openldap-technical March 2016

openldap-technical@openldap.org

51 participants
51 discussions

olcAccess/olcLimits modifications
by PenguinWhispererThe . 11 Mar '16

11 Mar '16

Good day to all, I'm currently looking into openldap and want to do some changes on an existing openldap directory. I've been able to apply my changes using delete and add in an ldif. For example: 10 olcLimits rules. Mine needs to be placed before the last olcLimit. - Delete current last line (with {10} specificier) - Add wanted line - Add previously deleted line This results in the intended config. However this looks like a hassle to me. For example in the case I had to insert on the 5th line I would have to delete 5 lines first, then add the line I want and then again add those 5 lines. Or I should use replace for replacing the whole list (what's the correct terminology for a list with {0}, {1}, ... ?). I need to copy paste all that data over to just add 1 new line(in case of olcLimits and olcAccess). I've been looking for examples for inserting in between but couldn't find any. Maybe I use the wrong keywords in our favorite search engine. Is this deleting and adding or replacing the way to go to make these changes? Are there alternatives? Thanks in advance for your responses. <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> 0 viruses found. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#DDB4FAA8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

4 4

[ LMBD ] Performance degradation
by nicolas prochazka 11 Mar '16

11 Mar '16

Hello, we are using lmbd in our product as database backend to save big key value ( 16K ) . First at all, lmbd is the best database in performance comparaison ( read / write) that we have tested. My question : # Databases data_dir:/data/cache/data lmdb version:LMDB 0.9.16: (August 14, 2015) db page size:4096 b-tree depath:4 branch pages:527 leaf pages:29287 overflow oages:6659875 data items:1331990 We have a lot of leaf pages, this is due to our big value size. When the database is empty, write and read are very fast, but when we delete all keys or a big part of keys, write and read (new keys) becomes very poor in performance ( / 100 ) . Is it a normal due to our big values ? The only solution we have found is to destroy database file rather than deleting keys Regards, Nicolas Prochazka

2 2

Collaborative work of MirrorMode replication and LDAP Sync Replication
by Andrei Valoshyn 10 Mar '16

10 Mar '16

Hello! slapd.conf configuration used *1.* I have test LDAP master and a consumer with LDAP Sync Replication type: Master: / overlay syncprov// // syncprov-checkpoint 100 10// // syncprov-sessionlog 100 /Consumer: syncrepl rid=115 provider=ldaps://master \ type=refreshOnly \ interval=00:00:00:30 \ scope=sub \ schemachecking=off \ searchbase="dc=exadel,dc=com" \ bindmethod=simple \ binddn="dc=exadel,dc=com" \ credentials=password \ retry="60 10 300 10" Sync is work. *2.* After that I have switched to MirrorMode replication via reconfiguring Master and Consumer: Master1(Master): /serverID 1/ / overlay syncprov// // syncprov-checkpoint 100 10// // syncprov-sessionlog 100 / / syncrepl rid=001 provider=ldaps://Master2 \// // bindmethod=simple \// // interval=00:00:00:30 \// // scope=sub \// // binddn="dc=exadel,dc=com" \// // credentials=password \// // searchbase="dc=exadel,dc=com" \// // schemachecking=off \// // type=refreshOnly \// // retry="60 +"// // // mirrormode on// / Master2(Consumer): /serverID 2/ / overlay syncprov// // syncprov-checkpoint 100 10// // syncprov-sessionlog 100 / / syncrepl rid=002 provider=ldaps://Master1 \// // bindmethod=simple \// // interval=00:00:00:30 \// // scope=sub \// // binddn="dc=exadel,dc=com" \// // credentials=password \// // searchbase="dc=exadel,dc=com" \// // schemachecking=off \// // type=refreshOnly \// // retry="60 +"// // // mirrormode on// / In this case SYNC is work(between Master1 -> Master2(NOT in Master2) -> Master1 direction) and other consumer pointed to Master1 or Master2) *3.* For fun I change configuration on Master1(Master) to previous state(Case 1) Master1: / overlay syncprov// // syncprov-checkpoint 100 10// // syncprov-sessionlog 100 / /Master2(Consumer): /serverID 2/ / overlay syncprov// // syncprov-checkpoint 100 10// // syncprov-sessionlog 100 / / syncrepl rid=002 provider=ldaps://Master1 \// // bindmethod=simple \// // interval=00:00:00:30 \// // scope=sub \// // binddn="dc=exadel,dc=com" \// // credentials=password \// // searchbase="dc=exadel,dc=com" \// // schemachecking=off \// // type=refreshOnly \// // retry="60 +"// // // mirrormode on// //In this case we have the same situation with SYNC as in CASE 2 - all work fine. Is it good working SYNC schema? What chance of breaking down db on Master1 I have? -- With Best Wishes Andrei Valoshyn Exadel Inc. System Administrator avaloshyn(a)exadel.com -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

