openldap-technical January 2020

openldap-technical@openldap.org

35 participants
45 discussions

Re: ldapsearch utility
by Peter Sui 07 Jan '20

07 Jan '20

Hi Quanah, Thank you for your response. I figured what you said in your response, and I have another question about the SASL. I have a ldap testing server, let's say the url is test.sample.net, and when I run the following command: ldapsearch -H ldap://test.sample.net:389 -x -b "" -s base -LLL supportedSASLMechanisms it returned: dn: supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: NTLM then I run the command: ldapsearch -H ldap://test.sample.net:389 -Y DIGEST-MD5 then it prompt: SASL/DIGEST-MD5 authentication started Please enter your password: I give a password, then it prompt: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database so question here, what password it asked here? since it's not asking for a DN. There could be many credentials here, will the server figure out the user by the password input? Thank you! Peter On Mon, Jan 6, 2020 at 8:17 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Tuesday, December 31, 2019 10:44 AM -0500 Peter Sui <peters(a)qnext.com> > > wrote: > > > if I run: > > ldapsearch -h ldap.forumsys.com -p 636 -b "" -s base "(objectClass=*)" > -D > > "cn=read-only-admin,dc=example,dc=com" -w password -Z > > It is not valid to combine startTLS with port 636. Also, you should > update > your options to match modern standards. > > > Example against ldaps:/// > > ldapsearch -H ldaps://ldap.forumsys.com:636 > > as opposed to > > ldapsearch -h ldap.forumsys.com -p 636 > > Example against ldap:/// > > ldapsearch -H ldap://ldap.forumsys.com:389 > > as opposed to > > ldapsearch -h ldap.forumsys.com -p 389 > > > I would note that the -Z(Z) options are for startTLS (generally against > port 389). It is not valid to mix startTLS with ldaps:// URIs. You've > not > provided any useful information about your setup, so it's not possible to > give you much help past that. > > As for your SASL question, as documented in the ldapsearch man page, you > provide the SASL Mech as a parameter to the -Y option. For example: > > ldapsearch -Y GSSAPI -H ldap://ldap.forumsys.com:389 > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

RE: ldapsearch utility
by Peter Sui 06 Jan '20

06 Jan '20

Hi, I'm trying to use ldapsearch to do some tests, lets say the testing ldap server host is: ldap.forumsys.com , test 1: if I run: ldapsearch -h ldap.forumsys.com -p 389 -b "" -s base "(objectClass=*)" -D "cn=read-only-admin,dc=example,dc=com" -w password it seems successful, but if I add ssl flag, like run: ldapsearch -h ldap.forumsys.com -p 389 -b "" -s base "(objectClass=*)" -D "cn=read-only-admin,dc=example,dc=com" -w password -Z I got error: ldap_start_tls: Connect error (-11) additional info: (unknown error code) ldap_result: Can't contact LDAP server (-1) if I run: ldapsearch -h ldap.forumsys.com -p 636 -b "" -s base "(objectClass=*)" -D "cn=read-only-admin,dc=example,dc=com" -w password -Z I got error: ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) so how can I do a search with ssl? test 2: this is about SASL authentication. Lets say the SASL mech is DIGEST-MD5, or EXTERNAL, or GSSAPI, what ldapsearch command should I run? I tried many, it did not work. Thanks! Peter Sui

2 1

please repost link to question "How to build OpenLDAP against specific OpenSSL install"
by Dunne, Kenneth 06 Jan '20

06 Jan '20

I found this, but get a 404 error following it: >The new OpenSSL 1.0.1e header files are located under /usr/local/include/openssl and the >libs are in /usr/local/lib64. <https://github.com/Zimbra-Community/zimbra-sources/blob/master/main/ThirdPa…> --Quanah

