openldap-technical January 2013

openldap-technical@openldap.org

71 participants
131 discussions

don't get running the slapd while using mdb backend
by Meike Stone 18 Jan '13

18 Jan '13

Hello, because of problems with bdb (virtual memory using and glibc) and limitiations (IDL), I want migrate to mdb. So my first question: Does mdb have limitations like bdb it have aka BDB_IDL_LOGN? Second, I set up an small lab for tests with mdb and don't get the slapd started with larger mdb size (10GB). Here the lab and test: Start slapd with an empty /var/lib/ldap/ldap.mdb directory I want reserve 10GByte disk space for mdb (maxsize 10737418240) error message in syslog ============================================================== @(#) $OpenLDAP: slapd 2.4.33 $ opensuse-buildservice(a)opensuse.org daemon: IPv6 socket() failed errno=97 (Address family not supported by protocol) mdb_db_open: database "ou=demo" cannot be opened, err 12. Restore from backup! backend_startup_one (type=mdb, suffix="ou=demo"): bi_db_open failed! (12) slapd stopped. created files from slapd while using ============================================================== ~# du -b /var/lib/ldap/ldap.mdb/* 12288 /var/lib/ldap/ldap.mdb/data.mdb 8192 /var/lib/ldap/ldap.mdb/lock.mdb I "straced" the start of slapd, here I think is the importand part: ============================================================== . . . stat("/var/lib/ldap/ldap.mdb", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 mmap(NULL, 2101248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe38f915000 brk(0x7fe3948ae000) = 0x7fe3948ae000 open("/var/lib/ldap/ldap.mdb/lock.mdb", O_RDWR|O_CREAT, 0600) = 9 fcntl(9, F_GETFD) = 0 fcntl(9, F_SETFD, FD_CLOEXEC) = 0 fcntl(9, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0 lseek(9, 0, SEEK_END) = 0 ftruncate(9, 8192) = 0 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_SHARED, 9, 0) = 0x7fe3941e4000 open("/var/lib/ldap/ldap.mdb/data.mdb", O_RDWR|O_CREAT, 0600) = 11 read(11, "", 4096) = 0 mmap(NULL, 10737418240, PROT_READ, MAP_SHARED, 11, 0) = -1 ENOMEM (Cannot allocate memory) close(11) = 0 munmap(0x7fe3941e4000, 8192) = 0 close(9) = 0 . . . So I tried to start slapd with the default of maxsize -- every thing is ok -- ============================================================== If i comment out maxsize 10737418240 (use the default of 10M), start slapd every thing is fine, slapd starts and create files: ~# du -b /var/lib/ldap/ldap.mdb/* 12288 /var/lib/ldap/ldap.mdb/data.mdb 8192 /var/lib/ldap/ldap.mdb/lock.mdb As I understand, at first slapd start, the database file will be created with the full size, but as sparse file? So why I don't see this, if I use the default (maxsize 10485760) Here my slapd.configuration file ============================================================== include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/rfc2307bis.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_mdb moduleload back_monitor sizelimit -1 timelimit 300 disallow bind_anon require authc gentlehup on tool-threads 4 serverID 001 database mdb suffix "ou=demo" rootdn "cn=admin" rootpw password directory /var/lib/ldap/ldap.mdb loglevel 256 maxsize 10737418240 index objectClass,entryUUID,entryCSN eq mounted filesystem for database ============================================================== debld02:/etc/openldap # mount | grep ldap /dev/sdb5 on /var/lib/ldap type ext3 (rw,relatime) free space on filsystem ============================================================== debld02:/etc/openldap # df -h | grep ldap /dev/sdb5 30G 5.6G 23G 20% /var/lib/ldap So I tried to create the sparse file manual ============================================================== ~# su -- ldap ~> id uid=76(ldap) gid=70(ldap) groups=70(ldap) ~> dd if=/dev/zero of=/var/lib/ldap/ldap.mdb/test.sparse bs=1 count=0 seek=10G 0+0 records in 0+0 records out 0 bytes (0 B) copied, 1.3413e-05 s, 0.0 kB/s ~> du -b /var/lib/ldap/ldap.mdb/test.sparse 10737418240 /var/lib/ldap/ldap.mdb/test.sparse What is going wrong with my test lab? Thanks Meike

3 4

Re: ldap update ( 2.2 to 2.4)
by Dan White 17 Jan '13

17 Jan '13

>On Thu, Jan 17, 2013 at 5:20 PM, Dan White <dwhite(a)olp.net> wrote: >> What is the output of: >> >> slapcat -n0 -s olcDatabase={1}bdb,cn=config >> >> (remove any passwords or sensitive information) >> >> Increase your debug level to see if you get any more specific information. On 01/17/13 18:37 -0200, Bruno Furtado wrote: >this is the output of slapcat: > > str2entry: invalid value for attributeType objectClass #1 (syntax >1.3.6.1.4.1.1466.115.121.1.38) That looks like the output of slapadd, not slapcat. Either that, or something strange has happened. >and this is the debug output: > config_add_internal: DN="olcDatabase={1}bdb,cn=config" no >structural objectClass in configuration table My output of the above slapcat command includes the following objectClasses (for olcDatabase={1}bdb,cn=config): objectClass: olcDatabaseConfig objectClass: olcBdbConfig If I understand your above error correctly, your configuration is bad. -- Dan White

