openldap-technical December 2013

openldap-technical@openldap.org

61 participants
73 discussions

Syncrepl on glued databases only replicates the superior and the first subordinate
by Robert Minsk 18 Dec '13

18 Dec '13

Openldap version 2.4.35 Our global ldap server has the following naming contexts: namingContexts: o=global,ou=studios,dc=methodstudios,dc=net namingContexts: o=chi01,ou=studios,dc=methodstudios,dc=net namingContexts: o=det01,ou=studios,dc=methodstudios,dc=net namingContexts: o=la01,ou=studios,dc=methodstudios,dc=net namingContexts: o=ny01,ou=studios,dc=methodstudios,dc=net namingContexts: o=lon01,ou=studios,dc=methodstudios,dc=net namingContexts: o=van01,ou=studios,dc=methodstudios,dc=net namingContexts: ou=studios,dc=methodstudios,dc=net namingContexts: ou=login,dc=methodstudios,dc=net ou=studio,dc=methodstudios,dc=net is the superior database and global, chi01, det01, la01, ny01, lon01, van01 are all have "subordinate advertise" and are all sync providers. The sync provider: database mdb suffix "ou=studios,dc=methodstudios,dc=net" rootdn ... rootpw ... directory /var/lib/ldap/studios.methodstudios.net maxsize 17179869184 serverID 201 overlay glue overlay syncprov syncprov-reloadhint TRUE syncprov-checkpoint 100 5 sync_use_subentry true ... The sync consumer only has a database for ou=studios,dc=methodstudios,dc=net. database mdb suffix "ou=studios,dc=methodstudios,dc=net" rootdn ... rootpw ... directory /var/lib/ldap/studios.methodstudios.net maxsize 17179869184 serverID 202 syncrepl rid=201 provider=ldap://<providor host name> type=refreshAndPersist retry="60 10 300 +" searchbase="ou=studios,dc=methodstudios,dc=net" bindmethod=simple starttls=yes binddn="..." credentials=... schemachecking=off sizelimit=unlimited timelimit=unlimited updateref ldap://<providor host name> It seems to be only syncing ou=studios,dc=methodstudios,dc=net and o=global,ou=studios,dc=methodstudios,dc=net. If I change the order of the provider server so that chi01 comes before global then only syncing ou=studios,dc=methodstudios,dc=net and o=chi01,ou=studios,dc=methodstudios,dc=net get sync. Am I doing anything obviously wrong? -- Robert Minsk Systems and Software Engineer WWW.METHODSTUDIOS.COM <http://www.methodstudios.com> 730 Arizona Ave, Santa Monica, CA 90401 O:+1 310 434 6500 <tel:+13104346500> // F:+1 310 434 6501 <tel:+13104346501> Los Angeles <http://www.methodstudios.com/signature/url/los-angeles><http://www.methodstudios.com/signature/url/los-angeles> This e-mail and any attachments are intended only for use by the addressee(s) named herein and may contain confidential information. If you are not the intended recipient of this e-mail, you are hereby notified any dissemination, distribution or copying of this email and any attachments is strictly prohibited. If you receive this email in error, please immediately notify the sender by return email and permanently delete the original, any copy and any printout thereof. The integrity and security of e-mail cannot be guaranteed.

1 1

Oracle OpenLDAP 2.4.30 add on PPOLICY
by David Barr 18 Dec '13

18 Dec '13

Thank you, Perfec, Dieter. I cannot compile the OpenLDAP.org version. I have tried several suggested methods from internet to test the policy, none work as I get syntax error. Suggestions? Example: openldapwhoami -e ppolicy -X -D "cn=Manager,dc=$DC1,dc=$DC2" "uid=$U" ldapsearch -e ppolicy -D "uid=user02,ou=People,dc=training,dc=com" -W Is there a command to see what policies are loaded via slapd.conf ? - David. --------------------------------------------------------- Am Tue, 17 Dec 2013 18:35:10 +0000 schrieb David Barr <David.Barr2(a)mclaneat.com>: > I am trying to get policy to work in an Oracle Solaris 11 environment. > Trouble is it is pre-compiled, anyone know how I can use a policy > that didn't come with the OpenLDAP 2.4.30-0.175.1.0.0.24.0 ? Run slapd -VVV in order to check the build in modules of slapd. -Dieter -- Dieter KlÃnter | Systemberatung http://dkluenter.de GPG Key ID:DA147B05 53Â37'09,95"N 10Â08'02,42"E ________________________________ CONFIDENTIALITY NOTICE: The information contained in this electronic mail (email) transmission (including attachments), is intended by MCLANE ADVANCED TECHNOLOGIES for the use of the named individual or entity to which it is addressed and may contain information that is privileged, confidential and/or protected as a trade secret. It is not intended for transmission to, or receipt by, any individual or entity other than the named addressee(s). If you have received this email in error, please delete it (including attachments) and any copies thereof without printing, copying or forwarding it, and notify the sender of the error by email reply immediately.