2 1

Issues with OpenLdap using OpenTLS
by Dunne, Kenneth 03 Jan '20

03 Jan '20

All I am able to connect to my home-built OpenSSL installation (from Dec-19 sources) on CentOS-7 without the TLS bind. I am now trying to use OpenTLS with OpenSSL, which is not currently working. From searching the internet I find this, Which indicates that maybe RH-based-unixes have unique issues with OpenTLS/OpenLdap: https://serverfault.com/questions/437546/centos-openldap-cert-trust-issues My slapd.conf now holds (as differs from the default installed slapd.conf) ... snip... ############### TLS # added per http://www.openldap.org/faq/data/cache/185.html TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt TLSCertificateFile /usr/local/etc/openldap/servercrt.pem TLSCertificateKeyFile /usr/local/etc/openldap/serverkey.pem TLSCipherSuite DES-CBC3-SHA ... snip... And my ldap.conf holds: ... snip... ############### TLS ############### TLS # added per http://www.openldap.org/faq/data/cache/185.html TLS_CACERT /etc/pki/tls/certs/ca-bundle.crt ### fails: ## TLS_CACERT /usr/local/etc/openldap/ cacert.pem URI ldaps://localhost:636 ############### TLS ... snip... .... Having added the 'cacert.pem' into the file " /etc/pki/tls/certs/ca-bundle.crt" I get farther in the authentication than using "/usr/local/etc/openldap/ cacert.pem": [root@kdunne-dev openldap]# /usr/local/bin/ldapsearch -Z -D "cn=Manager,dc=my-domain,dc=com" -d -1 ldap_create ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying ::1 636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect errno: 111 ldap_close_socket: 3 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect success TLS trace: SSL_connect:before/connect initialization tls_write: want=289, written=289 0000: 16 03 01 01 1c 01 00 01 18 03 03 51 03 78 81 fc ...........Q.x.. 0010: 66 89 9c 91 10 b6 e9 3d f1 12 66 27 c7 f5 80 e4 f......=..f'.... 0020: fb f6 5f 9d f8 bb 37 3b 84 cb 17 00 00 ac c0 30 .._...7;.......0 0030: c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 .,.(.$.......... 0040: 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 ...k.j.i.h.9.8.7 0050: 00 36 00 88 00 87 00 86 00 85 c0 32 c0 2e c0 2a .6.........2...* 0060: c0 26 c0 0f c0 05 00 9d 00 3d 00 35 00 84 c0 2f .&.......=.5.../ 0070: c0 2b c0 27 c0 23 c0 13 c0 09 00 a4 00 a2 00 a0 .+.'.#.......... 0080: 00 9e 00 67 00 40 00 3f 00 3e 00 33 00 32 00 31 ...g.@.?.>.3.2.1 0090: 00 30 00 9a 00 99 00 98 00 97 00 45 00 44 00 43 .0.........E.D.C 00a0: 00 42 c0 31 c0 2d c0 29 c0 25 c0 0e c0 04 00 9c .B.1.-.).%...... 00b0: 00 3c 00 2f 00 96 00 41 c0 12 c0 08 00 16 00 13 .<./...A........ 00c0: 00 10 00 0d c0 0d c0 03 00 0a 00 07 c0 11 c0 07 ................ 00d0: c0 0c c0 02 00 05 00 04 00 ff 01 00 00 43 00 0b .............C.. 00e0: 00 04 03 00 01 02 00 0a 00 0a 00 08 00 17 00 19 ................ 00f0: 00 18 00 16 00 23 00 00 00 0d 00 20 00 1e 06 01 .....#..... .... 0100: 06 02 06 03 05 01 05 02 05 03 04 01 04 02 04 03 ................ 0110: 03 01 03 02 03 03 02 01 02 02 02 03 00 0f 00 01 ................ 0120: 01 . TLS trace: SSL_connect:SSLv2/v3 write client hello A tls_read: want=7, got=0 TLS: can't connect: . ldap_err2string ldap_start_tls: Can't contact LDAP server (-1) ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Additionally: I am reading the FAQ http://www.openldap.org/faq/data/cache/185.html to generate the certs but am wondering if I am correctly understanding the instruction "Remember that the Common Name for this cert should be the fully qualified domain name of the server:" If I run my ldap server as: /usr/local/libexec/slapd -F /usr/local/etc/openldap/slapd.d -h 'ldaps://127.0.0.1:636 ldap://127.0.0.1:389' -d -1 Then would the 'common name' for use in the certificate be: cn=localhost:636 Any assistance is greatly appreciated. Thanks! Ken Dunne

