openldap-technical September 2011

openldap-technical@openldap.org

101 participants
119 discussions

pcache crashes server
by turbo＠bayour.com 19 Sep '11

19 Sep '11

I'm trying to use pcache on my server, but it crashes every time it gets a 'QUERY CACHABLE'... See my config in my other thread... This is a localy compiled OpenLDAP v2.4.26 with localy compiled Berkeley DB v5.1.25 on a CentOS v5.6 (Final). ----- s n i p ----- [...] => access_allowed: read access granted by read(=rscxd) conn=1000 op=1 ENTRY dn="uid=kpxb140,ou=people,dc=seml,dc=company,dc=tld" ber_flush2: 80 bytes to sd 17 0000: 30 4e 02 01 02 64 49 04 33 75 69 64 3d 6b 70 78 0N...dI.3uid=kpx 0010: 62 31 34 30 2c 6f 75 3d 50 65 6f 70 6c 65 2c 64 b140,ou=People,d 0020: 63 3d 73 65 6d 6c 2c 64 63 3d 00 00 00 00 00 00 c=seml,dc=xxxxxx 0030: 65 6e 65 63 61 2c 64 63 3d 6e 65 74 30 12 30 10 xxxxx,dc=net0.0. 0040: 00 00 00 00 00 31 09 04 07 6b 70 78 62 31 34 30 ..uid1...kpxb140 ldap_write: want=80, written=80 0000: 30 4e 02 01 02 64 49 04 33 75 69 64 3d 6b 70 78 0N...dI.3uid=kpx 0010: 62 31 34 30 2c 6f 75 3d 50 65 6f 70 6c 65 2c 64 b140,ou=People,d 0020: 63 3d 73 65 6d 6c 2c 64 63 3d 00 00 00 00 00 00 c=seml,dc=xxxxxx 0030: 00 00 00 00 00 2c 64 63 3d 6e 65 74 30 12 30 10 xxxxx,dc=net0.0. 0040: 04 03 75 69 64 31 09 04 07 6b 70 78 62 31 34 30 ..uid1...kpxb140 <= send_search_entry: conn 1000 exit. Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x41001940 (LWP 16414)] 0x00002aaaad0919c9 in pcache_op_cleanup (op=0x89ad40, rs=0x41000c10) at pcache.c:2369 2369 Attribute *a = rs->sr_entry->e_attrs; (gdb) bt #0 0x00002aaaad0919c9 in pcache_op_cleanup (op=0x89ad40, rs=0x41000c10) at pcache.c:2369 #1 0x000000000043f797 in ?? () #2 0x0000000000441a7a in slap_send_search_entry () #3 0x00002aaaaca0d9fe in ldap_back_search (op=0x89ad40, rs=0x41000c10) at search.c:361 #4 0x0000000000494722 in overlay_op_walk () #5 0x0000000000494c87 in ?? () #6 0x0000000000432f09 in fe_op_search () #7 0x0000000000433715 in do_search () #8 0x0000000000430c65 in ?? () #9 0x000000000043123f in ?? () #10 0x00002aaaaaac1f38 in ldap_int_thread_pool_wrapper (xpool=0x79d1d0) at tpool.c:685 #11 0x000000397c80673d in start_thread () from /lib64/libpthread.so.0 #12 0x000000397bcd40cd in clone () from /lib64/libc.so.6 ----- s n i p ----- ----- s n i p ----- [kpxb140@semldx00135 LDAPv3]$ alias ldapsearch.local alias ldapsearch.local='/usr/local/turbo/bin/ldapsearch -LLL -x -h localhost -b dc=company,dc=tld' [kpxb140@semldx00135 LDAPv3]$ ldapsearch.local 'uid=kpxb140' uid dn: uid=kpxb140,ou=People,dc=org1,dc=company,dc=tld uid: kpxb140 ldap_result: Can't contact LDAP server (-1) ----- s n i p ----- So it gets the value from the AD, transmogrifying it using rwm and sends the reply to the client. But when getting to the pcache overlay, it crashes...

