- openldap-technical - openldap.org

MDB_MAP_FULL: Environment mapsize limit reached
by Aleksander Dzierżanowski 26 Mar '14

26 Mar '14

Hello OpenLDAP guru & fans. Recently I was trying to migrate from 'bdb' to 'mdb' backend by adding temporary additional instance of OpenLDAP. Unfortunately I'm unable to import database both using 'slapadd' or regular replication mechanism. What I got is exact same error: slapadd -b o=mysuffix < /tmp/mysuffix.ldif 5332ec95 => mdb_idl_insert_keys: c_put id failed: MDB_MAP_FULL: Environment mapsize limit reached (-30792) 5332ec95 => mdb_tool_entry_put: index_entry_add failed: err=80 5332ec95 => mdb_tool_entry_put: txn_aborted! Internal error (80) slapadd: could not add entry dn="uid=myuser,ou=People,ou=developers,o=suffix" (line=2080): txn_aborted! Internal error (80) _# 9.26% eta none elapsed none spd 2.3 M/s Closing DB... My bdb 'maxsize' argument is set to 1GB. Database is really small, it contain just few hundred of small entries. My OpenLDAP version is 2.4.38 from OpenLTB project (I'm unable to use 2.4.39 because I need to use CentOS 6.4 version, latest one is for 6.5). Changing only backend to 'bdb' in configuration make import succesfull. Any advices? regards, -- Aleksander

1 1

Not adding attributes
by espeake＠oreillyauto.com 26 Mar '14

26 Mar '14

I have just started getting this error in the past 10 days. There has not been any configuration changes that we can find. In googleing this error I am not finding anything that matches it. If I create an ldif file to add these for the user, that works fine. Mar 25 16:42:21 tn-ldap-1 slapd[14976]: conn=33594 op=17: memberof_value_modify DN="uid=dsmith174,ou=users,dc=oreillyauto,dc=com" add locationEntry="ou=Store4351,ou=Locations,dc=oreillyauto,dc=com" failed err=32 Mar 25 16:42:22 tn-ldap-1 slapd[14976]: conn=33594 op=19: memberof_value_modify DN="uid=dsmith174,ou=users,dc=oreillyauto,dc=com" add oreillyGroup="cn=Store Non-Management,ou=Groups,dc=oreillyauto,dc=com" failed err=32 Mar 25 16:42:22 tn-ldap-1 slapd[14976]: conn=33594 op=21: memberof_value_modify DN="uid=dsmith174,ou=users,dc=oreillyauto,dc=com" add oreillyGroup="cn=Store,ou=Groups,dc=oreillyauto,dc=com" failed err=32 What I do wonder about though in my olcDatabase={1}hdb folder I have two memberOf overlays. This is the first one. # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 a078db21 dn: olcOverlay={0}memberof objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {0}memberof olcMemberOfDangling: ignore olcMemberOfRefInt: TRUE olcMemberOfGroupOC: groupOfUniqueNames olcMemberOfMemberAD: uniqueMember olcMemberOfMemberOfAD: oreillyGroup structuralObjectClass: olcMemberOf creatorsName: cn=config entryUUID: 91cea156-9e13-1032-84c3-0151b658a842 createTimestamp: 20130820183919Z entryCSN: 20130820183919.833799Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20130820183919Z This is the second one. # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 fe8a4925 dn: olcOverlay={1}memberof objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {1}memberof olcMemberOfDangling: ignore olcMemberOfRefInt: TRUE olcMemberOfGroupOC: oreillyOrgUnit olcMemberOfMemberAD: uniqueMember olcMemberOfMemberOfAD: locationEntry structuralObjectClass: olcMemberOf creatorsName: cn=config entryUUID: 91ceb650-9e13-1032-84c4-0151b658a842 createTimestamp: 20130820183919Z entryCSN: 20130820183919.834337Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20130820183919Z I have am looking through the application to see if something could have changed in the way it is presenting the data. I haven't found anything yet. Am I correct in that an error 32 means that it couldn't find the uid to add the group to? Thanks, Eric Speake Web Systems Administrator O'Reilly Auto Parts (417) 862-2674 Ext. 1975 This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 2

question about openldap restore with command sldapadd
by xiaoming zhao 26 Mar '14

26 Mar '14

All, I got one question, when doing openldap restore, in our script, we tried to remove the openldap/data directory, then restore the backup openldap files. but since we have other data added in openldap database after backup. then if we doing backup, it will remove the data newly added after backup. I tried to sldapadd with "-c" option, but the sldapadd command retrun value is 1. so we can't know if this is a error because of existing entry or some other error. Do you have any idea how to handle this case? ignore the existing entry when doing sldapadd. Thanks, Eric.

2 6

unsubscribe
by Alex Samad - Yieldbroker 26 Mar '14

26 Mar '14

1 0

Denying access to syncrepl consumere during initial DIT content load
by Christian Kratzer 24 Mar '14

24 Mar '14

Hi, I remember a discussion some time ago about the possibility of delaying access to a syncrepl. consumer during the intial DIT load. I have setup my servers to authenticate replication via sasl method external and the servers respective certificates which is nice. I have also setup limits and acl to the DIT as using a groupOfNames: olcLimits: group/groupOfNames/member="cn=replicators,ou=serviceaccounts,dc=cksoft,dc=net" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited olcAccess: to * by group/groupOfNames/member="cn=replicators,ou=serviceaccounts,dc=cksoft,dc=net" read This is all nice and shiny and I like having my ldap consumers configured without cleartext credentials (apart from the cert private key of course) ;) The fun starts when I delete the DIT from multiple consumers and allow them to resync from masters. If they also resync from each other they could possibly authenticate using sasl external but they would not be allowed access to all of the DIT, all of the attributes or be unlimited using olcLimits as the group might not yet have been replicated. I also had major fun just reseeding a single server out of a set of 4 causing data loss on the servers that connected to the not yet full synced up server. This is another situation in which it would be nice to be able to disallow any ldap connections to a consumere while it is in the initial sync phase. I seem to recall there was discussion in possibly addiing such a feature but my google foo is lacking and I cannot find the discussion. In case there is not yet such a feauture I am considering firewalling access to slapd during the initial sync phase. Is there any ldap way of reliably detecting that initial sync has completed apart from tailing syslog and looking for csn commit messages ... Greetings Christian -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Mobile: +49 171 1947 843 Geschaeftsfuehrer: Christian Kratzer Web: http://www.cksoft.de/

7 21

RE: Slave not able to update master pwdFailureTime via chain.
by Brad dameron 24 Mar '14

24 Mar '14

>From what I read I need to setup authzTo. But having problems understanding what I need to set in the slaps.conf and on the allowed user. -------- Original message -------- From: Esteban Pereira <esteban.pereira(a)gepsit.fr> Date:03/20/2014 10:55 AM (GMT-08:00) To: Brad dameron <serpent6877(a)hotmail.com>,openldap-technical(a)openldap.org Subject: Re: Slave not able to update master pwdFailureTime via chain. I've never configured this kind of architecture, but as far as I know the ppolicy, I think my first thought configuring this would have been to not rebind as user because the attribute modified is an operational one which need the manage right (not sure about that) So I should have configured this with the replication user with manage right and without rebinding as a user when chaining to the master. Hope this help On Thu, Mar 20, 2014 at 6:14 PM, Brad dameron <serpent6877(a)hotmail.com>wrote: > I understand what you are saying. But this is what the > ppolicy_forward_updates says: > > ppolicy_forward_updates > Specify that policy state changes that result from Bind operations (such as recording > failures, lockout, etc.) on a consumer should be forwarded to a master instead of > being written directly into the consumer’s local database. This setting is only use‐ > ful on a replication consumer, and also requires the updateref setting and chain > overlay to be appropriately configured. > > So when a password failure occurs "pwdFailureTime" it relays it to the master as the user doing a MOD > from what I have seen in my logs. And thus the user doesn't have access to modify this attribute. > > Brad > > > > ------------------------------ > Date: Thu, 20 Mar 2014 12:13:02 +0100 > Subject: Re: Slave not able to update master pwdFailureTime via chain. > From: esteban.pereira(a)gepsit.fr > To: serpent6877(a)hotmail.com > CC: openldap-technical(a)openldap.org > > > Hi Brad, > > pwdFailureTime is an operational attribute, I don't think any user can > modify it on any instance. May be you should try to modify it on the master > to see if it comes from this assumption. > > Esteban > > > On Thu, Mar 20, 2014 at 11:33 AM, Brad dameron <serpent6877(a)hotmail.com>wrote: > > OpenLDAP 2.4.23-26 on CentOS 5. I am trying to get the pwdFailureTime > updated on the master when the slave recieves a password failure. Here is > my config. It's pretty simple and basic. No TLS. > > Master: > > access to attrs=userPassword > by group.exact="cn=ldapadmins,ou=Groups,dc=test,dc=net" write > by dn.exact="cn=replication,dc=test,dc=net" read > by self write > by anonymous auth > by * none > access to * > by group.exact="cn=ldapadmins,ou=Groups,dc=test,dc=net" write > by dn.exact="cn=replication,dc=test,dc=net" write > by self write > by users read > by anonymous read > by * none > > > > Slave: > > overlay chain > chain-uri ldap://172.16.0.84:389 > chain-rebind-as-user TRUE > chain-idassert-bind bindmethod=simple > binddn="cn=replication,dc=test,dc=net" > credentials="MyPasswd" > mode="self" > chain-return-error TRUE > > # Password Policy > overlay ppolicy > ppolicy_default "cn=default,ou=Policies,dc=test,dc=net > ppolicy_use_lockout > ppolicy_forward_updates > > > # Slave Replication > syncrepl rid=101 > provider=ldap://172.16.0.84:389 > type=refreshAndPersist > interval=00:00:01:00 > retry="60 10 300 +" > searchbase="dc=test,dc=net" > schemachecking=off > bindmethod=simple > binddn="cn=replication,dc=test,dc=net" > credentials="MyPasswd" > updateref "ldap://172.16.0.84:389" > > > > I see the connection on the master but it gives a permission error: > > > Mar 20 09:47:46 LDAP-RADIUS-1 slapd[14288]: conn=1124 op=3 MOD > dn="cn=testuser,ou=People,dc=test,dc=net" > Mar 20 09:47:46 LDAP-RADIUS-1 slapd[14288]: conn=1124 op=3 MOD > attr=pwdFailureTime > Mar 20 09:47:46 LDAP-RADIUS-1 slapd[14288]: conn=1124 op=3 RESULT tag=103 > err=50 text= > > > I read that you maybe need authzTo added to the binddn for the chain? Or > is this only for TLS? > > I tried adding this ldif: > > dn: cn=replication,dc=test,dc=net > changetype: modify > add: authzTo > authzTo: * > > And even set the: > > chain-idassert-authzFrom "*" > > in the chain. But it always gives me the error code 50 not enough > permissions. I believe it is supposed to give access to the user to MOD the > pwdFailureTime tribute knowing it is coming from a relay. But I can't find > very specific docs on this or see what is wrong. Any help apreciated. > > Thanks, > Brad > > >

1 0

Build mdb tools
by "POISSON Frédéric" 21 Mar '14

21 Mar '14

Hello, I'm trying to build mdb tools (mdb_stat and mdb_copy inside libraries/liblmdb directory) on a Solaris 10 SPARC operating system with OpenLDAP 2.4.39. Is there some requirements for building the tools on this OS because i have a error during build ? Here is my result (while i do not set any specific gcc flags) : # make ... gcc -pthreads -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast mdb_stat.o liblmdb.a -o mdb_stat Undefined first referenced symbol in file fdatasync liblmdb.a(mdb.o) ld: fatal: Symbol referencing errors. No output written to mdb_stat collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `mdb_stat' # Notice that i use a gcc 3.4.3 and gcc option "-pthread" do not exist for this gcc release, i had to replace it by "-pthreads". I try to read mdb.c for any specific options but i don't find anything... Notice also that i succeed to build OpenLDAP 2.4.39 with my Solaris 10 environment. Thanks, -- Frederic Poisson

5 5

Re : Re: Build mdb tools
by "POISSON Frédéric" 21 Mar '14

21 Mar '14

Hello, Thanks for the answer, i build it without errors. I have patched the Makefile by for my Solaris 10 with gcc 3.4.3 : - replacing "-pthread" by "-pthreads", - add "-lrt" to OPT parameter. Regards, Le 20/03/14, Howard Chu <hyc(a)symas.com> a écrit : > "POISSON Frédéric" wrote: > >Hello, > > > >I'm trying to build mdb tools (mdb_stat and mdb_copy inside libraries/liblmdb > >directory) on a Solaris 10 SPARC operating system with OpenLDAP 2.4.39. > > > >Is there some requirements for building the tools on this OS because i have a > >error during build ? > > > >Here is my result (while i do not set any specific gcc flags) : > ># make > >... > >gcc -pthreads -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast > >mdb_stat.o liblmdb.a -o mdb_stat > >Undefined first referenced > > symbol in file > >fdatasync liblmdb.a(mdb.o) > >ld: fatal: Symbol referencing errors. No output written to mdb_stat > >collect2: ld returned 1 exit status > >*** Error code 1 > >make: Fatal error: Command failed for target `mdb_stat' > ># > > Read the Solaris manpage for fdatasync. > > The requirement for building on any given OS is that you know your own OS. > > >Notice that i use a gcc 3.4.3 and gcc option "-pthread" do not exist for this > >gcc release, i had to replace it by "-pthreads". I try to read mdb.c for any > >specific options but i don't find anything... > > > >Notice also that i succeed to build OpenLDAP 2.4.39 with my Solaris 10 > >environment. > > > >Thanks, > >-- > > > >*Frederic Poisson* > > > > > > > > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ > > > -- Frederic Poisson

1 0

Re: Slave not able to update master pwdFailureTime via chain.
by Esteban Pereira 20 Mar '14

20 Mar '14

I've never configured this kind of architecture, but as far as I know the ppolicy, I think my first thought configuring this would have been to not rebind as user because the attribute modified is an operational one which need the manage right (not sure about that) So I should have configured this with the replication user with manage right and without rebinding as a user when chaining to the master. Hope this help On Thu, Mar 20, 2014 at 6:14 PM, Brad dameron <serpent6877(a)hotmail.com>wrote: > I understand what you are saying. But this is what the > ppolicy_forward_updates says: > > ppolicy_forward_updates > Specify that policy state changes that result from Bind operations (such as recording > failures, lockout, etc.) on a consumer should be forwarded to a master instead of > being written directly into the consumer’s local database. This setting is only use‐ > ful on a replication consumer, and also requires the updateref setting and chain > overlay to be appropriately configured. > > So when a password failure occurs "pwdFailureTime" it relays it to the master as the user doing a MOD > from what I have seen in my logs. And thus the user doesn't have access to modify this attribute. > > Brad > > > > ------------------------------ > Date: Thu, 20 Mar 2014 12:13:02 +0100 > Subject: Re: Slave not able to update master pwdFailureTime via chain. > From: esteban.pereira(a)gepsit.fr > To: serpent6877(a)hotmail.com > CC: openldap-technical(a)openldap.org > > > Hi Brad, > > pwdFailureTime is an operational attribute, I don't think any user can > modify it on any instance. May be you should try to modify it on the master > to see if it comes from this assumption. > > Esteban > > > On Thu, Mar 20, 2014 at 11:33 AM, Brad dameron <serpent6877(a)hotmail.com>wrote: > > OpenLDAP 2.4.23-26 on CentOS 5. I am trying to get the pwdFailureTime > updated on the master when the slave recieves a password failure. Here is > my config. It's pretty simple and basic. No TLS. > > Master: > > access to attrs=userPassword > by group.exact="cn=ldapadmins,ou=Groups,dc=test,dc=net" write > by dn.exact="cn=replication,dc=test,dc=net" read > by self write > by anonymous auth > by * none > access to * > by group.exact="cn=ldapadmins,ou=Groups,dc=test,dc=net" write > by dn.exact="cn=replication,dc=test,dc=net" write > by self write > by users read > by anonymous read > by * none > > > > Slave: > > overlay chain > chain-uri ldap://172.16.0.84:389 > chain-rebind-as-user TRUE > chain-idassert-bind bindmethod=simple > binddn="cn=replication,dc=test,dc=net" > credentials="MyPasswd" > mode="self" > chain-return-error TRUE > > # Password Policy > overlay ppolicy > ppolicy_default "cn=default,ou=Policies,dc=test,dc=net > ppolicy_use_lockout > ppolicy_forward_updates > > > # Slave Replication > syncrepl rid=101 > provider=ldap://172.16.0.84:389 > type=refreshAndPersist > interval=00:00:01:00 > retry="60 10 300 +" > searchbase="dc=test,dc=net" > schemachecking=off > bindmethod=simple > binddn="cn=replication,dc=test,dc=net" > credentials="MyPasswd" > updateref "ldap://172.16.0.84:389" > > > > I see the connection on the master but it gives a permission error: > > > Mar 20 09:47:46 LDAP-RADIUS-1 slapd[14288]: conn=1124 op=3 MOD > dn="cn=testuser,ou=People,dc=test,dc=net" > Mar 20 09:47:46 LDAP-RADIUS-1 slapd[14288]: conn=1124 op=3 MOD > attr=pwdFailureTime > Mar 20 09:47:46 LDAP-RADIUS-1 slapd[14288]: conn=1124 op=3 RESULT tag=103 > err=50 text= > > > I read that you maybe need authzTo added to the binddn for the chain? Or > is this only for TLS? > > I tried adding this ldif: > > dn: cn=replication,dc=test,dc=net > changetype: modify > add: authzTo > authzTo: * > > And even set the: > > chain-idassert-authzFrom "*" > > in the chain. But it always gives me the error code 50 not enough > permissions. I believe it is supposed to give access to the user to MOD the > pwdFailureTime tribute knowing it is coming from a relay. But I can't find > very specific docs on this or see what is wrong. Any help apreciated. > > Thanks, > Brad > > >

1 0

Cups Schema
by Borresen, John - 0442 - MITLL 20 Mar '14

20 Mar '14

Hopefully, someone can point me in the correct direction. Forgive me if this falls into the category of "What is the color of George Washington's white horse?" But, I want to do this in the correct way. Using this schema: # Definitions for a schema to store CUPS printer information in LDAP # OID Base is iso(1) org(3) dod(6) internet(1) private(4) enterprise(1) me(5323) cupsSchema(22) # Syntaxes are under 1.3.6.1.4.1.5323.22.0 # Attributes are under 1.3.6.1.4.1.5323.22.1 # Object Classes are under 1.3.6.1.4.1.5323.22.2 attributetype ( 1.3.6.1.4.1.5323.22.1.1 NAME 'printerDescription' DESC 'Description of Printer' EQUALITY caseExactMatch SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) attributetype ( 1.3.6.1.4.1.5323.22.1.2 NAME 'printerURI' DESC 'CUPS style URI for printer' EQUALITY caseExactIA5Match SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.5323.22.1.3 NAME 'printerLocation' DESC 'Identifier string for Printer Location' EQUALITY caseExactMatch SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) attributetype ( 1.3.6.1.4.1.5323.22.1.4 NAME 'printerMakeAndModel' DESC 'String CUPS uses to figure out driver' EQUALITY caseExactMatch SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) attributetype ( 1.3.6.1.4.1.5323.22.1.5 NAME 'printerType' DESC 'Integer CUPS uses to figure out type' EQUALITY integerMatch SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) objectclass ( 1.3.6.1.4.1.5323.22.2.1 NAME 'cupsPrinter' SUP top AUXILIARY MUST ( printerDescription $ printerURI $ printerLocation $ printerMakeAndModel $ printerType ) ) There is no Structural ObjectClass defined specifically in this schema. Would I use the same ObjectClass as I used to define Hosts, it is a network device. Thanks, John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu

3 2

Slave not able to update master pwdFailureTime via chain.
by Brad dameron 20 Mar '14

20 Mar '14

OpenLDAP 2.4.23-26 on CentOS 5. I am trying to get the pwdFailureTime updated on the master when the slave recieves a password failure. Here is my config. It's pretty simple and basic. No TLS. Master: access to attrs=userPassword by group.exact="cn=ldapadmins,ou=Groups,dc=test,dc=net" write by dn.exact="cn=replication,dc=test,dc=net" read by self write by anonymous auth by * none access to * by group.exact="cn=ldapadmins,ou=Groups,dc=test,dc=net" write by dn.exact="cn=replication,dc=test,dc=net" write by self write by users read by anonymous read by * none Slave: overlay chain chain-uri ldap://172.16.0.84:389 chain-rebind-as-user TRUE chain-idassert-bind bindmethod=simple binddn="cn=replication,dc=test,dc=net" credentials="MyPasswd" mode="self" chain-return-error TRUE # Password Policy overlay ppolicy ppolicy_default "cn=default,ou=Policies,dc=test,dc=net ppolicy_use_lockout ppolicy_forward_updates # Slave Replication syncrepl rid=101 provider=ldap://172.16.0.84:389 type=refreshAndPersist interval=00:00:01:00 retry="60 10 300 +" searchbase="dc=test,dc=net" schemachecking=off bindmethod=simple binddn="cn=replication,dc=test,dc=net" credentials="MyPasswd" updateref "ldap://172.16.0.84:389" I see the connection on the master but it gives a permission error: Mar 20 09:47:46 LDAP-RADIUS-1 slapd[14288]: conn=1124 op=3 MOD dn="cn=testuser,ou=People,dc=test,dc=net" Mar 20 09:47:46 LDAP-RADIUS-1 slapd[14288]: conn=1124 op=3 MOD attr=pwdFailureTime Mar 20 09:47:46 LDAP-RADIUS-1 slapd[14288]: conn=1124 op=3 RESULT tag=103 err=50 text= I read that you maybe need authzTo added to the binddn for the chain? Or is this only for TLS? I tried adding this ldif: dn: cn=replication,dc=test,dc=net changetype: modify add: authzTo authzTo: * And even set the: chain-idassert-authzFrom "*" in the chain. But it always gives me the error code 50 not enough permissions. I believe it is supposed to give access to the user to MOD the pwdFailureTime tribute knowing it is coming from a relay. But I can't find very specific docs on this or see what is wrong. Any help apreciated. Thanks, Brad

2 1

mdb and bdb
by Friedrich Locke 20 Mar '14

20 Mar '14

Hi folks! I wonder if, with the increased interest on mdb, the support for bdb will be removed in a near future. Thanks a lot.

6 12

openldap 2.4(slave) replication to openldap2.3(provider not working
by Andrew Belford 19 Mar '14

19 Mar '14

Hi All I have just registered on the mail list seeking for assistance of how to get openldap replication working between 2.3 and 2.4 openldap. My provider is running on 2.3(openldap) which replicates successfully to a 2.3(openldap slave). Recently we build a rhel6 host that comes with openldap 2.4 with the intention to run openldap on it as slave. I have stand up the new slave(2.4 openldap) using the same configuration of the other running slave(2.3openldap) I have managed to slapadd the ldif of the master to the new slave slapadd -l /tmp/AAA01_20140314.ldif However, if I try and search for entries, it shows the following but I am expecting 32K objects [root@vm-nix-t01 ldap]# ldapsearch -x -h 127.0.0.1 "Objectclass=*" 1:1 # extended LDIF # # LDAPv3 # base <> (default) with scope subtree # filter: Objectclass=* # requesting: 1:1 # # search result search: 2 result: 32 No such object I also don't see any replication details in /var/log/slapd.log Could you please show me some troubleshooting directions here regards

2 3

Re: mdb and bdb
by Jeff D'Angelo 19 Mar '14

19 Mar '14

On 3/19/14 1:29 PM, Howard Chu wrote: > Quanah Gibson-Mount wrote: >> --On Wednesday, March 19, 2014 9:16 AM -0300 Friedrich Locke >> <friedrich.locke(a)gmail.com> wrote: >> >>> >>> >>> >>> Hi folks! >>> >>> I wonder if, with the increased interest on mdb, the support for bdb >>> will >>> be removed in a near future. >>> >>> Thanks a lot. > > See the slides from LDAPCon 2013. http://lanyrd.com/2013/ldapcon/sckyhk/ > > Since Oracle has changed the license of BDB 6 to AGPLv3, most network > services that used BDB will be required to migrate away from it. (This > also affects Cyrus SASL and Heimdal Kerberos, but we already wrote LMDB > drivers for them 3 years ago.) And since BDB is now technologically > obsolete anyway, there's no reason to continue to support it. Thanks for the explanation. Do you expect the statement in slapd-bdb(5), "hdb is the recommended primary database backend," to be revised and/or relaxed in 2.4? Based on the man pages, there are some who read the inverse to be true, that mdb is not (yet) recommended as the primary database backend, or even a reliable option. Or is that still the case? My current read from this discussion is that the recommendation has already flipped, but not yet officially in the documentation. Just wanted to make sure. Thanks! >> Hi Friedrich, >> >> bdb and hdb will still exist, but be disabled by default in configure, >> with >> OpenLDAP 2.5. Removal would be slated for OpenLDAP 2.6. > > -- Jeff

1 0

LDAP Manager
by Julien Courtès 19 Mar '14

19 Mar '14

Hey, I want to know if it's possible to setup manager in LDAP. I mean an user can have access to others account and change informations such as password for example. One manager can have rights on 2 users to change password. But the manager don't have rights to change informations of other users and only have rights in a single OU. Do I have to use ACL or there is an other way to do it? Thanks, Julien Courtès

2 1

Re: Question on replication files.
by Quanah Gibson-Mount 19 Mar '14

19 Mar '14

--On Friday, March 14, 2014 2:07 PM +0100 Marc Haber <mh+openldap-technical(a)zugschlus.de> wrote: > On Thu, Mar 13, 2014 at 11:03:22AM -0700, Quanah Gibson-Mount wrote: >> Known issue with 2.4.31. Solution is to upgrade and stop using the >> crap shipped by Debian. > > Please watch your language: it was the OpenLDAP project that released > this "crap" a while ago. Debian makes very specific decisions to: a) Not update what they ship to address known issues (The debian openldap package list is littered with bug reports with pointers to the upstream ITSes) b) Link to a TLS implementation that is known to be utterly flawed (<https://symas.com/software-design-and-trustworthiness/>) So don't try and lecture me about the decisions made by Debian. What they ship is crap, and what they ship could be fixed to not be crap. End of story. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 5

pam_ldap does not working
by PRAJITH 19 Mar '14

19 Mar '14

Hi, When users with an expired account try to log into PAM (SSH, Su, etc..) there is no warning displayed that the account is expired. The user is also allowed to login normally. In the slapd logging, the following message is displayed: Mar 18 12:46:25 sip slapd[11790]: ppolicy_bind: Entry uid=prajith,ou=people,dc=XXX,dc=XX has an expired password: 0 grace logins In auth log ### Mar 18 23:43:37 chiron-desktop-linux2 login[7411]: pam_unix(login:auth): authentication failure; logname=root uid=0 euid=0 tty=/dev/pts/0 ruser= rhost= user=prajith Mar 18 23:43:41 chiron-desktop-linux2 login[7411]: pam_unix(login:session): session opened for user prajith by root(uid=0) ### here is my ldap.conf ######## base dc=XXX,dc=XX uri ldap://XX.XX.XX ldap_version 3 pam_lookup_policy yes pam_password md5 pam_password exop nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,clamav,colord,daemon,dansguardi an,dnsmasq,festival,games,gnats,guest-yRzqOV,hplip,imspector,irc,kernoops,libuuid,libvir t-dnsmasq,libvirt-qemu,lightdm,list,lp,mail,man,messagebus,mysql,new s,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,swift,sync,sys,syslog,usbmux ,uucp,whoopsie,www-data ####### Best Regards, Prajith http://prajith.in --

2 1

lmdb maturity
by Jeff D'Angelo 18 Mar '14

18 Mar '14

Hi folks, Would anyone want to comment on the maturity of lmdb? I've been mostly swayed by the compelling technical arguments for it for most purposes of an instance of OpenLDAP, by whitepapers and benchmarks. I've yet to read many real complaints/known major issues against it. But still today, the manual pages for hdb and lmdb state hdb remains the preferred normal use database backend. There's also the future file [in]compatibility bit in the slapd-mdb man page. Any thoughts on when lmdb may be declared "good enough for production loads" and/or the default recommended backend? Thanks! -- Jeff

2 1

slapd shuts down for no reason
by GALAMBOS Daniel 18 Mar '14

18 Mar '14

Hi, We recently left the debian openldap, and compiled the 2.4.39 and installed on our servers. The old slapd failed multiple times a day, and now the new one too. The log says: Mar 15 07:06:25 ldap1 slapd[2798]: daemon: shutdown requested and initiated. Mar 15 07:06:25 ldap1 slapd[2798]: conn=72598 op=1 DISCONNECT tag=120 err=52 text= ... Mar 15 07:06:25 ldap1 slapd[2798]: conn=72570 op=3 DISCONNECT tag=120 err=52 text= Mar 15 07:06:25 ldap1 slapd[2798]: conn=72583 fd=45 closed (slapd shutdown) .... Mar 15 07:06:25 ldap1 slapd[2798]: conn=72602 fd=59 closed (slapd shutdown) Mar 15 07:06:25 ldap1 slapd[2798]: conn=72603 fd=60 closed (slapd shutdown) Mar 15 07:06:25 ldap1 slapd[2798]: slapd shutdown: waiting for 0 operations/tasks to finish Mar 15 07:06:25 ldap1 slapd[2798]: slapd stopped. I've run out of the ideas. The configure was with the following switches: --enable-crypt --enable-spasswd --enable-modules --enable-ppolicy --enable-syncprov --enable-unique --with-cyrus-sasl using libdb5.1-dev (deb 5.1.29-5) Can you give me some pointers where to search for errors? thanks, Dancsa

6 13

Fw: Salted hashes
by espeake＠oreillyauto.com 18 Mar '14

18 Mar '14

I have been doing some reading on the salted hash and I know that I never setup a salt for servers. We are doing some documentation for our security people and the question came up about the salt and if it differs for each user, or if the same salt is used? Thanks, Eric Speake Web Systems Administrator O'Reilly Auto Parts (417) 862-2674 Ext. 1975 This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

3 3

Re: Antw: Re: Question on replication files.
by Joshua Schaeffer 18 Mar '14

18 Mar '14

Not to beat a dead horse and not to bash on Debian (personally Debian is the only distro I use), but to further help other people make a decision as to which version they should/may want to install: the slapd package included with Debian or the latest version from source: The Debian community is fully aware of the numerous issues with their OpenLDAP package and acknowledges that it needs work, they have also been asking for help with OpenLDAP for some time (1878 days according to their "work-needing packages" list): openldap (#512360), requested 1878 days ago Description: OpenLDAP server, libraries, and utilities Reverse Depends: 389-admin 389-ds-base 389-ds-base-dev 389-ds-base-libs 389-dsgw adcli alpine am-utils aolserver4-nsldap apache2-bin (200 more omitted) Installations reported by Popcon: 163954 As the entry specifies bug #512360 in the BTS gives additional information about what work is needed: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512360 Thanks, Josh On Mon, Mar 17, 2014 at 11:32 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, March 17, 2014 9:00 AM +0100 Ulrich Windl < > Ulrich.Windl(a)rz.uni-regensburg.de> wrote: > > Dieter Klünter<dieter(a)dkluenter.de> schrieb am 14.03.2014 um 21:50 in >>>>> >>>> Nachricht >> <20140314215009.33f39aee(a)pink.avci.de>: >> >>> Am Fri, 14 Mar 2014 09:27:10 +0100 >>> schrieb "Ulrich Windl" <Ulrich.Windl(a)rz.uni-regensburg.de>: >>> >>> >>> Quanah Gibson-Mount <quanah(a)zimbra.com> schrieb am 13.03.2014 um >>>> >>> 19:03 in >>>> Nachricht <34E9E18C6D0A7C6D92162635(a)[192.168.1.46]>: >>>> > --On Thursday, March 13, 2014 1:56 PM -0500 espeake(a)oreillyauto.com >>>> > wrote: >>>> > >>>> >> Version 2.4.31-1+nmu2 >>>> >> >>>> >> Plain syncrepl. >>>> >> >>>> >> As I said I hope to be upgrading to the latest version in the next >>>> >> couple of months. Right now I need to get through this problem >>>> >> the best I can. >>>> > >>>> > Known issue with 2.4.31. Solution is to upgrade and stop using the >>>> > crap shipped by Debian. The LTB project now has a deb repository >>>> > for their builds, I'd advise investigating switching to using it. >>>> >>>> >> A: >> One could also file a bug report for Debian, I guess. >> >>> >>> >> B: > Rubbish, have you ever seen a Debian or Ubuntu maintainer posting to >> >>> this mailing list? >>> >> >> C: > Actually there is no qualified Debian or Ubuntu maintainer. >> >> What has A to do with B, and how can you conclude C from A or B? >> > > B obviously has to do with A. A qualified maintainer would maintain some > presence with the upstream project. > > C you can conclude from years of interacting with the Debian project, like > I have. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Architect - Server > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

3 2

RE: slapd shuts down for no reason
by Christian Kratzer 18 Mar '14

18 Mar '14

Hi, On Tue, 18 Mar 2014, Borresen, John - 0442 - MITLL wrote: > Only for logrotate. of which logs exactly ? > The -HUP in the logrotate.conf was not working. Even > on the command line kill the slapd process with a -HUP was not working. > Putting the /etc/init.d/slapd stop; sleep 5, /etc/init.d/slapd start does > make sense when nothing else was working. We tried numerous different > iterations, this was the only thing that worked for us. It worked...so, > thus it makes sense. restarting slapd does not make sense for syslog aus syslog has the file handle open, not slapd. >From my understanding it also does not make sense for auditlog. Greetings Christian > > -----Original Message----- > From: Christian Kratzer [mailto:ck-lists@cksoft.de] > Sent: Tuesday, March 18, 2014 8:51 AM > To: Borresen, John - 0442 - MITLL > Cc: Hallvard Breien Furuseth; openldap-technical(a)openldap.org > Subject: RE: slapd shuts down for no reason > > Hi, > > On Tue, 18 Mar 2014, Borresen, John - 0442 - MITLL wrote: > >> Fall back to legacy unix...sorry logrotate is more appropriate. Yes, >> yours is very similar to how ours looked and it would stop the daemon >> fine, and rotate the log but would not restart. I modified it to look > like this: >> >> .... >> /etc/init.d/slapd stop; sleep 5; /etc/init.d/slapd start > > why are you stopping and starting slapd ? This does not make any sense. > > Greetings > Christian > >> .... >> >> Commenting out the "/bin/kill -s HUP syslogd". >> >> Now, it does what it is supposed to do. >> >> John >> >> -----Original Message----- >> From: Hallvard Breien Furuseth [mailto:h.b.furuseth@usit.uio.no] >> Sent: Tuesday, March 18, 2014 4:26 AM >> To: Borresen, John - 0442 - MITLL >> Cc: openldap-technical(a)openldap.org >> Subject: RE: slapd shuts down for no reason >> >> On Mon, 2014-03-17 at 08:30 -0400, Borresen, John - 0442 - MITLL wrote: >>> We had a similar issue a few months back. I discovered that it was >>> dying at about the same time. Come to find out it was syslog >>> rotation that was doing it. Syslog sends a HUP signal to rotate the >>> logs and restart a daemon. I had to put a sleep statement in the syslog > for slapd. >> >> Your syslog rotates logs? On our host (RedHat) it's logrotate which >> does that. And it's logrotate which must kill -HUP syslogd, to make >> syslogd close and reopen the log. From logrotate.conf: >> >> notifempty >> missingok >> create 0640 ldap cerebrum >> start 0 >> >> /ldap/log/syslog/openldap.log { >> size=250M >> rotate 2500 >> compress >> delaycompress >> lastaction >> /bin/kill -s HUP syslogd >> endscript >> } >> >> > > -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Mobile: +49 171 1947 843 Geschaeftsfuehrer: Christian Kratzer Web: http://www.cksoft.de/

1 0

Re: Antw: Re: Question on replication files.
by Quanah Gibson-Mount 17 Mar '14

17 Mar '14

--On Monday, March 17, 2014 9:00 AM +0100 Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >>>> Dieter Klünter<dieter(a)dkluenter.de> schrieb am 14.03.2014 um 21:50 in > Nachricht > <20140314215009.33f39aee(a)pink.avci.de>: >> Am Fri, 14 Mar 2014 09:27:10 +0100 >> schrieb "Ulrich Windl" <Ulrich.Windl(a)rz.uni-regensburg.de>: >> >>> >>> Quanah Gibson-Mount <quanah(a)zimbra.com> schrieb am 13.03.2014 um >>> >>> 19:03 in >>> Nachricht <34E9E18C6D0A7C6D92162635(a)[192.168.1.46]>: >>> > --On Thursday, March 13, 2014 1:56 PM -0500 espeake(a)oreillyauto.com >>> > wrote: >>> > >>> >> Version 2.4.31-1+nmu2 >>> >> >>> >> Plain syncrepl. >>> >> >>> >> As I said I hope to be upgrading to the latest version in the next >>> >> couple of months. Right now I need to get through this problem >>> >> the best I can. >>> > >>> > Known issue with 2.4.31. Solution is to upgrade and stop using the >>> > crap shipped by Debian. The LTB project now has a deb repository >>> > for their builds, I'd advise investigating switching to using it. >>> > > A: >> One could also file a bug report for Debian, I guess. >> > > B: > Rubbish, have you ever seen a Debian or Ubuntu maintainer posting to >> this mailing list? > > C: > Actually there is no qualified Debian or Ubuntu maintainer. > > What has A to do with B, and how can you conclude C from A or B? B obviously has to do with A. A qualified maintainer would maintain some presence with the upstream project. C you can conclude from years of interacting with the Debian project, like I have. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

public ssh key access
by Ivan Upsons 17 Mar '14

17 Mar '14

dear all, i have openldap 2.4 running and phpldapadmin configured. one challenge i am facing is on how to include ssh keys to aid my authentication. i am running ubuntu 12.04. any ideas on how to go about this? Kind Regards Ivan

2 1

Question on replication files.
by espeake＠oreillyauto.com 17 Mar '14

17 Mar '14

We are having an issue with some users not replicating to all of servers. I have MMR setup with three nodes and there are a few times that a user is has an attribute changed, i.e. supervisor, and the change is replicated to one server and not to another. So the information is correct on 2 of 3 servers. My question is this after running a very long diff against two ldif's created by slapcat of the replication database. Shouldn't the replication databases be the same? The issues do happen with every change and every user, just a few times. I am n ot on the latest version and I cannot upgrade to the latest version with a better kernel until our staff upgrades our VM server due to migration issues with the kernel I would like have. We are on ubuntu 12.04 and if we can get the VM server updated soon we will start testing 14.04 when it is released. Any suggestions on a good way to test besides the obvious of turning on logging for sync which I have done in out test environment for now. Thanks, Eric Speake Web Systems Administrator O'Reilly Auto Parts (417) 862-2674 Ext. 1975 This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

5 10

two entries, the same attribute
by Friedrich Locke 15 Mar '14

15 Mar '14

Hi folks, i am planning to use opendalp to build my email infra structure. What happens is two users (two entries) hold the same email address ? Thanks in advance. Best regards, gustavo.

5 5

OpenLDAP back-end
by Андрей Андреев 15 Mar '14

15 Mar '14

Hi, everybody! I make some research about directory services and LDAP and can't understand(find) which method(hash,b+tree, etc.) used to search in BDB. Can you help me? -- Best regards, thexf.

1 0

Features been supported by LDAP
by saurabh ohri 15 Mar '14

15 Mar '14

Hi All, First of all thanks to everyone for all your support during the installation of openldap and its authentication, although would be requiring some more going further. Was wondering if you guys can help me with you feedback on the below features if openldap support of not? S.No Requirements 1 Authentication 2 Authorization(Admin/root or non admin/root) 3 Password policy push Changing password after first login(new User) Auto account lock/unlock in case of 3 invalid attempt Complexity(aplhanumeric, 8 chars, upper case/lowecase) Expiry and expiry warning Grace Logins 4 Forceful auto loading of application at startup 5 Auto Antivirus updates 6 logging access and tracebility 7 Rules based logins 8 High Availability 9 Pushing security policies in form of patches updates or fixes 10 Configuring auto schedulers(scans) 11 Group policies 12 Auto backups or auto-mapping of shared drives 13 Server management in terms of license etc 14 Supports SSL communication 15 Support for SSO 16 Running scripts on client 17 Supporting all above features on Windows/Mac/ubuntu/Linux clients Thanks again. Regards Sam

3 3

slapd-meta and idassert-bind
by Ana Fernandez 14 Mar '14

14 Mar '14

Hello, I've three servers with three different LDAP suffixes: ou=users, ou=ldap1 and ou=ldap2. Servers with ou=ldap1 and ou=ldap2 also have a replica of the ou=users suffix LDAP0 : ou=users,dc=test,dc=com LDAP1 : ou=ldap1,dc=test,dc=com and ou=users,dc=test,dc=com LDAP2 : ou=ldap2,dc=test,dc=com and ou=users,dc=test,dc=com Each application client, depending on which suffix needs to be accessed, connects to an instance or another. I want to unify access using ldap proxy. It seems that slapd-meta fits my requirements. I've configured this targets: # LDAP0 suffix "ou=users,dc=test,dc=com" uri "ldap://host1:389/ou=users,dc=test,dc=com" # LDAP1 suffix "ou=ldap1,dc=test,dc=com" uri "ldap://host2:389/ou=ldap1,dc=test,dc=com" # LDAP2 suffix "ou=ldap2,dc=test,dc=com" uri "ldap://host3:389/ou=ldap2,dc=test,dc=com" If the client binds the proxy with cn=user1,ou=users,dc=test,dc=com, it's authenticated successfully against ldap0 and can access to ou=users,dc=test,dc=com, but if tries to access ou=ldap1,dc=test,dc=com or ou=ldap2,dc=test,dc=com it binds anonymously to the targets and can not access anything. I've tried idassert-bind and works perfectly, but I was wondering if I can avoid the use of a "pseudo-root identity" who had privileges to assert the client's identity. As LDAP1 and LDAP2 have the ou=users suffix could authenticate the credentials of the users who bounds the proxy. I don't know if it's possible with slapd-meta, but the idea is that client's user/password will be send directly to targets for binding so there's no need of id assertion. The proxy simply passthrough the user/password to the targets. Is this possible or I have to use idassert-bind? Thanks

1 0

Regarding LDAP structure
by Joshua Riffle 14 Mar '14

14 Mar '14

I'm aware this may not be the best mailing list to discuss something as generalized as best practices for LDAP structuring within OpenLDAP, but would anyone be able to direct me to a mailing list that would be better suited for this kind of conversation? I'm looking for any or all of these kinds of communications within a mailing list: - Designing a person, account, group LDAP tree directory that would be scalable and flexible enough to grow to large sizes (millions) and still have a grip on best practices for identity management on an enterprise level. - Specifically for an educational institution if I can share the aches and pains of other directory owners with similar problems. - I also am trying to prove / disprove the use of having a person directory object with multiple child account objects as good or bad architecture and understand why. I've never seen this discussed in practice. - Good and bad ways to relate tree objects with each other. I only know of parent / child tree relationships or more "softly" by using DN's within an attribute like the group-member relationship. Joshua Riffle Software Engineer *Azusa Pacific University*

5 10

Planning migration to mdb
by Nick Milas 14 Mar '14

14 Mar '14

Hi, We have a running openldap installation (2.4.39) - a single master - with cn=config and hdb backend. So, config has the branches: I know we must slapcat our data and slapadd it in mdb afterwards. The question is: what changes should be done in the config DIT (and how) so that the config changes from hdb backend to mdb backend? Is it enough to slapcat config, then change: olcDatabase from {1}hdb to {1}mdb and: objectClass from olcHdbConfig to olcMdbConfig ...? Anything else? Can we safely delete all values of the olcDbConfig attribute which originate from converting from "DB_CONFIG"? What attributes can we safely remove? Thanks, Nick

3 3

What does COSINE stand for?
by Peng Yu 14 Mar '14

14 Mar '14

Hi, COSINE is mentioned in the following document. But it doesn't say what it stands for. Does anybody know what it stands for? Thanks. http://www.ietf.org/rfc/rfc1274.txt -- Regards, Peng

7 6

Where is "uid" defined in schema?
by Peng Yu 14 Mar '14

14 Mar '14

Hi, I'm not able to find where "uid" is defined. Could any expert point me where it is defined? Thanks. pengy@lithium:/etc/ldap/schema$ grep '\<uid\>' * core.ldif:# RFC 1274 (uid/dc) core.ldif:# NAME ( 'uid' 'userid' ) core.ldif: DESC 'RFC2377: uid object' core.ldif: SUP top AUXILIARY MUST uid ) core.schema:# RFC 1274 (uid/dc) core.schema:# NAME ( 'uid' 'userid' ) core.schema: DESC 'RFC2377: uid object' core.schema: SUP top AUXILIARY MUST uid ) cosine.schema:##attributetype ( 0.9.2342.19200300.100.1.1 NAME ( 'uid' 'userid' ) inetorgperson.ldif: $ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIdentifier $ pre inetorgperson.schema: photo $ roomNumber $ secretary $ uid $ userCertificate $ nis.ldif: f an account with POSIX attributes' SUP top AUXILIARY MUST ( cn $ uid $ uidNu nis.ldif: ttributes for shadow passwords' SUP top AUXILIARY MUST uid MAY ( userPassword nis.schema: MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory ) nis.schema: MUST uid openldap.ldif: MUST ( uid $ cn ) openldap.schema: MUST ( uid $ cn ) -- Regards, Peng

6 5

Cannot resolve group example to gid : not found (ldapadduser error)
by Peng Yu 13 Mar '14

13 Mar '14

Hi, https://help.ubuntu.com/13.10/serverguide/openldap-server.html#openldap-ser… I'm following the instructions on the following webpage, with the following sections skipped. - Modifying the slapd Configuration Database - Logging - Replication - Access Control - TLS - Replication and TLS Then I get the following errors when I try the following commands. I'm know that I might make simple mistakes but I have no clue how to figure it out. Could you help me on how to make the command work? Thanks. pengy@lithium:/etc/ldap/schema$ sudo ldapadduser george example Cannot resolve group example to gid : not found -- Regards, Peng

1 0

Basic Openldap Question
by Borresen, John - 0442 - MITLL 13 Mar '14

13 Mar '14

All, A question has popped up here about the "olcDatabase={-1}frontend" under cn=config. Besides replying that it is always there, I'm not really sure what it does or what its purpose is.in addition to what it states in the Admin Guide: ".is a special database that is used to hold database-level options that should be applied to all databases. Subsequent database definitions may also override some frontend settings." That's my question: What is the olcDatabase={-1}frontend dbase and what is its purpose? Thanks in advance, John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu

2 1

TLS with multiple LDAP servers
by Julien Courtès 13 Mar '14

13 Mar '14

Hi, I have two LDAP servers in master-slave ldap1.domain.com - master ldap2.domain.com - slave These servers got different ip addresses and are hosted on different servers But I want to enable TLS connection with clients. So can I create a unique certificate that I put on both servers and the client will use one unique certificate to connect to server "ldap1" or "ldap2" if the first one is down. If not, how should I do? I did a search and I found that I can use subjectAltNames or wildcard certificat. Thanks Julien Courtès

5 5

set syntax possible in search filter?
by Stephan Fabel 12 Mar '14

12 Mar '14

Hi, reading this: http://www.openldap.org/faq/data/cache/1133.html - do I read this correctly that the set syntax can also be employed in search filters? The reason I ask is because Mark is listing LDAP URIs and this sentence: "The LDAP search corresponding to the URI's DN, attributes, scope and filter is performed, and all the matching entries are dereferenced." I'm unsure because the Admin Guide for 2.4 only mentions sets in the context of ACLs, and slapd.access(5) states that it's "undocumented". Thanks for any clarification, Stephan

3 7

Kerberos issue running OpenLDAP on Mac OS X Mavericks
by Denis Ahearn 12 Mar '14

12 Mar '14

We have a Rails app that uses OpenLDAP in the local development environment on Mac OS X to authenticate and authorize users (we use Active Directory in production and staging). Up until now all development has been done on Macs running Mountain Lion, and OpenLDAP has worked fine. Recently a new developer joined our team who is using a Mac running Mavericks, however OpenLDAP is behaving differently on his Mac. On Mavericks, OpenLDAP is trying to do something with Kerberos, which is failing. We see the following in the slapd.log on Mavericks: 5319fc2c >>> dnPrettyNormal: <cn=jdoe,ou=people,dc=bluewaterbrand,dc=com> 5319fc2c <<< dnPrettyNormal: <cn=jdoe,ou=people,dc=bluewaterbrand,dc=com>, <cn=jdoe,ou=people,dc=bluewaterbrand,dc=com> 5319fc2c do_bind: version=3 dn="cn=jdoe,ou=people,dc=bluewaterbrand,dc=com" method=128 5319fc2c bdb_dn2entry("cn=jdoe,ou=people,dc=bluewaterbrand,dc=com") 5319fc2c => bdb_search 5319fc2c bdb_dn2entry("cn=kerberoskdc,cn=config,dc=bluewaterbrand,dc=com") 5319fc2c => bdb_dn2id("cn=config,dc=bluewaterbrand,dc=com") 5319fc2c <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) 5319fc2c entry_decode: "dc=bluewaterbrand,dc=com" 5319fc2c <= entry_decode(dc=bluewaterbrand,dc=com) 5319fc2c send_ldap_result: conn=-1 op=0 p=0 5319fc2c Entry *odusers_copy_entry(Operation *): Unable to locate cn=kerberoskdc,cn=config,dc=bluewaterbrand,dc=com (32) 5319fc2c odusers_copy_krbrealm: No entry associated with KerberosKDC cn=kerberoskdc,cn=config,dc=bluewaterbrand,dc=com 5319fc2c odusers_krb_auth: could not retrieve krb realm while authing jdoe 5319fc2c int odusers_increment_failedlogin(struct berval *): Unable to retrieve description of loginFailedAttempts attribute5319fc2c bdb_bind: Error to increment failed login count for cn=jdoe,ou=people,dc=bluewaterbrand,dc=com5319fc2c send_ldap_result: conn=1003 op=0 p=3 Here's the same section of slapd.log from a Mac running Mountain Lion, which is working correctly: 531e25c9 >>> dnPrettyNormal: <cn=cjdoe,ou=people,dc=bluewaterbrand,dc=com> 531e25c9 <<< dnPrettyNormal: <cn=cjdoe,ou=people,dc=bluewaterbrand,dc=com>, <cn=cjdoe,ou=people,dc=bluewaterbrand,dc=com> 531e25c9 do_bind: version=3 dn="cn=cjdoe,ou=people,dc=bluewaterbrand,dc=com" method=128 531e25c9 bdb_dn2entry("cn=cjdoe,ou=people,dc=bluewaterbrand,dc=com") 531e25c9 do_bind: v3 bind: "cn=cjdoe,ou=people,dc=bluewaterbrand,dc=com" to "cn=cjdoe,ou=people,dc=bluewaterbrand,dc=com" 531e25c9 send_ldap_result: conn=1003 op=0 p=3 531e25c9 send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 14 ldap_write: want=14, written=14 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ 531e25c9 connection_get(14): got connid=1003 531e25c9 connection_read(14): checking for input on id=1003 ber_get_next ldap_read: want=8, got=0 We've spent a copule of days looking into this, and can't find any noticeable differences in the ldap.conf and slapd.conf files between Mavericks and Mountain Lion that would explain why Mavericks is doing a search on "cn=kerberoskdc,cn=config,dc=bluewaterbrand,dc=com". Does anyone know why OpenLDAP on Mavericks is behaving the way that it is, and more importantly, what would be the correct way to resolve this issue? Our Rails app is using the devise and devise_ldap_authenticatable gems to handle user authentication, so it would seem that we don't want OpenLDAP to do anything with Kerberos at all. Can this be controlled via configuration, or is this an issue with how the OpenLDAP shipped with Mavericks was built? Thanks, Denis

