openldap-technical February 2014

openldap-technical@openldap.org

85 participants
90 discussions

Syncrepl and MMR
by Borresen, John - 0442 - MITLL 12 Feb '14

12 Feb '14

All, Ok, grasping at straws here. This is the cn=config for mm-server1 as of yesterday. mm-server1: dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /usr/local/openldap/etc/openldap/slapd.conf olcConfigDir: /usr/local/openldap/etc/openldap/slapd.d olcArgsFile: /var/lib/openldap/run/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcListenerThreads: 1 olcLocalSSF: 71 olcPidFile: /var/lib/openldap/run/slapd.pid olcReadOnly: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcTLSProtocolMin: 0.0 olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal entryUUID: 1b256f1e-2f15-4538-8a6f-5b021d015e35 creatorsName: cn=config createTimestamp: 20140122200748Z olcLogLevel: stats olcSecurity: tls=0 olcServerID: 1 ldap://mm-server1.example.ldap olcServerID: 2 ldap://mm-server2.example.ldap entryCSN: 20140131211613.134974Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140131211613Z dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}syncprov olcModuleLoad: {1}accesslog structuralObjectClass: olcModuleList entryUUID: 1191cf8f-8d46-4f2e-8aba-e65537210029 creatorsName: cn=admin,cn=config createTimestamp: 20140129175231Z entryCSN: 20140129175429.232704Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129175429Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by self write by users read by anonymous auth olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 77451682-9629-4753-9a80-5cc0e69a7482 creatorsName: cn=config createTimestamp: 20140122200748Z entryCSN: 20140122200748.381523Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140122200748Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: d7f25d3b-7ad1-4625-a577-a23a22b5494d creatorsName: cn=config createTimestamp: 20140122200748Z entryCSN: 20140122200748.381523Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140122200748Z dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=example,dc=ldap olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=ldapadmin,dc=example,dc=ldap olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/openldap/openldap-data olcDbCacheSize: 1000 olcDbConfig: {0}# $OpenLDAP$ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databas es. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-d b/db/ref/env/db_config.html> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig:: ezh9Iwk8aHR0cDovL3d3dy5vcGVubGRhcC5vcmcvZmFxL2luZGV4LmNnaT9maWxl PTI+ olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon re building olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 0.25 GB cache olcDbConfig: {16}set_cachesize 0 268435456 1 olcDbConfig: {17} olcDbConfig: {18}# Data Directory olcDbConfig: {19}#set_data_dir db olcDbConfig: {20} olcDbConfig: {21}# Transaction Log settings olcDbConfig: {22}set_lg_regionmax 262144 olcDbConfig: {23}set_lg_bsize 2097152 olcDbConfig: {24}#set_lg_dir logs olcDbConfig: {25} olcDbConfig: {26}# Note: special DB_CONFIG flags are no longer needed for "qui ck" olcDbConfig:: ezI3fSMgc2xhcGFkZCg4KSBvciBzbGFwaW5kZXgoOCkgYWNjZXNzIChzZWUgdGhl aXIgLXEgb3B0aW9uKS4g olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn eq,sub olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: sn eq,sub olcDbIndex: mail eq,sub olcDbIndex: departmentNumber eq olcDbIndex: automountKey eq olcDbIndex: memberUid eq olcDbIndex: printerURI eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 5a87b5f1-c445-4e0e-ba97-6d2d63093704 creatorsName: cn=config createTimestamp: 20140122200748Z olcMirrorMode: TRUE olcLimits: {0}dn.exact="cn=ldapadmin,dc=example,dc=ldap" size=unlimited time=u nlimited olcSyncrepl: {0}rid=002 provider=ldap://mm-server2.example.ldap bindmethod=simple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcSyncrepl: {1}rid=001 provider=ldap://mm-server1.example.ldap bindmethod=simple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn.exact="cn=ldapadmin,dc=example,dc=ldap" write by dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" read by * none olcAccess: {1}to * by * read entryCSN: 20140203200931.503493Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140203200931Z dn: olcOverlay={0}syncprov,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 04afe1bf-40c7-425a-8b25-74f8687323fc creatorsName: cn=admin,cn=config createTimestamp: 20140129180447Z entryCSN: 20140129180447.701059Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180447Z dn: olcOverlay={1}accesslog,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig entryUUID: 54b5fa00-8244-41d3-923d-0743a10bf192 creatorsName: cn=admin,cn=config createTimestamp: 20140129180903Z entryCSN: 