openldap-technical September 2011

openldap-technical@openldap.org

101 participants
119 discussions

slapd crash on bad indexed translucent
by Hugo Monteiro 20 Sep '11

20 Sep '11

Hello, I would like to report that i have been able to replicate a crash on slapd. Problem was noticed when performing a substring query on a translucent overlay database attribute, locally stored, which only had equality index. slapd version is 2.4.23 (debian squeeze slapd-2.4.23-7.2) on an amd64 xen vm. Should i file an ITS for this one? Regards, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

2 1

Double passwords in accounts
by Nick Milas 20 Sep '11

20 Sep '11

Hello, Based on the fact that the userPassword attribute is NOT single-valued in the schema definition, I was wondering whether there are cases where we could use a double-password approach or if doing that would just cause a mess. For example, could we store both a clear-text password (to be used e.g. in DIGEST authentication) AND an encrypted (SSHA or MD5) one for standard use? If that could work, (I assume that) openldap would know which one to use based on the negotiation with the client application, which would normally try different authentication methods in a particular order. Openldap would then use the right password automatically (ideally), depending on the authentication method used each time. Any info would be appreciated. Thanks, Nick

2 2

What expect to log at info level?
by Nick Urbanik 20 Sep '11

20 Sep '11

Dear Team, I'm using CentOS 5, some machines with OpenLDAP 2.3.43-12, some with 2.4.23-15, on both 32 and 64-bit architectures. I am puzzled by the lack of logging I see. In all cases, I am using slapd.conf OpenLDAP configuration. I am running slapd with the option -l local0: # ps auxwww | grep slap[d] ldap 17866 0.0 1.7 242104 9000 ? Ssl 15:54 0:00 /usr/sbin/slapd -h ldap:/// -u ldap -l local0 With this in /etc/syslog.conf: local0.info -/var/log/ldap and this: # grep loglevel /etc/openldap/slapd.conf loglevel -1 I get nothing logged when I restart OpenLDAP, nor when I search (and get output). However, if I change the /etc/syslog.conf entry to: local0.* -/var/log/ldap I get plenty of output into /var/log/ldap. QUESTIONS: 1. What should I expect to be logged at info priority with loglevel -1? 2. Does anyone have any suggestions of what I may be missing here? -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

5 12

open LDAP + TLS/SSL mini draft howto
by Olivier 19 Sep '11

19 Sep '11

Vijay, This may help. Check that each file is properly readable Best --- Olivier ---------- Forwarded message ---------- From: Olivier <ldap(a)guillard.nom.fr> Date: Thu, Aug 11, 2011 at 2:23 PM Subject: tls extra mini howto To: openldap-technical(a)openldap.org Having spent quite some time to make a TLS work I thought this may be usefull to some : 1/ Create a self CA certificate : a/ create the CA.key private key : $ openssl genrsa -des3 -out CA.key 1024 b/ create the CA.crt certificate : $ openssl req -new -key CA.key -x509 -days 1095 -out CA.crt 2/ for each ldap server (if you have more than one) create a certificat : a/ create the server.key private key : openssl genrsa -out server.key b/ create a server.csr certificate request: openssl req -new -key server.key -out server.csr c/ create the server.crt certificate signed by your own CA : openssl x509 -req -days 2000 -in server.csr -CA CA.crt -CAkey CA.key -CAcreateserial -out server.crt 3/ configure slapd.conf ( the correct "server.key" and "server.crt" files must be copied on each server): TLSCACertificateFile /etc/openldap/cacerts/CA.crt TLSCertificateFile /etc/openldap/cacerts/server.crt TLSCertificateKeyFile /etc/openldap/cacerts/server.key TLSCipherSuite HIGH:MEDIUM:+SSLv2 # personnally, I only check servers from client. # If you do, add this : TLSVerifyClient never 4/ on clients : copy CA.crt to the right place ( normally should be somewhere in /etc/pki..), and add this in ldap.conf : TLS_CACERT /etc/openldap/cacerts/CA.crt If you use sssd, add this in /etc/sssd/sssd.conf : lldap_tls_cacert = /etc/openldap/cacerts/CA.crt ldap_tls_reqcert = demand Then you can test using ldapsearch with -Z Best --- Olivier NOTE : I have'nt been able to make it work with mozilla certutil

