openldap-technical June 2016

openldap-technical@openldap.org

32 participants
34 discussions

cn=config database setup
by Trent Dierking 21 Jun '16

21 Jun '16

Following the quickstart guide at http://www.openldap.org/doc/admin24/quickstart.html and the following happens # ./sbin/slapadd -F etc/'cn=config' -l etc/openldap/slapd.ldif 57680d0f invalid config directory etc/cn=config, error 2 slapadd: bad configuration directory! # mkdir -p 'etc/cn=config' # ./sbin/slapadd -F etc/'cn=config' -l etc/openldap/slapd.ldif Available database(s) do not allow slapadd I've ensured the appropriate var/openldap-data directory exists. I've tried adding the maxsize key shown on the guide. I am not sure what else could cause this, as this is for the hardcoded cn=config database.

2 1

auditContext attribute ?
by Frank Swasey 20 Jun '16

20 Jun '16

I have discovered (on my test environment running 2.4.44 on RHEL7) that when I slapcat from either of the MMR syncing masters the suffix base entry has the auditContext attribute. If I take the generated LDIF to my replica server, it will not slapadd unless I delete the auditContext attribute. I assume this is something that I have accidentally turned on in the slapd configuration or is new in 2.4.44. I'm confused and not finding any documentation of this attribute and why it is getting included in the slapcat output - can anyone guide me to an answer? -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

2 2

ldap user login attempt kills slapd service
by Real, Elizabeth (392K) 16 Jun '16

16 Jun '16

Openldap gurus: Here is my setup, LDAPSERVERS: I have two ldap servers running RHEL7.2 and openldap 2.4.40. Both servers are configured with multi-master replication. Ldaps is enabled and a ppolicy applied. LDAPCLIENT: My ldap client is running RHEL7.2 as well, sssd 1.13.0, and openldap client 2.4.40. I have been troubleshooting this problem for a while and can’t figure out why everytime I try to login to an ldap client with a test user account the slapd service on only one of my ldap servers gets killed. Both getent and ldapsearch return the expected information when ran on the ldap client: ldapclient ~]# getent passwd realtest realtest:*:1004:312:Liz RealTest:/home/real:/bin/tcsh ldapclient ~]# ldapsearch -x -s sub -b 'ou=People,dc=cluster,dc=sec312' '(uid=realtest)' # extended LDIF # # LDAPv3 # base <ou=People,dc=cluster,dc=sec312> with scope subtree # filter: (uid=realtest) # requesting: ALL # # realtest, People, cluster.sec312 dn: uid=realtest,ou=People,dc=cluster,dc=sec312 gidNumber: 312 objectClass: account objectClass: top objectClass: posixAccount objectClass: shadowAccount uid: realtest loginShell: /bin/tcsh homeDirectory: /home/real cn: Liz RealTest uidNumber: 1004 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 LDAP SERVER /VAR/LOG/SECURE: serverA journal: Suppressed 19192 messages from /system.slice/slapd.service serverA journal: Suppressed 8449 messages from /system.slice/slapd.service serverA systemd: slapd.service: main process exited, code=killed, status=6/ABRT serverA systemd: Unit slapd.service entered failed state. serverA systemd: slapd.service failed. LDAP CLIENT /VAR/LOG/SECURE: ldapclient sshd[122938]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=node12.cluster.sec312 user=realtest ldapclient sshd[122938]: pam_sss(sshd:auth): received for user realtest: 7 (Authentication failure) ldapclient