openldap-technical December 2021

openldap-technical@openldap.org

21 participants
32 discussions

deltasync replication with 2.6 not working
by Stefan Kania 10 Dec '21

10 Dec '21

Hi to all, I still experimenting with openldap 2.6 and the deltasyncrepl with four hosts. I use debian 11 and the symas packages. I set up all four hosts with the following ldif-files. Starting with the basic settings: --------------------------------------- dn: cn=config objectClass: olcGlobal cn: config olcLogLevel: sync olcLogLevel: stats olcPidFile: /var/symas/run/slapd.pid olcArgsFile: /var/symas/run/slapd.args olcToolThreads: 1 # create cn=config #dn: olcBackend={0}mdb,cn=config #objectClass: olcBackendConfig #olcBackend: {0}mdb dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /opt/symas/lib/openldap olcModuleLoad: back_mdb olcModuleLoad: back_monitor olcModuleLoad: autoca.la olcModuleLoad: otp.la olcModuleLoad: argon2.la olcModuleLoad: syncprov olcModuleLoad: back_monitor olcModuleLoad: accesslog.la include: file:///opt/symas/etc/openldap/schema/core.ldif include: file:///opt/symas/etc/openldap/schema/cosine.ldif include: file:///opt/symas/etc/openldap/schema/nis.ldif include: file:///opt/symas/etc/openldap/schema/inetorgperson.ldif include: file:///opt/symas/etc/openldap/schema/dyngroup.ldif include: file:///opt/symas/etc/openldap/schema/kerberos.openldap.ldif dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcSizeLimit: 500 olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth manage by * break olcAccess: {1}to dn="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcPasswordHash: {ARGON2} dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4 olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth manage by dn.exact=uid=ldap-admin,ou=users,dc=example,dc=net write by * break dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to dn.subtree="cn=monitor" by dn.exact=cn=admin,cn=config read by dn.exact=cn=admin,dc=example,dc=net read dn: olcDatabase={2}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcmdbConfig olcDatabase: {2}mdb olcSuffix: dc=example,dc=net olcRootDN: cn=admin,dc=example,dc=net olcRootPW: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4 olcSizeLimit: unlimited olcTimeLimit: unlimited olcDbCheckpoint: 512 30 olcDbDirectory: /var/symas/openldap-data olcDbIndex: default eq olcDbIndex: objectClass olcDbIndex: entryUUID olcDbIndex: entryCSN olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: mail pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbIndex: description pres,eq,sub olcDbIndex: title pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbMaxSize: 85899345920 olcAccess: {0} to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth manage by dn.exact=uid=ldap-admin,ou=users,dc=example,dc=net write by dn.exact=uid=repl-user,ou=users,dc=example,dc=net read by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcAccess: {3} to attrs=userPassword by anonymous auth by self write by * none olcLimits: {0} dn.exact="uid=repl-user,ou=users,dc=example,dc=net" time=unlimited size=unlimited olcLimits: {1} dn.exact="uid=ldap-admin,ou=users,dc=example,dc=net" time=unlimited size=unlimited --------------------------------------- After all four host have the same basic settings I change the "serverId" with the following LDIF-File. My problem is the same, even when I put the serverIds into the basic setup. The reason why I split the serverId from the basic settings is because I use Ansible to configure all hosts. ------------------------- dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://ldap01.example.net olcServerID: 2 ldap://ldap02.example.net olcServerID: 3 ldap://ldap03.example.net olcServerID: 4 ldap://ldap04.example.net ------------------------- The next step is setting up the deltasync replication with the following LDIf-file: ------------------------- dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 dn: olcDatabase={3}mdb,cn=config changetype: add objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {3}mdb olcDbDirectory: /var/symas/accesslog olcSuffix: cn=accesslog olcAccess: {0}to dn.subtree="cn=accesslog" by dn.exact="uid=repl-user,ou=users,dc={first_dc}},dc=net" read by dn.exact="cn=admin,dc=example,dc=net" read olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcLimits: dn.exact="cn=uid=repl-user,dc=example,dc=net" time=unlimited size=unlimited olcSizeLimit: unlimited olcTimeLimit: unlimited olcMonitoring: TRUE olcDbCheckpoint: 0 0 olcDbIndex: entryCSN eq olcDbIndex: objectClass eq olcDbIndex: reqEnd eq olcDbIndex: reqResult eq olcDbIndex: reqStart eq olcDbIndex: reqDN eq olcDbMode: 0600 olcDbSearchStack: 16 olcDbMaxsize: 85899345920 dn: olcOverlay=syncprov,olcDatabase={3}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE