openldap-technical January 2025

openldap-technical@openldap.org

24 participants
24 discussions

07 Jan '25

Hello Everyone, Hope you are enjoying the day. Was curious what people are doing to monitor their MMR clusters being out of sync. At least the implementation we found and have been trying is using telegraf and the [ldap_org](https://github.com/falon/CSI-telegraf-plugins/blob/master/plugins… plugin to gather all objects on each ldap master and compare their count. How is the community doing it? Any better way to go about this? Any input is appreciated! Best, Dave

6 7

Re: consumer replication not recovering
by Suresh Veliveli 06 Jan '25

06 Jan '25

We did an upgrade from 2.6.3 to 2.6.7 at the same time, changing the backend db to "mdb". I think that's when we started to notice that consumer replication is not recovering. So we upgraded again to 2.6.8 to now 2.6.9. Thanks, Suresh On Fri, Jan 3, 2025 at 2:19 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, January 3, 2025 7:52 AM -0500 Suresh Veliveli > <Suresh.Veliveli(a)georgetown.edu> wrote: > > > > > > > The OS is Rock9, AWS EC2 instance. > > Question - Was this working on an earlier OpenLDAP version, and just > started having issues with 2.6.9? I was re-reading your initial post and > that wasn't clear. > > Thanks! > > --Quanah > > -- Suresh Veliveli Sr. UNIX Systems Engineer Georgetown University University Information Services | Security Infrastructure and Policy-Identity and Collaboration 202-262-6676 (cell) | 202-687-3108 (work)

2 2

Re: Replication issues with openldap 2.5
by Ulises Gonzalez Horta 03 Jan '25

03 Jan '25

Thanks for replying, from what I see in your answer, I have already distracted a and b, I can say c is also ruled out but I would like to double check it, maybe acls are not processing in the expected order. What is the best way to troubleshoot acls?? Any recommended log level? Ulises Gonzalez Horta Lead Linux Engineer C: 786 450 2970/ 240 727 6267 E: ugonzalezhorta(a)breezeline.com <jsutherland1(a)breezeline.com> On Fri, Dec 27, 2024 at 2:09 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, December 27, 2024 10:34 AM -0500 Ulises Gonzalez Horta > <ugonzalezhorta(a)breezeline.com> wrote: > > > > > > > Good morning > > > > I am trying to setup a replication in ldap 2.5, using syncrepl, I have a > > provider server and a consumer, both of the servers are running 2.5.11 > > from Ubuntu 22.04, I followed the admin guide chapter 18.3.1 to do the > > configuration. I have some information on the provider that is > > successfully being replicated to the consumer without any errors > > > > > > Consumer configuration > > ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config olcSyncRepl > > olcUpdateref > > dn: olcDatabase={1}mdb,cn=config > > olcSyncrepl: {0}rid=100 provider=ldap://provider:389 type=refr > > eshOnly interval=00:00:05:00 retry="300 +" > > searchbase="dc=metrocast,dc=net" f > > ilter="(|(entryDN:=dc=metrocast,dc=net)(entryDN:dnOneLevelMatch:=dc=met > > > Why do you have such a complicated filter? > > > > > On the consumer this same query returns error 49 > > > > ldapsearch -Z -LLL -H ldap://providert:389 -D > > "uid=user1,ou=employees,dc=metrocast,dc=net" -W -b > > "ou=employees,dc=metrocast,dc=net" "(mail=*pepe(a)breezeline.com) > > Either: > > a) The user entry doesn't exist > b) The user entry is missing the userPassword attribute > c) The ACLs don't allow anonymous "auth" access on the userPassword > attribute > > --Quanah > > >

5 11

Hello, I have an issue with the configuration of pam_setquota.so. I added the following quota schema:
by Rodrigo Prieto 03 Jan '25

03 Jan '25

# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 8fd665e7 dn: cn=quota,cn=schema,cn=config objectClass: olcSchemaConfig cn: quota olcAttributeTypes: {0}( 1.3.6.1.4.1.19937.1.1.1 NAME 'quota' DESC 'Quotas (FileSystem:BlocksSoft,BlocksHard,InodesSoft,InodesHard)' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{255} ) olcObjectClasses: {0}( 1.3.6.1.4.1.19937.1.2.1 NAME 'systemQuotas' DESC 'System Quotas' SUP posixAccount AUXILIARY MUST uid MAY quota ) I create a user, and the attributes are created correctly: objectclass: systemQuotas objectclass: posixAccount objectclass: inetOrgPerson objectclass: organizationalPerson objectclass: person quota: /home,500,510,0,0 Configuration of /etc/pam.d/common-session: # here are the per-package modules (the "Primary" block) session [default=1] pam_permit.so # here's the fallback if no module succeeds session requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around session required pam_permit.so # and here are more per-package modules (the "Additional" block) session required pam_unix.so session [success=ok default=ignore] pam_ldap.so minimum_uid=1000 session optional pam_systemd.so session optional pam_mkhomedir.so skel=/etc/skel umask=077 session required pam_setquota.so # end of pam-auth-update config When logging in with an LDAP user, the following appears in Debian logs: pam_setquota(login:session): no limits defined in configuration for user zprieto on /dev/vda5. I don’t know what is missing that prevents the user’s attributes from being read. Thank you very much.

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical January 2025