sshd[122938]: pam_ldap(sshd:auth): Authentication failure; user=realtest ldapclient sshd[122936]: error: PAM: Authentication failure for realtest from node12.cluster.sec312 ATTEMPT TO SSH AS TEST USER TO LDAP CLIENT: % ssh -v realtest@ldapclient OpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 60: Applying options for * debug1: Connecting to ldapclient [] port 22. debug1: Connection established. debug1: could not open key file '/etc/ssh/ssh_host_key': Permission denied debug1: could not open key file '/etc/ssh/ssh_host_dsa_key': Permission denied debug1: could not open key file '/etc/ssh/ssh_host_ecdsa_key': Permission denied debug1: could not open key file '/etc/ssh/ssh_host_rsa_key': Permission denied debug1: could not open key file '/etc/ssh/ssh_host_ed25519_key': Permission denied debug1: could not open key file '/etc/ssh/ssh_host_dsa_key': Permission denied debug1: could not open key file '/etc/ssh/ssh_host_ecdsa_key': Permission denied debug1: could not open key file '/etc/ssh/ssh_host_rsa_key': Permission denied debug1: could not open key file '/etc/ssh/ssh_host_ed25519_key': Permission denied debug1: identity file /home/real/.ssh/id_rsa type -1 debug1: identity file /home/real/.ssh/id_rsa-cert type -1 debug1: identity file /home/real/.ssh/id_dsa type -1 debug1: identity file /home/real/.ssh/id_dsa-cert type -1 debug1: identity file /home/real/.ssh/id_ecdsa type -1 debug1: identity file /home/real/.ssh/id_ecdsa-cert type -1 debug1: identity file /home/real/.ssh/id_ed25519 type -1 debug1: identity file /home/real/.ssh/id_ed25519-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.6.1 debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1 debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5-etm(a)openssh.com none debug1: kex: client->server aes128-ctr hmac-md5-etm(a)openssh.com none debug1: kex: curve25519-sha256(a)libssh.org need=16 dh_need=16 debug1: kex: curve25519-sha256(a)libssh.org need=16 dh_need=16 debug1: sending SSH2_MSG_KEX_ECDH_INIT debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ECDSA 14:c5:c2:60:29:ce:99:aa:67:41:a6:6a:11:2c:ca:86 debug1: Host 'ldapclient' is known and matches the ECDSA host key. debug1: Found key in /home/real/.ssh/known_hosts:22 debug1: ssh_ecdsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive,hostbased debug1: Next authentication method: gssapi-keyex debug1: No valid Key exchange context debug1: Next authentication method: gssapi-with-mic debug1: Unspecified GSS failure. Minor code may provide more information No Kerberos credentials available debug1: Unspecified GSS failure. Minor code may provide more information No Kerberos credentials available debug1: Unspecified GSS failure. Minor code may provide more information debug1: Unspecified GSS failure. Minor code may provide more information No Kerberos credentials available debug1: Next authentication method: hostbased debug1: No more client hostkeys for hostbased authentication. debug1: Next authentication method: publickey debug1: Trying private key: /home/real/.ssh/id_rsa debug1: Trying private key: /home/real/.ssh/id_dsa debug1: Trying private key: /home/real/.ssh/id_ecdsa debug1: Trying private key: /home/real/.ssh/id_ed25519 debug1: Next authentication method: keyboard-interactive Password: debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive,host based Any help will be greatly appreciated! Thank you, Liz

