openldap-technical December 2011

openldap-technical@openldap.org

88 participants
101 discussions

Security between server and client nodes.
by Jayavant Patil 02 Dec '11

02 Dec '11

Hi, I am using openLDAP-2.4.19-4 on fedora 12 machine. I want to make server secure from client nodes so that clients don't hack the server node. Hack in the sense that one client doesn't even read the data of another client, client doesn't tamper the server directory information or try to spoof the server. Does anybody have any suggestions how to avoid these things in openLDAP? Thanks in advance. -- Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

3 14

Re: OpenLDAP syncrepl woes
by Jeffrey Crawford 01 Dec '11

01 Dec '11

On Wed, Nov 23, 2011 at 10:13 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, November 23, 2011 9:26 AM -0800 Jeffrey Crawford > <jeffreyc(a)ucsc.edu> wrote: > >> read that already: >> >> my original question was the following: >> >> Granted the above issues might be explained away in that we don't yet >> have enough ram on the machines yet, however it does seem to present >> us with a problem when we notice the discrepancy, how do we during run >> time re-sync the data from the provider server? I have tried the slapd >> -c rid=2,csn=20111114000000.000000Z but that doesn't seem to do any >> good. (I've tried several different values of csn=0 >> csn=20111114000000.000000Z#000000#000#000000 etc. to no avail) > > > Regardless of RAM limitations, you should never have an inconsistent > database. However, so far, the only replication mechanism I've seen > guarantee this is delta-syncrepl. This may be better in the upcoming > OpenLDAP 2.4.27 for syncrepl. > > If you read the slapd man page for the -c option, it is quite clear: > > Use only the rid part to force a full reload. Humm that didn't seem to work. I'm rebuilding so I'll give that another try. > > >> from man slapadd >> >> LIMITATIONS >> Your slapd(8) should not be running when you do this to ensure >> consis- tency of the database. >> >> So how can I have slapd run, respond to what data it has currently yet >> understand that it will update all it's data with the source provider >> updating, adding, removing entries as necessary without removing the >> database first? > > I don't understand why you would want slapd to respond with completely bogus > data to any clients doing queries. If you're going to force reload the > replica anyway, it makes much more sense to use slapadd from the master > rather than trying to do it via syncrepl, which can take numerous amounts of > time longer than doing it via slapadd, and during that entire time period, > you have the possibility of sending out significantly erroneous data. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 2

[***** SPAM 3.5 *****] Re: pwdCheckModule not loaded
by Raffael Sahli 01 Dec '11

01 Dec '11

Is OpenLDAP compiled with enable-modules? You should see something in the syslog with loglevel -1 or run the daemon in forderground. Are you sure your daemon reads the config file and not a config db? Clément OUDOT <clem.oudot(a)gmail.com> schrieb: >Le 1 décembre 2011 17:00, Fabian Heinz <fabian.heinz(a)xinfo.de> a écrit : >> Sorry ... >> My outbox contains the mail with list, could be some problem with my >> mailclient html vs txt >> >> It shows as text so I hope list will be kept... > >Fail. > >> I'm using Ubuntu 11.10 >> And I have tried blank and column separated with /usr/lib/ /usr/lib/ldap >> /usr/local/libexec >> Which are the directories I installed the modules to. >> There was no error in logging but also no pwdCheckModule >> > >Sorry, no other idea. Maybe someone else can help you. > >Clément. >

1 0

Re: pwdCheckModule not loaded
by Clément OUDOT 01 Dec '11

01 Dec '11

Le 1 décembre 2011 17:00, Fabian Heinz <fabian.heinz(a)xinfo.de> a écrit : > Sorry ... > My outbox contains the mail with list, could be some problem with my > mailclient html vs txt > > It shows as text so I hope list will be kept... Fail. > I'm using Ubuntu 11.10 > And I have tried blank and column separated with /usr/lib/ /usr/lib/ldap > /usr/local/libexec > Which are the directories I installed the modules to. > There was no error in logging but also no pwdCheckModule > Sorry, no other idea. Maybe someone else can help you. Clément.