2 1

tls question
by Borresen, John - 0442 - MITLL 12 Mar '14

12 Mar '14

All, Can the olcTLSCACertificateFile and olcTLSCertificateFile be the same file? Finding some "interesting" examples online (even on some openssl.org pages) and would like clarification. Thanks, John -----Original Message----- From: Dieter Klünter [mailto:dieter@dkluenter.de] Sent: Tuesday, March 11, 2014 2:17 PM To: Borresen, John - 0442 - MITLL Cc: openldap-technical(a)openldap.org Subject: Re: TLS QUESTION Am Tue, 11 Mar 2014 13:15:21 -0400 schrieb "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu>: > Dieter; > > Now, receiving the following when attempting to sign the cert: > > Using configuration from /etc/pki/tls/openssl.cnf Enter pass phrase > for /usr/local/openldap/etc/openldap/CA_test/private/cakey.pem: Error > reading certificate request in /etc/openldap/CA_test/newreq.pem > 2729:error:0906D06C:PEM routines:PEM_read_bio:no start > line:pem_lib.c:647:Expecting: CERTIFICATE REQUEST Signed certificate > is in newcert.pem I would sys you delete all certificates and certificate database files and restart from scratch. If you are using the openssl CA tools in order to create certificates, /etc/ssl/openssl.cnf should be modified to meet your requirements (in particular FQDN). Run ./CA.pl -newca ./CA.pl -newreq ./CA.pl -sign openssl rsa -in nrewreq.pem -out myKey.pem mv newcert.pem host.pem ./CA.pl -verify host.pem -Dieter > > -----Original Message----- > From: Dieter Klünter [mailto:dieter@dkluenter.de] > Sent: Tuesday, March 11, 2014 9:31 AM > To: Borresen, John - 0442 - MITLL > Cc: openldap-technical(a)openldap.org > Subject: Re: TLS QUESTION > > Am Tue, 11 Mar 2014 09:19:15 -0400 > schrieb "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu>: > > > Guten morgen Dieter; > > > > I ran the openssl commands indicated below. > > > > But, ran them against my cacert.pem -- both the original and new > > successfully (they failed with servercrt.pem). > > > > I re-ran the CA.sh script this morning, and receiving the following > > errors when creating a new CA: > > > > Certificate is to be certified until Mar 8 13:09:05 2024 GMT (3650 > > days) failed to update database > > TXT_DB error number 2 > > This is an error of your certificate database files index.txt and > serial. > > -Dieter > > > > > -----Original Message----- > > From: Dieter Klünter [mailto:dieter@dkluenter.de] > > Sent: Monday, March 10, 2014 5:12 PM > > To: Borresen, John - 0442 - MITLL > > Subject: Re: TLS QUESTION > > > > Am Mon, 10 Mar 2014 16:55:04 -0400 > > schrieb "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu>: > > > > > Vielen Danke Dieter; > > > > > > Originally my command to create the client.pem was: > > > > > > grep -A 100 CERTIFICATE cacert.pem > client.pem > > > > > > Then I scp'd that out to the clients. That worked when doing SSL > > > on port 636 (and not wild-card certificates), but it is not > > > working now on TLS over 389 to mm-server1 and mm-server3 with > > > wild-card certs. > > > > > > The cacert.pem and client.pem is on each client. > > > > > > Doing further reading...the client.pem since it was built off the > > > cacert.pem (the server certificate) it should work. > > > > > > Should I use the cacert.pem or the servercrt.pem to create the > > > client.pem? > > > > Test this on each host > > openssl verify -CAfile path/to/ca client.pem servercert.pem > > > > openssl x509 -in servercert.pem -noout -text check for Common Name > > > > -Dieter > > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > From: Dieter Klünter [mailto:dieter@dkluenter.de] > > > Sent: Monday, March 10, 2014 2:41 PM > > > To: Borresen, John - 0442 - MITLL > > > Subject: Re: TLS QUESTION > > > > > > Am Mon, 10 Mar 2014 13:33:53 -0400 schrieb "Borresen, John - 0442 > > > - MITLL" > > > <John.Borresen(a)ll.mit.edu>: > > > > > > > Thanks Dieter... > > > > > > > > As I stated I saw Howard Chu's response to an individual in > > > > 2005 with a similar issue and he stated then, " For the slapd > > > > server you use the corresponding TLSCACertificateFile directive. > > > > You must use these configuration directives if you want to > > > > accept a self-signed cert." > > > > > > > > I did add the olcTLSCACertificateFile attribute (just forgot to > > > > list it in my original post). Was not certain at the time if > > > > the "olcTLSCertificateFile" should be removed so I did not > > > > remove it. So, before I do remove it, the attribute should be > > > > "olcTLSCACertificateFile" instead of "olcTLSCertificateFile" > > > > (and this should be removed), correct? > > > > > > > > The CA directories on all three servers look like this: > > > > > > > > # ll > > > > total 28 > > > > lrwxrwxrwx 1 root root 10 Jan 24 11:44 600f07a1.0 -> > > > > cacert.pem --> client hash -rw-r--r-- 1 ldap ldap 5136 Jan 17 > > > > 12:15 cacert.pem --> Self-signed certificate -rw-r--r-- 1 ldap > > > > ldap 1090 Jan 17 12:07 cert.csr --> Certificate Signing Request > > > > -rw-r--r-- 1 ldap ldap 1757 Jan 17 12:23 client.pem --> Client > > > > Certificate PEM -rw-r--r-- 1 ldap ldap 0 Jan 14 16:20 > > > > index.txt drwxr-xr-x 2 ldap ldap 4096 Jan 14 16:18 newcerts > > > > (empty) drwxr-xr-x 2 ldap ldap 4096 Jan 17 12:06 private --> > > > > server private key directory (cakey.pem) -rw-r--r-- 1 ldap > > > > ldap 3 Jan 17 11:59 serial This may sound like a dumb > > > > question... > > > > > > > > I created the client.pem from the cacert.pem (as indicated on > > > > openssl.org) then copied that to each client. Is there a step I > > > > missed in there? > > > > > > Yes, you have to create a client certificate for each host, while > > > the Common Name must match the FQDN of this host. my blog entry > > > may be of help: > > > > > > https://sys4.de/de/blog/2013/08/20/how-create-and-administer-x509- > > > ce > > > rt > > > ificate-chains-part-i > > > > > > -Dieter > > > > > > > If so, where? > > > > > > > > Thanks in advance > > > > > > > > John > > > > -----Original Message----- > > > > From: openldap-technical-bounces(a)OpenLDAP.org > > > > [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of > > > > Dieter Klünter Sent: Monday, March 10, 2014 12:58 PM To: > > > > openldap-technical(a)openldap.org Subject: Re: TLS QUESTION > > > > > > > > Am Mon, 10 Mar 2014 11:18:14 -0400 schrieb "Borresen, John - > > > > 0442 > > > > - MITLL" > > > > <John.Borresen(a)ll.mit.edu>: > > > > > > > > > All, > > > > > > > > > > > > > > > > > > > > My set up consists of three servers each syncing with each > > > > > other. The host names are: > > > > > > > > > > 1) mm-server1.example.ldap > > > > > > > > > > 2) mm-server2.example.ldap > > > > > > > > > > 3) mm-server3.example.ldap > > > > > > > > > > > > > > > > > > > > Utilizing TLSv1, on all three I have: > > > > > > > > > > olcTLSCertificateFile: > > > > > /usr/local/openldap/etc/openldap/CA/cacert.pem > > > > > > > > this should be opcTLSCAcertificateFile > > > > > > > > > > > > > > olcTLSCertificateKeyFile: > > > > > /usr/local/openldap/etc/openldap/CA/private/cakey.pem > > > > > > > > you are misssing the host certificate, something like > > > > olcTLSCertificateFile > > > > /usr/local/openldap/etc/openldap/CA/host.pem > > > > > > > > > > > > > > olcTLSCipherSuite: HIGH:MEDIUM+TLSv1+SSLv3 > > > > > > > > > > > > > > > > > > > > Configured with self-signed wild-card certs, originally > > > > > configured (using openssl 0.9.8) on mm-server2 and exported to > > > > > the other servers. > > > > > > > > > > > > > > > > > > > > When running ldapmodify, ldapsearch, etc with a "-Z", and > > > > > openssl s_client on mm-server1 or mm-server3 or any client > > > > > pointing back to mm-server1 or 3, I receive the following > > > > > error: > > > > > > > > > > > > > > > > > > > > TLS certificate verification: Error, self signed certificate > > > > > > > > > > TLS: can't connect: error:14090086:SSL > > > > > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed > > > > > (self signed certificate). > > > > > > > > > > ldap_start_tls: Connect error (-11) > > > > > > > > > > additional info: error:14090086:SSL > > > > > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed > > > > > (self signed certificate) > > > > > > > > > > > > > > > > > > > > Running any of those to mm-server2, it works with no such > > > > > error. > > > > > > > > > > > > > > > > > > > > I am guessing, that since the certs were created on > > > > > mm-server2, originally, that is why it works this way. Also, > > > > > guessing I missed a step somewhere. > > > > > > > > > > > > > > > > > > > > I read online a post from 2005 with a good explanation of > > > > > self-signed from Howard Chu about a similar problem. > > > > > > > > > > > > > > > > > > > > What is the best procedure for creating wild-card certs and > > > > > sharing those out to other servers? The procedure that was > > > > > used was from openssl.org so it was not a fly-by-night weblog. > > > > > > > > > > > > > > > > > > > > What did I miss (besides: a lot)? > > > > > > > > > > > > > > > > > > > > Thanks in advance, > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > John D. Borresen (Dave) > > > > > > > > > > Linux/Unix Systems Administrator > > > > > > > > > > MIT Lincoln Laboratory > > > > > > > > > > Surveillance Systems Group > > > > > > > > > > 244 Wood St > > > > > > > > > > Lexington, MA 02420 > > > > > > > > > > Ph: (781) 981-1609 > > > > > > > > > > Email: john.borresen(a)ll.mit.edu > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > Dieter Klünter | Systemberatung > > > > http://sys4.de > > > > GPG Key ID: E9ED159B > > > > 53°37'09,95"N > > > > 10°08'02,42"E > > > > > > > > > > > > > > > > -- > > > Dieter Klünter | Systemberatung > > > http://sys4.de > > > GPG Key ID: E9ED159B > > > 53°37'09,95"N > > > 10°08'02,42"E > > > > > > > > -- > > Dieter Klünter | Systemberatung > > http://sys4.de > > GPG Key ID: E9ED159B > > 53°37'09,95"N > > 10°08'02,42"E > > > > -- > Dieter Klünter | Systemberatung > http://sys4.de > GPG Key ID: E9ED159B > 53°37'09,95"N > 10°08'02,42"E -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

2 2

OpenLdap provider-client replication error
by Seun Ojedeji 12 Mar '14

12 Mar '14

Hello, I am trying to setup a sync between 2 ldap instance, following the guide here<http://askubuntu.com/questions/360190/how-to-configure-master-slave-ldap-re…>. I ran the command below, but got the following error message. sudo ldapadd -x -W -D cn=admin,dc=acme,dc=come -f /root/enable_sync_prov.ldif Enter LDAP Password: *modifying entry "olcDatabase={1}hdb,cn=config"ldap_modify: Insufficient access (50)* How do i fix the insuffient access problem? I am using the admin that has full write access on ldap. Regards -- ------------------------------------------------------------------------ *Seun Ojedeji,Federal University Oye-Ekitiweb: http://www.fuoye.edu.ng <http://www.fuoye.edu.ng> Mobile: +2348035233535**alt email: <http://goog_1872880453>seun.ojedeji(a)fuoye.edu.ng <seun.ojedeji(a)fuoye.edu.ng>*

2 8

Re: TLS QUESTION
by Dieter Klünter 12 Mar '14

12 Mar '14

Am Tue, 11 Mar 2014 09:19:15 -0400 schrieb "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu>: > Guten morgen Dieter; > > I ran the openssl commands indicated below. > > But, ran them against my cacert.pem -- both the original and new > successfully (they failed with servercrt.pem). > > I re-ran the CA.sh script this morning, and receiving the following > errors when creating a new CA: > > Certificate is to be certified until Mar 8 13:09:05 2024 GMT (3650 > days) failed to update database > TXT_DB error number 2 This is an error of your certificate database files index.txt and serial. -Dieter > -----Original Message----- > From: Dieter Klünter [mailto:dieter@dkluenter.de] > Sent: Monday, March 10, 2014 5:12 PM > To: Borresen, John - 0442 - MITLL > Subject: Re: TLS QUESTION > > Am Mon, 10 Mar 2014 16:55:04 -0400 > schrieb "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu>: > > > Vielen Danke Dieter; > > > > Originally my command to create the client.pem was: > > > > grep -A 100 CERTIFICATE cacert.pem > client.pem > > > > Then I scp'd that out to the clients. That worked when doing SSL > > on port 636 (and not wild-card certificates), but it is not working > > now on TLS over 389 to mm-server1 and mm-server3 with wild-card > > certs. > > > > The cacert.pem and client.pem is on each client. > > > > Doing further reading...the client.pem since it was built off the > > cacert.pem (the server certificate) it should work. > > > > Should I use the cacert.pem or the servercrt.pem to create the > > client.pem? > > Test this on each host > openssl verify -CAfile path/to/ca client.pem servercert.pem > > openssl x509 -in servercert.pem -noout -text check for Common Name > > -Dieter > > > > > > > > > > > > > -----Original Message----- > > From: Dieter Klünter [mailto:dieter@dkluenter.de] > > Sent: Monday, March 10, 2014 2:41 PM > > To: Borresen, John - 0442 - MITLL > > Subject: Re: TLS QUESTION > > > > Am Mon, 10 Mar 2014 13:33:53 -0400 > > schrieb "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu>: > > > > > Thanks Dieter... > > > > > > As I stated I saw Howard Chu's response to an individual in 2005 > > > with a similar issue and he stated then, " For the slapd server > > > you use the corresponding TLSCACertificateFile directive. You > > > must use these configuration directives if you want to accept a > > > self-signed cert." > > > > > > I did add the olcTLSCACertificateFile attribute (just forgot to > > > list it in my original post). Was not certain at the time if the > > > "olcTLSCertificateFile" should be removed so I did not remove it. > > > So, before I do remove it, the attribute should be > > > "olcTLSCACertificateFile" instead of "olcTLSCertificateFile" (and > > > this should be removed), correct? > > > > > > The CA directories on all three servers look like this: > > > > > > # ll > > > total 28 > > > lrwxrwxrwx 1 root root 10 Jan 24 11:44 600f07a1.0 -> cacert.pem > > > --> client hash -rw-r--r-- 1 ldap ldap 5136 Jan 17 12:15 > > > cacert.pem --> Self-signed certificate -rw-r--r-- 1 ldap ldap > > > 1090 Jan 17 12:07 cert.csr --> Certificate Signing Request > > > -rw-r--r-- 1 ldap ldap 1757 Jan 17 12:23 client.pem --> Client > > > Certificate PEM -rw-r--r-- 1 ldap ldap 0 Jan 14 16:20 > > > index.txt drwxr-xr-x 2 ldap ldap 4096 Jan 14 16:18 newcerts > > > (empty) drwxr-xr-x 2 ldap ldap 4096 Jan 17 12:06 private --> > > > server private key directory (cakey.pem) -rw-r--r-- 1 ldap > > > ldap 3 Jan 17 11:59 serial This may sound like a dumb > > > question... > > > > > > I created the client.pem from the cacert.pem (as indicated on > > > openssl.org) then copied that to each client. Is there a step I > > > missed in there? > > > > Yes, you have to create a client certificate for each host, while > > the Common Name must match the FQDN of this host. my blog entry may > > be of help: > > > > https://sys4.de/de/blog/2013/08/20/how-create-and-administer-x509-cert > > ificate-chains-part-i > > > > -Dieter > > > > > If so, where? > > > > > > Thanks in advance > > > > > > John > > > -----Original Message----- > > > From: openldap-technical-bounces(a)OpenLDAP.org > > > [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of > > > Dieter Klünter Sent: Monday, March 10, 2014 12:58 PM To: > > > openldap-technical(a)openldap.org Subject: Re: TLS QUESTION > > > > > > Am Mon, 10 Mar 2014 11:18:14 -0400 > > > schrieb "Borresen, John - 0442 - MITLL" > > > <John.Borresen(a)ll.mit.edu>: > > > > > > > All, > > > > > > > > > > > > > > > > My set up consists of three servers each syncing with each > > > > other. The host names are: > > > > > > > > 1) mm-server1.example.ldap > > > > > > > > 2) mm-server2.example.ldap > > > > > > > > 3) mm-server3.example.ldap > > > > > > > > > > > > > > > > Utilizing TLSv1, on all three I have: > > > > > > > > olcTLSCertificateFile: > > > > /usr/local/openldap/etc/openldap/CA/cacert.pem > > > > > > this should be opcTLSCAcertificateFile > > > > > > > > > > > olcTLSCertificateKeyFile: > > > > /usr/local/openldap/etc/openldap/CA/private/cakey.pem > > > > > > you are misssing the host certificate, something like > > > olcTLSCertificateFile /usr/local/openldap/etc/openldap/CA/host.pem > > > > > > > > > > > olcTLSCipherSuite: HIGH:MEDIUM+TLSv1+SSLv3 > > > > > > > > > > > > > > > > Configured with self-signed wild-card certs, originally > > > > configured (using openssl 0.9.8) on mm-server2 and exported to > > > > the other servers. > > > > > > > > > > > > > > > > When running ldapmodify, ldapsearch, etc with a "-Z", and > > > > openssl s_client on mm-server1 or mm-server3 or any client > > > > pointing back to mm-server1 or 3, I receive the following error: > > > > > > > > > > > > > > > > TLS certificate verification: Error, self signed certificate > > > > > > > > TLS: can't connect: error:14090086:SSL > > > > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed > > > > (self signed certificate). > > > > > > > > ldap_start_tls: Connect error (-11) > > > > > > > > additional info: error:14090086:SSL > > > > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed > > > > (self signed certificate) > > > > > > > > > > > > > > > > Running any of those to mm-server2, it works with no such error. > > > > > > > > > > > > > > > > I am guessing, that since the certs were created on mm-server2, > > > > originally, that is why it works this way. Also, guessing I > > > > missed a step somewhere. > > > > > > > > > > > > > > > > I read online a post from 2005 with a good explanation of > > > > self-signed from Howard Chu about a similar problem. > > > > > > > > > > > > > > > > What is the best procedure for creating wild-card certs and > > > > sharing those out to other servers? The procedure that was > > > > used was from openssl.org so it was not a fly-by-night weblog. > > > > > > > > > > > > > > > > What did I miss (besides: a lot)? > > > > > > > > > > > > > > > > Thanks in advance, > > > > > > > > > > > > > > > > > > > > > > > > John D. Borresen (Dave) > > > > > > > > Linux/Unix Systems Administrator > > > > > > > > MIT Lincoln Laboratory > > > > > > > > Surveillance Systems Group > > > > > > > > 244 Wood St > > > > > > > > Lexington, MA 02420 > > > > > > > > Ph: (781) 981-1609 > > > > > > > > Email: john.borresen(a)ll.mit.edu > > > > > > > > > > > > > > > > > > > > > > > > -- > > > Dieter Klünter | Systemberatung > > > http://sys4.de > > > GPG Key ID: E9ED159B > > > 53°37'09,95"N > > > 10°08'02,42"E > > > > > > > > > > > -- > > Dieter Klünter | Systemberatung > > http://sys4.de > > GPG Key ID: E9ED159B > > 53°37'09,95"N > > 10°08'02,42"E > > > > -- > Dieter Klünter | Systemberatung > http://sys4.de > GPG Key ID: E9ED159B > 53°37'09,95"N > 10°08'02,42"E -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

2 8

LMDB test assertion failures on Linux/MIPS
by Martin Lucina 11 Mar '14

11 Mar '14

Hi, I've recently started using LMDB in a new project targeted to MIPS (and later also ARM) architectures. While developing my storage code I found that test cases which execute perfectly on x86 were failing with assertions inside LMDB on mips and mipsel devices. Investigating further, I've found that the "mtest" test program included with LMDB also fails. Specifically, the failures I'm seeing are any of the following: mdb.c:2635: Assertion 'pglast <= env->me_pglast' failed in mdb_freelist_save() or mdb.c:5100: Assertion 'IS_BRANCH(mc->mc_pg[mc->mc_top])' failed in mdb_cursor_sibling() or mdb.c:5176: Assertion 'IS_LEAF(mp)' failed in mdb_cursor_next() or mdb.c:1713: Assertion 'rc == 0' failed in mdb_page_dirty() etc. The failures are intermittent in that there's about a 50% chance mtest will complete successfully. The line numbers are against LMDB 0.9.11 source. Target devices and toolchain combinations I have tried (all fail): - mips-sf-linux-musl cross compilers from musl.codu.org, musl libc 0.9.15. Atheros AR9344 cpu, OpenWRT trunk (Linux 3.10.28). - mipsel-sf-linux-musl cross compilers from musl.codu.org, musl libc 0.9.15, Broadcom BCM4706, Tomato firmware by "shibby" (Linux 2.6.22.x based on ASUS SDK). In all cases the code fails both with and without optimization, and is compiled as a static executable. Consulting with a friend who is also developing on MIPS devices he said he ran into similar problems when trying LMDB. He suggested that I check for problems with unaligned memory accesses; indeed compiling LMDB with -Wcast-align produces many warnings regarding such accesses. My knowledge of LMDB and MIPS internals is not up to debugging this but it seems like unaligned accesses may(?) be the underlying cause. What is the status of LMDB on MIPS? Has anyone tried it? Any help would be much appreciated. Martin

4 16

open(ldap|ssh) interaction
by Doug OLeary 11 Mar '14

11 Mar '14

Hey; When using local accounts, ssh honors password expiration even if using public key authentication. This is the case at least on HPUX, Solaris, and various flavors of Linux. This is a good thing. I won't go through all the security reasons why passwords should periodically change. Suffice to say that they should and most companies have policies regarding password expiration. When using openldap, however, if a user is configured to use public key authentication, he is allowed access to the account regardless of the password aging and/or pwdReset parameter. Is there a way to force openssh to honor these settings like it does for local accounts? Test environment is centos6.5 running on a kvm tying into an openldap server ver 2.4.23. My test environment is certainly following the symptoms of my client's unboundid server supporting a variety of linux platforms - all rhel based - from ver 4 through 6. Any help greatly appreciated. Doug O'Leary ------------ Senior UNIX/Security Admin CISSP, CISA, RHCSA, CEH O'Leary Computers Inc dkoleary(a)olearycomputers.com (w) 630-904-6098 (c) 630-248-2749 linkedin: http://www.linkedin.com/in/dkoleary resume: http://www.olearycomputers.com/resume.html

6 8

LMDB and FD_CLOEXEC
by Martin Lucina 11 Mar '14

11 Mar '14

Hi, is there any particular reason for MDB setting FD_CLOEXEC *only* on me->lfd? I can't see why it should not set it for the other fds it opens, as IMO it doesn't make sense to hang onto the fds after exec() -- the mmap will be gone in any case. Martin

2 4

Stuck with SSL issue
by saurabh ohri 11 Mar '14

11 Mar '14

Hi All, my ldapsearch and other things were working perfectly fine but not sure what happened now. Seem some SSL issue. When i am doing ldapsearch i am getting below error. [root@xxx-xxx-xxx etc]# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f /usr/local/openldap/dit.ldif -H ldaps://xxx-xxx-xxx.example.com Enter LDAP Password: ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Logs error: TLS trace: SSL_accept:SSLv3 flush data tls_read: want=5 error=Resource temporarily unavailable TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A 531ecbee daemon: activity on 1 descriptor 531ecbee daemon: activity on:531ecbee 531ecbee daemon: epoll: listen=7 active_threads=0 tvp=zero 531ecbee daemon: activity on 1 descriptor 531ecbee daemon: activity on:531ecbee 11r531ecbee 531ecbee daemon: read active on 11 531ecbee daemon: epoll: listen=7 active_threads=0 tvp=zero 531ecbee connection_get(11) 531ecbee connection_get(11): got connid=1000 531ecbee connection_read(11): checking for input on id=1000 tls_read: want=5, got=5 0000: 15 03 01 00 02 ..... tls_read: want=2, got=2 0000: 02 30 .0 TLS trace: SSL3 alert read:fatal:unknown CA ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca. 531ecbee connection_read(11): TLS accept failure error=-1 id=1000, closing 531ecbee connection_closing: readying conn=1000 sd=11 for close 531ecbee connection_close: conn=1000 sd=11 531ecbee daemon: removing 11 531ecbee daemon: activity on 1 descriptor 531ecbee daemon: activity on:531ecbee 531ecbee daemon: epoll: listen=7 active_threads=0 tvp=zero Please suggest. Regards Sam

4 4

RE: TLS QUESTION
by Borresen, John - 0442 - MITLL 11 Mar '14

11 Mar '14

Guten morgen Dieter; I ran the openssl commands indicated below. But, ran them against my cacert.pem -- both the original and new successfully (they failed with servercrt.pem). I re-ran the CA.sh script this morning, and receiving the following errors when creating a new CA: Certificate is to be certified until Mar 8 13:09:05 2024 GMT (3650 days) failed to update database TXT_DB error number 2 -----Original Message----- From: Dieter Klünter [mailto:dieter@dkluenter.de] Sent: Monday, March 10, 2014 5:12 PM To: Borresen, John - 0442 - MITLL Subject: Re: TLS QUESTION Am Mon, 10 Mar 2014 16:55:04 -0400 schrieb "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu>: > Vielen Danke Dieter; > > Originally my command to create the client.pem was: > > grep -A 100 CERTIFICATE cacert.pem > client.pem > > Then I scp'd that out to the clients. That worked when doing SSL on > port 636 (and not wild-card certificates), but it is not working now > on TLS over 389 to mm-server1 and mm-server3 with wild-card certs. > > The cacert.pem and client.pem is on each client. > > Doing further reading...the client.pem since it was built off the > cacert.pem (the server certificate) it should work. > > Should I use the cacert.pem or the servercrt.pem to create the > client.pem? Test this on each host openssl verify -CAfile path/to/ca client.pem servercert.pem openssl x509 -in servercert.pem -noout -text check for Common Name -Dieter > > > > > > -----Original Message----- > From: Dieter Klünter [mailto:dieter@dkluenter.de] > Sent: Monday, March 10, 2014 2:41 PM > To: Borresen, John - 0442 - MITLL > Subject: Re: TLS QUESTION > > Am Mon, 10 Mar 2014 13:33:53 -0400 > schrieb "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu>: > > > Thanks Dieter... > > > > As I stated I saw Howard Chu's response to an individual in 2005 > > with a similar issue and he stated then, " For the slapd server you > > use the corresponding TLSCACertificateFile directive. You must use > > these configuration directives if you want to accept a self-signed > > cert." > > > > I did add the olcTLSCACertificateFile attribute (just forgot to list > > it in my original post). Was not certain at the time if the > > "olcTLSCertificateFile" should be removed so I did not remove it. > > So, before I do remove it, the attribute should be > > "olcTLSCACertificateFile" instead of "olcTLSCertificateFile" (and > > this should be removed), correct? > > > > The CA directories on all three servers look like this: > > > > # ll > > total 28 > > lrwxrwxrwx 1 root root 10 Jan 24 11:44 600f07a1.0 -> cacert.pem > > --> client hash -rw-r--r-- 1 ldap ldap 5136 Jan 17 12:15 cacert.pem > > --> Self-signed certificate -rw-r--r-- 1 ldap ldap 1090 Jan 17 > > 12:07 cert.csr --> Certificate Signing Request -rw-r--r-- 1 ldap > > ldap 1757 Jan 17 12:23 client.pem --> Client Certificate PEM > > -rw-r--r-- 1 ldap ldap 0 Jan 14 16:20 index.txt drwxr-xr-x 2 > > ldap ldap 4096 Jan 14 16:18 newcerts (empty) drwxr-xr-x 2 ldap ldap > > 4096 Jan 17 12:06 private --> server private key directory > > (cakey.pem) -rw-r--r-- 1 ldap ldap 3 Jan 17 11:59 serial > > This may sound like a dumb question... > > > > I created the client.pem from the cacert.pem (as indicated on > > openssl.org) then copied that to each client. Is there a step I > > missed in there? > > Yes, you have to create a client certificate for each host, while the > Common Name must match the FQDN of this host. my blog entry may be of > help: > > https://sys4.de/de/blog/2013/08/20/how-create-and-administer-x509-cert > ificate-chains-part-i > > -Dieter > > > If so, where? > > > > Thanks in advance > > > > John > > -----Original Message----- > > From: openldap-technical-bounces(a)OpenLDAP.org > > [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Dieter > > Klünter Sent: Monday, March 10, 2014 12:58 PM To: > > openldap-technical(a)openldap.org Subject: Re: TLS QUESTION > > > > Am Mon, 10 Mar 2014 11:18:14 -0400 > > schrieb "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu>: > > > > > All, > > > > > > > > > > > > My set up consists of three servers each syncing with each other. > > > The host names are: > > > > > > 1) mm-server1.example.ldap > > > > > > 2) mm-server2.example.ldap > > > > > > 3) mm-server3.example.ldap > > > > > > > > > > > > Utilizing TLSv1, on all three I have: > > > > > > olcTLSCertificateFile: > > > /usr/local/openldap/etc/openldap/CA/cacert.pem > > > > this should be opcTLSCAcertificateFile > > > > > > > > olcTLSCertificateKeyFile: > > > /usr/local/openldap/etc/openldap/CA/private/cakey.pem > > > > you are misssing the host certificate, something like > > olcTLSCertificateFile /usr/local/openldap/etc/openldap/CA/host.pem > > > > > > > > olcTLSCipherSuite: HIGH:MEDIUM+TLSv1+SSLv3 > > > > > > > > > > > > Configured with self-signed wild-card certs, originally configured > > > (using openssl 0.9.8) on mm-server2 and exported to the other > > > servers. > > > > > > > > > > > > When running ldapmodify, ldapsearch, etc with a "-Z", and openssl > > > s_client on mm-server1 or mm-server3 or any client pointing back > > > to mm-server1 or 3, I receive the following error: > > > > > > > > > > > > TLS certificate verification: Error, self signed certificate > > > > > > TLS: can't connect: error:14090086:SSL > > > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed > > > (self signed certificate). > > > > > > ldap_start_tls: Connect error (-11) > > > > > > additional info: error:14090086:SSL > > > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed > > > (self signed certificate) > > > > > > > > > > > > Running any of those to mm-server2, it works with no such error. > > > > > > > > > > > > I am guessing, that since the certs were created on mm-server2, > > > originally, that is why it works this way. Also, guessing I > > > missed a step somewhere. > > > > > > > > > > > > I read online a post from 2005 with a good explanation of > > > self-signed from Howard Chu about a similar problem. > > > > > > > > > > > > What is the best procedure for creating wild-card certs and > > > sharing those out to other servers? The procedure that was used > > > was from openssl.org so it was not a fly-by-night weblog. > > > > > > > > > > > > What did I miss (besides: a lot)? > > > > > > > > > > > > Thanks in advance, > > > > > > > > > > > > > > > > > > John D. Borresen (Dave) > > > > > > Linux/Unix Systems Administrator > > > > > > MIT Lincoln Laboratory > > > > > > Surveillance Systems Group > > > > > > 244 Wood St > > > > > > Lexington, MA 02420 > > > > > > Ph: (781) 981-1609 > > > > > > Email: john.borresen(a)ll.mit.edu > > > > > > > > > > > > > > > > > -- > > Dieter Klünter | Systemberatung > > http://sys4.de > > GPG Key ID: E9ED159B > > 53°37'09,95"N > > 10°08'02,42"E > > > > > > -- > Dieter Klünter | Systemberatung > http://sys4.de > GPG Key ID: E9ED159B > 53°37'09,95"N > 10°08'02,42"E -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

1 0

RE: TLS QUESTION
by Borresen, John - 0442 - MITLL 11 Mar '14

11 Mar '14

Vielen Danke Dieter; Originally my command to create the client.pem was: grep -A 100 CERTIFICATE cacert.pem > client.pem Then I scp'd that out to the clients. That worked when doing SSL on port 636 (and not wild-card certificates), but it is not working now on TLS over 389 to mm-server1 and mm-server3 with wild-card certs. The cacert.pem and client.pem is on each client. Doing further reading...the client.pem since it was built off the cacert.pem (the server certificate) it should work. Should I use the cacert.pem or the servercrt.pem to create the client.pem? Thanks, John -----Original Message----- From: Dieter Klünter [mailto:dieter@dkluenter.de] Sent: Monday, March 10, 2014 2:41 PM To: Borresen, John - 0442 - MITLL Subject: Re: TLS QUESTION Am Mon, 10 Mar 2014 13:33:53 -0400 schrieb "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu>: > Thanks Dieter... > > As I stated I saw Howard Chu's response to an individual in 2005 with > a similar issue and he stated then, " For the slapd server you use the > corresponding TLSCACertificateFile directive. You must use these > configuration directives if you want to accept a self-signed cert." > > I did add the olcTLSCACertificateFile attribute (just forgot to list > it in my original post). Was not certain at the time if the > "olcTLSCertificateFile" should be removed so I did not remove it. > So, before I do remove it, the attribute should be > "olcTLSCACertificateFile" instead of "olcTLSCertificateFile" (and this > should be removed), correct? > > The CA directories on all three servers look like this: > > # ll > total 28 > lrwxrwxrwx 1 root root 10 Jan 24 11:44 600f07a1.0 -> cacert.pem --> > client hash -rw-r--r-- 1 ldap ldap 5136 Jan 17 12:15 cacert.pem --> > Self-signed certificate -rw-r--r-- 1 ldap ldap 1090 Jan 17 12:07 > cert.csr --> Certificate Signing Request -rw-r--r-- 1 ldap ldap 1757 > Jan 17 12:23 client.pem --> Client Certificate PEM -rw-r--r-- 1 ldap > ldap 0 Jan 14 16:20 index.txt drwxr-xr-x 2 ldap ldap 4096 Jan 14 > 16:18 newcerts (empty) drwxr-xr-x 2 ldap ldap 4096 Jan 17 12:06 > private --> server private key directory (cakey.pem) -rw-r--r-- 1 > ldap ldap 3 Jan 17 11:59 serial > This may sound like a dumb question... > > I created the client.pem from the cacert.pem (as indicated on > openssl.org) then copied that to each client. Is there a step I > missed in there? Yes, you have to create a client certificate for each host, while the Common Name must match the FQDN of this host. my blog entry may be of help: https://sys4.de/de/blog/2013/08/20/how-create-and-administer-x509-certifica… -Dieter > If so, where? > > Thanks in advance > > John > -----Original Message----- > From: openldap-technical-bounces(a)OpenLDAP.org > [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Dieter > Klünter Sent: Monday, March 10, 2014 12:58 PM To: > openldap-technical(a)openldap.org Subject: Re: TLS QUESTION > > Am Mon, 10 Mar 2014 11:18:14 -0400 > schrieb "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu>: > > > All, > > > > > > > > My set up consists of three servers each syncing with each other. > > The host names are: > > > > 1) mm-server1.example.ldap > > > > 2) mm-server2.example.ldap > > > > 3) mm-server3.example.ldap > > > > > > > > Utilizing TLSv1, on all three I have: > > > > olcTLSCertificateFile: > > /usr/local/openldap/etc/openldap/CA/cacert.pem > > this should be opcTLSCAcertificateFile > > > > > olcTLSCertificateKeyFile: > > /usr/local/openldap/etc/openldap/CA/private/cakey.pem > > you are misssing the host certificate, something like > olcTLSCertificateFile /usr/local/openldap/etc/openldap/CA/host.pem > > > > > olcTLSCipherSuite: HIGH:MEDIUM+TLSv1+SSLv3 > > > > > > > > Configured with self-signed wild-card certs, originally configured > > (using openssl 0.9.8) on mm-server2 and exported to the other > > servers. > > > > > > > > When running ldapmodify, ldapsearch, etc with a "-Z", and openssl > > s_client on mm-server1 or mm-server3 or any client pointing back to > > mm-server1 or 3, I receive the following error: > > > > > > > > TLS certificate verification: Error, self signed certificate > > > > TLS: can't connect: error:14090086:SSL > > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self > > signed certificate). > > > > ldap_start_tls: Connect error (-11) > > > > additional info: error:14090086:SSL > > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self > > signed certificate) > > > > > > > > Running any of those to mm-server2, it works with no such error. > > > > > > > > I am guessing, that since the certs were created on mm-server2, > > originally, that is why it works this way. Also, guessing I missed > > a step somewhere. > > > > > > > > I read online a post from 2005 with a good explanation of > > self-signed from Howard Chu about a similar problem. > > > > > > > > What is the best procedure for creating wild-card certs and sharing > > those out to other servers? The procedure that was used was from > > openssl.org so it was not a fly-by-night weblog. > > > > > > > > What did I miss (besides: a lot)? > > > > > > > > Thanks in advance, > > > > > > > > > > > > John D. Borresen (Dave) > > > > Linux/Unix Systems Administrator > > > > MIT Lincoln Laboratory > > > > Surveillance Systems Group > > > > 244 Wood St > > > > Lexington, MA 02420 > > > > Ph: (781) 981-1609 > > > > Email: john.borresen(a)ll.mit.edu > > > > > > > > > > -- > Dieter Klünter | Systemberatung > http://sys4.de > GPG Key ID: E9ED159B > 53°37'09,95"N > 10°08'02,42"E > -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

2 1

Re: RE : Re: ppolicy not verifying password length (not active !!)
by saurabh ohri 11 Mar '14

11 Mar '14

Thanks David, Self Service Password Also please suggest if the entry for TLS cert need to be made at /etc/ldap.conf or /etc/openldap/ldap.conf or /usr/local/openldap/etc/openldap/ldap.conf(This is the default one with ltb openldap) and can I put file name with publickey.pem. Please suggest with the parameter as default suggest in doc not working. Regards Sam On Tuesday, 11 March 2014 3:58 PM, David Coutadeur <dcoutadeur(a)linagora.com> wrote: Password policy overlay is available by default in the main openldap ltb package. Just use it via the configuration. No need to load the module. You could also need the check-password addon for the ppolicy overlay, available in a separate rpm: openldap-ltb-check-password David -------- Message d'origine -------- De : saurabh ohri Date :11/03/2014 05:49 (GMT+01:00) A : Quanah Gibson-Mount ,Patrick Laimbock ,openldap-technical(a)openldap.org Objet : Re: ppolicy not verifying password length (not active !!) Hi quanah/Patrick, I installed openldap ltb project on a new server as mentioned and following are the list of packages which are currently present but still cannot see ppolicy.la in my system, [root@xxx-xxx-xxx ~]# rpm -qa|grep openldap openldap-ltb-debuginfo-2.4.39-2.el6.x86_64 openldap-clients-2.4.23-34.el6_5.1.x86_64 openldap-2.4.23-34.el6_5.1.x86_64 openldap-ltb-check-password-1.1-8.el6.x86_64 openldap-ltb-2.4.39-2.el6.x86_64 openldap-ltb-contrib-overlays-2.4.39-2.el6.x86_64 Please suggest. Is that i am doing something wrong? Regards Sam On Tuesday, 11 March 2014 10:07 AM, saurabh ohri <sam_ohri(a)yahoo.co.in> wrote: Thanks Quanah for the reply. Does that mean that i need to rebuild the openldap server or just download the ppolicy.la for 2.4.39 version. I installed openldap-ltb-2.4.39-2.el6.x86_64 on rhel6.5. Please suggest. Regards Saurabh 9818925959 On Tuesday, 11 March 2014 12:59 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: --On Monday, March 10, 2014 4:22 PM +0800 saurabh ohri <sam_ohri(a)yahoo.co.in> wrote: > > > Thanks Patrick. It helped me to very much extend but again getting stuck > in pushing password policy on openldap. I got stuck in 2.4.23 and > upgraded to 2.4.39. But still it is an issue. > > Not able to found ppolicy.la in my system but copied the same from > previous version. Hope that id not effecting. That is not ok. You need to build ppolicy with your 2.4.39 build, and use that verison of the module. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

ppolicy not verifying password length (not active !!)
by Rodrigo Coutinho 11 Mar '14

11 Mar '14

Hi, I've installed the ppolicy overlay (static), included the shema, loaded the policy to the directory and define it as the default policy. However, to check the policy I've changed a user's password, below the minimum length specified by the policy, and no error was issued. I've used ldappasswd and Apache Directory Studio to change it and none issued no error. Although I did it with the root user, I suppose the policy should issue an error just the same, because I was changing another user's password. What am I missing, here ? Thank you in advance A transmiss�o de mensagens por e-mail n�o � absolutamente segura ou livre de erros. A mensagem pode ser intercetada, alterada, perdida, destru�da, chegar ao destinat�rio com atraso, ou mesmo com v�rus, n�o obstante o IFAP utilizar software anti-v�rus. Esta mensagem, incluindo eventuais ficheiros anexos, pode conter informa��o confidencial ou privilegiada e destina-se a uso exclusivo dos seus destinat�rios. Se n�o for o destinat�rio pretendido, informamos que a recebeu por engano, pelo que, qualquer utiliza��o, distribui��o, reencaminhamento ou outra forma de revela��o a terceiros, impress�o ou c�pia s�o expressamente proibidos. Se recebeu esta mensagem por engano, por favor contacte imediatamente o remetente por e-mail, e apague de imediato a mensagem do seu sistema inform�tico. O IFAP declina qualquer responsabilidade por erros ou omiss�es na presente mensagem e eventuais consequ�ncias, que resultem das situa��es referidas.

8 20

TLS QUESTION
by Borresen, John - 0442 - MITLL 10 Mar '14

10 Mar '14

All, My set up consists of three servers each syncing with each other. The host names are: 1) mm-server1.example.ldap 2) mm-server2.example.ldap 3) mm-server3.example.ldap Utilizing TLSv1, on all three I have: olcTLSCertificateFile: /usr/local/openldap/etc/openldap/CA/cacert.pem olcTLSCertificateKeyFile: /usr/local/openldap/etc/openldap/CA/private/cakey.pem olcTLSCipherSuite: HIGH:MEDIUM+TLSv1+SSLv3 Configured with self-signed wild-card certs, originally configured (using openssl 0.9.8) on mm-server2 and exported to the other servers. When running ldapmodify, ldapsearch, etc with a "-Z", and openssl s_client on mm-server1 or mm-server3 or any client pointing back to mm-server1 or 3, I receive the following error: TLS certificate verification: Error, self signed certificate TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self signed certificate). ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self signed certificate) Running any of those to mm-server2, it works with no such error. I am guessing, that since the certs were created on mm-server2, originally, that is why it works this way. Also, guessing I missed a step somewhere. I read online a post from 2005 with a good explanation of self-signed from Howard Chu about a similar problem. What is the best procedure for creating wild-card certs and sharing those out to other servers? The procedure that was used was from openssl.org so it was not a fly-by-night weblog. What did I miss (besides: a lot)? Thanks in advance, John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu

2 2

user can't login via LDAP
by Tim Dunphy 09 Mar '14

09 Mar '14

Hey all, I'm trying to get down to the bottom of a slight mystery we're having. We have a situation where some account stored in LDAP (using openldap) can log into some hosts but not others using their LDAP account information. To demonstrate, I take one of the users who is trying to login and verify that he does not have a local account on the target computer: [root@monitor:~] #grep spencer /etc/passwd [root@monitor:~] # [root@monitor:~] #id spencer id: spencer: No such user But the user should have the ability to login via their LDAP account: [root@monitor:~] #getent passwd | grep spencer spencer :*:10002:5000:Spencer Brown :/home/spencer:/bin/bash But when I attempt to log into the host using his password (this is a test account and I know the password) I get permission denied: [me@home:~/creds] #ssh spencer(a)monitor.jokefire.com spencer(a)monitor.jokefire.com's password: Permission denied, please try again. spencer(a)monitor.jokefire.com's password: Permission denied, please try again. spencer(a)monitor.jokefire.com's password: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password). And in the 'secure' log file on the host I'm trying to log into I see the following: Mar 9 10:43:02 monitor sshd[23137]: Invalid user spencer from xx.xx.xx.xx Mar 9 10:43:02 monitor sshd[23138]: input_userauth_request: invalid user spencer Mar 9 10:43:06 monitor sshd[23137]: pam_unix(sshd:auth): check pass; user unknown Mar 9 10:43:06 monitor sshd[23137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost= ool-182e9727.dyn.optonline.net Mar 9 10:43:06 monitor sshd[23137]: pam_succeed_if(sshd:auth): error retrieving information about user spencer Mar 9 10:43:08 monitor sshd[23137]: Failed password for invalid user spencer from xx.xx.xx.xx port 59017 ssh2 Mar 9 10:43:11 monitor sshd[23137]: pam_unix(sshd:auth): check pass; user unknown Mar 9 10:43:11 monitor sshd[23137]: pam_succeed_if(sshd:auth): error retrieving information about user spencer Mar 9 10:43:13 monitor sshd[23137]: Failed password for invalid user spencer from xx.xx.xx.xx port 59017 ssh2 Mar 9 10:43:14 monitor sshd[23496]: Connection closed by xx.xx.xx.xx Mar 9 10:43:15 monitor sshd[23137]: pam_unix(sshd:auth): check pass; user unknown Mar 9 10:43:15 monitor sshd[23137]: pam_succeed_if(sshd:auth): error retrieving information about user spencer Mar 9 10:43:17 monitor sshd[23137]: Failed password for invalid user spencer from xx.xx.xx.xx port 59017 ssh2 Mar 9 10:43:17 monitor sshd[23138]: Connection closed by xx.xx.xx.xx Mar 9 10:43:17 monitor sshd[23137]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=ool-182e9727.dyn.optonline.net Mar 9 10:43:20 monitor sshd[23717]: Connection closed by xx.xx.xx.xx Yet if I try logging in with another test account on the same host that denied 'spencer' I am able to. The other account I'm testing with is called 'leo': [walkiriasoares@wal-mac:~/creds] #ssh leo(a)monitor.jokefire.com leo(a)monitor.jokefire.com's password: Last login: Sun Mar 9 10:32:52 2014 from ool-xxxx.dyn.optonline.net ,--,------,--. ,--. ,--. ,--. ,--. | | .---| `.' |,---.,--,--,,-' '-`--,-' '-.,---.,--.--. ,--. | | `--,| |'.'| | .-. | '-. .-,--'-. .-| .-. | .--' | '-' | |` | | | ' '-' | || | | | | | | | ' '-' | | `-----'`--' `--' `--'`---'`--''--' `--' `--' `--' `---'`--' [leo@monitor ~]$ And I am able to verify that 'leo' does not have a local account: [root@monitor:~] #grep leo /etc/passwd [root@monitor:~] # However I can get a unix id on this account: [root@monitor:~] #id leo uid=10005(leo) gid=5000(admins) groups=5000(admins) And getent also shows that he is has an account: [root@monitor:~] #getent passwd | grep leo leo:*:10005:5000:Leo Demo :/home/leo:/bin/bash However if I shift gears and try to log into the Ldap server itself (using the same passwords), I can with both accounts. [me@home:~] #ssh -qt spencer(a)ldap01.example.com spencer(a)ldap01.example.com's password: Welcome to Ubuntu 12.04.3 LTS (GNU/Linux 3.2.0-54-virtual x86_64) [me@home~] #ssh -qt leo(a)ldap01.example.com leo(a)ldap01.example.com's password: Welcome to Ubuntu 12.04.3 LTS (GNU/Linux 3.2.0-54-virtual x86_64) Again I can verify that neither account is local to the ldap server: [root@ldap01:~] #egrep "(spencer|leo)" /etc/passwd [root@ldap01:~] # Here's what my nsswitch looks like on the monitoring host (where spencer can't login but leo can): [root@monitor:~] #grep -v "#" /etc/nsswitch.conf passwd: files sss shadow: files sss group: files sss hosts: files dns bootparams: nisplus [NOTFOUND=return] files ethers: files netmasks: files networks: files protocols: files rpc: files services: files sss netgroup: files sss publickey: nisplus automount: files ldap aliases: files nisplus And here is the /etc/pam.d/password-auth-ac file: [root@monitor:~] #grep -v "#" /etc/pam.d/password-auth-ac auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_sss.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so And here's the /etc/pam.d/system-auth-ac on the target host: [root@monitor:~] #grep -v "#" /etc/pam.d/system-auth-ac auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_sss.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so I'm just wondering if there might be a problem in the config or what I can possibly do to nail down the source of the problem. Thanks Tim -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

2 1

Works with ldapsearch, but can't get it to work with ldap_search_ext_s()
by Werner - Google 09 Mar '14

09 Mar '14

Hi, Trying to get a ldapclient to authenticate against it, but having a difficult time trying to figure out what i'm doing wrong. Would appreciate any tip/help pointing me in the correct direction. Company has a Microsoft Active Directory structure, like domain.com region_a users john.doe marcus.zap servers ... ... region_b users magaly.frap roger.smith ... servers ... ... Testing with ldapsearch, it works fine, returning the entry of john.doe, if i do a: >$ ldapsearch -v -h ldap_srv -p 389 -s sub -z 2 -l 15 -D auth_dn -w pass_dn -b "DC=domain,DC=com" "(sAMAccountName=john.doe)" sAMAccountName :: for info >$ldapsearch -VV ldapsearch: @(#) $OpenLDAP: ldapsearch 2.4.28 (Jul 4 2013 21:48:28) $ root(a)b1026.apple.com: /private/var/tmp/OpenLDAP/OpenLDAP-208.5~1/clients/tools (LDAP library: OpenLDAP 20428) ========= But with a simple code (extract bellow), on the same machine as the ldapsearch above, i'm unable to make it work. .... struct timeval timeOut = {15,0}; /* 15 second connection timeout */ char *attrs[] = {"sAMAccountName", NULL}; if ( (ld = ldap_init( "ldap_srv", 389 )) == NULL ) { return( 1 ); /* error */ } /* Bind with credentials to the LDAP server. */ rc = ldap_simple_bind_s( ld, auth_dn, pass_dn ); if ( rc != LDAP_SUCCESS ) { return( 1 ); /* error */ } /* Search for the entry. */ fprintf(stderr, "ldap_simple_bind_s(): Entering...\n"); rc = ldap_search_ext_s( ld, "DC=domain,DC=com", LDAP_SCOPE_SUBTREE, "(sAMAccountName=john.doe)", NULL, 0, NULL, NULL, &timeOut, 2, &result ); fprintf(stderr, "ldap_simple_bind_s(): after. rc=%d...\n", rc); ... ... :::::: The ldap_init(), ldap_simple_bind_s(), both work correctly. The call to: ldap_search_ext_s( ld, "DC=domain,DC=com", .... does never come back from the function call, i have waited for more than one hour. I never get the 2nd fprintf(...) Another point, should the ldap_search_ext_s() not return with an error after the defined "timeOut" (in my case 15 seconds) ? But, if i change the 2nd parameter (base dn) from: "DC=domain,DC=com" to "OU=region_a,DC=domain,DC=com", it works fine, returning the entry for john.doe in a few seconds. As i need to check users inside all of the "regions", i can't have the OU=region on the base search, because if i use it with OU=region_a,dc=domain,dc=com i'm not able to find the users from region_b, as expected :) Any tips to help me figure out what i'm doing wrong? Thanks werner

3 4

How get more detailed error information than the provided by ldap_err2string?
by Werner - Google 09 Mar '14

09 Mar '14

Hi, I've the sample code bellow, and when i intentionally put the wrong credentials, i get from "ldap_err2string( rc ) the error message: "Invalid credentials". But monitoring network traffic with wireshark, i can see that on the bindResponse packet that returns from the server, i also get a more detailed message. In my/this test case, "errorMessage: 80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 525, v1772" attached is also an image of the wireshark showing what i mean. Question is, is there a way i could retrieve this more detailed message? Thanks in advance for any help Regards. --- sample code: if ( (ld = (LDAP *)ldap_init( pHostName, iPortNum )) == NULL ) { perror( "ldap_init failed. Reason?:" ); exit ( 1 ); } if ( (rc=ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version)) != LDAP_SUCCESS ){ fprintf( stderr, "ldap_set_option(LDAP_OPT_PROTOCOL_VERSION): %s\n", ldap_err2string( rc ) ); exit( 1 ); } if ( (rc=ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF)) != LDAP_SUCCESS){ fprintf( stderr, "ldap_set_option(LDAP_OPT_REFERRALS): %s\n", ldap_err2string( rc )); exit( 1 ); } rc = ldap_simple_bind_s( ld, "auth_dn", "auth_pw" ); if ( rc != LDAP_SUCCESS ) { fprintf( stderr, "ldap_simple_bind_s() Failed: %s [%d]\n", ldap_err2string(rc), rc); ldap_unbind_s(ld); /* try unbind the failed connection anyway */ exit ( 1 ); }

4 6

Context around DNS resolution
by Joshua Schaeffer 09 Mar '14

09 Mar '14

I setup LDAPS (yes, will be switching to ldap + StartTLS) and ran intosomething odd and I'm really just looking for a bit of context. Everything is working correctlyand I'm able to authenticate clients to the ldap server, however when I runthe following ldapsearch I get an error: jschaeffer@zipmaster07:~$ ldapsearch -LLL -v -D cn=admin,dc=harmonywave,dc=com -W -H ldaps://baneling -b uid=jschaeffer,ou=People,dc=harmonywave,dc=com ldap_initialize( ldaps://baneling:636/??base ) Enter LDAP Password: ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) And from the debug output: 531c7c0a ber_get_next on fd 12 failed errno=0 (Success) 531c7c0a conn=1000 op=1 do_unbind 531c7c0a connection_close: conn=1000 sd=12 531c7c18 slap_listener_activate(6): 531c7c18 >>> slap_listener(ldaps:///) 531c7c18 connection_get(12): got connid=1001 531c7c18 connection_read(12): checking for input on id=1001 531c7c18 connection_get(12): got connid=1001 531c7c18 connection_read(12): checking for input on id=1001 531c7c18 connection_read(12): unable to get TLS client DN, error=49 id=1001 531c7c18 connection_get(12): got connid=1001 531c7c18 connection_read(12): checking for input on id=1001 ber_get_next 531c7c18 ber_get_next on fd 12 failed errno=0 (Success) 531c7c18 connection_close: conn=1001 sd=12 If I use the FQDN for the URI then everything works fine and I get results. I know DNS is working correctly, I can ping the server name and it returns the FQDN and reverse DNS resolution also works. The hostname and hostname -f commands work correctly on both client and server. Was it never intended for ldap commands to resolve server names to their FQDN? I'm also assuming that ldap + StartTLS would show the same behavior.