20140129180903.479192Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180903Z dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/openldap/accesslog olcSuffix: cn=accesslog olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart structuralObjectClass: olcBdbConfig entryUUID: ff63820b-fbe4-4a65-8c00-99e2cc28fca5 creatorsName: cn=admin,cn=config createTimestamp: 20140129175923Z olcAccess: {0}to * by dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" w rite by * none olcLimits: {0}dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" time.soft =unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcRootDN: uid=replicator,ou=Admins,dc=example,dc=ldap entryCSN: 20140203190415.581904Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140203190415Z dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 9246709d-7a9b-41f3-bca8-f665add4e4f2 creatorsName: cn=admin,cn=config createTimestamp: 20140129180331Z entryCSN: 20140129180331.702641Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180331Z mm-server2: dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /usr/local/openldap/etc/openldap/slapd.conf olcConfigDir: /usr/local/openldap/etc/openldap/slapd.d olcArgsFile: /var/lib/openldap/run/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcListenerThreads: 1 olcLocalSSF: 71 olcPidFile: /var/lib/openldap/run/slapd.pid olcReadOnly: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcTLSProtocolMin: 0.0 olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal entryUUID: 84a58742-a1ce-4714-a743-14daf3f40c75 creatorsName: cn=config createTimestamp: 20131218155313Z olcLogLevel: stats olcSecurity: tls=0 olcServerID: 1 ldap://mm-server1.example.ldap olcServerID: 2 ldap://mm-server2.example.ldap entryCSN: 20140131211906.564734Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140131211906Z contextCSN: 20140206183618.370299Z#000000#002#000000 contextCSN: 20140121211615.993780Z#000000#004#000000 dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}syncprov olcModuleLoad: {1}accesslog structuralObjectClass: olcModuleList entryUUID: ab2c7f52-e10f-4233-aa17-ac8b051defcf creatorsName: cn=admin,cn=config createTimestamp: 20140129182320Z entryCSN: 20140129182642.147840Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129182642Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by self write by users read by anonymous auth olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 46ec808c-285f-442f-8c70-d5bb8c2d39de creatorsName: cn=config createTimestamp: 20131218155313Z entryCSN: 20131218155313.477459Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20131218155313Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 4354a8b6-8a36-4804-81f8-14a8550aef74 creatorsName: cn=config createTimestamp: 20131218155313Z entryCSN: 20131218155313.477459Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20131218155313Z dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 644d3984-d125-446e-aae2-1ddc541f4661 creatorsName: cn=admin,cn=config createTimestamp: 20140121191314Z entryCSN: 20140121191314.076259Z#000000#004#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140121191314Z dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=example,dc=ldap olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=ldapadmin,dc=example,dc=ldap olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/openldap/openldap-data olcDbCacheSize: 1000 olcDbConfig: {0}# $OpenLDAP$ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databas es. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-d b/db/ref/env/db_config.html> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig:: ezh9Iwk8aHR0cDovL3d3dy5vcGVubGRhcC5vcmcvZmFxL2luZGV4LmNnaT9maWxl PTI+ olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon re building olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 0.25 GB cache olcDbConfig: {16}#set_cachesize 0 268435456 1 olcDbConfig: {17}set_cachesize 0 2147483648 1 olcDbConfig: {18} olcDbConfig: {19}# Data Directory olcDbConfig: {20}#set_data_dir db olcDbConfig: {21} olcDbConfig: {22}# Archive/deletion olcDbConfig: {23}set_flags DB_LOG_AUTOREMOVE olcDbConfig: {24} olcDbConfig: {25}# Transaction Log settings olcDbConfig: {26}set_lg_regionmax 262144 olcDbConfig: {27}set_lg_bsize 2097152 olcDbConfig: {28}#set_lg_dir logs olcDbConfig: {29} olcDbConfig: {30}# Note: special DB_CONFIG flags are no longer needed for "qui ck" olcDbConfig:: ezMxfSMgc2xhcGFkZCg4KSBvciBzbGFwaW5kZXgoOCkgYWNjZXNzIChzZWUgdGhl aXIgLXEgb3B0aW9uKS4g olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn eq,sub olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: sn eq,sub olcDbIndex: departmentNumber eq olcDbIndex: mail eq,sub olcDbIndex: automountKey eq olcDbIndex: memberUid eq olcDbIndex: printerURI eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 94ff450b-aa70-4507-9ca6-51cdd740ea3e creatorsName: cn=config createTimestamp: 20131218155313Z olcMirrorMode: TRUE olcLimits: {0}dn.exact="cn=ldapadmin,dc=example,dc=ldap" size=unlimited time=u nlimited olcSyncrepl: {0}rid=001 provider=ldap://mm-server1.example.ldap bindmethod=si mple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcSyncrepl: {1}rid=002 provider=ldap://mm-server2.example.ldap bindmethod=si mple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn.exact="cn=ldapadmin,dc=example,dc=ldap" write by dn.exact="uid=r eplicator,ou=Admins,dc=example,dc=ldap" read olcAccess: {1}to * by * read entryCSN: 20140206183618.370299Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140206183618Z dn: olcOverlay={0}accesslog,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {0}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig entryUUID: 6e4e1508-5eb9-4372-bbd1-813f859b0acc creatorsName: cn=admin,cn=config createTimestamp: 20140129182321Z entryCSN: 20140129182321.004272Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129182321Z dn: olcOverlay={1}syncprov,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 9108e0db-ba9e-4b40-b743-4016c61582bc creatorsName: cn=admin,cn=config createTimestamp: 20140129183014Z entryCSN: 20140129183014.073365Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129183014Z dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/openldap/accesslog olcSuffix: cn=accesslog olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart structuralObjectClass: olcBdbConfig entryUUID: 9b42a346-de9b-42d5-8a3b-3167f80d4b01 creatorsName: cn=admin,cn=config createTimestamp: 20140129182320Z olcAccess: {0}to * by dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" w rite by * none olcLimits: {0}dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" time.soft =unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcRootDN: uid=replicator,ou=Admins,dc=example,dc=ldap entryCSN: 20140203190210.968231Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140203190210Z dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 0366206b-4295-4463-952c-0b233646c24d creatorsName: cn=admin,cn=config createTimestamp: 20140129182831Z entryCSN: 20140129182831.866738Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129182831Z dn: olcDatabase={3}monitor,cn=config objectClass: olcDatabaseConfig olcAccess: {0}to dn.children="cn=monitor" by dn.children="cn=admin,cn=config" read olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcMonitoring: TRUE structuralObjectClass: olcDatabaseConfig entryUUID: 691d6dfc-82af-4e12-8f03-be93d5d5436b creatorsName: cn=admin,cn=config createTimestamp: 20140114170424Z entryCSN: 20140114170424.436842Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140114170424Z olcDatabase: {3}monitor An attempt IS being made between mm-server1 and mm-server2: Log output from mm-server1: <= ldap_dn2bv(cn=accesslog)=0 52fb7a31 SRCH "cn=accesslog" 2 052fb7a31 0 0 0 52fb7a31 filter: (objectClass=*) 52fb7a31 attrs:52fb7a31 reqDN52fb7a31 reqType52fb7a31 reqMod52fb7a31 reqNewRDN52fb7a31 reqDeleteOldRDN52fb7a31 reqNewSuperior52fb7a31 entryCSN52fb7a31 52fb7a31 base_candidates: base: "cn=accesslog" (0x00000001) 52fb7a31 send_ldap_result: err=0 matched="" text="" 52fb7a31 send_ldap_result: err=0 matched="" text="" 52fb7a31 connection_get(36) 52fb7a6d connection_get(36) => ldap_bv2dn(cn=ldapadmin,dc=example,dc=ldap,0) <= ldap_bv2dn(cn=ldapadmin,dc=example,dc=ldap)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=ldapadmin,dc=example,dc=ldap)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=ldapadmin,dc=example,dc=ldap)=0 Log output from mm-server2: 52fb7a0f attrs:52fb7a0f *52fb7a0f 52fb7a0f base_candidates: base: "cn=role2,ou=sudoers,dc=example,dc=ldap" (0x00000271) 52fb7a0f send_ldap_result: err=0 matched="" text="" ldap_build_search_req ATTRS: reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN 52fb7a31 do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) 52fb7a31 do_syncrepl: rid=001 rc -1 retrying ldap_build_search_req ATTRS: reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN 52fb7a6d do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) 52fb7a6d do_syncrepl: rid=001 rc -1 retrying ldap_build_search_req ATTRS: reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN 52fb7aa9 do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) 52fb7aa9 do_syncrepl: rid=001 rc -1 retrying ldap_build_search_req ATTRS: reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN 52fb7ae5 do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) 52fb7ae5 do_syncrepl: rid=001 rc -1 retrying Thanks in advance... John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