1 0

Re: open LDAP + TLS/SSL bind Failed.
by vijay s sheelavantar 19 Sep '11

19 Sep '11

Thank you very much Buchan. I have changed the certificate creation method. Now I created the certificates using CA.sh of openssl.I followed the instruction given in the below link to create the certificates. http://octaldream.com/~scottm/talks/ssl/opensslca.html 1. At the server side now i am able to do ldapsearch and ldapadd, as i have chenged the /usr/local/etc/openldap/ldap.conf on server to remove IP address. I have made necessary changes in /etc/hosts file also. BASE    dc=samsung,dc=comURI     ldaps://localhost.localdomain/TLS_CACERT      /etc/pki/CA/cacert.pemTLS_CACERTDIR   /etc/pki/CA/ 2.slapd.conf details for TLS are as follows TLSCipherSuite          HIGH:MEDIUM:+SSLv2:+SSLv3:RSATLSCACertificatePath    /etc/pki/CA/TLSCACertificateFile    /etc/pki/CA/cacert.pemTLSCertificateFile      /etc/pki/tls/misc/newcert.pemTLSCertificateKeyFile   /etc/pki/tls/misc/newkey.pemTLSVerifyClient         allow 3. I have copied the "cacert.pem" which is CA and "newcert.pem" which my server certificate to the client machine. I have copied these files to /etc/openldap/cacerts directory on client machine. and I have made the following configuration changes to "/etc/ldap.conf" file at the client side. base dc=samsung,dc=comuri ldaps://localhost.localdomain/tls_cacertfile  /etc/openldap/cacerts/cacert.pemtls_cert /etc/openldap/cacerts/newcert.pempam_password md5nss_map_attribute gecos description When the "TLSVerifyClient  allow" is specified in slapd.conf, I am able to login to the client machine properly, authentication is succesful. but when "TLSVerifyClient  demand" and when I try to login to the client machine the authentication is failing. I am getting the following error at the server side. TLS trace: SSL3 alert write:fatal:handshake failureTLS trace: SSL_accept:error in SSLv3 read client certificate BTLS: can't accept: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate.connection_read(12): TLS accept failure error=-1 id=1005, closingconnection_closing: readying conn=1005 sd=12 for closeconnection_close: conn=1005 sd=12daemon: activity on 1 descriptordaemon: activity on:daemon: removing 12conn=1005 fd=12 closed (TLS negotiation failure) please let me know where i am making mistake? how can i correct this and make it work properly? Thanks & Regards,Vijay S.

1 0

Re: LDAP Dynamic Library Creation Failed.
by vijay s sheelavantar 19 Sep '11

19 Sep '11

I checked in the config.log file it's really a huge file. I found few errors. which are as below. configure:10558: checking for shl_load in -ldldconfigure:10583: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -o conftest -g -O2 -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix -Bshareable conftest.c -ldld   >&5/opt/montavista/pro/devkit/mips/fp_be/bin/../lib/gcc-lib/mips-hardhat-linux/3.3.1/../../../../mips-hardhat-linux/bin/ld: cannot find -ldldcollect2: ld returned 1 exit status configure:15013: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -o conftest -g -O2 -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix -Bshareable conftest.c  -lrpcrt4 >&5conftest.c:88: error: parse error before "UuidCreate"conftest.c:88: warning: data definition has no type or storage classconftest.c:89: error: parse error before "UuidToStringA"conftest.c:89: warning: data definition has no type or storage classconfigure:15013: $? = 1 configure:19146: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -o conftest -g -O2 -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix -Bshareable conftest.c  -pthread -lresolv  >&5conftest.c:106: error: parse error before "rwlock"conftest.c:106: warning: data definition has no type or storage class conftest.c:125: error: too many arguments to function `ctime_r'conftest.c:133: error: too few arguments to function `gethostbyname_r'conftest.c:136: error: too few arguments to function `gethostbyaddr_r' onfigure:22645: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -c -g -O2 -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix conftest.c >&5conftest.c: In function `main':conftest.c:170: error: parse error before ')' token conftest.c:173: error: size of array `test_array' is negative conftest.c:247: error: structure has no member named `msg_accrightslen' Is there any problem with the libtool? I am not quite familiar with libtool.  

2 1

Quick newbie pointer - unauth ldap* commands as root on ldap master
by Tim Watts 19 Sep '11

19 Sep '11

Hi, Sorry - this will sound really dumb... For people who aren't very LDAP savvy, what the cleanest way to rig an LDAP server that I have root access to to: allow unprompted ldap* commands (eg ldapmodify). GoSA has got confused creating a user and I need to manually force some ldif files with minor changes through... MIT Kerberos has a kdamin.local command that does not care about authentication because it has direct access to the database files. Is there something similar for OpenLDAP? This is a files based ldap server, not using SQL. I have located an ldap.secret file but am having trouble authenticating with its content. I'm fairly confused because LDAP appears to have many many ways to handle authentication... Many thanks, Tim -- Tim Watts Personal Blog: http://www.dionic.net/tim/