dn: olcOverlay={0}syncprov,olcDatabase={2}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 10 olcSpSessionlog: 200 dn: olcOverlay={1}accesslog,olcDatabase={2}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogSuccess: TRUE olcAccessLogPurge: 01+00:00 00+04:00 dn: olcDatabase={2}mdb,cn=config changetype: modify replace: olcSyncrepl olcSyncrepl: rid=102 provider=ldap://ldap02.example.net bindmethod=simple timeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net credentials=secret filter="(objectclass=*)" searchbase="dc=example,dc=net" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog scope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=accesslog keepalive=240:10:30 starttls=yes olcSyncrepl: rid=103 provider=ldap://ldap03.example.net bindmethod=simple timeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net credentials=secret filter="(objectclass=*)" searchbase="dc=example,dc=net" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog scope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=accesslog keepalive=240:10:30 starttls=yes olcSyncrepl: rid=104 provider=ldap://ldap04.example.net bindmethod=simple timeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net credentials=secret filter="(objectclass=*)" searchbase="dc=example,dc=net" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog scope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=accesslog keepalive=240:10:30 starttls=yes - replace: olcMirrorMode olcMirrorMode: TRUE ------------------------- The olcSyncrepl is different on each host this one is from ldap01.example.net so the host is not in the list. On each other host everything is setup the same. When in Start slapd I always getting this error messsages (on server ldap1: --------------------- ez 09 15:20:56 ldap01 slapd[2406]: conn=1035 fd=18 ACCEPT from IP=192.168.56.48:56760 (IP=0.0.0.0:389) Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=0 STARTTLS Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=0 RESULT oid= err=0 qtime=0.000024 etime=0.000299 text= Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 fd=18 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.3 tls_cipher=TLS_AES_256_GCM_SHA384 Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=1 BIND dn="uid=repl-user,ou=users,dc=example,dc=net" method=128 Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=1 BIND dn="uid=repl-user,ou=users,dc=example,dc=net" mech=SIMPLE bind_ssf=0 ssf=256 Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=1 RESULT tag=97 err=0 qtime=0.000033 etime=0.026849 text= Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(&(objectClass=auditWriteObject)(reqResult=0))" Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior reqControls entryCSN Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=2 syncprov_op_search: got a persistent search with a cookie=rid=101,sid=004,csn=20211208190517.239632Z#000000#001#000000 Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=2 syncprov_findbase: searching Dez 09 15:20:56 ldap01 slapd[2406]: findbase failed! 32 Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=2 SEARCH RESULT tag=101 err=32 qtime=0.000019 etime=0.000166 nentries=0 text= Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 op=3 UNBIND Dez 09 15:20:56 ldap01 slapd[2406]: conn=1035 fd=18 closed --------------------- The rid 101 is NOT configured on this host, because it's ldap01 The same configuration is working on a Debian 10 with the openldpa-packages from debian. One more thing on debian 10 I see_ ---------------------- root@hm-01:~# ss -a | grep ldap | awk '{print$1 " " $2 " " $5 " " $6}' u_str LISTEN /var/run/slapd/ldapi 13381 tcp LISTEN 0.0.0.0:ldaps 0.0.0.0:* tcp LISTEN 0.0.0.0:ldap 0.0.0.0:* tcp ESTAB 192.168.56.41:ldap 192.168.56.44:35400 tcp ESTAB 192.168.56.41:ldap 192.168.56.42:57096 tcp ESTAB 192.168.56.41:ldap 192.168.56.43:54992 tcp ESTAB 192.168.56.41:33408 192.168.56.42:ldap tcp ESTAB 192.168.56.41:50268 192.168.56.43:ldap tcp LISTEN [::]:ldaps [::]:* tcp LISTEN [::]:ldap [::]:* ---------------------- What i expected because of "refreshAndPersist" on the Debian 11 host with the symas packages I see: --------------------- root@ldap01:~# ss -a | grep ldap | awk '{print$1 " " $2 " " $5 " " $6}' u_str LISTEN /var/symas/run/ldapi 14159 tcp LISTEN 0.0.0.0:ldaps 0.0.0.0:* tcp LISTEN 0.0.0.0:ldap 0.0.0.0:* tcp LISTEN [::]:ldaps [::]:* tcp LISTEN [::]:ldap [::]:* --------------------- So there is no permanent connection, that also shows the log. Error 32 means "no such object" but which object is missing. The accesslog DB files are there. The slapd is NOT running as rootI change all the permissions and settings to run slapd as unprivileged user. I'm lost :-) Stefan