2 1

ldapdelete failing
by Tim Dunphy 08 Mar '14

08 Mar '14

Hello, I'm trying to delete an entry in my ldap database. But when issuing this command I am getting an error: [root@ldap01:~/ldap] #ldapdelete -v -x 'dn: uid=spencer,ou=People,dc=example,dc=com' -D cn=admin,dc=example,dc=com -W ldap_initialize( <DEFAULT> ) Enter LDAP Password: deleting entry "dn: uid=spencer,ou=People,dc=example,dc=com" ldap_delete: Invalid DN syntax (34) additional info: invalid DN I find it strange to be getting an 'invalid dn' error as the dn I'm using in the delete command was pulled straight form an ldapsearch: root@ldap01:~/ldap] #ldapsearch -x -LLL -b dc=example,dc=com 'uid=spencer' dn dn: uid=spencer,ou=People,dc=example,dc=com It was a straight copy paste, so I am unsure of why I might be getting this error. Could I please get some help on the syntax I'll need to get the command to work properly? Thank you, Tim -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

2 2

Client doesn't send certificate for LDAPS
by Joshua Schaeffer 08 Mar '14

08 Mar '14

I'm in the process of setting up my slapd server to operate over LDAPS and having trouble when using a CA certificate (being my own certificate authority). I've been able to setup LDAPS when using a self-signed server certificate: root@baneling:~# slapcat -H ldap:///cn=config??base dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: none olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: 0e827846-3926-1033-9f74-632898b715c9 creatorsName: cn=config createTimestamp: 20140306025210Z olcTLSCertificateFile: /etc/ssl/certs/ldap.harmonywave.com.crt olcTLSCertificateKeyFile: /etc/ssl/private/ldap.harmonywave.com.key olcTLSCipherSuite: SECURE256 olcTLSVerifyClient: never entryCSN: 20140308131751.026022Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20140308131751Z This works fine and I'm able to authenticate clients. However if I use a CA certificate (again, being my own CA) to sign my server certificate and then change olcTLSVerifyClient to demand and add olcTLSCACertificateFile then I can no longer authenticate. I've installed my CA certificate on the client machine and pointed both ldap.conf and nslcd.conf to the CA certificate. However I get the following when debugging: root@baneling:~# slapd -d conns -h ldaps:/// 531b1cef @(#) $OpenLDAP: slapd (Apr 23 2013 12:16:04) $ root@lupin:/tmp/buildd/openldap-2.4.31/debian/build/servers/slapd 531b1cf0 slapd starting 531b1cf0 daemon: added 3r listener=(nil) 531b1cf0 daemon: added 6r listener=0x7fe2d98326e0 531b1cf0 daemon: added 7r listener=0x7fe2d98327c0 531b1cf0 daemon: epoll: listen=6 active_threads=0 tvp=zero 531b1cf0 daemon: epoll: listen=7 active_threads=0 tvp=zero 531b1cf0 daemon: activity on 1 descriptor 531b1cf0 daemon: activity on:531b1cf0 531b1cf0 daemon: epoll: listen=6 active_threads=0 tvp=zero 531b1cf0 daemon: epoll: listen=7 active_threads=0 tvp=zero 531b1cf4 daemon: activity on 1 descriptor 531b1cf4 daemon: activity on:531b1cf4 531b1cf4 daemon: epoll: listen=6 busy 531b1cf4 daemon: epoll: listen=7 active_threads=0 tvp=zero 531b1cf4 daemon: activity on 1 descriptor 531b1cf4 daemon: activity on:531b1cf4 531b1cf4 daemon: epoll: listen=6 active_threads=0 tvp=zero 531b1cf4 daemon: epoll: listen=7 active_threads=0 tvp=zero 531b1cf4 daemon: listen=6, new connection on 12 531b1cf4 daemon: added 12r (active) listener=(nil) 531b1cf4 daemon: activity on 1 descriptor 531b1cf4 daemon: activity on:531b1cf4 12r531b1cf4 531b1cf4 daemon: read active on 12 531b1cf4 daemon: epoll: listen=6 active_threads=0 tvp=zero 531b1cf4 daemon: epoll: listen=7 active_threads=0 tvp=zero 531b1cf4 daemon: activity on 1 descriptor 531b1cf4 daemon: activity on:531b1cf4 531b1cf4 daemon: epoll: listen=6 active_threads=0 tvp=zero 531b1cf4 daemon: epoll: listen=7 active_threads=0 tvp=zero 531b1cf4 daemon: activity on 1 descriptor 531b1cf4 daemon: activity on:531b1cf4 531b1cf4 daemon: epoll: listen=6 active_threads=0 tvp=zero 531b1cf4 daemon: epoll: listen=7 active_threads=0 tvp=zero 531b1cf4 daemon: activity on 1 descriptor 531b1cf4 daemon: activity on:531b1cf4 12r531b1cf4 531b1cf4 daemon: read active on 12 531b1cf4 daemon: epoll: listen=6 active_threads=0 tvp=zero 531b1cf4 daemon: epoll: listen=7 active_threads=0 tvp=zero TLS: can't accept: The peer did not send any certificate.. 531b1cf4 connection_closing: readying conn=1000 sd=12 for close 531b1cf4 daemon: removing 12 531b1cf4 daemon: activity on 1 descriptor 531b1cf4 daemon: activity on:531b1cf4 Why would the client not send the certificate if I've pointed TLS_CACERT in ldap.confand tls_cacertfile to that cert? Maybe I'm misunderstanding the basic concepts here, I am pretty new to a lot of this. I'm using OpenLDAP 2.4.31, Debian 7, and GnuTLS. Yes, I'm aware of its recent critical security bug and the warnings against it from this group (http://www.openldap.org/lists/openldap-devel/200802/msg00072.html). Thanks, Joshua

3 3

User-Managed Groups
by Tim Gustafson 08 Mar '14

08 Mar '14

Hi, I've had OpenLDAP set up for a while now such that users can create groups and manage the groups that they've created. I've achieved this by creating a new objectClass (called "managedGroup") which adds the "manager" attribute, and then I've set up ACLs like this: olcAccess: {14}to dn.base="ou=Groups,dc=whatever" attrs=children by users add by * break olcAccess: {15}to dn.subtree="ou=Groups,dc=whatever" filter="(&(objectClass=posixGroup)(objectClass=managedGroup)(gidNumber>=1000))" attrs=entry by users add by * break olcAccess: {16}to dn.subtree="ou=Groups,dc=whatever" attrs=cn,manager,memberUid,description by set.exact="this/manager & user" write by * break I also have the "unique" overlay installed to prevent multiple groups from having the same "cn" or "gidNumber". I've got a request from users to be able to re-name their groups now too. I tried changing "by users add" to "by users write" in clause 14, and added the "entry" attribute to "attrs=" in clause 16, but the server is still not letting users re-name their groups. The output of the log file looks like this: slapd[44745]: => acl_get: [16] attr entry slapd[44745]: => acl_mask: access to entry "cn=test-1234,ou=Groups,dc=whatever", attr "entry" requested slapd[44745]: => acl_mask: to all values by "uid=g-guest,ou=people,dc=whatever", (=0) slapd[44745]: <= check a_dn_pat: users slapd[44745]: <= acl_mask: [1] applying add(=arscxd) (stop) slapd[44745]: <= acl_mask: [1] mask: add(=arscxd) slapd[44745]: => slap_access_allowed: write access denied by add(=arscxd) slapd[44745]: => access_allowed: no more rules What am I missing? -- Tim Gustafson tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A

3 2

Help with trying to setup RE: Issues with setting up multiple master
by Alex Samad - Yieldbroker 07 Mar '14

07 Mar '14

Hi Any one got any hints at what I can look at to fix this ? Alex > -----Original Message----- > From: Alex Samad - Yieldbroker > Sent: Wednesday, 5 March 2014 4:11 PM > To: 'openldap-technical(a)openldap.org' > Subject: Issues with setting up multiple master > > Hi > > So I am setting up multi master following the steps here > http://www.openldap.org/doc/admin24/replication.html 18.3.3 > > I have 2 nodes and not 3. > > I did this on the master > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 1 > > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcRootPW: secret > > and on the 2nd > > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 2 > > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcRootPW: secret > > > > I used a different password on each site . changed it to the same password > no > > > I did this > > dn: cn=config > changetype: modify > replace: olcServerID > olcServerID: 1 $URI1 > olcServerID: 2 $URI2 > > dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config > changetype: add > objectClass: olcOverlayConfig > objectClass: olcSyncProvConfig > olcOverlay: syncprov > > dn: olcDatabase={0}config,cn=config > changetype: modify > add: olcSyncRepl > olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" > bindmethod=simple > credentials=secret searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" > bindmethod=simple > credentials=secret searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=1 > - > add: olcMirrorMode > olcMirrorMode: TRUE > > > I am wondering why I did > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 2 > > if I am just going to do this > > dn: cn=config > changetype: modify > replace: olcServerID > olcServerID: 1 $URI1 > olcServerID: 2 $URI2 > > This is what I get on the second node > Mar 5 16:08:09 alcldap1 slapd[21296]: do_syncrep2: rid=001 got empty > syncUUID with LDAP_SYNC_ADD > Mar 5 16:08:09 alcldap1 slapd[21296]: do_syncrepl: rid=001 rc -1 retrying (4 > retries left) > Mar 5 16:08:14 alcldap1 slapd[21296]: do_syncrep2: rid=001 got empty > syncUUID with LDAP_SYNC_ADD > Mar 5 16:08:14 alcldap1 slapd[21296]: do_syncrepl: rid=001 rc -1 retrying (4 > retries left) > Mar 5 16:08:19 alcldap1 slapd[21296]: do_syncrep2: rid=001 got empty > syncUUID with LDAP_SYNC_ADD > > > And on the first node > Mar 5 16:09:27 gsldap1 slapd[11028]: do_syncrep2: rid=002 got empty > syncUUID with LDAP_SYNC_ADD > x > Mar 5 16:09:27 gsldap1 slapd[11028]: do_syncrepl: rid=002 rc -1 retrying (4 > retries left) x > > I have done manual ldapsearch from both boxes to the other boxes with the > credentials and it works > > > So now I am stuff. Had a quick google, but could find anything relevant. > > Help :) > > Oh I started with info in the db's already. Just a rsync ... > > Alex > > >

1 1

Slapd TLS issue
by Eric Falbe 07 Mar '14

07 Mar '14

Hi, When I try to start slapd I get this error message: Checking configuration files for slapd: [WARNING] PROXIED attributeDescription "DC" inserted. config file testing succeeded Starting slapd: @(#) $OpenLDAP: slapd 2.4.23 (Feb 3 2014 19:11:35) $ mockbuild(a)c6b10.bsys.dev.centos.org: /builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd PROXIED attributeDescription "DC" inserted. bdb_db_open: database "dc=cassens,dc=com": unclean shutdown detected; attempting recovery. bdb_db_open: database "cn=accesslog": unclean shutdown detected; attempting recovery. slapd starting TLS: error: the certificate '/etc/pki/tls/certs/ldap.cassens.com.pem' could not be found in the database - error -12285:Unable to find the certificate or key necessary for authentication.. TLS: certificate '/etc/pki/tls/certs/ldap.cassens.com.pem' successfully loaded from PEM file. TLS: no unlocked certificate for certificate 'CN=ldap.cassens.com,OU=Ldap Server,O=Cassens Transport Company,C=US'. ppolicy_bind: Setting warning for password expiry for cn=replication,dc=cassens,dc=com = 0 seconds ^Cdaemon: shutdown requested and initiated. slapd shutdown: waiting for 0 operations/tasks to finish slapd stopped. This server was working last night, I had to promote our secondary ldap server this morning. I have attempted to rebuild the database backend (with slapcat and slapadd), but am still getting this same error. I have my ssl (self-signed) certificates located in /etc/pki/tls/certs/ldap.cassens.com.pem /etc/pki/tls/tls/certa/ca.pem /etc/pki/tls/private/ldap.cassens.comKey.pem These certificates worked fine up untill today, does anyone have any insight on where to look to being troubleshooting this issue? Thanks, Eric Falbe

5 6

Documentation required on openldap 2.4.39
by saurabh ohri 07 Mar '14

07 Mar '14

Hi, Does anyone installed openldap 2.4.39 or later. Please help me with self created document as i am getting stuck at various point. I have installed and configured but not able to : 1) Change the ldap to work for ldap(389) to ldaps(636) with openssl certs. 2) Not able to convert the slapd.conf to config. 3) Implementing password policies. 4) 2 node Replication Master-Master Please help as it is been 2 weeks and am dead stuck. Project completion data is near so quick help will be highly appreciated. Thanks again Regards Sam

2 1

LDAP Passwordless SSH Problem
by Kamran Khan 06 Mar '14

06 Mar '14

Hi all, I have a cluster, running RHEL6.5, which I have installed and configured LDAP w/ TLS support. The systems are all authenticating using LDAP properly, and I have added a test user to make sure this works. I can 'su' into the new user, and SSH across all systems. However, it requires a password upon every SSH. Please see verbose SSH below: =================================================== [root@usdtwclus01 ~]# su - jramey [jramey@usdtwclus01 ~]$ ssh -vvvvv n001 OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug2: ssh_connect: needpriv 0 debug1: Connecting to n001 [172.16.36.1] port 22. debug1: Connection established. debug3: Not a RSA1 key file /home/jramey/.ssh/id_rsa. debug2: key_type_from_name: unknown key type '-----BEGIN' debug3: key_read: missing keytype debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug2: key_type_from_name: unknown key type '-----END' debug3: key_read: missing keytype debug1: identity file /home/jramey/.ssh/id_rsa type 1 debug1: identity file /home/jramey/.ssh/id_rsa-cert type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3 debug1: match: OpenSSH_5.3 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.3 debug2: fd 5 setting O_NONBLOCK debug1: SSH2_MSG_KEXINIT sent debug3: Wrote 960 bytes for a total of 981 debug1: SSH2_MSG_KEXINIT received debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc(a)lysator.liu.se debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc(a)lysator.liu.se debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,zlib(a)openssh.com,zlib debug2: kex_parse_kexinit: none,zlib(a)openssh.com,zlib debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc(a)lysator.liu.se debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc(a)lysator.liu.se debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,zlib(a)openssh.com debug2: kex_parse_kexinit: none,zlib(a)openssh.com debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: mac_setup: found hmac-md5 debug1: kex: server->client aes128-ctr hmac-md5 none debug2: mac_setup: found hmac-md5 debug1: kex: client->server aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug3: Wrote 24 bytes for a total of 1005 debug2: dh_gen_key: priv key bits set: 120/256 debug2: bits set: 522/1024 debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug3: Wrote 144 bytes for a total of 1149 debug3: check_host_in_hostfile: host n001 filename /home/jramey/.ssh/known_hosts debug3: check_host_in_hostfile: host n001 filename /home/jramey/.ssh/known_hosts debug3: check_host_in_hostfile: match line 1 debug3: check_host_in_hostfile: host 172.16.36.1 filename /home/jramey/.ssh/known_hosts debug3: check_host_in_hostfile: host 172.16.36.1 filename /home/jramey/.ssh/known_hosts debug3: check_host_in_hostfile: match line 1 debug1: Host 'n001' is known and matches the RSA host key. debug1: Found key in /home/jramey/.ssh/known_hosts:1 debug2: bits set: 504/1024 debug1: ssh_rsa_verify: signature correct debug2: kex_derive_keys debug2: set_newkeys: mode 1 debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug3: Wrote 16 bytes for a total of 1165 debug2: set_newkeys: mode 0 debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug3: Wrote 48 bytes for a total of 1213 debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug2: key: /home/jramey/.ssh/id_rsa (0x7f0a9fb7a6a0) debug3: Wrote 64 bytes for a total of 1277 debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password debug3: authmethod_lookup gssapi-keyex debug3: remaining preferred: gssapi-with-mic,publickey,keyboard-interactive,password debug3: authmethod_is_enabled gssapi-keyex debug1: Next authentication method: gssapi-keyex debug1: No valid Key exchange context debug2: we did not send a packet, disable method debug3: authmethod_lookup gssapi-with-mic debug3: remaining preferred: publickey,keyboard-interactive,password debug3: authmethod_is_enabled gssapi-with-mic debug1: Next authentication method: gssapi-with-mic debug3: Trying to reverse map address 172.16.36.1. debug1: Unspecified GSS failure. Minor code may provide more information Credentials cache file '/tmp/krb5cc_15000' not found debug1: Unspecified GSS failure. Minor code may provide more information Credentials cache file '/tmp/krb5cc_15000' not found debug1: Unspecified GSS failure. Minor code may provide more information debug1: Unspecified GSS failure. Minor code may provide more information Credentials cache file '/tmp/krb5cc_15000' not found debug2: we did not send a packet, disable method debug3: authmethod_lookup publickey debug3: remaining preferred: keyboard-interactive,password debug3: authmethod_is_enabled publickey debug1: Next authentication method: publickey debug1: Offering public key: /home/jramey/.ssh/id_rsa debug3: send_pubkey_test debug2: we sent a publickey packet, wait for reply debug3: Wrote 368 bytes for a total of 1645 debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug2: we did not send a packet, disable method debug3: authmethod_lookup password debug3: remaining preferred: ,password debug3: authmethod_is_enabled password debug1: Next authentication method: password jramey@n001's password: =================================================== Any ideas on how to accomplish passwordless SSH with LDAP users? Please let me know. Thanks. -- Kamran Khan PSSC Labs HPC Software Technical Engineer

3 3

openldap search filter attribut equal to another
by Lanfeust troy 05 Mar '14

05 Mar '14

hi list, is it possible to write a filter like: (&(objectClass=inetOrgPerson)(mail=cn)) to retrieve all entry that attribute mail equal to attribute cn. thanks

4 3

mirror mode & sasl question
by Eileen(=^ω^=) 05 Mar '14

05 Mar '14

Hi all， This is Eileen from China SINAP. I am a beginner for openldap soft. I encountered a problem in my study on two LDAP services replication. I have 2 LDAP services, one name LDPA1, the other is LDAP2 . I want to make them synchronously in mirror mode. But when I set LDAP services rootpw both in hash, the 2 LDAP serivces can’t be synchronous. My question is 1. if I set my rootpw in hash, my bindmethod must be SASL? If I must use sasl method, can I put the sasl service in the same ldap service? If bindmethod=sasl then what is the saslmech should be? 2. If I change to sasl method, do I need change my database record? My slapd.conf file set as below, could you pls advice which place I should fix? moduleload syncprov.la database bdb suffix "dc=xxx,dc=xxx" checkpoint 1024 15 rootdn "cn=xxx,dc=xxx,dc=xxx" rootpw {SSHA}cXUVsI2kuKNK9kjCagWtvraossyAKuhX directory /var/lib/ldap/xxx access to * by self write by * read # Indices to maintain for this database index objectClass,entryCSN,entryUUID eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub serverID 1 (ldap2 service is 2) syncrepl rid=111 provider=ldap://other side ip bindmethod=sasl saslmech=ssha authcid=? Authzid=? Realm=? binddn="cn=xxx,dc=xxx,dc=xxx" credentials={SSHA}cXUVsI2kuKNK9kjCagWtvraossyAKuhX searchbase="dc=xxx,dc=xxx" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 My database record just like below: dn: cn=tiangexuan,ou=users,dc=xxx,dc=xxx cn: tiangexuan objectClass: posixAccount objectClass: shadowAccount objectClass: inetOrgPerson sn: tiangexuan uid: tiangexuan uidNumber: 10001 gidNumber: 90001 homeDirectory: /home/tiangexuan loginShell: /bin/bash userPassword: calvin Best wishes & regrads Eileen

3 2

Restricting access based on IP Address
by kevin sullivan 05 Mar '14

05 Mar '14

Hi, I am running an OpenLDAP server version 2.4.23 and I would like to restrict a user from connecting unless they are connecting via an ldapi connection or localhost. Specifically, I would like to only let the rootdn manage things from localhost or from an ldapi connection, which ensures that they are on localhost. I do not want to prevent other users from connecting to my LDAP server via an ldaps connection from anywhere on the network. Is this possible? I have read a good bit about access control directives, but I haven't seen what I am looking for. I am guessing that what I am looking for probably deals with 'sockname' or 'sockurl', but I don't know how to use those statements to properly configure slapd. Thanks, Kevin

5 4

Issues with setting up multiple master
by Alex Samad - Yieldbroker 05 Mar '14

05 Mar '14

Hi So I am setting up multi master following the steps here http://www.openldap.org/doc/admin24/replication.html 18.3.3 I have 2 nodes and not 3. I did this on the master dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: secret and on the 2nd dn: cn=config objectClass: olcGlobal cn: config olcServerID: 2 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: secret I used a different password on each site . changed it to the same password no I did this dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 $URI1 olcServerID: 2 $URI2 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE I am wondering why I did dn: cn=config objectClass: olcGlobal cn: config olcServerID: 2 if I am just going to do this dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 $URI1 olcServerID: 2 $URI2 This is what I get on the second node Mar 5 16:08:09 alcldap1 slapd[21296]: do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD Mar 5 16:08:09 alcldap1 slapd[21296]: do_syncrepl: rid=001 rc -1 retrying (4 retries left) Mar 5 16:08:14 alcldap1 slapd[21296]: do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD Mar 5 16:08:14 alcldap1 slapd[21296]: do_syncrepl: rid=001 rc -1 retrying (4 retries left) Mar 5 16:08:19 alcldap1 slapd[21296]: do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD And on the first node Mar 5 16:09:27 gsldap1 slapd[11028]: do_syncrep2: rid=002 got empty syncUUID with LDAP_SYNC_ADD x Mar 5 16:09:27 gsldap1 slapd[11028]: do_syncrepl: rid=002 rc -1 retrying (4 retries left) x I have done manual ldapsearch from both boxes to the other boxes with the credentials and it works So now I am stuff. Had a quick google, but could find anything relevant. Help :) Oh I started with info in the db's already. Just a rsync ... Alex

1 0

ppolicy not working in 2.4.23 !!
by saurabh ohri 05 Mar '14

05 Mar '14

Hi All, tried implementing the ppolicy on 2.4.23 version but it is not working. So i tried installing the upgraded version i.e 2.4.39 from source.but getting following error: Mar 4 12:36:06 juc-dom1-prd slapd[5513]: @(#) $OpenLDAP: slapd 2.4.39 (Mar 4 2014 11:05:59) $#012#011root@juc-dom1-prd.j.cinglevue.com:/tmp/openldap-2.4.39/servers/slapd Mar 4 12:36:06 juc-dom1-prd slapd[5513]: daemon: IPv6 socket() failed errno=97 (Address family not supported by protocol) Mar 4 12:36:06 juc-dom1-prd slapd[5513]: lt_dlopenext failed: (back_bdb.la) file not found Mar 4 12:36:06 juc-dom1-prd slapd[5513]: slapd stopped. Mar 4 12:36:06 juc-dom1-prd slapd[5513]: connections_destroy: nothing to destroy. Previously was getting error: Unrecognized database type (bdb) in openldap 2.4.39 In order to fix this i added below line in slapd.conf file: moduleload back_bdb.la Please help as implementing open ldap is getting crazy now. regards Sam

2 2

Critical GnuTLS bug ...
by Howard Chu 04 Mar '14

04 Mar '14

http://arstechnica.com/security/2014/03/critical-crypto-bug-leaves-linux-hu… Perhaps folks will take us more seriously the next time we say "don't use GnuTLS" ... http://www.openldap.org/lists/openldap-devel/200802/msg00072.html -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 3

Re: LMDB - growing the database
by Nat! 04 Mar '14

04 Mar '14

I wanted to resurrect this thread: >> >> Hi, >> >> I understand that the DB size has an upper limit set by the call to >> mdb_env_set_mapsize . I wonder what is the best strategy for growing the size. >> > The best strategy is to initially pick a large enough size that growing it is never an issue. E.g., set it to the amount of free space on the disk partition where the DB resides. As the docs state, when the DB is actually in use, there's no guarantee that there will be enough free system resources left for a resize attempt to even succeed. I.e., if you initially choose a small size, by the time you need to deal with it it may be too late. > > I have a problem with the "best strategy" because at least on OS X, the reserved file size of "data.mdb" is just the amount set by mdb_env_set_mapsize. Clearly reserving the amount of free space in my user partition would not be desirable, especially if I want to run more than just one lmdb based program. So I tried to grow my db progressively, by setting mdb_env_set_mapsize first to a small value and the enlarging it. Unfortunately it seems, that whenever I increase the env_mapsize, all the committed data is lost and I start with a clean database (determined by mdb_stat). So what gives ? The only thing I have come up with is, that I would need to copy the old database(s) into the new one with a cursor, but that sounds lame. Ciao Nat! --------------------------------------------------- Tradition is an easy alternative to thinking what to do. -- J. Watkinson

3 5

NEW LDAP PROJECT
by Borresen, John - 0442 - MITLL 04 Mar '14

04 Mar '14

All, There is a new project; a group that I support will be using OpenAM to manage single sign-on (SSO). The environment is outward facing, where multiple entities (outside users) will log on to a web portal via openam/opensso. The OpenAM will query the OpenLDAP (currently it is an embedded OpenDJ implementation) for user information. Based on their user credentials they will, hopefully, be forwarded to either a Production, Development or a Demonstration environment. The group wants to migrate to OpenLDAP as OpenDJ is 1) not friendly 2) very slow. I've been looking around at the OpenAM/OpenDJ configuration and most of the schemas are specifically legacy Sun Microsystems & Java specific. Basically, the OpenLDAP will be the User-store for OpenAM. 1) Should I migrate those schemas and everything else currently in OpenDJ over to OpenLDAP and import them? 2) What is the recommended methodology that I should follow to best implement the above scenario? Any pointers are much appreciated. Thanks, John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu

3 2

Troubleshooting OpenLDAP replication
by Igor Zinovik 04 Mar '14

04 Mar '14

Hello, list. I'm experiencing synchronization problem with my ldap provider-consumer setup. Both nodes are running OpenLDAP 2.4.38 (using mdb backend) at x86_64 under Linux 3.7.10. Both servers synchronize their time with one NTP server, so clocks are in sync. I have cn=dhcp,dc=my,dc=org containter which I would like to replicate to openldap consumer. Consumer uses old-fasioned slapd.conf file: # [... include, acl and logging settings skipped ...] rootdn "cn=root,dc=my,dc=org" rootpw [ skipped ] index objectClass eq index entryCSN eq index entryUUID eq index dlzHostname eq index dlzZoneName eq index dlzIPAddr eq index dlzType eq index dhcpHWAddress eq index cn eq,approx,sub syncrepl rid=1 ... syncrepl rid=2 provider=ldap://172.20.20.207 type=refreshAndPersist interval=00:00:01:00 retry="60 +" searchbase="cn=dhcp,dc=my,dc=org" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="uid=dhcpd,ou=services,dc=my,dc=org" credentials="[ skipped ]" Problem is that not all changes (adding new objects and changing attributes of existing objects) are replicated from master to consumer. I make change on master by hand, but I do not see log entries on consumer that changed attribute was replicated. LDAP provider setup (uses online configuartion): dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=my,dc=org olcAddContentAcl: FALSE olcLastMod: TRUE olcLimits: {0}group/groupOfNames/member="cn=ldap admins,ou=groups,dc=my,dc=org" size=unlimited olcLimits: {1}group/groupOfNames/member="cn=ldap admins,ou=groups,dc=my,dc=org" time=unlimited olcLimits: {2}group/groupOfNames/member="cn=admins,ou=mail,ou=groups,dc=my,dc=org" size=unlimited olcLimits: {3}group/groupOfNames/member="cn=replicators,ou=groups,dc=my,dc=org" size=unlimited time=unlimited User uid=dhcpd,ou=services,dc=my,dc=org is member of group cn=replicators,ou=groups,dc=my,dc=org. dn: cn=Replicators,ou=Groups,dc=my,dc=org cn: Replicators member: uid=dhcpd,ou=services,dc=my,dc=org Indices on master server: olcDbIndex: dhcpHWAddress,dhcpClassData eq ACL for cn=dhcp,dc=my,dc=org container (I have only one ACL entry, that mentions cn=dhcp,dc=my,dc=org): ... olcAccess: {15}to dn.subtree="cn=dhcp,dc=my,dc=org" by group/groupOfNames/member.exact="cn=dhcp readers,ou=dhcp,ou=groups,dc=my,dc=org" read by group/groupOfNames/member.exact="cn=dhcp writers,ou=dhcp,ou=groups,dc=my,dc=org" write ... dn: cn=dhcp readers,ou=dhcp,ou=Groups,dc=my,dc=org cn: dhcp readers objectClass: groupOfNames objectClass: top member: uid=dhcpd,ou=Services,dc=my,dc=org So for now I checked following: 1. Clocks on both server (both are in sync) 2. ACL for replication DN (replication user is able to read all needed data). 3. Size and time limits for replication DN (replication user has no limits on operations). 4. Schema (objectClasses and attrubutes) on both servers (both nodes use same schemas). 5. Disable indices on consumer server for replicated attributes from cn=dhcp,dc=my,dc=org container (not helped) What else I can check? BTW, I would be pleased if someone give somekind of systematic approach for troubleshooting OpenLDAP replication issues.

1 0

OpenLDAP: slapi & contrib overlays
by Sergio NNX 03 Mar '14

03 Mar '14

Hi, I'm building OpenLDAP 2.4.39 from source under MinGW. A couple of questions: a) I added '--enable-slapi' to configure. I got a few compilation errors. Is slapi Windows ready? b) I added some contrib modules (e.g. allop, lastbind, etc) and tried to link them statically. Compilation and linking worked OK. Then, I type: slapd -VVV and I expect to see those contrib modules listed under the overlay section. None of them appear. I added 'overlay allop' to slapd.conf, but when slapd starts, I get: 5314932d overlay "allop" not found 5314932d ..\etc\openldap\slapd.conf: line 30: <overlay> handler exited with 1! Can anyone point me to the right direction? Thanks in advance. Ciao, Sergio.

2 2

back-sql mysql and multiple DITs
by Robson, Alan 03 Mar '14

03 Mar '14

Hi, I have tried to set up a single instance of slapd serving information from two DITs that have been defined in separate mysql databases. I can comment out the database entries for either DIT, and everything works for the other DIT. But it won't support the two DITs simultaneously (it seems random which DIT will return results and which returns "no such object" when I restart slapd with both DITs configured). All the odbc stuff for both backends seems fine, isql runs and of course either database can be accessed through ldapsearch if it is the only one slapd serves. I can even run two instances of slapd, one with each DIT and successfully query them separately with ldapsearch, but I'd prefer one instance with the two DITs if possible. Could you please help me get this running, or is it just the law that only one sql backend can be used per server ? Many thanks Alan Slaptest says (when both DITs are defined in one slapd.conf)... WARNING: No dynamic config support for database sql. WARNING: No dynamic config support for database sql. config file testing succeeded slapd.conf (with both backends/DITs) is: # $OpenLDAP$ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # loglevel 64 moduleload /usr/lib64/openldap/back_sql.la include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/farm.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org #pidfile /usr/local/var/slapd.pid #pidfile /var/run/openldap/slapd.pid #argsfile /usr/local/var/slapd.args ####################################################################### # sql database definitions ####################################################################### database sql suffix "dc=server,dc=farm" rootdn "cn=root,dc=server,dc=farm" rootpw *********** dbname openldap dbuser openldap dbpasswd *************** subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_stmt "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no database sql suffix "dc=lab,dc=farm" rootdn "cn=root,dc=lab,dc=farm" rootpw ********** dbname lab dbuser ldap dbpasswd ******** subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_stmt "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no

2 3

replication delay problem
by Cyril Grosjean 02 Mar '14

02 Mar '14

I use a couple of OpenLDAP 2.4.36 servers in a multi-master replication setup. Write operations are sent to a single server, and then replicated to the second one. I sometimes have write operations "peaks" of about 900 operations (modifications of the pwdFailureTime attribute mainly) per hour. The number of bind failures per user is neither limited nor reset yet and I especially noticed a script that connects to the directory with the same service account and (wrong) password. So, until this script is modified with the right password (which will take time, unfortunately), it can generate tons of failures, and thus tons of replications. I noticed a several minutes replication delay between the directories, at peak time, when comparing the contextCSN attributes. It looks to me a big delay with regards to the number of modifications. Anything I could do to limit that delay ?

4 11

Dell Inspiron B130 repair
by Michael 02 Mar '14

02 Mar '14

Good evening. I’d like to have my DC power jack repaired on my Dell Inspiron B130 as well as have the keyboard replaced if possible. Please let me know what the additional costs would be for the keyboard. Thanks Michael Starling 860.381.9284

1 1

Fwd: Re: Aw: Re: LMDB get value
by Howard Chu 01 Mar '14

01 Mar '14

-------- Original Message -------- Subject: Re: Aw: Re: LMDB get value Date: Sat, 01 Mar 2014 13:39:47 -0800 From: Howard Chu <hyc(a)symas.com> To: Markus Doppelbauer <doppelbauer(a)gmx.net> CC: Markus Doppelbauer wrote: > You are right. Thanks a lot! > An other question. Is there a "define"-option to compile LMDB without a > dependency to "libpthread"? (We will replace Daniel Bernsteins "CDB" for > performance reasons with LMDB - so locking is not required). No, nor is such a flag needed. LMDB readers do no locking anyway. If you're replacing CDB, then none of this matters. > Thanks a lot > Markus > *Gesendet:* Samstag, 01. März 2014 um 17:04 Uhr > *Von:* "Howard Chu" <hyc(a)symas.com> > *An:* "Markus Doppelbauer" <doppelbauer(a)gmx.net>, openldap-technical(a)openldap.org > *Betreff:* Re: LMDB get value > Markus Doppelbauer wrote: > > Hello, > > Test case (modified sample-mdb.c): > > http://doppelbauer.name/bug.c.txt > > If I run this proram the first time, LMDB finds the key. The second time, > > mdb_cursor_get() returns NOTFOUND. > > How to fix this issue? > > You're using an invalid dbi the second time, you didn't call mdb_dbi_open(). > > > Thanks a lot > > Markus > > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

LMDB get value
by Markus Doppelbauer 01 Mar '14

01 Mar '14

2 1

slapd.ldif beginner
by Sonny Taberman 01 Mar '14

01 Mar '14

Hi all ldap people. I have been trying this new way of configuring a slapd server from scratch. Sorry to say total failure on my side. I'm not sure where to begin. I have built a linux system from LFS Linux from scratch. So I want to install openldap from source, so far no problems. When my installation is done i have a directory in /etc/ named openldap and the content inside is this: DB_CONFIG.example ldap.conf ldap.conf.default schema slapd.conf slapd.conf.default slapd.ldif slapd.ldif.default To start configure my slapd using slapd.conf there is no problem. Actually I'm beginning to think I'm pretty good att this. :-) But then I try to read all I can find about configure a new slapd using slapd.ldif, not that easy. I understand that I need a new directory named slapd.d. After that I have no clue. I guess something is hardcoded in slapd but what am I supposed to do next? How can i communicate with slapd ? I guess I have to define a password somewhere for a manager or administrator but how and where? Is there a tutorial somwhere ? All I need is how to start. :-) best regards Sonny

3 3

Re: ldap_add: Object class violation (65), additional info: attribute 'host' not allowed
by W Forum W 27 Feb '14

27 Feb '14

Thanks!!! I found the same solution just before, it saved my day :-) Kind Regards On 02/27/2014 05:20 PM, Harry Jede wrote: > W Forum W wrote: >> Hi I tried to create a custom auxiliary class but I get this error >> >> attributetype: Inconsistent duplicate attributeType: "host" >> >> If I change the attributeType: "host" to attributeType: "hosts" >> it works. But I need the 'host' attribute.not 'hosts' > Its simple. "host" is defined in "account". So dont declare it twice, > just use it. > > # exists already in account > #attributetype ( 1.3.6.1.4.1.9554.1 > # NAME 'host' > # DESC 'host computer' > # EQUALITY caseIgnoreMatch > # SUBSTR caseIgnoreSubstringsMatch > # SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} > # ) > > objectclass ( 1.3.6.1.4.1.9554.0 > NAME 'teststuff' > SUP top > AUXILIARY > DESC 'Abstraction of an account with extra attributes' > MAY ( host ) > ) > >> How can I solve this? >> >> My schema looks like >> >> attributetype ( 1.3.6.1.4.1.9554.1 >> NAME 'host' >> DESC 'host computer' >> EQUALITY caseIgnoreMatch >> SUBSTR caseIgnoreSubstringsMatch >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} >> ) >> >> objectclass ( 1.3.6.1.4.1.9554.0 >> NAME 'teststuff' >> SUP top >> AUXILIARY >> DESC 'Abstraction of an account with extra attributes' >> MAY ( host ) >> ) >> >> Thanks

1 0

ldap_add: Object class violation (65), additional info: attribute 'host' not allowed
by W Forum W 27 Feb '14

27 Feb '14

Hi I try to add a user but the host attribute is not accept (everything else is fine) ldapadd -x -W -D "cn=admin,dc=example,dc=com" -f user.ldif Enter LDAP Password: adding new entry "uid=user,ou=Users,dc=example,dc=comt" ldap_add: Object class violation (65) additional info: attribute 'host' not allowed how can i add a host attribute i have following schema installed core.schema cosine.schema nis.schema inetorgperson.schema samba.schema thanks in advance

3 9

"entries aggregation"
by Alexandre Santos 27 Feb '14

27 Feb '14

Hi, I have a question about "entries aggregation". If for example I have ou=users,dc=exemple,dc=com and ou=info,dc=exemple,dc=com, and both have to be related, how can i do that? The uid must be different for integrity. Example people "test" data in ou=users and info in ou=info uid=test,ou=users,dc=exemple,dc=com ... mail: test(a)exemple.com uid=test_info,ou=info,dc=exemple,dc=com ... address: Street test if i search address and mail for "uid=test" it should give me both entries. Thanks

1 0

Not able to authenticate Windows and MAC client
by saurabh ohri 27 Feb '14

27 Feb '14

Hi all, I am new to openldap and i manage dto install and configure the same. My linux client is working well but not able to authenticate windows and mac clients. Have been trying since past 2 days by google and other posts but still facing issue. Any help would be highly appreciated. Details: using openldap-2.4.23-34 on RHEL6.5 Client details: Mac 10.8.5 -- tried configuring the network account server but it is showing RED. Error This server is not responding. Windows 7 – tried installing GINA but it is giving me invalid credentials error. Configuration file on server: Password: # extended LDIF # # LDAPv3 # base <dc=j,dc=example,dc=com> (default) with scope subtree # filter: (objectclass=*) # requesting: ALL # # j.example.com dn: dc=j,dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization o: example Organization description: example Inc DIT dc: j # Users, j.example.com dn: ou=Users,dc=j,dc=example,dc=com objectClass: organizationalUnit ou: Users # Groups, j.example.com dn: ou=Groups,dc=j,dc=example,dc=com objectClass: organizationalUnit ou: Groups # Admins, j.example.com dn: ou=Admins,dc=j,dc=example,dc=com objectClass: organizationalUnit ou: Admins # sohri, Users, j.example.com dn: uid=sohri,ou=Users,dc=j,dc=example,dc=com uid: sohri cn: sohri sn: 1 objectClass: top objectClass: posixAccount objectClass: inetOrgPerson loginShell: /bin/bash homeDirectory: /home/sohri uidNumber: 15000 gidNumber: 10000 userPassword:: e1NTSEF9eWdkWExpZUdIT01YRytRM3ZmZWdNY3QwSmd2bFNqSkcg mail: sam.ohri(a)example.com gecos: Local User # tpearce, Users, j.example.com dn: uid=tpearce,ou=Users,dc=j,dc=example,dc=com uid: tpearce cn: tpearce sn: 2 objectClass: top objectClass: posixAccount objectClass: inetOrgPerson loginShell: /bin/bash homeDirectory: /home/tpearce uidNumber: 15001 gidNumber: 10000 userPassword:: e1NTSEF9eWdkWExpZUdIT01YRytRM3ZmZWdNY3QwSmd2bFNqSkc= mail: tony.pearce(a)example.com gecos: local User # ldapusers, Groups, j.example.com dn: cn=ldapusers,ou=Groups,dc=j,dc=example,dc=com objectClass: posixGroup objectClass: top cn: ldapusers userPassword:: e2NyeXB0fXg= gidNumber: 10000 memberUid: uid=sohri memberUid: uid=tpearce # search result search: 2 result: 0 Success # numResponses: 8 # numEntries: 7 Regards Sam

4 8

memberOf values case
by Matteo Perego 27 Feb '14

27 Feb '14

Hi, I know that openldap usage behaviour is case insensitive. In my case a client use ldap attribute values in a case sensitive way. I've noticed that the memberOf value is created by the overlay using the DN case used in the query and not the DN case read from the database, I mean: dn: cn=test,ou=LOCAL,dc=example,dc=org changetype: modify replace: member member: uid=123,ou=people,dc=example,dc=org will create a memberOf: cn=test,ou=LOCAL,dc=example,dc=org attribute. dn: cn=test,ou=local,dc=example,dc=org changetype: modify replace: member member: uid=123,ou=people,dc=example,dc=org will create a memberOf: cn=test,ou=local,dc=example,dc=org attribute. The case of OU entry in the database is not considered and the values case depends on the writer client. I'm wondering if this's a known and desidered behaviour and I should deal with it or there's a chance to change it. -- Best Regards, Matteo Perego Xego di Perego Matteo & C. s.a.s. Via Giovanni Pascoli, 18 24040 Arzago d’Adda (BG) Part IVA/Cod Fis: 03126510167 R.E.A. 351612 tel +39-3395294954 fax +39-02700525082 http://www.xego.it email: info(a)xego.it

3 3

Re: strategy for getting groupOfNames (AD) and posixAccount (Unix) to coexist?
by harry.jede＠arcor.de 26 Feb '14

26 Feb '14

Am Mittwoch, 26. Februar 2014 schrieb Jefferson Davis: > Sorry to be dense, but it appears I create my schema file from the > attribute definitions in the RFC, is that correct? Yes -- Harry Jede

1 0

Re: strategy for getting groupOfNames (AD) and posixAccount (Unix) to coexist?
by Jefferson Davis 26 Feb '14

26 Feb '14

So I've read, however, there is very little documentation on implementation, at least that I've been able to find. ----- Original Message ----- From: "Dieter Klünter" <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Friday, February 21, 2014 10:55:58 PM So I've read, however, there is very little documentation on implementation, at least that I've been able to find. Subject: Re: strategy for getting groupOfNames (AD) and posixAccount (Unix) to coexist? Am Fri, 21 Feb 2014 11:14:12 -0800 (PST) schrieb Jefferson Davis <jdavis(a)standard.k12.ca.us>: > This has been beating me like a red-headed stepchild... > > In the AD world, groupOfNames is expected (in combination with the > member attribute, provides for reverse group resolution, ie users by > group membership AND groups by member inclusion). This can be achieved by overlay memberOf, man slapo-memberof(5). > On the unix side of the fence, groups REQUIRE a gidNumber in order to > resolve group membership, using posixGroup structural OC in > conjunction with memberUID. The rfc2307bis.schema provides auxiliary object classes to solve this. In addition you may use the groupOfNames objectclass. > In attempting to future-proof our ldap services, and to accommodate > the AD-Focused nature of commercial products, I'm attempting to get > this to all work automatically, ie use the same group setup for both > (probably naive and ill-advised?). But you CANNOT have multiple > structural objectclasses in a single entry. So these requirements put > group structures in direct opposition of one another. > > Has anyone resolved this successfully, and if so, how? Overlays > (which ones, examples)? Schema mods (examples?) > > Splitting groups off as unix groups vs windows groups (sync could get > ugly) and could run into other issues with respect to file and dir > permissions. > > I also need to avoid breaking smbldap-tools, which at the moment > appears NOT to support the groupofnames model. > > Building this on CentOS 6, OpenLDAP 2.4.23-34, and migrating from > older OpenLDAP version. I'm somewhat open to considering a different > LDAP service (389/Apache/OpenDJ) though I've found java to be a > resource pig in the extreme, and would prefer to avoid if possible. > > If you have this working I would love to see the relevant > configuration files. -Dieter -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E -- Jefferson K Davis Technology and Information Systems Manager Standard School District 1200 North Chester Ave Bakersfield, CA 93308 661.392.2110 ext 120 (office) http://district.standard.k12.ca.us District Users: Click here to report technology issues