2 4

SASL2 and Openldap
by Jerry 10 Mar '16

10 Mar '16

I just started creating a new server with FreeBSD 11. I installed the openldap port. Now I am trying to figure out how to get sasl2 up and running. Openldap is running fine now without it, but I want to secure it further. Can anyone suggest a good "How to" on how to accomplish this on a FreeBSD OS (if that makes any difference). Examples are welcomed :) -- Jerry

3 4

Re: Antw: delta sync and strictrefresh
by Quanah Gibson-Mount 10 Mar '16

10 Mar '16

--On Thursday, March 10, 2016 8:27 AM +0100 Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >>>> Quanah Gibson-Mount <quanah(a)zimbra.com> schrieb am 10.03.2016 um 04:49 >>>> in > Nachricht <07CEB0B0E429A934BA46C978(a)[192.168.1.9]>: >> --On Wednesday, March 09, 2016 8:46 AM +0100 Ulrich Windl >> <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >>>> >>>> Sometimes it happen the consumer go out of sync. Convenient solution: >>> >>> What you describe is not a database out of sync, but a corrupted >>> database. You never have to delete a database that is out of sync; >>> you'll just have to refresh it, and that should be automatic if >>> configured and working correctly >> >> Except, as is often the case, you're generally wrong. Unfortunately, >> every > > You like being personal and inpolite? I really missed that! ;-) Generally, no, but unfortunately your answers to people's questions fall more on the incorrect side of things than the correct side of things, causing confusion and other problems. I appreciate that you want to participate and be helpful, but giving out advice that is wrong is not helpful at all. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration A division of Synacor, Inc

1 0

Experience with LDAP monitoring (cn=monitor)
by Ulrich Windl 10 Mar '16

10 Mar '16

Hi! I'd like to inform you about my experience with LDAP monitoring using the cn=monitor DN to query openLDAP. I wrote a NRPE-plugin used from Nagios/Centreon to gather performance data. So my experience is this: Issues with LDAP Monitoring "Uptime" is in whole seconds only (minor issue). SNMP uptime has a finer resolution (but limited range, unfortunately). Detailed data per peer can only be retrieved through the "Connections", but that's a moment's view only: So if a client opens a connection, does a few operations, then closes the connection, a polling client of the monitor will never see those client operations. Also when needing a cumulative count of operations per peer (or just the number of connections per peer (for a rate)), a monitor client will have to accumulate the numbers from all peer connections. If a connection (with significant operations being done) was closed since the last poll, the total number will look negative. So the monitor client will have to store accumulated numbers for closed connections per peer also (Keeping numbers for all closed connections seems inefficient). "Current Connections" is returned as monitor _counter_ object (monitorCounter), where in fact it's of type "gauge", opposed to "Total Connections" (which is also returned as monitor counter) which is actually a counter. This makes the code harder than necessary. What I'm missing are some database (BDB/HDB) runtime statistics. Ok, I'll attach four PNG graphs to let you see how far I got. Regards, Ulrich

4 4

log_rdns.patch
by A. Schulze 10 Mar '16

10 Mar '16

Hi again, this is my third and last patch I send today :-) I compiled openldap with '--enable-rlookups' and set 'reverse-lookup on' in slapd.conf I like to see the remote hostname logged. That didn't work somehow. ( I wrote this patch months ago and could not describe the real problem anymore) Anyway: the patch modify log output: reverse-lookup off: conn=4846 fd=42 ACCEPT from IP=127.0.0.1:46058 (IP=127.0.0.1:389) reverse-lookup on: conn=4191 fd=18 ACCEPT from localhost (IP=127.0.0.1:389) I never tested with ldapi:// connections. Also I expect the patch is not optimal for performance. But it works here in a small environment. Andreas

6 9

delta sync and strictrefresh
by A. Schulze 09 Mar '16

09 Mar '16

Hello, I'm a longtime openldap and syncreplica user. Now I learned about delta replication and the option "strictrefresh". But it doesn't work as promised. Maybe my expectation is simply wrong... Let's describe my use case: One ore two provider serve data to numerous consumer. Application running on the consumer host are configured to query the local consumer first and fall back to the provider. A typical LDAP-URI looks like "ldap://localhost ldaps://provider1 ldaps://provider2" Application only /read/ data. Sometimes it happen the consumer go out of sync. Convenient solution: delete the consumer ldap database and restart slapd. Now it take some time to fetch the whole data from provider to consumer server. Just in this time frame the application may query ldap://localhost and get an answer which is simply wrong because the data transfer is still in progress. That's what I want to avoid. Is that possible with openldap at all Thanks, Andreas

4 4

Patch: CIPHER_SERVER_PREFERENCE
by A. Schulze 09 Mar '16

09 Mar '16

Hello, The patch implement a feature similar to http://www.postfix.org/postconf.5.html#tls_preempt_cipherlist Not perfect, not configurable but works here without problems. Andreas

2 1

man page patches
by A. Schulze 09 Mar '16

09 Mar '16

Hello, here is my second patch set. They modify mostly man pages and spelling errors found by Debian lintain ( https://packages.debian.org/jessie/lintian) Andreas

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical March 2016