1 0

Re: ldap update ( 2.2 to 2.4)
by Dan White 17 Jan '13

17 Jan '13

On 01/17/13 17:10 -0200, Bruno Furtado wrote: >On Fri, Jan 11, 2013 at 6:09 PM, Dan White <dwhite(a)olp.net> wrote: >> On 01/11/13 17:29 -0200, Bruno Furtado wrote: >>> On Thu, Jan 10, 2013 at 12:34 PM, Dan White <dwhite(a)olp.net> wrote: >>>> On 01/10/13 12:04 -0200, Bruno Furtado wrote: >>>>> Hi Folks! >>>>> >>>>> I'm newbie to LDAP and I received a mission to update the version. >>>>> >>>>> Today is running Openldap 2.2.23 and I need to update to OpenLDAP >>>>> 2.4.28. all update attempts failed. I observed that the new version >>>>> have a different method of configuration. >>>>> >>>>> What the best way to do this? >>>>> >>>>> >>>> What error messages did you receive? >>>> >>>> You can use slaptest (with both -f and -F options) to convert your >>>> configuration to the newer configuration database format (see man >>>> slapd-config), although you can still use a slapd.conf based >>>> configuration. >>> >>> I tried both settings. >>> >>> This is the error message: >>> >>> 50f066f8 str2entry: invalid value for attributeType objectClass #1 >>> (syntax 1.3.6.1.4.1.1466.115.121.1.38) >>> >> >> This error means that you have a value within your input, for an >> objectClass, which is invalid per rfc2252 and is not accepted by the >> newer version of slapd that you are using. >> >> Try to found out which entry in your input is causing the error. > >Now when I try to start LDAP I get this error: > >config error processing olcDatabase={1}bdb,cn=config > >olcDatabase={1}bdb.ldif aparently is ok! What is the output of: slapcat -n0 -s olcDatabase={1}bdb,cn=config (remove any passwords or sensitive information) Increase your debug level to see if you get any more specific information. -- Dan White

1 0

back-sql documentation (was: SELinux woes)
by Ori Bani 17 Jan '13

17 Jan '13

>> Trying to switch to slapd.conf instead of dynamic configuration in >> order to test the back-sql backend > > As of version 2.4.27, I believe back-sql supports dynamic configuration, so > there's no need to switch to slapd.conf > > see http://www.openldap.org/software/release/changes.html : > > OpenLDAP 2.4.27 Release (2011/11/24) > > Added slapd-sql dynamic config support Oh! Thanks for the pointer. Anyone know if there's any chance the documentation is going to be updated? It's over a year later and the docs (and everything I saw in the list archives) say I must use slapd.conf