2 2

Replication from OpenLDAP to Fedora 389 DS
by Italo Valcy 26 Feb '14

26 Feb '14

Dear all, I`m trying to setup replication from OpenLDAP to Fedora 389 DS. It used to work by running slurpd in a push mode initiated by the provider. With OL 2.4 this seems to be replaced by syncrepl proxy mode [1], which works by defining a LDAP backend that will write updates on the consumer from data received from syncrepl engine (provider), acting as a proxy (examples in [1]). This is not working in case of sincronization from OL to 389 DS, because operational attributes (entryCSN, structuralObjectClass, entryUUID, etc.) is not accepted in 389 DS, giving the following error in 389 DS: [22/Feb/2014:18:17:25 -0300] - Entry "uid=XXX,dc=sub,dc=example,dc=com" -- attribute "entrycsn" not allowed I've tried to filter those operational attributes on synrepl, by using "exattrs='structuralObjectClass,entryUUID,entryCSN'" but it didnt help. Another approach (the right one, see bellow) would be disable "lastmod", but then syncprov overlay complains and don't starts (lastmod TRUE is required by syncprov). >From LDAP backend man pages, it already gives a feeling that when proxying, then lastmod should be OFF (and this is the default behavior): "Note: In early versions of back-ldap it was recommended to always set 'lastmod off' for ldap and meta databases. This was required because operational attributes related to entry creation and modification should not be proxied, as they could be mistakenly written to the target server(s), generating an error." So, is there any way to don't export the operational attributes from OL in the above scenario? Thanks for any help! [1] http://www.openldap.org/doc/admin24/replication.html#Syncrepl%20Proxy%20Mode -- Saudações, Italo Valcy :: http://wiki.dcc.ufba.br/Main/ItaloValcy

5 12

Excluding attributes fom reqOld
by Mundry, Marvin 26 Feb '14

26 Feb '14

Hi, the accesslog in my production environment is growing quite large which makes backing it up challenging. The reason is that there are plenty of accesslog entires which originate from slapo-ppolicy (users who can't remember their passwords): dn: reqStart=20140219033229.000000Z,cn=accesslog reqOld: pwdFailureTime: 20140218152927Z reqOld: pwdFailureTime: 20140218152957Z reqOld: pwdFailureTime: 20140218153027Z reqOld: pwdFailureTime: 20140218153057Z as I don't need pwdFailureTime in reqOld I would like to exclude this attribute form reqOld. I is my understanding that: * olcAccessLogOld only allows me to exclude whole user objects from appearing in reqOld (as I need reqOld info for users I can't do this) olcAccessLogOldAttr - only allows specifying a positive list of attributes that gets logged no matter whether they changed or not. what I need is something like: dn: olcOverlay={3}accesslog,olcDatabase={5}mdb,cn=config olcAccessLogOldAttr: !pwdFailureTime (a way to specify a list of attribs that never get logged even if they have changed) is there a way I can get rid of the pwdFailureTime in the accesslog? Best regards, Marvin Mundry University of Hamburg Regional Computer Center (RRZ) Division Zentrale Dienste Schlueterstrasse 70 20146 Hamburg +49 (0)40 42838-9109

1 0

Re: Cyrus IMAPD + virtual domains + SASL + OpenLDAP ldapdb
by Dan White 26 Feb '14

26 Feb '14

Forwarding to the list for posterity. On 02/25/14 15:22 -0700, Nels Lindquist wrote: >On 2/21/2014 1:45 PM, Dan White wrote: >> On 02/21/14 13:09 -0700, Nels Lindquist wrote: > ><snip> > >>> However, from what I can determine I'm not getting any realm component >>> in the searches coming through. The "default" realm configuration works >>> when I use a bare userid to authenticate, but when using a full e-mail >>> address, that comes through as >>> "uid=example(a)example.com,cn=[authmech],cn=auth". That said, I haven't >>> found a LogLevel which includes AuthzRegexp processing; I've tried >>> various settings, but the closest I've come is logging the resulting >>> bind requests (eg. BIND dn="uid=example,ou=people,dc=example,dc=com" >>> mech=DIGEST-MD5 sasl_ssf=128 ssf=128). >> >> I would not depend on realm being delivered in a consistent way from cyrus >> imapd/sasl. Different mechanisms will act in different ways. libsasl2 is >> responsible for providing the realm (or not). To maintain some consistency, >> create two sets of authz-regexp rules, such as: >> >> authz-regexp >> "uid=([^,]+),cn=([^,]+),cn=auth" >> "ldap:///dc=eng,dc=example,dc=com??one?(&(uid=$1)(objectClass=person))" >> >> authz-regexp >> "uid=([^,]+),cn=([^,]+),cn=([^,]+),cn=auth" >> >> "ldap:///dc=eng,dc=example,dc=com??one?(&(uid=$1@$2)(objectClass=person))" >> >> And you may need a third rule which matches cases where both a fully >> qualified username AND a realm are provided. > >To be more clear, in my LDAP none of the objects have uids incorporating >e-mail addresses, but that's how Cyrus IMAP allows for virtual domain >logins. > >My base dn is actually "o=top", and then I have the various domains laid >out like: > >dc=example,dc=com,o=top >dc=example2,dc=ca,o=top > >... so my plan was to use the virtual domain information to translate >into which subtree I need to search against. The "fallthrough" default >domain just searches the bare uid against a particular subtree. > >It seems to be working using this (we're using LDAPRouting with >Sendmail, so all mailboxes must have inetLocalMailRecipient attributes): > ># Match e-mail address; map to correct subtree > >authz-regexp > "uid=([^,]+)(a)([^,\.]+)\.([^,]+),cn=[^,]*,cn=auth" > "ldap:///dc=$2,dc=$3,o=top??sub?(&(uid=$1)(mailLocalAddress=*))" > > ># Default domain > >authz-regexp > "uid=([^,]*),cn=[^,]*,cn=auth" > "ldap:///dc=example,dc=com,o=top??sub?(&(uid=$1)(mailLocalAddress=*))" > >> ldapwhoami is highly recommend for testing this setup. Include all of -Y, >> -U, and -X. > >Thanks very much for putting me on the right track! -- Dan White

1 0

How to assign a password policy to a group of users, in one go
by Rodrigo Coutinho 25 Feb '14

25 Feb '14

Hi again, I've finally managed to setup the password policy, but only statically (ran configure again). Have defined two password policies, one for all (default) and another for a specific group of users. The question now is: Can I assign a password policy to a group of users (cn=some_group,ou=groups,dc=xxx,dc=local)in one go, or must I assign to each user individualy the pwdPolicySubentry? I have searched, and although slapo states that it can be done, no example is provided. Thank you in advance A transmiss�o de mensagens por e-mail n�o � absolutamente segura ou livre de erros. A mensagem pode ser intercetada, alterada, perdida, destru�da, chegar ao destinat�rio com atraso, ou mesmo com v�rus, n�o obstante o IFAP utilizar software anti-v�rus. Esta mensagem, incluindo eventuais ficheiros anexos, pode conter informa��o confidencial ou privilegiada e destina-se a uso exclusivo dos seus destinat�rios. Se n�o for o destinat�rio pretendido, informamos que a recebeu por engano, pelo que, qualquer utiliza��o, distribui��o, reencaminhamento ou outra forma de revela��o a terceiros, impress�o ou c�pia s�o expressamente proibidos. Se recebeu esta mensagem por engano, por favor contacte imediatamente o remetente por e-mail, e apague de imediato a mensagem do seu sistema inform�tico. O IFAP declina qualquer responsabilidade por erros ou omiss�es na presente mensagem e eventuais consequ�ncias, que resultem das situa��es referidas.

3 3

libldap "Happy Eyeballs" support (aka Fast Fallback or ipv4/ipv6 dual-stack)
by Žarko Milenković 25 Feb '14

25 Feb '14

Hi all, I would like to have Happy Eyeballs<http://en.wikipedia.org/wiki/Happy_eyeballs> algorithm (more details here<http://tools.ietf.org/html/rfc6555>) implemented for all network communication in my application. Because I'm using libldap for searching openldap server I'm not quite sure does library already support this or would I need to implement it myself? To further clarify, I have following scenario: ldap server on myoldap.organization.org that listens for both ipv6 and ipv4 connections. Clients connect to it using libldap. Does libldap have support to automatically choose ipv6 over ipv4 or vice versa? If yes, how is choice made? Is ipv6 always preferred if available or does better connection win? If no, then I know the way I need to go. The only thing to add there is that I would be willing to add this support to libldap. Thanks, Žarko

2 1

dynlist groups not usable in ACLs?
by DRVTiny 25 Feb '14

25 Feb '14

OpenLDAP 2.4.39, amd64, debian 7 When i use the group with only static members in "by group/groupOfNames/member" clause - all works perfectly But when i'm trying to use in ACL definition dynamic members in 1:1 identicaly group - it doesnt work at all and in slapd debug output i see: --- 530b1a22 dnMatch -40 "dc=ru" "uid=konovalov-aa,ou=people,dc=svc,dc=ot,dc=ru" --- where "dc=ru" is one static member of this group (all others is dynamic members and it is not compared to "uid=konovalov-aa,ou=people,dc=svc,dc=ot,dc=ru" at all). It is very strange behavior, because official documentation says that: --- Dynamic Groups are also supported in Access Control. Please see slapo-dynlist(5) and the Dynamic Lists overlay section. --- Any comments? Can i use dynlist'ed groups in OpenLDAP ACL?

3 2

strategy for getting groupOfNames (AD) and posixAccount (Unix) to coexist?
by Jefferson Davis 24 Feb '14

24 Feb '14

This has been beating me like a red-headed stepchild... In the AD world, groupOfNames is expected (in combination with the member attribute, provides for reverse group resolution, ie users by group membership AND groups by member inclusion). On the unix side of the fence, groups REQUIRE a gidNumber in order to resolve group membership, using posixGroup structural OC in conjunction with memberUID. In attempting to future-proof our ldap services, and to accommodate the AD-Focused nature of commercial products, I'm attempting to get this to all work automatically, ie use the same group setup for both (probably naive and ill-advised?). But you CANNOT have multiple structural objectclasses in a single entry. So these requirements put group structures in direct opposition of one another. Has anyone resolved this successfully, and if so, how? Overlays (which ones, examples)? Schema mods (examples?) Splitting groups off as unix groups vs windows groups (sync could get ugly) and could run into other issues with respect to file and dir permissions. I also need to avoid breaking smbldap-tools, which at the moment appears NOT to support the groupofnames model. Building this on CentOS 6, OpenLDAP 2.4.23-34, and migrating from older OpenLDAP version. I'm somewhat open to considering a different LDAP service (389/Apache/OpenDJ) though I've found java to be a resource pig in the extreme, and would prefer to avoid if possible. If you have this working I would love to see the relevant configuration files. -- Jefferson K Davis Technology and Information Systems Manager Standard School District 1200 North Chester Ave Bakersfield, CA 93308 661.392.2110 ext 120 (office) http://district.standard.k12.ca.us District Users: Click here to report technology issues

7 9

Relay recipient postfix via ldap exception email address
by Rony 23 Feb '14

23 Feb '14

I make postfix relay recipient via ldap and I want an exception email addresses can not look up but have not been successful, my configuration server_host = 1.1.1.1.1 ldap_search_base = o = example, c = com bind = no query_filter = (| (mail =% s) (mailAlternateAddress =% s)) (! (mail = group(a)example.com))) result_attribute = mail I want group(a)example.com can not look up, but have not been successful, how correct configuration?

2 1

Cyrus IMAPD + virtual domains + SASL + OpenLDAP ldapdb
by Nels Lindquist 22 Feb '14

22 Feb '14

I'm attempting to configure Cyrus IMAPD with ldapdb for SASL authentication. As I'm using virtual domains, I need users to be able to authenticate using their e-mail addresses, or just a bare userid for the default domain. I'm having some trouble getting everything working[1]. Based on this documentation extract from Cyrus SASL, I've been primarily focussing on the OpenLDAP configuration: "Unlike other LDAP-enabled plugins for other services that are common on the web, this plugin does not require you to configure DN search patterns to map usernames to LDAP DNs. This plugin requires SASL name mapping to be configured on the target slapd. This approach keeps the LDAP-specific configuration details in one place, the slapd.conf, and makes the configuration of remote services much simpler." I've set up a number of olcAuthzRegexp entries similar to (from the OpenLDAP 2.4 admin guide): "A more complex site might have several realms in use, each mapping to a different subtree in the directory. These can be handled with statements of the form: # Match Engineering realm authz-regexp uid=([^,]*),cn=engineering.example.com,cn=digest-md5,cn=auth ldap:///dc=eng,dc=example,dc=com??one?(&(uid=$1)(objectClass=person)) # Match Accounting realm authz-regexp uid=([^,].*),cn=accounting.example.com,cn=digest-md5,cn=auth ldap:///dc=accounting,dc=example,dc=com??one?(&(uid=$1)(objectClass=person)) # Default realm is customers.example.com authz-regexp uid=([^,]*),cn=digest-md5,cn=auth ldap:///dc=customers,dc=example,dc=com??one?(&(uid=$1)(objectClass=person))" However, from what I can determine I'm not getting any realm component in the searches coming through. The "default" realm configuration works when I use a bare userid to authenticate, but when using a full e-mail address, that comes through as "uid=example(a)example.com,cn=[authmech],cn=auth". That said, I haven't found a LogLevel which includes AuthzRegexp processing; I've tried various settings, but the closest I've come is logging the resulting bind requests (eg. BIND dn="uid=example,ou=people,dc=example,dc=com" mech=DIGEST-MD5 sasl_ssf=128 ssf=128). So my question is, how is the realm determined in such a scenario? Do I need to design olcAuththzRegexp entries to determine the realm based on the e-mail address supplied? If so, how does that information get passed back to Cyrus IMAPD so that the correct virtual domain is selected? Is there an appropriate olcLogLevel to see detailed olcAuthzRegexp processing? I'd be grateful for any suggestions or references to documentation, etc. I've done some searching of the mailing list archives to little avail. In case it matters, this is on CentOS 6.5 (x86_64) with stock OpenLDAP 2.4.23 and Cyrus SASL 2.1.23 packages, plus Cyrus IMAPD 2.4.17 built from Simon Matter's SRPM. [1] I *am* able to get authentication + virtual domains working with saslauthd, but I'd like to be able to support non-plaintext auth mechanisms. ---- Nels Lindquist

3 2

RE: Syncrepl and mmr
by Quanah Gibson-Mount 21 Feb '14

21 Feb '14

Hi John, SIDs (server IDs) must be unique across servers. RIDs (replication IDs) must be unique inside a single server. So the answer to your question is essentially "no". If you email me your full cn=config db bits from both servers (minus passwords), there's some cleanup on them I can send back. The serverID: 1 <URI> bit is only necessary if you are doing cn=config replication, which you are not doing. If you are going to use the <#> <URI> form, then the <URI> must EXACTLY MATCH the arguments slapd is being started with. Personally, since I do not do cn=config replication, and the URIs are customizable by customers, I go with the much simpler: olcServerID: <#> form. Then each server only has a single value for olcServerID, which is its specific serverID. This way I never have to worry that MMR replication is going to get mesed up because of URI changes. --Quanah --On Tuesday, February 18, 2014 10:09 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > All, > > The long weekend didn't help...still at a loss. Question... > > If the olcServerIDs look like, on all three servers: > > olcServerID: 1 ldap://mm-server1.example.ldap > olcServerID: 2 ldap://mm-server2.example.ldap > olcServerID: 3 ldap://mm-server3.example.ldap > > Should the Replica IDs (rid) in the olcSycnrepl directive be: > > olcSyncrepl: {0} rid=001 provider=mm-server1.example.ldap > bindmethod=simple binddn="cn=ldapadmin,dc=group42,dc=ldap" > credentials=<password> interval=01:00:00:00 > searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on > type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs=*,+" > syncdata=accesslog starttls=no olcSyncrepl: {1} rid=002 > provider=mm-server2.example.ldap bindmethod=simple > binddn="cn=ldapadmin,dc=group42,dc=ldap" credentials=<password> > interval=01:00:00:00 searchbase="dc=example,dc=ldap" > logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 > +" filter="(objectClass=*)" attrs=*,+" syncdata=accesslog starttls=no > olcSyncrepl: {0} rid=003 provider=mm-server3.example.ldap > bindmethod=simple binddn="cn=ldapadmin,dc=group42,dc=ldap" > credentials=<password> interval=01:00:00:00 > searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on > type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs=*,+" > syncdata=accesslog starttls=no > > OR > > olcSyncrepl: {0} rid=1 provider=mm-server1.example.ldap bindmethod=simple > binddn="cn=ldapadmin,dc=group42,dc=ldap" credentials=<password> > interval=01:00:00:00 searchbase="dc=example,dc=ldap" > logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 > +" filter="(objectClass=*)" attrs=*,+" syncdata=accesslog starttls=no > olcSyncrepl: {1} rid=2 provider=mm-server2.example.ldap bindmethod=simple > binddn="cn=ldapadmin,dc=group42,dc=ldap" credentials=<password> > interval=01:00:00:00 searchbase="dc=example,dc=ldap" > logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 > +" filter="(objectClass=*)" attrs=*,+" syncdata=accesslog starttls=no > olcSyncrepl: {0} rid=3 provider=mm-server3.example.ldap bindmethod=simple > binddn="cn=ldapadmin,dc=group42,dc=ldap" credentials=<password> > interval=01:00:00:00 searchbase="dc=example,dc=ldap" > logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 > +" filter="(objectClass=*)" attrs=*,+" syncdata=accesslog starttls=no > > OR > > Does it matter? > > Also, should the all three olcSycrepl directives be loaded on all three > servers so they look identical. What I mean by that is should each > Server "replicate" to itself? There is confusion on this matter. I > asked Quanah that back in late January, and he stated that the system > knows about itself so it knows what to ignore. Then last week, he asked > why I had the master replicating to itself. > > Also, since I have refreshAndPersist configured do I need an interval as > well? > > Thanks in advance, > > John > > -----Original Message----- > From: openldap-technical-bounces(a)OpenLDAP.org > [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Borresen, > John - 0442 - MITLL Sent: Friday, February 14, 2014 4:28 PM > To: Quanah Gibson-Mount; openldap-technical(a)openldap.org > Subject: RE: Syncrepl and mmr > > All, > > I just created an mm-server3, using the config_dbase and main_dbase from > mm-server2 -- copied the ldif's I created from mm-server2 then ran > slapadd. > > On mm-server3: > olcServerID: 1 ldap://mm-server1.example.ldap > olcServerID: 2 ldap://mm-server2.example.ldap > olcServerID: 3 ldap://mm-server3.example.ldap > > olcSyncrepl: {0} rid=001 provider=mm-server1.example.ldap > bindmethod=simple binddn="cn=ldapadmin,dc=group42,dc=ldap" > credentials=<password> interval=01:00:00:00 > searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on > type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs=*,+" > syncdata=accesslog starttls=no olcSyncrepl: {1} rid=002 > provider=mm-server2.example.ldap bindmethod=simple > binddn="cn=ldapadmin,dc=group42,dc=ldap" credentials=<password> > interval=01:00:00:00 searchbase="dc=example,dc=ldap" > logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 > +" filter="(objectClass=*)" attrs=*,+" syncdata=accesslog starttls=no > olcSyncrepl: {0} rid=003 provider=mm-server3.example.ldap > bindmethod=simple binddn="cn=ldapadmin,dc=group42,dc=ldap" > credentials=<password> interval=01:00:00:00 > searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on > type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs=*,+" > syncdata=accesslog starttls=no > > Started slapd, no errors. It immediately sync'd up with mm-server1! > Changes that I made on mm-server1 days ago which have never replicated > over to mm-server2...replicated to mm-server3 immediately on startup. > > I had not even got around to adding mm-server3 to mm-server1 (or > mm-server2) yet. > > The olcServerIDs and olcSyncrepl on both mm-server1 and 2 show: > olcServerID: 1 ldap://mm-server1.example.ldap > olcServerID: 2 ldap://mm-server2.example.ldap > > olcSyncrepl: {0} rid=001 provider=mm-server1.example.ldap > bindmethod=simple binddn="cn=ldapadmin,dc=group42,dc=ldap" > credentials=<password> interval=01:00:00:00 > searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on > type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs=*,+" > syncdata=accesslog starttls=no olcSyncrepl: {1} rid=002 > provider=mm-server2.example.ldap bindmethod=simple > binddn="cn=ldapadmin,dc=group42,dc=ldap" credentials=<password> > interval=01:00:00:00 searchbase="dc=example,dc=ldap" > logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 > +" filter="(objectClass=*)" attrs=*,+" syncdata=accesslog starttls=no > > So...now, I am at even more of a loss. Why would mm-server1 be > replicating to mm-server3 and not 2? When the configs are the same > between mm-server2 and 3??? > > > > Thanks in advance... > John > > > -----Original Message----- > From: openldap-technical-bounces(a)OpenLDAP.org > [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Borresen, > John - 0442 - MITLL Sent: Friday, February 14, 2014 1:34 PM > To: Quanah Gibson-Mount; openldap-technical(a)openldap.org > Subject: RE: Syncrepl and mmr > > All, > > If I went off the beaten' path...where did I go wrong? (my config and > error messages are in a previous posting) > > Thanks in advance, > John > > -----Original Message----- > From: openldap-technical-bounces(a)OpenLDAP.org > [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Borresen, > John - 0442 - MITLL Sent: Friday, February 14, 2014 8:40 AM > To: Quanah Gibson-Mount; openldap-technical(a)openldap.org > Subject: RE: Syncrepl and mmr > > Thanks Quanah, > > A few weeks back I asked that question (on 1/30): >> All Masters in the chain have the olcServerID's and olcSynRepl for >> itself and its partner? I can understand having each knowing about >> the others but why itself? It's replicating to itself? > -You replied > -It knows about itself so it knows what to ignore. > > Even in the Admin Guide is specifies setting it up that way...each server > has all the others and itself listed. I was following the procedures > delineated in the Admin Guide and in the man-pages (including how I > understood what was put out on the board): From the Admin Guide: > 8.3.3. N-Way Multi-Master > > For the following example we will be using 3 Master nodes. Keeping in > line with test050-syncrepl-multimaster of the OpenLDAP test suite, we > will be configuring slapd(8) via cn=config > > This sets up the config database: > > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 1 > > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcRootPW: secret > > second and third servers will have a different olcServerID obviously: > > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 2 > > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcRootPW: secret > > This sets up syncrepl as a provider (since these are all masters): > > dn: cn=module,cn=config > objectClass: olcModuleList > cn: module > olcModulePath: /usr/local/libexec/openldap > olcModuleLoad: syncprov.la > > Now we setup the first Master Node (replace $URI1, $URI2 and $URI3 etc. > with your actual ldap urls): > > dn: cn=config > changetype: modify > replace: olcServerID > olcServerID: 1 $URI1 > olcServerID: 2 $URI2 > olcServerID: 3 $URI3 > > dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config > changetype: add > objectClass: olcOverlayConfig > objectClass: olcSyncProvConfig > olcOverlay: syncprov > > dn: olcDatabase={0}config,cn=config > changetype: modify > add: olcSyncRepl > olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" > bindmethod=simple credentials=secret searchbase="cn=config" > type=refreshAndPersist retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" > bindmethod=simple credentials=secret searchbase="cn=config" > type=refreshAndPersist retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=003 provider=$URI3 binddn="cn=config" > bindmethod=simple credentials=secret searchbase="cn=config" > type=refreshAndPersist retry="5 5 300 5" timeout=1 > - > add: olcMirrorMode > olcMirrorMode: TRUE > > I followed what is put in the Admin Guide, etc... > > Thanks > > -----Original Message----- > From: openldap-technical-bounces(a)OpenLDAP.org > [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Quanah > Gibson-Mount Sent: Thursday, February 13, 2014 1:57 PM > To: Borresen, John - 0442 - MITLL; openldap-technical(a)openldap.org > Subject: Re: Syncrepl and mmr > > --On Thursday, February 13, 2014 10:54 AM -0500 "Borresen, John - 0442 - > MITLL" <John.Borresen(a)ll.mit.edu> wrote: > >> All, > > Your configuration is very confused. Why do you have the master > replicate to itself, for example? > > --Quanah > > > -- > > Quanah Gibson-Mount > Architect - Server > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > > > -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 5

AttributeDescription contains inappropriate characters
by Kamran Khan 21 Feb '14

21 Feb '14

Hi All, I'm a bit new to OpenLDAP, and I'm not quite sure what went wrong. I installed OpenLDAP because it was a prerequisite of Moab. After installing OpenLDAP and Moab yesterday, I had everything working just fine. I rebooted the cluster, and now OpenLDAP is not happy. ============================================================ [root@USDTWCLUS01 ~]# service slapd start Checking configuration files for slapd: [FAILED] <= str2entry: str2ad(o): AttributeDescription contains inappropriate characters slaptest: bad configuration file! ============================================================ I understand that something in my configuration must be messed up, but I am really unsure where there error is occuring. I'm unsure where my 'str2entry's are. Any help is greatly appreciated. Like I said, I had it working just fine yesterday, and after a reboot it didn't like something. Thanks. -- Kamran Khan PSSC Labs HPC Software Technical Engineer

3 4

openldap 2.4.33 configure problem - could not locate TLS/ssl package.
by xiaoming zhao 20 Feb '14

20 Feb '14

All, can someone help me out? When building openldap 2.4.33, I got the following error "Could not locate TLS/SSL package". did I missed something in openssl? how to fix it? Thanks in advance for your support! checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking for SSL_library_init in -lssl... no checking for ssl3_accept in -lssl... no checking gnutls/gnutls.h usability... no checking gnutls/gnutls.h presence... no checking for gnutls/gnutls.h... no checking nssutil.h usability... no checking nssutil.h presence... no checking for nssutil.h... no configure: WARNING: Could not locate TLS/SSL package configure: WARNING: TLS data protection not supported Thanks, Eric.

3 2

Re: LDAP via TLS
by Tim Dunphy 20 Feb '14

20 Feb '14

Hey Dan, Those docs you pointed me to worked beautifully! And thanks for the examples from your own config. I've used those too. Worked great! Thanks again. Although I do also apprecaite the advice to read the official docs. Good advice, however the ones that I've been pointed to worked well for me. I'll read the official docs for a fuller understanding tho. Tim On Wed, Feb 19, 2014 at 2:08 PM, Dan Pritts <danno(a)umich.edu> wrote: > I have simply > > TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt > TLSCertificateFile /etc/pki/tls/certs/ldap.icpsr.umich.edu.crt > TLSCertificateKeyFile /etc/pki/tls/private/ldap.icpsr.umich.edu.key > > > in my slapd.conf. CACertificateFile is almost certainly not required > for a server cert. > > > Maybe you are running into an oddity of the cn=config? Have you tried > just opening up the permissions to make sure the files are world readable? > no selinux involved? > > > > Folks on the list will probably yell at you to use the current version > rather than the centos packages. > > If you look through the archives for the last few weeks, you will find a > pointer to a site that has rpm builds of current openldap. > > Tim Dunphy <bluethundr(a)gmail.com> > February 19, 2014 at 1:35 PM > Hey ldap folks! > > I've attempted to add TLS capabilities to my newly created LDAP server > using the following document: > > http://www.server-world.info/en/note?os=CentOS_6&p=ldap&f=3 > > This is how my cert files are looking in terms of ownership and > permissions: > > [root@puppet:~] #ls -l /etc/pki/tls/*/* | grep ldap > -r-------- 1 ldap root 1241 Feb 19 13:06 /etc/pki/tls/certs/ldap.crt > -r-------- 1 ldap root 1021 Feb 19 13:05 /etc/pki/tls/misc/ldap.csr > -r-------- 1 ldap root 1679 Feb 19 13:01 /etc/pki/tls/private/ldap.key > > I got to the point where I'm attempting to add the configuration > parameters to my ldap setup like so: > > [root@puppet:~] #ldapmodify -Y EXTERNAL -H ldapi:/// > SASL/EXTERNAL authentication started > SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > SASL SSF: 0 > dn: cn=config > add: olcTLSCertificateFile > olcTLSCertificateFile: /etc/pki/tls/certs/ldap.crt > - > add: olcTLSCertificateKeyFile > olcTLSCertificateKeyFile: /etc/pki/tls/private/ldap.key > modifying entry "cn=config" > ldap_modify: Inappropriate matching (18) > additional info: modify/add: olcTLSCertificateFile: no equality > matching rule > > > These are the package version numbers I have installed via yum on CentOS > 6.5: > > openldap-2.4.23-34.el6_5.1.x86_64 > openldap-devel-2.4.23-34.el6_5.1.x86_64 > openldap-servers-2.4.23-34.el6_5.1.x86_64 > openldap-clients-2.4.23-34.el6_5.1.x86_64 > > Can anyone offer some wisdom as to why this error is happening? Or perhaps > offer some better documentation on how to enable the TLS abilities of > openldap? > > Thanks > Tim > > -- > GPG me!! > > gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B > > > -- > Dan Pritts > ICPSR Computing & Network Services > University of Michigan > +1 (734)615-7362 > -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

3 2

trouble with acls
by brendan kearney 20 Feb '14

20 Feb '14

list, i am running the below version: @(#) $OpenLDAP: slapd 2.4.26 (Jun 27 2012 15:27:46) $ mockbuild@x86-16.phx2.fedoraproject.org:/builddir/build/BUILD/openldap-2.4.26/openldap-2.4.26/build-servers/servers/slapd i have the below acls: olcAccess: {0}to attrs=userPassword,shadowLastChange by anonymous auth by * none olcAccess: {1}to attrs=loginShell by self write by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to dn.subtree="dc=bpk2,dc=com" by dn="cn=adm-srv,dc=bpk2,dc=com" write by dn="cn=kdc-srv,dc=bpk2,dc=com" read by * none olcAccess: {4}to dn.subtree="dc=bpk2,dc=com" by set="[cn=ldapAdmins,ou=Groups, dc=bpk2,dc=com]/memberUid & user/uid" write by set="[cn=users,ou=Groups,dc=bp k2,dc=com]/memberUid & user/uid" read by * none i issue the below search query: ldapsearch -h ldap1 -Y GSSAPI -b 'dc=bpk2,dc=com' -s sub '(objectclass=ipHost)' and get the below output: SASL/GSSAPI authentication started SASL username: brendan(a)BPK2.COM SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <dc=bpk2,dc=com> with scope subtree # filter: (objectclass=ipHost) # requesting: ALL # # search result search: 4 result: 32 No such object # numResponses: 1 the logs for acls show: 2014-02-19T18:41:17.562950-05:00 server slapd[2033]: => access_allowed: search access to "dc=bpk2,dc=com" "entry" requested 2014-02-19T18:41:17.562976-05:00 server slapd[2033]: => dn: [3] 2014-02-19T18:41:17.562986-05:00 server slapd[2033]: => dn: [4] dc=bpk2,dc=com 2014-02-19T18:41:17.562996-05:00 server slapd[2033]: => acl_get: [4] matched 2014-02-19T18:41:17.563005-05:00 server slapd[2033]: => acl_get: [4] attr entry 2014-02-19T18:41:17.563014-05:00 server slapd[2033]: => acl_mask: access to entry "dc=bpk2,dc=com", attr "entry" requested 2014-02-19T18:41:17.563024-05:00 server slapd[2033]: => acl_mask: to all values by "uid=brendan,ou=users,dc=bpk2,dc=com", (=0) 2014-02-19T18:41:17.563034-05:00 server slapd[2033]: <= check a_dn_pat: cn=adm-srv,dc=bpk2,dc=com 2014-02-19T18:41:17.563043-05:00 server slapd[2033]: <= check a_dn_pat: cn=kdc-srv,dc=bpk2,dc=com 2014-02-19T18:41:17.563052-05:00 server slapd[2033]: <= check a_dn_pat: * 2014-02-19T18:41:17.563290-05:00 server slapd[2033]: <= acl_mask: [3] applying none(=0) (stop) 2014-02-19T18:41:17.563327-05:00 server slapd[2033]: <= acl_mask: [3] mask: none(=0) 2014-02-19T18:41:17.563336-05:00 server slapd[2033]: => slap_access_allowed: search access denied by none(=0) 2014-02-19T18:41:17.563344-05:00 server slapd[2033]: => access_allowed: no more rules i am trying to figure out why i keep getting denied. i tried slapacl: sudo slapacl -F /etc/openldap/slapd.d -v -U brendan(a)BPK2.COM -b "dc=bpk2,dc=com" "dc/read:bpk2,dc=com" this shows a weird user dn and an error: authcDN: "uid=brendan(a)bpk2.com,ou=users,dc=bpk2,dc=com" read access to dc=bpk2,dc=com: DENIED are my olcRegExp statements wrong: olcAuthzRegexp: {0}uid=([^,]*),cn=bpk2.com,cn=gssapi,cn=auth uid=$1,ou=Users,dc=bpk2,dc=com olcAuthzRegexp: {1}uid=([^,]*),cn=gssapi,cn=auth uid=$1,ou=Users,dc=bpk2,dc=com where am i not going about this correctly? any help would be appreciated. brendan kearney

1 0

LDAP via TLS
by Tim Dunphy 19 Feb '14

19 Feb '14

Hey ldap folks! I've attempted to add TLS capabilities to my newly created LDAP server using the following document: http://www.server-world.info/en/note?os=CentOS_6&p=ldap&f=3 This is how my cert files are looking in terms of ownership and permissions: [root@puppet:~] #ls -l /etc/pki/tls/*/* | grep ldap -r-------- 1 ldap root 1241 Feb 19 13:06 /etc/pki/tls/certs/ldap.crt -r-------- 1 ldap root 1021 Feb 19 13:05 /etc/pki/tls/misc/ldap.csr -r-------- 1 ldap root 1679 Feb 19 13:01 /etc/pki/tls/private/ldap.key I got to the point where I'm attempting to add the configuration parameters to my ldap setup like so: [root@puppet:~] #ldapmodify -Y EXTERNAL -H ldapi:/// SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: cn=config add: olcTLSCertificateFile olcTLSCertificateFile: /etc/pki/tls/certs/ldap.crt - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/pki/tls/private/ldap.key modifying entry "cn=config" ldap_modify: Inappropriate matching (18) additional info: modify/add: olcTLSCertificateFile: no equality matching rule These are the package version numbers I have installed via yum on CentOS 6.5: openldap-2.4.23-34.el6_5.1.x86_64 openldap-devel-2.4.23-34.el6_5.1.x86_64 openldap-servers-2.4.23-34.el6_5.1.x86_64 openldap-clients-2.4.23-34.el6_5.1.x86_64 Can anyone offer some wisdom as to why this error is happening? Or perhaps offer some better documentation on how to enable the TLS abilities of openldap? Thanks Tim -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

3 2

RE: Syncrepl and mmr
by Quanah Gibson-Mount 19 Feb '14

19 Feb '14

--On Wednesday, February 19, 2014 2:20 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > First had this (mm-server1): > 5304e1ff olcMirrorMode: value #0: <olcMirrorMode> database is not a shadow > slapadd: could not add entry dn=olcDatabase={1}bdb,cn=config (line=2260) For MMR Mode, MirrorMode must be set to TRUE. If it does not accept TRUE then there is something wrong with your configuration. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

how to get list of valid attributes
by Umar Draz 19 Feb '14

19 Feb '14

HI All I want a list of valid attributes for specific objectClass e.g. I have a user abc with the dn of this user is cn=Abc User,ou=accounts,dc=mydom,dc=com the abc user has these object classes posixAccount shadowAccount OrginizatinalPerson yubikeyUser now I want to get the valid schema attribute of yubikeyUser for only the above mentioned user. Is this possible? Umar

4 3

ldapsearch error - Unknown error (60)
by Auteria W. Winzer Jr. 19 Feb '14

19 Feb '14

To the members of the mailing list, Upon a test search I'm getting the following error: $ ldapsearch -LLL -v -z none -x -e "2.16.840.1.113730.3.4.9" -h bugsbunny.bar -p 9999 -b "ou=foo,o=bar" -D "uid=xxx,ou=foo,o=bar" -w "xxxxxxxx" "(&(objectClass=groupOfUniqueNames)(displayname=*))" displayname ldap_initialize( ldap://bugsbunny.bar:9999 ) filter: (&(objectClass=groupOfUniqueNames)(displayname=*)) requesting: displayname Unknown error (60) Additional information: VLV Control When looking up the error I noticed the following: LDAP_SORT_CONTROL_MISSING - 60 (x'3C) - Unused in standards. Sun LDAP Directory Server only. Server did not receive a required server-side sorting control. Can someone that has experience with this type of LDAP search criteria assist me to obtain a final resolution? Thanks to everyone, and regards, Auteria Winzer Jr.

4 11

Sun LDAP to OpenLDAP
by Suresh Prajapati 18 Feb '14

18 Feb '14

Hi , We are migrating our infrastructure from Sun Solaris to AWS. So as a part of migration we need to do the transition from Sun Directory Server to OpenLDAP. I exported the user database in ldif file from Sun LDAP. Now I am trying to import the database in to OpenLDAP Server on Ubuntu which I've installed in AWS. While importing the database I am getting a lots of error , because the sun schema for storing the users and openldap is totally different. The issue I'm currently stuck on is getting the data in the LDIF into a format that can be imported using slapadd/ldapadd Any help would be appreciated Below are the details for Ubuntu Server and OpenLDAP Server OS : Distributor ID: Ubuntu Description: Ubuntu 10.04 LTS Release: 10.04 OpenLDAP Version : *slapd 2.4.21-0ubuntu5.7 OpenLDAP server (slapd)* Thanks Suresh

