openldap-technical December 2013

openldap-technical@openldap.org

61 participants
73 discussions

ADDING OBJECT CLASS
by Borresen, John - 0442 - MITLL 23 Dec '13

23 Dec '13

For my Users, currently utilizing the following: ObjectClass: account (structural) objectClass: posixAccount (auxiliary) objectClass: pwdPolicy (auxiliary) objectClass: shadowAccount (auxiliary) objectClass: top (abstract) cn: gidNumber: homeDirectory: pwdAttribute: uid: uidNumber: gecos: loginShell: pwdAllowUserChange: pwdMinLength: pwdMustChange: shadowLastChange: userPassword: I would like to add and objectClass(es) so that I can add, emailAddress, employee number. Can someone refresh my memory on what I need (objectClasses)? Thanks, John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420

6 7

Replicate cn=config between masters and slaves?
by Karsten Heymann 23 Dec '13

23 Dec '13

Hi, when setting up a cluster with 1+x masters and 1+x slaves, is it possible to use a single cn=config replicated between all of these? Or do masters and slaves need to have different settings anyhow. I'd like not to have to manage schema information and acls in two places. Best, Karsten

4 7

BIND ERROR
by Borresen, John - 0442 - MITLL 21 Dec '13

21 Dec '13

Built a test 2.4.38 server, port 389 (for now), trying to set up a NetApp filer. When attempting to run: Wcc -u jdoe No passwd entry for jdoe I can see on the server the following: 52b4adfe => bdb_search 52b4adfe bdb_dn2entry("ou=users,dc=example,dc=ldap") 52b4adfe search_candidates: base="ou=users,dc=example,dc=ldap" (0x000002d6) scope=2 52b4adfe => bdb_dn2idl("ou=users,dc=example,dc=ldap") 52b4adfe <= bdb_dn2idl: id=2 first=726 last=727 52b4adfe => bdb_equality_candidates (objectClass) 52b4adfe => key_read 52b4adfe <= bdb_index_read: failed (-30989) 52b4adfe <= bdb_equality_candidates: id=0, first=0, last=0 52b4adfe bdb_search_candidates: id=0 first=726 last=0 52b4adfe bdb_search: no candidates 52b4adfe send_ldap_result: conn=1007 op=5 p=3 52b4adfe send_ldap_response: msgid=12 tag=101 err=0 ber_flush2: 14 bytes to sd 20 Thanks in advance John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

