240.253/ Is Red Hat doing something unique here ? Have they bypassed the client's /etc/ldap.conf file in favor of this new nslcd daemon and pam_ldap.conf file ? Strings on pam_ldap.so does show a reference to /etc/pam_ldap.conf but nothing for /etc/ldap.conf I've tried reading through the various README and other docs supplied with this stuff but nothing seems to indicate a major change in how the ldap client accesses the ldap server in this version of Red Hat. Can anyone shed some light on this ? Can I assume that generic openldap clients still expect to use /etc/ldap.conf as the one and only ldap configuration file and nothing else ? Al Licause

2 1

accesslog overlay doesnt work
by Gianluigi Nigro 19 Jul '10

19 Jul '10

Hi, on an empty and clean database (running for the first time) I get the error: Jul 19 17:14:54 centostest slapd[27698]: @(#) $OpenLDAP: slapd 2.4.21 (Jul 19 2010 15:47:56) $ root@centostest.passepartout.local:/opt/openldap-2.4.21/servers/slapd Jul 19 17:14:55 centostest slapd[27699]: bdb_monitor_db_open: monitoring disabled; configure monitor database to enable Jul 19 17:14:55 centostest slapd[27699]: bdb_db_open: database "cn=accesslog": unclean shutdown detected; attempting recovery. Jul 19 17:14:55 centostest slapd[27699]: bdb_db_open: warning - no DB_CONFIG file found in directory /opt/ldap/var/openldap-data: (14). Expect poor performance for suffix "cn=accesslog". Jul 19 17:14:55 centostest slapd[27699]: slapd starting Jul 19 17:14:55 centostest slapd[27699]: bdb(dc=passcom,dc=it): PANIC: fatal region error detected; run recovery slapd.conf looks like this: include /opt/ldap/etc/openldap/schema/core.schema include /opt/ldap/etc/openldap/schema/local.schema include /opt/ldap/etc/openldap/schema/cosine.schema include /opt/ldap/etc/openldap/schema/dnszone.schema pidfile /opt/ldap/var/run/slapd.pid argsfile /opt/ldap/var/run/slapd.args modulepath /opt/ldap/libexec/openldap moduleload accesslog.la database bdb suffix "dc=passcom,dc=it" rootdn "cn=Manager,dc=passcom,dc=it" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw ***secret*** # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /opt/ldap/var/openldap-data # Indices to maintain index objectClass eq overlay accesslog logdb "cn=accesslog" database bdb suffix "cn=accesslog" index reqStart eq Any help is appreciated. -------------------------------------------------------------------- Il contenuto di questo messaggio di posta elettronica e ogni eventuale documento a quest'ultimo allegato puo contenere informazioni la cui riservatezza e' tutelata ed e' rivolto unicamente agli effettivi destinatari i quali prendono atto del carattere non strettamente personale dei messaggi di risposta, che potranno essere noti all'organizzazione aziendale. Sono vietati la riproduzione e l'uso di questo messaggio in mancanza di autorizzazione del destinatario. Se avete ricevuto questo messaggio per errore, vogliate cortesemente chiamarci immediatamente per telefono o fax e distruggere quanto ricevuto (compresi i file allegati) senza farne copia. Qualsivoglia utilizzo non autorizzato del contenuto di questo messaggio costituisce violazione dell'obbligo di non prendere cognizione della corrispondenza tra altri soggetti.

2 1

ldapi:// confidentiality required: different olcSecurity settings (cn=config and olcDatabase={-1}frontend.ldif)
by openldap-ml＠stresst.net 18 Jul '10