3 3

Syncrepl and mmr
by Borresen, John - 0442 - MITLL 18 Feb '14

18 Feb '14

All, The following are excerpts from my multi-master logs and at the end are the cn=config dbase for both systems. I can see that communications are being attempted, but not succeeding. The other day, entries were added to "cn=role2,ou=sudoers,dc=example,dc=ldap" to the Syncrepl... I have opened up my ACLs (may not be reflected in the cn=config below) for "uid=replicator,ou=Admins,dc=example,dc=ldap" and "cn=ldapadmin,dc=example,dc=ldap". The replicator account is the rootDN for /var/lib/openldap/accesslog with read privs on olcDatabase={1}bdb (primary dbase). The ldapadmin account is the rootDN for the olcDatabase={1}bdb and full write privs on the accesslog dbase. The olcSyncRepl rids are authenticating to ldapadmin (I removed the binding to replicator for troubleshooting -- alas no affect). I am hoping some other eyes can see where my mistake(s) are and point me in the correct direction. Honestly, I am not even sure where to start asking questions. If I read the ACLs sections correctly (both in the Admin Guide and man-page), the rootDNs are granted full read/write everywhere privs by default to their respective Databases. So, with that logic I shouldn't have to put the "replicator" in the olcAccess for olcDataBase={2}bdb (accesslog dbase)...only the ldapadmin account should have an entry. Correct? And, I shouldn't have to put the ldapadmin account in the olcAccess for the olcDatabase={1}bdb (primary dbase). Correct? What am I missing? And where? MM-SERVER1: 52fce402 PRESENT 52fce402 => access_allowed: search access to "reqStart=20140211203819.000000Z,cn=accesslog" "objectClass" requested 52fce402 => acl_get: [1] attr objectClass 52fce402 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "objectClass" requested 52fce402 => acl_mask: to all values by "cn=ldapadmin,dc=example,dc=ldap", (=0) 52fce402 <= check a_dn_pat: uid=replicator,ou=admins,dc=example,dc=ldap 52fce402 <= check a_dn_pat: cn=ldapadmin,dc=example,dc=ldap 52fce402 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fce402 <= acl_mask: [2] mask: write(=wrscxd) 52fce402 => slap_access_allowed: search access granted by write(=wrscxd) 52fce402 => access_allowed: search access granted by write(=wrscxd) 52fce402 <= test_filter 6 52fce402 => send_search_entry: conn 2109 dn="reqStart=20140211203819.000000Z,cn=accesslog" 52fce402 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "entry" requested 52fce402 => acl_get: [1] attr entry 52fce402 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "entry" requested 52fce402 => acl_mask: to all values by "cn=ldapadmin,dc=example,dc=ldap", (=0) 52fce402 <= check a_dn_pat: uid=replicator,ou=admins,dc=example,dc=ldap 52fce402 <= check a_dn_pat: cn=ldapadmin,dc=example,dc=ldap 52fce402 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fce402 <= acl_mask: [2] mask: write(=wrscxd) 52fce402 => slap_access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: result not in cache (reqType) 52fce402 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "reqType" requested 52fce402 => acl_get: [1] attr reqType 52fce402 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "reqType" requested 52fce402 => acl_mask: to value by "cn=ldapadmin,dc=example,dc=ldap", (=0) 52fce402 <= check a_dn_pat: uid=replicator,ou=admins,dc=example,dc=ldap 52fce402 <= check a_dn_pat: cn=ldapadmin,dc=example,dc=ldap 52fce402 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fce402 <= acl_mask: [2] mask: write(=wrscxd) 52fce402 => slap_access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: result not in cache (reqDN) 52fce402 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "reqDN" requested 52fce402 => acl_get: [1] attr reqDN 52fce402 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "reqDN" requested 52fce402 => acl_mask: to value by "cn=ldapadmin,dc=example,dc=ldap", (=0) 52fce402 <= check a_dn_pat: uid=replicator,ou=admins,dc=example,dc=ldap 52fce402 <= check a_dn_pat: cn=ldapadmin,dc=example,dc=ldap 52fce402 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fce402 <= acl_mask: [2] mask: write(=wrscxd) 52fce402 => slap_access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: result not in cache (reqMod) 52fce402 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "reqMod" requested 52fce402 => acl_get: [1] attr reqMod 52fce402 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "reqMod" requested 52fce402 => acl_mask: to value by "cn=ldapadmin,dc=example,dc=ldap", (=0) 52fce402 <= check a_dn_pat: uid=replicator,ou=admins,dc=example,dc=ldap 52fce402 <= check a_dn_pat: cn=ldapadmin,dc=example,dc=ldap 52fce402 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fce402 <= acl_mask: [2] mask: write(=wrscxd) 52fce402 => slap_access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: result was in cache (reqMod) 52fce402 => access_allowed: result was in cache (reqMod) 52fce402 => access_allowed: result was in cache (reqMod) 52fce402 => access_allowed: result not in cache (entryCSN) 52fce402 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "entryCSN" requested 52fce402 => acl_get: [1] attr entryCSN 52fce402 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "entryCSN" requested 52fce402 => acl_mask: to value by "cn=ldapadmin,dc=example,dc=ldap", (=0) 52fce402 <= check a_dn_pat: uid=replicator,ou=admins,dc=example,dc=ldap 52fce402 <= check a_dn_pat: cn=ldapadmin,dc=example,dc=ldap 52fce402 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fce402 <= acl_mask: [2] mask: write(=wrscxd) 52fce402 => slap_access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: read access granted by write(=wrscxd) 52fce402 conn=2109 op=1 ENTRY dn="reqStart=20140211203819Z,cn=accesslog" MM-SERVER2: 52fce47a =>do_syncrep2 rid=001 ldap_result ld 0x97b3ed0 msgid 2 wait4msg ld 0x97b3ed0 msgid 2 (infinite timeout) wait4msg continue ld 0x97b3ed0 msgid 2 all 0 ** ld 0x97b3ed0 Connections: * host: mm-server1.example.ldap port: 389 (default) refcnt: 2 status: Connected last used: Thu Feb 13 10:27:54 2014 ** ld 0x97b3ed0 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x97b3ed0 request count 1 (abandoned 0) ** ld 0x97b3ed0 Response Queue: Empty ld 0x97b3ed0 response count 0 ldap_chkResponseList ld 0x97b3ed0 msgid 2 all 0 ldap_chkResponseList returns ld 0x97b3ed0 NULL ldap_int_select read1msg: ld 0x97b3ed0 msgid 2 all 0 ber_get_next ldap_read: want=8, got=8 0000: 30 81 b2 02 01 02 64 48 0.....dH ldap_read: want=173, got=173 0000: 04 0c 63 6e 3d 61 63 63 65 73 73 6c 6f 67 30 38 ..cn=accesslog08 0010: 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 04 28 06..entryCSN1*.( 0020: 32 30 31 34 30 32 30 33 31 38 33 38 33 31 2e 37 20140203183831.7 0030: 35 31 38 33 38 5a 23 30 30 30 30 30 30 23 30 30 51838Z#000000#00 0040: 31 23 30 30 30 30 30 30 a0 63 30 61 04 18 31 2e 1#000000.c0a..1. 0050: 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 2e 31 3.6.1.4.1.4203.1 0060: 2e 39 2e 31 2e 32 04 45 30 43 0a 01 01 04 00 04 .9.1.2.E0C...... 0070: 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 30 31 <rid=001,sid=001 0080: 2c 63 73 6e 3d 32 30 31 34 30 32 30 33 31 38 33 ,csn=20140203183 0090: 38 33 31 2e 37 35 31 38 33 38 5a 23 30 30 30 30 831.751838Z#0000 00a0: 30 30 23 30 30 31 23 30 30 30 30 30 30 00#001#000000 ber_get_next: tag 0x30 len 178 contents: ber_dump: buf=0x9764590 ptr=0x9764590 end=0x9764642 len=178 0000: 02 01 02 64 48 04 0c 63 6e 3d 61 63 63 65 73 73 ...dH..cn=access 0010: 6c 6f 67 30 38 30 36 04 08 65 6e 74 72 79 43 53 log0806..entryCS 0020: 4e 31 2a 04 28 32 30 31 34 30 32 30 33 31 38 33 N1*.(20140203183 0030: 38 33 31 2e 37 35 31 38 33 38 5a 23 30 30 30 30 831.751838Z#0000 0040: 30 30 23 30 30 31 23 30 30 30 30 30 30 a0 63 30 00#001#000000.c0 0050: 61 04 18 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 34 a..1.3.6.1.4.1.4 0060: 32 30 33 2e 31 2e 39 2e 31 2e 32 04 45 30 43 0a 203.1.9.1.2.E0C. 0070: 01 01 04 00 04 3c 72 69 64 3d 30 30 31 2c 73 69 .....<rid=001,si 0080: 64 3d 30 30 31 2c 63 73 6e 3d 32 30 31 34 30 32 d=001,csn=201402 0090: 30 33 31 38 33 38 33 31 2e 37 35 31 38 33 38 5a 03183831.751838Z 00a0: 23 30 30 30 30 30 30 23 30 30 31 23 30 30 30 30 #000000#001#0000 00b0: 30 30 00 read1msg: ld 0x97b3ed0 msgid 2 message type search-entry ber_scanf fmt ({xx) ber: ber_dump: buf=0x9764590 ptr=0x9764593 end=0x9764642 len=175 0000: 64 48 04 0c 63 6e 3d 61 63 63 65 73 73 6c 6f 67 dH..cn=accesslog 0010: 30 38 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 0806..entryCSN1* 0020: 04 28 32 30 31 34 30 32 30 33 31 38 33 38 33 31 .(20140203183831 0030: 2e 37 35 31 38 33 38 5a 23 30 30 30 30 30 30 23 .751838Z#000000# 0040: 30 30 31 23 30 30 30 30 30 30 a0 63 30 61 04 18 001#000000.c0a.. 0050: 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 1.3.6.1.4.1.4203 0060: 2e 31 2e 39 2e 31 2e 32 04 45 30 43 0a 01 01 04 .1.9.1.2.E0C.... 0070: 00 04 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 ..<rid=001,sid=0 0080: 30 31 2c 63 73 6e 3d 32 30 31 34 30 32 30 33 31 01,csn=201402031 0090: 38 33 38 33 31 2e 37 35 31 38 33 38 5a 23 30 30 83831.751838Z#00 00a0: 30 30 30 30 23 30 30 31 23 30 30 30 30 30 30 0000#001#000000 ber_scanf fmt ({a) ber: ber_dump: buf=0x9764590 ptr=0x97645df end=0x9764642 len=99 0000: 30 61 04 18 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 0a..1.3.6.1.4.1. 0010: 34 32 30 33 2e 31 2e 39 2e 31 2e 32 04 45 30 43 4203.1.9.1.2.E0C 0020: 0a 01 01 04 00 04 3c 72 69 64 3d 30 30 31 2c 73 ......<rid=001,s 0030: 69 64 3d 30 30 31 2c 63 73 6e 3d 32 30 31 34 30 id=001,csn=20140 0040: 32 30 33 31 38 33 38 33 31 2e 37 35 31 38 33 38 203183831.751838 0050: 5a 23 30 30 30 30 30 30 23 30 30 31 23 30 30 30 Z#000000#001#000 0060: 30 30 30 000 ber_scanf fmt (o) ber: ber_dump: buf=0x9764590 ptr=0x97645fb end=0x9764642 len=71 0000: 04 45 30 43 0a 01 01 04 00 04 3c 72 69 64 3d 30 .E0C......<rid=0 0010: 30 31 2c 73 69 64 3d 30 30 31 2c 63 73 6e 3d 32 01,sid=001,csn=2 0020: 30 31 34 30 32 30 33 31 38 33 38 33 31 2e 37 35 0140203183831.75 0030: 31 38 33 38 5a 23 30 30 30 30 30 30 23 30 30 31 1838Z#000000#001 0040: 23 30 30 30 30 30 30 #000000 ldap_get_dn_ber ber_scanf fmt ({ml{) ber: ber_dump: buf=0x9764590 ptr=0x9764593 end=0x9764642 len=175 0000: 64 48 04 0c 63 6e 3d 61 63 63 65 73 73 6c 6f 67 dH..cn=accesslog 0010: 30 38 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 0806..entryCSN1* 0020: 04 28 32 30 31 34 30 32 30 33 31 38 33 38 33 31 .(20140203183831 0030: 2e 37 35 31 38 33 38 5a 23 30 30 30 30 30 30 23 .751838Z#000000# 0040: 30 30 31 23 30 30 30 30 30 30 a0 63 30 61 04 18 001#000000.c0a.. 0050: 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 1.3.6.1.4.1.4203 0060: 2e 31 2e 39 2e 31 2e 32 04 45 30 43 0a 01 01 04 .1.9.1.2.E0C.... 0070: 00 04 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 ..<rid=001,sid=0 0080: 30 31 2c 63 73 6e 3d 32 30 31 34 30 32 30 33 31 01,csn=201402031 0090: 38 33 38 33 31 2e 37 35 31 38 33 38 5a 23 30 30 83831.751838Z#00 00a0: 30 30 30 30 23 30 30 31 23 30 30 30 30 30 30 0000#001#000000 ber_scanf fmt ({em) ber: ber_dump: buf=0x950b980 ptr=0x950b980 end=0x950b9c5 len=69 0000: 30 43 0a 01 01 04 00 04 3c 72 69 64 3d 30 30 31 0C......<rid=001 0010: 2c 73 69 64 3d 30 30 31 2c 63 73 6e 3d 32 30 31 ,sid=001,csn=201 0020: 34 30 32 30 33 31 38 33 38 33 31 2e 37 35 31 38 40203183831.7518 0030: 33 38 5a 23 30 30 30 30 30 30 23 30 30 31 23 30 38Z#000000#001#0 0040: 30 30 30 30 30 00000 52fce47a do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) ldap_msgfree ldap_free_request (origid 2, msgid 2) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 17 0000: 30 05 02 01 03 42 00 0....B. ldap_write: want=7, written=7 0000: 30 05 02 01 03 42 00 0....B. ldap_free_connection: actually freed 52fce47a do_syncrepl: rid=001 rc -1 retrying 52fce47a daemon: activity on 1 descriptor 52fce47a daemon: activity on:52fce47a 52fce47a daemon: epoll: listen=7 active_threads=0 tvp=zero MM-SERVER2: dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /usr/local/openldap/etc/openldap/slapd.conf olcConfigDir: /usr/local/openldap/etc/openldap/slapd.d olcArgsFile: /var/lib/openldap/run/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcListenerThreads: 1 olcLocalSSF: 71 olcPidFile: /var/lib/openldap/run/slapd.pid olcReadOnly: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcTLSProtocolMin: 0.0 olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal entryUUID: 1b256f1e-2f15-4538-8a6f-5b021d015e35 creatorsName: cn=config createTimestamp: 20140122200748Z olcLogLevel: stats olcSecurity: tls=0 olcServerID: 1 ldap://mm-server1.example.ldap olcServerID: 2 ldap://mm-server2.example.ldap entryCSN: 20140131211613.134974Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140131211613Z dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}syncprov olcModuleLoad: {1}accesslog structuralObjectClass: olcModuleList entryUUID: 1191cf8f-8d46-4f2e-8aba-e65537210029 creatorsName: cn=admin,cn=config createTimestamp: 20140129175231Z entryCSN: 20140129175429.232704Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129175429Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by self write by users read by anonymous auth olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 77451682-9629-4753-9a80-5cc0e69a7482 creatorsName: cn=config createTimestamp: 20140122200748Z entryCSN: 20140122200748.381523Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140122200748Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: d7f25d3b-7ad1-4625-a577-a23a22b5494d creatorsName: cn=config createTimestamp: 20140122200748Z entryCSN: 20140122200748.381523Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140122200748Z dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=example,dc=ldap olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=ldapadmin,dc=example,dc=ldap olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/openldap/openldap-data olcDbCacheSize: 1000 olcDbConfig: {0}# $OpenLDAP$ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databas es. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-d b/db/ref/env/db_config.html> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig:: ezh9Iwk8aHR0cDovL3d3dy5vcGVubGRhcC5vcmcvZmFxL2luZGV4LmNnaT9maWxl PTI+ olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon re building olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 0.25 GB cache olcDbConfig: {16}set_cachesize 0 268435456 1 olcDbConfig: {17} olcDbConfig: {18}# Data Directory olcDbConfig: {19}#set_data_dir db olcDbConfig: {20} olcDbConfig: {21}# Transaction Log settings olcDbConfig: {22}set_lg_regionmax 262144 olcDbConfig: {23}set_lg_bsize 2097152 olcDbConfig: {24}#set_lg_dir logs olcDbConfig: {25} olcDbConfig: {26}# Note: special DB_CONFIG flags are no longer needed for "qui ck" olcDbConfig:: ezI3fSMgc2xhcGFkZCg4KSBvciBzbGFwaW5kZXgoOCkgYWNjZXNzIChzZWUgdGhl aXIgLXEgb3B0aW9uKS4g olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn eq,sub olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: sn eq,sub olcDbIndex: mail eq,sub olcDbIndex: departmentNumber eq olcDbIndex: automountKey eq olcDbIndex: memberUid eq olcDbIndex: printerURI eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 5a87b5f1-c445-4e0e-ba97-6d2d63093704 creatorsName: cn=config createTimestamp: 20140122200748Z olcMirrorMode: TRUE olcLimits: {0}dn.exact="cn=ldapadmin,dc=example,dc=ldap" size=unlimited time=u nlimited olcSyncrepl: {0}rid=002 provider=ldap://mm-server2.example.ldap bindmethod=simple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcSyncrepl: {1}rid=001 provider=ldap://mm-server1.example.ldap bindmethod=simple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn.exact="cn=ldapadmin,dc=example,dc=ldap" write by dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" read by * none olcAccess: {1}to * by * read entryCSN: 20140203200931.503493Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140203200931Z dn: olcOverlay={0}syncprov,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 04afe1bf-40c7-425a-8b25-74f8687323fc creatorsName: cn=admin,cn=config createTimestamp: 20140129180447Z entryCSN: 20140129180447.701059Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180447Z dn: olcOverlay={1}accesslog,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig entryUUID: 54b5fa00-8244-41d3-923d-0743a10bf192 creatorsName: cn=admin,cn=config createTimestamp: 20140129180903Z entryCSN: 20140129180903.479192Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180903Z dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/openldap/accesslog olcSuffix: cn=accesslog olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart structuralObjectClass: olcBdbConfig entryUUID: ff63820b-fbe4-4a65-8c00-99e2cc28fca5 creatorsName: cn=admin,cn=config createTimestamp: 20140129175923Z olcAccess: {0}to * by dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" w rite by * none olcLimits: {0}dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" time.soft =unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcRootDN: uid=replicator,ou=Admins,dc=example,dc=ldap entryCSN: 20140203190415.581904Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140203190415Z dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 9246709d-7a9b-41f3-bca8-f665add4e4f2 creatorsName: cn=admin,cn=config createTimestamp: 20140129180331Z entryCSN: 20140129180331.702641Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180331Z MM-SERVER2: dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /usr/local/openldap/etc/openldap/slapd.conf olcConfigDir: /usr/local/openldap/etc/openldap/slapd.d olcArgsFile: /var/lib/openldap/run/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcListenerThreads: 1 olcLocalSSF: 71 olcPidFile: /var/lib/openldap/run/slapd.pid olcReadOnly: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcTLSProtocolMin: 0.0 olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal entryUUID: 84a58742-a1ce-4714-a743-14daf3f40c75 creatorsName: cn=config createTimestamp: 20131218155313Z olcLogLevel: stats olcSecurity: tls=0 olcServerID: 1 ldap://mm-server1.example.ldap olcServerID: 2 ldap://mm-server2.example.ldap entryCSN: 20140131211906.564734Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140131211906Z contextCSN: 20140206183618.370299Z#000000#002#000000 contextCSN: 20140121211615.993780Z#000000#004#000000 dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}syncprov olcModuleLoad: {1}accesslog structuralObjectClass: olcModuleList entryUUID: ab2c7f52-e10f-4233-aa17-ac8b051defcf creatorsName: cn=admin,cn=config createTimestamp: 20140129182320Z entryCSN: 20140129182642.147840Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129182642Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by self write by users read by anonymous auth olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 46ec808c-285f-442f-8c70-d5bb8c2d39de creatorsName: cn=config createTimestamp: 20131218155313Z entryCSN: 20131218155313.477459Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20131218155313Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 4354a8b6-8a36-4804-81f8-14a8550aef74 creatorsName: cn=config createTimestamp: 20131218155313Z entryCSN: 20131218155313.477459Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20131218155313Z dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 644d3984-d125-446e-aae2-1ddc541f4661 creatorsName: cn=admin,cn=config createTimestamp: 20140121191314Z entryCSN: 20140121191314.076259Z#000000#004#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140121191314Z dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=example,dc=ldap olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=ldapadmin,dc=example,dc=ldap olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/openldap/openldap-data olcDbCacheSize: 1000 olcDbConfig: {0}# $OpenLDAP$ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databas es. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-d b/db/ref/env/db_config.html> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig:: ezh9Iwk8aHR0cDovL3d3dy5vcGVubGRhcC5vcmcvZmFxL2luZGV4LmNnaT9maWxl PTI+ olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon re building olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 0.25 GB cache olcDbConfig: {16}#set_cachesize 0 268435456 1 olcDbConfig: {17}set_cachesize 0 2147483648 1 olcDbConfig: {18} olcDbConfig: {19}# Data Directory olcDbConfig: {20}#set_data_dir db olcDbConfig: {21} olcDbConfig: {22}# Archive/deletion olcDbConfig: {23}set_flags DB_LOG_AUTOREMOVE olcDbConfig: {24} olcDbConfig: {25}# Transaction Log settings olcDbConfig: {26}set_lg_regionmax 262144 olcDbConfig: {27}set_lg_bsize 2097152 olcDbConfig: {28}#set_lg_dir logs olcDbConfig: {29} olcDbConfig: {30}# Note: special DB_CONFIG flags are no longer needed for "qui ck" olcDbConfig:: ezMxfSMgc2xhcGFkZCg4KSBvciBzbGFwaW5kZXgoOCkgYWNjZXNzIChzZWUgdGhl aXIgLXEgb3B0aW9uKS4g olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn eq,sub olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: sn eq,sub olcDbIndex: departmentNumber eq olcDbIndex: mail eq,sub olcDbIndex: automountKey eq olcDbIndex: memberUid eq olcDbIndex: printerURI eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 94ff450b-aa70-4507-9ca6-51cdd740ea3e creatorsName: cn=config createTimestamp: 20131218155313Z olcMirrorMode: TRUE olcLimits: {0}dn.exact="cn=ldapadmin,dc=example,dc=ldap" size=unlimited time=u nlimited olcSyncrepl: {0}rid=001 provider=ldap://mm-server1.example.ldap bindmethod=si mple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcSyncrepl: {1}rid=002 provider=ldap://mm-server2.example.ldap bindmethod=si mple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn.exact="cn=ldapadmin,dc=example,dc=ldap" write by dn.exact="uid=r eplicator,ou=Admins,dc=example,dc=ldap" read olcAccess: {1}to * by * read entryCSN: 20140206183618.370299Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140206183618Z dn: olcOverlay={0}accesslog,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {0}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig entryUUID: 6e4e1508-5eb9-4372-bbd1-813f859b0acc creatorsName: cn=admin,cn=config createTimestamp: 20140129182321Z entryCSN: 20140129182321.004272Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129182321Z dn: olcOverlay={1}syncprov,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 9108e0db-ba9e-4b40-b743-4016c61582bc creatorsName: cn=admin,cn=config createTimestamp: 20140129183014Z entryCSN: 20140129183014.073365Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129183014Z dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/openldap/accesslog olcSuffix: cn=accesslog olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart structuralObjectClass: olcBdbConfig entryUUID: 9b42a346-de9b-42d5-8a3b-3167f80d4b01 creatorsName: cn=admin,cn=config createTimestamp: 20140129182320Z olcAccess: {0}to * by dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" w rite by * none olcLimits: {0}dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" time.soft =unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcRootDN: uid=replicator,ou=Admins,dc=example,dc=ldap entryCSN: 20140203190210.968231Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140203190210Z dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 0366206b-4295-4463-952c-0b233646c24d creatorsName: cn=admin,cn=config createTimestamp: 20140129182831Z entryCSN: 20140129182831.866738Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129182831Z dn: olcDatabase={3}monitor,cn=config objectClass: olcDatabaseConfig olcAccess: {0}to dn.children="cn=monitor" by dn.children="cn=admin,cn=config" read olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcMonitoring: TRUE structuralObjectClass: olcDatabaseConfig entryUUID: 691d6dfc-82af-4e12-8f03-be93d5d5436b creatorsName: cn=admin,cn=config createTimestamp: 20140114170424Z entryCSN: 20140114170424.436842Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140114170424Z olcDatabase: {3}monitor Thanks in advance, John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu

2 5

LMDB: transactions across dbis, dbi lifetime
by Martin Lucina 18 Feb '14

18 Feb '14

Hi, I'm having trouble understanding the interaction between txns and dbis in LMDB. Quoting from the docs for mdb_dbi_open(): The database handle will be private to the current transaction until the transaction is successfully committed. If the transaction is aborted the handle will be closed automatically. After a successful commit the handle will reside in the shared environment, and may be used by other transactions. This function must not be called from multiple concurrent transactions. A transaction that uses this function must finish (either commit or abort) before any other transaction may use this function. 1. Is it legal to: a. begin a txn b. open a bunch of dbis in that txn. c. perform some operations (get/put) on distinct dbis. d. commit the txn. In other words, may a txn span multiple dbis? 2. AFTER the initial transaction in which mdb_dbi_open() was called has been committed, can I freely use the dbi in subsequent transactions? I.e. stash it away in a static variable? 3. Is the dbi still valid if a subsequent transaction on it is aborted with mdb_txn_abort()? The first part of the quoted paragraph suggests not...? I have tested at least points 1. and 2. above and "it seems to work" but I'd like to verify that this is actually expected usage. I've not particularly tested for point 3. but it would make programming to the API rather hard if I had to reopen dbis whenever a higher level operation fails. Martin

2 2

Use the current date/timestamp in filters
by Laurent Meunier 17 Feb '14

17 Feb '14

Hi, I'm trying to build a ldap query with the current date or the current timestamp (something like myAttributeDate >= now()). All solutions I've found on Internet require to compute the current date in a script and then build the ldap query with the computed date. Unfortunately, I can't do this because the ldap query will be in a static file: ldap_filter in /etc/saslauthd.conf. Is it possible with OpenLDAP to use the current date or timestamp in a ldap query without compute it in a script? Thanks. -- Laurent Meunier <laurent(a)deltalima.net>

4 5

ldap/pwd complexity and PAM?
by Doug OLeary 16 Feb '14

16 Feb '14

Hi; In my free time, I've been studying openldap and the ppolicy overlay. I started working on password complexity today. While searching for information on implementing complexity, I ran across the link immediately following which seems to indicate that openldap honors the settings in /etc/pam.d/password-auth. http://ubuntuforums.org/showthread.php?t=2172393 I tried configuring that on a test kvm and can't even get it working with local accounts so obviously I borked something in the password-auth file - like maybe not even the right pam.d file; however, before I spend a whole lot of time troubleshooting this, is my understanding accurate? Will openldap honor the settings in pam.d? It seems that'd be a whole lot cleaner and more supportable than compiling a specialized password checking module. Any info greatly appreciated. Thanks for your time. Doug O'Leary ------------ Senior UNIX/Security Admin CISSP, CISA, RHCSA, CEH O'Leary Computers Inc dkoleary(a)olearycomputers.com (w) 630-904-6098 (c) 630-248-2749 linkedin: http://www.linkedin.com/in/dkoleary resume: http://www.olearycomputers.com/resume.html

3 3

MIT Kerberos and LDAP Backend Passwords synchronization
by Abdelkader Chelouah 14 Feb '14

14 Feb '14

Hello all, I configured a KDC (MIT Kerberos 1.12.1) with an OpenLDAP (2.4.32) Backend. Everything is working fine. We want to migrate smoothly from LDAP password to KDC password. For that purpose, we plan to force user to change their password using ldappasswd command, intercept the password modification with smbkrb5pwd overlay and then change the userPassword attribute for SASL passthrough. I setup up the overlay smbkrb5pwd (last git version) to synchronized LDAP and Kerberos passwords as decribed on https://github.com/opinsys/smbkrb5pwd The module is loaded correctly. However, the "ldappasswd" command hangs now. This is apparently due to a locking issue. Is anyone succeeded to configure the overlay ? Is there any other way to synchronize LDAP et KDC passwords when OpenLDAP is used as a Backend ?

3 4

LDAP proxy and memberOf overlay
by Ingo Mailinglists 13 Feb '14

13 Feb '14

Hi List, I am currently stuck with setting up OpenLDAP servers to fully address my use case. I hope someone here can point me in the right direction. I think it comes down to the point at where I do not know how to use the memberOf overlay with an LDAP proxy (back_ldap). First the use case: * I have a corporate OpenLDAP server that holds entries for our employees * There are also multiple http-based services which are allowed to be used after successful user authentication and given that group membership requirements are met. * The http-based services need to be accessed by both internal employees (those for which entries are stored in the corporate OpenLDAP server) and external people (for which there are no user entries yet). The task is to come up with an approach that supports the following: * allow the http-based services to authenticate both internal and external users against an OpenLDAP server * allow authorization based on group memberships * entries that represent external people are not allowed to be stored in the existing corporate OpenLDAP server * entries that represent group memberships are not allowed to be stored in the existing corporate OpenLDAP server * in general, no changes to the corporate OpenLDAP server are allowed at all Here is my approach so far: * I have set up a new OpenLDAP server with two databases. * The first is a local hdb database. The suffix is set to a subordinate of the corporate OpenLDAP server. * The second is a ldap database, which points to and has the same suffix as the corporate OpenLDAP server. The purpose of the local hdb database is twofold * it should store entries for external people * it should store the group memberships for both external people and employees from my own company I did some tests with Apache 2.2.22, mod_ldap and mod_authnz_ldap. I can authenticate both types of users (external from hdb and internal from ldap). I can even authorize them based on their group membership (using groupOfNames stored in the local hdb database). The group membership check also works for user entries that are proxied via the ldap database backend. However, the approach fails for services that need the memberOf overlay for making authorization decisions based on group membership (ownCloud is such an example). I have enabled the memberOf overlay for the local hdb database. So external users are not the problem. However, I cannot enable it for the ldap database, as I am not allowed to make any changes to the user entries of the corporate OpenLDAP server. That is, I am not allowed to add the memberOf attribute to the respective entries - even if ACLs would allow me to do so. Now this is the point where I am stuck. Basically, I am looking for a way to add the memberOf attribute to proxied user entries locally on my new OpenLDAP server, without affecting the entries in the corporate OpenLDAP server. Any help that might point me in the right direction is highly appreciated. Thanks, Ingo

3 2

k5start
by Brendan Kearney 13 Feb '14

13 Feb '14

i am looking to move away from credentials in my configs, and want to use k5start to maintain the kerberos ticket for replication. i am wondering if any folks here are using k5start to do this, in addition to using k5start on the same machine to maintain tickets for other processes? nslcd is one example that would use k5start to maintain the kerberos ticket. is anyone using k5start to maintain tickets for more than one process, on one machine?

1 0

Proper way to configure custom schemas
by Nerijus Kislauskas 13 Feb '14

13 Feb '14

Hi, What is a proper set of actions to add attribute via cn=config to custom schema, also add attribute to custom objectclass? My way: 1. Add attribute 2. Delete old objectlass definition 3. Add new objectClass with new attribute included What if I have 100 objectClasses, and want replace only 1? I am in trouble to do this on Debian wheezy, slapd 2.4.31. My test.ldif: ------------------------------------------ dn: cn={8}ktuEduPerson,cn=schema,cn=config changetype: modify add: olcAttributeTypes olcAttributeTypes: ( ktuAttributeType:36 NAME 'macaroni' DESC 'LDAP attribute for macaroni' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSub stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) Let's add the attribute: $ ldapmodify ... -f test.ldif Enter LDAP Password: modifying entry "cn={8}ktuEduPerson,cn=schema,cn=config" ldap_modify: No such object (32) $ Ooops, something went wrong, but cn=config sees this attribute: $ ldapsearch ... "cn={8}ktuEduPerson,cn=schema,cn=config" | grep macaroni Enter LDAP Password: olcAttributeTypes: {41}( ktuAttributeType:36 NAME 'macaroni' DESC 'LDAP ... $ But in case of VM/slapd restart, my macaroni attribute will be gone: $ sudo grep -iR macaroni /etc/ldap/slapd.d/ $ Access rights of process and config files are ok. Changing lets say olcLogLevel works fine, config is synced. Am I the only one in the world facing this problem? Or I should fill 69th bug on slapd in Debian? Is slapd package usable in Debian for something bigger than kindergarden? And yes, I know about "Why is using the OpenLDAP server from a Linux distribution not recommended?". -- Sincerely, Nerijus Kislauskas KTU ITD, Litnet valdymo centras Studentu g. 48a - 101, Kaunas tel.: (8~37) 30 06 45 mob. tel.: 8-614-93889 e-mail.: nerijus.kislauskas(a)ktu.lt

4 6

slapo-accesslog
by Michael 13 Feb '14

13 Feb '14

I'm trying to configure a means to be able to get the lastlogin time for users in my environment. However, since I'm stuck using the RHEL version of OpenLDAP I can't take advantage of the "lastbind overlay" Here's my config. overlay accesslog logdb cn=accesslog logops bind logsuccess TRUE # scan the accesslog DB every day, and purge entries older than 90 days logpurge 90+00:00 01+00:00 The accesslog DB is populated and I can query for BIND operations, however the only BIND operations that get recorded are BINDS to the LDAP server itself. BINDS to clients do not get recorded in the accesslog. Is this the advertised behavior of the accesslog? -Mike

4 5

Syncrepl and mmr
by Borresen, John - 0442 - MITLL 12 Feb '14

12 Feb '14

All, Hope I am not persona non grata (that is supposed to be funny) based on the responses I received from my last post earlier today. Tomorrow I am starting from scratch...I have one week to get this working -- afraid to find out what will happen after that. Anyway, I've increased the syslog verbosity on both servers. mm-server1: 52fbefc2 <= send_search_entry: conn 1013 exit. 52fbefc2 => test_filter 52fbefc2 PRESENT 52fbefc2 => access_allowed: search access to "reqStart=20140211203819.000000Z,cn=accesslog" "objectClass" requested 52fbefc2 => acl_get: [1] attr objectClass 52fbefc2 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "objectClass" requested 52fbefc2 => acl_mask: to all values by "cn=ldapadmin,dc=group42,dc=ldap", (=0) 52fbefc2 <= check a_dn_pat: uid=replicator,ou=admins,dc=group42,dc=ldap 52fbefc2 <= check a_dn_pat: cn=ldapadmin,dc=group42,dc=ldap 52fbefc2 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fbefc2 <= acl_mask: [2] mask: write(=wrscxd) 52fbefc2 => slap_access_allowed: search access granted by write(=wrscxd) 52fbefc2 => access_allowed: search access granted by write(=wrscxd) 52fbefc2 <= test_filter 6 52fbefc2 => send_search_entry: conn 1013 dn="reqStart=20140211203819.000000Z,cn=accesslog" 52fbefc2 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "entry" requested 52fbefc2 => acl_get: [1] attr entry 52fbefc2 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "entry" requested 52fbefc2 => acl_mask: to all values by "cn=ldapadmin,dc=group42,dc=ldap", (=0) 52fbefc2 <= check a_dn_pat: uid=replicator,ou=admins,dc=group42,dc=ldap 52fbefc2 <= check a_dn_pat: cn=ldapadmin,dc=group42,dc=ldap 52fbefc2 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fbefc2 <= acl_mask: [2] mask: write(=wrscxd) 52fbefc2 => slap_access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: result not in cache (reqType) 52fbefc2 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "reqType" requested 52fbefc2 => acl_get: [1] attr reqType 52fbefc2 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "reqType" requested 52fbefc2 => acl_mask: to value by "cn=ldapadmin,dc=group42,dc=ldap", (=0) 52fbefc2 <= check a_dn_pat: uid=replicator,ou=admins,dc=group42,dc=ldap 52fbefc2 <= check a_dn_pat: cn=ldapadmin,dc=group42,dc=ldap 52fbefc2 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fbefc2 <= acl_mask: [2] mask: write(=wrscxd) 52fbefc2 => slap_access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: result not in cache (reqDN) 52fbefc2 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "reqDN" requested 52fbefc2 => acl_get: [1] attr reqDN 52fbefc2 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "reqDN" requested 52fbefc2 => acl_mask: to value by "cn=ldapadmin,dc=group42,dc=ldap", (=0) 52fbefc2 <= check a_dn_pat: uid=replicator,ou=admins,dc=group42,dc=ldap 52fbefc2 <= check a_dn_pat: cn=ldapadmin,dc=group42,dc=ldap 52fbefc2 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fbefc2 <= acl_mask: [2] mask: write(=wrscxd) 52fbefc2 => slap_access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: result not in cache (reqMod) 52fbefc2 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "reqMod" requested 52fbefc2 => acl_get: [1] attr reqMod 52fbefc2 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "reqMod" requested 52fbefc2 => acl_mask: to value by "cn=ldapadmin,dc=group42,dc=ldap", (=0) 52fbefc2 <= check a_dn_pat: uid=replicator,ou=admins,dc=group42,dc=ldap 52fbefc2 <= check a_dn_pat: cn=ldapadmin,dc=group42,dc=ldap 52fbefc2 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fbefc2 <= acl_mask: [2] mask: write(=wrscxd) 52fbefc2 => slap_access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: result was in cache (reqMod) 52fbefc2 => access_allowed: result was in cache (reqMod) 52fbefc2 => access_allowed: result was in cache (reqMod) 52fbefc2 => access_allowed: result not in cache (entryCSN) 52fbefc2 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "entryCSN" requested 52fbefc2 => acl_get: [1] attr entryCSN 52fbefc2 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "entryCSN" requested 52fbefc2 => acl_mask: to value by "cn=ldapadmin,dc=group42,dc=ldap", (=0) 52fbefc2 <= check a_dn_pat: uid=replicator,ou=admins,dc=group42,dc=ldap 52fbefc2 <= check a_dn_pat: cn=ldapadmin,dc=group42,dc=ldap 52fbefc2 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fbefc2 <= acl_mask: [2] mask: write(=wrscxd) 52fbefc2 => slap_access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: read access granted by write(=wrscxd) 52fbefc2 conn=1013 op=1 ENTRY dn="reqStart=20140211203819Z,cn=accesslog" 52fbefc2 daemon: activity on 1 descriptor 52fbefc2 daemon: activity on:52fbefc2 18r52fbefc2 52fbefc2 daemon: read active on 18 52fbefc2 daemon: epoll: listen=7 active_threads=0 tvp=zero 52fbefc2 daemon: activity on 1 descriptor 52fbefc2 daemon: activity on:52fbefc2 52fbefc2 daemon: epoll: listen=7 active_threads=0 tvp=zero 52fbefc2 daemon: activity on 1 descriptor 52fbefc2 daemon: activity on:52fbefc2 52fbefc2 daemon: epoll: listen=7 active_threads=0 tvp=zero 52fbefc2 connection_get(18) 52fbefc2 connection_get(18): got connid=1013 52fbefc2 connection_read(18): checking for input on id=1013 ber_get_next ldap_read: want=8, got=7 0000: 30 05 02 01 03 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x76a43d0 ptr=0x76a43d0 end=0x76a43d5 len=5 0000: 02 01 03 42 00 ...B. 52fbefc2 op tag 0x42, time 1392242626 ber_get_next ldap_read: want=8, got=0 mm-server2: 52fbf12a =>do_syncrep2 rid=001 ldap_result ld 0x9715890 msgid 2 wait4msg ld 0x9715890 msgid 2 (infinite timeout) wait4msg continue ld 0x9715890 msgid 2 all 0 ** ld 0x9715890 Connections: * host: mm-server1.example.ldap port: 389 (default) refcnt: 2 status: Connected last used: Wed Feb 12 17:09:46 2014 ** ld 0x9715890 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x9715890 request count 1 (abandoned 0) ** ld 0x9715890 Response Queue: Empty ld 0x9715890 response count 0 ldap_chkResponseList ld 0x9715890 msgid 2 all 0 ldap_chkResponseList returns ld 0x9715890 NULL ldap_int_select read1msg: ld 0x9715890 msgid 2 all 0 ber_get_next ldap_read: want=8, got=8 0000: 30 81 b2 02 01 02 64 48 0.....dH ldap_read: want=173, got=173 0000: 04 0c 63 6e 3d 61 63 63 65 73 73 6c 6f 67 30 38 ..cn=accesslog08 0010: 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 04 28 06..entryCSN1*.( 0020: 32 30 31 34 30 32 30 33 31 38 33 38 33 31 2e 37 20140203183831.7 0030: 35 31 38 33 38 5a 23 30 30 30 30 30 30 23 30 30 51838Z#000000#00 0040: 31 23 30 30 30 30 30 30 a0 63 30 61 04 18 31 2e 1#000000.c0a..1. 0050: 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 2e 31 3.6.1.4.1.4203.1 0060: 2e 39 2e 31 2e 32 04 45 30 43 0a 01 01 04 00 04 .9.1.2.E0C...... 0070: 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 30 31 <rid=001,sid=001 0080: 2c 63 73 6e 3d 32 30 31 34 30 32 30 33 31 38 33 ,csn=20140203183 0090: 38 33 31 2e 37 35 31 38 33 38 5a 23 30 30 30 30 831.751838Z#0000 00a0: 30 30 23 30 30 31 23 30 30 30 30 30 30 00#001#000000 ber_get_next: tag 0x30 len 178 contents: ber_dump: buf=0x9762840 ptr=0x9762840 end=0x97628f2 len=178 0000: 02 01 02 64 48 04 0c 63 6e 3d 61 63 63 65 73 73 ...dH..cn=access 0010: 6c 6f 67 30 38 30 36 04 08 65 6e 74 72 79 43 53 log0806..entryCS 0020: 4e 31 2a 04 28 32 30 31 34 30 32 30 33 31 38 33 N1*.(20140203183 0030: 38 33 31 2e 37 35 31 38 33 38 5a 23 30 30 30 30 831.751838Z#0000 0040: 30 30 23 30 30 31 23 30 30 30 30 30 30 a0 63 30 00#001#000000.c0 0050: 61 04 18 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 34 a..1.3.6.1.4.1.4 0060: 32 30 33 2e 31 2e 39 2e 31 2e 32 04 45 30 43 0a 203.1.9.1.2.E0C. 0070: 01 01 04 00 04 3c 72 69 64 3d 30 30 31 2c 73 69 .....<rid=001,si 0080: 64 3d 30 30 31 2c 63 73 6e 3d 32 30 31 34 30 32 d=001,csn=201402 0090: 30 33 31 38 33 38 33 31 2e 37 35 31 38 33 38 5a 03183831.751838Z 00a0: 23 30 30 30 30 30 30 23 30 30 31 23 30 30 30 30 #000000#001#0000 00b0: 30 30 00 read1msg: ld 0x9715890 msgid 2 message type search-entry ber_scanf fmt ({xx) ber: ber_dump: buf=0x9762840 ptr=0x9762843 end=0x97628f2 len=175 0000: 64 48 04 0c 63 6e 3d 61 63 63 65 73 73 6c 6f 67 dH..cn=accesslog 0010: 30 38 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 0806..entryCSN1* 0020: 04 28 32 30 31 34 30 32 30 33 31 38 33 38 33 31 .(20140203183831 0030: 2e 37 35 31 38 33 38 5a 23 30 30 30 30 30 30 23 .751838Z#000000# 0040: 30 30 31 23 30 30 30 30 30 30 a0 63 30 61 04 18 001#000000.c0a.. 0050: 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 1.3.6.1.4.1.4203 0060: 2e 31 2e 39 2e 31 2e 32 04 45 30 43 0a 01 01 04 .1.9.1.2.E0C.... 0070: 00 04 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 ..<rid=001,sid=0 0080: 30 31 2c 63 73 6e 3d 32 30 31 34 30 32 30 33 31 01,csn=201402031 0090: 38 33 38 33 31 2e 37 35 31 38 33 38 5a 23 30 30 83831.751838Z#00 00a0: 30 30 30 30 23 30 30 31 23 30 30 30 30 30 30 0000#001#000000 ber_scanf fmt ({a) ber: ber_dump: buf=0x9762840 ptr=0x976288f end=0x97628f2 len=99 0000: 30 61 04 18 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 0a..1.3.6.1.4.1. 0010: 34 32 30 33 2e 31 2e 39 2e 31 2e 32 04 45 30 43 4203.1.9.1.2.E0C 0020: 0a 01 01 04 00 04 3c 72 69 64 3d 30 30 31 2c 73 ......<rid=001,s 0030: 69 64 3d 30 30 31 2c 63 73 6e 3d 32 30 31 34 30 id=001,csn=20140 0040: 32 30 33 31 38 33 38 33 31 2e 37 35 31 38 33 38 203183831.751838 0050: 5a 23 30 30 30 30 30 30 23 30 30 31 23 30 30 30 Z#000000#001#000 0060: 30 30 30 000 ber_scanf fmt (o) ber: ber_dump: buf=0x9762840 ptr=0x97628ab end=0x97628f2 len=71 0000: 04 45 30 43 0a 01 01 04 00 04 3c 72 69 64 3d 30 .E0C......<rid=0 0010: 30 31 2c 73 69 64 3d 30 30 31 2c 63 73 6e 3d 32 01,sid=001,csn=2 0020: 30 31 34 30 32 30 33 31 38 33 38 33 31 2e 37 35 0140203183831.75 0030: 31 38 33 38 5a 23 30 30 30 30 30 30 23 30 30 31 1838Z#000000#001 0040: 23 30 30 30 30 30 30 #000000 ldap_get_dn_ber ber_scanf fmt ({ml{) ber: ber_dump: buf=0x9762840 ptr=0x9762843 end=0x97628f2 len=175 0000: 64 48 04 0c 63 6e 3d 61 63 63 65 73 73 6c 6f 67 dH..cn=accesslog 0010: 30 38 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 0806..entryCSN1* 0020: 04 28 32 30 31 34 30 32 30 33 31 38 33 38 33 31 .(20140203183831 0030: 2e 37 35 31 38 33 38 5a 23 30 30 30 30 30 30 23 .751838Z#000000# 0040: 30 30 31 23 30 30 30 30 30 30 a0 63 30 61 04 18 001#000000.c0a.. 0050: 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 1.3.6.1.4.1.4203 0060: 2e 31 2e 39 2e 31 2e 32 04 45 30 43 0a 01 01 04 .1.9.1.2.E0C.... 0070: 00 04 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 ..<rid=001,sid=0 0080: 30 31 2c 63 73 6e 3d 32 30 31 34 30 32 30 33 31 01,csn=201402031 0090: 38 33 38 33 31 2e 37 35 31 38 33 38 5a 23 30 30 83831.751838Z#00 00a0: 30 30 30 30 23 30 30 31 23 30 30 30 30 30 30 0000#001#000000 ber_scanf fmt ({em) ber: ber_dump: buf=0x9762970 ptr=0x9762970 end=0x97629b5 len=69 0000: 30 43 0a 01 01 04 00 04 3c 72 69 64 3d 30 30 31 0C......<rid=001 0010: 2c 73 69 64 3d 30 30 31 2c 63 73 6e 3d 32 30 31 ,sid=001,csn=201 0020: 34 30 32 30 33 31 38 33 38 33 31 2e 37 35 31 38 40203183831.7518 0030: 33 38 5a 23 30 30 30 30 30 30 23 30 30 31 23 30 38Z#000000#001#0 0040: 30 30 30 30 30 00000 52fbf12a do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) ldap_msgfree ldap_free_request (origid 2, msgid 2) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 17 0000: 30 05 02 01 03 42 00 0....B. ldap_write: want=7, written=7 0000: 30 05 02 01 03 42 00 0....B. ldap_free_connection: actually freed 52fbf12a do_syncrepl: rid=001 rc -1 retrying 52fbf12a daemon: activity on 1 descriptor 52fbf12a daemon: activity on:52fbf12a 52fbf12a daemon: epoll: listen=7 active_threads=0 tvp=zero 52fbf166 daemon: epoll: listen=7 active_threads=0 tvp=zero 52fbf166 =>do_syncrepl rid=001 ldap_create ldap_url_parse_ext(ldap://mm-server1.example.ldap) ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP mm-server1.example.ldap:389 ldap_new_socket: 17 ldap_prepare_socket: 17 ldap_connect_to_host: Trying <mm-server1_IP>:389 ldap_pvt_connect: fd: 17 tm: -1 async: 0 attempting to connect: connect success ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x9761740 ptr=0x9761740 end=0x9761778 len=56 0000: 30 36 02 01 01 60 31 02 01 03 04 1f 63 6e 3d 6c 06...`1.....cn=l 0010: 64 61 70 61 64 6d 69 6e 2c 64 63 3d 67 72 6f 75 dapadmin,dc=exam 0020: 70 34 32 2c 64 63 3d 6c 64 61 70 80 0b 47 72 70 ple,dc=ldap..<pas 0030: 34 32 2d 41 64 6d 21 6e sword> ber_scanf fmt ({i) ber: ber_dump: buf=0x9761740 ptr=0x9761745 end=0x9761778 len=51 0000: 60 31 02 01 03 04 1f 63 6e 3d 6c 64 61 70 61 64 `1.....cn=ldapad 0010: 6d 69 6e 2c 64 63 3d 67 72 6f 75 70 34 32 2c 64 min,dc=example,d 0020: 63 3d 6c 64 61 70 80 0b 47 72 70 34 32 2d 41 64 c=ldap..<passwo 0030: 6d 21 6e rd> ber_flush2: 56 bytes to sd 17 0000: 30 36 02 01 01 60 31 02 01 03 04 1f 63 6e 3d 6c 06...`1.....cn=l 0010: 64 61 70 61 64 6d 69 6e 2c 64 63 3d 67 72 6f 75 dapadmin,dc=grou 0020: 70 34 32 2c 64 63 3d 6c 64 61 70 80 0b 47 72 70 p42,dc=ldap..<pass 0030: 34 32 2d 41 64 6d 21 6e word> ldap_write: want=56, written=56 0000: 30 36 02 01 01 60 31 02 01 03 04 1f 63 6e 3d 6c 06...`1.....cn=l 0010: 64 61 70 61 64 6d 69 6e 2c 64 63 3d 67 72 6f 75 dapadmin,dc=grou 0020: 70 34 32 2c 64 63 3d 6c 64 61 70 80 0b 47 72 70 p42,dc=ldap..<pas 0030: 34 32 2d 41 64 6d 21 6e sword> ldap_result ld 0x950ac90 msgid 1 Thanks in advance... John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

2 1

rwm overlay causes slapd segfault
by Jarbas Peixoto Júnior 12 Feb '14

12 Feb '14

Needed to enable authentication on ldap server via the mail attribute. I used the overlay rwm as documentation: * Http://www.openldap.org/doc/admin24/overlays.html # Rewrite / Remap * http://www.openldap.org/lists/openldap-software/200707/msg00487.html * http://www.openldap.org/software/man.cgi?query=slapo-rwm&sektion=5&apropos=… I run the current version of OpenLDAP : dpkg -l | grep openldap ii openldap-ltb 2.4.39-1 amd64 OpenLDAP server with addons from the LDAP Tool Box project ii openldap-ltb-check-password 2.4.39-1 amd64 check_password module for password policy ii openldap-ltb-contrib-overlays 2.4.39-1 amd64 Overlays contributed to OpenLDAP My configuration snippet is shown below : ... backend hdb moduleload rwm overlay rwm rwm-rewriteEngine on rwm-rewriteMap ldap attr2dn "ldaps:///dc=gov,dc=br?dn?sub?" rwm-rewriteContext bindDN rwm-rewriteRule "^mail=[^,]+@[^,]+$" "${attr2dn($0)}" ":@I" database hdb ... Everything worked fine , but sometimes occurred a ' slapd segfault " there was no apparent cause . A log analysis allowed us to identify the query that caused the "crash " was the folder containing " ** " as follows : "(mail=*name**surname*)(mailAlternateAddress=*name**surname*)" Redid several searches and this is really "crash " in some situations : Normal ======= ldapsearch -xLLL -H ldaps://www-linuxprev -b dc=gov,dc=br "(uid=jarbas*peixoto)" mail dn: uid=jarbas.peixoto,ou=URMS,ou=SUAT,ou=DRD,ou=DATAPREV,dc=gov,dc=br mail: jarbas.peixoto(a)dataprev.gov.br Normal ======= ldapsearch -xLLL -H ldaps://www-linuxprev -b dc=gov,dc=br "(uid=jarbas**peixoto)" mail ldap_search_ext: Bad search filter (-7) Normal ======= ldapsearch -xLLL -H ldaps://www-linuxprev -b dc=gov,dc=br "(mail=jarbas*peixoto(a)dataprev.gov.br)" mail dn: uid=jarbas.peixoto,ou=URMS,ou=SUAT,ou=DRD,ou=DATAPREV,dc=gov,dc=br mail: jarbas.peixoto(a)dataprev.gov.br Normal ======= ldapsearch -xLLL -H ldaps://www-linuxprev -b dc=gov,dc=br "(mail=jarbas**peixoto(a)dataprev.gov.br)" mail ldap_search_ext: Bad search filter (-7) Segfault - Note that there is a space between the two asterisks ( "* *" ) ================================================================ ldapsearch -xLLL -H ldaps://www-linuxprev -b dc=gov,dc=br "(mail=jarbas* *peixoto(a)dataprev.gov.br)" mail Additional information: massaged filter parse error The excerpts from server logs are: Feb 12 09:49:18 linuxprev slapd[27108]: conn=1004 fd=19 ACCEPT from IP=10.82.0.22:46996 (IP=0.0.0.0:636) Feb 12 09:49:18 linuxprev slapd[27108]: conn=1004 fd=19 TLS established tls_ssf=128 ssf=128 Feb 12 09:49:18 linuxprev slapd[27108]: conn=1004 op=0 BIND dn="" method=128 Feb 12 09:49:18 linuxprev slapd[27108]: conn=1004 op=0 RESULT tag=97 err=0 text= Feb 12 09:49:18 linuxprev slapd[27108]: conn=1004 op=1 SRCH base="dc=gov,dc=br" scope=2 deref=0 filter="(mail=jarbas**peixoto(a)dataprev.gov.br)" Feb 12 09:49:18 linuxprev slapd[27108]: conn=1004 op=1 SRCH attr=mail Feb 12 09:49:18 linuxprev slapd[27108]: conn=1004 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text=massaged filter parse error Feb 12 09:49:18 linuxprev kernel: [19683068.279488] slapd[27112] general protection ip:7f9c3520cac9 sp:7f9bc9eb2960 error:0 in libc-2.13.so[7f9c35191000+182000] To work around this error I added the lines: # Remove os '**" da pesquisa 'mail=**' evitando o segfault rwm-rewriteContext searchFilter rwm-rewriteRule "(.*)(\\* ?\\*)(.*)" "$1*$3" "@I" This problem also occurs in other versions of slapd native Debian and Ubuntu. Without the overlay rwm not occur this BUG . Can anyone confirm if it is really a bug in the " rwm overlay" ? Regards, Jarbas

3 4

subtree-exclude (was Re: slapd-meta exclude syntax; larger problem with rwm, collective attributes.)
by Dan Pritts 12 Feb '14

12 Feb '14

Hi - Anyone have any thoughts about my question about "subtree-exclude" with slapd-meta? > Dan Pritts <mailto:danno@umich.edu> > February 7, 2014 at 10:51 AM > Hi folks - > > first, a simple, direct question. I'm trying to use the meta backend, > and exclude part of the > back-end directory (which is AD, if that matters). > > I tried the following config: > > -------------------------- > include /usr/local/pkg/openldap-2.4.39/etc/openldap/schema/core.schema > include > /usr/local/pkg/openldap-2.4.39/etc/openldap/schema/cosine.schema > include > /usr/local/pkg/openldap-2.4.39/etc/openldap/schema/inetorgperson.schema > include /usr/local/pkg/openldap-2.4.39/etc/openldap/schema/nis.schema > > pidfile /var/run/openldap/slapd-filter.pid > argsfile /var/run/openldap/slapd-filter.args > > loglevel any > > access to * > by * read > > database meta > suffix "dc=adsroot,dc=itd,dc=umich,dc=edu" > uri > "ldap://adsroot.itd.umich.edu/dc=adsroot,dc=itd,dc=umich,dc=edu" > rootdn "cn=Manager,dc=adsroot,dc=itd,dc=umich,dc=edu" > > #subtree-exclude > "ou=ICPSR,ou=Organizations,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu" > #subtree-exclude > "ou=ICPSR,ou=Accounts,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu" > subtree-exclude > "dn.subtree:ou=ICPSR,ou=Organizations,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu" > subtree-exclude > "dn.subtree:ou=ICPSR,ou=Accounts,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu" > -------------------------- > > As you can see i tried two syntaxes for subtree-exclude. with either > one, a search for "cn=danno" returns > dn: > cn=danno,ou=ICPSR,ou=Accounts,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu > > What am I doing wrong? Or do I misunderstand what subtree-exclude is > supposed to be doing? > > openldap 2.4.39 on centos 6, x64. > -- Dan Pritts ICPSR Computing & Network Services University of Michigan +1 (734)615-7362

1 0

Simple way to check that MMR is in sync?
by Philip Colmer 12 Feb '14

12 Feb '14

Hi I've got a 2-node setup for master-master replication. Other than creating or modifying a record on one node and then checking/waiting for that change to appear on the other node, is there a recommended way to check that the nodes are in sync and not encountering any problems? Thanks. Philip