1 0

how to manage groups in different machines using LDAP
by Daniel Szortyka 11 Feb '14

11 Feb '14

Hey guys, I'm new in the forum and new in the LDAP world. I have my environment set up and working fine so far. I have a LDAP server and few other stations which autenticate in my server, OK so far. However, I have applications running exclusively with a special group, let's say "SAS" and that's my problem. Group SAS in MachineA is GID = 501 (/etc/groups) Group SAS in MachineB is GID = 502 (/etc/groups) (this was defined some time ago.. every computer has a different GID for Group SAS) UserA was created with GID = 501 in LDAP. The problem is that when UserA authenticates in MachineB, he doesn't have a group assigned. I would like to know which direction I should go to make sure no matter what computer the user authenticates, he'll get the right group assigned. Tks in advance. -Daniel Szortyka Porto Alegre / RS / Brasil SysAdm at IBOPE -- Esta mensagem é destinada exclusivamente para a(s) pessoa(s) a quem é dirigida, podendo conter informação confidencial. Se você não for destinatário desta mensagem, desde já fica notificado de abster-se a divulgar, copiar, distribuir, examinar ou, de qualquer forma, utilizar a informação contida nesta mensagem, por ser ilegal. Caso você tenha recebido esta mensagem por engano, pedimos que nos retorne este E-Mail, promovendo, desde logo, a eliminação do seu conteúdo em sua base de dados, registros ou sistema de controle. This message is exclusively destined for the people to whom it is directed, and it can bear private and/or legally exceptional information. If you are not addressee of this message, since now you are advised to not release, copy, distribute, check or, otherwise, use the information contained in this message, because it is illegal. If you received this message by mistake, we ask you to return this email, making possible, as soon as possible, the elimination of its contents of your database, registrations or controls system. Este mensaje ha sido enviado exclusivamente para la(s) persona(s) destinataria(s) y puede contener información confidencial. Si Usted no es el destinatario, esta desde ya compelido a no divulgar, copiar, distribuir, examinar o, de cualquier manera, utilizar la información contenida en este mensaje, por razones legales. Caso Usted haya recibido este mensaje equivocadamente, favor contestar al remitente en forma inmediata, borrándolo de su base de datos, registros o sistema de control.

2 3

Accelog overlay do not register unbind idletimeout
by David Tello 11 Feb '14

11 Feb '14

Hi all, I have a doubt. I have a idletimeout and it's working correctly. The session die after this time and new binds are required. The problem es that this automatic unbind isn't appears in the accesslog. No problem with the binds but there isn't any automatic unbind. I think that the configuration of overlay accesslog is correct, because the manual unbind appears correctly. Someone know if is this the normal behavior? Thanks for your time.