1 0

Re: pwdCheckModule not loaded
by Clément OUDOT 01 Dec '11

01 Dec '11

Le 1 décembre 2011 16:33, Fabian Heinz <fabian.heinz(a)xinfo.de> a écrit : > I already did that after your last mail > > => no effect > > Must there one modulepath or are there multiple possible > It seems like the second one but I better ask ... Please keep the list in copy! man slapd.conf: modulepath <pathspec> Specify a list of directories to search for loadable modules. Typically the path is colon-separated but this depends on the operating system. The default is /home/clement/Programmes/openldap/libexec/openldap, which is where the standard OpenLDAP install will place its modules. Clément.

1 0

Re: pwdCheckModule not loaded
by Clément OUDOT 01 Dec '11

01 Dec '11

Le 1 décembre 2011 14:53, Fabian Heinz <fabian.heinz(a)xinfo.de> a écrit : > > Hi > > Thanks for the fast reply. > > > > But didn’t help > > > > Modulepath points to /usr/lib/ldap > > > > I also tried to add a second modulepath, don’t know if this is correct… > > modulepath /usr/lib/ldap > > moduleload back_bdb.la > > moduleload back_hdb.la > > moduleload back_ldap.la > > moduleload back_bdb.lda > > moduleload ppolicy.la > > > > modulepath /usr/local/lib > > > > I installed the library in /usr/local/libexec > > > > Added the modulepath > > But still no effect > > > > Is there any logging for loading of the function? Please keep the list in copy. You said: > modulepath /usr/local/lib > I installed the library in /usr/local/libexec Try modulepath /usr/local/libexec Clément.

1 0

SHELL env variable not red
by Olivier 01 Dec '11

01 Dec '11

Hello, I have configured nss/pam on a REDHAT6 box to authenticate users against an ldap : it works but I have a problem with getting my favorite user shell when I log in. The "loginShell" shell attribute sounds to not been used to provide users with their favorite shell when they log in : may be I misunderstood the usage of this "posixAccount" attribute ? Thanks for your help, see below for additional indications : $ ssh olivier(a)redhatbox.example.fr olivier(a)redhatbox.example.fr's password: < MY LDAP PASSWORD> RHN Satellite kickstart on 2011-06-16 ##################### # redhatbox.example.fr # # # # Hello # ##################### sh-4.1$ grep olivier /etc/passwd <returns nothing (no local entry for olivier)> -sh-4.1$ pwd /home/olivier (my home directory found in ldap) -sh-4.1$ env | grep -i shell SHELL=/bin/sh ( my shell user environnment is not picked in ldap) sh-4.1$ ldapsearch -D uid=olivier,ou=staff,ou=people,dc=example,dc=fr -W uid=olivier Enter LDAP Password: < MY LDAP PASSWORD> # olivier, staff, people, example.fr dn: uid=olivier,ou=staff,ou=people,dc=example,dc=fr cn: Olivier G gidNumber: 18000 homeDirectory: /home/olivier objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount sn: olivier uid: olivier uidNumber: 1000 shadowLastChange: 15282 loginShell: /bin/tcsh givenName: Olivier mail: olivier(a)example.fr userPassword:: xxxxxxxxxxxxxxxxxxxxxxx -sh-4.1$ cat /etc/shells /bin/sh /bin/bash /sbin/nologin /bin/tcsh (my favorite shell is allowed) /bin/csh ANY HELP ??? Thanks --- Olivier