12 28

Syncrepl and MMR
by Borresen, John - 0442 - MITLL 12 Feb '14

12 Feb '14

All, Ok, grasping at straws here. This is the cn=config for mm-server1 as of yesterday. mm-server1: dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /usr/local/openldap/etc/openldap/slapd.conf olcConfigDir: /usr/local/openldap/etc/openldap/slapd.d olcArgsFile: /var/lib/openldap/run/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcListenerThreads: 1 olcLocalSSF: 71 olcPidFile: /var/lib/openldap/run/slapd.pid olcReadOnly: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcTLSProtocolMin: 0.0 olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal entryUUID: 1b256f1e-2f15-4538-8a6f-5b021d015e35 creatorsName: cn=config createTimestamp: 20140122200748Z olcLogLevel: stats olcSecurity: tls=0 olcServerID: 1 ldap://mm-server1.example.ldap olcServerID: 2 ldap://mm-server2.example.ldap entryCSN: 20140131211613.134974Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140131211613Z dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}syncprov olcModuleLoad: {1}accesslog structuralObjectClass: olcModuleList entryUUID: 1191cf8f-8d46-4f2e-8aba-e65537210029 creatorsName: cn=admin,cn=config createTimestamp: 20140129175231Z entryCSN: 20140129175429.232704Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129175429Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by self write by users read by anonymous auth olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 77451682-9629-4753-9a80-5cc0e69a7482 creatorsName: cn=config createTimestamp: 20140122200748Z entryCSN: 20140122200748.381523Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140122200748Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: d7f25d3b-7ad1-4625-a577-a23a22b5494d creatorsName: cn=config createTimestamp: 20140122200748Z entryCSN: 20140122200748.381523Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140122200748Z dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=example,dc=ldap olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=ldapadmin,dc=example,dc=ldap olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/openldap/openldap-data olcDbCacheSize: 1000 olcDbConfig: {0}# $OpenLDAP$ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databas es. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-d b/db/ref/env/db_config.html> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig:: ezh9Iwk8aHR0cDovL3d3dy5vcGVubGRhcC5vcmcvZmFxL2luZGV4LmNnaT9maWxl PTI+ olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon re building olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 0.25 GB cache olcDbConfig: {16}set_cachesize 0 268435456 1 olcDbConfig: {17} olcDbConfig: {18}# Data Directory olcDbConfig: {19}#set_data_dir db olcDbConfig: {20} olcDbConfig: {21}# Transaction Log settings olcDbConfig: {22}set_lg_regionmax 262144 olcDbConfig: {23}set_lg_bsize 2097152 olcDbConfig: {24}#set_lg_dir logs olcDbConfig: {25} olcDbConfig: {26}# Note: special DB_CONFIG flags are no longer needed for "qui ck" olcDbConfig:: ezI3fSMgc2xhcGFkZCg4KSBvciBzbGFwaW5kZXgoOCkgYWNjZXNzIChzZWUgdGhl aXIgLXEgb3B0aW9uKS4g olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn eq,sub olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: sn eq,sub olcDbIndex: mail eq,sub olcDbIndex: departmentNumber eq olcDbIndex: automountKey eq olcDbIndex: memberUid eq olcDbIndex: printerURI eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 5a87b5f1-c445-4e0e-ba97-6d2d63093704 creatorsName: cn=config createTimestamp: 20140122200748Z olcMirrorMode: TRUE olcLimits: {0}dn.exact="cn=ldapadmin,dc=example,dc=ldap" size=unlimited time=u nlimited olcSyncrepl: {0}rid=002 provider=ldap://mm-server2.example.ldap bindmethod=simple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcSyncrepl: {1}rid=001 provider=ldap://mm-server1.example.ldap bindmethod=simple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn.exact="cn=ldapadmin,dc=example,dc=ldap" write by dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" read by * none olcAccess: {1}to * by * read entryCSN: 20140203200931.503493Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140203200931Z dn: olcOverlay={0}syncprov,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 04afe1bf-40c7-425a-8b25-74f8687323fc creatorsName: cn=admin,cn=config createTimestamp: 20140129180447Z entryCSN: 20140129180447.701059Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180447Z dn: olcOverlay={1}accesslog,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig entryUUID: 54b5fa00-8244-41d3-923d-0743a10bf192 creatorsName: cn=admin,cn=config createTimestamp: 20140129180903Z entryCSN: 20140129180903.479192Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180903Z dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/openldap/accesslog olcSuffix: cn=accesslog olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart structuralObjectClass: olcBdbConfig entryUUID: ff63820b-fbe4-4a65-8c00-99e2cc28fca5 creatorsName: cn=admin,cn=config createTimestamp: 20140129175923Z olcAccess: {0}to * by dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" w rite by * none olcLimits: {0}dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" time.soft =unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcRootDN: uid=replicator,ou=Admins,dc=example,dc=ldap entryCSN: 20140203190415.581904Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140203190415Z dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 9246709d-7a9b-41f3-bca8-f665add4e4f2 creatorsName: cn=admin,cn=config createTimestamp: 20140129180331Z entryCSN: 20140129180331.702641Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180331Z mm-server2: dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /usr/local/openldap/etc/openldap/slapd.conf olcConfigDir: /usr/local/openldap/etc/openldap/slapd.d olcArgsFile: /var/lib/openldap/run/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcListenerThreads: 1 olcLocalSSF: 71 olcPidFile: /var/lib/openldap/run/slapd.pid olcReadOnly: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcTLSProtocolMin: 0.0 olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal entryUUID: 84a58742-a1ce-4714-a743-14daf3f40c75 creatorsName: cn=config createTimestamp: 20131218155313Z olcLogLevel: stats olcSecurity: tls=0 olcServerID: 1 ldap://mm-server1.example.ldap olcServerID: 2 ldap://mm-server2.example.ldap entryCSN: 20140131211906.564734Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140131211906Z contextCSN: 20140206183618.370299Z#000000#002#000000 contextCSN: 20140121211615.993780Z#000000#004#000000 dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}syncprov olcModuleLoad: {1}accesslog structuralObjectClass: olcModuleList entryUUID: ab2c7f52-e10f-4233-aa17-ac8b051defcf creatorsName: cn=admin,cn=config createTimestamp: 20140129182320Z entryCSN: 20140129182642.147840Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129182642Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by self write by users read by anonymous auth olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 46ec808c-285f-442f-8c70-d5bb8c2d39de creatorsName: cn=config createTimestamp: 20131218155313Z entryCSN: 20131218155313.477459Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20131218155313Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 4354a8b6-8a36-4804-81f8-14a8550aef74 creatorsName: cn=config createTimestamp: 20131218155313Z entryCSN: 20131218155313.477459Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20131218155313Z dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 644d3984-d125-446e-aae2-1ddc541f4661 creatorsName: cn=admin,cn=config createTimestamp: 20140121191314Z entryCSN: 20140121191314.076259Z#000000#004#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140121191314Z dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=example,dc=ldap olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=ldapadmin,dc=example,dc=ldap olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/openldap/openldap-data olcDbCacheSize: 1000 olcDbConfig: {0}# $OpenLDAP$ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databas es. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-d b/db/ref/env/db_config.html> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig:: ezh9Iwk8aHR0cDovL3d3dy5vcGVubGRhcC5vcmcvZmFxL2luZGV4LmNnaT9maWxl PTI+ olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon re building olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 0.25 GB cache olcDbConfig: {16}#set_cachesize 0 268435456 1 olcDbConfig: {17}set_cachesize 0 2147483648 1 olcDbConfig: {18} olcDbConfig: {19}# Data Directory olcDbConfig: {20}#set_data_dir db olcDbConfig: {21} olcDbConfig: {22}# Archive/deletion olcDbConfig: {23}set_flags DB_LOG_AUTOREMOVE olcDbConfig: {24} olcDbConfig: {25}# Transaction Log settings olcDbConfig: {26}set_lg_regionmax 262144 olcDbConfig: {27}set_lg_bsize 2097152 olcDbConfig: {28}#set_lg_dir logs olcDbConfig: {29} olcDbConfig: {30}# Note: special DB_CONFIG flags are no longer needed for "qui ck" olcDbConfig:: ezMxfSMgc2xhcGFkZCg4KSBvciBzbGFwaW5kZXgoOCkgYWNjZXNzIChzZWUgdGhl aXIgLXEgb3B0aW9uKS4g olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn eq,sub olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: sn eq,sub olcDbIndex: departmentNumber eq olcDbIndex: mail eq,sub olcDbIndex: automountKey eq olcDbIndex: memberUid eq olcDbIndex: printerURI eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 94ff450b-aa70-4507-9ca6-51cdd740ea3e creatorsName: cn=config createTimestamp: 20131218155313Z olcMirrorMode: TRUE olcLimits: {0}dn.exact="cn=ldapadmin,dc=example,dc=ldap" size=unlimited time=u nlimited olcSyncrepl: {0}rid=001 provider=ldap://mm-server1.example.ldap bindmethod=si mple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcSyncrepl: {1}rid=002 provider=ldap://mm-server2.example.ldap bindmethod=si mple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn.exact="cn=ldapadmin,dc=example,dc=ldap" write by dn.exact="uid=r eplicator,ou=Admins,dc=example,dc=ldap" read olcAccess: {1}to * by * read entryCSN: 20140206183618.370299Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140206183618Z dn: olcOverlay={0}accesslog,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {0}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig entryUUID: 6e4e1508-5eb9-4372-bbd1-813f859b0acc creatorsName: cn=admin,cn=config createTimestamp: 20140129182321Z entryCSN: 20140129182321.004272Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129182321Z dn: olcOverlay={1}syncprov,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 9108e0db-ba9e-4b40-b743-4016c61582bc creatorsName: cn=admin,cn=config createTimestamp: 20140129183014Z entryCSN: 20140129183014.073365Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129183014Z dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/openldap/accesslog olcSuffix: cn=accesslog olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart structuralObjectClass: olcBdbConfig entryUUID: 9b42a346-de9b-42d5-8a3b-3167f80d4b01 creatorsName: cn=admin,cn=config createTimestamp: 20140129182320Z olcAccess: {0}to * by dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" w rite by * none olcLimits: {0}dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" time.soft =unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcRootDN: uid=replicator,ou=Admins,dc=example,dc=ldap entryCSN: 20140203190210.968231Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140203190210Z dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 0366206b-4295-4463-952c-0b233646c24d creatorsName: cn=admin,cn=config createTimestamp: 20140129182831Z entryCSN: 20140129182831.866738Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129182831Z dn: olcDatabase={3}monitor,cn=config objectClass: olcDatabaseConfig olcAccess: {0}to dn.children="cn=monitor" by dn.children="cn=admin,cn=config" read olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcMonitoring: TRUE structuralObjectClass: olcDatabaseConfig entryUUID: 691d6dfc-82af-4e12-8f03-be93d5d5436b creatorsName: cn=admin,cn=config createTimestamp: 20140114170424Z entryCSN: 20140114170424.436842Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140114170424Z olcDatabase: {3}monitor An attempt IS being made between mm-server1 and mm-server2: Log output from mm-server1: <= ldap_dn2bv(cn=accesslog)=0 52fb7a31 SRCH "cn=accesslog" 2 052fb7a31 0 0 0 52fb7a31 filter: (objectClass=*) 52fb7a31 attrs:52fb7a31 reqDN52fb7a31 reqType52fb7a31 reqMod52fb7a31 reqNewRDN52fb7a31 reqDeleteOldRDN52fb7a31 reqNewSuperior52fb7a31 entryCSN52fb7a31 52fb7a31 base_candidates: base: "cn=accesslog" (0x00000001) 52fb7a31 send_ldap_result: err=0 matched="" text="" 52fb7a31 send_ldap_result: err=0 matched="" text="" 52fb7a31 connection_get(36) 52fb7a6d connection_get(36) => ldap_bv2dn(cn=ldapadmin,dc=example,dc=ldap,0) <= ldap_bv2dn(cn=ldapadmin,dc=example,dc=ldap)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=ldapadmin,dc=example,dc=ldap)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=ldapadmin,dc=example,dc=ldap)=0 Log output from mm-server2: 52fb7a0f attrs:52fb7a0f *52fb7a0f 52fb7a0f base_candidates: base: "cn=role2,ou=sudoers,dc=example,dc=ldap" (0x00000271) 52fb7a0f send_ldap_result: err=0 matched="" text="" ldap_build_search_req ATTRS: reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN 52fb7a31 do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) 52fb7a31 do_syncrepl: rid=001 rc -1 retrying ldap_build_search_req ATTRS: reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN 52fb7a6d do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) 52fb7a6d do_syncrepl: rid=001 rc -1 retrying ldap_build_search_req ATTRS: reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN 52fb7aa9 do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) 52fb7aa9 do_syncrepl: rid=001 rc -1 retrying ldap_build_search_req ATTRS: reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN 52fb7ae5 do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) 52fb7ae5 do_syncrepl: rid=001 rc -1 retrying Thanks in advance... John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

1 0

how to manage groups in different machines using LDAP
by Daniel Szortyka 11 Feb '14

11 Feb '14

Hey guys, I'm new in the forum and new in the LDAP world. I have my environment set up and working fine so far. I have a LDAP server and few other stations which autenticate in my server, OK so far. However, I have applications running exclusively with a special group, let's say "SAS" and that's my problem. Group SAS in MachineA is GID = 501 (/etc/groups) Group SAS in MachineB is GID = 502 (/etc/groups) (this was defined some time ago.. every computer has a different GID for Group SAS) UserA was created with GID = 501 in LDAP. The problem is that when UserA authenticates in MachineB, he doesn't have a group assigned. I would like to know which direction I should go to make sure no matter what computer the user authenticates, he'll get the right group assigned. Tks in advance. -Daniel Szortyka Porto Alegre / RS / Brasil SysAdm at IBOPE -- Esta mensagem é destinada exclusivamente para a(s) pessoa(s) a quem é dirigida, podendo conter informação confidencial. Se você não for destinatário desta mensagem, desde já fica notificado de abster-se a divulgar, copiar, distribuir, examinar ou, de qualquer forma, utilizar a informação contida nesta mensagem, por ser ilegal. Caso você tenha recebido esta mensagem por engano, pedimos que nos retorne este E-Mail, promovendo, desde logo, a eliminação do seu conteúdo em sua base de dados, registros ou sistema de controle. This message is exclusively destined for the people to whom it is directed, and it can bear private and/or legally exceptional information. If you are not addressee of this message, since now you are advised to not release, copy, distribute, check or, otherwise, use the information contained in this message, because it is illegal. If you received this message by mistake, we ask you to return this email, making possible, as soon as possible, the elimination of its contents of your database, registrations or controls system. Este mensaje ha sido enviado exclusivamente para la(s) persona(s) destinataria(s) y puede contener información confidencial. Si Usted no es el destinatario, esta desde ya compelido a no divulgar, copiar, distribuir, examinar o, de cualquier manera, utilizar la información contenida en este mensaje, por razones legales. Caso Usted haya recibido este mensaje equivocadamente, favor contestar al remitente en forma inmediata, borrándolo de su base de datos, registros o sistema de control.

2 3

Accelog overlay do not register unbind idletimeout
by David Tello 11 Feb '14

11 Feb '14

Hi all, I have a doubt. I have a idletimeout and it's working correctly. The session die after this time and new binds are required. The problem es that this automatic unbind isn't appears in the accesslog. No problem with the binds but there isn't any automatic unbind. I think that the configuration of overlay accesslog is correct, because the manual unbind appears correctly. Someone know if is this the normal behavior? Thanks for your time.

1 0

Problem with ppolicy
by Mikael Nehlsen 11 Feb '14

11 Feb '14

Hello! I have a problem with the ppolicy module. I have 2 ldaptrees dc=example,dc=com and o=external and I want to have password policies (lockout after 5 failed login attempts) and I can see that it works on dc=example,dc=com but it does not work on o=external. Both trees save failed login attempts but only the first tree locks people out o=external just saves more and more failed attempts but never lockout the user. I have tried a lot of things and I can not figure out what the problem is. I hope someone here can help me. It is 2 replicated ubuntu 10.04 servers with openldap 2.4.21-0ubuntu5.7 and the ppolicy configuration looks like this: ppolmodule.ldif : dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModuleLoad: ppolicy.la ldapadd -x -D "cn=admin,cn=config" -w password -f ~/ppolmodule.ldif -h ldap1 ppol.ldif: dn: ou=policies,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: policies dn: cn=default,ou=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxFailure: 5 pwdMinLength: 6 ldapadd -x -D "cn=admin,dc=example,dc=com" -w password -f ~/ppol.ldif -h ldap1 ppol_external.ldif: dn: ou=policies,o=external objectClass: organizationalUnit objectClass: top ou: policies dn: cn=default,ou=policies,o=external objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxFailure: 5 pwdMinLength: 6 ldapadd -x -D "cn=admin,dc=example,dc=com" -w password -f ~/ppol_external.ldif -h ldap1 ppoloverlay.ldif: dn: olcOverlay=ppolicy,olcDatabase={1}bdb,cn=config olcOverlay: ppolicy objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: FALSE olcPPolicyDefault: cn=default,ou=policies,dc=example,dc=com ppoloverlay_external.ldif: dn: olcOverlay=ppolicy,olcDatabase={2}bdb,cn=config olcOverlay: ppolicy objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: FALSE olcPPolicyDefault: cn=default,ou=policies,o=external ldapadd -x -D "cn=admin,cn=config" -w password -f ~/ppoloverlay.ldif -h ldap1 ldapadd -x -D "cn=admin,cn=config" -w password -f ~/ppoloverlay_external.ldif -h ldap1 I tried with only one default policy for both trees as well, it made no difference. /Mikael

1 1

Recommended version of BDB package
by Mark Cairney 11 Feb '14

11 Feb '14

Hi, Having recently experienced some issues with our Live server (2.4.38, Scientific Linux 6.4 64-bit) I was looking into possible causes and found the following Debian bug report which suggests that BDB 5.X is problematic with OpenLDAP. What's the "best" version of BDB to go with- I see 4.7.25 "with patches" mentioned in the posting and I noticed that this is the version shipped with LTB. If I were to downgrade my BDB database would this be the best one to go for? I would like to migrate to MDB but there's an issue with alias de-referencing that's a bit of a deal-breaker for us at the moment as a number of our departments use them to provide subsets of their own users(ITS#7657). Kind regards, Mark -- /**************************** Mark Cairney ITI UNIX Section Information Services University of Edinburgh Tel: 0131 650 6565 Email: Mark.Cairney(a)ed.ac.uk *******************************/ The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

5 9

compile error with 2.4.39 on Solaris 10 (SPARC)
by Amos 11 Feb '14

11 Feb '14

get an error when attempting to compile, 64-bit: /bin/sh ../../libtool --mode=compile gcc -m64 -I/usr/local/BerkeleyDB.5.3/include -I/usr/local/include/openssl -I/usr/local/include/sasl -g -O2 -I../../include -I../../include -DLDAP_LIBRARY -c version.c /bin/sh ../../libtool --mode=link gcc -m64 -I/usr/local/BerkeleyDB.5.3/include -I/usr/local/include/openssl -I/usr/local/include/sasl -g -O2 -L/usr/local/lib/sparcv9 -R/usr/local/lib/sparcv9 -L/usr/local/BerkeleyDB.5.3/lib/sparcv9 -R/usr/local/BerkeleyDB.5.3/lib/sparcv9 -release 2.4 -version-info 12:2:10 -rpath /usr/local/lib/sparcv9 -o libldap.la bind.lo open.lo result.lo error.lo compare.lo search.lo controls.lo messages.lo references.lo extended.lo cyrus.lo modify.lo add.lo modrdn.lo delete.lo abandon.lo sasl.lo gssapi.lo sbind.lo unbind.lo cancel.lo filter.lo free.lo sort.lo passwd.lo whoami.lo getdn.lo getentry.lo getattr.lo getvalues.lo addentry.lo request.lo os-ip.lo url.lo pagectrl.lo sortctrl.lo vlvctrl.lo init.lo options.lo print.lo string.lo util-int.lo schema.lo charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo tls2.lo tls_o.lo tls_g.lo tls_m.lo turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo assertion.lo deref.lo ldif.lo fetch.lo version.lo ../../libraries/liblber/ liblber.la -lresolv -lgen -lnsl -lsocket -lsasl2 -lssl -lcrypto gmake[2]: *** No rule to make target `../../libraries/liblber/liblber.la', needed by `apitest'. Stop. gmake[2]: Leaving directory `/usr/soft/that/openldap-2.4.39/src/default/sparcv9_sun_solaris2.10/libraries/libldap' gmake[1]: *** [all-common] Error 1 gmake[1]: Leaving directory `/usr/soft/that/openldap-2.4.39/src/default/sparcv9_sun_solaris2.10/libraries' gmake: *** [all-common] Error 1 I get the same thing when attempting 32-bit compile: /bin/sh ../../libtool --mode=compile gcc -I/usr/local/BerkeleyDB.5.3/include -I/usr/local/include/openssl -I/usr/local/include/sasl -g -O2 -I../../include -I../../include -DLDAP_LIBRARY -c version.c /bin/sh ../../libtool --mode=link gcc -I/usr/local/BerkeleyDB.5.3/include -I/usr/local/include/openssl -I/usr/local/include/sasl -g -O2 -L/usr/local/lib -R/usr/local/lib -L/usr/local/BerkeleyDB.5.3/lib -R/usr/local/BerkeleyDB.5.3/lib -release 2.4 -version-info 12:2:10 -rpath /usr/local/lib -o libldap.la bind.lo open.lo result.lo error.lo compare.lo search.lo controls.lo messages.lo references.lo extended.lo cyrus.lo modify.lo add.lo modrdn.lo delete.lo abandon.lo sasl.lo gssapi.lo sbind.lo unbind.lo cancel.lo filter.lo free.lo sort.lo passwd.lo whoami.lo getdn.lo getentry.lo getattr.lo getvalues.lo addentry.lo request.lo os-ip.lo url.lo pagectrl.lo sortctrl.lo vlvctrl.lo init.lo options.lo print.lo string.lo util-int.lo schema.lo charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo tls2.lo tls_o.lo tls_g.lo tls_m.lo turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo assertion.lo deref.lo ldif.lo fetch.lo version.lo ../../libraries/liblber/liblber.la -lresolv -lgen -lnsl -lsocket -lsasl2 -lssl -lcrypto gmake[2]: *** No rule to make target `../../libraries/liblber/liblber.la', needed by `apitest'. Stop. gmake[2]: Leaving directory `/usr/soft/that/openldap-2.4.39/src/default/sparcv9_sun_solaris2.10/libraries/libldap' gmake[1]: *** [all-common] Error 1 gmake[1]: Leaving directory `/usr/soft/that/openldap-2.4.39/src/default/sparcv9_sun_solaris2.10/libraries' gmake: *** [all-common] Error 1 Didn't encounter this with 2.4.38. Amos

2 1

Slow to add 1 million items
by Andrew Eross 11 Feb '14

11 Feb '14

Hello all, I've been Google'ing around and searching the archives, but I haven't quite been able to find an answer, so I wanted to ask the list. I've been experimenting with OpenLDAP adds to see how quickly we can get data inserted into the DB. I'm using Ubuntu 10.04, and I've tried both the packaged OpenLDAP 2.4.21 using hdb, and just recently the latest OpenLDAP 2.4.39 using lmdb, both with relatively similar results. The short version is: to insert 1 million records, it's taking about 8 hours on a machine with 2GB RAM / 3Ghz / SSD, which seems like a long time to me. The insert method is to use a single big ldiff file like this: ### snip ### dn: cn=newtest0,ou=customer,dc=test,dc=com objectclass: inetOrgPerson userPassword: 90sac90sudasdjcao0sdjtest telephoneNumber: 61400000000 sn: none dn: cn=newtest1,ou=customer,dc=test,dc=com objectclass: inetOrgPerson userPassword: 90sac90sudasdjcao0sdjtest telephoneNumber: 61400000000 sn: none ### snip ### Then add it with ldapadd: ldapadd -x -D cn=admin,dc=test,dc=com -w test -f ./test My configuration (for mdb in this instance) used with 2.4.39 is this: ### config ### include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema database mdb directory /usr/local/var/openldap-data suffix "dc=test,dc=com" rootdn "cn=admin,dc=test,dc=com" rootpw test maxsize 1980732000 #Indexes index cn,telephoneNumber eq index objectClass eq ### config ### Any ideas or things I could try? Thank you! Andrew

7 13

Openldap shutdown expectedly
by Liu Yongjian 10 Feb '14

10 Feb '14

I have make a question on http://stackoverflow.com/questions/21619553/openldap-unexpectedly-shutdown Can anyone help me? -- Thank you

2 1

Have you seen this FUD - IT pros suffer OpenLDAP configuration headaches ?
by Gavin Henry 10 Feb '14

10 Feb '14

http://searchdatacenter.techtarget.com/feature/IT-pros-suffer-OpenLDAP-conf… Any one been in touch with them? -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretec.co.uk Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk OpenPGP (GPG/PGP) Public Key: 0x8CFBA8E6 - Import from hkp://subkeys.pgp.net or http://www.suretecgroup.com/0x8CFBA8E6.gpg

18 20

SASL DIGEST-MD5 works but PLAIN/LOGIN fails
by Michael Ströder 09 Feb '14

09 Feb '14

HI! I'd like let users authenticate via SASL/PLAIN or SASL/LOGIN so they do not have to deal with full bind-DNs, my client does not have to search the user and to avoid slapo-rwm. Yes, the connection is protected with TLS. Later it has to work with hashed userPassword values. It should be feasible. Or not? Test system: latest OpenLDAP RE24 cyrus-sasl-2.1.25-28.1.2.x86_64 shipped with openSUSE 13.1 In my test setup everything works with DIGEST-MD5 but not with PLAIN or LOGIN (clear-text userPassword value for testing). The log shows that the SASL username gets mapped by authz-regexp to the correct LDAP user entry: 52f60408 <==slap_sasl2dn: Converted SASL name to uid=user,ou=dept,o=example 52f60408 slap_sasl_getdn: dn:id converted to uid=user,ou=dept,o=example But SASL does not use "pwcheck_method: slapd" for mechs PLAIN/LOGIN but works with DIGEST-MD5: $ ldapwhoami -H ldapi:/// -Y DIGEST-MD5 -U user -w secret SASL/DIGEST-MD5 authentication started SASL username: user SASL SSF: 128 SASL data security layer installed. dn:uid=user,ou=dept,o=example $ ldapwhoami -H ldapi:/// -Y LOGIN -U user -w secret SASL/LOGIN authentication started ldap_sasl_interactive_bind_s: Authentication method not supported (7) additional info: SASL(-4): no mechanism available: checkpass failed $ ldapwhoami -H ldapi:/// -Y PLAIN -U user -w secret SASL/PLAIN authentication started ldap_sasl_interactive_bind_s: Authentication method not supported (7) additional info: SASL(-4): no mechanism available: Password verification failed The trace shows for PLAIN or LOGIN (running slapd -d config,stats,stats2,acl,args,trace): SASL [conn=1002] Error: unknown password verifier(s) slapd My /usr/lib64/sasl.conf contains: ---------------------------- snip ---------------------------- pwcheck_method: slapd mech_list: plain login digest-md5 external ---------------------------- snip ---------------------------- I've checked that this is the right file by setting "pwcheck_method: foobar" which appears in the logs then. My slapd.conf contains: ---------------------------- snip ---------------------------- disallow bind_anon require bind LDAPv3 strong # SSF value for ldapi:// localSSF 256 # minimum required SSF value (security strength factor) security transport=128 sasl=0 # Since we require TLS we can relax this sasl-secprops none,minssf=0 ---------------------------- snip ---------------------------- Any clue? Ciao, Michael.

5 8

rwm-rewriteMap for bindDN and slapo-ppolicy
by Michael Ströder 08 Feb '14

08 Feb '14

HI! I'm trying to use slapo-rwm to simplify bind-DNs used. I'm also using slapo-lastbind to record the last simple bind timestamp and slapo-ppolicy also for recording pwdFailureTime. Using latest RE24 of course. Something like this defined *within* the database section: ---------------------- snip ---------------------- overlay accesslog [..] rwm-rewriteMap slapd uid2dn "ldap:///o=example?entryDN?sub?" rwm-rewriteContext bindDN rwm-rewriteRule "^(uid=[^,]+),o=example$" "${uid2dn($1)}" ":@I" overlay lastbind overlay ppolicy ppolicy_default cn=ppolicy-default,cn=ampua,ou=ampua ppolicy_hash_cleartext ppolicy_use_lockout slapo-lastbind correctly updates the attribute 'authTimestamp' in the entry referenced by the rewritten bind-DN. slapo-ppolicy does *not* correctly update the attribute 'pwdFailureTime' in the entry referenced by the rewritten bind-DN. ---------------------- snip ---------------------- Any idea what's going on? BTW: Using the rwm-rewriteMap in a MMR setup causes seg faults in a running provider slapd when bringing up another empty provider. Have to examine that further though. Ciao, Michael.

1 1

slapd-meta exclude syntax; larger problem with rwm, collective attributes.
by Dan Pritts 08 Feb '14

08 Feb '14

Hi folks - first, a simple, direct question. I'm trying to use the meta backend, and exclude part of the back-end directory (which is AD, if that matters). I tried the following config: -------------------------- include /usr/local/pkg/openldap-2.4.39/etc/openldap/schema/core.schema include /usr/local/pkg/openldap-2.4.39/etc/openldap/schema/cosine.schema include /usr/local/pkg/openldap-2.4.39/etc/openldap/schema/inetorgperson.schema include /usr/local/pkg/openldap-2.4.39/etc/openldap/schema/nis.schema pidfile /var/run/openldap/slapd-filter.pid argsfile /var/run/openldap/slapd-filter.args loglevel any access to * by * read database meta suffix "dc=adsroot,dc=itd,dc=umich,dc=edu" uri "ldap://adsroot.itd.umich.edu/dc=adsroot,dc=itd,dc=umich,dc=edu" rootdn "cn=Manager,dc=adsroot,dc=itd,dc=umich,dc=edu" #subtree-exclude "ou=ICPSR,ou=Organizations,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu" #subtree-exclude "ou=ICPSR,ou=Accounts,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu" subtree-exclude "dn.subtree:ou=ICPSR,ou=Organizations,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu" subtree-exclude "dn.subtree:ou=ICPSR,ou=Accounts,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu" -------------------------- As you can see i tried two syntaxes for subtree-exclude. with either one, a search for "cn=danno" returns dn: cn=danno,ou=ICPSR,ou=Accounts,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu What am I doing wrong? Or do I misunderstand what subtree-exclude is supposed to be doing? openldap 2.4.39 on centos 6, x64. The larger question - As I posted last week I am trying to put a proxy in front of Active Directory. AD has most of the required attributes for my application, but I need to fill in a couple that are missing. Translucent proxy makes sense, combined with the collect overlay. Unfortunately, slapd crashes when it encounters a DN from AD that has one of the collect attributes (its 7797). Not just a lookup failure, a hard crash. :( So, it next occurred to me to use another instance of slapd with rwm as a "filter" to remove the attributes I am trying to use with collect. It's complicated further by the fact that some subtrees have different attributes that I want to filter, or not. I tried soemthing like this: -------------------------- database ldap uri ldap://foo suffix ou=foo,dc=example,dc=edu [ rwm entries to leave only the attributes i want for ou=foo ] database ldap uri ldap://foo suffix ou=bar,dc=example,dc=edu [ rwm entries to leave only the attributes i want for ou=bar ] database meta uri ldap://foo suffix dc=example,dc=edu subtree-exclude ou=foo subtree-exclude ou=bar -------------------------- I had to add the third database entry, with the root dn, before auth would work. Presuming that i can actually make meta work with the subtree-exclude like I want, should a config like this work? As it is, everything is being returned from the third database entry, with the suffix at the root DN. So, I'm not sure if this idea of combining multiple ldap databases would work. thanks for any input! danno -- Dan Pritts ICPSR Computing & Network Services University of Michigan +1 (734)615-7362

2 2

Re: Slow to add 1 million items
by Andrew Eross 07 Feb '14

07 Feb '14

Hi Quanah, Ubuntu 10.04 LTS Linux 2.6.32-43-generic-pae #97-Ubuntu SMP Wed Sep 5 16:59:17 UTC 2012 i686 GNU/Linux The latest OpenLDAP 2.4.39 All of those tests done with the mdb backend, of course, and the actual file system is ext4 It's a fairly stock 10.04 system, no special config/kernel changes. Cheers, Andrew Andrew Eross CTO Locatrix Communications Office: +61 7 3123 1469 Mobile: +55 37 9858 9815 eross(a)locatrix.com On Wed, Feb 5, 2014 at 1:26 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, February 04, 2014 6:52 PM -0200 Andrew Eross < > eross(a)locatrix.com> wrote: > > >> >> Thanks, Dieter, Quanah. >> >> >> I've been doing some experimenting with those mdb options. >> >> >> I ran a few tests with inserting 10,000 records, wiping the DB in >> between, and changing just the one option at a time: >> >> >> Base-line, no extra options: 4m8sWith "writemap" enabled: 8m55s >> >> With "writemap+mapasync" enabled: 5m12s >> With "dbnosync+checkpoint 0kb/1min": 0m14s >> > > I know you answered some of this before, but please update with: > > What kernel? > What OpenLDAP version? > What Ubuntu release? > What filesystem for the LDAP DB? > > Thanks, > > Quanah > > > -- > > Quanah Gibson-Mount > Architect - Server > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

5 7

RE: Antw: RE: Syncrepl and mmr
by Ulrich Windl 07 Feb '14

07 Feb '14

Hi! (People will flame me because of this, but...) I'd suggest to start completely new with a clean standard distribution. Once your configuration works, you can update your software and change configuration until it stops working. ;-) Regards, Ulrich >>> "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> schrieb am 06.02.2014 um 17:47 in Nachricht <20140206164804.ECB0F44E78(a)rrzmta2.uni-regensburg.de>: > All, > > I came in this morning, and the test environment was hung. Not sure what is > going on. slapd on both servers will not stay up for more than 5-minutes. I > tried to back step so attempted to slapadd from the dbase.ldif that I created > the other day when things were working. When slapadding, I am receiving the > following error: > # slapadd -w -q -F /usr/local/openldap/etc/openldap/slapd.d -l > /usr/local/openldap/etc/openldap/ldif/backup/mm-server2_example_ldap.ldif > 52f3bb11 olcDbDirectory: value #0: invalid path: No such file or directory > 52f3bb11 config error processing olcDatabase={1}bdb,cn=config: > olcDbDirectory: value #0: invalid path: No such file or directory > slapadd: bad configuration directory! > > Any assistance as to what to look for would be great! > > Thanks in advance > John > > ________________________________________ > From: Ulrich Windl [Ulrich.Windl(a)rz.uni-regensburg.de] > Sent: Wednesday, February 05, 2014 2:50 AM > To: Borresen, John - 0442 - MITLL; openldap-technical(a)openldap.org; Quanah > Gibson-Mount > Subject: Antw: RE: Syncrepl and mmr > > "52f0fe5f send_search_entry: conn 1003 access to attribute userPassword, > value #0 not allowed" > > I'm not surprised that you have a problem with the user's password. > >>>> "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> schrieb am > 04.02.2014 um 15:56 in Nachricht > <201402041456.s14EuaHc022629(a)boole.openldap.org>: >> Here is a log snippet from mm-server2: >> >> 52f0fe5f => slap_access_allowed: read access granted by read(=rscxd) >> 52f0fe5f => access_allowed: read access granted by read(=rscxd) >> 52f0fe5f => access_allowed: result was in cache (objectClass) >> 52f0fe5f => access_allowed: result was in cache (objectClass) >> 52f0fe5f => access_allowed: result was in cache (objectClass) >> 52f0fe5f => access_allowed: result was in cache (objectClass) >> 52f0fe5f => access_allowed: result not in cache (userPassword) >> 52f0fe5f => access_allowed: read access to >> "uid=jdoe,ou=Users,dc=example,dc=ldap" "userPassword" requested >> 52f0fe5f => acl_get: [1] attr userPassword >> 52f0fe5f => acl_mask: access to entry "uid=jdoe,ou=Users,dc=example,dc=ldap", >> attr "userPassword" requested >> 52f0fe5f => acl_mask: to value by "cn=admin,cn=config", (=0) >> 52f0fe5f <= check a_dn_pat: self >> 52f0fe5f <= check a_dn_pat: anonymous >> 52f0fe5f <= check a_dn_pat: cn=ldapadmin,dc=example,dc=ldap >> 52f0fe5f <= check a_dn_pat: uid=replicator,ou=admins,dc=example,dc=ldap >> 52f0fe5f <= check a_dn_pat: * >> 52f0fe5f <= acl_mask: [5] applying none(=0) (stop) >> 52f0fe5f <= acl_mask: [5] mask: none(=0) >> 52f0fe5f => slap_access_allowed: read access denied by none(=0) >> 52f0fe5f => access_allowed: no more rules >> 52f0fe5f send_search_entry: conn 1003 access to attribute userPassword, >> value #0 not allowed >> 52f0fe5f conn=1003 op=20 ENTRY dn="uid=jdoe,ou=users,dc=example,dc=ldap" >> ber_flush2: 496 bytes to sd 21 >> >> >> >> -----Original Message----- >> From: openldap-technical-bounces(a)OpenLDAP.org >> [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Borresen, >> John - 0442 - MITLL >> Sent: Tuesday, February 04, 2014 9:31 AM >> To: Quanah Gibson-Mount; openldap-technical(a)openldap.org >> Subject: RE: Syncrepl and mmr >> >> All, >> >> This morning, I shut down slapd on mm-server2 and, using the ldif that I >> created off of mm-server1 primary dbase (used slapcat to create) and > attempted >> to resync the dbases. >> >> Background: when viewing the dbases on mm-server1 and mm-server2 on Apache >> Directory Studio (binding with cn=ldapadmin,dc=example,dc=ldap), the >> "ou=Users,dc=example,dc=ldap" will show the userPassword attribute on >> mm-server1, but NOT on mm-server2. If I perform an ldapsearch (again, with >> cn=ldapadmin,dc=example,dc=ldap, on both servers the userPassword attribute >> echoes out to console as expected. When binding to >> uid=replicator,ou=Admins,dc=example,dc=ldap on both servers, on the Apache >> Directory Studio, the userPassword attribute is seen. >> >> Now, this morning, as stated, slapd was shut down on mm-server2. >> >> Moved /var/lib/openldap/openldap-data out of the way Recreated the >> /var/lib/openldap/openldap-data directory, copying the DB_CONFIG back in. >> >> Chowned it the directory to ldap:ldap >> >> Ran: >> >> # slapadd -w -q -F /usr/local/openldap/etc/openldap/slapd.d -l >> /usr/local/openldap/etc/openldap/ldif/backup/example_ldap.ldif >> _#################### 100.00% eta none elapsed none fast! >> >> Closing DB... >> # /usr/local/openldap/sbin/slapindex -F >> /usr/local/openldap/etc/openldap/slapd.d >> >> Reconnected, to mm-server2 via the Apache Directory Studio using >> cn=ldapadmin,dc=example,dc=ldap & > uid=replicator,ou=Admins,dc=example,dc=ldap, >> same results as before. >> >> Any suggestions? >> >> Thanks in advance, >> John >> >> -----Original Message----- >> From: openldap-technical-bounces(a)OpenLDAP.org >> [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Borresen, >> John - 0442 - MITLL >> Sent: Monday, February 03, 2014 4:22 PM >> To: Quanah Gibson-Mount; openldap-technical(a)openldap.org >> Subject: RE: Syncrepl and mmr >> >> Well...that was a "doh!" on my part. <lol> >> >> One last stupid question for the evening. "slapcat" created the ldif, when >> slapadd-ing to the the secondary, should I remove the extra lines (ex. >> entryUUID, creatorsName,createTimeStamp)? >> >> Thanks, >> John >> >> -----Original Message----- >> From: Quanah Gibson-Mount [mailto:quanah@zimbra.com] >> Sent: Monday, February 03, 2014 4:03 PM >> To: Borresen, John - 0442 - MITLL; openldap-technical(a)openldap.org >> Subject: RE: Syncrepl and mmr >> >> --On Monday, February 03, 2014 3:57 PM -0500 "Borresen, John - 0442 - MITLL" >> <John.Borresen(a)ll.mit.edu> wrote: >> >>> Hmmmmmmmm, >>> >>> Taking your advice to reload the secondary from the primary...by >>> creating master set of ldifs off of the primary (mm-server1): >>> >>> On the primary (mm-server1): >>># slapcat -F /usr/local/openldap/etc/openldap/slapd.d -l # >>>backup/example_ldap.ldif -b dc=example,dc=ldap >>> 52f000f2 ldif_read_file: checksum error on >>>"/usr/local/openldap/etc/openldap/slapd.d/cn=config.ldif" 52f000f2 >>> bdb_monitor_db_open: monitoring disabled; configure monitor database >>>to enable >>> >>> On the secondary (mm-server2): >>> the same command worked... >> >> There is no indication here the command failed. All it is reporting is that >> someone modified cn=config.ldif by hand rather than correctly using >> ldapmodify. >> >> --Quanah >> >> -- >> >> Quanah Gibson-Mount >> Architect - Server >> Zimbra, Inc. >> -------------------- >> Zimbra :: the leader in open source messaging and collaboration

1 0

RE: Antw: RE: Syncrepl and mmr
by Quanah Gibson-Mount 06 Feb '14

06 Feb '14

--On Thursday, February 06, 2014 12:32 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > All, > > The oldDbDirectory statement is pointing to > /var/lib/openldap/openldap-data > > The accesslog olcDbDirectory statement is: /var/lib/openldap/accesslog Then one of those does not exist or is not accessible to the openldap user. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 2

RE: Antw: RE: Syncrepl and mmr
by Quanah Gibson-Mount 06 Feb '14

06 Feb '14

--On Thursday, February 06, 2014 12:37 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Then one of those does not exist or is not accessible to the openldap > user. Please read the OR portion of this sentence. You can also add -d -1 to your slapadd command to get more output on the error. Likely the permissons on one of /var, /var/lib, or /var/lib/openldap blocks access for the ldap user. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

RE: Antw: RE: Syncrepl and mmr
by Quanah Gibson-Mount 06 Feb '14

06 Feb '14

--On Thursday, February 06, 2014 11:47 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > All, > > I came in this morning, and the test environment was hung. Not sure what > is going on. slapd on both servers will not stay up for more than > 5-minutes. I tried to back step so attempted to slapadd from the > dbase.ldif that I created the other day when things were working. When > slapadding, I am receiving the following error: ># slapadd -w -q -F /usr/local/openldap/etc/openldap/slapd.d -l ># /usr/local/openldap/etc/openldap/ldif/backup/mm-server2_example_ldap.ldif > 52f3bb11 olcDbDirectory: value #0: invalid path: No such file or directory > 52f3bb11 config error processing olcDatabase={1}bdb,cn=config: > olcDbDirectory: value #0: invalid path: No such file or directory > slapadd: bad configuration directory! The database directory you specified for slapd to use in olcDatabase={1}bdb,cn=config doesn't exist, as it clearly states. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

RE: Syncrepl and mmr
by Quanah Gibson-Mount 06 Feb '14

06 Feb '14

--On Monday, February 03, 2014 3:57 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Hmmmmmmmm, > > Taking your advice to reload the secondary from the primary...by creating > master set of ldifs off of the primary (mm-server1): > > On the primary (mm-server1): ># slapcat -F /usr/local/openldap/etc/openldap/slapd.d -l ># backup/example_ldap.ldif -b dc=example,dc=ldap > 52f000f2 ldif_read_file: checksum error on > "/usr/local/openldap/etc/openldap/slapd.d/cn=config.ldif" 52f000f2 > bdb_monitor_db_open: monitoring disabled; configure monitor database to > enable > > On the secondary (mm-server2): > the same command worked... There is no indication here the command failed. All it is reporting is that someone modified cn=config.ldif by hand rather than correctly using ldapmodify. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 5

Re: OpenLDAP slapd problems - ldap_result: Can't contact LDAP server (-1) result.c:813 --- Low Sensitivity/Aerospace Internal Use Only
by Christian Kratzer 05 Feb '14

05 Feb '14

Hi Warraon, On Wed, 5 Feb 2014, Warron S French wrote: > Low Sensitivity/Aerospace Internal Use Only > > Thank you Christian, I don't know how to apply the patch, nor do I know > where to get it. I will just wait for 2.4.40 to be officially released. > Do you have any idea when that might be since I posted the issue last > Thursday? I know this is Open Source code, so I am wondering how long it > will be before I can continue with my dead-in-the-water project. I have no idea when the 2.4.40 release will be as I am not associated with the openldap project or their release management. Altough unless something serious turns up it will propably be a couple of months as 2.4.39 has just been released a week ago. As you have been cc:ing the ltb-project people on this list I assume you are using their packages ? If you are and are willing to compile their source package, then integrating the patch should not be too hard. It's just a matter of locating the patch in the git repository and adding it to the build. ps: Adding the list back to cc. Greetings Christian > Thanks, > > Warron French, MBA, SCSA > > > > From: Christian Kratzer <ck(a)cksoft.de> > To: Quanah Gibson-Mount <quanah(a)zimbra.com>, > Cc: Warron S French <Warron.S.French(a)aero.org>, > openldap-technical(a)openldap.org, ltb-users(a)mail.ltb-project.org > Date: 02/04/2014 04:37 PM > Subject: Re: OpenLDAP slapd problems - ldap_result: Can't contact > LDAP server (-1) result.c:813 --- Low Sensitivity/Aerospace Internal Use > Only > > > > Hi, > > On Tue, 4 Feb 2014, Quanah Gibson-Mount wrote: >> --On Tuesday, February 04, 2014 10:17 PM +0100 Christian Kratzer >> <ck(a)cksoft.de> wrote: >> >> >>> You should open an ITS for this. I will be glad to add my input once I >>> see the ITS. >> >> There already is an ITS for this, and the fix has already been committed > for >> the OpenLDAP 2.4.40 release, or one can grab the patch and apply it to > their >> 2.4.39 source and rebuild. > > saw your mail after sending. ;( > > Greetings > Christian > > -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Mobile: +49 171 1947 843 Geschaeftsfuehrer: Christian Kratzer Web: http://www.cksoft.de/

1 0

Re: OpenLDAP slapd problems - ldap_result: Can't contact LDAP server (-1) result.c:813 --- Low Sensitivity/Aerospace Internal Use Only
by Quanah Gibson-Mount 04 Feb '14

04 Feb '14

--On Tuesday, February 04, 2014 10:17 PM +0100 Christian Kratzer <ck(a)cksoft.de> wrote: > You should open an ITS for this. I will be glad to add my input once I > see the ITS. There already is an ITS for this, and the fix has already been committed for the OpenLDAP 2.4.40 release, or one can grab the patch and apply it to their 2.4.39 source and rebuild. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

OpenLDAP slapd problems - ldap_result: Can't contact LDAP server (-1) --- Low Sensitivity/Aerospace Internal Use Only
by Warron S French 04 Feb '14

04 Feb '14

Low Sensitivity/Aerospace Internal Use Only Working on a CentOS-6.5 server, running LTB Project's slapd-2.4.38. Someone suggested I implement a cn=admin,cn=config for a cn=config setup. (I don't know how to technically word that). Anyway, I need to make TLS-related changes and was told to do the following command: ldapmodify -x -D "cn=admin,cn=config" -W -d 256 ...then at the blank line type the following, each on a single line: Dn: cn=config Changetype: modify Add: olcTLSCipherSuite OlcTLSCipherSuite: HIGH:MEDIUM+TLSv1+SSLv3 <CTRL-D> I have been getting an error reponse of: ldap_result: Can't contact LDAP server (-1) This __ONLY__ occurs after I hit <CTRL-D>, not before. Yes, the daemon, slapd, is actually running, but after this failure it abruptly stops. I know this because in a separate terminal on the same system, I am running a while-loop with a ps -e | grep slapd in it. Please note the "-x" option according to the man page for ldapmodify is supposed to Use simple authentication instead of SASL. Thank you all for your help, hopefully you can: 1) tell me what this error means, and 2) how to fix my problem so that I can complete the olcTLSxxxx changes I need to implement. Warron French, MBA, SCSA The Aerospace Corporation Sr. UNIX SA & Storage Admin Mailstop: CH1-230 Desk: 571-307-5311 Cell: 703-967-8936 Low Sensitivity/Aerospace Internal Use Only

4 16

re: search on multimaster gives 2 different results
by Gare Calhoun 04 Feb '14

04 Feb '14

Hello, Follow-up on how I solved this issue: Dumped an ldif copy of the offending server and reloaded that server with slapadd. This corrected the autogroups on that server. We are doing a lot of programmatic additions, updates, and deletions to OpenLDAP, which could have caused the initial issue. hth someone. Gare - *To*: *openldap-technical(a)openldap.org <openldap-technical%40openldap.org>* - *Subject*: *search on multimaster gives 2 different results* - *From*: *Gare Calhoun <gcalhoun(a)antioch.edu <gcalhoun%40antioch.edu>>* - Date: Thu, 19 Dec 2013 16:56:00 -0600 ------------------------------ Hello, We are running 2 servers in multimaster mode ; openldap-2.4.35 on CentOS 6.6 using the autogroup overlay. I have a search filter (APersonCategory=*ADJ*) that returns different numbers of records when queried against each server. The actual records exist on both servers. 1 server is not returning all expected records. The other server returns records as expected. There is no index defined for this attribute in slapd.conf on either server. schema definition of attribute is same on each server: attributetype ( 1.3.6.1.4.1.5923.1.1.1.23 NAME 'APersonCategory' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) Would someone suggest what to look at to troubleshoot this? Thank you very much for your assistance. -Gare Calhoun -- . . . . . . . . . . . . . . . . . . . . . . . . . . . . Gare Calhoun Antioch University IT Services, Software Developer

1 0

RE: Syncrepl and mmr
by Quanah Gibson-Mount 04 Feb '14

04 Feb '14

--On Tuesday, February 04, 2014 11:03 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > I saw that too...and been going through the ACLs to find where...they are > identical (albeit, so far as I have found) between the two servers. I would suggest you slapcat cn=config for each master, and do a diff of the database portion. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

RE: Syncrepl and mmr
by Quanah Gibson-Mount 04 Feb '14

04 Feb '14

--On Tuesday, February 04, 2014 9:56 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Here is a log snippet from mm-server2: This clearly shows that access to userPassword was denied by your ACLs on MMR2. Clearly there is some difference in the ACLs stored in cn=config between MMR1 and MMR2. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 04 Feb '14

04 Feb '14

--On Tuesday, February 04, 2014 9:31 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: ># slapadd -w -q -F /usr/local/openldap/etc/openldap/slapd.d -l ># /usr/local/openldap/etc/openldap/ldif/backup/example_ldap.ldif > _#################### 100.00% eta none elapsed none fast! > Closing DB... ># /usr/local/openldap/sbin/slapindex -F ># /usr/local/openldap/etc/openldap/slapd.d Why would you run slapindex after a slapadd, given that slapadd already indexes the DB? --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

java API for SAML integration
by Jignesh Patel 04 Feb '14

04 Feb '14

We have been using SimpleSAMLphp with openldap 2.4.33. Is there any Java API available which can provide similar functionality? Jignesh Patel Chief Architect iCare.com LLC 14001 NW 4th Street Sunrise, FL 33325 O: 954-616-5604 F: 954-616-5609 jignesh(a)icare.com CONFIDENTIALITY NOTE: The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, please immediately reply to the sender that you have received this communication in error and then delete it. Thank you.

4 4

set-based constraint for prefix
by Michael Ströder 04 Feb '14

04 Feb '14

HI! Maybe I'm overlooking something obvious... I'd like to enforce a prefix naming convention by using a set-based constraint. The idea is that 'cn' value of an entry should *start* with the 'cn' value of the superior entry and a hyphen. Example with Superior entry has 'cn: example': example-foo -> accept examplefoo -> disallow foo-bar -> disallow My problem is the "start with" since I cannot find a way to express the wildcard string in a set. The following does not work since [*] is interpreted literally so only the exact value 'example-*' is accepted: # 'cn' has to use superior entry's 'cn' value as prefix constraint_attribute cn set "(this/-1/cn + [-] + [*] ) & this/cn" restrict="ldap:///ou=ampua??sub?(|(objectClass=mySrvGroup)(objectClass=myGroup))" Any help is appreciated. Ciao, Michael.

3 2

Re: OpenLDAP 2.4.39 available
by Clément OUDOT 04 Feb '14

04 Feb '14

2014-01-30 OpenLDAP Project <project(a)openldap.org>: > OpenLDAP 2.4.39 is now available for download as detailed on our download > page: > > http://www.openldap.org/software/download/ > > Hi, packages from LDAP Tool Box were released this morning: http://ltb-project.org/wiki/download#openldap Clément.