2 4

Fwd: Re: pcache crashes server
by turbo＠bayour.com 19 Sep '11

19 Sep '11

[My reply should have gone to the list - using a new webclient at work] -------- Original Message -------- Subject: Re: pcache crashes server Date: Mon, 19 Sep 2011 12:09:37 +0200 From: Pierangelo Masarati <masarati(a)aero.polimi.it> To: turbo(a)bayour.com On 09/19/2011 11:39 AM, turbo(a)bayour.com wrote: > On Mon, 19 Sep 2011 10:57:53 +0200, Pierangelo Masarati wrote: >> On 09/19/2011 09:48 AM, turbo(a)bayour.com wrote: >>> I'm trying to use pcache on my server, but it crashes every time it >>> gets a >>> 'QUERY CACHABLE'... >>> >>> See my config in my other thread... >> >> What other thread? Please, always provide a link to the archives, to >> help others help you. > > http://www.openldap.org/lists/openldap-technical/201109/msg00160.html I know, maybe others don't. You should reply to the list. I already gave all the advice I could. p. >>> So it gets the value from the AD, transmogrifying it using rwm and >>> sends >>> the reply to the >>> client. But when getting to the pcache overlay, it crashes... >> >> The root cause is likely rwm. This won't fix at least until 2.5, for >> reasons explained in ITSes involving slapo-rwm. Please decouple the >> two overlays, at the cost of adding an intermediate proxy. > > Where you thinking of ITS#6166 here (it was referenced in ITS#6997) > or > some other ITS? >

1 2

Re: open LDAP + TLS/SSL bind Failed.
by arun.sasi1＠wipro.com 19 Sep '11

19 Sep '11

Daniel, Please perform the below steps to create certificate... $ /usr/lib/ssl/misc/CA.pl -newreq $ /usr/lib/ssl/misc/CA.pl -signreq $ openssl rsa < newkey.pem > clearkey.pem then $ sudo cp cacert.pem /usr/share/ca-certificates/Domain.crt Then, edit the /etc/ca-certificates.conf file, and add Domain.crt at the end of the file. Finally, run update-ca-certificates: $ sudo update-ca-certificates Updating certificates in /etc/ssl/certs....done. Thanks, -Arun Message: 9 Date: Sun, 18 Sep 2011 22:59:51 -0400 From: Daniel Qian <daniel(a)up247solution.com> To: openldap-technical(a)openldap.org Subject: Re: open LDAP + TLS/SSL bind Failed. Message-ID: <4E76B027.9020800(a)up247solution.com> Content-Type: text/plain; charset="utf-8"; Format="flowed" On 11-09-16 3:57 AM, vijay s sheelavantar wrote: > Hi, > I am trying to configure LDAP Client/server on 2 Fedora-10 linux machines. > > I have installed and configured openldap-2.4.26 server on one machine > and pam_ldap-186, nss_ldap-265 on the other machines. > > I have created the TLS certificates using following command on the server. > > openssl req -newkey rsa:1024 -x509 -nodes -out \ server.pem -keyout > server.pem -days 3650 > > and I have created the client.pem by copying CERTIFICATE portion of > the server.pem. > > When my client try to connect to the server I get following errors. > > *TLS trace: SSL3 alert read:fatal:unknown CA > TLS trace: SSL_accept:failed in SSLv3 read client certificate A > TLS: can't accept: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 > alert unknown ca. > connection_read(12): TLS accept failure error=-1 id=1012, closing > connection_closing: readying conn=1012 sd=12 for close > connection_close: conn=1012 sd=12 > daemon: removing 12 > conn=1012 fd=12 closed (TLS negotiation failure) > * > My Configurations are as follows. > > slapd.conf > > access to attrs=userPassword > by self write > by anonymous auth > by * none > > access to * > by * read > > #TLS Certificate section > TLSCipherSuite HIGH:MEDIUM:+SSLv2:+SSLv3:RSA > TLSCACertificateFile /etc/openldap/cacerts/server.pem > TLSCertificateFile /etc/openldap/cacerts/server.pem > TLSCertificateKeyFile /etc/openldap/cacerts/server.pem > TLSVerifyClient allow > > and client side ldap.conf > > base dc=samsung,dc=com > uri ldaps://10.254.204.181/ > TLS_CACERT /etc/openldap/cacerts/client.pem > pam_password md5 > > nsswitch.conf > > passwd: files ldap > shadow: files ldap > group: files ldap > > netgroup: files ldap > automount: files ldap > > I am not getting why it is saying Unknown ca. even though the > certificate is created on server machine itself. > > Kindly help me to solve this problem. > <http://sigads.rediff.com/RealMedia/ads/click_nx.ads/www.rediffmail.com/ signatureline.htm@Middle?> > Treat yourself at a restaurant, spa, resort and much more with *Rediff > Deal ho jaye! > <http://track.rediff.com/click?url=___http://dealhojaye.rediff.com?sc_ci d=mailsignature___&cmp=signature&lnk=rediffmailsignature&newservice=deal s>* you may try this cd /etc/openldap/cacerts/ ln -s client.pem `openssl x509 -noout -hash -in client.pem`.0

1 0

Re: open LDAP + TLS/SSL bind Failed.
by vijay s sheelavantar 19 Sep '11

19 Sep '11

1 0

← Newer
1
2
3
4
5
6
7
8
...
12
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical September 2011