openldap-technical November 2015

openldap-technical@openldap.org

64 participants
60 discussions

LMDB physical file size
by Christian Sell 11 Nov '15

11 Nov '15

Hello, we are using LMDB as the underlying storage engine for a lightweight + high performance special-purpose object + mass data database. I have 2 questions about the size of the physical file used by LMDB: To create the environment, we are using a mapsize of 1 GiB and the flags MDB_NOSUBDIR | MDB_NOLOCK. Under Linux, this results in one file with a size that seems to correspond to the size of the data actually stored. However, under Windows, the file size is the same as the mapsize, namely 1 GiB. We are currently using env_copy2 and MDB_COMPACT to push this down every time the env is closed, but I fear that this will become very slow with large databases. The same issue surfaced under Linux when we were recently experimenting with the MDB_WRITEMAP option to improve performance when dealing with very large data sets. This option caused also the Linux file size to go up to 1 GiB, even though the actual data was < 50 K. We'd like to hear if there are ways to improve this. thanks, Christian

5 5

PPolicy, syncrepl
by RDSYS 11 Nov '15

11 Nov '15

Hello, I am new to this list and more or less to OpenLdap also. We use OpenLdap $OpenLDAP: slapd (Sep 11 2015 15:11:55) $#012#011buildd@babin:/build/openldap-nFTO9j/openldap-2.4.40+dfsg/debian/build/servers/slapd on the master running DEBIAN "jessie" and $OpenLDAP: slapd (Sep 11 2015 15:18:38) $#012#011buildd@binet:/build/openldap-kFav7u/openldap-2.4.31/debian/build/servers/slapd on the consumer running DEBIAN "wheezy" I had a working Master-Slave sync up to the moment when I configured PPolicy on master and slave. From that time on the sync to the consumer did not work any more. The log on the consumer say: syncrepl_message_to_op: rid=001 mods check (pwdChangedTime: multiple values provided) do_syncrepl: rid=001 rc 19 retrying The log on the master state: send_search_entry: conn 1654 ber write failed. What can be the reason? Any help would be appreciated. Thanks Reiner

2 1

Controlling rootdn access
by Michael Hierweck 11 Nov '15

11 Nov '15

Hi all, I'm trying to improve security by restricting rootdn access to localhost. See: http://www.openldap.org/doc/admin24/access-control.html#Controlling%20rootd… But I can't delete the olcRootPW attribute from the olcDatabase object: ldap_modify: Inappropriate matching (18) additional info: modify/delete: olcRootPW: no equality matching rule I suppose the access restriction to the rootdn's userPassword attribute does not take effect as the provided password will be compared against the olcRootPW attribute (directly). Thanks in advance Michael

4 7

modify ldap conn=-1
by Daniel Jung 11 Nov '15

11 Nov '15

Hi, Typically conn represents external connection number? Sometimes i see conn=-1. Does this mean this is local or sycnrepl connection modification? thanks

2 1

Synchronization/replication and testing with ldapsearch
by Rebecka Gulliksson 10 Nov '15

10 Nov '15

Hi! I’m trying to setup an instance of slapd that supports RFC4533 (Content Synchronization Operation) for use with a consumer that is *not* another slapd instance. So right now I want to test my slapd instance with ‘ldapsearch' instead of in an master-slave setup. I’m on Mac OS X with the following in my slapd.conf: overlay syncprov syncprov-checkpoint 100 1 syncprov-sessionlog 100 Then I use ldapsearch ldapsearch -x -h localhost -Esync=ro but I get no syncCookie. Essentially I want to achieve what has been asked (but not answered) here: http://www.openldap.org/lists/openldap-software/200907/msg00045.html. Is there anything else I need to add to slapd.conf or is my ldapsearch command missing something? Any pointers to documentation of how to set it up? Regards, --- Rebecka Gulliksson ICT Services and System Development (ITS) Umeå University SE-901 87 Umeå, Sweden rebecka.gulliksson(a)umu.se www.its.umu.se