1 0

Problem with ppolicy
by Mikael Nehlsen 11 Feb '14

11 Feb '14

Hello! I have a problem with the ppolicy module. I have 2 ldaptrees dc=example,dc=com and o=external and I want to have password policies (lockout after 5 failed login attempts) and I can see that it works on dc=example,dc=com but it does not work on o=external. Both trees save failed login attempts but only the first tree locks people out o=external just saves more and more failed attempts but never lockout the user. I have tried a lot of things and I can not figure out what the problem is. I hope someone here can help me. It is 2 replicated ubuntu 10.04 servers with openldap 2.4.21-0ubuntu5.7 and the ppolicy configuration looks like this: ppolmodule.ldif : dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModuleLoad: ppolicy.la ldapadd -x -D "cn=admin,cn=config" -w password -f ~/ppolmodule.ldif -h ldap1 ppol.ldif: dn: ou=policies,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: policies dn: cn=default,ou=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxFailure: 5 pwdMinLength: 6 ldapadd -x -D "cn=admin,dc=example,dc=com" -w password -f ~/ppol.ldif -h ldap1 ppol_external.ldif: dn: ou=policies,o=external objectClass: organizationalUnit objectClass: top ou: policies dn: cn=default,ou=policies,o=external objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxFailure: 5 pwdMinLength: 6 ldapadd -x -D "cn=admin,dc=example,dc=com" -w password -f ~/ppol_external.ldif -h ldap1 ppoloverlay.ldif: dn: olcOverlay=ppolicy,olcDatabase={1}bdb,cn=config olcOverlay: ppolicy objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: FALSE olcPPolicyDefault: cn=default,ou=policies,dc=example,dc=com ppoloverlay_external.ldif: dn: olcOverlay=ppolicy,olcDatabase={2}bdb,cn=config olcOverlay: ppolicy objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: FALSE olcPPolicyDefault: cn=default,ou=policies,o=external ldapadd -x -D "cn=admin,cn=config" -w password -f ~/ppoloverlay.ldif -h ldap1 ldapadd -x -D "cn=admin,cn=config" -w password -f ~/ppoloverlay_external.ldif -h ldap1 I tried with only one default policy for both trees as well, it made no difference. /Mikael

1 1

Recommended version of BDB package
by Mark Cairney 10 Feb '14

10 Feb '14

Hi, Having recently experienced some issues with our Live server (2.4.38, Scientific Linux 6.4 64-bit) I was looking into possible causes and found the following Debian bug report which suggests that BDB 5.X is problematic with OpenLDAP. What's the "best" version of BDB to go with- I see 4.7.25 "with patches" mentioned in the posting and I noticed that this is the version shipped with LTB. If I were to downgrade my BDB database would this be the best one to go for? I would like to migrate to MDB but there's an issue with alias de-referencing that's a bit of a deal-breaker for us at the moment as a number of our departments use them to provide subsets of their own users(ITS#7657). Kind regards, Mark -- /**************************** Mark Cairney ITI UNIX Section Information Services University of Edinburgh Tel: 0131 650 6565 Email: Mark.Cairney(a)ed.ac.uk *******************************/ The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