2 2

RE: [EXT]:Re: OpenLDAP SSLV3 disable
by Quanah Gibson-Mount 09 Dec '21

09 Dec '21

--On Tuesday, December 7, 2021 10:00 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > HI Quanah/Geert, > > Hope this email finds you well !!! > > Continues to the below email with Gnutls I am facing an issue with sync > between master/slave with mirror mode on. As per the earlier suggestion, > I am trying to re-compile OpenLDAP with Openssl on the Redhat server. > It's failing to find OpenSSL libraries though I defined explicitly in the > user profile but still not helping. > > Any idea how I can point to the OpenSSL libraries? > > > ./configure --prefix=/opt/dirsvcs --with-tls=openssl > > configure: error: Could not locate TLS/SSL package Check the output in the config.log file as to why it had the error. Generally, I'd guess because you didn't set the CPPFLAGS and thus it couldn't find the header files. Alternatively, you could simply deploy the builds from Symas, which link to OpenSSL already and skip building OpenLDAP yourself. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Antw: [EXT] mmr of cn=config with OpenLDAP 2.6
by Stefan Kania 09 Dec '21

09 Dec '21

Am 09.12.21 um 08:12 schrieb Ulrich Windl: >>>> Stefan Kania <stefan(a)kania-online.de> schrieb am 07.12.2021 um 16:52 in > Nachricht <37d8d0c0-fd4a-885d-7a8c-3874412eaa06(a)kania-online.de>: > > ... >> What I don't understand: Do I realy have to put all Servers in the >> replication, even the server it self? So do I realy have to add on >> Server-01, the Server "server-01, server-02, server-03 ,server-04" to >> the replication? Dosn't it mean that server-01 is replicating to it >> self? If it's correct, can someone explain why? O did I understud >> something wrong on the webpage? > > Ebery change has a "change ID" (entryCSN): If a server receives an update having the same change ID that is already present, the update will be ignored, and maybe more importantly it won't propagate that update any further. That's how I understand it. So it does not harm. > Ok, that makes sense, but why only for the replication of cn=config. If you set up a mmr for the main DB you don't put only the other server into the Replication. If you have ldap1 ldap2 ldap3 lda4, on ldap1 you only have ldap2 ldap3 and ldap4 in the configuration. That's what I like to understand :-) >> >> Stefan > > > >

1 0

Re: Antw: [EXT] OpenLDAP Upgrade
by Ulrich Windl 08 Dec '21

08 Dec '21

>>> <santoshk.sethi(a)tcs.com> schrieb am 07.12.2021 um 10:57 in Nachricht <20211207095727.5262.37798(a)hypatia.openldap.org>: > Thanks Emmanuel, > Is it a stable version we can reply upon? Because the request is for a > production environment which are running critical business applications > > As part the OS upgrade (6.4 to 7.9), the default OpenLDAP comes in RHEL7.9 > is openldap-servers-2.4.44-24.el7_9. > > This is a existing setup in production. We just want to upgrade it (rpm > -Uvh) :) on the exisitng RPMs. Actually when you'd update you'd use "rpm -vF ..." I guess ;-) But I'm unsure whether that will work "cross-vendor"; maybe check the file lists (rpm -qvlp ...) and compare with existng paths, also. The best would probably be to have a snapshot-type backup (like for a VM shutting down, making a volume snapshot, then boot and trxy the update) > > #rpm -qa | grep -i openldap > openldap-2.4.23-31.el6.x86_64 > compat-openldap-2.3.43-2.el6.x86_64 > openldap-devel-2.4.23-31.el6.x86_64 > openldap-servers-2.4.23-31.el6.x86_64 > openldap-clients-2.4.23-31.el6.x86_64 > > > Thanks > Santosh

1 0

2.6 slapadd bug? - SHA512 userPassword hash get 2 characters appended to the end at import
by Dave Macias 06 Dec '21

06 Dec '21

Hello, Playing with 2.6 on rhel8 When imported my data.ldif I noticed i no longer could bind and my credentials would fail. Thought it was simply my account and tried with other test accounts and failed too. When i compare the userPassword attributes from the source to my 2.6 environment, i see there are two extra characters at the end. So original looks like: (and whats in data.ldif file) userPassword:: e2Nblablasuperdupper512hashthatendshere vs the one in 2.6 userPassword:: e2Nblablasuperdupper512hashthatendshereXX This happens on all the userPassword attributes that are SHA512. The XX characters seem random, no pattern to it. In other words each userPassword attribute has its own XX characters. Interesting, i dont see this issue with accounts that still have SHA1 hash. They are identical. I dont recall if i saw this on 2.5 but I’ll update on that. Thank you, Dave