1 0

changing database backend
by Aleksander Dzierżanowski 04 Feb '14

04 Feb '14

Hi, Any ideas how to migrate database from back-bdb to other backend (for example mdb), while using cn=config? When using slapd.conf - flat config file - it seems to be simple task. But how to do it using cn=config? For sure it is not online operation, and any offline modifications to LDIF config files are not recommended. Regards, — Olo

4 3

RE: Syncrepl and mmr
by Quanah Gibson-Mount 03 Feb '14

03 Feb '14

--On Monday, February 03, 2014 4:22 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Well...that was a "doh!" on my part. <lol> > > One last stupid question for the evening. "slapcat" created the ldif, > when slapadd-ing to the the secondary, should I remove the extra lines > (ex. entryUUID, creatorsName,createTimeStamp)? Only if your goal is to completely break replication. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 03 Feb '14

03 Feb '14

--On Monday, February 03, 2014 3:31 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Thanks for your assistance Quanah! > > About the userPassword attributes... > > On Apache Directory Studio (we only normally use it as a quick visual > reference)...but, we bind both servers as cn=ldapadmin,dc=example,dc=ldap > & cn=admin,cn=config (plus now > uid=replicator,ou=Admins,dc=example,dc=ldap). > > I just tested an ldapsearch by binding to the uid=replicator and the > userPassword attribute returns when searching for it...though both are > different from each other (verified with other users "jdoe2" and "jdoe3", > etc) If it is correct via ldapsearch, that is what counts. ADS may be attempting some security by hiding userPassword? > Supposedly, if I update one server, the other server should update, too. > That is if they are properly talking. Correct? And assuming your masters are in sync to start with, which is critical when thinking about replication. It would appear you've been allowing writes ops to each master prior to getting replication working? I believe you mentioned before this is a test environment. I would suggest you reload your secondary master from the primary master, and then test replication. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 03 Feb '14

03 Feb '14

--On Monday, February 03, 2014 2:26 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Ok, > > Sanity Check, please. Still seeing "empty syncUUID" messages. Also, the > "userPassword" attributes on mm-server2, cannot be seen (via Apache > Directory Studio -- but show up with ldapsearch), but when I attempt to > add (via ldapmodify) it returns value already present. if it shows up with ldapsearch when binding as uid=ldapreplicator,ou=admins,dc=example,dc=ldap then you are set. I have no idea who/what you are binding with via apache dir studio. ># {1}bdb, config > dn: olcDatabase={1}bdb,cn=config > olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by > anonymous auth by dn="cn=ldapadmin,dc=example,dc=ldap" manage by > dn="uid=replicator,ou=Admins,dc=example,dc=ldap" read by * none > olcAccess: {1}to * by * read Unless you plan on doing some really bizarre things, it is unlikely your ldapadmin needs manage access. See <http://www.openldap.org/its/index.cgi/?findid=7795> ># {2}bdb, config > dn: olcDatabase={2}bdb,cn=config > olcAccess: {0}to * by > dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" write by * none The replicator only ever needs read access, not write. Also separate nit. You should be doing dn.exact in the first set of ACLs as well (you have it correctly in the second set). --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 03 Feb '14

03 Feb '14

--On Monday, February 03, 2014 1:06 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > The "cn=replicator,cn=accesslog" was the olcRootDN for the accesslog. > > Rather that was my intent. > > Rereading documentation...and the script you shared with me a few weeks > back. > > Currently, my set up is: > 1) The rootDN for the cn=config is cn=admin (cn=admin,cn=config) > 2) the rootDN for my primary dbase is cn=ldapadmin > (cn=ldapadmin,dc=example,dc=ldap) 3) the rootDN for the accesslog, as > mentioned above, is/was cn=replicator (cn=replicator,cn=accesslog) > > My ou=Users,dc=example,dc=ldap has all the End-Users uids for logins. > > Noticed you have a cn=admins,cn=zimbra. > > Bear with the stupid question, this is more of a sanity check for me > (getting pressure from my side to get this project done -- so very > rushed). > > I could/should create an "ou=Admins,dc=example,dc=ldap", on both > MM-Servers > > In that ou create/move the replicator that I wrongfully created in > cn=accesslog: > > uid=replicator,ou=Admins,dc=example,dc=ldap > > That will get this user in the dbase. > > Modify, the olcSyncrepl, olcAccess, etc on both MM-Servers. > > Is that basically, correct? Yes. For replication, you need one single replication DN to be used for replication, that has read access into both your primary DB and your accesslog DB. The rootdns are entirely separate from any of that. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 03 Feb '14

03 Feb '14

--On Monday, February 03, 2014 9:57 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > All, > > I turned off TLS on both MMR machines, so I could more easily > troubleshoot Syncrepl/MMR configuration. Once over this hurdle, I'll > re-incorporate TLS. > > The following is a snippet of the SLAPD output-log file: > > <MM-SERVER2> > 52efa558 => bdb_dn2id("cn=replicator,cn=accesslog") > 52efa558 <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair > found (-30989) 52efa558 send_ldap_result: conn=5226 op=0 p=3 > 52efa558 send_ldap_result: err=49 matched="" text="" What is cn=replicator,cn=accesslog? Whatever it is, it doesn't exist in your DB. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Re: Deprecation of back-bdb
by Clément OUDOT 03 Feb '14

03 Feb '14

2014-02-03 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Monday, February 03, 2014 4:48 PM +0100 Clément OUDOT < > clem.oudot(a)gmail.com> wrote: > > >> >> >> >> Hi, >> >> as Howard said in his conference at FOSDEM, back-bdb is deprecated, and >> is disabled by default. >> >> Should I fill an ITS? >> > > No. It is deprecated in 2.5 and later. > > If I remember well, BDB should be deprecated for 2.4 and HDB deprecated for 2.5. See slide 37 of this presentation: http://fr.slideshare.net/ldapcon/whats-new-in-openldap Clément.

3 2

Deprecation of back-bdb
by Clément OUDOT 03 Feb '14

03 Feb '14

Hi, as Howard said in his conference at FOSDEM, back-bdb is deprecated, and is disabled by default. I just downloaded 2.4.39 tarball, and tested the configure script, it seems back-bdb is still activated by default: clement@ader:~/Programmes/openldap-2.4.39$ ./configure --help | grep bdb --enable-bdb enable Berkeley DB backend no|yes|mod [yes] Should I fill an ITS? Clément.

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 03 Feb '14

03 Feb '14

--On Friday, January 31, 2014 4:34 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > I have turned off TLS for the time being. > > Now, I think it is an ACLs issue that I need to figure out...seeing the > following: > > ldap_write: want=531 error=Broken pipe > 52ec16ae ber_flush2 failed errno=32 reason="Broken pipe" > 52ec16ae connection_closing: readying conn=1074 sd=22 for close > 52ec16ae send_search_entry: conn 1074 ber write failed. > 52ec16ae connection_resched: attempting closing conn=1074 sd=22 > 52ec16ae connection_close: conn=1074 sd=22 > 52ec16ae daemon: removing 22 > 52ec16ae conn=1074 fd=22 closed (connection lost on write) > 52ec16ae daemon: activity on 1 descriptor > 52ec16ae daemon: activity on:52ec16ae > 52ec16ae daemon: epoll: listen=7 active_threads=0 tvp=zero That would not be an acl issue. broken pipes, flushing problems, etc... I generally see that with firewalls causing problems. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

problem with accessing secure ldap
by c chupela 03 Feb '14

03 Feb '14

I've been tasked with figuring out why a redhat 6.4 server w/openldap v2.4.23 is not accessible. This server is a test server. I have a production server that is working properly, and I've gone thru and compared config files, etc, but haven't found any differences. I'm a newbie with this, so my understanding is still somewhat limited. Here's what I've done or checked so far: - iptables is not running - if I run netstat, I can see port 389/port 636 in listening state: tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 5603/slapd tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 5603/slapd tcp 0 0 :::636 :::* LISTEN 5603/slapd tcp 0 0 :::389 :::* LISTEN 5603/slapd I can telnet to port 389 on this server from another server, but not to port 636 - putty will throw back an immediate 'connection closed by remote host' message. I'm not seeing any slapd related messages in /var/log/messages. What else can I check on here? Thanks Chris

8 16

LMDB database size
by Markus Doppelbauer 01 Feb '14

01 Feb '14

5 6

slapd.d and back-sql
by Robson, Alan 01 Feb '14

01 Feb '14

Hi all, I'm trying to set up back-sql on Ubuntu using openldap version 2.4.39 that uses slapd.d as its configuration store. All of the config examples I can find online use slapd.conf. A 2011 email from this mailing list explains that it simply is not possible to use the slapd.d config method to specify a dbname. Is that still the case ? I am trying to add an entry for my mysql database using ldapadd and the following ldif... # order value not present so entry will be appended # to current children dn: olcDatabase=sql,cn=config objectClass: olcDatabaseConfig olcDatabase: mysql dbName: ldap olcSuffix: dc=nodomain The response I get is... adding new entry "olcDatabase=sql,cn=config" ldap_add: Undefined attribute type (17) additional info: dbName: attribute type undefined I tried dbname (no capital N) as well, but I get the same result. As you may be able to tell, I have a very loose grip on what to do here ! I'd appreciate some guidance. I am confident that I have odbc and the database/user set up as it describes in the manual section on back-sql. My database connection is called "ldap" in odbc.ini. /etc/odbcinst.ini: [mysql] Description = ODBC for MySQL Driver = /usr/lib/x86_64-linux-gnu/odbc/libmyodbc.so Setup = /usr/lib/x86_64-linux-gnu/odbc/libodbcmyS.so FileUsage = 1 /etc/odbc.ini: [ldap] Description = MySQL connection to 'test' database Driver = mysql Database = ldap UserName = ldap Password = ldap Server = localhost Port = 3306 Socket = /var/run/mysqld/mysqld.sock If I need to go back to using slapd.conf, how can I generate one from my slapd.d setup ? Many thanks Alan

2 3

OpenLDAP compatibility between client and server of different versions
by Fabien C. 01 Feb '14

01 Feb '14

Hello, I have a few questions about OpenLDAP versions compatibility: - How to know what version of OpenLDAP client is compatible with what version of the server? - Is there backward or forward compatibility tables from the client and/or server point of view? - For a given version of the server, how to know which clients are compatible, and conversely? - And most important: what about replication? Thank you! Fabien C.

2 3

RE: Syncrepl and mmr
by Quanah Gibson-Mount 31 Jan '14

31 Jan '14

--On Friday, January 31, 2014 2:37 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > I am using OpenSSL 0.9.8 (CentOS rpm version -- CentOS 5.9), > unfortunately and I cannot upgrade it. Oddly it works for all other > connections between these systems and clients...I don't understand why it > isn't for this portion. Well, you're at a point where I don't know how to help you further. Something's definitely wrong with your TLS stack, but I've no idea what. ;) --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Re: Syncrepl and mmr
by Michael Ströder 31 Jan '14

31 Jan '14

Borresen, John - 0442 - MITLL wrote: > I'm not trying to implement partial replication. Missed the smiley? Your *first* ACL should give read access to the whole tree to the group of replicas and then pass on all other access checking to the subsequent ACLs (by * break). Something like: limits group="cn=replicas,dc=example,dc=com" time=unlimited size=unlimited access to dn.subtree="ou=ampua" by group="cn=replicas,dc=example,dc=com" read by * break Ciao, Michael. > -----Original Message----- > From: Michael Ströder [mailto:michael@stroeder.com] > Sent: Friday, January 31, 2014 2:15 PM > To: Quanah Gibson-Mount; Borresen, John - 0442 - MITLL; openldap-technical(a)openldap.org > Subject: Re: Syncrepl and mmr > > Quanah Gibson-Mount wrote: >> --On Friday, January 31, 2014 1:20 PM -0500 "Borresen, John - 0442 - MITLL" >> <John.Borresen(a)ll.mit.edu> wrote: >> >>> Thanks, Quanah >>> >>> Not sure what you meant by " Well, it may not have been this issue, but >>> it definite would become an issue then." >>> >>> Was what I did a good thing or not? Curious minds want to know. <lol> >> >> The lack of read permissions for the replication user would absolutely be an >> issue at some point. ;) > > To put it the other way round: > It's very hard to implement partial replication correctly. ;-} > > Ciao, Michael.

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 31 Jan '14

31 Jan '14

--On Friday, January 31, 2014 2:25 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > I'm not trying to implement partial replication. Throwing darts from 100 > miles away and trying to hit a penny nailed to the opposite side of > tree...yes that is what I feel like I'm doing. : At this point, I've no idea what you've done to break your servers in relation to TLS. I would ask what SSL implementation you are linked to (Openssl, GnuTLS, or MozNSS). --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 31 Jan '14

31 Jan '14

--On Friday, January 31, 2014 1:20 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Thanks, Quanah > > Not sure what you meant by " Well, it may not have been this issue, but > it definite would become an issue then." > > Was what I did a good thing or not? Curious minds want to know. <lol> The lack of read permissions for the replication user would absolutely be an issue at some point. ;) > MM Server1: ># ldapsearch -H ldap://mm-server1.example.ldap -d 256 -x -D ># cn=admin,cn=config -W -ZZ -b olcDatabase=\{1\}bdb,cn=config olcSyncrepl What CA cert is your ldapsearch command using? --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 4

RE: Syncrepl and mmr
by Quanah Gibson-Mount 31 Jan '14

31 Jan '14

--On Friday, January 31, 2014 8:54 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Thanks Quanah > > I'm sure it isn't 100% correct, but I added the following ACL to my > accesslog DB on both MM servers: > > olcAccess: to * by dn="cn=ldapadmin,dc=group42,dc=ldap" read by * none Well, it may not have been this issue, but it definite would become an issue then. ;) > I'm still seeing > gp42-admin3 (MM server1) > Jan 31 08:25:17 gp42-admin3 slapd[3599]: conn=5551 op=2 SRCH > base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Jan 31 > 08:25:17 gp42-admin3 slapd[3599]: conn=5551 op=2 SRCH attr=reqDN reqType > reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Jan 31 08:25:17 > gp42-admin3 slapd[3599]: do_syncrep2: rid=001 got empty syncUUID with > LDAP_SYNC_ADD (cn=accesslog) Jan 31 08:25:17 gp42-admin3 slapd[3599]: > do_syncrepl: rid=001 rc -1 retrying Jan 31 08:25:17 gp42-admin3 > slapd[3599]: send_search_entry: conn 5551 ber write failed. Jan 31 > 08:25:17 gp42-admin3 slapd[3599]: conn=5551 fd=32 closed (connection lost > on write) Jan 31 08:25:17 gp42-admin3 slapd[3599]: do_syncrep2: rid=002 > got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 31 08:25:17 > gp42-admin3 slapd[3599]: do_syncrepl: rid=002 rc -1 retrying Your masters are unable to talk to each other. You need to determine why. This will take debugging on your part, as I've never seen anything like this before. > gp42-admin4 (MM server2) > Jan 31 08:25:19 gp42-admin4 slapd[26000]: conn=8050 fd=101 ACCEPT from > IP=155.34.133.73:10446 (IP=0.0.0.0:389) Jan 31 08:25:19 gp42-admin4 > slapd[26000]: conn=8050 op=0 BIND dn="dc=group42,dc=ldap" method=163 Jan > 31 08:25:19 gp42-admin4 slapd[26000]: conn=8050 op=0 RESULT tag=97 err=13 > text=TLS confidentiality required Jan 31 08:25:19 gp42-admin4 > slapd[26000]: conn=8050 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" > method=128 Jan 31 08:25:19 gp42-admin4 slapd[26000]: conn=8050 op=1 > RESULT tag=97 err=13 text=TLS confidentiality required Jan 31 08:25:19 > gp42-admin4 slapd[26000]: conn=8050 op=2 UNBIND > Jan 31 08:25:19 gp42-admin4 slapd[26000]: conn=8050 fd=101 closed > Jan 31 08:25:51 gp42-admin4 slapd[26000]: do_syncrep2: rid=001 got empty > syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 31 08:25:51 gp42-admin4 > slapd[26000]: do_syncrepl: rid=001 rc -1 retrying This says that your consumer is connecting without sending a startTLS, while you've configured the master to require startTLS. Clearly you need to either enable startTLS in the syncrepl statement, or not require starttls on your master. --Quanah > -----Original Message----- > From: Quanah Gibson-Mount [mailto:quanah@zimbra.com] > Sent: Thursday, January 30, 2014 5:10 PM > To: Borresen, John - 0442 - MITLL; openldap-technical(a)openldap.org > Subject: RE: Syncrepl and mmr > > --On Thursday, January 30, 2014 4:51 PM -0500 "Borresen, John - 0442 - > MITLL" <John.Borresen(a)ll.mit.edu> wrote: > >> Well, that was helpful -- lol > > > Looking at your previously supplied configuration, it is clearly apparent > that you provided your replication user no ACLs to read the accesslog DB, > so the error you see makes sense. It can't read the data out of > accesslog, so it throws an error stating that fact. > > --Quanah > > -- > > Quanah Gibson-Mount > Architect - Server > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 31 Jan '14

31 Jan '14

--On Thursday, January 30, 2014 4:51 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Well, that was helpful -- lol Looking at your previously supplied configuration, it is clearly apparent that you provided your replication user no ACLs to read the accesslog DB, so the error you see makes sense. It can't read the data out of accesslog, so it throws an error stating that fact. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Re: Overlay ppolicy not found
by Dieter Klünter 31 Jan '14

31 Jan '14

Am Thu, 30 Jan 2014 12:13:04 +0000 schrieb Rodrigo Coutinho <Rodrigo.Coutinho(a)ifap.pt>: > Hi again, > > Th result was: > > Included static overlays: > syncprov > Included static backends: > config > ldif > monitor > bdb > hdb > mdb > relay > > What now? Check with your OS Distribution whether there are additional dynamic loadable modules. -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 31 Jan '14

31 Jan '14

--On Thursday, January 30, 2014 4:25 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Thanks Quanah... > > Question, about the "manage" Access Level when would that be used? > > It is not talked about at all other than Table 5.4 in section 8.3.3. The man pages are the definitive source for all information. I would suggest you read the slapd.access(5) man page. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

4 3

RE: Syncrepl and mmr
by Quanah Gibson-Mount 30 Jan '14

30 Jan '14

--On Thursday, January 30, 2014 4:51 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > All Masters in the chain have the olcServerID's and olcSynRepl for itself > and its partner? I can understand having each knowing about the others > but why itself? It's replicating to itself? It knows about itself so it knows what to ignore. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

RE: Syncrepl and mmr
by Quanah Gibson-Mount 30 Jan '14

30 Jan '14

--On Thursday, January 30, 2014 4:35 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Seeing the following in the logs: > > Jan 30 16:28:41 gp42-admin4 slapd[26000]: do_syncrep2: rid=001 got empty > syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 30 16:28:41 gp42-admin4 > slapd[26000]: do_syncrepl: rid=001 rc -1 retrying > > Jan 30 16:33:02 gp42-admin3 slapd[3599]: do_syncrep2: rid=002 got empty > syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 30 16:33:02 gp42-admin3 > slapd[3599]: do_syncrepl: rid=002 rc -1 retrying Sounds like you managed to break your system somehow. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 30 Jan '14

30 Jan '14

--On Thursday, January 30, 2014 3:28 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Thanks Quanah... > > Now, I'm going to ask this... > > My current ACL is: > > olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by > anonymous auth by * none olcAccess: {1}to * by * read > > Supposed this allows the user to modify their userPassword and (in so > doing) modifying the shadowLastChange, allows anonymous to authenticate > against these entries and allows others to read these entries > > Am I reading that correctly...or at least close? > > To give my syncrepl user (ldapadmin) access, my new ACL would another > olcAccess: > > olcAccess:{2}to * by cn=ldapdmin manage > > Is that correct? I would suggest you re-read the documentation on ACLs. As noted in the ACL documentation, ACL processing STOPS on the first matching ACL by default. So NO ACL is evaluated for userPassword and ShadowLastChange if they do not match the self write, anonymous auth bits. What you would want is something like: olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by replicauser read by * none olcAccess: {1}to * by * read I.e, specifically grant read access to those 2 attrs to whatever the DN is for your replication user. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Syncrepl and mmr
by Borresen, John - 0442 - MITLL 30 Jan '14

30 Jan '14

For some reason the original never made it. Not sure why. ________________________________________ From: Borresen, John - 0442 - MITLL Sent: Wednesday, January 29, 2014 4:41 PM To: openldap-technical(a)openldap.org Subject: Syncrepl -- MMR All, Troubleshooting some issues, not to mention to verify that Syncrepl are working as they should, following setting up a 2-way multi-master in our test environment. 1) I noticed that the “userPassword” attributes have all disappeared?! 2) On one of the masters I was able to add it back in (for my account, of course) and added a password (SHA). It has not propagated over to the other master. -->Here is the slapd.log from server#1: Jan 29 16:10:06 gp42-admin3 slapd[3599]: do_syncrep2: rid=002 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 29 16:10:06 gp42-admin3 slapd[3599]: do_syncrepl: rid=002 rc -1 retrying Jan 29 16:10:34 gp42-admin3 slapd[3599]: conn=1216 fd=30 ACCEPT from IP=155.34.133.44:54271 (IP=0.0.0.0:389) Jan 29 16:10:34 gp42-admin3 slapd[3599]: conn=1216 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 16:10:34 gp42-admin3 slapd[3599]: conn=1216 op=0 STARTTLS Jan 29 16:10:34 gp42-admin3 slapd[3599]: conn=1216 op=0 RESULT oid= err=0 text= Jan 29 16:10:34 gp42-admin3 slapd[3599]: conn=1216 fd=30 TLS established tls_ssf=256 ssf=256 Jan 29 16:10:34 gp42-admin3 slapd[3599]: conn=1216 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" method=128 Jan 29 16:10:34 gp42-admin3 slapd[3599]: conn=1216 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" mech=SIMPLE ssf=0 Jan 29 16:10:34 gp42-admin3 slapd[3599]: conn=1216 op=1 RESULT tag=97 err=0 text= Jan 29 16:10:34 gp42-admin3 slapd[3599]: conn=1216 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Jan 29 16:10:34 gp42-admin3 slapd[3599]: conn=1216 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Jan 29 16:10:34 gp42-admin3 slapd[3599]: send_search_entry: conn 1216 ber write failed. Jan 29 16:10:34 gp42-admin3 slapd[3599]: conn=1216 fd=30 closed (connection lost on write) Jan 29 16:11:02 gp42-admin3 slapd[3599]: conn=1217 fd=31 ACCEPT from IP=172.25.91.233:36144 (IP=0.0.0.0:389) Jan 29 16:11:02 gp42-admin3 slapd[3599]: conn=1217 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 16:11:02 gp42-admin3 slapd[3599]: conn=1217 op=0 STARTTLS Jan 29 16:11:02 gp42-admin3 slapd[3599]: conn=1217 op=0 RESULT oid= err=0 text= Jan 29 16:11:02 gp42-admin3 slapd[3599]: conn=1217 fd=31 TLS established tls_ssf=256 ssf=256 Jan 29 16:11:02 gp42-admin3 slapd[3599]: conn=1217 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" method=128 Jan 29 16:11:02 gp42-admin3 slapd[3599]: conn=1217 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" mech=SIMPLE ssf=0 Jan 29 16:11:02 gp42-admin3 slapd[3599]: conn=1217 op=1 RESULT tag=97 err=0 text= Jan 29 16:11:02 gp42-admin3 slapd[3599]: conn=1217 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Jan 29 16:11:02 gp42-admin3 slapd[3599]: conn=1217 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Jan 29 16:11:02 gp42-admin3 slapd[3599]: do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 29 16:11:02 gp42-admin3 slapd[3599]: do_syncrepl: rid=001 rc -1 retrying Jan 29 16:11:02 gp42-admin3 slapd[3599]: conn=1217 op=3 UNBIND Jan 29 16:11:02 gp42-admin3 slapd[3599]: conn=1217 fd=31 closed Jan 29 16:11:06 gp42-admin3 slapd[3599]: do_syncrep2: rid=002 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 29 16:11:06 gp42-admin3 slapd[3599]: do_syncrepl: rid=002 rc -1 retrying Jan 29 16:11:34 gp42-admin3 slapd[3599]: conn=1218 fd=30 ACCEPT from IP=155.34.133.44:54273 (IP=0.0.0.0:389) Jan 29 16:11:34 gp42-admin3 slapd[3599]: conn=1218 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 16:11:34 gp42-admin3 slapd[3599]: conn=1218 op=0 STARTTLS Jan 29 16:11:34 gp42-admin3 slapd[3599]: conn=1218 op=0 RESULT oid= err=0 text= Jan 29 16:11:34 gp42-admin3 slapd[3599]: conn=1218 fd=30 TLS established tls_ssf=256 ssf=256 Jan 29 16:11:34 gp42-admin3 slapd[3599]: conn=1218 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" method=128 Jan 29 16:11:34 gp42-admin3 slapd[3599]: conn=1218 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" mech=SIMPLE ssf=0 Jan 29 16:11:34 gp42-admin3 slapd[3599]: conn=1218 op=1 RESULT tag=97 err=0 text= Jan 29 16:11:34 gp42-admin3 slapd[3599]: conn=1218 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Jan 29 16:11:34 gp42-admin3 slapd[3599]: conn=1218 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Jan 29 16:11:34 gp42-admin3 slapd[3599]: send_search_entry: conn 1218 ber write failed. Jan 29 16:11:34 gp42-admin3 slapd[3599]: conn=1218 fd=30 closed (connection lost on write) Jan 29 16:11:41 gp42-admin3 slapd[3599]: conn=1032 op=27 SRCH base="cn=accesslog" scope=1 deref=3 filter="(objectClass=*)" Jan 29 16:11:41 gp42-admin3 slapd[3599]: conn=1032 op=27 SRCH attr=hasSubordinates objectClass Jan 29 16:11:41 gp42-admin3 slapd[3599]: conn=1032 op=27 SEARCH RESULT tag=101 err=0 nentries=36 text= Jan 29 16:11:41 gp42-admin3 slapd[3599]: conn=1032 op=28 SRCH base="cn=accesslog" scope=0 deref=3 filter="(objectClass=*)" Jan 29 16:11:41 gp42-admin3 slapd[3599]: conn=1032 op=28 SRCH attr=* Jan 29 16:11:41 gp42-admin3 slapd[3599]: conn=1032 op=28 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 29 16:12:02 gp42-admin3 slapd[3599]: conn=1219 fd=31 ACCEPT from IP=172.25.91.233:36146 (IP=0.0.0.0:389) Jan 29 16:12:02 gp42-admin3 slapd[3599]: conn=1219 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 16:12:02 gp42-admin3 slapd[3599]: conn=1219 op=0 STARTTLS Jan 29 16:12:02 gp42-admin3 slapd[3599]: conn=1219 op=0 RESULT oid= err=0 text= Jan 29 16:12:02 gp42-admin3 slapd[3599]: conn=1219 fd=31 TLS established tls_ssf=256 ssf=256 Jan 29 16:12:02 gp42-admin3 slapd[3599]: conn=1219 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" method=128 Jan 29 16:12:02 gp42-admin3 slapd[3599]: conn=1219 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" mech=SIMPLE ssf=0 Jan 29 16:12:02 gp42-admin3 slapd[3599]: conn=1219 op=1 RESULT tag=97 err=0 text= Jan 29 16:12:02 gp42-admin3 slapd[3599]: conn=1219 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Jan 29 16:12:02 gp42-admin3 slapd[3599]: conn=1219 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Jan 29 16:12:02 gp42-admin3 slapd[3599]: do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 29 16:12:02 gp42-admin3 slapd[3599]: do_syncrepl: rid=001 rc -1 retrying Jan 29 16:12:02 gp42-admin3 slapd[3599]: conn=1219 op=3 UNBIND Jan 29 16:12:02 gp42-admin3 slapd[3599]: conn=1219 fd=31 closed Jan 29 16:12:06 gp42-admin3 slapd[3599]: do_syncrep2: rid=002 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 29 16:12:06 gp42-admin3 slapd[3599]: do_syncrepl: rid=002 rc -1 retrying Jan 29 16:12:34 gp42-admin3 slapd[3599]: conn=1220 fd=30 ACCEPT from IP=155.34.133.44:54275 (IP=0.0.0.0:389) Jan 29 16:12:34 gp42-admin3 slapd[3599]: conn=1220 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 16:12:34 gp42-admin3 slapd[3599]: conn=1220 op=0 STARTTLS Jan 29 16:12:34 gp42-admin3 slapd[3599]: conn=1220 op=0 RESULT oid= err=0 text= Jan 29 16:12:34 gp42-admin3 slapd[3599]: conn=1220 fd=30 TLS established tls_ssf=256 ssf=256 Jan 29 16:12:34 gp42-admin3 slapd[3599]: conn=1220 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" method=128 Jan 29 16:12:34 gp42-admin3 slapd[3599]: conn=1220 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" mech=SIMPLE ssf=0 Jan 29 16:12:34 gp42-admin3 slapd[3599]: conn=1220 op=1 RESULT tag=97 err=0 text= Jan 29 16:12:34 gp42-admin3 slapd[3599]: conn=1220 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Jan 29 16:12:34 gp42-admin3 slapd[3599]: conn=1220 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Jan 29 16:12:34 gp42-admin3 slapd[3599]: send_search_entry: conn 1220 ber write failed. Jan 29 16:12:34 gp42-admin3 slapd[3599]: conn=1220 fd=30 closed (connection lost on write) Jan 29 16:13:02 gp42-admin3 slapd[3599]: conn=1221 fd=31 ACCEPT from IP=172.25.91.233:36149 (IP=0.0.0.0:389) Jan 29 16:13:02 gp42-admin3 slapd[3599]: conn=1221 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 16:13:02 gp42-admin3 slapd[3599]: conn=1221 op=0 STARTTLS Jan 29 16:13:02 gp42-admin3 slapd[3599]: conn=1221 op=0 RESULT oid= err=0 text= Jan 29 16:13:03 gp42-admin3 slapd[3599]: conn=1221 fd=31 TLS established tls_ssf=256 ssf=256 Jan 29 16:13:03 gp42-admin3 slapd[3599]: conn=1221 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" method=128 Jan 29 16:13:03 gp42-admin3 slapd[3599]: conn=1221 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" mech=SIMPLE ssf=0 Jan 29 16:13:03 gp42-admin3 slapd[3599]: conn=1221 op=1 RESULT tag=97 err=0 text= Jan 29 16:13:03 gp42-admin3 slapd[3599]: conn=1221 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Jan 29 16:13:03 gp42-admin3 slapd[3599]: conn=1221 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Jan 29 16:13:03 gp42-admin3 slapd[3599]: do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 29 16:13:03 gp42-admin3 slapd[3599]: do_syncrepl: rid=001 rc -1 retrying Jan 29 16:13:03 gp42-admin3 slapd[3599]: conn=1221 op=3 UNBIND Jan 29 16:13:03 gp42-admin3 slapd[3599]: conn=1221 fd=31 closed Jan 29 16:13:06 gp42-admin3 slapd[3599]: do_syncrep2: rid=002 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 29 16:13:06 gp42-admin3 slapd[3599]: do_syncrepl: rid=002 rc -1 retrying Jan 29 16:13:34 gp42-admin3 slapd[3599]: conn=1222 fd=30 ACCEPT from IP=155.34.133.44:54277 (IP=0.0.0.0:389) Jan 29 16:13:34 gp42-admin3 slapd[3599]: conn=1222 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 16:13:34 gp42-admin3 slapd[3599]: conn=1222 op=0 STARTTLS Jan 29 16:13:34 gp42-admin3 slapd[3599]: conn=1222 op=0 RESULT oid= err=0 text= Jan 29 16:13:34 gp42-admin3 slapd[3599]: conn=1222 fd=30 TLS established tls_ssf=256 ssf=256 Jan 29 16:13:34 gp42-admin3 slapd[3599]: conn=1222 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" method=128 Jan 29 16:13:34 gp42-admin3 slapd[3599]: conn=1222 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" mech=SIMPLE ssf=0 Jan 29 16:13:34 gp42-admin3 slapd[3599]: conn=1222 op=1 RESULT tag=97 err=0 text= Jan 29 16:13:34 gp42-admin3 slapd[3599]: conn=1222 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Jan 29 16:13:34 gp42-admin3 slapd[3599]: conn=1222 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Jan 29 16:13:34 gp42-admin3 slapd[3599]: conn=1222 op=3 UNBIND Jan 29 16:13:34 gp42-admin3 slapd[3599]: conn=1222 fd=30 closed -->Here is the log from the other server, same time frame: Jan 29 16:10:06 gp42-admin4 slapd[26000]: conn=3232 fd=108 ACCEPT from IP=172.25.91.233:41849 (IP=0.0.0.0:389) Jan 29 16:10:06 gp42-admin4 slapd[26000]: conn=3232 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 16:10:06 gp42-admin4 slapd[26000]: conn=3232 op=0 STARTTLS Jan 29 16:10:06 gp42-admin4 slapd[26000]: conn=3232 op=0 RESULT oid= err=0 text= Jan 29 16:10:06 gp42-admin4 slapd[26000]: conn=3232 fd=108 TLS established tls_ssf=256 ssf=256 Jan 29 16:10:06 gp42-admin4 slapd[26000]: conn=3232 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" method=128 Jan 29 16:10:06 gp42-admin4 slapd[26000]: conn=3232 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" mech=SIMPLE ssf=0 Jan 29 16:10:06 gp42-admin4 slapd[26000]: conn=3232 op=1 RESULT tag=97 err=0 text= Jan 29 16:10:06 gp42-admin4 slapd[26000]: conn=3232 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Jan 29 16:10:06 gp42-admin4 slapd[26000]: conn=3232 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Jan 29 16:10:06 gp42-admin4 slapd[26000]: send_search_entry: conn 3232 ber write failed. Jan 29 16:10:06 gp42-admin4 slapd[26000]: conn=3232 fd=108 closed (connection lost on write) Jan 29 16:10:26 gp42-admin4 slapd[26000]: conn=3233 fd=109 ACCEPT from IP=155.34.133.44:38468 (IP=0.0.0.0:389) Jan 29 16:10:26 gp42-admin4 slapd[26000]: conn=3233 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 16:10:26 gp42-admin4 slapd[26000]: conn=3233 op=0 STARTTLS Jan 29 16:10:26 gp42-admin4 slapd[26000]: conn=3233 op=0 RESULT oid= err=0 text= Jan 29 16:10:26 gp42-admin4 slapd[26000]: conn=3233 fd=109 TLS established tls_ssf=256 ssf=256 Jan 29 16:10:26 gp42-admin4 slapd[26000]: conn=3233 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" method=128 Jan 29 16:10:26 gp42-admin4 slapd[26000]: conn=3233 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" mech=SIMPLE ssf=0 Jan 29 16:10:26 gp42-admin4 slapd[26000]: conn=3233 op=1 RESULT tag=97 err=0 text= Jan 29 16:10:26 gp42-admin4 slapd[26000]: conn=3233 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Jan 29 16:10:26 gp42-admin4 slapd[26000]: conn=3233 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Jan 29 16:10:26 gp42-admin4 slapd[26000]: do_syncrep2: rid=002 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 29 16:10:26 gp42-admin4 slapd[26000]: do_syncrepl: rid=002 rc -1 retrying Jan 29 16:10:26 gp42-admin4 slapd[26000]: send_search_entry: conn 3233 ber write failed. Jan 29 16:10:26 gp42-admin4 slapd[26000]: conn=3233 fd=109 closed (connection lost on write) Jan 29 16:10:34 gp42-admin4 slapd[26000]: do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 29 16:10:34 gp42-admin4 slapd[26000]: do_syncrepl: rid=001 rc -1 retrying Jan 29 16:11:06 gp42-admin4 slapd[26000]: conn=3234 fd=108 ACCEPT from IP=172.25.91.233:41852 (IP=0.0.0.0:389) Jan 29 16:11:06 gp42-admin4 slapd[26000]: conn=3234 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 16:11:06 gp42-admin4 slapd[26000]: conn=3234 op=0 STARTTLS Jan 29 16:11:06 gp42-admin4 slapd[26000]: conn=3234 op=0 RESULT oid= err=0 text= Jan 29 16:11:06 gp42-admin4 slapd[26000]: conn=3234 fd=108 TLS established tls_ssf=256 ssf=256 Jan 29 16:11:06 gp42-admin4 slapd[26000]: conn=3234 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" method=128 Jan 29 16:11:06 gp42-admin4 slapd[26000]: conn=3234 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" mech=SIMPLE ssf=0 Jan 29 16:11:06 gp42-admin4 slapd[26000]: conn=3234 op=1 RESULT tag=97 err=0 text= Jan 29 16:11:06 gp42-admin4 slapd[26000]: conn=3234 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Jan 29 16:11:06 gp42-admin4 slapd[26000]: conn=3234 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Jan 29 16:11:06 gp42-admin4 slapd[26000]: send_search_entry: conn 3234 ber write failed. Jan 29 16:11:06 gp42-admin4 slapd[26000]: conn=3234 fd=108 closed (connection lost on write) Jan 29 16:11:26 gp42-admin4 slapd[26000]: conn=3235 fd=109 ACCEPT from IP=155.34.133.44:38470 (IP=0.0.0.0:389) Jan 29 16:11:26 gp42-admin4 slapd[26000]: conn=3235 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 16:11:26 gp42-admin4 slapd[26000]: conn=3235 op=0 STARTTLS Jan 29 16:11:26 gp42-admin4 slapd[26000]: conn=3235 op=0 RESULT oid= err=0 text= Jan 29 16:11:26 gp42-admin4 slapd[26000]: conn=3235 fd=109 TLS established tls_ssf=256 ssf=256 Jan 29 16:11:26 gp42-admin4 slapd[26000]: conn=3235 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" method=128 Jan 29 16:11:26 gp42-admin4 slapd[26000]: conn=3235 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" mech=SIMPLE ssf=0 Jan 29 16:11:26 gp42-admin4 slapd[26000]: conn=3235 op=1 RESULT tag=97 err=0 text= Jan 29 16:11:26 gp42-admin4 slapd[26000]: conn=3235 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Jan 29 16:11:26 gp42-admin4 slapd[26000]: conn=3235 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Jan 29 16:11:26 gp42-admin4 slapd[26000]: do_syncrep2: rid=002 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 29 16:11:26 gp42-admin4 slapd[26000]: do_syncrepl: rid=002 rc -1 retrying Jan 29 16:11:26 gp42-admin4 slapd[26000]: send_search_entry: conn 3235 ber write failed. Jan 29 16:11:26 gp42-admin4 slapd[26000]: conn=3235 fd=109 closed (connection lost on write) Jan 29 16:11:34 gp42-admin4 slapd[26000]: do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 29 16:11:34 gp42-admin4 slapd[26000]: do_syncrepl: rid=001 rc -1 retrying Jan 29 16:11:47 gp42-admin4 slapd[26000]: conn=3036 op=20 SRCH base="cn=accesslog" scope=0 deref=3 filter="(objectClass=*)" Jan 29 16:11:47 gp42-admin4 slapd[26000]: conn=3036 op=20 SRCH attr=* Jan 29 16:11:47 gp42-admin4 slapd[26000]: conn=3036 op=20 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 29 16:11:49 gp42-admin4 slapd[26000]: conn=3036 op=21 SRCH base="cn=accesslog" scope=1 deref=3 filter="(objectClass=*)" Jan 29 16:11:49 gp42-admin4 slapd[26000]: conn=3036 op=21 SRCH attr=hasSubordinates objectClass Jan 29 16:11:49 gp42-admin4 slapd[26000]: conn=3036 op=21 SEARCH RESULT tag=101 err=4 nentries=500 text= Jan 29 16:11:49 gp42-admin4 slapd[26000]: conn=3036 op=22 SRCH base="cn=accesslog" scope=0 deref=3 filter="(objectClass=*)" Jan 29 16:11:49 gp42-admin4 slapd[26000]: conn=3036 op=22 SRCH attr=* Jan 29 16:11:49 gp42-admin4 slapd[26000]: conn=3036 op=22 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 29 16:12:06 gp42-admin4 slapd[26000]: conn=3236 fd=108 ACCEPT from IP=172.25.91.233:41854 (IP=0.0.0.0:389) Jan 29 16:12:06 gp42-admin4 slapd[26000]: conn=3236 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 16:12:06 gp42-admin4 slapd[26000]: conn=3236 op=0 STARTTLS Jan 29 16:12:06 gp42-admin4 slapd[26000]: conn=3236 op=0 RESULT oid= err=0 text= Jan 29 16:12:06 gp42-admin4 slapd[26000]: conn=3236 fd=108 TLS established tls_ssf=256 ssf=256 Jan 29 16:12:06 gp42-admin4 slapd[26000]: conn=3236 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" method=128 Jan 29 16:12:06 gp42-admin4 slapd[26000]: conn=3236 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" mech=SIMPLE ssf=0 Jan 29 16:12:06 gp42-admin4 slapd[26000]: conn=3236 op=1 RESULT tag=97 err=0 text= Jan 29 16:12:06 gp42-admin4 slapd[26000]: conn=3236 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Jan 29 16:12:06 gp42-admin4 slapd[26000]: conn=3236 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Jan 29 16:12:06 gp42-admin4 slapd[26000]: send_search_entry: conn 3236 ber write failed. Jan 29 16:12:06 gp42-admin4 slapd[26000]: conn=3236 fd=108 closed (connection lost on write) Jan 29 16:12:18 gp42-admin4 slapd[26000]: conn=2702 op=23 SRCH base="dc=group42,dc=ldap" scope=1 deref=3 filter="(objectClass=*)" Jan 29 16:12:18 gp42-admin4 slapd[26000]: conn=2702 op=23 SRCH attr=hasSubordinates objectClass Jan 29 16:12:18 gp42-admin4 slapd[26000]: conn=2702 op=23 SEARCH RESULT tag=101 err=0 nentries=15 text= Jan 29 16:12:18 gp42-admin4 slapd[26000]: conn=2702 op=24 SRCH base="dc=group42,dc=ldap" scope=0 deref=3 filter="(objectClass=*)" Jan 29 16:12:18 gp42-admin4 slapd[26000]: conn=2702 op=24 SRCH attr=* Jan 29 16:12:18 gp42-admin4 slapd[26000]: conn=2702 op=24 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 29 16:12:21 gp42-admin4 slapd[26000]: conn=2702 op=25 SRCH base="ou=Users,dc=group42,dc=ldap" scope=1 deref=3 filter="(objectClass=*)" Jan 29 16:12:21 gp42-admin4 slapd[26000]: conn=2702 op=25 SRCH attr=hasSubordinates objectClass Jan 29 16:12:21 gp42-admin4 slapd[26000]: conn=2702 op=25 SEARCH RESULT tag=101 err=0 nentries=123 text= Jan 29 16:12:26 gp42-admin4 slapd[26000]: conn=3237 fd=109 ACCEPT from IP=155.34.133.44:38472 (IP=0.0.0.0:389) Jan 29 16:12:26 gp42-admin4 slapd[26000]: conn=2702 op=26 SRCH base="uid=daveb,ou=Users,dc=group42,dc=ldap" scope=0 deref=3 filter="(objectClass=*)" Jan 29 16:12:26 gp42-admin4 slapd[26000]: conn=2702 op=26 SRCH attr=* Jan 29 16:12:26 gp42-admin4 slapd[26000]: conn=2702 op=26 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 29 16:12:26 gp42-admin4 slapd[26000]: conn=3237 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 16:12:26 gp42-admin4 slapd[26000]: conn=3237 op=0 STARTTLS Jan 29 16:12:26 gp42-admin4 slapd[26000]: conn=3237 op=0 RESULT oid= err=0 text= Jan 29 16:12:26 gp42-admin4 slapd[26000]: conn=3237 fd=109 TLS established tls_ssf=256 ssf=256 Jan 29 16:12:26 gp42-admin4 slapd[26000]: conn=3237 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" method=128 Jan 29 16:12:26 gp42-admin4 slapd[26000]: conn=3237 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" mech=SIMPLE ssf=0 Jan 29 16:12:26 gp42-admin4 slapd[26000]: conn=3237 op=1 RESULT tag=97 err=0 text= Jan 29 16:12:26 gp42-admin4 slapd[26000]: conn=3237 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Jan 29 16:12:26 gp42-admin4 slapd[26000]: conn=3237 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Jan 29 16:12:26 gp42-admin4 slapd[26000]: do_syncrep2: rid=002 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 29 16:12:26 gp42-admin4 slapd[26000]: do_syncrepl: rid=002 rc -1 retrying Jan 29 16:12:26 gp42-admin4 slapd[26000]: conn=3237 op=3 UNBIND Jan 29 16:12:26 gp42-admin4 slapd[26000]: conn=3237 fd=109 closed Jan 29 16:12:34 gp42-admin4 slapd[26000]: do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 29 16:12:34 gp42-admin4 slapd[26000]: do_syncrepl: rid=001 rc -1 retrying Jan 29 16:13:06 gp42-admin4 slapd[26000]: conn=3238 fd=108 ACCEPT from IP=172.25.91.233:41857 (IP=0.0.0.0:389) Jan 29 16:13:06 gp42-admin4 slapd[26000]: conn=3238 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 16:13:06 gp42-admin4 slapd[26000]: conn=3238 op=0 STARTTLS Jan 29 16:13:06 gp42-admin4 slapd[26000]: conn=3238 op=0 RESULT oid= err=0 text= Jan 29 16:13:06 gp42-admin4 slapd[26000]: conn=3238 fd=108 TLS established tls_ssf=256 ssf=256 Jan 29 16:13:06 gp42-admin4 slapd[26000]: conn=3238 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" method=128 Jan 29 16:13:06 gp42-admin4 slapd[26000]: conn=3238 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" mech=SIMPLE ssf=0 Jan 29 16:13:06 gp42-admin4 slapd[26000]: conn=3238 op=1 RESULT tag=97 err=0 text= Jan 29 16:13:06 gp42-admin4 slapd[26000]: conn=3238 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Jan 29 16:13:06 gp42-admin4 slapd[26000]: conn=3238 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Jan 29 16:13:06 gp42-admin4 slapd[26000]: conn=3238 op=3 UNBIND Jan 29 16:13:06 gp42-admin4 slapd[26000]: conn=3238 fd=108 closed Jan 29 16:13:26 gp42-admin4 slapd[26000]: conn=3239 fd=109 ACCEPT from IP=155.34.133.44:38474 (IP=0.0.0.0:389) Jan 29 16:13:26 gp42-admin4 slapd[26000]: conn=3239 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 16:13:26 gp42-admin4 slapd[26000]: conn=3239 op=0 STARTTLS Jan 29 16:13:26 gp42-admin4 slapd[26000]: conn=3239 op=0 RESULT oid= err=0 text= Jan 29 16:13:26 gp42-admin4 slapd[26000]: conn=3239 fd=109 TLS established tls_ssf=256 ssf=256 Jan 29 16:13:26 gp42-admin4 slapd[26000]: conn=3239 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" method=128 Jan 29 16:13:26 gp42-admin4 slapd[26000]: conn=3239 op=1 BIND dn="cn=ldapadmin,dc=group42,dc=ldap" mech=SIMPLE ssf=0 Jan 29 16:13:26 gp42-admin4 slapd[26000]: conn=3239 op=1 RESULT tag=97 err=0 text= Jan 29 16:13:26 gp42-admin4 slapd[26000]: conn=3239 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Jan 29 16:13:26 gp42-admin4 slapd[26000]: conn=3239 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Jan 29 16:13:26 gp42-admin4 slapd[26000]: do_syncrep2: rid=002 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 29 16:13:26 gp42-admin4 slapd[26000]: do_syncrepl: rid=002 rc -1 retrying Jan 29 16:13:26 gp42-admin4 slapd[26000]: conn=3239 op=3 UNBIND Jan 29 16:13:26 gp42-admin4 slapd[26000]: conn=3239 fd=109 closed Jan 29 16:13:34 gp42-admin4 slapd[26000]: do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) Jan 29 16:13:34 gp42-admin4 slapd[26000]: do_syncrepl: rid=001 rc -1 retrying -->When trying to get a copy of the olcDatabase={0}bdb,cn=config from server#1, I receive the following: # slapcat -s olcDatabase=\{1\}bdb,cn=config 52e97450 ldif_read_file: checksum error on "/usr/local/openldap/etc/openldap/slapd.d/cn=config.ldif" 52e97450 ldif_read_file: checksum error on "/usr/local/openldap/etc/openldap/slapd.d/cn=config.ldif" dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=group42,dc=ldap olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=ldapadmin,dc=group42,dc=ldap olcRootPW:: _____________________________________= olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/openldap/openldap-data olcDbCacheSize: 1000 olcDbConfig: {0}# $OpenLDAP$ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databas es. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-d b/db/ref/env/db_config.html> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig:: ezh9Iwk8aHR0cDovL3d3dy5vcGVubGRhcC5vcmcvZmFxL2luZGV4LmNnaT9maWxl PTI+ olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon re building olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 0.25 GB cache olcDbConfig: {16}set_cachesize 0 268435456 1 olcDbConfig: {17} olcDbConfig: {18}# Data Directory olcDbConfig: {19}#set_data_dir db olcDbConfig: {20} olcDbConfig: {21}# Transaction Log settings olcDbConfig: {22}set_lg_regionmax 262144 olcDbConfig: {23}set_lg_bsize 2097152 olcDbConfig: {24}#set_lg_dir logs olcDbConfig: {25} olcDbConfig: {26}# Note: special DB_CONFIG flags are no longer needed for "qui ck" olcDbConfig:: ezI3fSMgc2xhcGFkZCg4KSBvciBzbGFwaW5kZXgoOCkgYWNjZXNzIChzZWUgdGhl aXIgLXEgb3B0aW9uKS4g olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn eq,sub olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: sn eq,sub olcDbIndex: mail eq,sub olcDbIndex: departmentNumber eq olcDbIndex: automountKey eq olcDbIndex: memberUid eq olcDbIndex: printerURI eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 5a87b5f1-c445-4e0e-ba97-6d2d63093704 creatorsName: cn=config createTimestamp: 20140122200748Z olcSyncrepl: {0}rid=001 provider=ldap://gp42-admin3.group42.ldap bindmethod=si mple binddn="cn=ldapadmin,dc=group42,dc=ldap" credentials=<password> interva l=01:00:00:00 searchbase="dc=group42,dc=ldap" logbase="cn=accesslog" schemach ecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs= "*,+" syncdata=accesslog starttls=yes tls_cacert=/usr/local/openldap/etc/open ldap/CA/cacert.pem olcSyncrepl: {1}rid=002 provider=ldap://gp42-admin4.group42.ldap bindmethod=si mple binddn="cn=ldapadmin,dc=group42,dc=ldap" credentials=<password> interva l=01:00:00:00 searchbase="dc=group42,dc=ldap" logbase="cn=accesslog" schemach ecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs= "*,+" syncdata=accesslog starttls=yes tls_cacert=/usr/local/openldap/etc/open ldap/CA/cacert.pem olcMirrorMode: TRUE entryCSN: 20140129193518.096476Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129193518Z dn: olcOverlay={0}syncprov,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 04afe1bf-40c7-425a-8b25-74f8687323fc creatorsName: cn=admin,cn=config createTimestamp: 20140129180447Z entryCSN: 20140129180447.701059Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180447Z dn: olcOverlay={1}accesslog,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig entryUUID: 54b5fa00-8244-41d3-923d-0743a10bf192 creatorsName: cn=admin,cn=config createTimestamp: 20140129180903Z entryCSN: 20140129180903.479192Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180903Z -->From server#2: # slapcat -s olcDatabase=\{1\}bdb,cn=config dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=group42,dc=ldap olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=ldapadmin,dc=group42,dc=ldap olcRootPW:: ________________________________= olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/openldap/openldap-data olcDbCacheSize: 1000 olcDbConfig: {0}# $OpenLDAP$ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databas es. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-d b/db/ref/env/db_config.html> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig:: ezh9Iwk8aHR0cDovL3d3dy5vcGVubGRhcC5vcmcvZmFxL2luZGV4LmNnaT9maWxl PTI+ olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon re building olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 0.25 GB cache olcDbConfig: {16}#set_cachesize 0 268435456 1 olcDbConfig: {17}set_cachesize 0 2147483648 1 olcDbConfig: {18} olcDbConfig: {19}# Data Directory olcDbConfig: {20}#set_data_dir db olcDbConfig: {21} olcDbConfig: {22}# Archive/deletion olcDbConfig: {23}set_flags DB_LOG_AUTOREMOVE olcDbConfig: {24} olcDbConfig: {25}# Transaction Log settings olcDbConfig: {26}set_lg_regionmax 262144 olcDbConfig: {27}set_lg_bsize 2097152 olcDbConfig: {28}#set_lg_dir logs olcDbConfig: {29} olcDbConfig: {30}# Note: special DB_CONFIG flags are no longer needed for "qui ck" olcDbConfig:: ezMxfSMgc2xhcGFkZCg4KSBvciBzbGFwaW5kZXgoOCkgYWNjZXNzIChzZWUgdGhl aXIgLXEgb3B0aW9uKS4g olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn eq,sub olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: sn eq,sub olcDbIndex: departmentNumber eq olcDbIndex: mail eq,sub olcDbIndex: automountKey eq olcDbIndex: memberUid eq olcDbIndex: printerURI eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 94ff450b-aa70-4507-9ca6-51cdd740ea3e creatorsName: cn=config createTimestamp: 20131218155313Z olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by * none olcAccess: {1}to * by * read olcSyncrepl: {0}rid=001 provider=ldap://gp42-admin3.group42.ldap bindmethod=si mple binddn="cn=ldapadmin,dc=group42,dc=ldap" credentials=<password> interva l=01:00:00:00 searchbase="dc=group42,dc=ldap" logbase="cn=accesslog" schemach ecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs= "*,+" syncdata=accesslog starttls=yes tls_cacert=/usr/local/openldap/etc/open ldap/CA/cacert.pem olcSyncrepl: {1}rid=002 provider=ldap://gp42-admin4.group42.ldap bindmethod=si mple binddn="cn=ldapadmin,dc=group42,dc=ldap" credentials=<password> interva l=01:00:00:00 searchbase="dc=group42,dc=ldap" logbase="cn=accesslog" schemach ecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs= "*,+" syncdata=accesslog starttls=yes tls_cacert=/usr/local/openldap/etc/open ldap/CA/cacert.pem olcMirrorMode: TRUE entryCSN: 20140129193241.088847Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129193241Z dn: olcOverlay={0}accesslog,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {0}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig entryUUID: 6e4e1508-5eb9-4372-bbd1-813f859b0acc creatorsName: cn=admin,cn=config createTimestamp: 20140129182321Z entryCSN: 20140129182321.004272Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129182321Z dn: olcOverlay={1}syncprov,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 9108e0db-ba9e-4b40-b743-4016c61582bc creatorsName: cn=admin,cn=config createTimestamp: 20140129183014Z entryCSN: 20140129183014.073365Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129183014Z Thank you in advance, let me know if any expanding information is needed. John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

2 2

migrating from syncrepl to delta syncrepl
by Paul B. Henson 30 Jan '14

30 Jan '14

When we first deployed openldap a decade or so ago, we implemented regular syncrepl rather than delta syncrepl because at the time the latter did not support mirror mode. As part of a project to implement the password policy overlay, we plan to switch to delta syncrepl to make the replication of failed login attributes etc more efficient. If I understand correctly, while obviously if a provider is only configured for syncrepl a consumer can only use syncrepl, if a provider is configured for delta syncrepl, a consumer can do either? As such, my tentative deployment plan (intended to avoid downtime), is: * Update configuration on backup master to provide delta syncrepl * Cutover load balancer to backup master * Update primary master to provide delta syncrepl, and to consume changes from backup master via delta syncrepl * Cutover load balancer back to primary master * Update backup master to consume changes from primary master via delta syncrepl * One at a time, remove slaves from load balancer and update to consume changes from both masters via delta syncrepl Currently on my masters, syncrepl is configured as: ----- overlay syncprov syncprov-checkpoint 500 30 syncprov-reloadhint TRUE syncprov-sessionlog 500 ----- And consumers are configured as: ----- syncrepl rid=1 provider=ldaps://master-2.ldap.csupomona.edu/ type=refreshAndPersist retry="10 10 60 +" searchbase="dc=csupomona,dc=edu" bindmethod=simple binddn=cn=XXXX credentials=XXXXXX ----- To add delta syncrepl support to the provider, my understanding is that I need to add the access log database: ----- database mdb directory /var/lib/openldap-data/accesslog maxsize 2147483648 suffix cn=accesslog rootdn cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE ----- And update the syncrepl config on the primary database to include the accesslog overlay: ----- overlay syncprov syncprov-checkpoint 500 30 syncprov-reloadhint TRUE syncprov-sessionlog 500 overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 ----- And then on the consumer, I need to update the syncrepl configuration to include the logbase, logfilter, and syncdata elements: ----- syncrepl rid=1 provider=ldaps://master-2.ldap.csupomona.edu/ type=refreshAndPersist retry="10 10 60 +" searchbase="dc=csupomona,dc=edu" bindmethod=simple binddn=cn=XXXX credentials=XXXXXX logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog ----- Does this all seem reasonable and pass sanity check? Thanks much.

