openldap-technical December 2016

openldap-technical@openldap.org

33 participants
61 discussions

Re: n-way multi master and mirror mode
by brendan kearney 04 Dec '16

04 Dec '16

so is it intended to indicate or dictate active vs standby status? I would want to maintain active/active status for load sharing. I am also not using a load balancer, and rely on SRV records or configs to share load. any ideas why I am seeing deferred operations, otherwise? On Dec 3, 2016 4:28 PM, "Quanah Gibson-Mount" <quanah(a)symas.com> wrote: > --On Saturday, December 03, 2016 3:13 PM -0500 Brendan Kearney < > bpk678(a)gmail.com> wrote: > > i have a n-way multi master replicated directory, and i currently have >> mirror mode turned on. i am getting events in my logs about deferring >> operations (too many executing, etc) and want to know if i am causing >> these with mirror mode. the reading i am able to do on the topic seems >> to indicate that mirror mode is only necessary in provider/consumer >> replication, but i wanted to clarify that. is mirror mode necessary for >> n-way multi master replication? am i safe to turn it off, if it not >> needed? >> > > Mirror-Mode is a concept that has nothing to do with OpenLDAP > configuration in and of itself. The parameter in slapd.conf/cn=config is > badly misnamed. Either your servers are configured for multi-master > replication, or they aren't. > > Mirror mode is simply where you put a load balancer or similar device in > front of your LDAP servers and direct write traffic to only one > multi-master configured node at a time. > > See also <http://www.openldap.org/its/index.cgi/?findid=8511>. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > >

2 1

Re: n-way multi master and mirror mode
by Quanah Gibson-Mount 03 Dec '16

03 Dec '16

--On Saturday, December 03, 2016 4:53 PM -0500 brendan kearney <bpk678(a)gmail.com> wrote: > > so is it intended to indicate or dictate active vs standby status? I > would want to maintain active/active status for load sharing. I am also > not using a load balancer, and rely on SRV records or configs to share > load. > > > any ideas why I am seeing deferred operations, otherwise? That's generally normal. Unless you are seeing them be deferred for a significant amount of time, I wouldn't worry about it. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Having issue with openldap with TLS as a AD proxy
by Patrick.Ouellet＠promutuel.ca 03 Dec '16

03 Dec '16

Hello everyone, I hope Im at the right place for these kind of question, please tell me if I’m wrong. I just installed openldap as a proxy for AD. The proxy in itself works fine, I have made a few ldapsearch and got result I was expecting. Now I want to add TLS to it for security reason. I’m using openldap 2.4.42 on Ubuntu 16.04.1 LTS unfortunately it’s built with gnutls which I don’t know much about I would have preferred it to be built with openssl. So Im trying to make TLS work so I added these to slapd.conf TLSCipherSuite HIGH:!NULL TLSCACertificateFile /etc/SSL/LDAP/certificate_chain.cer.pem.gnutls TLSCertificateFile /etc/SSL/LDAP/p01ldp5001.cer.pem TLSCertificateKeyFile /etc/SSL/LDAP/p01ldp5001.key.pem TLSVerifyClient never security ssf=128 I also used certtool (gnutls tool) to validate my certificate I can verify my certificate_chain.cer.pem.gnutls with certtool so the file in itself is okay. certtool -e --infile certificate_chain.cer.pem.gnutls Loaded 2 certificates, 1 CAs and 0 CRLs Subject: C=CA,ST=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Intermediate CA 1 Issuer: C=CA,ST=Quebec,L=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Root CA Checked against: C=CA,ST=Quebec,L=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Root CA Output: Verified. The certificate is trusted. Chain verification output: Verified. The certificate is trusted. I can also verify the whole chain if I make a file containing the 3 certs, CA, Intermediate and Server certtool -e --infile full_chain.pem --verify-hostname p01ldp5001.services.local --verify-purpose 1.3.6.1.5.5.7.3.1 Loaded 3 certificates, 1 CAs and 0 CRLs Subject: C=CA,ST=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Intermediate CA 1 Issuer: C=CA,ST=Quebec,L=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Root CA Checked against: C=CA,ST=Quebec,L=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Root CA Output: Verified. The certificate is trusted. Subject: C=CA,ST=Quebec,L=Quebec,O=Promutuel CES,OU=Operations,CN=p01ldp5001.services.local Issuer: C=CA,ST=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Intermediate CA 1 Checked against: C=CA,ST=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Intermediate CA 1 Output: Verified. The certificate is trusted. Chain verification output: Verified. The certificate is trusted. Yet when I try to start the server I get this error main: TLS init def ctx failed: -1 Can someone help me with this? Patrick Ouellet [ligne] Administrateur Linux Operation VPSI [promutuel-assurance] Groupe Promutuel 2000, boulevard Lebourgneuf, 4e étage, Québec (Québec) G2K 0B6 [tel] 418 840-1188, poste 2393 / 1 800 510-4630 [telec] 418 840-9900 promutuelassurance.ca<https://www.promutuelassurance.ca/> Si vous devez imprimer ce document, faites-le recto verso. Si vous n'êtes pas le destinataire de ce message, veuillez le détruire après avoir informé l'expéditeur de son erreur. Par ailleurs, il est interdit de copier ou de modifier tout courriel sans l'autorisation de l'auteur. Promutuel Assurance n'assume aucune responsabilité à l'égard du contenu des messages personnels envoyés par ses employés. If you need to print this document, please print it double-sided. If you are not the intended recipient of this message, please notify the sender of the error and destroy the message. Please further note that it is prohibited to copy or modify any email without the author’s permission. Promutuel Insurance accepts no liability whatsoever with regard to the content of personal messages sent by its employees.

