openldap-technical January 2013

openldap-technical@openldap.org

71 participants
131 discussions

Replication LDAP Users Samba
by rodrigo tavares 29 Jan '13

29 Jan '13

Hello, Today, I have one host vmware, it a master, it replicate all datas about LDAP from filesever01 (Samba). Using LDAP, I using the inteface, and when i create a ldap user, it create a samba account. So, i not need create user samba. ldap admin dn = cn=admin,dc=def,dc=mg,dc=gov,dc=us ldap group suffix = ou=Groups ldap machine suffix = ou=Computers ldap passwd sync = yes pam password change = yes encrypt passwords = True ldap suffix = ou=def,dc=def,dc=mg,dc=gov,dc=us ldap ssl = no ldap user suffix = ou=Users Well, When I remove slapd config replicate, i got change users samba passwords. But is replication LDAP is active, my ldap users can to email, but sambausers is not login in domain. root@fileserver02:~# smbclient -L localhost -U house.green Enter house.green's password: session setup failed: NT_STATUS_LOGON_FAILURE Any suggestion ? Rodrigo Faria Tavares

1 0

389 port is closed from the client point of view
by Asmaa Ahmed 29 Jan '13

29 Jan '13

Hello, I am trying to get my ldap binding running, but some how it doen't work!When I checked the port using nmap, I can see clearly that it is closed while the server listens to it! client# nmap -p 389 ldap.domain.com Starting Nmap 5.00 ( http://nmap.org ) at 2013-01-29 23:09 ESTInteresting ports on ldap.domain.com (203.28.247.83):PORT STATE SERVICE389/tcp closed ldap Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds root@server:/etc/ldap# nmap -p 389 localhost Starting Nmap 5.00 ( http://nmap.org ) at 2013-01-29 23:09 ESTInteresting ports on localhost (127.0.0.1):PORT STATE SERVICE389/tcp open ldap Nmap done: 1 IP address (1 host up) scanned in 0.04 secondsroot@server:/etc/ldap#root@server:/etc/ldap# nmap localhost Starting Nmap 5.00 ( http://nmap.org ) at 2013-01-29 23:10 ESTInteresting ports on localhost (127.0.0.1):Not shown: 994 closed portsPORT STATE SERVICE22/tcp open ssh80/tcp open http389/tcp open ldap464/tcp open kpasswd5636/tcp open ldapssl749/tcp open kerberos-adm Nmap done: 1 IP address (1 host up) scanned in 0.05 secondsroot@server:/etc/ldap# cat /etc/hosts127.0.0.1 localhost#127.0.1.1 ldap.domain.com ldap203.28.247.83 ldap.domain.com ldap How can I fix this? Thanks.

2 3

Re: replication between a back-sql master and back-hdb slave
by Benin Technologies 28 Jan '13

28 Jan '13

ok thanks I found that in the mailing list archive, dating back from 2007 (http://www.openldap.org/lists/openldap-software/200708/msg00015.html) Indeed back-sql was intended to loosely support acting as a syncrepl provider (limited to refreshOnly), but it's currently broken, and it's never been fixed (mostly due to lack of interest). Patches (or sponsorships) are welcome. Ing. Pierangelo Masarati OpenLDAP Core Team So I was wondering if it has been fix since... > your question is, can I use back-sql as syncperov. A sql backend is not > a fully featered database to use with slapd. > > -Dieter >

3 4

Usage of groups in an access control
by Marco de Booij 28 Jan '13

28 Jan '13

I use openLDAP already for years to store my users so I have to define them only once. The users can logon to both Linux and Windows (samba). Now I want to add address-books and manage the access rights. I have a problem with the usage of groups in an access control. I want to gave addressbooks in my LDAP but they should not be accessible by everybody. I used http://www.openldap.org/faq/data/cache/52.html to configure openLDAP but it does not seem to work. I have created a group like this: dn: cn=abk-admin,ou=Roles,dc=example,dc=com objectClass: groupOfNames member: cn=My ENTRY,ou=People,dc=example,dc=com cn: abk-admin and an address-book like this: dn: ou=abk1,ou=Addressbooks,dc=example,dc=com ou: abk1 objectClass: organizationalUnit objectClass: top (Both entries are output of slapcat. I did not put in the attributes like creatorsName and entryUUID) In the slapd:conf I have the following access rules: access to attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdMustChange,sambaPwdLastSet by dn="cn=admin,dc=example,dc=com" write by dn="cn=proxyuser,dc=example,dc=com" read by anonymous auth by self write by * none access to attrs=shadowLastChange,shadowMax by self write by * read access to dn.base="" by * read access to * by dn="cn=admin,dc=example,dc=com" write by * read access to dn.children="ou=abk1,ou=Addressbooks,dc=example,dc=com" by dn="cn=admin,dc=example,dc=com" write by groupOfNames="cn=abk-admin,ou=Roles,dc=example,dc=com" write by groupOfNames="cn=abk-user,ou=Roles,dc=example,dc=com" read by * none I searched around and changed dn.children by dn.subtree and dn.one but the result is the same. I can read the entries but I cannot insert or delete an entry. I can only do this with admin but only if the line for admin is defined. What did I do wrong or understood wrong? I tried to find the answer on the internet but was not able :( OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) Debian 6.0.6 Regards, Marco