2 2

Overlay ppolicy not found
by Rodrigo Coutinho 30 Jan '14

30 Jan '14

Hi, I'm new to LDAP and have searched your site and others, but have found nothing. I've installed OpenLdap 2.4.35 on a Red Hat Linux 5.9, following the instructions on this site. I've migrated the users and groups from the production database (Oracle). Now, I would like to set Password policies and have altered the slapd.conf accordingly. # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/ppolicy.schema # Load dynamic backend modules: modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la moduleload ppolicy.la ####################################################################### # BDB database definitions ####################################################################### overlay ppolicy ppolicy_default "cn=default,ou=pwpolicies,ou=config,dc=ifap,dc=local" However, when I execute slapd, I get the following error message: 52ea27a8 @(#) $OpenLDAP: slapd 2.4.35 (Oct 21 2013 16:37:56) $ root@abc00102:/u01/ldap/openldap-2.4.35/servers/slapd 52ea27a8 overlay "ppolicy" not found 52ea27a8 slapd stopped. 52ea27a8 connections_destroy: nothing to destroy. So, can I install the policy after installing OpenLdap or must I reinstall everything again ? Should I use the ppolicy.la or the ppolicy.so as stated in http://www.zytrax.com/books/ldap/ch6/ppolicy.html <http://www.zytrax.com/books/ldap/ch6/ppolicy.html> ? # required if the overlay is built dynamically loadmodule ppolicy.la # OR loadmodule ppolicy.so Thank you in advance Rodrigo Coutinho A transmiss�o de mensagens por e-mail n�o � absolutamente segura ou livre de erros. A mensagem pode ser intercetada, alterada, perdida, destru�da, chegar ao destinat�rio com atraso, ou mesmo com v�rus, n�o obstante o IFAP utilizar software anti-v�rus. Esta mensagem, incluindo eventuais ficheiros anexos, pode conter informa��o confidencial ou privilegiada e destina-se a uso exclusivo dos seus destinat�rios. Se n�o for o destinat�rio pretendido, informamos que a recebeu por engano, pelo que, qualquer utiliza��o, distribui��o, reencaminhamento ou outra forma de revela��o a terceiros, impress�o ou c�pia s�o expressamente proibidos. Se recebeu esta mensagem por engano, por favor contacte imediatamente o remetente por e-mail, e apague de imediato a mensagem do seu sistema inform�tico. O IFAP declina qualquer responsabilidade por erros ou omiss�es na presente mensagem e eventuais consequ�ncias, que resultem das situa��es referidas.

2 1

Re: [LMDB] Error 87 followed by MDB_PAGE_NOTFOUND
by Hallvard Breien Furuseth 29 Jan '14

29 Jan '14

On 2014-01-29 23:10, Alain wrote: > On Wed, Jan 29, 2014 at 4:36 PM, Hallvard Breien Furuseth > <h.b.furuseth(a)usit.uio.no> wrote: > >> On 2014-01-29 16:58, Alain wrote: >> >>> While running our app (which seemed to be running slow on this last >>> job), I ended up receiving an rc:87 on a commit, which my app >>> couldn't >>> recover from. I have verified that I have free disk space, free RAM. >> >> Error numbers are OS-dependent. What's errno 87? >> E.g. what does this say: perl -le '$! = 87; print $!' > > I'm running under Windows and have perl only under Cygwin, so not > sure if the results are meaningful, but I get: > $ perl -le '$! = 87; print $!' > Cannot exec a shared library directly Not meaningful, no. Google(windows error 87) says ERROR_INVALID_PARAMETER, which ought to mean a programmer error in your application. If this is code which worked previously, then maybe it lacks error checking. E.g. you're doing mdb_txn_begin() which fails and you use the resulting txn anyway. >> Which LMDB version and operating system do you use? > > I am at commit 5bda356, from 23 days ago and this is running under > Windows 7. > >> If the latest commit was bad, maybe previous one is >> OK. We need to give mdb_copy an option to make a >> backup using the oldest instead of youngest commit. >> Then you'll lose just the last commit instead of >> everything. >> >> That sounds good, as I'm thinking that this is the 2nd copy that >> Howard described during one of his presentation. Yes. -- Hallvard

1 0

[LMDB] Error 87 followed by MDB_PAGE_NOTFOUND
by Alain 29 Jan '14

29 Jan '14

While running our app (which seemed to be running slow on this last job), I ended up receiving an rc:87 on a commit, which my app couldn't recover from. I have verified that I have free disk space, free RAM. Upon restart, after the db was opened, the first process started and quickly reported an MDB_PAGE_NOTFOUND on a call to mdb_cursor_get For your info, here the db info as reported during the restart: Env Stats:{ms_branch_pages=0, ms_psize=4096, ms_depth=1, ms_leaf_pages=1, ms_overflow_pages=0, ms_entries=23} Info:{me_last_pgno=678442, me_mapaddr=0, me_mapsize=4194304000, me_last_txnid=112652, me_maxreaders=300, me_numreaders=0} Data Db Stats:{ms_branch_pages=315, ms_psize=4096, ms_depth=4, ms_leaf_pages=71375, ms_overflow_pages=25, ms_entries=7768832} Primitive Db Stats:{ms_branch_pages=990, ms_psize=4096, ms_depth=4, ms_leaf_pages=183396, ms_overflow_pages=17263, ms_entries=3537190} Incidence Db Stats:{ms_branch_pages=516, ms_psize=4096, ms_depth=4, ms_leaf_pages=86349, ms_overflow_pages=0, ms_entries=11534223} % Full:66.254105% 1- What could have caused this error 87, which seems to be related to some arguments issue? 2- More importantly, what can be done to avoid getting a db in a state like this which seems to me to be corrupted (and that's also what the doc says)? I am keeping the db should it be required for forensic analysis. Thanks Alain

2 1

MDB_BAD_VALSIZE error
by Chris Card 29 Jan '14

29 Jan '14

Hi All, I'm running openldap 2.4.36 on centos 6.3, 64 bit. I'm finally trying out MDB as a replacement for BDB in our openldap setup, and I've noticed that I'm getting MDB_BAD_VALSIZE errors when adding some DNs, which could be added without error when using BDB as the backend: 52e9170b <= mdb_dn2id_add 0x5da55e: -30781 52e9170b mdb_add: dn2id_add failed: MDB_BAD_VALSIZE: Too big key/data, key is empty, or wrong DUPFIXED size (-30781) Looking at the code, it seems that this error happens when MDB_MAXKEYSIZE is exceeded and MDB_MAXKEYSIZE is set to 511 as far as I can see. The DNs which are giving this error are between 232 and 255 characters long. Does the MDB backend have an implicit limit on the length of valid DNs? Can this be increased (by changing MDB_MAXKEYSIZE) and if so, what is the longest DN which can be supported by the MDB backend? Chris

3 5

Ldapdelete
by Borresen, John - 0442 - MITLL 28 Jan '14

28 Jan '14

All, Attempting to backtrack a bit by deleting an overlay using the following (have tried both with & without the escape character with the same error "Invalid DN": # ldapdelete -W -x -ZZ -D cn=admin,cn=config -v -d 9 "olcOverlay=\{0\}syncprov,olcDatabase=\{0\}config,cn=config" And receiving the following error: ... read1msg: ld 0xb749c40 0 new referrals read1msg: mark request completed, ld 0xb749c40 msgid 3 request done: ld 0xb749c40 msgid 3 res_errno: 34, res_error: <invalid DN>, res_matched: <> ldap_free_request (origid 3, msgid 3) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_err2string ldap_delete: Invalid DN syntax (34) additional info: invalid DN ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 3 TLS trace: SSL3 alert write:warning:close notify ldap_free_connection: actually freed Here is a slapcat of that "olcDatabase". # slapcat -s olcDatabase=\{0\}config,cn=config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: _________________________________= olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 4354a8b6-8a36-4804-81f8-14a8550aef74 creatorsName: cn=config createTimestamp: 20131218155313Z entryCSN: 20131218155313.477459Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20131218155313Z dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 644d3984-d125-446e-aae2-1ddc541f4661 creatorsName: cn=admin,cn=config createTimestamp: 20140121191314Z entryCSN: 20140121191314.076259Z#000000#004#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140121191314Z Thanks in advance John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

1 0

indexing warning considered harmful
by Michael Ströder 28 Jan '14

28 Jan '14

HI! We all know the following messages in syslog (loglevel stats): mdb_equality_candidates: (foo) not indexed At first glance this seems helpful to find indexing issues. But IMO 1. this is somewhat mis-leading. regarding performance tuning and 2. if internal searches are conducted (e.g. by set-based ACLs) the amount of the very same indexing warnings is really annoying and costs performance due to excessive logging. AFAIK a set of search candidates is derived from filter assertions by first searching the indexed attributes. Then the non-indexed assertions are tested but only on the search candidate set. Is this correct? If yes, then indexing an attribute which is present in many entries can lead to large search candidate set even though the amount of final search results are small. Consider the following simple example: (&(objectClass=posixAccount)(uid=foo)) With lots of user accounts this would lead to two search candidate sets, one very large and one with one entry (assuming uid values are unique). Not indexing objectClass would one result in *one* search candidate. So indexing objectClass might not be very wise. What do you think about this? Ciao, Michael.

3 4

slapadd question
by Mundry, Marvin 27 Jan '14

27 Jan '14

hi, when I use slapadd to setup cn=config I get > slapadd: warning, missing attrs entryUUID,entryCSN from entry dn="olcDatabase=bdb,cn=config" warnings (one for each database and overlay that is configured) as soon as I add an olcSyncrepl attribute to "dn: olcDatabase=config,cn=config" should I be worried about these warnings? what I am doing: slapadd -S 1 -bcn=config -l slapd.ldif -F slapd.d/ with slapd.ldif having the following content: dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /usr/local/openldap/var/run/slapd.args olcPidFile: /usr/local/openldap/var/run/slapd.pid dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/local/openldap/libexec/openldap olcModuleload: back_bdb.la dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///usr/local/openldap/etc/openldap/schema/core.ldif dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: frontend dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootDN: cn=admin,cn=config olcRootPW:: e1NTSEF9L1Q1US9ibUl0V3pYRnpOUG9iajdsbk5IVVJmS2E5Ykk= olcSyncrepl: rid=001 provider=ldap://someldapserver/ binddn="cn=acme" credentials=secret bindmethod=simple searchbase="cn=config" type=refreshAndPersist dn: olcDatabase=bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: bdb olcSuffix: dc=my-domain,dc=com olcRootDN: cn=Manager,dc=my-domain,dc=com olcRootPW: secret olcDbDirectory: /usr/local/openldap/var/openldap-data Best regards, Marvin

2 1

Ldap Autofs Connection Issue
by Borresen, John - 0442 - MITLL 27 Jan '14

27 Jan '14

All, Here is an interesting dilemma that we are trying to figure out. server1.example.ldap server2.example.ldap client1.example.ldap All running 2.4.38, this is a test environment. Server1 is a client to itself, server2 is a client to itself, and client1 is a client to server2. client1's LDAP Autofs (in the /etc/nsswitch.conf) is pointing to server2...and it works fine. In the /etc/sysconfig/autofs file on the client (client1) the URI entry indicates: "ldap://server2.example.ldap"; and the /etc/nsswitch.conf file shows "ldap" On both server1 and server2, for now -- because if fails otherwise, the URI in the /etc/sysconfig/autofs shows "ldaps://server1.production.ldap"; and the /etc/nsswitch.conf file shows "ldap". As you can see, the production server is using port 636 (SSL), the test environment is using TLS over port 389. Neither test environment server holds the production certificates, and the production side is not holding the test environment certs. Another interesting tidbit, is all the Automount/NFS servers are NetApp filers and they hold certs for the Production Environment, except one which is a Test Filer (in the Test Environment). Sorry if this sounds like an old "Abbott & Costello" routine from the 30's... If anyone can shed some light on what to look for. That would be great. By the way, permission is not an issue. I can explicitly mount all mountpoints to all three in the test environment. The issue is LDAP and Autofs in the Test environment. Thanks, in advance. -----Original Message----- From: openldap-technical-bounces(a)OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Dieter Klünter Sent: Friday, January 24, 2014 4:09 PM To: openldap-technical(a)openldap.org Subject: Re: Ldap Connection Issue Am Fri, 24 Jan 2014 14:45:25 -0500 schrieb "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu>: > All, > > Very similar issue that Warron was/is having. > > Server1: # ldapsearch -W -x -ZZ -b cn=config -v -D cn=admin,cn=config > Server1: # ldapsearch -W -x -ZZ -H ldap://server2.example.ldap -b > cn=config -v -D cn=admin,cn=config > > These commands work (they returns the dbase as expect & desired), both > servers are clients to themselves and the other server (using > self-signed wildcard certificates) Both ldap.confs are identical, the > one on server1 was used on server2. The URI directive looks like: > > uri ldap://server1.example.ldap ldap://server1.<FQDN> > ldap://server2.example.ldap ldap://server2.<FQDN> > > Server2: > > a) # ldapsearch -W -x -ZZ -b cn=config -v -D cn=admin,cn=config > Fails with: > ldap_initialize( <DEFAULT> ) > ldap_start_tls: Connect error (-11) > > > b) # ldapsearch -W -x -ZZ -H ldap://server2.example.ldap -b > cn=config -v -D cn=admin,cn=config > > ldap_initialize( ldap://server2.example.ldap:389/??base ) > > ldap_start_tls: Connect error (-11) > > > c) # ldapsearch -W -x -ZZ -h ldap://server1.example.ldap -b > cn=config -v -D cn=admin,cn=config > > d) ldap_initialize( ldap://ldap:%2F%2Fserver1.example.ldap) > > e) Could not create LDAP session handle for > URI=ldap://ldap:%2F%2Fgp42-admin4.llan.ll.mit.edu (-9): Bad parameter > to an ldap routine > > There is one other client that like server1 can search the dbase(s) on > both servers (it too is a client of both servers). > > Any ideas at what to look for? read on ldapsearch(1) and distinction of -h and -H parameters. furthermore read on LDAP URL and escape sequences (RFC-4516). -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

1 0

Question about olcServerID
by Philip Colmer 27 Jan '14

27 Jan '14

If I extend my existing OpenLDAP implementation to support N-way multi-master, is it acceptable for the first server to retain an olcServerID of 0 (the default when OpenLDAP gets installed) or do I need to change it to a non-zero value? Probably a stupid question but I thought I better ask before making any changes :-) Thanks. Philip

1 0

Re: SLAPD Proxy and AD backend - Binding by UPN.
by egidiomelissano＠libero.it 25 Jan '14

25 Jan '14

> You can configure dovecot to use any (unique) user record attribute for authentication Could you give me an example, please? Regards, Egidio.

2 1

SLAPD Proxy and AD backend - Binding by UPN.
by egidiomelissano＠libero.it 25 Jan '14

25 Jan '14

Hello everyone. First of all, I'm a newbie in OpenLDAP Server administration (but not in Active Directory). Said that, this is my goal: - set up an LDAP Front End-Server to a AD Back-End Server - and, so far, there are many infos about this. But I wanna do it in an environment where there are many UX services which binding to AD Server, and any service of these needs ldap-client configuration, with insertion and storing of credential for binding. One of these is Dovecot which do ldap-authentication of any user of its by a typical fashion... user: ad_username(a)my.ad psw: ad_username_password Hence, I wish to avoid spreading of AD-binding-credentials gathering this couple of data in just one point of my system: that is, OpenLDAP proxy or SLAPD Front-End. I've already tried to do it. First of all, I got an error at installation stage which gave me crazy and I've not yet solved: i.e, after copy of DB_CONFIG example file to lib directory: root@lamp ~# rm -fr /var/lib/ldap/* && rm -fr /etc/ldap/slapd.d/* && cp /usr/share/slapd/DB_CONFIG /var/lib/ldap/DB_CONFIG when I run: root@lamp ~# slapadd -v -l xdom.ldif+ I get an error like the following: 52e1597b bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (14). Even though DB_CONFING is there and has right permissions... Anyway, I discovered that this issues was not blocking, so I went forward. I populate splap.d: root@lamp ~# slaptest -f /etc/ldap/slapd.conf -F /etc/ldap/slapd.d/ 52e280b2 bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (14). Expect poor performance for suffix "dc=xdom,dc=loc". I gave right permission to directories: root@lamp ~# chown -R openldap:openldap /etc/ldap/slapd.d/ && chown -R openldap:openldap /var/lib/ldap/ and I started LDAP Service: root@lamp ~# service slapd start At this time, I tested OpenLDAP Proxy Server by 5 combinations of ldap request: 1) bypassing OpenLDAP Proxy Server and directly binding AD Server by conventional D.N.: ldapsearch -H ldap://server.my.ad -D "cn=ad_user,ou=ced,dc=my,dc=ad" -w ad_user_password -x -b "ou=ced,dc=my,dc=ad" -LLL "(sAMAccountName=*)" and it works. 2) bypassing OpenLDAP Proxy Server and directly binding AD Server by U.P.N (User Principal Name): ldapsearch -H ldap://server.my.ad -D ad_user(a)my.ad -w ad_user_password -x -b "ou=ced,dc=my,dc=ad" -LLL "(sAMAccountName=*)" and it works. 3) through OpenLDAP Proxy Server without any binding: ldapsearch -x -b "ou=ced,dc=my,dc=ad" -LLL "(sAMAccountName=*)" and it works. 4) through OpenLDAP Proxy Server and binding by conventional D.N.: ldapsearch -D "cn=ad_user,ou=ced,dc=my,dc=ad" -w ad_user_password -x -b "ou=ced,dc=my,dc=ad" -LLL "(sAMAccountName=*)" and it works. 5) through OpenLDAP Proxy Server and binding by U.P.N (User Principal Name): ldapsearch -D ad_user(a)my.ad -w ad_user_password -x -b "ou=ced,dc=my,dc=ad" - LLL "(sAMAccountName=*)" and it DOES NOT works. And it is a very BIG BIG problem for me: I cannot force users to authenticate themselves in Dovecot by complicated and unacceptable (because of comma, equal and space characters) D.N.!!!! I tried to face this issue by Rewriting Overlay, just to discover that these library rewrite BINDDN only after "dnPrettyNormal()" call (making "rewriting- method" useless...) Now, please: help me!!!! What can I do? How can I solve my issue??? And how can I avoid DB_CONFING issue? Regards, Egidio. PS: follow my ldap.conf and slapd.conf ## LDAP.CONF #################################### BASE dc=xdom,dc=loc URI ldap://localhost TLS_CACERT /etc/ssl/certs/ca-certificates.crt ## SLAPD.CONF #################################### include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args logfile /var/log/slapd.log loglevel -1 modulepath /usr/lib/ldap moduleload back_bdb moduleload back_ldap moduleload rwm tool-threads 1 database bdb suffix "dc=xdom,dc=loc" checkpoint 1024 15 rootdn "cn=droot,dc=xdom,dc=loc" rootpw {SSHA}Xhy4Gc0k5DU+gfpbpkv+PJWJ92Itp5rJ Database ldap Suffix "dc=ts,dc=dipvvf,dc=it" Uri "ldap://server.my.ad/ ldap://server2.my.ad/" rebind-as-user idassert-bind bindmethod=simple binddn="cn=email ed. demon,ou=email,ou=virtualization,ou=ced,dc=ts, dc=dipvvf,dc=it" credentials=xxxxxx mode=none idassert-authzFrom "*" overlay rwm rwm-rewriteEngine on rwm-rewriteMap ldap samacc "ldap://vfdc1.ts.dipvvf.it/dc=ts,dc=dipvvf,dc=it?dn? sub?samaccountname=" #"ldap:///dc=ts,dc=dipvvf,dc=it?dn?sub?samaccountname=" rwm-rewriteContext bindDN rwm-rewriteRule "^([^,]+)@[^,]+$" "${samacc($1)}" ":@I"

2 1

Ldap Connection Issue
by Borresen, John - 0442 - MITLL 24 Jan '14

24 Jan '14

All, Very similar issue that Warron was/is having. Server1: # ldapsearch -W -x -ZZ -b cn=config -v -D cn=admin,cn=config Server1: # ldapsearch -W -x -ZZ -H ldap://server2.example.ldap -b cn=config -v -D cn=admin,cn=config These commands work (they returns the dbase as expect & desired), both servers are clients to themselves and the other server (using self-signed wildcard certificates) Both ldap.confs are identical, the one on server1 was used on server2. The URI directive looks like: uri ldap://server1.example.ldap ldap://server1.<FQDN> ldap://server2.example.ldap ldap://server2.<FQDN> Server2: a) # ldapsearch -W -x -ZZ -b cn=config -v -D cn=admin,cn=config Fails with: ldap_initialize( <DEFAULT> ) ldap_start_tls: Connect error (-11) b) # ldapsearch -W -x -ZZ -H ldap://server2.example.ldap -b cn=config -v -D cn=admin,cn=config ldap_initialize( ldap://server2.example.ldap:389/??base ) ldap_start_tls: Connect error (-11) c) # ldapsearch -W -x -ZZ -h ldap://server1.example.ldap -b cn=config -v -D cn=admin,cn=config d) ldap_initialize( ldap://ldap:%2F%2Fserver1.example.ldap) e) Could not create LDAP session handle for URI=ldap://ldap:%2F%2Fgp42-admin4.llan.ll.mit.edu (-9): Bad parameter to an ldap routine There is one other client that like server1 can search the dbase(s) on both servers (it too is a client of both servers). Any ideas at what to look for? thanks in advance John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

2 2

LMDB as separate library
by Jan Staněk 24 Jan '14

24 Jan '14

Hello, I'm trying to package LMDB for Fedora as possible system-wide replacement for Oracle's BerkeleyDB. The main trouble is that in current state the LMDB builds an unversioned liblmdb.so, although having a option to link the binaries dynamically without patching the Makefile would be also nice. I want to ask, are there any intentions to release the LMDB as separable library (with versioned soname, etc.)? Thanks in advance, Jan -- Jan Stanek - Red Hat Associate Developer Engineer - Databases Team

2 1

ldap_bind: Invalid credentials (49)
by W Forum W 24 Jan '14

24 Jan '14

Hi, I try to add the samba.schema in my openldap server (Debian Wheezy), default installed. slapd: 2.4.31 ldap-utils 2.4.31 I followed this tutorial https://help.ubuntu.com/10.04/serverguide/samba-ldap.html I can use ldapsearch, ldapadd and ldapmodify with my cn=admin,dc=example,dc=com password but when I try to add the new schema to the directory with ldapadd -x -D cn=admin,cn=config -W -f /tmp/cn\=samba.ldif I get ldap_bind: Invalid credentials (49) Is there a different password for cn=admin,cn=config? I was never asked to create it. And how can I change it if necessary? Many thanks!!!

4 4

Re: ldap_add: Object class violation (65), additional info: attribute 'host' not allowed
by W Forum W 24 Jan '14

24 Jan '14

Hi, Thanks for the quick response I am using Debian wheezy. I installed the ldapns.schema from the deb package but I still when I try to add a user (as a ldif file with a host attribute defined) a get the error ldap_add: Object class violation (65) additional info: attribute 'host' not allowed If I remove the host attribute (from ldif file) the user is added successfully. How can I get the host attribute working? Many thanks On 01/20/2014 05:43 PM, Joshua Schaeffer wrote: > There is some information from the Debian wiki > (https://wiki.debian.org/LDAP/PAM) on adding a host attribute to a > user, but I'm sure it applies to other distro's as well: > > To add the "host" attribute to a user, he should have an objectClass > that supports this. The "account" objectClass has the attribute, but > is not compatible with the "inetOrgPerson" objectClass. To work around > this, you can use the "ldapns" schema, supplied with the libpam-ldap > <http://packages.debian.org/libpam-ldap> package. This schema provides > the "hostObject" objectClass, which has the proper "host" attribute. > > > On Mon, Jan 20, 2014 at 9:08 AM, W Forum W <wforumw(a)gmail.com > <mailto:wforumw@gmail.com>> wrote: > > Hi > I try to add a user but the host attribute is not accept > (everything else is fine) > > ldapadd -x -W -D "cn=admin,dc=example,dc=com" -f user.ldif > Enter LDAP Password: > adding new entry "uid=user,ou=Users,dc=example,dc=comt" > ldap_add: Object class violation (65) > additional info: attribute 'host' not allowed > > how can i add a host attribute > i have following schema installed > > core.schema > cosine.schema > nis.schema > inetorgperson.schema > samba.schema > > thanks in advance > >

2 1

providing a default value for an attribute (w/ translucent proxy)
by Dan Pritts 23 Jan '14

23 Jan '14

Hi all - I've got a familiar story, I'm sure. I have a campus-wide AD infrastructure that I'd like to leverage. Unfortunately, my LDAP client (an Isilon NAS) requires some attributes that AD doesn't populate. e.g., homeDirectory. As it turns out, the silly thing doesn't even use these values, at least not for our use case. But the entire lookup fails if it doesn't get something back for those attributes. I presumably can use a translucent proxy to set these attributes locally. I tested this successfully. Ideally, though, instead of creating DNs for each person on the translucent proxy server, I'd like to just have slapd fill in a default value for these attributes when they are empty. I would also be happy with a method that just overwrites the existing attribute, regardless of whether it exists. Again, for ALL DNs... I don't want to create each account individually in both places. I thought maybe the rewrite overlay would allow this but it seems like I was incorrect (please advise if it can be done). I have poked around and found no other way to do this. Am I missing something? thanks -- Dan Pritts ICPSR Computing & Network Services University of Michigan +1 (734)615-7362

2 2

Re: Implementing PPolicy
by Dieter Klünter 23 Jan '14

23 Jan '14

Am Wed, 22 Jan 2014 18:14:22 -0700 schrieb Joshua Schaeffer <jschaeffer0922(a)gmail.com>: > Just now getting back to this. I ran the daemon in debug mode, then > ran the passwd utility on a different server for my uid (got the same > results as before and then terminated the daemon) and it output a lot > on the acl's. I attached the full log file. Below is the tail end of > the log: > > =================================================== > 52e068f8 <= acl_mask: [3] mask: read(=rscxd) > 52e068f8 => slap_access_allowed: read access granted by read(=rscxd) > 52e068f8 => access_allowed: read access granted by read(=rscxd) > 52e068f8 => access_allowed: result not in cache (userPassword) > 52e068f8 => access_allowed: read access to > "uid=jschaeffer,ou=People,dc=harmonywave,dc=com" "userPassword" > requested 52e068f8 => acl_get: [1] attr userPassword > 52e068f8 => acl_mask: access to entry > "uid=jschaeffer,ou=People,dc=harmonywave,dc=com", attr "userPassword" > requested > 52e068f8 => acl_mask: to value by "", (=0) > 52e068f8 <= check a_dn_pat: self > 52e068f8 <= check a_dn_pat: anonymous > 52e068f8 <= acl_mask: [2] applying auth(=xd) (stop) > 52e068f8 <= acl_mask: [2] mask: auth(=xd) > 52e068f8 => slap_access_allowed: read access denied by auth(=xd) > 52e068f8 => access_allowed: no more rules > 52e068f8 send_search_entry: conn 1000 access to attribute > userPassword, value #0 not allowed > 52e068fb => bdb_entry_get: found entry: > "uid=jschaeffer,ou=people,dc=harmonywave,dc=com" > 52e068fb => bdb_entry_get: found entry: > "cn=default,ou=policies,dc=harmonywave,dc=com" > 52e068fb => access_allowed: result not in cache (userPassword) > 52e068fb => access_allowed: auth access to > "uid=jschaeffer,ou=People,dc=harmonywave,dc=com" "userPassword" > requested 52e068fb => acl_get: [1] attr userPassword > 52e068fb => acl_mask: access to entry > "uid=jschaeffer,ou=People,dc=harmonywave,dc=com", attr "userPassword" > requested > 52e068fb => acl_mask: to value by "", (=0) > 52e068fb <= check a_dn_pat: self > 52e068fb <= check a_dn_pat: anonymous > 52e068fb <= acl_mask: [2] applying auth(=xd) (stop) > 52e068fb <= acl_mask: [2] mask: auth(=xd) > 52e068fb => slap_access_allowed: auth access granted by auth(=xd) [...] There is an anonymous trying to read a userPassword (and probably trying to modifying it afterwards). Acording to your access rules only auth permissions are granted to anonymous. -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

2 1

Access of entryUUID in an overlay module
by Alexander Kläser 23 Jan '14

23 Jan '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear all, I am new to OpenLDAP. In order to process transactions in a separate piece of software, I am parsing the output of a slightly modified version of the auditlog overlay module. As I need to know the entryUUID of a modified LDAP object, I tried to query it and write it along with the other information into the auditlog file. My current patch seems to navigate slapd into a deadlock situation. I do not understand the reason for that and would be very happy if someone may help to point me into the correct direction for implementing this. Here is my patch that I am working with, so far: ==================== - --- ./servers/slapd/overlays/auditlog.c.orig 2014-01-09 12:26:22.060000000 -0500 +++ ./servers/slapd/overlays/auditlog.c 2014-01-17 11:13:34.624000000 - -0500 @@ -24,6 +24,7 @@ #ifdef SLAPD_OVER_AUDITLOG #include <stdio.h> +#include <time.h> #include <ac/string.h> #include <ac/ctype.h> @@ -74,8 +75,13 @@ Modifications *m; struct berval *b, *who = NULL, peername; char *what, *whatm, *suffix; - - time_t stamp; + struct timeval stamp; int i; + int rc; + Entry *e = NULL; + Attribute *a_entryUUID; + char *entryUUID = "NULL"; + BackendInfo *bi = op->o_bd->bd_info; if ( rs->sr_err != LDAP_SUCCESS ) return SLAP_CB_CONTINUE; @@ -119,6 +125,16 @@ if ( !who ) who = &op->o_dn; + /* get the entryUUID */ + //rc = overlay_entry_get_ov( op, &op->o_req_ndn, NULL, NULL, 0, &e, on ); + op->o_bd->bd_info = (BackendInfo *)on->on_info; + rc = be_entry_get_rw( op, &op->o_req_ndn, NULL, NULL, 0, &e ); + op->o_bd->bd_info = bi; + if ( rc == LDAP_SUCCESS ) { + a_entryUUID = attr_find( e->e_attrs, slap_schema.si_ad_entryUUID ); + entryUUID = a_entryUUID->a_vals[0].bv_val; + } + peername = op->o_conn->c_peer_name; ldap_pvt_thread_mutex_lock(&ad->ad_mutex); if((f = fopen(ad->ad_logfile, "a")) == NULL) { @@ -126,9 +142,11 @@ return SLAP_CB_CONTINUE; } - - stamp = slap_get_time(); - - fprintf(f, "# %s %ld %s%s%s %s conn=%ld\n", - - what, (long)stamp, suffix, who ? " " : "", who ? who->bv_val : "", + gettimeofday(&stamp, NULL); + fprintf(f, "# %s %ld.%06ld %s %s%s%s %s conn=%ld\n", + what, stamp.tv_sec, stamp.tv_usec, + entryUUID, + suffix, who ? " " : "", who ? who->bv_val : "", peername.bv_val ? peername.bv_val: "", op->o_conn->c_connid); if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) && @@ -176,7 +194,7 @@ break; } - - fprintf(f, "# end %s %ld\n\n", what, (long)stamp); + fprintf(f, "# end %s %ld.%06ld\n\n", what, stamp.tv_sec, stamp.tv_usec); fclose(f); ldap_pvt_thread_mutex_unlock(&ad->ad_mutex); ==================== thanks so much in advance Alex - -- Dr. Alexander Kläser Open Source Software Engineer Univention GmbH be open. Mary-Somerville-Str.1 28359 Bremen Tel. : +49 421 22232-59 Fax : +49 421 22232-99 klaeser(a)univention.de http://www.univention.de Geschäftsführer: Peter H. Ganten HRB 20755 Amtsgericht Bremen Steuer-Nr.: 71-597-02876 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlLZWZkACgkQgX5Q1Nb/qB0VSACfanVbcP79n3gEnH0zivWSThGA dxUAnj+2NaKhLweCFjFMtGoHPdHzByQZ =DHYq -----END PGP SIGNATURE-----

2 3

Re: N-Way Multi-Master
by Quanah Gibson-Mount 23 Jan '14

23 Jan '14

--On Wednesday, January 22, 2014 9:40 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Anyway, setting up (or attempting) an N-way Multi-Master (in the end will > be 3-way Multi-Master -- the below is only a 2-Way). Been reading the > man pages, and the procedure(s) in section 18.3.3 in the "24 Admin > Guide", etc. OpenLDAP version you are using? > Currently, have two servers (going to build one more) to play with. You could slapcat cn=config and manually fix the ldif output and then reload it if you aren't able to modify it. Personally, I avoid configuring cn=config for MMR, and instead focus on MMR for the actual databases. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 2

RE: N-Way Multi-Master
by Quanah Gibson-Mount 22 Jan '14

22 Jan '14

--On Wednesday, January 22, 2014 4:56 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > I was not able to get slapcat to work, so, thankfully being a test > environment, it was easy to back step and recreate the slapd.d. > > Now, rereading the Admin Guide...years ago, on our production environment > I did this wrong and trying to correct in our test environment before > rolling it out; but, it was my intent to create MMR but only ended up > creating a Delta-syncrepl. > > Am I mistaken, or do I on each server in the MMR configuration need to > create an accesslog? Looking at the script that Quanah sent, it appears > that it is what's going on. If you are going to set up delta-syncrepl based MMR, then yes, the accesslog db must exist on each master. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

RE: N-Way Multi-Master
by Quanah Gibson-Mount 22 Jan '14

22 Jan '14

--On Wednesday, January 22, 2014 2:00 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Thanks Quanah...I was wondering about that (both points --> slapcat and > only focusing on the actual dbases in MMR), too. > > I will attempt that (slapcat)...first. You might find this script useful as well: <https://github.com/Zimbra-Community/zimbra-sources/blob/master/main/ZimbraS…> --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

openldap.org down?
by Patrick Lists 22 Jan '14

22 Jan '14

Hi, I wanted to check if 2.4.39 had been released yet but the website does not seem to work. I only seen "Connecting" followed by "Connected" and then nothing. Regards, Patrick

2 3

RE: Antw: Adding attributes to cn=config
by Borresen, John - 0442 - MITLL 22 Jan '14

22 Jan '14

Thanks, I should've caught that. Going too fast and not enough coffee. -----Original Message----- From: Ulrich Windl [mailto:Ulrich.Windl@rz.uni-regensburg.de] Sent: Wednesday, January 22, 2014 3:02 AM To: Borresen, John - 0442 - MITLL Subject: Antw: Adding attributes to cn=config >>> "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> schrieb >>> am 21.01.2014 um 17:38 in Nachricht <201401211638.s0LGccwE074678(a)boole.openldap.org>: > Ok, > > Trying to add the following: > > objectClass: olcGlobal --> this is the objectClass on another server > that has SSL already set up. > dn: cn=config > changetype: add > olcTLSCipherSuite: HIGH:MEDIUM+TLSv1+SSLv3 > olcTLSCertificateFile: /usr/local/openldap/etc/openldap/CA/cacert.pem > olcTLSCertificateKeyFile: > /usr/local/openldap/etc/openldap/CA/private/cakey.pem > adding new entry "cn=config" > ldapmodify: Object class violation (65) > additional info: no objectClass attribute > > I've read the various manpages that deal with ldif formats, > ldapmodify, ldapadd, etc and been googling too. > > What am I missing? You want to "modify" cn=config, not "add" it. You want to "add" atributes. I'm surprised that someone with a "mit.edu" adress has such primitive problems ;-) Ulrich > > Thanks in advance. > > John D. Borresen (Dave) > Linux/Unix Systems Administrator > MIT Lincoln Laboratory > Surveillance Systems Group > 244 Wood St > Lexington, MA 02420 > Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

1 0

N-Way Multi-Master
by Borresen, John - 0442 - MITLL 22 Jan '14

22 Jan '14

***NOTE: Btw, I can't get to the openldap.org site, this morning. Receiving a "Bad Response" Anyway, setting up (or attempting) an N-way Multi-Master (in the end will be 3-way Multi-Master -- the below is only a 2-Way). Been reading the man pages, and the procedure(s) in section 18.3.3 in the "24 Admin Guide", etc. Currently, have two servers (going to build one more) to play with. (1) [root@<client_of_server2> openldap]# ldapsearch -W -x -H "ldap://<server2>.example.ldap" -ZZ -v -D cn=admin,cn=config -b cn=config olcOverlay={0}syncprov ldap_initialize( ldap://<server2>.example.ldap ) Enter LDAP Password: filter: olcOverlay={0}syncprov requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: olcOverlay={0}syncprov # requesting: ALL # # {0}syncprov, {0}config, config dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcSyncProvConfig olcOverlay: {0}syncprov (2) [root@<server1> openldap]# ldapsearch -W -x -H "ldap://<server1>.example.ldap" -ZZ -v -D cn=admin,cn=config -b cn=config olcOverlay=syncprov ldap_initialize( ldap://<server1>.example.ldap ) Enter LDAP Password: filter: olcOverlay=syncprov requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: olcOverlay=syncprov # requesting: ALL # # {0}syncprov, {0}config, config dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcSyncProvConfig olcOverlay: {0}syncprov (3) [root@<server1> openldap]# ldapsearch -W -x -H "ldap://<server1>.example.ldap" -ZZ -v -D cn=admin,cn=config -b cn=config olcDatabase=config ldap_initialize( ldap://<server1>.example.ldap ) Enter LDAP Password: filter: olcDatabase=config requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: olcDatabase=config # requesting: ALL # # {0}config, config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW: {SSHA}**** olcSyncUseSubentry: FALSE olcMonitoring: FALSE olcSyncrepl: {0}rid=001 provider=ldap://<server1>.example.ldap binddn="cn=co nfig" bindmethod=simple credentials=<password> searchbase="cn=config" type=r efreshAndPersist retry="5 5 300 5" timeout=1 When I attempted to add the olcSyncrepl attribute, I added two "rids" but, somehow it only took one. Now, I can't add a second, nor can I delete the rid=001. With the configuration as it stands, I know it is in a loop. Attempt to add the second rid, again: #Add_LDIF: dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncrepl olcSyncreple: {1}rid=002 provider://<server2>.example.ldap binddn="cn=config" bindmethod=simple credentials=<password> searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 I receive the following error: LDAP error code 53: shadow context; no update referral If I attempt to add an olcUpdateRef, the following error appears: "must appear after syncrepl or updatedn" Even if, what appears to me, I add it after the syncrepl attribute. This is a test configuration...so, back-tracking is not a problem. Just would like to know if the Admin Guide missed a few steps and/or I did and where. Again, right now, the openldap.org site cannot be reached...so, I can't review the manual to see what I may have missed. Thanks in advance; Dave Borresen MIT Lincoln Lab

1 0

Adding attributes to cn=config
by Borresen, John - 0442 - MITLL 21 Jan '14

21 Jan '14

Ok, Trying to add the following: objectClass: olcGlobal --> this is the objectClass on another server that has SSL already set up. dn: cn=config changetype: add olcTLSCipherSuite: HIGH:MEDIUM+TLSv1+SSLv3 olcTLSCertificateFile: /usr/local/openldap/etc/openldap/CA/cacert.pem olcTLSCertificateKeyFile: /usr/local/openldap/etc/openldap/CA/private/cakey.pem adding new entry "cn=config" ldapmodify: Object class violation (65) additional info: no objectClass attribute I've read the various manpages that deal with ldif formats, ldapmodify, ldapadd, etc and been googling too. What am I missing? Thanks in advance. John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

3 6

Implementing PPolicy
by Joshua Schaeffer 21 Jan '14

21 Jan '14

I'm trying implement the password policy overlay into my openldap setup, I'm running a Debian 7 server and installed openldap with the package manager. =================================================== root@baneling:~# dpkg -l | grep slapd ii slapd 2.4.31-1+nmu2 amd64 OpenLDAP server (slapd) =================================================== I currently have my ldap server setup for authentication and authorization, I'm using libnss-ldapd and libpam-ldapd on my other machines to search the ldap directory and would like to implement the password policy provided by the overlay. I believe I've added the schema, loaded thedynamic module, and added the overlay to my databasecorrectly, however I'm not sure it's actually working. I've been mostly followingthis article and the openldap documentation: http://www.zytrax.com/books/ldap/ch6/ppolicy.html http://www.openldap.org/doc/admin24/overlays.html#Password Policies <http://www.openldap.org/doc/admin24/overlays.html#Password%20Policies> Here is my slapd.d config (shortened for brevity): =================================================== root@baneling:~# slapcat -b cn=config [...] dn: cn=module{1},cn=config objectClass: olcModuleList cn: module{1} structuralObjectClass: olcModuleList entryUUID: ad917d22-1583-1033-9e53-473d795f568b creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20140119183138Z olcModuleLoad: {0}ppolicy.so olcModulePath: /usr/lib/ldap entryCSN: 20140119183433.154615Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20140119183433Z [...] dn: cn={4}ppolicy,cn=schema,cn=config objectClass: olcSchemaConfig cn: {4}ppolicy [...] dn: olcOverlay={0}ppolicy,olcDatabase={1}hdb,cn=config objectClass: olcPPolicyConfig olcOverlay: {0}ppolicy olcPPolicyDefault: cn=default,ou=Policies,dc=harmonywave,dc=com olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: TRUE structuralObjectClass: olcPPolicyConfig entryUUID: 3c8dc8ce-158d-1033-9e57-473d795f568b creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20140119194003Z entryCSN: 20140119194003.774030Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20140119194003Z =================================================== And my container for the default policy: =================================================== root@baneling:~# ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b ou=Policies,dc=harmonywave,dc=com SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: ou=Policies,dc=harmonywave,dc=com ou: Policies objectClass: top objectClass: organizationalUnit dn: cn=default,ou=Policies,dc=harmonywave,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAttribute: userPassword pwdAllowUserChange: TRUE pwdExpireWarning: 432000 pwdFailureCountInterval: 1800 pwdGraceAuthNLimit: 10 pwdInHistory: 10 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxAge: 7776000 pwdMaxFailure: 6 pwdMinAge: 86400 pwdMinLength: 10 pwdMustChange: FALSE pwdSafeModify: TRUE sn: passwdpolicy =================================================== However, I'm not sure the policy is actually being applied. I thought it might be because I originally created my user before adding the schema and overlay, so I deleted the user and recreated it. I'm able to log into a server using my uid, however if I try to change my password I get the following: =================================================== jschaeffer@defiler:~$ passwd (current) LDAP Password: New password: Retype new password: password change failed: Constraint violation passwd: Authentication token manipulation error passwd: password unchanged =================================================== I've been entering mycurrent password correctly when it asks and I am using a complex new password. I also don't see any of the ppolicy attributes on my user (pwdChangeTime, pwdFailureTime, pwdGraceUseTime, etc): =================================================== root@baneling:~# ldapsearch -LLL -x -D cn=admin,dc=harmonywave,dc=com -W -H ldapi:/// -b uid=jschaeffer,ou=People,dc=harmonywave,dc=com Enter LDAP Password: dn: uid=jschaeffer,ou=People,dc=harmonywave,dc=com objectClass: top objectClass: account objectClass: posixAccount uid: jschaeffer cn: Joshua Schaeffer uidNumber: 3000 gidNumber: 3000 homeDirectory: /home/jschaeffer loginShell: /bin/bash gecos: Joshua Schaeffer userPassword:: .... =================================================== I've been searching around for on the web for answers to the passwd issue, but I've not been able to find anything useful. Does anyone know how to verify that the ppolicy overlay is actually working?

2 3

re: sudoCommand" limitation
by Juergen.Sprenger＠swisscom.com 21 Jan '14

21 Jan '14

Hi Michel, > Are there any limitations of the "sudoCommand" values? e.g. length <= 64 attributetype ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Command(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) The LDAP definition for the IA5 String syntax is: ( 1.3.6.1.4.1.1466.115.121.1.26 DESC 'IA5 String' ) http://tools.ietf.org/search/rfc4517#section-3.3.15 AFAIK there should be no limitation of length according to rfc4517. Regards Juergen

1 0

LDIF and cn=config
by Côme BERNIGAUD 21 Jan '14

21 Jan '14

Hello, I'm trying to figure out what's happening with my LDAP. I insert an LDIF modifying a schema in cn=schema,cn=config, OpenLDAP gives me an error "No such object", but it still does the modification. How can I do to avoid having this error while the modification is working? I can't just ignore the error because I intend to script this and I need to know if it actually succeeded or not. Please have a look at the log attached to understand my problem. Côme

1 0

"sudoCommand" limitation?
by michel.del-piero＠isc-ejpd.admin.ch 20 Jan '14

20 Jan '14

Hi Are there any limitations of the "sudoCommand" values? e.g. length <= 64 Regards Michel

2 1

RE24 testing call (2.4.39)
by Quanah Gibson-Mount 20 Jan '14

20 Jan '14

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.39 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

5 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical