- openldap-technical - openldap.org

kerberos ldap/host.my.domain
by Friedrich Locke 29 Jun '11

29 Jun '11

Hi folks, i have just installed openldap and i am facing a situation i would like to share with you. In OpenBSD (the OS i am using) i have the keytab file inside /etc/kerberosV. Its access mode is 600, its ownership is root:wheel. But OpenBSD specifies a user and group the slapd daemon should run as; the user is "u" and group "g". In order to get SASL/GSSAPI working i need to add to the keytab the principal ldap/host.my.domain. I did it; now the keytab has the principals host/x.y.z and ldap/x.y.z But since slapd runs as another user it is prevented from accessing the keytab file. So i thought the following possible solutions: 0) Run slapd as root 1) change the permission of the keytab Any of those options above makes security less secure. I known there should be some more approaches, but i cannot think it right now. How did you handle that? Thanks a lot for your time and cooperation. Best regards.

4 3

n-way syncrepl issues
by Marcel van Dorp 29 Jun '11

29 Jun '11

Hi list, I tried to read all information about the subject, both in the mail archives and on the website (admin guide and faq-o-matic), but somehow things are not working as expected. I have 3 servers, Debian 6 with the distro-version of openldap (2.4.23-7). I use phpldapadmin (PLA for short), version 1.2.0.5. I also use ldapvi and the standard ldap-tools (ldapadd/ldapmodify etc). I use the slapd.d/ config backend. My userdata DIT is empty at the moment, until the issues are resolved. *) When using n-way multimaster, I understand that the whole DIT is identical on all servers (assuming full read access for the replication DN, which is the case). Because of this, I used a generic name for the certificates, while on each server the content of the files are server-specific. This works as expected. The other difference between the servers is the slapd startup command line: in it is each server's own FQDN. On debian, this is specified in /etc/default/slapd. On server1 this file has: SLAPD_SERVICES=ldap://127.0.0.1 ldaps://server1.domain.tld ldapi:///" On server2 the URI changes in ldaps://server2.domain.tld and on server3 it changes likewise. This is al per the admin guide. For some reason, replication is not working as expected. Some updates go through, others are ignored and stay local on a server. The servers are on different subnets with a firewall in-between, but I can access each server from the other servers using eg 'ldapsearch'. Question: With n-way multimaster, I understand the DIT should be identical on all servers. Can I just do tar -czf slapd.conf.tgz /etc/ldap/slapd.d on one server, and copy and untar this on the other servers (with slapd stopped) and start slapd? My (anonymized) slapd.d is at the end of this message (I deleted the (default) schema definitions for readability). Question: Is the above-mentioned method a valid way to add/restore an extra n-way multimaster node in the setup? If so, Do I do the export AFTER adding the extra node to the config, or BEFORE? Question: I also want to replicate the dc=domain,dc=tld DIT. Can I use the same rid values in de replication statements as for the cn=config DIT, or do they need to be unique within the total config? Question: I do not like to use the cn=admin,cn=config identity as the replication ID. Yet I do not have content in the dc=domain,dc=tld DIT, and thus no way to specifiy another identity. Can this be solved? Once the DIT has the identity, I assume I can change the replication ID (as long as ACLs are not blocking things). Can anyone answer my questions, or point me in the right direction? I tried numerous things with all kind of different results, but I feel I miss some fundamental insight. Thanks for any help! Marcel -------------------------------------------------------------------- Anonymized slapd.d config of server1 (exported using PLA) -------------------------------------------------------------------- # Server: Server1 (ldap://localhost) # Search Scope: sub # Search Filter: (objectClass=*) # Total Entries: 13 # # Generated by phpLDAPadmin (http://phpldapadmin.sourceforge.net) on June 29, 2011 8:19 am # Version: 1.2.0.5 version: 1 # Entry 1: cn=config dn: cn=config cn: config contextcsn: 20110621205759.540662Z#000000#000#000000 createtimestamp: 20110429201711Z creatorsname: cn=config entrycsn: 20110621205759.540662Z#000000#000#000000 entrydn: cn=config entryuuid: 690a54f4-06e9-1030-9aec-e9c45301ace2 modifiersname: cn=admin,cn=config modifytimestamp: 20110621205759Z objectclass: olcGlobal olcargsfile: /var/run/slapd/slapd.args olcloglevel: sync olcloglevel: stats olcloglevel: args olcpidfile: /var/run/slapd/slapd.pid olcserverid: 11 ldaps://server1.domain.tld olcserverid: 12 ldaps://server2.domain.tld olcserverid: 13 ldaps://server3.domain.tld olctlscacertificatefile: /etc/ssl/certs/cacert.org.pem olctlscertificatefile: /etc/ssl/certs/thishost.crt olctlscertificatekeyfile: /etc/ssl/private/thishost.key olctlsverifyclient: NEVER olctoolthreads: 1 structuralobjectclass: olcGlobal subschemasubentry: cn=Subschema # Entry 2: cn=module{0},cn=config dn: cn=module{0},cn=config cn: module{0} createtimestamp: 20110429201711Z creatorsname: cn=admin,cn=config entrycsn: 20110429201711.660046Z#000000#000#000000 entrydn: cn=module{0},cn=config entryuuid: 690b3608-06e9-1030-9af4-e9c45301ace2 modifiersname: cn=admin,cn=config modifytimestamp: 20110429201711Z objectclass: olcModuleList olcmoduleload: {0}back_hdb olcmoduleload: {1}syncprov.la olcmodulepath: /usr/lib/ldap structuralobjectclass: olcModuleList subschemasubentry: cn=Subschema # Entry 3: cn=schema,cn=config ### DELETED default schema definitions for readability # Entry 4: cn={0}core,cn=schema,cn=config ### DELETED default schema definitions for readability # Entry 5: cn={1}cosine,cn=schema,cn=config ### DELETED default schema definitions for readability # Entry 6: cn={2}nis,cn=schema,cn=config ### DELETED default schema definitions for readability # Entry 7: cn={3}inetorgperson,cn=schema,cn=config ### DELETED default schema definitions for readability # Entry 8: olcBackend={0}hdb,cn=config dn: olcBackend={0}hdb,cn=config createtimestamp: 20110429201711Z creatorsname: cn=admin,cn=config entrycsn: 20110429201711.707740Z#000000#000#000000 entrydn: olcBackend={0}hdb,cn=config entryuuid: 69127d0a-06e9-1030-9af5-e9c45301ace2 modifiersname: cn=admin,cn=config modifytimestamp: 20110429201711Z objectclass: olcBackendConfig olcbackend: {0}hdb structuralobjectclass: olcBackendConfig subschemasubentry: cn=Subschema # Entry 9: olcDatabase={-1}frontend,cn=config dn: olcDatabase={-1}frontend,cn=config createtimestamp: 20110429201711Z creatorsname: cn=config entrycsn: 20110429201711.654507Z#000000#000#000000 entrydn: olcDatabase={-1}frontend,cn=config entryuuid: 690a5da0-06e9-1030-9aed-e9c45301ace2 modifiersname: cn=config modifytimestamp: 20110429201711Z objectclass: olcDatabaseConfig objectclass: olcFrontendConfig olcaccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth manage by * break olcaccess: {1}to dn.exact="" by * read olcaccess: {2}to dn.base="cn=Subschema" by * read olcdatabase: {-1}frontend olcsizelimit: 500 structuralobjectclass: olcDatabaseConfig subschemasubentry: cn=Subschema # Entry 10: olcDatabase={0}config,cn=config dn: olcDatabase={0}config,cn=config createtimestamp: 20110429201711Z creatorsname: cn=config entrycsn: 20110619065612.945749Z#000000#000#000000 entrydn: olcDatabase={0}config,cn=config entryuuid: 690a693a-06e9-1030-9aee-e9c45301ace2 modifiersname: cn=admin,cn=config modifytimestamp: 20110619065612Z objectclass: olcDatabaseConfig olcaccess: {0}to * by dn.exact=cn=admin,cn=config read by dn.exact=gidNumber=0+uidNumber=0,cn=pe ercred,cn=external,cn=auth manage by * break olcdatabase: {0}config olcmirrormode: TRUE olcrootdn: cn=admin,cn=config olcrootpw: {SSHA}deletedforsecurityreasons olcsyncrepl: {0}rid=011 provider=ldaps://server1.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="cn=config" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub olcsyncrepl: {1}rid=012 provider=ldaps://server2.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="cn=config" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub olcsyncrepl: {2}rid=013 provider=ldaps://server3.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="cn=config" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub structuralobjectclass: olcDatabaseConfig subschemasubentry: cn=Subschema # Entry 11: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config createtimestamp: 20110512150606Z creatorsname: cn=admin,cn=config entrycsn: 20110522201415.682681Z#000000#000#000000 entrydn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config entryuuid: 1ae3191c-10f5-1030-9102-e14c7638455a modifiersname: cn=admin,cn=config modifytimestamp: 20110522201415Z objectclass: olcOverlayConfig objectclass: olcSyncProvConfig objectclass: top olcoverlay: {0}syncprov olcspcheckpoint: 100 10 structuralobjectclass: olcSyncProvConfig subschemasubentry: cn=Subschema # Entry 12: olcDatabase={1}hdb,cn=config dn: olcDatabase={1}hdb,cn=config createtimestamp: 20110512144416Z creatorsname: cn=admin,cn=config entrycsn: 20110619123128.846982Z#000000#000#000000 entrydn: olcDatabase={1}hdb,cn=config entryuuid: 0e60d5a6-10f2-1030-9d9b-35ce2d01c34c modifiersname: cn=admin,cn=config modifytimestamp: 20110619123128Z objectclass: olcDatabaseConfig objectclass: olcHdbConfig olcaccess: {0}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by dn="cn=admin,cn=config" write by * none olcaccess: {1}to dn.base="" by * read olcaccess: {2}to * by self write by dn="cn=admin,cn=config" write by * read olcdatabase: {1}hdb olcdbcheckpoint: 512 30 olcdbconfig: {0}set_cachesize 0 2097152 0 olcdbconfig: {1}set_lk_max_objects 1500 olcdbconfig: {2}set_lk_max_locks 1500 olcdbconfig: {3}set_lk_max_lockers 1500 olcdbdirectory: /var/lib/ldap/ olcdbindex: objectClass eq olcdbindex: entryCSN eq olcdbindex: entryUUID eq olclastmod: TRUE olcmirrormode: TRUE olcrootdn: cn=admin,cn=config olcrootpw: {SSHA}s1C7GBjdeletedforsecurityreasons olcsuffix: dc=domain,dc=tld olcsyncrepl: {0}rid=011 provider=ldaps://server1.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="dc=domain,dc=tld" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub olcsyncrepl: {1}rid=012 provider=ldaps://server2.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="dc=domain,dc=tld" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub olcsyncrepl: {2}rid=013 provider=ldaps://server3.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="dc=domain,dc=tld" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub structuralobjectclass: olcHdbConfig subschemasubentry: cn=Subschema # Entry 13: olcOverlay={0}syncprov,olcDatabase={1}hdb,cn=config dn: olcOverlay={0}syncprov,olcDatabase={1}hdb,cn=config createtimestamp: 20110522163658Z creatorsname: cn=admin,cn=config entrycsn: 20110522201502.521704Z#000000#000#000000 entrydn: olcOverlay={0}syncprov,olcDatabase={1}hdb,cn=config entryuuid: 74b70896-18dd-1030-94f4-2183161cb5d6 modifiersname: cn=admin,cn=config modifytimestamp: 20110522201502Z objectclass: olcOverlayConfig objectclass: olcSyncProvConfig objectclass: top olcoverlay: {0}syncprov olcspcheckpoint: 100 10 structuralobjectclass: olcSyncProvConfig subschemasubentry: cn=Subschema