2 2

OTP broken?
by Emmanuel Dreyfus 09 Nov '15

09 Nov '15

Hello It seems OTP was broken at some time, I wonder if it is just me (and why), or if it is more genral. I have a user with: cmusaslsecretOTP: sha1 0499 se2124 xxxxxxxxxxxxxxxx 00000000 slapd.conf contains: access to dn.regex="^uid=.+,dc=example,dc=net$" attrs=cmusaslsecretOTP by anonymous auth stop by self write stop by * none stop I try: $ ldapwhomai -Y OTP -X dn:${user_dn} SASL/OTP authentication started (delay) ldap_sasl_interactive_bind_s: Server is unavailable (52) additional info: SASL(-8): transient failure (e.g., weak key): simultaneous OTP authentications not permitted This is: OpenLDAP 2.4.42 Cyrusl SASL 2.1.26 While there, this uses sha1. Is there some new specs about doing it with sha256? Patching cyrus-sasl to add a new hashing algorithme is just a one liner. -- Emmanuel Dreyfus manu(a)netbsd.org

7 15

OpenLDAP & SSSD Question
by Borresen, John - 0444 - MITLL 09 Nov '15

09 Nov '15

Hopefully someone out there can shed some light on this. Running OpenLDAP 2.4.40 on our CentOS 5 servers, with an assortment of CentOS 5, 6, 7; Fedora20+, Ubuntu 12.04 to 14.04. The CentOS 5's are running as straight LDAP clients. The others are using SSSD / LDAP. On the CentOS 5, when running "getent hosts", it will return the entire LDAP Hosts dbase; which is the behavior we want. On all the systems running SSSD, they only return the local hosts file. If explicitly adding a host to the command "getent hosts some_host", it will only return if the host is in the local hosts file or DNS; never searching (watching the logs) either the LDAP or SSSD. Debug is at maximum. Again any help is appreciated. Thanks, JD Borresen

3 4

val/integerMatch="0"
by Michael Ströder 08 Nov '15

08 Nov '15

HI! Maybe I'm doing something obviously wrong but I don't see it. I want to limit the right to reset a counter value solely to zero with this ACL directive: add_content_acl yes [..] access to dn.subtree="ou=ae-dir" filter="(aeStatus=0)" attrs=oathHOTPCounter val/integerMatch="0" by group/aeGroup/member="cn=2fa admins,cn=2fa,ou=ae-dir" write by * break [..] The modify request looks like this (old value is 10): dn: serialNumber=yubikey-23,cn=2fa,ou=ae-dir changetype: modify replace: oathHOTPCounter oathHOTPCounter: 0 - It seems the ACL does not trigger, without the val= part the modification is allowed (but to any value). I also tried other forms: val="0" val=0 val.regex="^0$" Can somebody help me? Thanks in advance. Ciao, Michael.

2 3

ldiftopasswd: Can it be done with SSHA hashes?
by Chuck Peters 07 Nov '15

07 Nov '15

Can I convert the ldif's userPassword:: "salted hash, aka SSHA" to "hash type$salt$hash" format of shadow passwords? Or do I need to force those users with SSHA hashed passwords to change their password? Most of the users passwords are in crypt format. I found a perl one liner to base64 decode those passwords hashes. (1) I'm attempting to create shadow passwd files with an old Debian 6.0.10 (squeeze) LDAP installation and Debian's slapd package (2.4.23-7.3+deb6u2 squeeze-lts patched oldoldstable) includes a perl script ldiftopasswd, which I thought came from upstream, but it's not included in the most recent source of openldap. If my reading of the perl is correct, it was meant for earlier iterations of shadow passwords that did not include hash format or salt. I'm not having any success using the script this far. 1. http://www.perlmonks.org/bare/?node_id=963814 alias ldapdecode="perl -MMIME::Base64 -n -00 -e 's/\n //g;s/(?<=:: )(\S+)/decode_base64(\$1)/eg;print'" and just do ldapsearch | ldapdecode Thanks, Chuck

4 4

accesslog purge starves kerberos kdc authentications
by Paul B. Henson 06 Nov '15

06 Nov '15

We're running MIT kerberos with the ldap backend, specifically 3 openldap servers doing delta syncrepl. We started having a problem a while back where once a day the kdc would time out authentication requests, and finally tracked it down to openldap purging the accesslog. We currently have the accesslog overlay configured to delete entries over 7 days old once a day, and it seems that while openldap is processing the purge the kdc is starved out and unable to process authentications in a timely fashion. We do (thanks to our ISO) have account lockout enabled, so every authentication involves not only a read but a write. Is it expected for the accesslog purge to be so disruptive? Is there any way to tune it so it doesn't overwhelm the system to the point of being unresponsive? Would it be better to purge the accesslog more frequently as to amortize the work across multiple intervals rather than being concentrated once a day? Thanks for any suggestions...

5 10

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2015