4 5

RE: mdb_stat() crashes under DB_STALE
by Peter Zhu (pezhu) 02 Jan '20

02 Jan '20

Hi, Quanah Thanks for your info. I am forwarding my info to the mailing-list. Cheers, Peter From: Quanah Gibson-Mount <quanah.gibsonmount(a)gmail.com> Sent: Thursday, January 2, 2020 12:18 PM To: Peter Zhu (pezhu) <pezhu(a)cisco.com> Subject: Re: mdb_stat() crashes under DB_STALE I would advise you use the correct methods for asking for assistance. I would start with the openldap-technical mailing list (https://www.openldap.org/lists/) Regards, Quanah On Mon, Dec 23, 2019 at 3:18 PM Peter Zhu (pezhu) <pezhu(a)cisco.com<mailto:pezhu@cisco.com>> wrote: Hi, Folks I am using LMDB 9.24, and have experienced the following crashes: warning: Unable to find libthread_db matching inferior's thread library, thread debugging will not be available. Core was generated by `/ngfw/usr/local/sf/bin/sfhassd -c /etc/sf/sfhassd.conf'. Program terminated with signal SIGSEGV, Segmentation fault. #0 mdb_node_search (mc=mc@entry=0x2b794dbf7320, key=0x560ed4785f30, exactp=exactp@entry=0x2b794dbf730c) at mdb.c:5322 5322 mdb.c: No such file or directory. [Current thread is 1 (LWP 12824)] (gdb) (gdb) bt #0 mdb_node_search (mc=mc@entry=0x2b794dbf7320, key=0x560ed4785f30, exactp=exactp@entry=0x2b794dbf730c) at mdb.c:5322 #1 0x00002b792c57c79f in mdb_page_search (mc=0x2b794dbf74e0, key=key@entry=0x0, flags=flags@entry=2) at mdb.c:5617 #2 0x00002b792c57c960 in mdb_cursor_init (mc=mc@entry=0x2b794dbf74e0, txn=txn@entry=0x2b79600332c0, dbi=dbi@entry=5, mx=mx@entry=0x2b794dbf7670) at mdb.c:7623 #3 0x00002b792c58713d in mdb_stat (txn=0x2b79600332c0, dbi=5, arg=0x2b794dbf7a10) at mdb.c:9856 #4 0x00002b792c798c17 in LMDBCache::GetMstByType (this=0x560ed4782fb0, type=SSL_CACHE_ORIG_CERT, mst=0x2b794dbf7a10, idx=CACHE_TABLE_FIFO) at lmdbCache.cpp:1408 #5 0x00002b792c7946df in LMDBCache::InsertKeyValuePair (this=0x560ed4782fb0, type=SSL_CACHE_ORIG_CERT, key=0x2b794dbf7b60, data=0x2b794dbf7d00, idx=CACHE_TABLE_FIFO, asyncWrite=0) at lmdbCache.cpp:820 #6 0x00002b792c795aae in LMDBCache::InsertFiFoKeyValue (this=0x560ed4782fb0, type=SSL_CACHE_ORIG_CERT, appKey=0x2b794dbf7d00) at lmdbCache.cpp:1007 #7 0x00002b792c795143 in LMDBCache::InsertKeyValuePair (this=0x560ed4782fb0, type=SSL_CACHE_ORIG_CERT, key=0x2b794dbf7d00, data=0x2b794dbf7cf0) at lmdbCache.cpp:907 #8 0x00002b792c7957c4 in LMDBCache::InsertKeyValuePair (this=0x560ed4782fb0, type=SSL_CACHE_ORIG_CERT, key_=0x2b7960033abe "37364826527", value=0x2b7960033ada "moredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredead"...) at lmdbCache.cpp:953 #9 0x00002b792c79a228 in lmdb_insert_to_cache (type=3, key=0x2b7960033abe "37364826527", value=0x2b7960033ada "moredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredeadbeefmoremoredead"...) at lmdbCacheCWrapper.cpp:38 #10 0x0000560ed2c37155 in LocalInputThread (thread_handle=thread_handle@entry=0x2b79600008c0, arg=arg@entry=0x2b7950000b40) at local.c:473 #11 0x0000560ed2c38aa2 in _threadlist_create_stub (arg=0x2b794d3f3cc0) at ThreadList.c:174 #12 0x00002b792b8243d4 in ?? () from /lib64/libpthread.so.0 #13 0x00002b792ca8791d in clone () from /lib64/libc.so.6 Can you folks let me know if you can help. Or please forward my email to Howard Chu. Thanks and have Happy Holidays. Peter

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical January 2020