openldap-technical August 2012

openldap-technical@openldap.org

75 participants
91 discussions

Re: got into a "checksum error" situation
by Gavin Henry 12 Aug '12

12 Aug '12

On 12 August 2012 20:24, Jeff Dickens <jeff(a)seamanpaper.com> wrote: > > Thanks, I will certainly do that in the future. So is there a way to recalculate the checksum on my config as it is now, so that I can get back to normal? slapcat it, check it and make any edits needed, then delete what's in slapd.d/* and then slapadd it back. Checksums will sort themselves. > As an aside, my TLS config does indeed work now. Nice work! -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretec.co.uk Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk Did you see our API? http://www.surevoip.co.uk/api

1 0

Re: got into a "checksum error" situation
by Jeff Dickens 12 Aug '12

12 Aug '12

Yes, I edited it by hand. Clearly not advisable since the comments said "don't do that", but since the server wouldn't start I couldn't use ldapmodify. On Fri, Aug 10, 2012 at 6:51 AM, Gavin Henry <ghenry(a)suretecsystems.com>wrote: > Not knowing what else to do, I removed the lines containing > > "olcTLS" from /etc/ldap/slapd.d/cn=config.ldif. Then I was able to > restart > > slapd (congratulating myself) and then re-ran my ldapmodify command to > enter > > the correct locations of the cert and key. But I still get a checksum > error > > in syslog: > > > Aug 8 17:04:53 grackle slapd[2028]: slapd starting > > Aug 8 17:05:01 grackle slapd[2028]: ldif_read_file: checksum error on > > "/etc/ldap /slapd.d/cn=config.ldif" > > So you edited this by hand? > > > > > I haven't even tried to see if I have TLS working, but I have two > > questions: > > > > #1. How should I have recovered from this (human) error? What I did > > didn't seem to work out very well. > > > > and > > > > #2. How do I un-screw my config and resolve the checksum problem? > > > > Thanks in advance for any assistance. > > > > -- > > Jeff Dickens > > IT Manager 978-632-1513 > > > > > > > > -- > Kind Regards, > > Gavin Henry. > Managing Director. > > T +44 (0) 1224 279484 > M +44 (0) 7930 323266 > F +44 (0) 1224 824887 > E ghenry(a)suretecsystems.com > > Open Source. Open Solutions(tm). > > http://www.suretecsystems.com/ > > Suretec Systems is a limited company registered in Scotland. Registered > number: SC258005. Registered office: 24 Cormack Park, Rothienorman, > Inverurie, > Aberdeenshire, AB51 8GL. > > Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html > > Do you know we have our own VoIP provider called SureVoIP? See > http://www.surevoip.co.uk > > Did you see our API news? > http://www.surevoip.co.uk/news-events/surevoip-launches-innovative-api > -- * Jeff Dickens* IT Manager 978-632-1513

3 2

access to inherited attributes
by Michael Ströder 11 Aug '12

11 Aug '12

HI! I cannot find anything in slapd.access(5) indicating that access attrs=mysupattr by <who> <access> also grants <access> to attributes inherited from mysupattr (which have SUP mysupattr in the attribute type description). Is this the expected behaviour? Where is this documented? (testing with 2.4.32) Ciao, Michael.