1 0

Sendmail + LDAP
by Vasily Yakovlev 29 Jun '11

29 Jun '11

Hi, I experince some problems with setting up Sendmail with the LDAP database for virtual mail accounts. I believe, that the reason of my problem is in configuring dovecot-deliver, but nobody answers me in the dovecot-mailing list, so i've decided to post a message here What i have: - FreeBSD 8.2-RELEASE - sendmail (Version 8.14.4 with LDAP support installed from ports) - Dovecot LDA + dovecot (as pop3/imap) - 1.2.16 - openldap - 2.4.23 1. Following http://wiki.dovecot.org/LDA/Sendmail i've set up deliver as LDA. Everything worked fine. 2. Following http://wiki.dovecot.org/HowTo/DovecotOpenLdap i've set up Dovecot to work with tha ldap. Now i can authorize through the client or web interface and get to my maildir. 3. Now, i want my sendmail to accept mail for the account in LDAP database. sendmail.mc: ++++++++++++++++++++++ FEATURE(`local_procmail', `/usr/local/libexec/dovecot/deliver',`/usr/local/libexec/dovecot/deliver -d $u') MODIFY_MAILER_FLAGS(`LOCAL', `-f') ...................................... define(`confLDAP_DEFAULT_SPEC', `-h "localhost" -b "dc=mydomain,dc=ru" -d "cn=dovecot,ou=accounts,dc=mydomain,dc=ru" -MLDAP_AUTH_SIMPLE -P /etc/mail/ldap_pass')dnl LDAPROUTE_DOMAIN(`mydomain.ru')dnl FEATURE(`ldap_routing', `null -T<TMPF>', `ldap -1 -T<TMPF> -v mail -k (&(objectclass=posixaccount)(mail=%0))', `passthru')dnl ...................................... MAILER(procmail) ++++++++++++++++++++++ After re-making the sendmail: ++++++++++++++++++++++ [root@test2 /etc/mail]# sendmail -bv -d60.1 test_user(a)mydomain.ru map_lookup(dequote, test) => NOT FOUND (0) map_lookup(host, mydomain.ru) => mydomain.ru. (0) map_lookup(dequote, test_user) => NOT FOUND (0) map_lookup(ldapmra, test_user(a)mydomain.ru) => test_user(a)mydomain.ru (0) map_lookup(ldapmh, test_user(a)mydomain.ru) => NOT FOUND (68) map_lookup(host, mydomain.ru) => mydomain.ru. (0) map_lookup(dequote, test_user) => NOT FOUND (0) map_lookup(virtuser, test_user(a)mydomain.ru) => NOT FOUND (0) map_lookup(virtuser, @mydomain.ru) => NOT FOUND (0) test_user(a)mydomain.ru... User unknown ++++++++++++++++++++++ It's the problem of the local delivery, i believe. Why? Because after sendmail getting an email it passes it to the LDA, which must check the LDAP (not the passwd!) database for the user, to which this email is send to. Are there some possibilities to solve this problem? Or, maybe there might be a problem in cofiguring the OpenLDAP? I appreciate any help... ----------------------- Best regards, Vasily Yakovlev

1 0

SASL working but kerberos DOMAIN is not set
by Friedrich Locke 28 Jun '11

28 Jun '11

I have setted openldap+sasl+kerberos. It is working but the keberos realm is not seted in the bind dn, why? Here is my session: sioux@gustav$ ldapsearch -Y GSSAPI -b "" -s base -LLL supportedSASLMechanisms SASL/GSSAPI authentication started SASL username: sioux(a)UFV.BR SASL SSF: 56 SASL data security layer installed. dn: supportedSASLMechanisms: OTP supportedSASLMechanisms: NTLM supportedSASLMechanisms: GSSAPI supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: CRAM-MD5 sioux@gustav$ Here is what i got from slapd err output : ... ... ... do_bind: dn () SASL mech GSSAPI slap_sasl_getdn: u:id converted to uid=sioux,cn=GSSAPI,cn=auth >>> dnNormalize: <uid=sioux,cn=GSSAPI,cn=auth> <<< dnNormalize: <uid=sioux,cn=gssapi,cn=auth> ==>slap_sasl2dn: converting SASL name uid=sioux,cn=gssapi,cn=auth to a DN <==slap_sasl2dn: Converted SASL name to <nothing> SASL Authorize [conn=1001]: proxy authorization allowed authzDN="" send_ldap_sasl: err=0 len=-1 do_bind: SASL/GSSAPI bind: dn="uid=sioux,cn=gssapi,cn=auth" sasl_ssf=56 send_ldap_response: msgid=3 tag=97 err=0 ber_flush2: 14 bytes to sd 13 ... ... ... Any ideia about what is going on ?

2 1

Re: access
by Friedrich Locke 28 Jun '11

28 Jun '11

Sorry folks, please forgive me, i forgot to let you know i am using kerberos (SASL); so i bind via sasl mechanism not as the dn owned by me. Thanks once more for your help. On Tue, Jun 28, 2011 at 2:05 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, June 28, 2011 10:05 AM -0300 Friedrich Locke > <friedrich.locke(a)gmail.com> wrote: > >> Dear list members, >> >> i would like to use openldap for unix users and group of my local >> network. I started studying openldap access mechanism yesterday; and i >> am a little confused. >> >> I am writing in order to get some help for a single scenario i would >> like to share with you. >> >> My users will be below ou=users,dc=ufv,dc=br. >> >> I would like to write an access rule for the following. >> >> User X had complete access to his/her entry: >> >> cn=X,dc=ufv,dc=br > > by self write > by users read > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

access
by Friedrich Locke 28 Jun '11

28 Jun '11

Dear list members, i would like to use openldap for unix users and group of my local network. I started studying openldap access mechanism yesterday; and i am a little confused. I am writing in order to get some help for a single scenario i would like to share with you. My users will be below ou=users,dc=ufv,dc=br. I would like to write an access rule for the following. User X had complete access to his/her entry: cn=X,dc=ufv,dc=br but only read access for the others entry below dc=ufv,dc=br. How could this access be implemente? Is it possible? Thanks a lot for your time and support. Fried.

2 1

LDAP-Proxy: backend inaccessible via ldaps (w/o proxy no errors)
by Jahnke-Zumbusch, Dirk 27 Jun '11

27 Jun '11

Hi all, I would like to use the proxy features (and as soon as this works for me also some kind of rewriting / mapping) with openldap 2.4.25: ./configure --prefix=/scratch/openldap \ --with-tls=openssl \ --enable-meta \ --enable-ldap \ --enable-rewrite \ --enable-rwm \ --enable-bdb \ --enable-overlays \ --enable-perl \ --enable-shell make install... I may access one LDAP backend via ldap: but not the other (Active Directory) via ldaps: What works fine is 1. ldapsearch for LDAP-Tree-1 / Server-1: ========================================= Direct access to LDAP server: ----------------------------- ldapsearch -x -H ldap://ldap-server-1 -b 'ou=OU1,o=desy,c=de' '(mail=*)' | fgrep num # numResponses: 7 # numEntries: 6 and using the proxy: ----------------------------- ldapsearch -x -H ldap://ldap-proxy -b 'ou=OU1,o=desy,c=de' '(mail=*)' | fgrep num # numResponses: 7 # numEntries: 6 (This tree is rather small.) what is not working is 2. ldapsearch for Active-Directory / Server-2: ============================================== Direct Access to AD-Server ----------------------------- ldapsearch -x -H ldaps://domain-controller \ -D CN=accountname,OU=...,OU=...,OU=...,DC=desy,DC=de \ -W \ -b 'ou=ou1,...,dc=desy,dc=de' \ '(samaccountname=testuser)' | fgrep num Enter LDAP Password: # numResponses: 2 # numEntries: 1 Doing the same via the proxy fails: ----------------------------------- ldapsearch -x -H ldap://ldap-proxy -b 'ou=...,...,dc=desy,dc=de' # extended LDIF # # LDAPv3 # base <ou=...,...,dc=desy,dc=de> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 48 Inappropriate authentication # numResponses: 1 I would like to understand why this fails. slapd.conf is like this ---------- include /scratch/openldap/etc/openldap/schema/core.schema include /scratch/openldap/etc/openldap/schema/cosine.schema include /scratch/openldap/etc/openldap/schema/inetorgperson.schema idletimeout 120 pidfile /scratch/openldap/var/run/slapd.pid argsfile /scratch/openldap/var/run/slapd.args # -- 1st LDAP-backend, the one which works, see 1. above database ldap uri ldap://ldap-server-1:portnumber/ suffix "ou=ouA,o=desy,c=de" # -- 2nd LDAP-/Active-Driectory-backend, that one, which fails database ldap suffix "ou=OU1,...,dc=desy,dc=de" uri ldaps://domain-controller/ acl-bind bindmethod=simple binddn="CN=...,DC=desy,DC=de" credentials=TopSecret idassert-bind bindmethod=simple binddn="CN=...,DC=desy,DC=de" credentials=TopSecret mode=none tls_cacertdir=/etc/pki/tls/certs tls_reqcert=never tls_crlcheck=none idle-timeout 1800 rebind-as-user yes # -- just to make sure for now that I will see everything access to * by * read # === END OF SLAPD.CONF === When I am strace'ing slapd with "-e trace=file -f" I cannot see that any file in tls_cacertdir is read. But I would have expected that. Any directions what I should looking for, now? Kind regards, Dirk -- Dirk Jahnke-Zumbusch Deutsches Elektronen-Synchrotron DESY IT Information Fabrics Member of the Helmholtz Association D-22603 Hamburg Notkestrasse 85 / 22607 Hamburg T: +49-40-899.81760 F: +49-40-899.41760 dirk.jahnke-zumbusch(a)desy.de