3 6

Checking that account is locked
by Radovan Semancik 16 Jun '16

16 Jun '16

Hi, I was exploring account lockout functionality of password policy overlay. I would like to know how to reliably check whether particular account is locked or not (e.g. for use by a helpdesk application). It looks like from the documentation that this is not possible to do by just examining the account LDAP entry. Is that right? The locked account contains pwdAccountLockedTime that indicates the time when the account was locked. But I also need to determine whether the lock has not expired. For that I need the value of pwdLockoutDuration from the password policy. But how to determine what entry contains a default password policy? For that I need access to cn=config, right? So if my helpdesk application does not have access to the cn=config then I'm pretty much out of luck. Is my thinking OK or have I overlooked something? -- Radovan Semancik Software Architect evolveum.com

4 5

Assertion failed
by mdii 14 Jun '16

14 Jun '16

Hi, I'm having some trouble when starting a openLDAP 2.4.35. In the log files I have the message: ** ld 0x7f11e4100910 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x7f11e4100910 request count 1 (abandoned 0) ** ld 0x7f11e4100910 Response Queue: Empty ld 0x7f11e4100910 response count 0 ldap_chkResponseList ld 0x7f11e4100910 msgid 2 all 0 *slapd: ./../../../libraries/liblmdb/mdb.c:4025: mdb_page_search_root: Assertion `(((mp)->mp_pb.pb.pb_lower - ((unsigned) __builtin_offsetof (MDB_page, mp_ptrs))) >> 1) > 1' failed.* ldap_chkResponseList returns ld 0x7f11e4100910 NULL ldap_int_select read1msg: ld 0x7f11e4100910 msgid 2 all 0 ber_get_next tls_read: want=5, got=5 0000: 17 03 03 02 90 ..... tls_read: want=656, got=656 0000: 39 eb 87 92 b0 b2 1d f6 e2 b9 bc 4e 80 08 88 47 9..........N...G 0010: bc 01 92 5e e1 b4 a7 19 ae 42 2b 07 b9 f9 ae b9 ...^.....B+..... 0020: 3f e3 ec 58 ca cc d2 28 89 f8 5b d1 a1 c9 00 bf ?..X...(..[..... 0030: 17 87 0a f6 e3 56 24 e8 6b 58 98 f5 95 c2 3d 2b .....V$.kX....=+ 0040: aa e4 3b a6 09 0e 2b bd a4 c5 16 31 e6 7d cf 88 ..;...+....1.}.. 0050: 33 91 cd 9b 00 e8 37 66 64 0f a0 70 35 c9 5a 42 3.....7fd..p5.ZB 0060: 3e 62 f1 61 b0 7b 1f 24 89 3f ef 08 bb df 11 f8 >b.a.{.$.?...... 0070: 43 8e f4 6a 67 d0 d5 e0 13 18 11 7a c1 ba 40 60 C..jg......z..@` 0080: 2b ba 0d ad 6f 64 f0 95 dc e6 7d 37 f4 b4 47 39 +...od....}7..G9 0090: 88 7f 2a 16 5c 78 37 d2 4b e9 be f8 b2 fd aa db ..*.\x7.K....... 00a0: b6 5c 50 f2 68 24 48 09 46 cf a9 e3 f0 b3 0a a7 .\P.h$H.F....... 00b0: f7 4c 25 9f 92 26 31 fe 19 f3 af c3 d9 33 e3 38 .L%..&1......3.8 00c0: a4 b1 bd b6 e4 48 07 3d dd 6f f5 96 8f 78 c6 f0 .....H.=.o...x.. 00d0: 11 bc 2a f2 08 98 3e 50 d0 d5 5c e0 06 1c 43 ea ..*...>P..\...C. 00e0: 07 cf fb 64 95 5d 55 12 e5 85 d0 28 af 47 fa 5c ...d.]U....(.G.\ ... 0260: 4a 62 da 51 4c 37 2e c6 87 e9 a3 04 29 a4 4b e4 Jb.QL7......).K. 0270: 1f 3b ef f9 4f 2a 88 d4 56 53 7f 92 e3 51 88 c1 .;..O*..VS...Q.. 0280: cf a3 90 52 4e a5 98 72 51 20 2f f7 7f c0 aa be ...RN..rQ /..... ldap_read: want=8, got=8 0000: 30 82 02 66 02 01 02 64 0..f...d ldap_read: want=610, got=610 0000: 82 02 28 04 15 6f 75 3d 67 72 6f 75 70 65 73 2c ..(..ou=groupes, 0010: 6f 3d 6d 61 6e 70 6f 77 65 72 30 82 02 0d 30 28 o=manpower0...0( 0020: 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 31 19 04 ..objectClass1.. 0030: 03 74 6f 70 04 12 6f 72 67 61 6e 69 7a 61 74 69 .top..organizati 0040: 6f 6e 61 6c 55 6e 69 74 30 0f 04 02 6f 75 31 09 onalUnit0...ou1. 0050: 04 07 67 72 6f 75 70 65 73 30 2d 04 15 73 74 72 ..groupes0-..str 0060: 75 63 74 75 72 61 6c 4f 62 6a 65 63 74 43 6c 61 ucturalObjectCla 0070: 73 73 31 14 04 12 6f 72 67 61 6e 69 7a 61 74 69 ss1...organizati 0080: 6f 6e 61 6c 55 6e 69 74 30 33 04 0c 63 72 65 61 onalUnit03..crea 0090: 74 6f 72 73 4e 61 6d 65 31 23 04 21 63 6e 3d 61 torsName1#.!cn=a 00a0: 64 6d 69 6e 2c 6f 75 3d 70 72 6f 67 72 61 6d 6d dmin,ou=programm 00b0: 65 73 2c 6f 3d 6d 61 6e 70 6f 77 65 72 30 33 04 es,o=manpower03. 00c0: 09 65 6e 74 72 79 55 55 49 44 31 26 04 24 32 65 .entryUUID1&.$2e *Aborted* I already try to delete de lock.mdb and data.mdb files in order to recreate then (in case of a db corruption), but the error continues to pop... I also saw the thread "(ITS#7756) LMDB assertion failed in mdb_page_search_root ( http://www.openldap.org/lists/openldap-bugs/201311/msg00054.html). Is there anyway to bypass this error ? Thanks in advance for your help, Marc