3 2

Re: TLS Configurations with OpenLDAP-2.4.23 on CentOS-6.2 --- Low Sensitivity/Aerospace Internal Use Only
by Quanah Gibson-Mount 18 Dec '13

18 Dec '13

--On Wednesday, December 18, 2013 11:21 AM -0500 Warron S French <Warron.S.French(a)aero.org> wrote: > Low Sensitivity/Aerospace Internal Use Only > > Quanah, thank you for responding. Please keep replies on the list. > I have since my email updated all of my servers using yum > kernel-<whatever> update, and gotten my three virtual systems updated all > to CentOS-6.4, and on the same kernel. So, can we agree I have addressed > situation-A? Or do I need to update further? Yes, 6.4 is fine. > As for situation-B, thank you for filling me in. I was getting really > frustrated and was starting to think I was doing something wrong. But, > can you tell me, does symas or LTB come in a CentOS package format? > Something I can maintain easily instead of building from source code? Yes, I suggest you follow the links I provided. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

RE: OPENLDAP UPGRADE
by Quanah Gibson-Mount 18 Dec '13

18 Dec '13

--On Wednesday, December 18, 2013 11:33 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Yea, that's is what I was thinking, too. Ran netstat: > ># netstat -tulpn | grep ':389' | grep 'LISTEN' > tcp 0 0 :::389 :::* > LISTEN 25516/java > > Why java is LISTENING on port 389...I have no idea! I am thinking since > someone (not me) tried to build OpenDJ, it still has some fingers out > there holding onto resources. Time to use "kill -9". --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

OPENLDAP UPGRADE
by Borresen, John - 0442 - MITLL 18 Dec '13

18 Dec '13

In the process of upgrading to 2.4.38 (was able to work with the LTB group to resolve the repo issue there), created a slapd.conf, and converted to the slapd.d format successfully. - this is initially on a test server. Most of the slapd.conf was migrated over from the 2.4.23 configuration that is currently in production. When starting slapd, receiving the following (and slapd does not start): # /usr/local/openldap/libexec/slapd -u ldap -d 1 -F /usr/local/openldap/etc/openldap/slapd.d 52b1c516 @(#) $OpenLDAP: slapd 2.4.38 (Nov 27 2013 13:40:34) $ clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2.4.38/servers/slapd ldap_pvt_gethostbyname_a: host=<server_name>, r=0 52b1c516 daemon_init: listen on ldap:/// 52b1c516 daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) 52b1c516 daemon: bind(7) failed errno=98 (Address already in use) 52b1c516 daemon: bind(7) failed errno=98 (Address already in use) 52b1c516 slap_open_listener: failed on ldap:/// 52b1c516 slapd stopped. 52b1c516 connections_destroy: nothing to destroy. Here is my slapd.conf: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/openldap/etc/openldap/schema/core.schema # ## Added to support the inetOrgPerson objectClass include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema include /usr/local/openldap/etc/openldap/schema/java.schema include /usr/local/openldap/etc/openldap/schema/misc.schema include /usr/local/openldap/etc/openldap/schema/nis.schema include /usr/local/openldap/etc/openldap/schema/openldap.schema # include /usr/local/openldap/etc/openldap/pmi.schema include /usr/local/openldap/etc/openldap/schema/ppolicy.schema include /usr/local/openldap/etc/openldap/schema/2307bis.schema include /usr/local/openldap/etc/openldap/schema/printers.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org referral ldap://<server_name>.test.ldap pidfile /var/lib/openldap/run/slapd.pid argsfile /var/lib/openldap/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/openldap/libexec/openldap # moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read access to * by self write by users read by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database config rootdn "cn=admin,cn=config" rootpw {SSHA}_________________________ database bdb suffix "dc=test,dc=ldap" rootdn "cn=ldapadmin,dc=test,dc=ldap" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}_________________________ # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/openldap/openldap-data # Indices to maintain index objectClass eq index cn,sn,mail eq,sub index departmentNumber eq index automountKey eq index entryCSN eq index entryUUID eq index gidNumber,memberUID eq index uid eq index uidNumber,printerURI eq John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

3 3

TLS Configurations with OpenLDAP-2.4.23 on CentOS-6.2 --- Low Sensitivity/Aerospace Internal Use Only
by Warron S French 18 Dec '13