1 0

How to perform windows domain authentication with openldap
by Jintao Fang 27 Jun '11

27 Jun '11

I am trying to develop a ldap client with openldap and cyrus-sasl, there is one feature that user can directly sign to the ldap server if he is in a domain. Does anyone have used openldap like this? Thanks a lot.

5 4

back-sql modified queries
by Mark Nienberg 25 Jun '11

25 Jun '11

1 0

ACL caused uidNumber=4294967295 ?
by niko 24 Jun '11

24 Jun '11

Hi,I got weird problem with ldap & samba &sssd。 pdbedit -L showed all users having the same uid (4294967295) ACL : [root@rhel6 slapd.d]# grep -ir "olcAccess" . ./cn=config/olcDatabase={2}monitor.ldif:olcAccess: {0}to * by dn.base="cn=manager,dc=my-domain,dc=com" read by * none ./cn=config/olcDatabase={0}config.ldif:olcAccess: {0}to * by * none ./cn=config/olcDatabase={1}bdb.ldif:olcAccess: to * by * read by self write More specification below： -------------------------------------------------------------------------------------------------------------------------------------------------------- [root@rhel6 cn=config]# pdbedit -L testsmb:4294967295:testsmb *<sometimes, the user testsmb has correct uid 503, I don't know why> *test2:4294967295:test2 test3:4294967295:test3 [root@rhel6 ~]# getent -s sss passwd example:*:9999:9999::/home/example:/bin/sh *<sometimes,we can get user testsmb here>* [root@rhel6 cn=config]# ldapsearch -x -D "cn=root,dc=rhel6,dc=ldaptest,dc=com" -W ........ # testsmb, rhel6.ldaptest.com dn: uid=testsmb,dc=rhel6,dc=ldaptest,dc=com cn: testsmb uid: testsmb uidNumber: 503 loginShell: /bin/bash homeDirectory: /home/testsmb gidNumber: 500 userPassword:: e2NyeXB0fUFPblQvYkJsbEJTWFk= objectClass: posixAccount objectClass: shadowAccount objectClass: person objectClass: sambaSamAccount sambaPwdLastSet: 1308553125 sambaPwdCanChange: 1308553125 sambaNTPassword: 1D82374AB98BB16761B9A4F90441E201 sambaLMPassword: 67E272A0267766A117306D272A9441BB sambaPrimaryGroupSID: 2001 sambaAcctFlags: [U ] shadowLastChange: 15145 gecos: testsmb sn: testsmb sambaSID: S-1-5-21-423381952-115127825-699677302-1004 # test2, rhel6.ldaptest.com Dn: uid=test2,dc=rhel6,dc=ldaptest,dc=com cn: test2 uid: test2 uidNumber: 504 loginShell: /bin/bash homeDirectory: /home/test2 gidNumber: 500 userPassword:: e2NyeXB0fVhSbXVGQUd2cHMublE= objectClass: posixAccount objectClass: shadowAccount objectClass: person objectClass: sambaSamAccount sambaPwdLastSet: 1308557836 sambaPwdCanChange: 1308557836 sambaNTPassword: 1D82374AB98BB16761B9A4F90441E201 sambaLMPassword: 67E272A0267766A117306D272A9441BB sambaPrimaryGroupSID: 2001 sambaAcctFlags: [U ] shadowLastChange: 15145 gecos: test2 sn: test2 sambaSID: S-1-5-21-423381952-115127825-699677302-1005 # example, rhel6.ldaptest.com dn: uid=example,dc=rhel6,dc=ldaptest,dc=com cn: Example user sn: Example user uid: example uidNumber: 9999 gidNumber: 9999 loginShell: /bin/sh homeDirectory: /home/example objectClass: posixAccount objectClass: person userPassword:: KkxLKg== smb.conf security = user passdb backend = ldapsam:ldap://rhel6.ldaptest.com ldap admin dn = "cn=root,dc=rhel6,dc=ldaptest,dc=com" ldap suffix = dc=rhel6,dc=ldaptest,dc=com ldap group suffix = ou=Groups ldap machine suffix = ou=Computers ldap idmap suffix = ou=Idmap ldap ssl = start tls ldap passwd sync = yes Debug info show below slapd debug acl ------------------------------------------------------------------------------------------------------------------------------------ [root@rhel6 ~]# service slapd start Starting slapd: @(#) $OpenLDAP: slapd 2.4.19 (Jun 30 2010 03:56:07) $ mockbuild@x86-003.build.bos.redhat.com:/builddir/build/BUILD/openldap-2.4.19/openldap-2.4.19/build-servers/servers/slapd => access_allowed: search access to "cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={0}corba,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={1}core,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={2}cosine,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={3}duaconf,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={4}dyngroup,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={5}inetorgperson,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={6}java,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={7}misc,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={8}nis,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={9}openldap,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={10}ppolicy,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={11}collective,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={12}samba,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "olcDatabase={-1}frontend,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "olcDatabase={0}config,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) Backend ACL: access to * by * none /etc/openldap/slapd.d: line 1: warning: cannot assess the validity of the ACL scope within backend naming context => access_allowed: search access to "olcDatabase={1}bdb,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) Backend ACL: access to * by * read by self write /etc/openldap/slapd.d: line 1: warning: cannot assess the validity of the ACL scope within backend naming context => access_allowed: search access to "olcDatabase={2}monitor,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) Backend ACL: access to * by dn.base="cn=manager,dc=my-domain,dc=com" read by * none /etc/openldap/slapd.d: line 1: warning: cannot assess the validity of the ACL scope within backend naming context slapd starting * * *debug info for " su - test2"* sssd debug info ------------------------------------------------------------------------------------------------------------------------------------------------------------- (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_parse_entry] (9): OriginalDN: [uid=test2,dc=rhel6,dc=ldaptest,dc=com]. (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_process_result] (8): Trace: sh[0x9e08488], connected[1], ops[0x9ea1b10], ldap[0x9e08540] (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_get_generic_done] (6): Search result: Success(0), (null) (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_get_users_process] (6): Search for users, returned 1 results. (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_process_result] (8): Trace: sh[0x9e08488], connected[1], ops[(nil)], ldap[0x9e08540] (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_process_result] (8): Trace: ldap_result found nothing! (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [ldb] (9): start ldb transaction (nesting: 0) (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_save_user_send] (9): Save user (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_save_user_send] (2): User [test2] filtered out! (id out of range) (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_save_users_process] (2): Failed to store user 0. Ignoring. (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [ldb] (9): commit ldb transaction (nesting: 0) (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_get_users_done] (9): Saving 1 Users - Done (Tue Jun 21 11:02:48 2011) [sssd[nss]] [sbus_remove_timeout] (8): 0x9dcde28 (Tue Jun 21 11:02:48 2011) [sssd[nss]] [sbus_dispatch] (9): dbus conn: 9DCDF38 (Tue Jun 21 11:02:48 2011) [sssd[nss]] [sbus_dispatch] (9): Dispatching. (Tue Jun 21 11:02:48 2011) [sssd[nss]] [sss_dp_get_reply] (4): Got reply (0, 0, Success) from Data Provider (Tue Jun 21 11:02:48 2011) [sssd[nss]] [nss_cmd_getpwnam_callback] (2): No matching domain found for [test2], fail! (Tue Jun 21 11:02:48 2011) [sssd[nss]] [nss_cmd_getpwnam_callback] (2): No results for getpwnam call (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [acctinfo_callback] (4): Request processed. Returned 0,0,Success slapd debug info ----------------------------------------------------------------------------------------------------------------------------------------------------------------- => acl_mask: access to entry "dc=rhel6,dc=ldaptest,dc=com", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: search access granted by read(=rscxd) => access_allowed: search access granted by read(=rscxd) => access_allowed: search access to "dc=rhel6,dc=ldaptest,dc=com" "entry" requested => acl_get: [1] attr entry => acl_mask: access to entry "dc=rhel6,dc=ldaptest,dc=com", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: search access granted by read(=rscxd) => access_allowed: search access granted by read(=rscxd) => access_allowed: search access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "uid" requested => acl_get: [1] attr uid => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "uid" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: search access granted by read(=rscxd) => access_allowed: search access granted by read(=rscxd) => access_allowed: search access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "objectClass" requested => acl_get: [1] attr objectClass => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "objectClass" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: search access granted by read(=rscxd) => access_allowed: search access granted by read(=rscxd) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "entry" requested => acl_get: [1] attr entry => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (cn) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "cn" requested => acl_get: [1] attr cn => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "cn" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (uid) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "uid" requested => acl_get: [1] attr uid => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "uid" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (uidNumber) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "uidNumber" requested => acl_get: [1] attr uidNumber => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "uidNumber" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (loginShell) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "loginShell" requested => acl_get: [1] attr loginShell => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "loginShell" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (homeDirectory) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "homeDirectory" requested => acl_get: [1] attr homeDirectory => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "homeDirectory" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (gidNumber) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "gidNumber" requested => acl_get: [1] attr gidNumber => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "gidNumber" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (userPassword) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "userPassword" requested => acl_get: [1] attr userPassword => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "userPassword" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (objectClass) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "objectClass" requested => acl_get: [1] attr objectClass => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "objectClass" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result was in cache (objectClass) => access_allowed: result was in cache (objectClass) => access_allowed: result was in cache (objectClass) => access_allowed: result not in cache (shadowLastChange) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "shadowLastChange" requested => acl_get: [1] attr shadowLastChange => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "shadowLastChange" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (gecos) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "gecos" requested => acl_get: [1] attr gecos => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "gecos" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (modifyTimestamp) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "modifyTimestamp" requested => acl_get: [1] attr modifyTimestamp => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "modifyTimestamp" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd)