2 1

Rename DN ?
by Tim Watts 18 Sep '11

18 Sep '11

Hi folks, Quick question if I may: Is it possible to rename a DN, eg this LDIF file: dn: cn=Fred,ou=people,dc=example,dc=com changetype: modify replace: dn dn: cn=Fred,ou=people,ou=external,dc=example,dc=com I tried that, and ldapmodify does not seem to like it :( Many thanks, Tim -- Tim Watts Personal Blog: http://www.dionic.net/tim/

3 3

open LDAP + TLS/SSL bind Failed.
by vijay s sheelavantar 18 Sep '11

18 Sep '11

Hi, I am trying to configure LDAP Client/server on 2 Fedora-10 linux machines. I have installed and configured openldap-2.4.26 server on one machine and pam_ldap-186, nss_ldap-265 on the other machines. I have created the TLS certificates using following command on the server. openssl req -newkey rsa:1024 -x509 -nodes -out \ server.pem -keyout server.pem -days 3650 and I have created the client.pem by copying CERTIFICATE portion of the server.pem. When my client try to connect to the server I get following errors. TLS trace: SSL3 alert read:fatal:unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca. connection_read(12): TLS accept failure error=-1 id=1012, closing connection_closing: readying conn=1012 sd=12 for close connection_close: conn=1012 sd=12 daemon: removing 12 conn=1012 fd=12 closed (TLS negotiation failure) My Configurations are as follows. slapd.conf access to attrs=userPassword by self write by anonymous auth by * none access to * by * read #TLS Certificate section TLSCipherSuite HIGH:MEDIUM:+SSLv2:+SSLv3:RSA TLSCACertificateFile /etc/openldap/cacerts/server.pem TLSCertificateFile /etc/openldap/cacerts/server.pem TLSCertificateKeyFile /etc/openldap/cacerts/server.pem TLSVerifyClient allow and client side ldap.conf  base dc=samsung,dc=com uri ldaps://10.254.204.181/ TLS_CACERT /etc/openldap/cacerts/client.pem pam_password md5 nsswitch.conf passwd: files ldap shadow: files ldap group: files ldap netgroup: files ldap automount: files ldap I am not getting why it is saying Unknown ca. even though the certificate is created on server machine itself. Kindly help me to solve this problem.

4 3

Re: SASL and non-cleartext passwords storage
by Julien Vehent 18 Sep '11

18 Sep '11

On 18.09.2011 14:36, Jacobus brogly.decap wrote: > No, encrypting passwords over the wire is somthing TOTALLY different > and > seperate from how they are stored on disk (in case you want to > migrate or > export) > Dont solve 2 different problems at the same time,..I recommend you > read > chapter 2 of IBM redbook on LDAP. > My apologies for not being clear. Let me go back to the initial problem. I have postfix, cyrus-imapd and openldap installed on a debian. I do not care about protecting passwords over the wire because I already use ldaps for all communications with slapd. postfix and cyrus-imapd both use ldapdb plugins to verify users against slapd. ldapdb is configured to authenticate postfix and cyrus-imap with their own private users, and then a proxy authorization is performed to take the identify of the real users. ex: postfix uses the user "postfixldap" and once authenticated, takes the identity of user "julien" +--------+ +----------+ |postfix | | cyrus | +--------+ +--------+-+ | | proxy | |proxy ldapdb ldapdb | +-----------+ |user "cyrusldap" user | | slapd | | +------->user=julien<--------+ "postfixldap" | | +-----------+ This method is nice because it avoid having an additional software in between postfix and cyrus (pam-ldap or saslauthd). But the problem is that ldapdb requires to use DIGEST-MD5 and therefore to store the passwords in cleartext in the directory. I'm looking for a solution to avoid storing the messages in cleartext. Is it possible while still using ldapdb in postfix and cyrus-imap ? Julien