18 Dec '13

Low Sensitivity/Aerospace Internal Use Only Hello, I need help figuring out why I can't get CentOS-6.2 machines to authenticate against my OpenLDAP implementation where user and group entries are stored. I can use ldapsearch and get back the results I am expecting, but I don't know where in my long list of configurations I might have gone wrong, or left something else out. All of my instructions have been based on reading several (easily 20) other people's pages for configuring an LDAP DIT for the explicit purpose of centralizing USER AUTHENTICATION. I can submit my MS Word document that I used to keep track of the steps that I used thus far. I am writing up the instructions so that I can repeat them in the hopes of building a small development environment for my coworkers. In my environment I have all CentOS-6.4 OS virtual machines that I am running inside of my PC running Oracle VirtualBox. I am attempting to keep them entirely isolated from the network so, I have... a dedicated DNS server, dedicated CA server and dedicated LDAP server. Their names respectively, can be wsf-LabDNS, wsf-LabCA and wsf-LabLDAP. I wrote a script that automates the creation of an LDIF file so that the same script can turn around and add records (DNs) using ldapadd. I have CA certificates for my DNS, CA and LDAP servers, and my CA is a self-signed CA. My DNS and LDAP servers' certificates are signed by my CA. I am attempting to use my DNS and CA servers as LDAP-USER-AUTH clients against my LDAP server. CentOS requires the use of TLS certificates. I cannot get user authentication to work no matter what I have done over the past 4 months. I have a user account I created, called wsf29221, that I am using to test against LDAP. I used yum to install all of my packages, meaning I did not compile anything from scratch. I am using all of the OpenLDAP-2.4.23-32.el6_4.1. The commands I am attempting are: su - wsf29221 id wsf29221 ssh wsf29221@wsf-LabDNS (from wsf--LabCA) I am pretty sure my problem is in the TLS configuration, but I don't really know what to look at or even where to start. Warron French, MBA, SCSA |||||Submission End||||| Low Sensitivity/Aerospace Internal Use Only

2 1

Oracle OpenLDAP 2.4.30 add on PPOLICY
by David Barr 17 Dec '13

17 Dec '13

I am trying to get policy to work in an Oracle Solaris 11 environment. Trouble is it is pre-compiled, anyone know how I can use a policy that didn't come with the OpenLDAP 2.4.30-0.175.1.0.0.24.0 ? Excerpt from my slapd.conf ########### # SCHEMAS # ########### # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/ppolicy.schema ########### # MODULES # ########### # Load dynamic backend modules: modulepath /etc/openldap/modules moduleload ppolicy.la ################### # PASSWORD POLICY # ################### overlay ppolicy ppolicy_default "cn=Standard Policy,ou=Policies,dc=XXXXX,dc=XXXXX" ppolicy_use_lockout Any Ideas? ________________________________ CONFIDENTIALITY NOTICE: The information contained in this electronic mail (email) transmission (including attachments), is intended by MCLANE ADVANCED TECHNOLOGIES for the use of the named individual or entity to which it is addressed and may contain information that is privileged, confidential and/or protected as a trade secret. It is not intended for transmission to, or receipt by, any individual or entity other than the named addressee(s). If you have received this email in error, please delete it (including attachments) and any copies thereof without printing, copying or forwarding it, and notify the sender of the error by email reply immediately.

3 2

deploy monitor backend while existing DB in the root namespace
by GALAMBOS Daniel 17 Dec '13

17 Dec '13

Hi, My task was to configure our existing openldap (debian wheezy 2.4.31-1+nmu2) to use use monitor backend. The main problem is that our (BDB backed) database has empty suffix (for historical reason). If the monitor defined later under the /etc/ldap/slapd.d then the BDB, slapd fails to start, because BDB database would hide the monitor. database init failed (monitor) 52b038c0 olcDatabase: value #0: "monitor" database serving namingContext "cn=Monitor" is hidden by "bdb" database serving namingContext "". (monitor) 52b038c0 config error processing olcDatabase={2}monitor,cn=config: "monitor" database serving namingContext "cn=Monitor" is hidden by "bdb" database serving namingContext "". If it's defined before the bdb, then the slapd starts, but ldapsearch give 'no such object' for cn=Monitor. (should not be permission issue) It was doesn't matter if i included 'olcSubordinate: true' in the monitor. When I added a non-empty suffix to the bdb in the devel environment, the monitor worked, but this can't be the solution for our prod servers. monitor backend is defined by: dn: olcDatabase=monitor objectClass: olcDatabaseConfig olcDatabase: monitor olcAccess: {0}to * by read olcSubordinate: TRUE A colleague is concerned about the performance loss because of the monitor backend. Does monitor use significant resources in a heavily used slapd? Thanks, Dancsa

2 1

replication refint
by Artur Nike 17 Dec '13

17 Dec '13

Hi All, debian wheezy, OpenLDAP 2.4.31, muti-master replication Small question whether referential integrity (multiple-captains) are replicated? It seems to me that, yes, but the change (removal), entry on one of the servers does not call the bonds on the other. can by example: in annex replikat_refint.html ...sorry for the little technical diagram but I just had libre-office. Can anyone have any suggestions or experience with this problem. For all, thank you in advance. Muniek

2 3

default setup examples/documentation
by Alex Mestiashvili 17 Dec '13

17 Dec '13

Hi All, I am trying to find some kind of official documentation or examples for default structures for ldap. It is clear that the structure can vary a lot for different cases. But most of the users I think want to have a couple of ldif files simulating unix's passwd/group files something like that: ou=People,dc=example,dc=com uid=toor,ou=People,dc=example,dc=com ou=Group,dc=example,dc=com with proper objectClasses and shadow attributes. That should be enough to start using ldap. For sure there are tons of examples in the net, but this time I tried to do it just by reading openldap.org site and couldn't find enough to start with it. Could you please point me on more or less official documentation for the case above ? Thank you, Alex

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical December 2013