1 0

ppolicy overlay and pwdreset attribute question
by Cyril GROSJEAN 24 Jun '11

24 Jun '11

I use OpenLDAP 2.4.24 with the following default password policy, because I want my users to change their password at first connection, or after a password reset by an administrator: dn: cn=default,ou=policies,dc=company cn: default description: Strategie de gestion des mots de passe par defaut objectClass: top objectClass: person objectClass: pwdPolicy pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 0 pwdFailureCountInterval: 0 pwdGraceAuthNLimit: 0 pwdInHistory: 0 pwdMaxAge: 0 pwdMaxFailure: 0 pwdMinAge: 0 pwdMinLength: 8 pwdMustChange: TRUE pwdSafeModify: FALSE sn: policy When creating a user account (either as administrator or any user with sufficient rights), the pwdReset attribute is not set automatically, and thus, the newly created user can bind and search without being forced to change his password. I have to manually set the pwdReset attribute to TRUE in the user entry at creation time or after creation to force a password change. Is this normal behaviour ? I would have expected to see the pwdReset attribute automatically set (by the ppolicy overlay). Otherwise, setting pwdMustChange to TRUE in the password policy definition looks unuseful. On the contrary, when the user changes his password, the pwdReset attribute is automatically removed, which tends to mean the password policy overlay is called and does something in this case ..

3 5

olcDbCacheSize: no equality matching rule
by Gerard Ranke 24 Jun '11

24 Jun '11

Dear listmembers, After upgrading from openldap 2.4.21 to 2.4.25 my olcDbCacheSize entry seems to have gone awoll. I tried to fix that with the following ldif file: dn: olcDatabase={1}hdb,cn=config changetype:modify add: olcDbCachesize olcDbCachesize: 10000 but I got this errormessage: modifying entry "olcDatabase={1}hdb,cn=config" ldap_modify: Inappropriate matching (18) additional info: modify/add: olcDbCacheSize: no equality matching rule Does anybody have any idea what is wrong? Many thanks in advance, Gerard Ranke

2 1

RE: ppolicy works, then doesn't
by Cyril GROSJEAN 24 Jun '11

24 Jun '11

Do you have any clue (from the access log for example), that this user’s password has been successfully changed after 20110606211056Z ? Or is there any chance that the password was changed while the policy overlay wasn’t loaded, which could occur if it was changed on a misconfigured replica for example.

2 1

N-Way replication
by Darouichi, Aziz 23 Jun '11

23 Jun '11

I setup N-Way replication openldap-2.4.23 in RHEL5. Config file is identical on both servers. In one server I get this error message in the log. send_search_entry: conn 1000 ber write failed. I run slapdindex, and turned off schemasearch. Error message still being generated. Thanks,

2 3

[SOLVED] olcDbCacheSize: no equality matching rule
by Gerard Ranke 23 Jun '11

23 Jun '11

>Dear listmembers, >After upgrading from openldap 2.4.21 to 2.4.25 my olcDbCacheSize entry seems to have gone awoll. I >tried to fix that with the following ldif file: >dn: olcDatabase={1}hdb,cn=config >changetype:modify >add: olcDbCachesize >olcDbCachesize: 10000 >but I got this errormessage: >modifying entry "olcDatabase={1}hdb,cn=config" >ldap_modify: Inappropriate matching (18) > additional info: modify/add: olcDbCacheSize: no equality matching rule Been staring at this for too long: The olcDbCacheSize was sitting right there... Sorry for the noise. Best, gerard

1 0

Schema modification errors
by Marc Elliott 23 Jun '11

23 Jun '11

Hi All, I have a brand new OpenLDAP server installed by Ubuntu and running locally on which I need to alter one of the core schemas to accommodate some legacy data. Unfortunately, I keep getting errors on my modification attempts. (BTW - the LDAP repository is current empty, though schemas have been added to cn=config) The LDIF I've been submitting is: dn: cn=core,cn=schema,cn=config changetype: modify delete: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' ) - add: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a group of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description $ uniqueMember ) ) And the error I get is: #!RESULT ERROR #!CONNECTION ldap://localhost:389 #!DATE 2011-06-21T10:29:02.855 #!ERROR [LDAP: error code 21 - objectclasses: value #0 invalid per syntax] dn: cn=core,cn=schema,cn=config changetype: modify delete: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' ) - add: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a group of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description $ uniqueMember ) ) Any ideas? I'm new to OpenLDAP and usually try to avoid changing standard schema elements so I may be missing something simple. Thanks! Marc

1 0

ppolicy works, then doesn't
by Bidwell, Matt 22 Jun '11

22 Jun '11

I had ppolicy working. Then it stopped. I've cut some stuff for security but I've included some debug info off the ldap server and the ldapsearch + output for that user. Most notably pwdHistory and pwdChangedTime no longer updates. pwdMinLength seems to work, as does pwdCheckQuality. Any ideas why it stopped working or what else I can use to debug? I've recently changed the hash, but it didn't coincide with the date ppolicy stopped working. Matt >From Ldap server debug: acl: internal mod entryCSN: modify access granted acl: internal mod modifiersName: modify access granted acl: internal mod modifyTimestamp: modify access granted bdb_modify_internal: replace userPassword bdb_modify_internal: replace entryCSN bdb_modify_internal: replace modifiersName bdb_modify_internal: replace modifyTimestampca oc_check_required entry (uid=testuser,ou=fte,ou=people), objectClass "posixAccount" oc_check_required entry (uid=testuser,ou=fte,ou=people), objectClass "shadowAccount" oc_check_required entry (uid=testuser,ou=fte,ou=people), objectClass "inetOrgPerson" oc_check_allowed type "roomNumber" oc_check_allowed type "employeeType" oc_check_allowed type "shadowExpire" oc_check_allowed type "homePhone" oc_check_allowed type "givenName" oc_check_allowed type "mobile" oc_check_allowed type "objectClass" oc_check_allowed type "shadowLastChange" oc_check_allowed type "uid" oc_check_allowed type "mail" oc_check_allowed type "uidNumber" oc_check_allowed type "cn" oc_check_allowed type "telephoneNumber" oc_check_allowed type "loginShell" oc_check_allowed type "host" oc_check_allowed type "gidNumber" oc_check_allowed type "gecos" oc_check_allowed type "homeDirectory" oc_check_allowed type "sn" oc_check_allowed type "structuralObjectClass" oc_check_allowed type "entryUUID" oc_check_allowed type "creatorsName" oc_check_allowed type "createTimestamp" oc_check_allowed type "pwdHistory" oc_check_allowed type "pwdChangedTime" oc_check_allowed type "pwdPolicySubentry" oc_check_allowed type "userPassword" oc_check_allowed type "entryCSN" oc_check_allowed type "modifiersName" oc_check_allowed type "modifyTimestamp" Ldapsearch: # testuser, fte, people, dn: uid=testuser,ou=fte,ou=people structuralObjectClass: inetOrgPerson entryUUID: 2c51bca1-1460-4b26-ae20-3c054c861d30 creatorsName: cn=admin createTimestamp: 20110523222307Z pwdHistory: 20110606211017Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}aZlEl1nHU2K pwdHistory: 20110606211045Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}LCJWgHumf2f pwdHistory: 20110606211056Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}toDKXKosvds pwdChangedTime: 20110606211056Z pwdPolicySubentry: cn=default,ou=policies entryCSN: 20110617223036.234028Z#000000#000#000000 modifiersName: uid=testuser,ou=fte,ou=people modifyTimestamp: 20110617223036Z entryDN: uid=testuser,ou=fte,ou=people subschemaSubentry: cn=Subschema hasSubordinates: FALSE # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1

1 1

Schema modification errors
by Marc Elliott 21 Jun '11

21 Jun '11

Hi All, I have a brand new OpenLDAP server installed by Ubuntu and running locally on which I need to alter one of the core schemas to accommodate some legacy data. Unfortunately, I keep getting errors on my modification attempts. (BTW - the LDAP repository is current empty, though schemas have been added to cn=config) The LDIF I've been submitting is: dn: cn=core,cn=schema,cn=config changetype: modify delete: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' ) - add: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a group of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description $ uniqueMember ) ) And the error I get is: #!RESULT ERROR #!CONNECTION ldap://localhost:389 #!DATE 2011-06-21T10:29:02.855 #!ERROR [LDAP: error code 21 - objectclasses: value #0 invalid per syntax] dn: cn=core,cn=schema,cn=config changetype: modify delete: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' ) - add: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a group of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description $ uniqueMember ) ) Any ideas? I'm new to OpenLDAP and usually try to avoid changing standard schema elements so I may be missing something simple. Thanks! Marc

1 0

Re: schema replication problems with test059-slave-config
by Christopher Strider Cook 20 Jun '11