2 1

MMR: How do you tell that the MMR servers are in sync?
by Frank Swasey 13 Jun '16

13 Jun '16

I am a newbie with MMR. I've just set up my first test of this. I have found it to be almost impossible to determine (via the contextCSN values) if the masters (let alone all the replicas) are actually synched. How are you folks, who are already using MMR, checking/verifying that the MMR participants (and their replicas) are actually in sync? Thanks, -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

7 13

Maximum number of uniqueMembers
by Rébeli-Szabó Tamás 10 Jun '16

10 Jun '16

Hi all, is there a limit for the number of attributes for entries? Specifically, I want to have 500,000 uniqueMembers for a group entry, but I cannot add more than 359,000. When I try to add 360,000 or more, I get: "ldapadd: update failed ... ldap_add: Can't contact LDAP server (-1)" The group entry look like this: dn: cn=biggroup,ou=groups,dc=test,dc=com objectClass:top objectClass: groupOfUniqueNames cn: Ah, big group uniqueMember: uid=user1,ou=users,dc=test,dc=com uniqueMember: uid=user2,ou=users,dc=test,dc=com ... uniqueMember: uid=user359000,ou=users,dc=test,dc=com I have 1 million users in ou=users,dc=test,dc=com (so I haven't run into a limit here). I am on 2.4.41, LMDB with 4G maxsize (RHEL 5.10; 2.6.39). I have no limits set in slapd.conf. Another, related issue: If I add 359k members to a group, and then I try to modify the group to add another member, ldapadd hangs. When I trace it, all I can see is continual ldap_result calls, that is, the client is waiting for the update operation to end on the server, and slapd is using nearly 100% of CPU. If I restart the server, I can add one member, but I cannot add say a hundred thousand more. Any hint is appreciated. Regards, tamas <tel:+36%2030%202100%20873>

2 3

LMDB Hanging Problem in Multi-Threaded Application
by Yahoo! 09 Jun '16

09 Jun '16

Hello, I successfully ran a multi-threaded application using LMDB 0.9.10-1 on a 64-bit Ubuntu 14.04 machine with 4x10-core Xeon E5-2660 v3 CPUs and 132 GB RAM. I then attempted to run the same application on a CentOS 6.7 box with 2x4-core i7-4790K CPUs and 32 GB RAM, where I tried two versions of LMDB: first EPEL RPM package version 0.9.18-1, and then the latest version 0.9.70 which I downloaded and compiled from GitHub sources on 4/27/2016. On the CentOS system with fewer cores, my application started to hang. I have traced the problem to a periodic commit, after which a new transaction must be created. I commit periodically to avoid a long delay when the application shuts down, at which point a 2 GB database is flushed to disk. I have a single write transaction, which is protected by a mutex when calling mdb_txn_commit(), mdb_txn_begin() and mdb_put(). The threads are created by TBB using parallel_for, and each thread has access to the single MDB_dbi and associated MDB_txn for writing. When a counter hits a certain value, we lock a mutex and call mdb_txn_commit(), and then we create a new MDB_txn to replace the invalidated one. Other threads try to acquire the same mutex before attempting to call mdb_put(). After a new write transaction is created, the next call the mdb_put() works fine on my 40-core Ubuntu box and the database is created successfully, but the application hangs on my 8-core CentOS box. My only guess is that I am encountering a race condition that is somehow avoided on the faster machine. Is the above valid LMDB usage? I have tried to find information about multi-threaded writing, and I have not found any definitive answers. I would be happy to share the relevant code, but I need to first strip out a great deal of project-specific ancillary code, which will take some time. Thanks, Alex

4 5

Re: Re: ldapdelete: Use wild card to delete multiple enetries
by Parveen Verma 08 Jun '16