3 2

Re: slapd crashes with ch_realloc of X bytes failed
by Meike Stone 17 Jan '13

17 Jan '13

Hello, I could update both systems during my vacation to 2.4.33. Both servers had 16GByte RAM. The system crashed again randomly (as expected). So we increased the memory on one server to 24 GByte RAM. No effect, this server crashes too, sometime till 5 times a day. I installed a test machine (VM), but only with 7GByte RAM and could reproduce the crashes with one/two parallel searches. So I tried tcmalloc, but with the same result. I digged a little deeper and the results are, that not the physical memory from the system is insufficient. First - slapd tries to allocate memory more then available, but not use it. It is enough physical memory available during slapd crashes. I ran the commands continuously with while and sleep 1: free -m, and pmap $PID_OF_LDAP and vmstat 1 The last memory information before the crash was: pmap: -------------------------- 21954: slapd START SIZE RSS PSS DIRTY SWAP PERM MAPPING 00007f63f4904000 4K 0K 0K 0K 0K rw-p [anon] 00007f63f4905000 4K 0K 0K 0K 0K ---p [anon] 00007f63f4906000 16384K 2080K 2080K 2080K 0K rw-p [anon] 00007f63f5906000 4K 0K 0K 0K 0K ---p [anon] 00007f63f5907000 16384K 4120K 4120K 4120K 0K rw-p [anon] 00007f63f6907000 4K 0K 0K 0K 0K ---p [anon] 00007f63f6908000 16384K 4120K 4120K 4120K 0K rw-p [anon] 00007f63f7908000 4K 0K 0K 0K 0K ---p [anon] 00007f63f7909000 16384K 4104K 4104K 4104K 16K rw-p [anon] 00007f63f8909000 4K 0K 0K 0K 0K ---p [anon] 00007f63f890a000 16384K 8K 8K 8K 4K rw-p [anon] 00007f63f990a000 24K 8K 8K 8K 0K rw-s /SYSV0000000c 00007f63f9910000 544K 44K 44K 44K 0K rw-s /SYSV0000000b 00007f63f9998000 2304K 12K 12K 12K 0K rw-s /SYSV0000000a 00007f63f9bd8000 2097152K 2097052K 2097052K 2097052K 0K rw-s /SYSV00000009 00007f6479bd8000 78008K 60508K 60508K 60508K 0K rw-s /SYSV00000008 00007f647e806000 16K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libplain.so.2.0.22 00007f647e80a000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libplain.so.2.0.22 00007f647ea09000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libplain.so.2.0.22 00007f647ea0a000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libplain.so.2.0.22 00007f647ea0b000 16K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libanonymous.so.2.0.22 00007f647ea0f000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libanonymous.so.2.0.22 00007f647ec0e000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libanonymous.so.2.0.22 00007f647ec0f000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libanonymous.so.2.0.22 00007f647ec10000 20K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libsasldb.so.2.0.22 00007f647ec15000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libsasldb.so.2.0.22 00007f647ee14000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libsasldb.so.2.0.22 00007f647ee15000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libsasldb.so.2.0.22 00007f647ee16000 16K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/liblogin.so.2.0.22 00007f647ee1a000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/liblogin.so.2.0.22 00007f647f019000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/liblogin.so.2.0.22 00007f647f01a000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/liblogin.so.2.0.22 00007f647f01b000 8K 0K 0K 0K 0K r-xp /lib64/libkeyutils-1.2.so 00007f647f01d000 2044K 0K 0K 0K 0K ---p /lib64/libkeyutils-1.2.so 00007f647f21c000 4K 0K 0K 0K 4K r--p /lib64/libkeyutils-1.2.so 00007f647f21d000 4K 0K 0K 0K 4K rw-p /lib64/libkeyutils-1.2.so 00007f647f21e000 28K 0K 0K 0K 0K r-xp /usr/lib64/libkrb5support.so.0.1 00007f647f225000 2048K 0K 0K 0K 0K ---p /usr/lib64/libkrb5support.so.0.1 00007f647f425000 4K 0K 0K 0K 4K r--p /usr/lib64/libkrb5support.so.0.1 00007f647f426000 4K 0K 0K 0K 4K rw-p /usr/lib64/libkrb5support.so.0.1 