2 1

Re: SASL and non-cleartext passwords storage
by Julien Vehent 18 Sep '11

18 Sep '11

On 18.09.2011 12:30, Jacobus brogly.decap wrote: > Sure, just choose "a schema" there are many hashes to choose from > SHA1-SHA2, MD5 etc...you can look it up in the admin guide on the > openldap.org [2] website...setting it up is really trivial! How is this going to work with proxy authorization ? the ldapdb auxprop plugin in postfix doesn't work with hash passwords. Should I go back to using saslauthd ? > 2011/9/18 Julien Vehent > >> Hi List, >> >> I'm working on a setup where postfix and cyrus-imap do proxy >> authorization against openldap (my setup is here http://1nw.eu/!cD >> [1] >> ). I love this solution, it's a lot more elegant that using >> saslauthd. >> But I'm concerned about passwords stored in cleartext, as required >> by >> DIGEST-MD5. >> >> I know of the many ways to protect the data stored in openldap (file >> system encryption, etc...), but if somebody gets a root access, >> passwords will be disclosed, and I want to prevent that. >> >> My question is: Is there a way to use hashed passwords with sasl and >> proxy authorization ? >> >> Thanks, >> Julien Links: ------ [1] http://1nw.eu/!cD [2] http://openldap.org [3] mailto:julien@linuxwall.info

1 0

SASL and non-cleartext passwords storage
by Julien Vehent 18 Sep '11

18 Sep '11

Hi List, I'm working on a setup where postfix and cyrus-imap do proxy authorization against openldap (my setup is here http://1nw.eu/!cD ). I love this solution, it's a lot more elegant that using saslauthd. But I'm concerned about passwords stored in cleartext, as required by DIGEST-MD5. I know of the many ways to protect the data stored in openldap (file system encryption, etc...), but if somebody gets a root access, passwords will be disclosed, and I want to prevent that. My question is: Is there a way to use hashed passwords with sasl and proxy authorization ? Thanks, Julien