5 9

compile error with 2.4.39 on Solaris 10 (SPARC)
by Amos 10 Feb '14

10 Feb '14

get an error when attempting to compile, 64-bit: /bin/sh ../../libtool --mode=compile gcc -m64 -I/usr/local/BerkeleyDB.5.3/include -I/usr/local/include/openssl -I/usr/local/include/sasl -g -O2 -I../../include -I../../include -DLDAP_LIBRARY -c version.c /bin/sh ../../libtool --mode=link gcc -m64 -I/usr/local/BerkeleyDB.5.3/include -I/usr/local/include/openssl -I/usr/local/include/sasl -g -O2 -L/usr/local/lib/sparcv9 -R/usr/local/lib/sparcv9 -L/usr/local/BerkeleyDB.5.3/lib/sparcv9 -R/usr/local/BerkeleyDB.5.3/lib/sparcv9 -release 2.4 -version-info 12:2:10 -rpath /usr/local/lib/sparcv9 -o libldap.la bind.lo open.lo result.lo error.lo compare.lo search.lo controls.lo messages.lo references.lo extended.lo cyrus.lo modify.lo add.lo modrdn.lo delete.lo abandon.lo sasl.lo gssapi.lo sbind.lo unbind.lo cancel.lo filter.lo free.lo sort.lo passwd.lo whoami.lo getdn.lo getentry.lo getattr.lo getvalues.lo addentry.lo request.lo os-ip.lo url.lo pagectrl.lo sortctrl.lo vlvctrl.lo init.lo options.lo print.lo string.lo util-int.lo schema.lo charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo tls2.lo tls_o.lo tls_g.lo tls_m.lo turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo assertion.lo deref.lo ldif.lo fetch.lo version.lo ../../libraries/liblber/ liblber.la -lresolv -lgen -lnsl -lsocket -lsasl2 -lssl -lcrypto gmake[2]: *** No rule to make target `../../libraries/liblber/liblber.la', needed by `apitest'. Stop. gmake[2]: Leaving directory `/usr/soft/that/openldap-2.4.39/src/default/sparcv9_sun_solaris2.10/libraries/libldap' gmake[1]: *** [all-common] Error 1 gmake[1]: Leaving directory `/usr/soft/that/openldap-2.4.39/src/default/sparcv9_sun_solaris2.10/libraries' gmake: *** [all-common] Error 1 I get the same thing when attempting 32-bit compile: /bin/sh ../../libtool --mode=compile gcc -I/usr/local/BerkeleyDB.5.3/include -I/usr/local/include/openssl -I/usr/local/include/sasl -g -O2 -I../../include -I../../include -DLDAP_LIBRARY -c version.c /bin/sh ../../libtool --mode=link gcc -I/usr/local/BerkeleyDB.5.3/include -I/usr/local/include/openssl -I/usr/local/include/sasl -g -O2 -L/usr/local/lib -R/usr/local/lib -L/usr/local/BerkeleyDB.5.3/lib -R/usr/local/BerkeleyDB.5.3/lib -release 2.4 -version-info 12:2:10 -rpath /usr/local/lib -o libldap.la bind.lo open.lo result.lo error.lo compare.lo search.lo controls.lo messages.lo references.lo extended.lo cyrus.lo modify.lo add.lo modrdn.lo delete.lo abandon.lo sasl.lo gssapi.lo sbind.lo unbind.lo cancel.lo filter.lo free.lo sort.lo passwd.lo whoami.lo getdn.lo getentry.lo getattr.lo getvalues.lo addentry.lo request.lo os-ip.lo url.lo pagectrl.lo sortctrl.lo vlvctrl.lo init.lo options.lo print.lo string.lo util-int.lo schema.lo charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo tls2.lo tls_o.lo tls_g.lo tls_m.lo turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo assertion.lo deref.lo ldif.lo fetch.lo version.lo ../../libraries/liblber/liblber.la -lresolv -lgen -lnsl -lsocket -lsasl2 -lssl -lcrypto gmake[2]: *** No rule to make target `../../libraries/liblber/liblber.la', needed by `apitest'. Stop. gmake[2]: Leaving directory `/usr/soft/that/openldap-2.4.39/src/default/sparcv9_sun_solaris2.10/libraries/libldap' gmake[1]: *** [all-common] Error 1 gmake[1]: Leaving directory `/usr/soft/that/openldap-2.4.39/src/default/sparcv9_sun_solaris2.10/libraries' gmake: *** [all-common] Error 1 Didn't encounter this with 2.4.38. Amos

2 1

Slow to add 1 million items
by Andrew Eross 10 Feb '14

10 Feb '14

Hello all, I've been Google'ing around and searching the archives, but I haven't quite been able to find an answer, so I wanted to ask the list. I've been experimenting with OpenLDAP adds to see how quickly we can get data inserted into the DB. I'm using Ubuntu 10.04, and I've tried both the packaged OpenLDAP 2.4.21 using hdb, and just recently the latest OpenLDAP 2.4.39 using lmdb, both with relatively similar results. The short version is: to insert 1 million records, it's taking about 8 hours on a machine with 2GB RAM / 3Ghz / SSD, which seems like a long time to me. The insert method is to use a single big ldiff file like this: ### snip ### dn: cn=newtest0,ou=customer,dc=test,dc=com objectclass: inetOrgPerson userPassword: 90sac90sudasdjcao0sdjtest telephoneNumber: 61400000000 sn: none dn: cn=newtest1,ou=customer,dc=test,dc=com objectclass: inetOrgPerson userPassword: 90sac90sudasdjcao0sdjtest telephoneNumber: 61400000000 sn: none ### snip ### Then add it with ldapadd: ldapadd -x -D cn=admin,dc=test,dc=com -w test -f ./test My configuration (for mdb in this instance) used with 2.4.39 is this: ### config ### include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema database mdb directory /usr/local/var/openldap-data suffix "dc=test,dc=com" rootdn "cn=admin,dc=test,dc=com" rootpw test maxsize 1980732000 #Indexes index cn,telephoneNumber eq index objectClass eq ### config ### Any ideas or things I could try? Thank you! Andrew