1 0

Re: ACL: access to all values vs. to value
by Dora Paula 10 Aug '12

10 Aug '12

Gavin Henry wrote: >> is there a possibility to create an acl statement that grants access to any >> (unknown) value of an attribute but denys access to all values of the same >> attribute? > > Can you explain that again? BTW: Your answer didn't find its way into the openldap-technical archive: http://www.openldap.org/lists/openldap-technical/201208/threads.html Nevertheless, please let me try to explain using a short (but complete) example: Sample slapd.conf: ================== include /openldap/schema/core.schema pidfile /openldap/schema/slapd.pid argsfile /openldap/schema/slapd.args access to * by self write by users read by anonymous auth database mdb suffix "o=test" rootdn "cn=Manager,o=test" rootpw secret directory /openldap/var/openldap-data/test index objectClass eq access to dn.one="ou=persons,o=test" attrs=description by users write by * none Sample val.ldif: ================ dn: o=test objectClass: organization objectClass: top o: test dn: ou=persons,o=test objectClass: organizationalUnit objectClass: top ou: persons dn: cn=PersonA,ou=persons,o=test objectClass: person objectClass: top cn: PersonA sn: PersonA userPassword:: UGVyc29uQQ== Sample modifications.ldif: ========================== #mod 1 (should succeed) dn: cn=PersonA,ou=persons,o=test changetype: modify add: description description: Description of A #mod 2 (should succeed) dn: cn=PersonA,ou=persons,o=test changetype: modify add: description description: Another description of A description: Just another description of A #mod 3 (should succeed) dn: cn=PersonA,ou=persons,o=test changetype: modify delete: description description: Another description of A description: Just another description of A #mod 4 (should fail) dn: cn=PersonA,ou=persons,o=test changetype: modify delete: description slapd startup: (version: git master) ==================================== deepee@test:~$ /openldap/libexec/slapd -f slapd.conf.acl -u openldap -g openldap -d 128 -h "ldap://0.0.0.0:1389/ ldapi://%2Ftmp%2Fldapi_acl/" 50258437 @(#) $OpenLDAP: slapd 2.X (Aug 10 2012 20:44:06) $ deepee@test:/.../slapd Backend ACL: access to * by self write by users read by anonymous auth Backend ACL: access to dn.one="ou=persons,o=test" attrs=description by users write by * none Backend ACL: access to * by * none 50258437 config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context 50258437 mdb_monitor_db_open: monitoring disabled; configure monitor database to enable 50258437 slapd starting ldapmodify: =========== deepee@test:~$ cat /tmp/val.ldif | /openldap/bin/ldapmodify -c -x -H "ldap://localhost:1389" -D "cn=PersonA,ou=persons,o=test" -w PersonA modifying entry "cn=PersonA,ou=persons,o=test" modifying entry "cn=PersonA,ou=persons,o=test" modifying entry "cn=PersonA,ou=persons,o=test" modifying entry "cn=PersonA,ou=persons,o=test" slapd.log (level 128): ====================== 50258ca0 => access_allowed: result not in cache (userPassword) 50258ca0 => access_allowed: auth access to "cn=PersonA,ou=persons,o=test" "userPassword" requested 50258ca0 => dn: [1] ou=persons,o=test 50258ca0 => acl_get: [1] matched 50258ca0 => acl_get: [2] attr userPassword 50258ca0 => acl_mask: access to entry "cn=PersonA,ou=persons,o=test", attr "userPassword" requested 50258ca0 => acl_mask: to value by "", (=0) 50258ca0 <= check a_dn_pat: self 50258ca0 <= check a_dn_pat: users 50258ca0 <= check a_dn_pat: anonymous 50258ca0 <= acl_mask: [3] applying auth(=xd) (stop) 50258ca0 <= acl_mask: [3] mask: auth(=xd) 50258ca0 => slap_access_allowed: auth access granted by auth(=xd) 50258ca0 => access_allowed: auth access granted by auth(=xd) 50258ca0 => access_allowed: result not in cache (description) 50258ca0 => access_allowed: add access to "cn=PersonA,ou=persons,o=test" "description" requested 50258ca0 => dn: [1] ou=persons,o=test 50258ca0 => acl_get: [1] matched 50258ca0 => acl_get: [1] attr description 50258ca0 => acl_mask: access to entry "cn=PersonA,ou=persons,o=test", attr "description" requested 50258ca0 => acl_mask: to value by "cn=persona,ou=persons,o=test", (=0) 50258ca0 <= check a_dn_pat: users 50258ca0 <= acl_mask: [1] applying write(=wrscxd) (stop) 50258ca0 <= acl_mask: [1] mask: write(=wrscxd) 50258ca0 => slap_access_allowed: add access granted by write(=wrscxd) 50258ca0 => access_allowed: add access granted by write(=wrscxd) 50258ca0 acl: internal mod entryCSN: modify access granted 50258ca0 acl: internal mod modifiersName: modify access granted 50258ca0 acl: internal mod modifyTimestamp: modify access granted 50258ca0 => access_allowed: result not in cache (description) 50258ca0 => access_allowed: add access to "cn=PersonA,ou=persons,o=test" "description" requested 50258ca0 => dn: [1] ou=persons,o=test 50258ca0 => acl_get: [1] matched 50258ca0 => acl_get: [1] attr description 50258ca0 => acl_mask: access to entry "cn=PersonA,ou=persons,o=test", attr "description" requested 50258ca0 => acl_mask: to value by "cn=persona,ou=persons,o=test", (=0) 50258ca0 <= check a_dn_pat: users 50258ca0 <= acl_mask: [1] applying write(=wrscxd) (stop) 50258ca0 <= acl_mask: [1] mask: write(=wrscxd) 50258ca0 => slap_access_allowed: add access granted by write(=wrscxd) 50258ca0 => access_allowed: add access granted by write(=wrscxd) 50258ca0 => access_allowed: result was in cache (description) 50258ca0 acl: internal mod entryCSN: modify access granted 50258ca0 acl: internal mod modifiersName: modify access granted 50258ca0 acl: internal mod modifyTimestamp: modify access granted 50258ca0 => access_allowed: result not in cache (description) 50258ca0 => access_allowed: delete access to "cn=PersonA,ou=persons,o=test" "description" requested 50258ca0 => dn: [1] ou=persons,o=test 50258ca0 => acl_get: [1] matched 50258ca0 => acl_get: [1] attr description 50258ca0 => acl_mask: access to entry "cn=PersonA,ou=persons,o=test", attr "description" requested 50258ca0 => acl_mask: to value by "cn=persona,ou=persons,o=test", (=0) 50258ca0 <= check a_dn_pat: users 50258ca0 <= acl_mask: [1] applying write(=wrscxd) (stop) 50258ca0 <= acl_mask: [1] mask: write(=wrscxd) 50258ca0 => slap_access_allowed: delete access granted by write(=wrscxd) 50258ca0 => access_allowed: delete access granted by write(=wrscxd) 50258ca0 => access_allowed: result was in cache (description) 50258ca0 acl: internal mod entryCSN: modify access granted 50258ca0 acl: internal mod modifiersName: modify access granted 50258ca0 acl: internal mod modifyTimestamp: modify access granted 50258ca0 => access_allowed: result not in cache (description) 50258ca0 => access_allowed: delete access to "cn=PersonA,ou=persons,o=test" "description" requested 50258ca0 => dn: [1] ou=persons,o=test 50258ca0 => acl_get: [1] matched 50258ca0 => acl_get: [1] attr description 50258ca0 => acl_mask: access to entry "cn=PersonA,ou=persons,o=test", attr "description" requested 50258ca0 => acl_mask: to all values by "cn=persona,ou=persons,o=test", (=0) 50258ca0 <= check a_dn_pat: users 50258ca0 <= acl_mask: [1] applying write(=wrscxd) (stop) 50258ca0 <= acl_mask: [1] mask: write(=wrscxd) 50258ca0 => slap_access_allowed: delete access granted by write(=wrscxd) 50258ca0 => access_allowed: delete access granted by write(=wrscxd) 50258ca0 acl: internal mod entryCSN: modify access granted 50258ca0 acl: internal mod modifiersName: modify access granted 50258ca0 acl: internal mod modifyTimestamp: modify access granted So far so good, all four modification operations succeeded. That's slapd's known default behavior and completely correct in regard to the above defined acl. My intention is to let the first three operations (to value(s)) succeed and the last operation (to all values) fail by "Insufficient access (50)". After studying the documentation, doing some (unstructured, trial and error) testing with various combinations of acl statements, I finally had a closer look into slapd's source: Am I right, that slapd's acl engine currently does not offer a chance to differentiate between these two types of modification?