20 Jun '11

I'm assuming that my schema sync config issues are related to the mirrormode configuration I have not working well with the additional sync of the cn=schema,cn=config tree into cn=config,cn=slave. So I'm looking for other ways to have a single authoritative schema source that replicates to all locations. Overview: I have a pair of MirrorMode servers syncing cn=config between themselves. Also on these servers is a cn=config,cn=slave which also sync in a MirrorMode setup. Then there are a number of Consumer servers that syncrepl cn=config,cn=slave with a suffixmassage into their local cn=config databases. Initially, there was a syncrepl on the mirrormode servers that synced cn=schema,cn=config into cn=schema,cn=config,cn=slave. But this is failing (I'm presuming do to a conflict over use of the contextCSN, with the mirrormode syncs) So what are my options for keeping cn=schema,cn=config on the consumers in sync with cn=schema,cn=config on the mirrormode providers? Thanks, Chris

1 0

Password Policy
by Darouichi, Aziz 17 Jun '11

17 Jun '11

Hi, I am trying to institute a password policy in openldap-2.4.23. I would like to hash userPassword: I used "ppolicy_hash_cleartext" This is the policy file: dn: ou=policies,dc=establishment,dc=edu objectClass: top objectClass: organizationalUnit ou: policies dn: cn=default,ou=policies,dc=establishment,dc=edu cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: 2.5.4.35 ppolicy_hash_cleartext pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 Password still shows up in clear txt. Thanks

2 1

experiences creating load-balanced/HA OpenLDAP clusters
by David N. Blank-Edelman 17 Jun '11

17 Jun '11

Hi- I'm in the process of building out our next revision of an OpenLDAP cluster (a master, several slaves, and a load balancer HA pair to distribute the workload to these servers). I was curious if anyone who has done a similar thing with open source software would be willing to share their experiences? I've combed the archives and it seems like the last time this topic came up here was around two years ago. I'm not sure the choices have changed much since then, but just in case I thought I'd ask to get a sense of the current "state of the art". At the moment I'm thinking about either doing a Pacemaker + HAproxy setup or just an updated version of our current ultramonkey setup (LVS + heartbeat + ldirectord). Does anybody have a config they particularly like/dislike? Thanks! -- dNb

2 1

Syncrepl issues, "glue" objectClass
by Mark Cairney 17 Jun '11

17 Jun '11

Hi, I've been trying to use a tool called "Grouper" to provision a hierarchical structure into my LDAP directory. I'm currently running OpenLDAP 2.4.25 with BDB 4.8.30 on 3 SL5.5 servers in a multi-master configuration. During the provisioning process it seems to be hitting a race condition where it creates a higher-level ou before the base-level ou is there resulting in the base-level ou existing in the tree with the "glue" objectClass. As this is invisible to searches I end up with syncrepl constantly trying to replicate it ad infinitum: Jun 10 14:53:16 alder slapd[20702]: syncrepl_entry: rid=031 be_modify ou=2010/2011,ou=courses,ou=grouper,dc=authorise,dc=ed,dc=ac,dc=uk (0) Jun 10 14:53:16 alder slapd[20702]: syncprov_sendresp: cookie= Jun 10 14:53:16 alder slapd[20702]: do_syncrep2: rid=032 cookie= Jun 10 14:53:16 alder slapd[20702]: do_syncrep2: rid=031 cookie= Jun 10 14:53:16 alder slapd[20702]: syncrepl_entry: rid=032 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) Jun 10 14:53:16 alder slapd[20702]: syncrepl_entry: rid=032 be_search (0) Jun 10 14:53:16 alder slapd[20702]: syncrepl_entry: rid=032 ou=2010/2011,ou=courses,ou=grouper,dc=authorise,dc=ed,dc=ac,dc=uk Jun 10 14:53:16 alder slapd[20702]: syncrepl_entry: rid=031 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) Jun 10 14:53:16 alder slapd[20702]: syncrepl_entry: rid=031 be_search (0) Jun 10 14:53:16 alder slapd[20702]: syncrepl_entry: rid=031 ou=2010/2011,ou=courses,ou=grouper,dc=authorise,dc=ed,dc=ac,dc=uk Jun 10 14:53:16 alder slapd[20702]: syncprov_sendresp: cookie= Jun 10 14:53:17 alder last message repeated 210 times Jun 10 14:53:17 alder slapd[20702]: syncrepl_entry: rid=032 be_modify ou=2010/2011,ou=courses,ou=grouper,dc=authorise,dc=ed,dc=ac,dc=uk (0) Jun 10 14:53:17 alder slapd[20702]: do_syncrep2: rid=032 cookie= Jun 10 14:53:17 alder slapd[20702]: syncrepl_entry: rid=032 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) Doing a bit of digging on the web the suggested solution is to modify the object and remove the glue objectlcass but there doesn't seem to be an obvious way to do this given that it's invisible to ldapsearch and if you try an ldapadd the object already exists? Even a sample ldif file for ldapmodify would be grand. Cheers, Mark /********************************* Mark Cairney ITI UNIX Section Information Services University of Edinburgh Tel: 0131 650 6565 Email: mark.cairney(a)ed.ac.uk *********************************/ -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

2 3

allow or deny certain user access to certain hosts
by Hai Tao 17 Jun '11

17 Jun '11

I like to deny certain ldap user from ssh to certain hosts. I wonder how this can be done? Is there a way to associate with the /etc/security/access.conf file with ldap? Thanks. Hai Tao

1 0

Support Reverse Group Membership Maintenance for OpenLDAP 2.3
by Pedro Rodrigo Cardiel 17 Jun '11

17 Jun '11

Hello, I have some doubts about a topic openldap. I am working with groups in ldap and I have the need to ask users of a certain group. I have read that when you ask you can only filter by the field name and the value of this. And there is a way that when you add a user to a group, plus add the field member in the object group, adds a field memberOf to the object person. This is named "Reverse Group Membership Maintenance". I understand that I have to load a module in openldap of this way "moduleload memberof.la" but openldap can not find it. I have seen on the internet there is a package to install that module to the version 2.4. My question is: Does the openfire version 2.3 supports this functionality? I use: Centos Linux ia3 2.6.18-194.32.1.el5 #1 SMP Wed Jan 5 17:53:09 EST 2011 i686 i686 i386 GNU/Linux. Installed Packages Name : openldap Arch : i386 Version : 2.3.43 Release : 12.el5_6.7 Size : 593 k Repo : installed Regards -- ----------------------------------------------------------- Pedro Rodrigo Cardiel Programador Senior GeoSLab Logo C/ Carlos Marx, 6 CP 50015 Zaragoza (Spain) Tlf: +34 976 762134 +34 976 065152 Fax: +34 976 106201 prodrig(a)GeoSLab.com <mailto:suzarso@GeoSLab.com> http://www.GeoSLab.com Follow us on Twitter <http://twitter.com/GeoSLab> ------------------------------------------------------------------------ / Antes de imprimir este correo piensa si realmente es necesario hacerlo / Before printing this email, assess if it is really needed / / ---- ADVERTENCIA ---- La información contenida en este correo electrónico, y en su caso, cualquier fichero anexo al mismo, son de carácter privado y confidencial siendo para uso exclusivo de su destinatario. Si usted no es el destinatario correcto, el empleado o agente responsable de entregar el mensaje al destinatario, o ha recibido esta comunicación por error, le informamos que está totalmente prohibida cualquier divulgación, distribución o reproducción de esta comunicación según la legislación vigente y le rogamos que nos lo notifique inmediatamente, procediendo a su destrucción sin continuar su lectura. / / ---- WARNING ---- Information contained in this email, and any attached files, are private and confidential for the addressee. If you are not the intended recipient, employee or agent responsible for delivering this message to the addressee, or have received this communication by mistake, please be aware that any dissemination, distribution or duplication under current laws is forbidden and we request you to notify us immediately and destroy the message without continue reading. / ------------------------------------------------------------------------

2 1

parse_syncrepl_line: unable to parse "bindmethod=sasl"
by devendra ayalasomayajula 17 Jun '11

17 Jun '11

I am trying to setup mirror mode configuration setup. Attempted to set bindmethod to sasl and I see following error when slapd starts. invalid bind config value bindmethod=sasl /home/y/conf/atlas/slapd_ldapmaster.conf: line 62: Error: parse_syncrepl_line: unable to parse "bindmethod=sasl" . failed to add syncinfo slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. The setups runs fine when bindmethod is set to simple. Appreciate any info on why this is failing. --dev

2 1

slapd is pinned at 100% utilization
by Bryce Powell 17 Jun '11

17 Jun '11

Hi, I have two OpenLDAP 2.4.11 servers, using BDB 4.6.21 (Patches 4.6.21.1 & 4.6.21.2 & 4.6.21.3 applied), hosted on CentOS 5.2, setup for multi-master replication. Works great except that every couple of months either one of the slapd servers will pin the CPU at 100%. Requests continue to be served without any noticeable degradation in response, and no discernable errors in the LDAP logs. I see the forums frequently mention CPU utilization issues, but most of the time this seems to be related to non-indexed queries, which I don't believe is the cause in this case. Restarting slapd resolves the issue, temporarily ... Any suggestions would be appreciated. Regards, Bryce Powell

2 1

schema replication problems with test059-slave-config
by Christopher Strider Cook 16 Jun '11