00007f647f427000 12K 0K 0K 0K 0K r-xp /lib64/libcom_err.so.2.1 00007f647f42a000 2044K 0K 0K 0K 0K ---p /lib64/libcom_err.so.2.1 00007f647f629000 4K 0K 0K 0K 4K r--p /lib64/libcom_err.so.2.1 00007f647f62a000 4K 0K 0K 0K 4K rw-p /lib64/libcom_err.so.2.1 00007f647f62b000 144K 0K 0K 0K 0K r-xp /usr/lib64/libk5crypto.so.3.1 00007f647f64f000 2044K 0K 0K 0K 0K ---p /usr/lib64/libk5crypto.so.3.1 00007f647f84e000 8K 0K 0K 0K 8K r--p /usr/lib64/libk5crypto.so.3.1 00007f647f850000 4K 0K 0K 0K 4K rw-p /usr/lib64/libk5crypto.so.3.1 00007f647f851000 632K 0K 0K 0K 0K r-xp /usr/lib64/libkrb5.so.3.3 00007f647f8ef000 2044K 0K 0K 0K 0K ---p /usr/lib64/libkrb5.so.3.3 00007f647faee000 12K 0K 0K 0K 12K r--p /usr/lib64/libkrb5.so.3.3 00007f647faf1000 8K 0K 0K 0K 8K rw-p /usr/lib64/libkrb5.so.3.3 00007f647faf3000 172K 0K 0K 0K 0K r-xp /usr/lib64/libgssapi_krb5.so.2.2 00007f647fb1e000 2048K 0K 0K 0K 0K ---p /usr/lib64/libgssapi_krb5.so.2.2 00007f647fd1e000 4K 0K 0K 0K 4K r--p /usr/lib64/libgssapi_krb5.so.2.2 00007f647fd1f000 4K 0K 0K 0K 4K rw-p /usr/lib64/libgssapi_krb5.so.2.2 00007f647fd20000 28K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libgssapiv2.so.2.0.22 00007f647fd27000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libgssapiv2.so.2.0.22 00007f647ff26000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libgssapiv2.so.2.0.22 00007f647ff27000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libgssapiv2.so.2.0.22 00007f647ff28000 48K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libdigestmd5.so.2.0.22 00007f647ff34000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libdigestmd5.so.2.0.22 00007f6480133000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libdigestmd5.so.2.0.22 00007f6480134000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libdigestmd5.so.2.0.22 00007f6480135000 84K 0K 0K 0K 0K r-xp /lib64/libz.so.1.2.3 00007f648014a000 2044K 0K 0K 0K 0K ---p /lib64/libz.so.1.2.3 00007f6480349000 4K 0K 0K 0K 4K r--p /lib64/libz.so.1.2.3 00007f648034a000 4K 0K 0K 0K 4K rw-p /lib64/libz.so.1.2.3 00007f648034b000 84K 0K 0K 0K 0K r-xp /lib64/libgcc_s.so.1 00007f6480360000 2044K 0K 0K 0K 0K ---p /lib64/libgcc_s.so.1 00007f648055f000 4K 0K 0K 0K 4K r--p /lib64/libgcc_s.so.1 00007f6480560000 4K 0K 0K 0K 4K rw-p /lib64/libgcc_s.so.1 00007f6480561000 940K 0K 0K 0K 0K r-xp /usr/lib64/libstdc++.so.6.0.16 00007f648064c000 2048K 0K 0K 0K 0K ---p /usr/lib64/libstdc++.so.6.0.16 00007f648084c000 32K 0K 0K 0K 32K r--p /usr/lib64/libstdc++.so.6.0.16 00007f6480854000 8K 0K 0K 0K 8K rw-p /usr/lib64/libstdc++.so.6.0.16 00007f6480856000 84K 0K 0K 0K 4K rw-p [anon] 00007f648086b000 36K 28K 28K 0K 0K r-xp /lib64/libunwind.so.7.0.0 00007f6480874000 2044K 0K 0K 0K 0K ---p /lib64/libunwind.so.7.0.0 00007f6480a73000 4K 4K 4K 4K 0K r--p /lib64/libunwind.so.7.0.0 00007f6480a74000 4K 4K 4K 4K 0K rw-p /lib64/libunwind.so.7.0.0 00007f6480a75000 16K 4K 4K 4K 0K rw-p [anon] 00007f6480a79000 1460K 444K 38K 0K 0K r-xp /lib64/libc-2.11.3.so 00007f6480be6000 2048K 0K 0K 0K 0K ---p /lib64/libc-2.11.3.so 00007f6480de6000 16K 16K 16K 8K 0K r--p /lib64/libc-2.11.3.so 00007f6480dea000 4K 4K 4K 4K 0K rw-p /lib64/libc-2.11.3.so 00007f6480deb000 20K 16K 16K 16K 4K rw-p [anon] 00007f6480df0000 36K 28K 10K 0K 0K r-xp /lib64/libwrap.so.0.7.6 00007f6480df9000 2044K 0K 0K 0K 0K ---p /lib64/libwrap.so.0.7.6 00007f6480ff8000 4K 4K 4K 0K 0K r--p /lib64/libwrap.so.0.7.6 00007f6480ff9000 4K 4K 4K 4K 0K rw-p /lib64/libwrap.so.0.7.6 00007f6480ffa000 4K 4K 4K 4K 0K rw-p [anon] 00007f6480ffb000 76K 4K 0K 0K 0K r-xp /lib64/libresolv-2.11.3.so 00007f648100e000 2048K 0K 0K 0K 0K ---p /lib64/libresolv-2.11.3.so 00007f648120e000 4K 0K 0K 0K 4K r--p /lib64/libresolv-2.11.3.so 00007f648120f000 4K 0K 0K 0K 4K rw-p /lib64/libresolv-2.11.3.so 00007f6481210000 8K 0K 0K 0K 0K rw-p [anon] 00007f6481212000 48K 4K 0K 0K 0K r-xp /lib64/libcrypt-2.11.3.so 00007f648121e000 2044K 0K 0K 0K 0K ---p /lib64/libcrypt-2.11.3.so 00007f648141d000 4K 0K 0K 0K 4K r--p /lib64/libcrypt-2.11.3.so 00007f648141e000 4K 0K 0K 0K 4K rw-p /lib64/libcrypt-2.11.3.so 00007f648141f000 184K 0K 0K 0K 0K rw-p [anon] 00007f648144d000 1484K 4K 4K 0K 0K r-xp /usr/lib64/libcrypto.so.0.9.8 00007f64815c0000 2044K 0K 0K 0K 0K ---p /usr/lib64/libcrypto.so.0.9.8 00007f64817bf000 64K 0K 0K 0K 64K r--p /usr/lib64/libcrypto.so.0.9.8 00007f64817cf000 100K 0K 0K 0K 100K rw-p /usr/lib64/libcrypto.so.0.9.8 00007f64817e8000 16K 0K 0K 0K 12K rw-p [anon] 00007f64817ec000 308K 4K 4K 0K 0K r-xp /usr/lib64/libssl.so.0.9.8 00007f6481839000 2044K 0K 0K 0K 0K ---p /usr/lib64/libssl.so.0.9.8 00007f6481a38000 8K 0K 0K 0K 8K r--p /usr/lib64/libssl.so.0.9.8 00007f6481a3a000 24K 0K 0K 0K 24K rw-p /usr/lib64/libssl.so.0.9.8 00007f6481a40000 8K 4K 0K 0K 0K r-xp /lib64/libdl-2.11.3.so 00007f6481a42000 2048K 0K 0K 0K 0K ---p /lib64/libdl-2.11.3.so 00007f6481c42000 4K 0K 0K 0K 4K r--p /lib64/libdl-2.11.3.so 00007f6481c43000 4K 0K 0K 0K 4K rw-p /lib64/libdl-2.11.3.so 00007f6481c44000 100K 44K 36K 0K 0K r-xp /usr/lib64/libsasl2.so.2.0.22 00007f6481c5d000 2048K 0K 0K 0K 0K ---p /usr/lib64/libsasl2.so.2.0.22 00007f6481e5d000 4K 4K 4K 4K 0K r--p /usr/lib64/libsasl2.so.2.0.22 00007f6481e5e000 4K 4K 4K 4K 0K rw-p /usr/lib64/libsasl2.so.2.0.22 00007f6481e5f000 84K 4K 0K 0K 0K r-xp /lib64/libnsl-2.11.3.so 00007f6481e74000 2044K 0K 0K 0K 0K ---p /lib64/libnsl-2.11.3.so 00007f6482073000 4K 0K 0K 0K 4K r--p /lib64/libnsl-2.11.3.so 00007f6482074000 4K 0K 0K 0K 4K rw-p /lib64/libnsl-2.11.3.so 00007f6482075000 8K 0K 0K 0K 0K rw-p [anon] 00007f6482077000 364K 4K 0K 0K 0K r-xp /lib64/libm-2.11.3.so 00007f64820d2000 2044K 0K 0K 0K 0K ---p /lib64/libm-2.11.3.so 00007f64822d1000 4K 0K 0K 0K 4K r--p /lib64/libm-2.11.3.so 00007f64822d2000 120K 0K 0K 0K 8K rw-p /lib64/libm-2.11.3.so 00007f64822f0000 96K 4K 4K 0K 0K r-xp /usr/lib64/libslp.so.1.0.0 00007f6482308000 2044K 0K 0K 0K 0K ---p /usr/lib64/libslp.so.1.0.0 00007f6482507000 4K 0K 0K 0K 4K r--p /usr/lib64/libslp.so.1.0.0 00007f6482508000 4K 0K 0K 0K 4K rw-p /usr/lib64/libslp.so.1.0.0 00007f6482509000 92K 76K 26K 0K 0K r-xp /lib64/libpthread-2.11.3.so 00007f6482520000 2048K 0K 0K 0K 0K ---p /lib64/libpthread-2.11.3.so 00007f6482720000 4K 4K 4K 4K 0K r--p /lib64/libpthread-2.11.3.so 00007f6482721000 4K 4K 4K 4K 0K rw-p /lib64/libpthread-2.11.3.so 00007f6482722000 16K 4K 4K 4K 0K rw-p [anon] 00007f6482726000 400K 4K 4K 0K 0K r-xp /usr/lib64/libodbc.so.1.0.0 00007f648278a000 2044K 0K 0K 0K 0K ---p /usr/lib64/libodbc.so.1.0.0 00007f6482989000 4K 0K 0K 0K 4K r--p /usr/lib64/libodbc.so.1.0.0 00007f648298a000 28K 0K 0K 0K 28K rw-p /usr/lib64/libodbc.so.1.0.0 00007f6482991000 4K 0K 0K 0K 0K rw-p [anon] 00007f6482992000 1224K 196K 187K 0K 0K r-xp /usr/lib64/libdb-4.5.so 00007f6482ac4000 2048K 0K 0K 0K 0K ---p /usr/lib64/libdb-4.5.so 00007f6482cc4000 12K 4K 4K 4K 8K r--p /usr/lib64/libdb-4.5.so 00007f6482cc7000 12K 12K 12K 12K 0K rw-p /usr/lib64/libdb-4.5.so 00007f6482cca000 36K 4K 0K 0K 0K r-xp /usr/lib64/libltdl.so.7.2.0 00007f6482cd3000 2044K 0K 0K 0K 0K ---p /usr/lib64/libltdl.so.7.2.0 00007f6482ed2000 4K 0K 0K 0K 4K r--p /usr/lib64/libltdl.so.7.2.0 00007f6482ed3000 4K 0K 0K 0K 4K rw-p /usr/lib64/libltdl.so.7.2.0 00007f6482ed4000 56K 44K 14K 0K 0K r-xp /usr/lib64/liblber-2.4.so.2.8.5 00007f6482ee2000 2044K 0K 0K 0K 0K ---p /usr/lib64/liblber-2.4.so.2.8.5 00007f64830e1000 4K 4K 4K 4K 0K r--p /usr/lib64/liblber-2.4.so.2.8.5 00007f64830e2000 4K 4K 4K 4K 0K rw-p /usr/lib64/liblber-2.4.so.2.8.5 00007f64830e3000 308K 64K 64K 0K 0K r-xp /usr/lib64/libldap_r-2.4.so.2.8.5 00007f6483130000 2048K 0K 0K 0K 0K ---p /usr/lib64/libldap_r-2.4.so.2.8.5 00007f6483330000 4K 4K 4K 4K 0K r--p /usr/lib64/libldap_r-2.4.so.2.8.5 00007f6483331000 8K 8K 8K 8K 0K rw-p /usr/lib64/libldap_r-2.4.so.2.8.5 00007f6483333000 12K 8K 8K 8K 4K rw-p [anon] 00007f6483336000 288K 96K 96K 0K 0K r-xp /usr/local/lib/libtcmalloc.so.4.1.0 00007f648337e000 2044K 0K 0K 0K 0K ---p /usr/local/lib/libtcmalloc.so.4.1.0 00007f648357d000 4K 4K 4K 4K 0K r--p /usr/local/lib/libtcmalloc.so.4.1.0 00007f648357e000 4K 4K 4K 4K 0K rw-p /usr/local/lib/libtcmalloc.so.4.1.0 00007f648357f000 156K 92K 92K 88K 36K rw-p [anon] 00007f64835a6000 124K 40K 0K 0K 0K r-xp /lib64/ld-2.11.3.so 00007f6483708000 212K 0K 0K 0K 0K r--s /var/run/nscd/group 00007f648373d000 212K 0K 0K 0K 0K r--s /var/run/nscd/passwd 00007f6483772000 212K 0K 0K 0K 0K r--s /var/run/nscd/dbvbS4oY 00007f64837a7000 48K 28K 28K 24K 20K rw-p [anon] 00007f64837bc000 24K 8K 8K 8K 0K rw-s /SYSV00000007 00007f64837c2000 8K 4K 4K 4K 4K rw-p [anon] 00007f64837c4000 4K 4K 4K 4K 0K r--p /lib64/ld-2.11.3.so 00007f64837c5000 4K 4K 4K 4K 0K rw-p /lib64/ld-2.11.3.so 00007f64837c6000 4K 4K 4K 4K 0K rw-p [anon] 00007f64837c7000 1944K 456K 456K 0K 0K r-xp /usr/lib/openldap/slapd 00007f6483bac000 20K 8K 8K 8K 12K r--p /usr/lib/openldap/slapd 00007f6483bb1000 48K 24K 24K 24K 24K rw-p /usr/lib/openldap/slapd 00007f6483bbd000 3812K 1052K 1052K 984K 1788K rw-p [heap] 00007f6483f76000 5004408K 4574484K 4574484K 4574392K 257508K rw-p [heap] 00007fff9f532000 132K 4K 4K 4K 32K rw-p [stack] 00007fff9f5b6000 4K 4K 0K 0K 0K r-xp [vdso] ffffffffff600000 4K 0K 0K 0K 0K r-xp [vsyscall] Total: 7350688K 6749464K 6748875K 6747724K 259932K 5091328K writable-private, 80668K readonly-private, 2178692K shared, and 4900700K referenced ================================================================================ last free -m before crash: ------------------------------- total used free shared buffers cached Mem: 6928 6813 115 0 0 2180 -/+ buffers/cache: 4632 2296 Swap: 2047 288 1759 last free after crash: ------------------------------- total used free shared buffers cached Mem: 6928 4978 1950 0 0 2166 -/+ buffers/cache: 2810 4117 Swap: 2047 42 2005 ================================================================================ and vmstat: ------------------------------- procs -----------memory---------- ---swap-- -----io---- -system-- -----cpu------ r b swpd free buff cache si so bi bo in cs us sy id wa st 1 4 295284 110148 540 2255804 108 0 13428 0 796 1373 3 5 27 65 0 0 3 295260 118140 608 2242804 36 0 9308 0 2227 1309 2 5 23 70 0 0 3 295224 116668 680 2237396 48 0 4008 0 1253 2002 3 6 52 39 0 1 0 295164 116296 736 2232588 128 0 6028 0 1083 954 3 14 45 39 0 0 0 42332 4742716 768 2219044 784 0 1104 0 1428 1178 3 23 63 11 0 0 0 42332 4743020 768 2219168 0 0 0 0 253 97 0 0 100 0 0 0 0 42332 4743408 768 2219160 0 0 0 0 201 98 0 0 100 0 0 0 1 42300 4743408 768 2219140 216 0 216 0 295 150 0 0 99 1 0 What I see, that slapd had reserved "Total: 7350688K" (overcommitted?), but only referenced 4900700K. Why does slapd reserve so much memory and use it not? Because of this, I changed the default values for memory overcomittment from: vm.overcommit_memory = 0 (guess, default) vm.overcommit_ratio = 50 to: vm.overcommit_memory=2 (strict overcommit) vm.overcommit_ratio=100 but it crashed again (ch_malloc of 34545 bytes failed): . . 00007f2bf8e1a000 5019920K 4597460K 4597460K 4597116K 333472K rw-p [heap] 00007fffe86c5000 132K 0K 0K 0K 36K rw-p [stack] 00007fffe87af000 4K 4K 0K 0K 0K r-xp [vdso] ffffffffff600000 4K 0K 0K 0K 0K r-xp [vsyscall] Total: 7333420K 6766996K 6766484K 6765536K 336192K 5074068K writable-private, 80660K readonly-private, 2178692K shared, and 4681876K referenced So in spite of increase the memory from 16GByte to 24 GByte (one of the production server - configuration described in the first mail) same results. Is there anywhere a memory leak - how can I find out this? Thanks Meike P.S., mdb is not the option now, we need time to evaluate this ...