3 2

n-way multi master and mirror mode
by Brendan Kearney 03 Dec '16

03 Dec '16

i have a n-way multi master replicated directory, and i currently have mirror mode turned on. i am getting events in my logs about deferring operations (too many executing, etc) and want to know if i am causing these with mirror mode. the reading i am able to do on the topic seems to indicate that mirror mode is only necessary in provider/consumer replication, but i wanted to clarify that. is mirror mode necessary for n-way multi master replication? am i safe to turn it off, if it not needed? thanks in advance, brendan

1 0

Re: Building OpenLDAP with TLS support
by Quanah Gibson-Mount 02 Dec '16

02 Dec '16

--On Thursday, December 01, 2016 4:58 PM -0800 Tom Leach <leach(a)coas.oregonstate.edu> wrote: > So, as a followup to anyone else who may hit this issue, OpenLDAP 2.4.44 > won't build (without a set of patches) using OpenSSL 1.1.0c. I downloaded > the older OpenSSL 1.0.2j and everything built fine. > Hopefully the patches that allow OpenSSL 1.1.0 will be rolled into > OpenLDAP 2.4.45 but it may be longer as there seem to be a number of > OpenSSL API changes. > Tom Hi Tom, This has already been discussed several times in the last month on the list. ;) <http://www.openldap.org/lists/openldap-technical/201611/msg00016.html> is a recent example. Full support for OpenSSL 1.1 is scheduled for 2.4.45. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: LibLmdb non string data
by Howard Chu 02 Dec '16