18 Jul '10

It took me quite some time to figure out a small configuration error (concerning ldapi:// confidentiality required) and I just want to let you know about it and possibly save you some time during your next debugging session: Security strength factor "olcSecurity: ..." values that are differing between cn=config.ldif and for example cn=config/olcDatabase={-1}frontend.ldif might lead to strange ldapi-related "confidentiality required" effects that temporarily disappear right after online-re-configuration (via cn=config) - but they appear again right after any slapd restart... Disclaimer: The cause for the problem (differing cn=config database-specific olcSecurity values) is a result of a mis-configuration and don't seems to be a general slapd problem, but as we are all able to online (mis-)configure slapd via cn=config it's possibly of common interest. ;-) Only in case there's no need for these kind of differences (for any special slapd configuration scenario) might be slapd could detect them and inform the user about it? After re-aligning cn=config.ldif's and cn=config/olcDatabase={-1}frontend.ldif's olcSecurity settings the following strange behavior has disappeared and slapd runs and answers fine - even after its restart. slapd version: CVS HEAD 1.) empty database directory: root@tingletangle:/usr/local/openldap/etc/openldap# ls -al /usr/local/openldap/var/openldap-data/foo.bar/* -rw-r--r-- 1 openldap openldap 368 Jun 17 22:50 /usr/local/openldap/var/openldap-data/foo.bar/DB_CONFIG 2.) relevant slapd.d's content: root@tingletangle:/usr/local/openldap/etc/openldap# grep -r olcSec slapd.d/ slapd.d/cn=config.ldif:olcSecurity: simple_bind=128 slapd.d/cn=config.ldif:olcSecurity: ssf=128 slapd.d/cn=config.ldif:olcSecurity: tls=0 slapd.d/cn=config/olcDatabase={1}monitor.ldif:olcSecurity: ssf=128 slapd.d/cn=config/olcDatabase={1}monitor.ldif:olcSecurity: tls=128 slapd.d/cn=config/olcDatabase={1}monitor.ldif:olcSecurity: update_ssf=128 slapd.d/cn=config/olcDatabase={1}monitor.ldif:olcSecurity: simple_bind=128 slapd.d/cn=config/cn=schema.ldif:olcAttributeTypes: ( OLcfgGlAt:59 NAME 'olcSecurity' EQUALITY caseIgnoreMatch slapd.d/cn=config/cn=schema.ldif: ontUseCopyIgnore $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity slapd.d/cn=config/cn=schema.ldif: cRequires $ olcRestrict $ olcRootDN $ olcRootPW $ olcSchemaDN $ olcSecurity $ slapd.d/cn=config/olcDatabase={-1}frontend.ldif:olcSecurity: ssf=128 slapd.d/cn=config/olcDatabase={-1}frontend.ldif:olcSecurity: tls=128 slapd.d/cn=config/olcDatabase={-1}frontend.ldif:olcSecurity: update_ssf=128 slapd.d/cn=config/olcDatabase={-1}frontend.ldif:olcSecurity: simple_bind=128 root@tingletangle:/usr/local/openldap/etc/openldap# grep -r olcLocal slapd.d/ slapd.d/cn=config.ldif:olcLocalSSF: 128 slapd.d/cn=config/cn=schema.ldif:olcAttributeTypes: ( OLcfgGlAt:26 NAME 'olcLocalSSF' SYNTAX OMsInteger SINGLE- slapd.d/cn=config/cn=schema.ldif: p $ olcIndexIntLen $ olcLocalSSF $ olcLogFile $ olcLogLevel $ olcPasswordCryp root@tingletangle:/usr/local/openldap/etc/openldap# grep -r olcSaslSecProps slapd.d/ slapd.d/cn=config.ldif:olcSaslSecProps: noplain,noanonymous slapd.d/cn=config/cn=schema.ldif:olcAttributeTypes: ( OLcfgGlAt:56 NAME 'olcSaslSecProps' SYNTAX OMsDirectorySt slapd.d/cn=config/cn=schema.ldif: ontUseCopyIgnore $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity summary (cn=config.ldif): olcSecurity: simple_bind=128 olcSecurity: ssf=128 olcSecurity: tls=0 olcLocalSSF: 128 olcSaslSecProps: noplain,noanonymous summary (olcDatabase={-1}frontend.ldif and olcDatabase={1}monitor.ldif) olcSecurity: ssf=128 olcSecurity: tls=128 olcSecurity: update_ssf=128 olcSecurity: simple_bind=128 So, now let's have some fun with the above configuration especially with points 8.) 