2 3

[OT] SELinux woes
by Ori Bani 17 Jan '13

17 Jan '13

All, Trying to switch to slapd.conf instead of dynamic configuration in order to test the back-sql backend I ran into a problem with SELinux that I do not understand. The startup fails with the error: /etc/openldap/slapd.conf: line 27: invalid path: Permission denied Disabling SELinux fixes the problem, however I'm not sure what is going on. The line in question is naturally the "directory" that points in this case to /var/lib/ldap. That directory is a hand-made clone of the original one that was there which was moved (renamed) out of the way. Here is what I did: mv /etc/openldap/slapd.d /etc/openldap/slapd.d.BAK mv /var/lib/ldap /var/lib/ldap.BAK mkdir /var/lib/ldap chown ldap:ldap /var/lib/ldap chmod 700 /var/lib/ldap create a simple /etc/openldap/slapd.conf The ownership and permissions on ldap and ldap.BAK directories are identical. OpenLDAP works fine if I disable SELinux. What is SELinux doing here?

3 3

Issue with LDAP TLS for Unix Login
by Arvind Navale 17 Jan '13

17 Jan '13

Hi Folks, I have a openldap server version slapd 2.4.16 running on a Solaris-10 OS. I have generated the self signed CA certificate on the ldap server to use TLS and configured the slapd.conf with certificate information. I am looking to get LDAP authentication using TLS on the ldap client side. I was able to setup centos-6.3 linux as ldap client using openldap client to LDAP authentication using TLS but I am having issues to setup a Solaris-10 OS using native LDAP client software. Solaris-10 LDAP client is setup using 'ldapclient manaul' and certificate was added using certutil command. Here is error messages seeing when trying to authenticate when using LDAP-TLS in sladp.log file on the openldap server side, Jan 14 14:51:53 ldapsrv slapd[543]: [ID 848112 local4.debug] conn=1270 fd=25 ACCEPT from IP=10.90.180.236:41051 (IP=0.0.0.0:636) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 609413 local4.debug] daemon: waked Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 802679 local4.debug] daemon: activity on: Jan 14 14:51:53 ldapsrv slapd[543]: [ID 522297 local4.debug] 25r Jan 14 14:51:53 ldapsrv slapd[543]: [ID 100000 local4.debug] Jan 14 14:51:53 ldapsrv slapd[543]: [ID 694296 local4.debug] daemon: read activity on 25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 525477 local4.debug] connection_get(25) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 611214 local4.debug] connection_get(25): got connid=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 138202 local4.debug] connection_read(25): checking for input on id=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 609413 local4.debug] daemon: waked Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 802679 local4.debug] daemon: activity on: Jan 14 14:51:53 ldapsrv slapd[543]: [ID 522297 local4.debug] 25r Jan 14 14:51:53 ldapsrv slapd[543]: [ID 100000 local4.debug] Jan 14 14:51:53 ldapsrv slapd[543]: [ID 694296 local4.debug] daemon: read activity on 25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 525477 local4.debug] connection_get(25) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 611214 local4.debug] connection_get(25): got connid=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 138202 local4.debug] connection_read(25): checking for input on id=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 688457 local4.debug] connection_read(25): TLS accept failure error=-1 id=1270, closing Jan 14 14:51:53 ldapsrv slapd[543]: [ID 734893 local4.debug] connection_closing: readying conn=1270 sd=25 for close Jan 14 14:51:53 ldapsrv slapd[543]: [ID 330685 local4.debug] connection_close: conn=1270 sd=25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 609413 local4.debug] daemon: waked Jan 14 14:51:53 ldapsrv slapd[543]: [ID 423323 local4.debug] daemon: removing 25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 485650 local4.debug] conn=1270 fd=25 closed (TLS negotiation failure) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 802679 local4.debug] daemon: activity on: Jan 14 14:51:53 ldapsrv slapd[543]: [ID 522297 local4.debug] 23r Jan 14 14:51:53 ldapsrv slapd[543]: [ID 100000 local4.debug] On the ldap client side I have enabled pam debugging and I see the following error messages associated with it, Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 492885 auth.debug] PAM[6459]: pam_setcred(80c9bd8, 2) Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 931871 auth.debug] PAM[6459]: load_modules(80c9bd8, pam_sm_setcred)=/usr/lib/security/pam_authtok_get.s o.1 Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 962116 auth.debug] PAM[6459]: pam_setcred(80c9bd8, 2): error Permission denied Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 509612 auth.debug] PAM[6459]: pam_set_item(80c9bd8:authtok) Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 725776 auth.debug] PAM[6459]: pam_end(80c9bd8): status = Permission denied Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 826707 auth.debug] PAM[6820]: pam_set_item(80c9bd8:authtok) Jan 14 14:52:45 drac9ec2 last message repeated 1 time Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 887652 auth.debug] PAM[6820]: pam_authenticate(80c9bd8, 1): error Authentication failed Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 285619 auth.debug] ldap pam_sm_authenticate(sshd-kbdint ldapusr2), flags = 1 Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 293258 auth.warning] libsldap: Status: 81 Mesg: openConnection: simple bind failed - Can't contact LDA P server Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 887652 auth.debug] PAM[6820]: pam_authenticate(80c9bd8, 1): error Permission denied Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 826707 auth.debug] PAM[6820]: pam_set_item(80c9bd8:authtok) Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 800047 auth.info] Keyboard-interactive (PAM) userauth failed[9] while authenticating: Authentication fa iled Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 800047 auth.notice] Failed keyboard-interactive for ldapusr2 from 10.90.176.38 port 44078 ssh2 Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 826707 auth.debug] PAM[6820]: pam_set_item(80c9bd8:conv) Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 814791 auth.debug] PAM[6820]: pam_end(80c9bd8): status = Authentication failed Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 324150 auth.debug] PAM[6820]: pam_start(sshd-kbdint,ldapusr2,80a98a8:80c9bd8) - debug = 1 Here is the ldapclient I have ran to setup the ldapclient, ldapclient -v manual -a defaultServerList=10.90.177.2 -a credentialLevel=anonymous -a domainName=dvsg-ldap.com -a defaultSearchBase=dc=dvsg-ldap,dc=com -a authenticationMethod=tls:simple -a serviceAuthenticationMethod=pam_ldap:tls:simple -a proxyDN=cn=readonly,dc=dvsg-ldap,dc=com -a proxyPassword=secret -a certificatePath=/var/ldap Any guidance or help to resolve this issue would be most appreciated. thank you, Arvind.