1 0

Re: How to disable cn=config module in OpenLDAP
by pradyumna dash 17 Sep '11

17 Sep '11

Hi, Please find the configuration files as attached. When i run the below command i get the output ldapsearch -x -h 192.168,0.1 -D "cn=Manager,dc=example,dc=com" -b "dc=example,dc=com" -W but when i try either ldapsearch -x or ldapsearch -x -h 192.168.0.1 -b "cn=Manager,dc=example,dc=com" it shows : base <cn=Manager,dc=example,dc=com> with scope subtree filter: (objectclass=*) requesting: ALL #search result search: 2 result: 32 No such object #numResponse: 1 OS : SLES 11 SP1 LDAP : 2.4.20-0.4.29 What i have changed is insted of dynamic backend i am trying to use slapd.conf file so i have changed in /etc/sysconfig/openldap file OPENLDAP_CONFIG_BACKEND="files". Please suggest how to solve this. Regards, Neo On Wed, Sep 14, 2011 at 8:47 PM, Bill MacAllister <whm(a)stanford.edu> wrote: > > > --On Wednesday, September 14, 2011 07:46:17 PM +0200 pradyumna dash < > neomatrixgem(a)gmail.com> wrote: > > Hi, >> >> Yes i tried below >> >> ldapsearch -x -h l <http://somehost.com/>dap1.**example.com<http://dap1.example.com/>-b >> >> cn=Manager,dc=example,dc=com >> > > If that is the command line that you used no wonder you didn't get > the results you expected. > > > It asked me to provide the password i have provided that then it shows the >> same error, nothing came up. >> > > Why don't you provide exactly what you typed and and what the response > was? Just cut and paste it into a _text_ message. Sending HTML just > muddies the waters already murky waters. > > The -x requests a simple bind and since you have not provided a bind DN > or bind password it will attempt an anonymous bind. It is hard to believe > that you are seeing what you report. The host where the ldap server is > running is actually named 'ldap1.example.com'? > > > I have checked my ldap.conf as well it looks okay. >> > > Unless you were going to include the ldap.conf file this statement was > a waste of bytes. > > > Bill > > Regards, >> Neo >> >> On Wed, Sep 14, 2011 at 6:41 PM, Bill MacAllister <whm(a)stanford.edu> >> wrote: >> >> >>> >>> --On Wednesday, September 14, 2011 06:35:09 PM +0200 pradyumna dash < >>> neomatrixgem(a)gmail.com> wrote: >>> >>> Hi, >>> >>>> >>>> ldapsearch -x shows the content of LDAP database as well wothout any >>>> additional options. I can see the same in one of my servers,I took a >>>> dump >>>> of >>>> the running server by slapcat and restored the same in this server. >>>> >>>> I can see the data by slapcat but ldapsearch is not working. >>>> >>>> The box where ldap running fine its using slapd.d backend, but this >>>> server >>>> i >>>> have configured to run from slapd.conf file, can it be a issue with the >>>> DB >>>> backup and restore as they are both using different backend? >>>> >>>> Regards, >>>> Neo >>>> >>>> >>> Did you even try my suggestion? The error message that you got back, >>> i.e. >>> "32 no such object" is telling you that you have not supplied a baseDN >>> for the search. >>> >>> Bill >>> >>> P.S. Top posting to replies sucks. >>> >>> >>> On Wed, Sep 14, 2011 at 6:29 PM, Bill MacAllister <whm(a)stanford.edu> >>> >>>> wrote: >>>> >>>> >>>> >>>>> --On Wednesday, September 14, 2011 06:20:03 PM +0200 pradyumna dash < >>>>> neomatrixgem(a)gmail.com> wrote: >>>>> >>>>> I have fixed this by deleting the slapd.d and also changed the script >>>>> to >>>>> >>>>> read slapd.conf file but now >>>>>> >>>>>> when am trying ldapserach -x its showing 32 no such object >>>>>> >>>>>> but the below command works >>>>>> >>>>>> ldapsearch -LLL -Wx -D "cn=Manager,dc=mail,dc=domain,******dc=com >>>>>> >>>>>> why is that ? >>>>>> >>>>>> >>>>>> Because you did it wrong. There is not enough information in your >>>>> message to tell much more than you contacted an LDAP server and >>>>> got an error message. You might want to try using a fully specified >>>>> search and work back from there. For example: >>>>> >>>>> ldapsearch -x -h somehost.com -b cn=sometree,dc=domain,dc=com >>>>> >>>>> Bill >>>>> >>>>> >>>>> Regards, >>>>> >>>>> Neo >>>>>> On Wed, Sep 14, 2011 at 5:34 PM, pradyumna dash < >>>>>> neomatrixgem(a)gmail.com >>>>>> > wrote: >>>>>> >>>>>> Hi , >>>>>> >>>>>> >>>>>>> Can i disable cn=config module, I just want to use plain old >>>>>>> slapd.conf >>>>>>> file. How to disable that. So that LDAP wont use the directory. >>>>>>> >>>>>>> Am using SLES 11 SP1 and i tried deleteting the directory but if i am >>>>>>> unable to restart the service. >>>>>>> >>>>>>> Regards, >>>>>>> Neo >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>> -- >>>>> >>>>> Bill MacAllister >>>>> Infrastructure Delivery Group, Stanford University >>>>> >>>>> >>>>> >>>>> >>> >>> -- >>> >>> Bill MacAllister >>> Infrastructure Delivery Group, Stanford University >>> >>> >>> > > > -- > > Bill MacAllister > Infrastructure Delivery Group, Stanford University > >