16 Jun '11

I have a setup based on the one created in test059-slave-config, but complicating matters, the providers are a mirrormode pair. Running 2.4.25 under Debian Squeeze. On this pair I have cn=config,cn=slave created as laid out in test059-slave-config, with additional syncing to allow mirrormode operation. dn: olcDatabase={2}ldif,cn=config objectClass: olcConfig objectClass: olcDatabaseConfig objectClass: olcLdifConfig objectClass: top olcDatabase: {2}ldif olcDbDirectory: /var/lib/ldap-slave-config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth manage by * break olcAccess: {1}to * by dn.base="cn=admin,dc=savagebeast,dc=com" olcAccess: {2}to * by dn.base="cn=repl,dc=savagebeast,dc=com" olcAccess: {3}to dn.base="" by * write olcMirrorMode: TRUE olcRootDN: cn=admin,cn=config,cn=slave olcRootPW: {SHA}xxx olcSuffix: cn=config,cn=slave olcSyncrepl: {0}rid=006 provider=ldaps://guess.savagebeast.com bindmethod=si mple binddn="cn=admin,cn=config" credentials=xxx searchbase="cn=schema,cn =config" schemachecking=off type=refreshAndPersist retry="60 +" suffixmassa ge="cn=schema,cn=config,cn=slave" olcSyncrepl: {1}rid=005 provider=ldaps://who.savagebeast.com bindmethod=simp le binddn="cn=admin,cn=config" credentials=xxx searchbase="cn=schema,cn=c onfig" schemachecking=off type=refreshAndPersist retry="60 +" suffixmassage ="cn=schema,cn=config,cn=slave" olcSyncrepl: {2}rid=007 provider=ldaps://who.savagebeast.com bindmethod=simp le binddn="cn=admin,cn=config,cn=slave" credentials=xxx searchbase="cn=co nfig,cn=slave" schemachecking=on type=refreshAndPersist retry="60 +" olcSyncrepl: {3}rid=008 provider=ldaps://guess.savagebeast.com bindmethod=si mple binddn="cn=admin,cn=config,cn=slave" credentials=xxx searchbase="cn= config,cn=slave" schemachecking=on type=refreshAndPersist retry="60 +" createTimestamp: 20110609185532Z creatorsName: cn=admin,cn=config entryCSN: 20110616183041.867322Z#000000#002#000000 entryDN: olcDatabase={2}ldif,cn=config entryUUID:: Y2JmNTE3MTAtMjcxNS0xMDMwLThkMGYtNWY4MDFiNjU0MGFl modifiersName: cn=admin,cn=config modifyTimestamp: 20110616183041Z structuralObjectClass: olcLdifConfig subschemaSubentry: cn=Subschema {NB: To future google searchers; I originally had this database setup as a HDB. After a week of use, this failed to allow new consumers to sync with it because <ASSUMING> the database ordering dictates how the initial sync is ordered, which normally wouldn't be a problem, but since the cn=config database is interpreted as it's loaded ordering became important. IE: defining a database before the back_ module used was loaded; Moving to the ldif database format seems to provide a consistent top down ordering.} RID 7 and 8 work fine and configurations changes propagate between the Mirrormode providers and the remote consumers. RID 5 and 6 performed the initial sync properly but have since started issuing errors on both masters: Jun 16 12:02:41 who slapd[9589]: do_syncrep2: rid=006 LDAP_RES_SEARCH_RESULT (53) Server is unwilling to perform Jun 16 12:02:41 who slapd[9589]: do_syncrep2: rid=006 (53) Server is unwilling to perform Jun 16 12:02:41 who slapd[9589]: do_syncrepl: rid=006 rc -2 retrying Jun 16 12:02:59 who slapd[9589]: do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT (53) Server is unwilling to perform Jun 16 12:02:59 who slapd[9589]: do_syncrep2: rid=005 (53) Server is unwilling to perform Jun 16 12:02:59 who slapd[9589]: do_syncrepl: rid=005 rc -2 retrying Running in full debug I see errors about the CSN timestamps: ber_dump: buf=0x7fae40019d00 ptr=0x7fae40019dea end=0x7fae40019ded len=3 0000: 00 01 ff ... => get_ctrls: oid="2.16.840.1.113730.3.4.2" (critical) <= get_ctrls: n=2 rc=0 err="" attrs: * + conn=1000 op=1 SRCH base="cn=schema,cn=config" scope=2 deref=0 filter="(objectClass=*)" conn=1000 op=1 SRCH attr=* + send_ldap_result: conn=1000 op=1 p=3 send_ldap_result: err=53 matched="" text="consumer state is newer than provider!" send_ldap_response: msgid=2 tag=101 err=53 ber_flush2: 52 bytes to sd 17 0000: 30 32 02 01 02 65 2d 0a 01 35 04 00 04 26 63 6f 02...e-..5...&co 0010: 6e 73 75 6d 65 72 20 73 74 61 74 65 20 69 73 20 nsumer state is 0020: 6e 65 77 65 72 20 74 68 61 6e 20 70 72 6f 76 69 newer than provi 0030: 64 65 72 21 der! tls_write: want=165, written=165 0000: 17 03 02 00 a0 0b 68 27 f3 13 cc 34 a9 75 cd 8d ......h'...4.u.. 0010: f7 f9 35 d5 b8 4c f5 a8 49 4e e1 fb e2 c5 3b 72 ..5..L..IN....;r 0020: df f8 e0 d2 72 34 1e e3 bd 6e 26 ca 25 8a c1 3e ....r4...n&.%..> 0030: 20 65 e2 56 f5 f4 b0 60 09 a2 eb ab b5 b7 2f e2 e.V...`....../. 0040: 6a bd f3 48 12 c3 59 bb 87 cd 7d bd 99 76 5f 29 j..H..Y...}..v_) 0050: f9 5f 27 d4 09 4f 0e 31 a9 89 b6 33 43 f3 65 ab ._'..O.1...3C.e. 0060: 69 bf a1 19 3c 51 70 52 79 3d a6 d1 39 c7 c1 1d i...<QpRy=..9... 0070: 5c 37 ac 89 a4 82 ed 68 cf f4 1a e4 52 90 20 6b \7.....h....R. k 0080: 51 11 db 0e e2 a4 38 04 17 aa 65 b3 e2 38 5a 1e Q.....8...e..8Z. 0090: 00 15 52 2e 75 2f 05 81 86 a0 41 cd 91 ca 5b 92 ..R.u/....A...[. 00a0: e5 69 bd 41 d6 .i.A. ldap_write: want=52, written=52 0000: 30 32 02 01 02 65 2d 0a 01 35 04 00 04 26 63 6f 02...e-..5...&co 0010: 6e 73 75 6d 65 72 20 73 74 61 74 65 20 69 73 20 nsumer state is 0020: 6e 65 77 65 72 20 74 68 61 6e 20 70 72 6f 76 69 newer than provi 0030: 64 65 72 21 der! read1msg: ld 0x7fae44100d60 msgid 2 all 0 conn=1000 op=1 SEARCH RESULT tag=101 err=53 nentries=0 text=consumer state is newer than provider! ber_get_next tls_read: want=5, got=5 0000: 17 03 02 00 a0 ..... tls_read: want=160, got=160 0000: 0b 68 27 f3 13 cc 34 a9 75 cd 8d f7 f9 35 d5 b8 .h'...4.u....5.. 0010: 4c f5 a8 49 4e e1 fb e2 c5 3b 72 df f8 e0 d2 72 L..IN....;r....r 0020: 34 1e e3 bd 6e 26 ca 25 8a c1 3e 20 65 e2 56 f5 4...n&.%..> e.V. 0030: f4 b0 60 09 a2 eb ab b5 b7 2f e2 6a bd f3 48 12 ..`....../.j..H. 0040: c3 59 bb 87 cd 7d bd 99 76 5f 29 f9 5f 27 d4 09 .Y...}..v_)._'.. 0050: 4f 0e 31 a9 89 b6 33 43 f3 65 ab 69 bf a1 19 3c O.1...3C.e.i...< 0060: 51 70 52 79 3d a6 d1 39 c7 c1 1d 5c 37 ac 89 a4 QpRy=..9...\7... 0070: 82 ed 68 cf f4 1a e4 52 90 20 6b 51 11 db 0e e2 ..h....R. kQ.... 0080: a4 38 04 17 aa 65 b3 e2 38 5a 1e 00 15 52 2e 75 .8...e..8Z...R.u 0090: 2f 05 81 86 a0 41 cd 91 ca 5b 92 e5 69 bd 41 d6 /....A...[..i.A. ldap_read: want=8, got=8 0000: 30 32 02 01 02 65 2d 0a 02...e-. ldap_read: want=44, got=44 0000: 01 35 04 00 04 26 63 6f 6e 73 75 6d 65 72 20 73 .5...&consumer s 0010: 74 61 74 65 20 69 73 20 6e 65 77 65 72 20 74 68 tate is newer th 0020: 61 6e 20 70 72 6f 76 69 64 65 72 21 an provider! ber_get_next: tag 0x30 len 50 contents: ber_dump: buf=0x7fae340013a0 ptr=0x7fae340013a0 end=0x7fae340013d2 len=50 0000: 02 01 02 65 2d 0a 01 35 04 00 04 26 63 6f 6e 73 ...e-..5...&cons 0010: 75 6d 65 72 20 73 74 61 74 65 20 69 73 20 6e 65 umer state is ne 0020: 77 65 72 20 74 68 61 6e 20 70 72 6f 76 69 64 65 wer than provide 0030: 72 21 r! read1msg: ld 0x7fae44100d60 msgid 2 message type search-result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x7fae340013a0 ptr=0x7fae340013a3 end=0x7fae340013d2 len=47 0000: 65 2d 0a 01 35 04 00 04 26 63 6f 6e 73 75 6d 65 e-..5...&consume 0010: 72 20 73 74 61 74 65 20 69 73 20 6e 65 77 65 72 r state is newer 0020: 20 74 68 61 6e 20 70 72 6f 76 69 64 65 72 21 than provider! read1msg: ld 0x7fae44100d60 0 new referrals read1msg: mark request completed, ld 0x7fae44100d60 msgid 2 request done: ld 0x7fae44100d60 msgid 2 res_errno: 53, res_error: <consumer state is newer than provider!>, res_matched: <> ldap_free_request (origid 2, msgid 2) do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x7fae340013a0 ptr=0x7fae340013a3 end=0x7fae340013d2 len=47 0000: 65 2d 0a 01 35 04 00 04 26 63 6f 6e 73 75 6d 65 e-..5...&consume 0010: 72 20 73 74 61 74 65 20 69 73 20 6e 65 77 65 72 r state is newer 0020: 20 74 68 61 6e 20 70 72 6f 76 69 64 65 72 21 than provider! ber_scanf fmt (}) ber: ber_dump: buf=0x7fae340013a0 ptr=0x7fae340013d2 end=0x7fae340013d2 len=0 ldap_err2string do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT (53) Server is unwilling to perform ldap_err2string ldap_err2string do_syncrep2: rid=005 (53) Server is unwilling to perform ldap_err2string ldap_msgfree ldap_free_connection 1 1 ldap_send_unbind Any pointers on where to troubleshoot and resolve this?