7 13

Openldap shutdown expectedly
by Liu Yongjian 10 Feb '14

10 Feb '14

I have make a question on http://stackoverflow.com/questions/21619553/openldap-unexpectedly-shutdown Can anyone help me? -- Thank you

2 1

Have you seen this FUD - IT pros suffer OpenLDAP configuration headaches ?
by Gavin Henry 09 Feb '14

09 Feb '14

http://searchdatacenter.techtarget.com/feature/IT-pros-suffer-OpenLDAP-conf… Any one been in touch with them? -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretec.co.uk Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk OpenPGP (GPG/PGP) Public Key: 0x8CFBA8E6 - Import from hkp://subkeys.pgp.net or http://www.suretecgroup.com/0x8CFBA8E6.gpg

18 20

SASL DIGEST-MD5 works but PLAIN/LOGIN fails
by Michael Ströder 09 Feb '14

09 Feb '14

HI! I'd like let users authenticate via SASL/PLAIN or SASL/LOGIN so they do not have to deal with full bind-DNs, my client does not have to search the user and to avoid slapo-rwm. Yes, the connection is protected with TLS. Later it has to work with hashed userPassword values. It should be feasible. Or not? Test system: latest OpenLDAP RE24 cyrus-sasl-2.1.25-28.1.2.x86_64 shipped with openSUSE 13.1 In my test setup everything works with DIGEST-MD5 but not with PLAIN or LOGIN (clear-text userPassword value for testing). The log shows that the SASL username gets mapped by authz-regexp to the correct LDAP user entry: 52f60408 <==slap_sasl2dn: Converted SASL name to uid=user,ou=dept,o=example 52f60408 slap_sasl_getdn: dn:id converted to uid=user,ou=dept,o=example But SASL does not use "pwcheck_method: slapd" for mechs PLAIN/LOGIN but works with DIGEST-MD5: $ ldapwhoami -H ldapi:/// -Y DIGEST-MD5 -U user -w secret SASL/DIGEST-MD5 authentication started SASL username: user SASL SSF: 128 SASL data security layer installed. dn:uid=user,ou=dept,o=example $ ldapwhoami -H ldapi:/// -Y LOGIN -U user -w secret SASL/LOGIN authentication started ldap_sasl_interactive_bind_s: Authentication method not supported (7) additional info: SASL(-4): no mechanism available: checkpass failed $ ldapwhoami -H ldapi:/// -Y PLAIN -U user -w secret SASL/PLAIN authentication started ldap_sasl_interactive_bind_s: Authentication method not supported (7) additional info: SASL(-4): no mechanism available: Password verification failed The trace shows for PLAIN or LOGIN (running slapd -d config,stats,stats2,acl,args,trace): SASL [conn=1002] Error: unknown password verifier(s) slapd My /usr/lib64/sasl.conf contains: ---------------------------- snip ---------------------------- pwcheck_method: slapd mech_list: plain login digest-md5 external ---------------------------- snip ---------------------------- I've checked that this is the right file by setting "pwcheck_method: foobar" which appears in the logs then. My slapd.conf contains: ---------------------------- snip ---------------------------- disallow bind_anon require bind LDAPv3 strong # SSF value for ldapi:// localSSF 256 # minimum required SSF value (security strength factor) security transport=128 sasl=0 # Since we require TLS we can relax this sasl-secprops none,minssf=0 ---------------------------- snip ---------------------------- Any clue? Ciao, Michael.

5 8

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical February 2014