12.) 14.) 22.) 23.) 3.) populate slapd's database (data + cn=config) and index the data: /usr/local/openldap/sbin/slapadd -v -F slapd.d -b "dc=foo,dc=bar" -l dump-dc\=foo\,dc\=bar-20100718.ldif /usr/local/openldap/sbin/slapindex -v -F slapd.d -b "dc=foo,dc=bar" chown -R openldap:openldap /usr/local/openldap 4.) start slapd: /usr/local/openldap/libexec/slapd \ -F /usr/local/openldap/etc/openldap/slapd.d \ -u openldap -g openldap \ -l local4 \ -h "ldaps://0.0.0.0:636/ ldap://0.0.0.0:389 ldapi:/// ldap://[::]:389/ ldaps://[::]:636/" 5.) check whether slapd is running: root@tingletangle:/usr/local/openldap/etc/openldap# ps -ef | grep slapd | grep -v grep openldap 1605 1 1 23:43 ? 00:00:00 /usr/local/openldap/libexec/slapd -F /usr/local/openldap/etc/openldap/slapd.d -u openldap -g openldap -l local4 -h ldaps://0.0.0.0:636/ ldap://0.0.0.0:389 ldapi:/// ldap://[::]:389/ ldaps://[::]:636/ 6.) check slapd's listeners: root@tingletangle:/usr/local/openldap/etc/openldap# netstat -nap | grep slapd tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 1605/slapd tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 1605/slapd tcp6 0 0 :::389 :::* LISTEN 1605/slapd tcp6 0 0 :::636 :::* LISTEN 1605/slapd unix 2 [ ACC ] STREAM LISTENING 4730 1605/slapd /usr/local/openldap/var/run/ldapi unix 2 [ ] DGRAM 4724 1605/slapd 7.) check cn=config's content: 7a1.) ldapsearch cn=config (ldapi:// without -Z): root@tingletangle:/usr/local/openldap/etc/openldap# /usr/local/openldap/bin/ldapsearch -x -H ldapi://%2Fusr%2Flocal%2Fopenldap%2Fvar%2Frun%2Fldapi -D "cn=ldapmanager,cn=config" -W -b 'cn=config' -s base olcSecurity olcSaslSecProps olcLocalSSF Enter LDAP Password: ldap_bind: Confidentiality required (13) additional info: TLS confidentiality required 7a2.) ldapsearch cn=config (ldap:// without -Z): root@tingletangle:/usr/local/openldap/etc/openldap# /usr/local/openldap/bin/ldapsearch -x -H ldap://localhost -D "cn=ldapmanager,cn=config" -W -b 'cn=config' -s base olcSecurity olcSaslSecProps olcLocalSSF Enter LDAP Password: ldap_bind: Confidentiality required (13) additional info: TLS confidentiality required 7b1.) ldapsearch cn=config (ldapi:// with -Z): root@tingletangle:/usr/local/openldap/etc/openldap# /usr/local/openldap/bin/ldapsearch -x -H ldapi://%2Fusr%2Flocal%2Fopenldap%2Fvar%2Frun%2Fldapi -D "cn=ldapmanager,cn=config" -W -b 'cn=config' -s base -Z olcSecurity olcSaslSecProps olcLocalSSF Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=config> with scope baseObject # filter: (objectclass=*) # requesting: olcSecurity olcSaslSecProps olcLocalSSF # # config dn: cn=config olcLocalSSF: 128 olcSaslSecProps: noplain,noanonymous olcSecurity: simple_bind=128 olcSecurity: ssf=128 olcSecurity: tls=0 # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 7b2.) ldapsearch cn=config (ldap:// with -Z): root@tingletangle:/usr/local/openldap/etc/openldap# /usr/local/openldap/bin/ldapsearch -x -H ldap://localhost -D "cn=ldapmanager,cn=config" -W -b 'cn=config' -s base -Z olcSecurity olcSaslSecProps olcLocalSSF Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=config> with scope baseObject # filter: (objectclass=*) # requesting: olcSecurity olcSaslSecProps olcLocalSSF # # config dn: cn=config olcLocalSSF: 128 olcSaslSecProps: noplain,noanonymous olcSecurity: simple_bind=128 olcSecurity: ssf=128 olcSecurity: tls=0 # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 8.) change "olcSecurity: tls=0" into "olcSecurity: tls=1" root@tingletangle:/usr/local/openldap/etc/openldap# /usr/local/openldap/bin/ldapmodify -v -a -x -H ldap://localhost -D "cn=ldapmanager,cn=config" -W -Z -f tls_modify_0-1.ldif ldap_initialize( ldap://localhost:389/??base ) Enter LDAP Password: delete olcSecurity: tls=0 add olcSecurity: tls=1 modifying entry "cn=config" modify complete 9.) check whether modify in deed completed: root@tingletangle:/usr/local/openldap/etc/openldap# /usr/local/openldap/bin/ldapsearch -x -H ldap://localhost -D "cn=ldapmanager,cn=config" -W -b 'cn=config' -s base -Z olcSecurity olcSaslSecProps olcLocalSSF Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=config> with scope baseObject # filter: (objectclass=*) # requesting: olcSecurity olcSaslSecProps olcLocalSSF # # config dn: cn=config olcLocalSSF: 128 olcSaslSecProps: noplain,noanonymous olcSecurity: simple_bind=128 olcSecurity: ssf=128 olcSecurity: tls=1 # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 10.) ldapsearch cn=config (ldapi:// without -Z): root@tingletangle:/usr/local/openldap/etc/openldap# /usr/local/openldap/bin/ldapsearch -x -H ldapi://%2Fusr%2Flocal%2Fopenldap%2Fvar%2Frun%2Fldapi -D "cn=ldapmanager,cn=config" -W -b 'cn=config' -s base olcSecurity olcSaslSecProps olcLocalSSF Enter LDAP Password: ldap_bind: Confidentiality required (13) additional info: TLS confidentiality required 11.) ldapsearch cn=config (ldapi:// with -Z): root@tingletangle:/usr/local/openldap/etc/openldap# /usr/local/openldap/bin/ldapsearch -x -H ldapi://%2Fusr%2Flocal%2Fopenldap%2Fvar%2Frun%2Fldapi -D "cn=ldapmanager,cn=config" -W -b 'cn=config' -s base -Z olcSecurity olcSaslSecProps olcLocalSSF Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=config> with scope baseObject # filter: (objectclass=*) # requesting: olcSecurity olcSaslSecProps olcLocalSSF # # config dn: cn=config olcLocalSSF: 128 olcSaslSecProps: noplain,noanonymous olcSecurity: simple_bind=128 olcSecurity: ssf=128 olcSecurity: tls=1 # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 12.) change "olcSecurity: tls=1" back into "olcSecurity: tls=0" root@tingletangle:/usr/local/openldap/etc/openldap# /usr/local/openldap/bin/ldapmodify -v -a -x -H ldap://localhost -D "cn=ldapmanager,cn=config" -W -Z -f tls_modify_1-0.ldif ldap_initialize( ldap://localhost:389/??base ) Enter LDAP Password: delete olcSecurity: tls=1 add olcSecurity: tls=0 modifying entry "cn=config" modify complete 13.) check whether modify in deed completed: root@tingletangle:/usr/local/openldap/etc/openldap# /usr/local/openldap/bin/ldapsearch -x -H ldap://localhost -D "cn=ldapmanager,cn=config" -W -b 'cn=config' -s base -Z olcSecurity olcSaslSecProps