2 1

Breathing life into the OpenLDAP Cookbook
by Gavin Henry 10 Aug '12

10 Aug '12

Hi All, I started getting this all together in 2008, but never really moved on it and have now opened it up. I'm pretty sure all these topics are still relevant and I've added some more: http://wiki.suretec.org/openldap:cookbook Feel free to add anything in the right place. You'll need to register to edit. Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretec.co.uk Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk Did you see our API? http://www.surevoip.co.uk/api

3 7

Internal telephone extension number
by Gavin Henry 10 Aug '12

10 Aug '12

Hi all, What attribute are you using to represent an internal telephone extension? Can't see any standards based ones. Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretec.co.uk Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk Did you see our API? http://www.surevoip.co.uk/api

4 4

critical applications
by Friedrich Locke 09 Aug '12

09 Aug '12

Dear friends, i am planning to use openldap 2.4.26 and bdb 4.6.21v0 for mission critical application mailing system. I tried some time ago i tried to implement a mail server using qmail, qmail-ldap patch, openldap and bdb but while time passed and email were coming and going, slapd was eating all system memory and needed to be restart. I wonder if someone in the mailing list have used such technologies so far and with which degree of success ? Thanks in advance for your time and cooperation. Best regards. []s gustavo.

2 1

doubt
by Luiz Guilherme Nunes Fernandes 09 Aug '12

09 Aug '12

Dear, i have one doubt, after running slaptest, the error is displayed: slapo-ppolicy cannot be global slaptest: bad configuration file! ########################## My config: # Slapd.conf # Converter slapd.conf para diretório slapd.d # slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d # schema Padrão include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema # schema adicionais include /etc/openldap/schema/collective.schema include /etc/openldap/schema/corba.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/pmi.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/qmail.schema include /etc/openldap/schema/sudo.schema # Permitir o protocolo LDAPv2 allow bind_v2 # Arquivo de informação de processos slapd pidfile /var/run/slapd/slapd.pid # Lista de argumentos que são repassados ao servidoe slapd argsfile /var/run/slapd/slapd.args # Nivel de logs loglevel 256 modulepath /usr/lib/ldap/ moduleload back_bdb.la moduleload ppolicy.la # Politicas de senhas overlay ppolicy ppolicy_default "cn=StandardPolicy,dc=abc" ppolicy_use_lockout # Limites Aplicado a toda as buscas no LDAP, Tamanho e Tempo Limite (Segundos) sizelimit 500 # Número de CPUs Utilizada para criar indíces tool-threads 1 # Banco de Dados backend bdb database bdb # Raiz da estrutura hierarquica da base OpenLdap suffix "dc=abc" # Conta admin da base OpenLdap rootdn "cn=admin,dc=abc" # Senha da conta admin OpenLdap # slappasswd -h {SSHA} -s novasenha -v # novasenha = ####### rootpw ######### # Diretório do banco de dados # Obs: Altere a permissão do diretório "chown -R ldap /var/lib/ldap" directory "/var/lib/ldap" # Quantidade de memória RAM para o cache (2Mb) dbconfig set_cachesize 0 2097152 0 # Núḿero de objetos que podem ser bloqueados ao mesmo tempo dbconfig set_lk_max_objects 1500 # Número de bloqueios dbconfig set_lk_max_locks 1500 # Número de travas dbconfig set_lk_max_lockers 1500 # Opções de indexação para a base #index objectClass eq index uid eq # Armazena o tempo e data das entradas modificadas lastmod on # Checagem periódica da base de dados checkpoint 512 30 # Controle de acessos à base de dados access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=abc" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=abc" write by * read Thanks for attention. -- <<<<<<<<<<<<<<<<<<<------------------------------>>>>>>>>>>>>>>>>>>> -=| A idéia de um fim que termina em um início. |=- Att. ♪ ♫ Luiz Guilherme Nunes Fernandes ♫ ♪ <<<<<<<<<<<<<<<<<<<------------------------------>>>>>>>>>>>>>>>>>>>

2 1

Newbie Question about adding 2nd entry for admin
by Tech Only 09 Aug '12

09 Aug '12

Hello, I am a newbie. Trying to learn ldap. Is it possible to add second admin user to openldap? Like manager/admin? If yes, please post the ldif entry. If this is a wrong forum please let me know where I can post it? Thanks, ST

2 1

ACL: access to all values vs. to value
by Dora Paula 09 Aug '12

09 Aug '12

Hi list, is there a possibility to create an acl statement that grants access to any (unknown) value of an attribute but denys access to all values of the same attribute? For example: # allow this: dn: cn=PersonA,ou=persons,o=test changetype: modify delete: description description: PersonA's description # deny this: dn: cn=PersonA,ou=persons,o=test changetype: modify delete: description - Thank you very much.

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical August 2012