1 0

Strange ACL evaluation depending on AttributeSelection?
by Michael Ströder 17 Jan '13

17 Jan '13

HI! Today I made a strange observation tested with release 2.4.32 and git-build RE24 6f33e2c both with same results. The following commands (lines wrapped herein) were all typed as user root which gets mapped by authz-regexp to the rootdn of the database o=example (LDAPI with SASL/EXTERNAL). Let's check that: # ldapwhoami SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn:uid=admin,o=example I wanted to check ACLs applied to attribute 'sambaNTPassword' and to test Samba logon of course. Samba logon did work when putting the Samba demon user in a special group which has read access everywhere but it didn't when the special Samba ACLs were to be applied. So I tried to examine a possible bug in my ACLs but noticed unexpected results during that. Everything looks fine with a normal search as rootdn and we see that the entry indeed contains 'sambaNTPassword': # ldapsearch -LLL "(&(objectclass=sambaSamAccount)(uid=wtester))" sambaNTPassword SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: employeeNumber=42424242,ou=users,o=example sambaNTPassword: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx But when requesting to use the authz-DN with which the Samba demon binds the attribute is not shown which one might consider an ACL issue. Note that sambaNTPassword is explicitly requested just like Samba correctly does it: # ldapsearch -LLL -X "dn:uid=samba_dc_1,ou=samba,o=example" "(&(objectclass=sambaSamAccount)(uid=wtester))" sambaNTPassword SASL/EXTERNAL authentication started SASL username: dn:uid=samba_dc_1,ou=samba,o=example SASL SSF: 0 dn: employeeNumber=42424242,ou=users,o=example But then I would expect this search also *not* to return attribute 'sambaNTPassword' but it does! # ldapsearch -LLL -X "dn:uid=samba_dc_1,ou=samba,o=example" "(&(objectclass=sambaSamAccount)(uid=wtester))" "*" |grep -i sambaNTPassword SASL/EXTERNAL authentication started SASL username: dn:uid=samba_dc_1,ou=samba,o=example SASL SSF: 0 sambaNTPassword: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Maybe I'm doing something wrong on the command-line but I simply don't get it... :-/ Or is there some difference in ACL handling based on SearchRequest.attributes (AttributeSelection)? I have an ACL which blocks access to password attributes of disabled users by using a filter-based ACL. Hmm, I did not try what happens when explicitly requesting the attribute used in the filter. I have to do that tomorrow... Ciao, Michael.

2 3

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

Ok Thanks a lot , looks like i will be able to swim through Final question, before going for this config. What would be impact of lastmode on/off with and without replication with big db size. On Thu, Jan 17, 2013 at 4:45 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 17, 2013 4:37 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> I am using rpm from symas, latest update on 29th dec,2013. i think that >> will work. >> >> Is my acceslog db configuration in slapd.conf right ? >> > > If that is your actual config file, no. You stuck the definition of the > accesslog DB in the middle of your existing DB configuration, which is > going to cause you all sorts of problems. I prefer to list the accesslog > db prior to the main db. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

1 0

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

I am using rpm from symas, latest update on 29th dec,2013. i think that will work. Is my acceslog db configuration in slapd.conf right ? On Thu, Jan 17, 2013 at 4:27 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 17, 2013 2:49 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> My Bad >> >> Going forward, what would be my strategy, to enable delta sync repl with >> one master is already running with 200G mdb db. >> >> What i understand is >> 1.enable accesslog overlay on master server configure accesslog start >> the master >> 2. Take backup with mdb_copyand restore it on other master servers. >> 3. Enable accesslog configure to new consumers(work as providers as >> well) >> > > That sounds about right. I assume you are using current RE24 OpenLDAP, > and not 2.4.33. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

2 1

← Newer
1
...
4
5
6
7
8
9
10
...
14
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical January 2013