4 6

Re: Permissions, users, startup when install from source
by Ori Bani 28 Jan '13

28 Jan '13

Thanks for your reply, >> If compiling and installing from source, I don't see any information >> in the manual about how to auto-start the software and about >> process/file/directory permissions and ownership. I'm still searching >> the Faq-O-Matic (which is a little frustrating). >> >> Taking a step back, I'd love to install from yum on RHEL/CentOS and >> let it be taken care of in a trusted manner. But we require better >> password hashing than SHA1, so we are required to compile by hand >> using the passwd/sha2 contributed module (little surprised this isn't >> accepted into the core project, but I'm sure there are reasons). >> Maybe I can find this in a third-party repo somewhere? > > Not sure what you mean. the SHA2 contrib module is shipped with every > OpenLDAP release. Thus, as best I can tell, it is indeed included. My "surprised" comment is in reference to the fact that the default build of OpenLDAP only supports SHA1, which is widely regarded as deprecated. Why hasn't the sha2 module been migrated out of the contrib directory is what I am getting at (which commonly requires situations like this -- forcing people who wouldn't otherwise do so to install from source just to obtain this feature). One could argue that situations like this contribute to the lack of adoption of stronger password schemes in general. Something of an off-topic tangent. > If you are using RHEL or CentOS, you may be interested in > <http://ltb-project.org/wiki/download#openldap> Great. I will investigate. Does anyone else know of any yum-compatible repos that have a sha2-enabled OpenLDAP build in them? Anyone know anything about the OpenLDAP packages in RepoForge? I actually only assumed without testing that the OpenLDAP package in the CentOS base repo doesn't have the sha2 module compiled in. I should go back and check that assumption. Also, reflecting on the installation of the sha2 module, it occurs to me that short of the CentOS repo package already having sha2 compiled in, the best course of action is probably to compile only the sha2 module and use it with the CentOS package --- including the module in the slapd configuration seems to be the extent of integration, so that should work, no? If so, I think this would be the best option. >> After installation, what is commonly done in this regard? Create >> user/group "ldap" with no login shell and chown ldap:ldap on >> /usr/local/var/openldap-data? Is that all? > > It depends on your needs. I have done anything from running slapd as root, > to running it as a specific user. I'd welcome pointers to somewhere this is discussed (don't see it in the docs, maybe in the FAQ?). I don't have needs that are much different than anyone else. I naively assume slapd should generally not be run as root. In that case, is creating a ldap user/group and chowning the openldap-data directory the only things to do? >> Then what do people use for auto-starting the software (presumably >> with -u ldap -g ldap) in a RedHat environment? > > I wrote my own startup script that works with chkconfig. > <http://linuxcommand.org/man_pages/chkconfig8.html> I'm looking for anyone who wants to share such scripts. Thanks kindly for your time, much appreciated.

5 9

Re: syncrepl issue
by Meike Stone 28 Jan '13

28 Jan '13

> > a) Use a current release. That would be 2.4.33. > b) Delta-syncrepl supports MMR in current releases > c) The reason I suggest delta-syncrepl is because syncrepl is known to be > problematic, particularly with MMR. If you want reliable replication, use > delta-syncrepl. Is it recommended in MMR setups to use delta-syncrepl before syncrepl in general? Are there any disadvantages, like using more RAM, or other things to care..? Thanks, Meike

2 1

replication between a back-sql master and back-hdb slave
by Benin Technologies 28 Jan '13

28 Jan '13

Hi, I set up a back-sql server to access some existing data in a postgresql database. I was wondering if it's possible to replicate that server to some (read-only) back-hdb servers. Thanks BT

2 2

Is any way to make proxy cache working for acl requests?
by Tio Teath 28 Jan '13

28 Jan '13

I'm thick and tired of configuring this dame thing! I mean slapo-pcache. It just won't work. Is any way to force this to cache JUST EVERYTHING, including ACL requests to remote server? I don't care of disk or memory usage, I just want dame thing working!

1 0

back-sql : defining groups
by DavidHornung 27 Jan '13

27 Jan '13

Hello, until now I don't understand how to add users to a group in Openldap with back-sql I use a VIEW for ldap_entries like described in the manual pages of slapd-sql. CREATE VIEW ldap_entries (id, dn, oc_map_id, parent, keyval) AS SELECT 0, UPPER(’o=MyCompany,c=NL’), 3, 0, ’baseObject’ FROM unixusers WHERE userid=’root’ UNION SELECT (1000000000+userid), UPPER(CONCAT(CONCAT(’cn=’,gecos),’,o=MyCompany,c=NL’)), 1, 0, userid FROM unixusers UNION SELECT (2000000000+groupnummer), UPPER(CONCAT(CONCAT(’cn=’,groupnaam),’,o=MyCompany,c=NL’)), 2, 0, groupnummer FROM groups; How can I add users to a group? 1.) build additional entries like uid=testuser,cn=group1,o=MyCompany,c=NL OR 2.) use the memberOf Attribute (but how?) Thank you for your answers Cheers, David

1 0

Re: slapcat output is truncated every now and then
by Bálint Réczey 25 Jan '13

25 Jan '13

Hi Quanah, 2013/1/25 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Friday, January 25, 2013 12:07 AM +0100 Bálint Réczey < > balint(a)balintreczey.hu> wrote: > > >> I have a attached two patches hoping that they may be useful. >> > > I suggest you file an ITS if you want them considered for inclusion: > I have file them under http://www.openldap.org/its/index.cgi?findid=7503 and http://www.openldap.org/its/index.cgi?findid=7504 hopefully complying to the instructions. Please CC me in further related discussions about the problem because I will unsubscribe from the list for now. Cheers, Balint

2 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical January 2013