2 1

Authentication problem
by Jean-Charles 20 Dec '13

20 Dec '13

Hello I have a problem authenticating from a client RedHat 6.3 to a server RedHat 6.3 Connection is ok I can change user when I am root with *su paula* with no problem When I change from non root to paula *su paula* : I am requested a password, but I get an incorrect password message despite the password bieng correct Here are the details : _*SERVER Configuration (obtained with slapcat) *_ The first database does not allow slapcat; using the first available one (2) bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (2). Expect poor performance for suffix "dc=jcs-PC,dc=home". dn: dc=jcs-PC,dc=home dc: jcs-PC objectClass: dcObject objectClass: organization o: NETEXPANSION structuralObjectClass: organization entryUUID: b9dcdb1e-f628-1032-8eef-4f234421cd34 creatorsName: cn=ldapadmin,dc=jcs-PC,dc=home createTimestamp: 20131210205228Z entryCSN: 20131210205228.791640Z#000000#000#000000 modifiersName: cn=ldapadmin,dc=jcs-PC,dc=home modifyTimestamp: 20131210205228Z dn: ou=employes,dc=jcs-PC,dc=home objectClass: organizationalUnit ou: employes structuralObjectClass: organizationalUnit entryUUID: 2008d924-f629-1032-8ef0-4f234421cd34 creatorsName: cn=ldapadmin,dc=jcs-PC,dc=home createTimestamp: 20131210205520Z entryCSN: 20131210205520.207551Z#000000#000#000000 modifiersName: cn=ldapadmin,dc=jcs-PC,dc=home modifyTimestamp: 20131210205520Z dn: cn=Paula Bionda,ou=employes,dc=jcs-PC,dc=home cn: Paula Bionda sn: Bionda uid: paula uidNumber: 503 gidNumber: 1100 gecos: Paula Bionda homeDirectory: /home/paula shadowLastChange: 10877 shadowMin: 0 shadowMax: 999999 shadowWarning: 7 shadowInactive: -1 shadowExpire: -1 shadowFlag: 0 structuralObjectClass: person entryUUID: e4f37848-f930-1032-985a-91cf669ea788 creatorsName: cn=ldapadmin,dc=jcs-PC,dc=home createTimestamp: 20131214172830Z loginShell: /bin/bash objectClass: top objectClass: person objectClass: posixAccount objectClass: shadowAccount userPassword:: e1NTSEF9aEFzWFZFejlIa2xQSUpFSFF2SnpoZmo1cTYzdzRLUlg= entryCSN: 20131219155524.533147Z#000000#000#000000 modifiersName: cn=Paula Bionda,ou=employes,dc=jcs-PC,dc=home modifyTimestamp: 20131219155524Z dn: ou=groups,dc=jcs-PC,dc=home objectClass: organizationalUnit ou: groups structuralObjectClass: organizationalUnit entryUUID: e1a8545a-fa85-1032-84b7-a9514c4c1551 creatorsName: cn=ldapadmin,dc=jcs-PC,dc=home createTimestamp: 20131216100923Z entryCSN: 20131216100923.403228Z#000000#000#000000 modifiersName: cn=ldapadmin,dc=jcs-PC,dc=home modifyTimestamp: 20131216100923Z dn: cn=mygroup,ou=groups,dc=jcs-PC,dc=home objectClass: top objectClass: posixGroup cn: mygroup gidNumber: 1100 memberUid: paula memberUid: giuseppe structuralObjectClass: posixGroup entryUUID: c26713a0-fa9f-1032-8b7d-155dd966052d creatorsName: cn=ldapadmin,dc=jcs-PC,dc=home createTimestamp: 20131216131437Z entryCSN: 20131216131437.881194Z#000000#000#000000 modifiersName: cn=ldapadmin,dc=jcs-PC,dc=home modifyTimestamp: 20131216131437Z _*CLIENT C*__*onfiguration *_ authconfig-tui gives [] Cache Infomation [*] Use LDAP [] Use NIS [] Use IPAV2 [] Use WinBind [*] Use MD5 Passwords [*] Use Shadow Passwords [*] Use LDAP Authentication [] Use Kerboros [*] Use Fingerprint Reader [] Use Windbind Authentication [*] Local Authorization is sufficient [] Use TLS ldap://192.168.1.12/ Base DN: dc=jcs-PC,dc=home _*Result su paula *_ a) when I am logged in as root, *su paula* logs me into paula : no problem b) when I am not logged in as root and I do *su paula* I am requested a password (as expected), but then I get incorrect password despite the password being correct Here is the log Dec 19 18:49:50 jcs-PC slapd[6441]: => slap_access_allowed: backend default read access granted to "(anonymous)" Dec 19 18:49:50 jcs-PC slapd[6441]: => access_allowed: read access granted by read(=rscxd) Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1005 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1006 fd=21 ACCEPT from IP=192.168.1.17:56000 (IP=0.0.0.0:389) Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1006 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1006 op=0 STARTTLS Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1006 op=0 RESULT oid= err=0 text= Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1006 fd=21 closed (TLS negotiation failure) Dec 19 19:04:43 jcs-PC slapd[6441]: conn=1005 op=4 UNBIND Dec 19 19:04:43 jcs-PC slapd[6441]: conn=1005 fd=14 closed And these are the last 2 lines of wireshark _Source_ _Destination_ _Protocol_ _Info_ 192.168.1.17(Client) 192.168.1.12 (Server) LDAP ExtendedReq LDAP_START_TLS_OID 192.168.1.12 192.168.1.17 LDAP ExtendedResp LDAP_START_TLS_OID responseName missing I am surprised about STARTLS because there seems to be nothing in my configuration files about TLS Thank you Axel --

1 0

search on multimaster gives 2 different results
by Gare Calhoun 19 Dec '13

19 Dec '13

Hello, We are running 2 servers in multimaster mode ; openldap-2.4.35 on CentOS 6.6 using the autogroup overlay. I have a search filter (APersonCategory=*ADJ*) that returns different numbers of records when queried against each server. The actual records exist on both servers. 1 server is not returning all expected records. The other server returns records as expected. There is no index defined for this attribute in slapd.conf on either server. schema definition of attribute is same on each server: attributetype ( 1.3.6.1.4.1.5923.1.1.1.23 NAME 'APersonCategory' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) Would someone suggest what to look at to troubleshoot this? Thank you very much for your assistance. -Gare Calhoun -- . . . . . . . . . . . . . . . . . . . . . . . . . . . . Gare Calhoun Antioch University IT Services, Software Developer

1 0

Fw: TLS Configurations with OpenLDAP-2.4.23 on CentOS-6.2 --- Low Sensitivity/Aerospace Internal Use Only
by Warron S French 19 Dec '13