2 2

Password Policy
by ldap＠mm.st 14 Jun '11

14 Jun '11

Running RH5 with openldap-2.3.43. We have a script that pulls ssha passwords from a ldap server out of our control. So when a user updates their passwords on that server, the script pulls the password periodically and updates our ldap servers so users can use our ldap servers with posix attributes to authenticate to systems using ldap and pam settings. We need to inactivate accounts after a period of inactivity. We can do this using the shadowInactive attribute in ldap that is based on when the user password expired. So the issue we have is that when the user logs into a system and their accounts are expired they can enter a new password and our ldap servers our updated with the new password, but when the script runs at a later time, the password is reset back to whatever is in the ldap server we pull passwords from. We would like users to not be able to change their password using the password command. We can accomplish this in a few ways including: 1. pam_password_prohibit_message in ldap.conf 2. Just commenting out the ldap module in pam that controls password updates. The problem is that we have a small group of users that are added manually that we would like to be able to change their passwords using the passwd command. The above will impact all users. We are looking for suggestions on how to handle the above. We thought of the following: 1. Use the ppolocy overlay and create a default policy for all users that sets pwdAllowUserChange to no and then create individual policies to that allow certain users to change their pass. In this method, what happens to all the shadow attributes, are they overwridden by the ppolicy. I don't see anything regarding Inactive accounts in ppolicy like the shadowInactive attribute. 2. Could we accomplish this by figuring out a ACL in slapd.conf that only users with a special attribute value are able to write to the userPassword attribute? Any other suggestions?

3 4

Re: Client App and STARTLS auth
by Massimiliano Pala 14 Jun '11

14 Jun '11

Hi Rich, to provide a better vision, I am trying to use openldap to connect to a server and ignoring errors in authentication of the certificates. I am working on a *client*. In particular the code I wrote is like this: ldap_initialize(&ld, url); if(crypto_api == LDAP_CRYPTO_API_OPENSSL) { // This Works.. SSL_CTX *ctx = NULL; ... } else { int opt_val = 0; if(ldap_set_option(ld, LDAP_OPT_X_TLS_NEWCTX, &opt_val) != LDAP_OPT_SUCCESS) { /// ERROR if here (does not happen) } // This works till now opt_val = LDAP_OPT_X_TLS_TRY; if(ldap_set_option(ld, LDAP_OPT_X_TLS_REQUIRE_CERT, &opt_val) != LDAP_OPT_SUCCESS) { if(ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &opt_val) != LDAP_OPT_SUCCESS) { // Error .. } } m_error = ldap_start_tls_s(corePnt->m_ldap, NULL, NULL); ... Note that m_error gets a -11... On the server the output (-d 1) is: connection_get(14): got connid=1007 connection_read(14): checking for input on id=1007 TLS: error: accept - force handshake failure: errno 11 - moznss error -5938 TLS: can't accept: (unknown). I have no clue why this is not working. Another thing which is interesting.. on Ubuntu I tried to change the TLS_CERTREQ option to "allow" ... and the code works - but I can not have it working by using the ldap_set_option().. (on Fedora 14/15 setting the option in the ldap.conf file - in /etc/openldap/ - does not work..). Heeeeeellp!!! :D Cheers, Max On 06/10/2011 10:50 PM, Rich Megginson wrote: > On Fri, Jun 10, 2011 at 4:19 PM, Massimiliano Pala<pala(a)isis.poly.edu> wrote: >> Hi Philip, all, >> >> thanks for the advice. I have changed the code.. and the option is set >> correctly. Question, do you think it is safe to do this as a fallback: >> >> if(ldap_set_option(ld, LDAP_OPT_X_TLS_REQUIRE_CERT,&level) != >> LDAP_OPT_SUCCESS) >> { >> if(ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT,&level) != >> LDAP_OPT_SUCCESS) >> { >> /// Total Failure >> } >> } >> >> Still.. although I set the option, I still get the -11 error when >> trying to bind. > > What -11 error? Client or server? Can you run with -d 1 to get > detailed trace information? > >> >> Is there any other option I have to set to "disable" certificate >> verification for non-openssl crypto api ? >> >> Cheers, >> Max >> >> >> On 06/10/2011 05:23 PM, Philip Guenther wrote: >> [..] >>> >>> Howard has already pointed out that the value must be an LDAP_OPT_X_TLS_* >>> constant and not a string; I just wanted to add that in version 2.3 and >>> earlier, that option (and most of the other TLS options) could only be set >>> globally: ldap_set_option() would fail for them if the first argument >>> wasn't NULL. So, make sure you're building against a current version. >>> >>> >>> Philip Guenther >> >> >> -- >> >> http://member.acm.org/~openca/ >> >> Massimiliano Pala, Ph.D. >> Director, OpenCA Labs >> Professor, NYU Poly >> >> -- http://member.acm.org/~openca/ Massimiliano Pala, Ph.D. Director, OpenCA Labs Professor, NYU Poly

2 3

How to migrate master and keep slave in sync?
by Stefano Zanmarchi 14 Jun '11

14 Jun '11

Hi, we have a 2.4.21 master on Solaris and a syncrepl 2.4.21 slave on Linux, and need to migrate the master to a new platform (Linux) and new version (2.4.21). Of course we need that the syncrepl slave (not managed by us) keeps in sync with the new master. Given that the ip, ports and certificates of the new master will not change, would it be enough to do the following? 1) stop the "old" 2.4.21/Solaris master 2) import its contents (via slapcat and slapadd) into the "new" 2.4.23/Linux (stopped) master 3) start the new 2.4.23/Linux master Thank you very much, Stefano

2 1

Linking Clients - which Crypto API ?
by Massimiliano Pala 14 Jun '11

14 Jun '11

Hi all, I have a little problem. I am implementing an application that uses the OpenLDAP libraries. Until not too much time ago, linking with OpenSSL was sufficiently safe (on almost every Linux distros) and providing my own verification function through the SSL_CTX (by using the ldap_set_option(m_ldap, LDAP_OPT_SERVER_CERTIFICATE, _my_verify)) was easy. Now, Linux distros started to use GnuTLS, NSS, and OpenSSL as the crypto API. My question is: how do I develop an application that when deployed on different systems might need to use functions and data structures from different crypto-api (e.g., when I distribute the binaries of my app) ? How can I retrieve that info *at runtime* (I'd like my binaries to be compatible) ? At least, is there a function that allows me to know which crypto APIs are expected by libldap_r (so that I don't pass in the wrong data structure since it is a (void *)) ? Or at least, is there a way to set/get options so that I would know which API is in use ? Thanks, -- http://member.acm.org/~openca/ Massimiliano Pala, Ph.D. Director, OpenCA Labs Professor, NYU Poly