3 6

2.6 rhel8 rpm pkg - lastbind module issue
by Dave Macias 03 Dec '21

03 Dec '21

Hello, Playing around with 2.6 Was attempting to add lastbind module but get error: cat <<EOF | ldapadd -D cn=config -w mysecret dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /opt/symas/lib/openldap/ olcModuleLoad: lastbind.la EOF adding new entry "cn=module,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: <olcModuleLoad> handler exited with 1 I have no issues doing the above with 2.5 rpm rhel8 pkg. Is there something im doing wrong? Any input is appreciated. Thank you, Dave

4 10

Q: Detect "user on grace logins" (ppolicy being used)?
by Ulrich Windl 02 Dec '21

02 Dec '21

Hi! I have a question: When using ppolicy, is tthere a simple way for a user to detect that he/she is "on grace logins", i.e. the poassword has to be changed soon? We had a situation where some monitoring tools uses periodic logins to sume user account. When that user should have changed the password, the periodic logins consumed all the grace logins, and the user was effectively locked out. While there are many ways to resolve this, I wonder whether it would be rather easy to avoid any further login attempts when the user is expected to change the password. Regards, Ulrich

2 1

Concurrent/simultaneous write access
by Jäckel, Carsten 02 Dec '21

02 Dec '21

Hello, during internal discussions, we came up with the question of how OpenLDAP deals with concurrent, competing write accesses to an LDAP object. The background to the question is that we use two applications that want to write attributes on the same user object in the DIT and maybe this could happen at the same time. Does anyone know how the OpenLDAP deals with such a situation? We would like to ask the following questions in detail: - Does the OpenLDAP lock the entire object for write access or only the attributes that are currently being changed? - Is there a kind of queue for write operations in which the competing write accesses are stored? If so, what criteria are used to determine which write operation has priority? - Are there scenarios caused by concurrent, simultaneous write access to objects / object attributes that lead to a crash of the openLDAP? - How can we best simulate simultaneous write access to an object in the DIT from different systems? - Are there different behaviors dealing with concurrent write-access when using different openLDAP versions? Kind regards, Carsten

2 1

force resync of slave
by Enrico Weigelt, metux IT consult 02 Dec '21

02 Dec '21

Hello friends, I've encountered my slaves (Zimbra cluster) aren't fully in sync with master. Some entries are missing attributes. Maybe it's a fallout from previous errors in my MMR setup (several minutes clocks difference, so one master couldn't sync to another). * modifying an affected entry doesn't fix it, just changes the actually changed attributes (delta-sync ?) * starting the slave w/ -c 'rid=100,csn=0' showed lots of corresponding log traffic (on first start), but still tells the entries were equal, doesn't fix the entries * problem: I don't know which entries are affect, just found a few of them Can anyone give me a hint on how to do a full resync ? thx --mtx -- --- Hinweis: unverschlüsselte E-Mails können leicht abgehört und manipuliert werden ! Für eine vertrauliche Kommunikation senden Sie bitte ihren GPG/PGP-Schlüssel zu. --- Enrico Weigelt, metux IT consult Free software and Linux embedded engineering info(a)metux.net -- +49-151-27565287

2 1

Move from memberof to dynlist
by Magnus Morén 01 Dec '21

01 Dec '21

I am trying to move from memberof(overlay) to dynlist but can't get it to work. I have static groups with uniqueMembers cn=somegroup,ou=group,dc=domain,dc=net uniqueMember: uid=user1,ou=people,dc=domain,dc=net uniqueMember: uid=user2,ou=people,dc=domain,dc=net ... I want to have: memberOf: cn=somegroup,ou=group,dc=domain,dc=net on all users who is member of any group. In my test i use cn=config style and OpenLDAP 2.6.0 from Symas In my old ldap server (slapd.conf based) i have overlay memberof memberof-group-oc groupOfUniqueNames memberof-member-ad uniqueMember memberof-refint true I have tried this from man slapo-dynlist but I must have done something wrong or not understand how it is supposed to work. This example extends the dynamic memberOf feature to add the memberOf attribute to all the members of both static and dynamic groups: include /path/to/dyngroup.schema # ... database <database> # ... overlay dynlist dynlist-attrset groupOfURLs memberURL member+memberOf@groupOfNames This dynamic memberOf feature can fully replace the functionality of the slapo-memberof(5) overlay.

3 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical December 2021