02 Dec '16

Hallvard Breien Furuseth wrote: > On 02. des. 2016 12:26, Tim Uckun wrote: >> I am writing a wrapper for liblmdb and one thing I was able to do was to >> store simple integers and floats as the value into the database. This seems >> to work pretty well but I am wondering if this is somehow against best >> practice. >> >> One bad thing about this is that when you are doing a seek or a cursor >> operation the code does not know what kind of data is at the record. I have >> some routines to cast them back from the pointers but the user has to know >> what to cast them to. It would be very handy if the MDB_val struct had a >> field for metadata, even if it just a byte. > > LMDB handles binary data fine. The problem is ordering: > > Use a single datatype for each DB, and mdb_set_compare() > mdb_set_dupsort() to order data in that DB properly. Or > MDB_INTEGERKEY/MDB_INTEGERDUP which do this for unsigned int/size_t. > > If that is not feasible and you are mixing different datatypes in a > single database, you need to tag each data item so the compare function > can figure out how to parse and order them all. Note that a slow > compare function can degrade LMDB's performance. > > Note that the compare functions may receive unaligned values. Though > you can hack alignment 2, 4, or sizeof(size_t) = 4 or 8 by ensuring > *every* key and value in a DB has size = multiple of that alignment. > Keys always have alignment of at least 2. Hmm, I should add some > code so data will too except when both key and data have uneven size. > > Requests to add a user-defined argument to the compare functions have > been rejected. If you need that, maybe your wrapper can emulate it by > setting thread-specific data before calling LMDB, and then your sort > function can read that data. That gets cumbersome, though. > > If this is all generic, maybe define a DB with meta-info where your > wrapper can look up which datatypes (sizes, compare functions, whatever) > are in which database. > Or just stick your own identifier byte at the beginning of each data value. (Or key, if you're trying to use different type'd keys.) -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Question about LibLmdb MDB_GET_BOTH_RANGE and MDB_SET_RANGE
by Tim Uckun 02 Dec '16

02 Dec '16

I am trying to figure out how these calls work. The SET_RANGE works as expected but I was expecting different behavior fro GET_BOTH_RANGE. I have the following code in my spec file. txn.put(db, "1", "1") txn.put(db, "1", "1.1") txn.put(db, "1", "1.2") txn.put(db, "1", "1.3") txn.put(db, "2", "2") txn.put(db, "2.1", "2.1") txn.put(db, "2.2", "2.2") Then I do a seek like this cur.find_ge(".") #this uses SET_RANGE cur.find_ge(".", "1.2") #this uses GET_BOTH_RANGE The result of the first call is "1", "1" but the second call results in a MDB_NOTFOUND Seems like I am missing something here. Thanks.