olcLocalSSF Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=config> with scope baseObject # filter: (objectclass=*) # requesting: olcSecurity olcSaslSecProps olcLocalSSF # # config dn: cn=config olcLocalSSF: 128 olcSaslSecProps: noplain,noanonymous olcSecurity: simple_bind=128 olcSecurity: ssf=128 olcSecurity: tls=0 # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 14.) ldapsearch cn=config (ldapi:// without -Z now seem to work?!): root@tingletangle:/usr/local/openldap/etc/openldap# /usr/local/openldap/bin/ldapsearch -x -H ldapi://%2Fusr%2Flocal%2Fopenldap%2Fvar%2Frun%2Fldapi -D "cn=ldapmanager,cn=config" -W -b 'cn=config' -s base olcSecurity olcSaslSecProps olcLocalSSF Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=config> with scope baseObject # filter: (objectclass=*) # requesting: olcSecurity olcSaslSecProps olcLocalSSF # # config dn: cn=config olcLocalSSF: 128 olcSaslSecProps: noplain,noanonymous olcSecurity: simple_bind=128 olcSecurity: ssf=128 olcSecurity: tls=0 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 15.) ldapsearch cn=config (ldapi:// with -Z): root@tingletangle:/usr/local/openldap/etc/openldap# /usr/local/openldap/bin/ldapsearch -x -H ldapi://%2Fusr%2Flocal%2Fopenldap%2Fvar%2Frun%2Fldapi -D "cn=ldapmanager,cn=config" -W -b 'cn=config' -s base -Z olcSecurity olcSaslSecProps olcLocalSSF Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=config> with scope baseObject # filter: (objectclass=*) # requesting: olcSecurity olcSaslSecProps olcLocalSSF # # config dn: cn=config olcLocalSSF: 128 olcSaslSecProps: noplain,noanonymous olcSecurity: simple_bind=128 olcSecurity: ssf=128 olcSecurity: tls=0 # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 16.) killall slapd: root@tingletangle:/usr/local/openldap/etc/openldap# killall slapd root@tingletangle:/usr/local/openldap/etc/openldap# ps -ef | grep slap root 1650 1525 0 00:01 pts/0 00:00:00 grep slap 17.) re-check relevant slapd.d's content: root@tingletangle:/usr/local/openldap/etc/openldap# grep -r olcSec slapd.d/ slapd.d/cn=config.ldif:olcSecurity: simple_bind=128 slapd.d/cn=config.ldif:olcSecurity: ssf=128 slapd.d/cn=config.ldif:olcSecurity: tls=0 slapd.d/cn=config/olcDatabase={1}monitor.ldif:olcSecurity: ssf=128 slapd.d/cn=config/olcDatabase={1}monitor.ldif:olcSecurity: tls=128 slapd.d/cn=config/olcDatabase={1}monitor.ldif:olcSecurity: update_ssf=128 slapd.d/cn=config/olcDatabase={1}monitor.ldif:olcSecurity: simple_bind=128 slapd.d/cn=config/cn=schema.ldif:olcAttributeTypes: ( OLcfgGlAt:59 NAME 'olcSecurity' EQUALITY caseIgnoreMatch slapd.d/cn=config/cn=schema.ldif: ontUseCopyIgnore $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity slapd.d/cn=config/cn=schema.ldif: cRequires $ olcRestrict $ olcRootDN $ olcRootPW $ olcSchemaDN $ olcSecurity $ slapd.d/cn=config/olcDatabase={-1}frontend.ldif:olcSecurity: ssf=128 slapd.d/cn=config/olcDatabase={-1}frontend.ldif:olcSecurity: tls=128 slapd.d/cn=config/olcDatabase={-1}frontend.ldif:olcSecurity: update_ssf=128 slapd.d/cn=config/olcDatabase={-1}frontend.ldif:olcSecurity: simple_bind=128 root@tingletangle:/usr/local/openldap/etc/openldap# grep -r olcLocal slapd.d/ slapd.d/cn=config.ldif:olcLocalSSF: 128 slapd.d/cn=config/cn=schema.ldif:olcAttributeTypes: ( OLcfgGlAt:26 NAME 'olcLocalSSF' SYNTAX OMsInteger SINGLE- slapd.d/cn=config/cn=schema.ldif: p $ olcIndexIntLen $ olcLocalSSF $ olcLogFile $ olcLogLevel $ olcPasswordCryp root@tingletangle:/usr/local/openldap/etc/openldap# grep -r olcSaslSecProps slapd.d/ slapd.d/cn=config.ldif:olcSaslSecProps: noplain,noanonymous slapd.d/cn=config/cn=schema.ldif:olcAttributeTypes: ( OLcfgGlAt:56 NAME 'olcSaslSecProps' SYNTAX OMsDirectorySt slapd.d/cn=config/cn=schema.ldif: ontUseCopyIgnore $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity summary (cn=config.ldif): olcSecurity: simple_bind=128 olcSecurity: ssf=128 olcSecurity: tls=0 olcLocalSSF: 128 olcSaslSecProps: noplain,noanonymous summary (olcDatabase={-1}frontend.ldif) olcSecurity: ssf=128 olcSecurity: tls=128 olcSecurity: update_ssf=128 olcSecurity: simple_bind=128 18.) re-start slapd: /usr/local/openldap/libexec/slapd \ -F /usr/local/openldap/etc/openldap/slapd.d \ -u openldap -g openldap \ -l local4 \ -h "ldaps://0.0.0.0:636/ ldap://0.0.0.0:389 ldapi:/// ldap://[::]:389/ ldaps://[::]:636/" 19.) check whether slapd is running: root@tingletangle:/usr/local/openldap/etc/openldap# ps -ef | grep slapd | grep -v grep openldap 1656 1 1 00:07 ? 00:00:00 /usr/local/openldap/libexec/slapd -F /usr/local/openldap/etc/openldap/slapd.d -u openldap -g openldap -l local4 -h ldaps://0.0.0.0:636/ ldap://0.0.0.0:389 ldapi:/// ldap://[::]:389/ ldaps://[::]:636/ 20.) check slapd's listeners: root@tingletangle:/usr/local/openldap/etc/openldap# netstat -npa | grep slapd tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 1656/slapd tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 1656/slapd tcp6 0 0 :::389 :::* LISTEN 1656/slapd tcp6 0 0 :::636 :::* LISTEN 1656/slapd unix 2 [ ACC ] STREAM LISTENING 5292 1656/slapd /usr/local/openldap/var/run/ldapi unix 2 [ ] DGRAM 5286 1656/slapd 21.) ldapsearch cn=config (ldapi:// without -Z): root@tingletangle:/usr/local/openldap/etc/openldap# /usr/local/openldap/bin/ldapsearch -x -H ldapi://%2Fusr%2Flocal%2Fopenldap%2Fvar%2Frun%2Fldapi -D "cn=ldapmanager,cn=config" -W -b 'cn=config' -s base olcSecurity olcSaslSecProps olcLocalSSF Enter LDAP Password: ldap_bind: Confidentiality required (13) additional info: TLS confidentiality required 22.) ldapmodify cn=config olcSecurity: tls=0 --> tls=1 --> tls=0 root@tingletangle:/usr/local/openldap/etc/openldap# /usr/local/openldap/bin/ldapmodify -v -a -x -H ldap://localhost -D "cn=ldapmanager,cn=config" -W -Z -f tls_modify_0-1-0.ldif ldap_initialize( ldap://localhost:389/??base ) Enter LDAP Password: delete olcSecurity: tls=0 add olcSecurity: tls=1 delete olcSecurity: tls=1 add olcSecurity: tls=0 modifying entry "cn=config" modify complete 23.) ldapsearch cn=config (ldapi:// without -Z now works again until next slapd restart): root@tingletangle:/usr/local/openldap/etc/openldap# /usr/local/openldap/bin/ldapsearch -x -H ldapi://%2Fusr%2Flocal%2Fopenldap%2Fvar%2Frun%2Fldapi -D "cn=ldapmanager,cn=config" -W -b 'cn=config' -s base olcSecurity olcSaslSecProps olcLocalSSF Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=config> with scope baseObject # filter: (objectclass=*) # requesting: olcSecurity olcSaslSecProps olcLocalSSF # # config dn: cn=config olcLocalSSF: 128 olcSaslSecProps: noplain,noanonymous olcSecurity: simple_bind=128 olcSecurity: ssf=128 olcSecurity: tls=0 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1

1 0

Line breaks with slapcat
by ml ml 18 Jul '10

18 Jul '10

Hello, i get linebreaks (after i guess 80 chars) when i use: lapcat -b "somebase" -l /tmp/ldap-example.ldif.tmp This is on debian lenny. I get the same problem with stdout. Any ideas? Cheers, Mario

3 2

Changing the DN of an OpenLDAP server
by Troy Telford 17 Jul '10

17 Jul '10

I've recently needed to change my domain name. My OpenLDAP server is currently set to use "dc=master,dc=some,dc=com" And I need to change it to "dc=master,dc=other,dc=com" Obviously, the clients will need to be updated as well, but I need to start with the server. I haven't been too successful in finding how to do this; I suspect I'm just using the wrong search terms. Where can I find the documentation that explains how to do this? -- Troy Telford ttelford.groups(a)gmail.com

3 2

Re: Configuring slapd.conf-less OpenLDAP
by Benjamin Griese 17 Jul '10

17 Jul '10

Good morning. Please set logging in your hdb/bdb config ldif. This logfile should be the default. Please be sure to always reply to the mailinglist. Bye Am 29.06.2010 08:05 schrieb "Braden McDaniel" <braden(a)endoframe.com>: On Wed, 2010-06-23 at 18:35 +0200, Benjamin Griese wrote: > There is no cleartext because even that ... Hm... I've tried base64-encoding the value for olcRootPW; still no luck. :-( > What does your logfile say to your invalid passwd? > > Enable logging by setting the loglevel to... I've added olcLogLevel: 256 to cn=config.ldif. But I'm not seeing anything in /var/log/messages. Are the log messages going somewhere else? -- Braden McDaniel <braden(a)endoframe.com>

3 4

restrict all access to starttls only, with exception
by ben thielsen 16 Jul '10

16 Jul '10

hi- i have a directory to which i'd like to require starttls for any and all access, with one exception - i have a few clients which can't yet do starttls, so i'd like to accommodate them (by way of a group they're in - e.g. "by group.exact=..."), but only if they're connecting from localhost (inet, not unix). i've been reading man 5 slapd.access, and have been experimenting with peername and the various *ssf statements, but haven't yet found the proper combination. any insight is greatly appreciated. i've included my current acls below. also - where can i read more about each of the *ssf settings and what they mean? i'd like to be a bit more confident about which one i should be using. i see some description in the discussion of sasl-secprops in man 5 slapd.conf, as referenced by http://www.openldap.org/doc/admin24/access-control.html - ". transport=<n> specifies the transport security strength factor." - but that's a bit too recursive for me just yet :) . thanks- -ben current acls: {0}to attrs=userPassword by self =xw by anonymous auth by * none {1}to dn.sub="uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=com" by self manage by users read by * none {2}to filter=(&(objectclass=iphost)(cn=flip.example.com)) attrs=authorizedservice val.exact=sshd by group.exact="cn=ssh,ou=all_servers,ou=servers,ou=groups,dc=example,dc=com" compare by group.exact="cn=ssh,ou=flip,ou=servers,ou=groups,dc=example,dc=com" compare by * =dxrs {3}to filter=(&(objectclass=iphost)(cn=flip.example.com)) attrs=authorizedservice val.exact=login by group.exact="cn=console,ou=all_servers,ou=servers,ou=groups,dc=example,dc=com" compare by group.exact="cn=console,ou=flip,ou=servers,ou=groups,dc=example,dc=com" compare by * =dxrs {4}to * by self write by group.exact="cn=directory_administrators,ou=general,ou=groups,dc=example,dc=com" manage by users read by * none

1 0

Problems with C code
by Bryan Boone 16 Jul '10

16 Jul '10

Hi everyone. Can someone please tell me what is wrong with this code snippet? char **temp; if (ldap_get_option(ld, LDAP_OPT_X_TLS_CACERTDIR, temp) != LDAP_SUCCESS) { ldap_perror(ld, "ldap_get_option"); return (1); }

2 2

← Newer
1
2
3
4
5
6
7
8
9
...
13
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical July 2010