19 Dec '13

Low Sensitivity/Aerospace Internal Use Only Quanah, I downloaded the RPMs for OpenLDAP-LTB, but I didn't see anything that looked like my prior OpenLDAP (original) files. With my prior set, I was doing configuration changes in the /etc/openldap/slapd.d/cn=config directory's files. I didn't feel comfortable with moving forward because I found no README file or Getting Started or whatever. I was also looking for such documentation on the www.ltb-project.org website so that I could get a preliminary idea of what I was going to do, before I executed the installation and configuration steps. One of my major concerns is the ability to update the binaries on a regular basis for security purposes. I need to do it very easily and without re-engineering a yum repository every time there is an update. I am going to be building this LDAP system on a totally isolated environment, NO internet access at all. Can you (or anyone else) tell me, do I need to register with the LTB-Project.org website in order to find good, solid, installation and configuration instructions for what I need to accomplish? I am a newbie at OpenLDAP, I am senior in UNIX skills. I just have never had a single successful implementation of OpenLDAP. Warron French, MBA, SCSA ----- Forwarded by Warron S French/Emp/Aerospace/US on 12/19/2013 01:04 PM ----- From: Quanah Gibson-Mount <quanah(a)zimbra.com> To: Warron S French <Warron.S.French(a)aero.org>, openldap-technical(a)openldap.org, Date: 12/18/2013 01:06 PM Subject: Re: TLS Configurations with OpenLDAP-2.4.23 on CentOS-6.2 --- Low Sensitivity/Aerospace Internal Use Only Sent by: openldap-technical-bounces(a)OpenLDAP.org --On Wednesday, December 18, 2013 12:38 PM -0500 Warron S French <Warron.S.French(a)aero.org> wrote: > Low Sensitivity/Aerospace Internal Use Only > > Sorry, I thought I had replied back to the list. Apparently I have to > forward my responses to the list. > > I am checking into the options you suggested. I will probably pursue the > LTB Project, would you agree that's the better course of action? It's magnitudes better than what ships with RHEL/CentOS. Plenty of people use it with success. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration Low Sensitivity/Aerospace Internal Use Only

2 1

Monitoring back-mdb's olcDbMaxSize
by Michael Ströder 19 Dec '13

19 Dec '13

HI! Using back-mdb there's one thing which could cause trouble: One has to configure olcDbMaxSize which cannot be changed later. So when monitoring OpenLDAP with back-mdb it would be interesting to see how much space of configured olcDbMaxSize is already occupied. Does it make sense to compare the real file size shown by du -h /path/to/data.mdb to configured olcDbMaxSize? Ciao, Michael.

4 5

Fw: Fw: LDAP ERROR 19 CONTRAINT VIOLATION --- Low Sensitivity/Aerospace Internal Use Only
by Warron S French 19 Dec '13

19 Dec '13

Low Sensitivity/Aerospace Internal Use Only John, what was your solution? Was it a syntax error? Warron French, MBA, SCSA ----- Forwarded by Warron S French/Emp/Aerospace/US on 12/19/2013 09:41 AM ----- From: "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> To: "openldap-technical(a)openldap.org" <openldap-technical(a)openldap.org>, Date: 12/19/2013 09:06 AM Subject: RE: LDAP ERROR 19 CONTRAINT VIOLATION Sent by: openldap-technical-bounces(a)OpenLDAP.org Nevermind, resolved it. From: openldap-technical-bounces(a)OpenLDAP.org [ mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Borresen, John - 0442 - MITLL Sent: Thursday, December 19, 2013 8:36 AM To: openldap-technical(a)openldap.org Subject: LDAP ERROR 19 CONTRAINT VIOLATION Adding sudo.schema (sudo.ldif) to cn=schema,cn=config: # ldapadd -H ldap:/// -x -D cn=admin,cn=config -W -f /usr/local/openldap/etc/openldap/schema/sudo.ldif Enter LDAP Password: adding new entry "cn=sudo,cn=schema,cn=config" ldap_add: Constraint violation (19) additional info: structuralObjectClass: no user modification allowed Currently, my schema?s are: cn={0}core cn={1}cosine cn={2}inetorgperson cn={3}java cn={4}misc cn={5}nis cn={6}openldap cn={7}policy cn={8}2307bis cn={9}printers John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu Low Sensitivity/Aerospace Internal Use Only

1 0

LDAP ERROR 19 CONTRAINT VIOLATION
by Borresen, John - 0442 - MITLL 19 Dec '13

19 Dec '13

Adding sudo.schema (sudo.ldif) to cn=schema,cn=config: # ldapadd -H ldap:/// -x -D cn=admin,cn=config -W -f /usr/local/openldap/etc/openldap/schema/sudo.ldif Enter LDAP Password: adding new entry "cn=sudo,cn=schema,cn=config" ldap_add: Constraint violation (19) additional info: structuralObjectClass: no user modification allowed Currently, my schema's are: cn={0}core cn={1}cosine cn={2}inetorgperson cn={3}java cn={4}misc cn={5}nis cn={6}openldap cn={7}policy cn={8}2307bis cn={9}printers John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

1 1

TLS: peer cert untrusted or revoked (0x42)
by Kumar, Amit 18 Dec '13

18 Dec '13

Dear All, We have installed a newer version of Ubuntu 13.10 and trying to setup LDAP client. Context: Self signed server CA certificate in pem format installed on the client with a hashed symbolic link pointing to it. We have other clients that are able to validate and are working great, hence I do not think this is a certificate issue, and also it is not expired. And I get this legendary error "TLS: peer cert untrusted or revoked (0x42)" for which number of recommendation have been made online, to set TLS_REQCERT & TLS_CACERT in the /etc/ldap.conf Although this did not work for me. While openssl and gnutls command can successfully connect and validate the certificate, ldapsearch and getent miserably fails. Any insight into this error and an approach to fix this will be greatly appreciated. Best Regards, Amit

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical December 2013