08 Jun '16

Thanks for your answer. So I take it that we can't give wild card/regular expression in ldapdelete. I have just installed an OpenLDAP with LMDB only [ without bdb/hdb]. ./configure --prefix=/my/home/directory/parveen/OpenLDAP_LMDB --exec-prefix=/my/home/directory/parveen/OpenLDAP_LMDB --enable-bdb=no --enable-hdb=no So I was adding and deleting entries and it was taking time. For addition, I switch from ldapadd to slapadd [stoping slapd for a while]. For deletion, I was thinking of some wild card like things to see if timing can be improved. I was adding some 100K entries and deleting them, it was taking time, so I thought it could be faster if we give command in one go and then ldapdelete just receives the output and send to STDOUT/STDERR. To Others, Is there any plan for adding wild cards or its in my fantasy only? The GURU has well decided not to provide such things as ldapdelete is destructive and a little misunderstanding in handling wildcards/regular expression can delete the DB. Thanks anyways!! ---------------- Hi, you cannot use wildcards in deletes as per my understanding. You can, however, use wildcards in search filters. If you are on a Unix-like system, you can feed the output of a search with a bit of transformation into ldapmodify. You may want to try something like this (I ran this on Linux): ldapmodify -f <(ldapsearch -b "dc=ALCATEL,dc=FR" "(cn=Parveen30*)" | grep dn: | sed 's/$/\nchangetype:delete\n'/) Regards, tamás On Wed, Jun 8, 2016 at 5:54 PM, Parveen Verma <parveen.subs(a)gmail.com> wrote: > Hello All, > > Is there a Way to delete multiple LDAP entries by using some wildcards or > regular expression. > Like I have below entries. > dn: cn=Parveen20,dc=ALCATEL,dc=FR > dn: cn=Parveen200,dc=ALCATEL,dc=FR > dn: cn=Parveen201,dc=ALCATEL,dc=FR > dn: cn=Parveen202,dc=ALCATEL,dc=FR > dn: cn=Parveen203,dc=ALCATEL,dc=FR > dn: cn=Parveen204,dc=ALCATEL,dc=FR > dn: cn=Parveen205,dc=ALCATEL,dc=FR > dn: cn=Parveen206,dc=ALCATEL,dc=FR > dn: cn=Parveen207,dc=ALCATEL,dc=FR > dn: cn=Parveen208,dc=ALCATEL,dc=FR > dn: cn=Parveen209,dc=ALCATEL,dc=FR > dn: cn=Parveen30,dc=ALCATEL,dc=FR > dn: cn=Parveen300,dc=ALCATEL,dc=FR > dn: cn=Parveen301,dc=ALCATEL,dc=FR > dn: cn=Parveen302,dc=ALCATEL,dc=FR > dn: cn=Parveen303,dc=ALCATEL,dc=FR > dn: cn=Parveen304,dc=ALCATEL,dc=FR > dn: cn=Parveen305,dc=ALCATEL,dc=FR > dn: cn=Parveen306,dc=ALCATEL,dc=FR > dn: cn=Parveen307,dc=ALCATEL,dc=FR > dn: cn=Parveen308,dc=ALCATEL,dc=FR > dn: cn=Parveen309,dc=ALCATEL,dc=FR > > > I want to delete entries with 301,302,303.... > So how can I give this, except putting all these in a LDIF file. > > or how can below work > > cn=Parveen30*,dc=ALCATEL,dc=FR > >

1 0

Problem with ppolicy
by Il Neofita 08 Jun '16

08 Jun '16

Hi there, I have a problem with ppolicy and got stuck finding a solution. I am using openldap-2.4.40-9 Oracle 7.2, the lock seems to be ignored. This what I have configured dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModuleLoad: ppolicy.la olcModulePath: /usr/lib64/openldap dn: olcOverlay=ppolicy,olcDatabase={2}hdb,cn=config objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyDefault: cn=ppolicy,ou=policies,dc=ddd olcPPolicyUseLockout: TRUE olcPPolicyHashCleartext: TRUE dn: cn=ppolicy,ou=policies,dc=ddd objectClass: top objectClass: device objectClass: pwdPolicyChecker objectClass: pwdPolicy cn: ppolicy pwdAttribute: userPassword pwdAllowUserChange: TRUE pwdInHistory: 4 pwdMinLength: 8 pwdMaxFailure: 6 pwdFailureCountInterval: 1800 pwdCheckQuality: 1 pwdMustChange: TRUE pwdGraceAuthNLimit: 3 pwdMaxAge: 3600 pwdExpireWarning: 31536000 pwdLockoutDuration: 900 pwdLockout: TRUE pwdCheckModule: pwcheck.la and I tried to add the attribute pwdReset: TRUE and pwdAccountLockedTime: 20110214195250Z in a specific user, however, the user is not locked and I do not even been ask to change the password Here is what happens ldapwhoami -e ppolicy -x -D "uid=ldap001,ou=People,dc=ddd" -W -h localhost Enter LDAP Password: dn:uid=ldap001,ou=People,dc=ddd Any idea what I should check

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical June 2016