1 0

pwdCheckModule not loaded
by Fabian Heinz 01 Dec '11

01 Dec '11

Hi together, I want to setup password policy in a small company. Were using openldap for a while without any pw constraints. Now I got ppolicy working and pw update fails correctly on the defined constraints. But I am not able to load the pwdCheckModule. I implemented some basic function which should always fail, just to see it is working. But it seems not be loaded. I compiled it as shared library with libtool and tried different locations with no result. I even cannot find any logging information about that. Can you give some tips where to find the loggings or how to increase them. At the moment I configured slapd.conf to loglevel -1 And can only find logging in the syslog Here my policy ldif version: 1 DN: cn=default,ou=policies,dc=company,dc=com objectClass: top objectClass: device objectClass: pwdPolicy objectClass: pwdPolicyChecker cn: default pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckModule: libcheck_password.so pwdCheckQuality: 1 pwdExpireWarning: 432000 pwdFailureCountInterval: 0 pwdGraceAuthNLimit: 0 pwdInHistory: 0 pwdLockout: TRUE pwdLockoutDuration: 1920 pwdMaxAge: 7516800 pwdMaxFailure: 4 pwdMinLength: 8 pwdMustChange: TRUE pwdSafeModify: FALSE I tried to put the shared library to /usr/local/lib and /usr/lib/ldap Both had not effect. Thanks and greetings fabs Beschreibung: C:\Users\fabs\AppData\Roaming\Microsoft\Signatures\xinfo-Dateien\bgleft.png Fabian Heinz Tel.: +49-89-1891788-34 Mobile.: +49-176-36107036 Mail: <mailto:fabian.heinz@xinfo.de> fabian.heinz(a)xinfo.de Beschreibung: C:\Users\fabs\AppData\Roaming\Microsoft\Signatures\xinfo-Dateien\bgbottom.pn g X-info Wieland Sacher GmbH IT-Beratung · Dienstleistung · Entwicklung Automotive IT · Application Solutions · Communications Am Stichgartl 6 | 85764 Oberschleißheim | Tel +49-89-31770785 | Fax +49-89-31770786 | <http://www.xinfo.de> www.xinfo.de Geschäftsführung: Dipl. Phys. Wieland Sacher | Sitz der Gesellschaft:Oberschleißheim Amtsgericht München HRB 1088 49 | UST-Nr:143-828-10155 | UID-NR: DE170540430 <http://www.app-solut.com/> Beschreibung: APP-SOLUT Mobile Applications · Internet Applications · Customized Software

2 1

Possible ACL Issue while try to read Root DSE
by Axel Birndt 01 Dec '11

01 Dec '11

Hi @All, i'am new on this list and i have a question. While i'am using the tool web2ldap from Michael Stroeder and try to create a new entry with this tool. I'am using openldap with cn=config backend on ubuntu 10.04 Michael mentioned it could be a acl problem, because his tool couldn't read the Root DSE If i specify the search base and the adminuser i could see the content of the Tree root. ldapsearch -b "dc=2axels-company,dc=de" -s base 'objectclass=*' -h localhost -D cn=admin,dc=2axels-company,dc=de -W -------------------->> abirndt@ubuntunb:~$ ldapsearch -b "dc=2axels-company,dc=de" -s base 'objectclass=*' -h localhost -D cn=admin,dc=2axels-company,dc=de -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=2axels-company,dc=de> with scope baseObject # filter: objectclass=* # requesting: ALL # # 2axels-company.de dn: dc=2axels-company,dc=de objectClass: dcObject objectClass: organization o: 2axels-company.de dc: 2axels-company description: Tree root <<<<---------------------------------------- But if i use ldapsearch with the following command i got nothing: ldapsearch -b "" -s base 'objectclass=*' ldap_sasl_interactive_bind_s: No such object (32) Could you help me please to identify if there is a problem with reading the Root DSE? What could i do next ? Any help is very appreciated. -- Gruß Axel ------------------------------

6 14

Overlay ordering and compatibility
by Nick Milas 01 Dec '11

01 Dec '11

Hello, We are using overlays: auditlog, dynlist, syncrprov and we would like to evaluate the deployment of MemberOf overlay as well. Is there a suggested ordering of the above overlays? (I've read that ordering matters.) In general: * Is there a suggested ordering list of all standard overlays (i.e. of overlays included in the distibution and/or "officially" documented in http://www.openldap.org/doc/admin24/overlays.html)? * Is there a list of possibly incompatible overlays, i.e. overlays which cannot or should not be used at the same time? * Are there any direct or indirect limitations in the number of used overlays? (e.g. software-related limitations, performance / stability risks etc.) Thanks, Nick

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical December 2011