1 1

Re: slapd does not creating pid file
by sim123 16 Sep '11

16 Sep '11

On Fri, Sep 16, 2011 at 12:01 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, September 16, 2011 11:46 AM -0700 sim123 <Sim3159(a)gmail.com> > wrote: > > Hi, >> >> >> I am using openldap 2.4.25 and configured location of pidfile and >> argsfile in slapd.conf. However, when running slapd its not creating pid >> file or args file. On searching for this issue I found the bug reported >> earlier stating similar problem. Is that fixed or do I need to do some >> other configuration. >> > > It works for me. Perhaps slapd can't write to the location you specified. > I am running it as root. And found out that if I CD into libexec directory and run slapd from there it all works. However if I run it like /opt/openldap-2.4.25/libexec/slapd no .pid or .args get created. And I am giving absolute path for pidFile and argsFile in slapd.conf Thanks > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

slapd does not creating pid file
by sim123 16 Sep '11

16 Sep '11

Hi, I am using openldap 2.4.25 and configured location of pidfile and argsfile in slapd.conf. However, when running slapd its not creating pid file or args file. On searching for this issue I found the bug reported earlier stating similar problem. Is that fixed or do I need to do some other configuration. Thanks

2 1

Re: secure passwords
by sim123 16 Sep '11

16 Sep '11

On Wed, Sep 14, 2011 at 3:28 PM, Jacobus brogly.decap < jacobusbogers(a)gmail.com> wrote: > > > I want to do the same thing, > > Best way is to do it via a module , there is an example in the src > distribution > > /openldap-2.4.23/contrib/slapd-modules/passwd/sha2 > > basicly you dont want cleartext password stored in the DIT, so you want to > hash it > > I tried ppolicy overlay with ppolicy_hash_cleartext on, looks like its doing SSHA with ldapadd or ldapmodify operations. However, just wondering if this is the best way. Thanks > Cheers, > > Jacob > 2011/9/14 sim123 <Sim3159(a)gmail.com> > >> >> >> On Wed, Sep 14, 2011 at 3:00 AM, Buchan Milne <bgmilne(a)staff.telkomsa.net >> > wrote: >> >>> On Tuesday, 13 September 2011 23:01:23 sim123 wrote: >>> > Hi All, >>> > >>> > I am trying to store SSHA passwords in openldap instead of plain text >>> via C >>> > code and wondering how this works. I tried exploring archives, FAQ etc >>> and >>> > what I gathered from there is openLDAP has built in support for various >>> > password encryption algorithm however it does not have any APIs for >>> > generating passwords >>> >>> Are you sure? >>> >>> > and password-has directive works with ldpapassword >>> > utility only. >>> >>> Really? It seems to work fine from pam_ldap (using 'pam_password exop'), >>> Net::LDAP and various other tools. >>> >>> > http://www.openldap.org/faq/data/cache/906.html >>> > >>> > If I use some tool like Apache DS and modify my userPassword attribute >>> to >>> > be SSHA instead of plain text it all works. I want to know how this >>> works >>> > under the hood? Who is responsible for generating hashed passwords? If >>> I >>> > generate it using some C routine how does LDAP Server retrieves it >>> during >>> > the bind operation? I would really appreciate if there is any related >>> > documentation available. >>> >>> Maybe you should read about the Password Modification extended operation >>> .... >>> >>> IMHO, you shouldn't be hashing passwords on the client-side, it is much >>> better >>> to let the DS hash the password in the format it is configured for (so >>> you >>> know it will actually be able to use the password, and allowing you to >>> use >>> newer/stronger hashes as and when the DS supports them, without coding >>> the >>> support yourself). >>> >> >> I agree that DS should hash the password, however I am not sure what >> password modification extended operation is, is it ldappasswd utility or >> does openLDAP offer some kind of API to do so? Also can how can I configure >> hashing in SLAPD? >> >> Basically my C program will call ldap_add_ext_s() operation, while doing >> that how can I make sure that userPassword attribute be treated differently >> (hashed)? I was looking into password policy and not sure if it suffice my >> needs. >> >>> >>> Regards, >>> Buchan >>> >> >> >

1 0

← Newer
1
2
3
4
5
6
7
8
9
...
12
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical September 2011