2 1

Building OpenLDAP with TLS support
by Tom Leach 01 Dec '16

01 Dec '16

OK, I know I'm missing something since I know people are building OpenLDAP with OpenSSL for TLS/SSL, but when I add the --with-tls flag to configure, it all goes pear shaped. I'm starting with freshly downloaded tarballs of openssl-1.1.0c and openldap-2.4.44 on CentOS 7.2.1511. I've install the packages using yum: yum -y install tcp_wrappers tcp_wrappers-devel tcp_wrappers-libs libtool-ltdl-devel I've built/installed openssl with: ./config shared --prefix=/usr/local;make;make test; make install I then successfully build openldap with: ./configure CPPFLAGS="-I/usr/local/include" LDFLAGS="-L/usr/local/lib -Wl,-rpath,/usr/local/lib" --prefix=/usr/local --enable-wrappers --enable-syncprov=yes --enable-crypt=yes --enable-accesslog=yes --enable-auditlog=yes --enable-constraint=yes --enable-ppolicy=yes --enable-modules --enable-mdb --enable-debug=yes --enable-syslog --enable-slapd --enable-cleartext --enable-monitor --enable-overlays -with-threads --enable-rewrite --enable-syncprov=yes (without TLS support) make depend; make; make distclean I now add the "--with-tls=openssl" option to configure it fails with: ./configure CPPFLAGS="-I/usr/local/include" LDFLAGS="-L/usr/local/lib -Wl,-rpath,/usr/local/lib" --prefix=/usr/local --enable-wrappers --enable-syncprov=yes --enable-crypt=yes --enable-accesslog=yes --enable-auditlog=yes --enable-constraint=yes --enable-ppolicy=yes --enable-modules --enable-mdb --enable-debug=yes --enable-syslog --enable-slapd --enable-cleartext --enable-monitor --enable-overlays -with-threads --enable-rewrite --enable-syncprov=yes --with-tls=openssl <snip> checking for sys/un.h... yes checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking for SSL_library_init in -lssl... no checking for ssl3_accept in -lssl... no configure: error: Could not locate TLS/SSL package In looking at config.log: configure:15466: checking openssl/ssl.h usability configure:15466: cc -c -g -O2 -I/usr/local/include conftest.c >&5 configure:15466: $? = 0 configure:15466: result: yes configure:15466: checking openssl/ssl.h presence configure:15466: cc -E -I/usr/local/include conftest.c configure:15466: $? = 0 configure:15466: result: yes configure:15466: checking for openssl/ssl.h configure:15466: result: yes configure:15478: checking for SSL_library_init in -lssl configure:15503: cc -o conftest -g -O2 -I/usr/local/include -L/usr/local/lib -L/usr/local/lib64 -Wl,-rpath,/usr/local/lib conftest.c -lssl -lcrypto -lresolv >&5 /tmp/ccpvG28c.o: In function `main': /usr/local/src/openldap-2.4.44/conftest.c:107: undefined reference to `SSL_library_init' collect2: error: ld returned 1 exit status configure:15503: $? = 1 The source for OpenSSL 1.1.0c no longer has SSL_library_init in either the ssl or crypto libraries. It's now a macro in ssh.h which references OPENSSL_init_ssl. Since the OpenLDAP configure script doesn't pull in ssh.h in it's test, it doesn't find SSL_library_init and that test fails. As a hack, I changed the test in configure to use OPENSSL_init_ssl instead of SSL_library_init and OpenLDAP successfully configured but that blows up during make with a whole host of errors. I've also tried adding "-I/usr/local/include/openssl" to the CPPFLAGS environment but that doesn't change anything (as I expected): ./configure CPPFLAGS="-I/usr/local/include -I/usr/local/include/openssl" LDFLAGS="-L/usr/local/lib -Wl,-rpath,/usr/local/lib" --prefix=/usr/local --enable-wrappers --enable-syncprov=yes --enable-crypt=yes --enable-accesslog=yes --enable-auditlog=yes --enable-constraint=yes --enable-ppolicy=yes --enable-modules --enable-mdb --enable-debug=yes --enable-syslog --enable-slapd --enable-cleartext --enable-monitor --enable-overlays -with-threads --enable-rewrite --enable-syncprov=yes --with-tls=openssl So, is my next step to pull the dev version of 2.4.45 from git or am I just being a moron? Tom Leach

1 1

Re: restrict openldap TLS version
by Quanah Gibson-Mount 01 Dec '16

01 Dec '16

--On Thursday, December 01, 2016 6:24 PM +0000 David Ward <daward(a)Brocade.COM> wrote: Hi David, > I'm looking for a test method to restrict the level of TLS used with > slapd. I'm running ver 2.4.40 which supports TLS 1.2. I see the > undocumented command 'TLSProtocolMin' to require minimum strength. I > would like to disable certain version. I'm unclear what you mean by undocumented. It is clearly documented in the slapd.conf(5) man page (for 2.4.44), which you can freely view on the OpenLDAP.org website: TLSProtocolMin <major>[.<minor>] Specifies minimum SSL/TLS protocol version that will be negotiated. If the server doesn't support at least that version, the SSL handshake will fail. To require TLS 1.x or higher, set this option to 3.(x+1), e.g., TLSProtocolMin 3.2 would require TLS 1.1. Specifying a minimum that is higher than that supported by the OpenLDAP implementation will result in it requiring the highest level that it does support. This directive is ignored with GnuTLS. There is not, as far as I know, any way to fine tune things beyond this (I.e., accept TLS 1.1 and TLS 1.3, but not TLS 1.2). Hope that helps! Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 3

restrict openldap TLS version
by David Ward 01 Dec '16

01 Dec '16

I'm looking for a test method to restrict the level of TLS used with slapd. I'm running ver 2.4.40 which supports TLS 1.2. I see the undocumented command 'TLSProtocolMin' to require minimum strength. I would like to disable certain version. I saw in the thread 'Re: undocumented TLSProtocolMin' that there is mention of 'SSL_OP_NO_TLSv1_2'. Has this been implemented and how do you configure this in slapd.conf? This would be what I'm looking for in a method to toggle different version of TLS. -David

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical December 2016