2 5

OpenLDAp + OpenSSL: decrypt error
by Nguyen, Quoc Khanh 14 Jun '11

14 Jun '11

Hi all, I'm confusing about this problem. Please help... I installed OpenLDAP (2.4.25) with Cyrus SASL (2.1.23) and OpenSSL (0.9.8r). I started LDAP with SSL port: #./slapd -h 'ldaps:///' Everything OK, but when i test uid of OpenLDAP with SASL, i have a problem: root@ftp:/usr/local/sasl2/sbin# ./testsaslauthd -u khanhnq -p 123456 0: NO "authentication failed" I check log and have a message: ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:636 ldap_new_socket: 10 ldap_prepare_socket: 10 ldap_connect_to_host: Trying 127.0.0.1:636 ldap_pvt_connect: fd: 10 tm: 5 async: 0 ldap_ndelay_on: 10 ldap_int_poll: fd: 10 tm: 5 ldap_is_sock_ready: 10 ldap_ndelay_off: 10 ldap_pvt_connect: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 0, subject: /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com, issuer: /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com TLS certificate verification: depth: 0, err: 7, subject: /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com, issuer: /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com TLS certificate verification: Error, certificate signature failure TLS trace: SSL3 alert write:fatal:decrypt error TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:func(144):reason(134) (certificate signature failure). ldap_err2string ldap_unbind ldap_create ldap_url_parse_ext(ldaps://localhost) ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:636 ldap_new_socket: 10 ldap_prepare_socket: 10 ldap_connect_to_host: Trying 127.0.0.1:636 ldap_pvt_connect: fd: 10 tm: 5 async: 0 ldap_ndelay_on: 10 ldap_int_poll: fd: 10 tm: 5 ldap_is_sock_ready: 10 ldap_ndelay_off: 10 ldap_pvt_connect: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 0, subject: /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com, issuer: /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com TLS certificate verification: depth: 0, err: 7, subject: /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com, issuer: /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com TLS certificate verification: Error, certificate signature failure TLS trace: SSL3 alert write:fatal:decrypt error TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:func(144):reason(134) (certificate signature failure). ldap_err2string saslauthd[766] :do_auth : auth failure: [user=khanhnq] [service=imap] [realm=] [mech=ldap] [reason=Unknown] saslauthd[766] :do_request : response: NO What i'm doing wrong? I test OpenSSL using client authenticate and it's work OK. # openssl s_client -connect localhost:636 -state -CAfile /var/myCA/demoCA/cacert.pem -cert /var/myCA/clientcrt.pem -key /var/myCA/clientkey.pem CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL_connect:SSLv3 read server hello A depth=1 /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com verify return:1 depth=0 /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write certificate verify A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL_connect:SSLv3 read server session ticket A SSL_connect:SSLv3 read finished A --- Certificate chain 0 s:/C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com i:/C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com 1 s:/C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com i:/C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com --- Server certificate -----BEGIN CERTIFICATE----- MIICiTCCAfKgAwIBAgIJAMmeK8RVIEWgMA0GCSqGSIb3DQEBBQUAMEgxCzAJBgNV BAYTAlZOMQwwCgYDVQQIEwNIQ00xDDAKBgNVBAoTA1NHVDELMAkGA1UECxMCTlcx EDAOBgNVBAMTB2FiYy5jb20wHhcNMTEwNjEzMDYzMDQ3WhcNMTIwNjEyMDYzMDQ3 WjBIMQswCQYDVQQGEwJWTjEMMAoGA1UECBMDSENNMQwwCgYDVQQKEwNTR1QxCzAJ BgNVBAsTAk5XMRAwDgYDVQQDEwdhYmMuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GN ADCBiQKBgQDEW/sP8n2M7y0LT7ONPZQSnWdOC+E2qyngXaouoKEZauyLkTwWJyQY MkCeGKwQo1KMGd1O04sw5uD2IWgYBfGuynSalyfGfwETGc4Y/xPHV+FpOY5KRssn qzmL5Gso276vIOR4KnjZdm5Msp3WQ2z4aNUkLbMspyBugKP9GgjfAwIDAQABo3sw eTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBD ZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUD7QVqUbn35Jgi1yQdumsHRBdAkswHwYDVR0j BBgwFoAUAdNX4GIDCCQpSpUEfLXJPW74L2IwDQYJKoZIhvcNAQEFBQADgYEAMf8i zRpqasBFf6acpRvGG/AkLU+Cz10ffH6zE3DsoKngxP6zEDFOb1quX+E7RE98W/0T iQPLqS5XLIuLX6BNRjnv79DdyynpwsFVip6pHvDZafWBXrzWVn7WEXy5+VpfjBxe CADHvgvp4LXh7EtvppO1vPyvphCCexsmCIzoxyA= -----END CERTIFICATE----- subject=/C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com issuer=/C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com --- Acceptable client certificate CA names /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com --- SSL handshake has read 2431 bytes and written 1804 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit Secure Renegotiation IS supported Compression: zlib compression Expansion: zlib compression SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: B79630EC32BF14F01931D1EAB3DC0CF7DA29B42E012C8BD8171EEF46D993BB96 Session-ID-ctx: Master-Key: 230F7D9D0736A40EB148CA9091BA0105E6949721E55FD9F84AD057C1CBA38F0A1B2269CAB07E7E71E3310954DDF260BF Key-Arg : None TLS session ticket: 0000 - 07 19 41 07 ec 4c 66 10-24 a0 dd be 02 ff 05 90 ..A..Lf.$....... 0010 - a0 f8 64 d3 08 77 a0 bf-24 81 ad 04 b8 d9 e6 9a ..d..w..$....... 0020 - 04 5a df 4a d5 a1 65 2b-52 4c d4 a2 c2 d6 8b 7f .Z.J..e+RL...... 0030 - fa 66 c7 05 54 58 fa 5d-9a a3 75 82 d0 e8 76 dd .f..TX.]..u...v. 0040 - 4f da 54 ac 8e 40 95 68-7c da 6f 08 7f 52 a3 f6 O.T..@.h|.o..R.. 0050 - c2 bd 44 ff dd 95 b3 0c-e5 9e 16 95 7c c8 6d ee ..D.........|.m. 0060 - 96 03 6b db ae 8c 34 8e-a3 29 87 16 f0 a6 0e 8c ..k...4..)...... 0070 - ac fa c2 76 4a 2d 75 f5-fc b7 1e 83 ec a7 47 0a ...vJ-u.......G. 0080 - 72 50 e8 24 e2 22 34 5f-ff 6a b1 ea f0 cc 2e 55 rP.$."4_.j.....U 0090 - 9f ec ea 1b b5 da 12 70-f4 0c ee 10 5b d0 4e 7a .......p....[.Nz 00a0 - 0d 60 06 70 02 f7 eb a3-f3 79 a7 69 5d c3 61 d3 .`.p.....y.i].a. 00b0 - 51 2a 8a 82 c2 11 70 c9-8b 4f 19 58 50 83 6b 0e Q*....p..O.XP.k. 00c0 - bf 9e aa 6a 8f 72 59 9c-10 da cc 8f 90 05 db e2 ...j.rY......... 00d0 - 08 31 d8 62 1a 24 0d 50-a4 e1 75 e6 ee 49 19 32 .1.b.$.P..u..I.2 00e0 - 1f b6 0e 77 11 42 ce 3a-7e 7e 9c 2b be 59 d4 b4 ...w.B.:~~.+.Y.. 00f0 - 24 36 b0 a5 39 30 9f 3a-49 f7 19 10 73 f1 3e 06 $6..90.:I...s.>. 0100 - b4 04 58 3a 5f 4c 02 29-54 b1 25 c7 2f 06 4a 62 ..X:_L.)T.%./.Jb 0110 - fb 4b 52 82 ea 50 7e 12-0e 8b 5a eb a4 34 77 3c .KR..P~...Z..4w< 0120 - 9f f4 0d 85 0f 43 9a 5d-f1 ba 3e 28 ab 86 98 17 .....C.]..>(.... 0130 - d1 10 49 d2 a6 f3 e7 32-72 62 41 ac 4c 51 4b 05 ..I....2rbA.LQK. 0140 - bd e7 a3 30 cd 47 37 95-f9 76 1d 4a f1 a2 58 b0 ...0.G7..v.J..X. 0150 - 0b a8 ca 4e 4f a1 67 ff-01 3e 11 29 a9 db f1 3e ...NO.g..>.)...> 0160 - 43 64 f8 58 4e d3 44 6f-ee cc 61 6d b3 82 ab 77 Cd.XN.Do..am...w 0170 - e7 3b 6b 83 af b7 42 76-89 e2 e0 d6 8e 66 61 fe .;k...Bv.....fa. 0180 - df 7c d8 28 63 04 22 06-cd 41 28 46 d4 08 00 b4 .|.(c."..A(F.... 0190 - 2b 9e 90 ec ee 9f 8e 34-9b 15 5c 71 e8 29 88 c8 +......4..q.).. 01a0 - 35 4d 88 aa c3 05 53 0a-b8 bd 90 38 68 cf 8b 0b 5M....S....8h... 01b0 - b0 f3 48 c0 02 8a 9f be-05 1b 13 4a 49 67 32 8f ..H........JIg2. 01c0 - 66 f2 41 18 11 f1 eb ed-2a d0 a4 de d9 10 83 95 f.A.....*....... 01d0 - c6 aa 1a 74 83 36 31 db-68 b1 88 37 2b 18 da 6b ...t.61.h..7+..k 01e0 - b9 be 87 36 64 5c a0 b1-23 eb df d9 8f 96 10 ae ...6d..#....... 01f0 - 4e db 3b c2 77 65 a4 11-df 65 a8 26 98 4f df 69 N.;.we...e....... 0210 - f6 93 93 b1 c0 89 65 3a-0d bc 16 e8 f0 5f 9f 5c ......e:....._. 0220 - 8a bc ea 56 b7 e7 d4 75-4c 19 6d 18 73 64 3c 95 ...V...uL.m.sd. 0260 - 78 0d 94 f1 3a 1a 64 35-b5 54 b5 84 76 44 62 b1 x...:.d5.T..vDb. 0270 - 36 5c 1d d6 79 27 6d 1c-3c df bb d2 bf 2c 06 40 6..y'm.

2 2

issue regarding ldap apache authentication in public_html/*
by VIKAS MARWAHA 13 Jun '11

13 Jun '11

hi I need a little help. I am implementing LDAP services in my college. The apache LDAP authentication works fine with any directory viz. /var/www/*/* /home/username/ but it doesn't works with /home/username/public_html/anyfolder/ i.e with a subfolder in public_html. The issue is whenever i write the lines in http.conf the folder stops appearing in the browser. i dont see the folder when i browse http://localhost/~username/foldername i don't see the folder in browser. lines in http.conf file <Directory /home/vikasmarwaha/public_html/private/> Authtype Basic AuthName "Secured Area : Vikas Marwaha's Page : Secured with LDAP : Authorized personal only" AuthBasicProvider ldap AuthzLDAPAuthoritative on AuthLDAPURL "ldap://127.0.0.1:389/ou=People,dc=example,dc=com?uid?" require ldap-user vikasmarwaha </Directory> Please tell me where am i wrong.! this one works perfect.. <Directory /home/vikasmarwaha/> Authtype Basic AuthName "Secured Area : Vikas Marwaha's Page : Secured with LDAP : Authorized personal only" AuthBasicProvider ldap AuthzLDAPAuthoritative on AuthLDAPURL "ldap://127.0.0.1:389/ou=People,dc=example,dc=com?uid?" require ldap-user vikasmarwaha </Directory> but it doesn't satisfies my requirements. Need to secure the subfolder(under public_html -- user's web space.) not the whole user directory. -- Vikas Marwaha http://vikasmarwaha.co.cc Sent via HP Touchsmart powered by Backtrack 5 Linux Technology of Future.

2 1

passwords disappear
by Bidwell, Matt 11 Jun '11

11 Jun '11

If a user changes passwords on and ldap client machine, the shadow entry disappears. This is true for all hash methods except for {CRYPT}. Clearly I would like {SSHA} or {MD5} over {CRYPT}. The client machines are pretty standard RHEL 5 machines. I have exop in the config on the client. Setting the password on the LDAP server works correctly. Running the server in debug didn't make anything jump out at me. Anyone have any ideas? Perhaps I'm missing an ACL I don't know about. Matt

2 1

Client App and STARTLS auth
by Massimiliano Pala 11 Jun '11

11 Jun '11

Hi all, are there examples on how to use STARTLS without requiring that the server's certificate is trusted ? If the crypto api used in the ldap library is OpenSSL, that is easy: - create a new ssl_ctx() with SSL_CTX_new() - set my function as the verify function with SSL_CTX_set_verify() - use the LDAP_OPT_X_TLS_CTX option to point to my new ssl_ctx My problem is: when GnuTLS or NSS crypto libraries are used instead, how do I force the same behavior ? Or, if providing my own function is not possible, how do I force the STARTLS to go on also if it finds non-trusted server/CA certificates ? Thanks, Max -- http://member.acm.org/~openca/ Massimiliano Pala, Ph.D. Director, OpenCA Labs Professor, NYU Poly

4 6

Scaling Syncrepl
by Duncan Idaho 10 Jun '11

10 Jun '11

In my environment I have a need to synchronize from a single master to 125 globally distributed read-only consumers. I've attempted this in two ways and run into problems in either direction. First, I attempted a multi-tier replication strategy where the master would sync to a regional consumer which would in-turn act as a producer for around 20 slaves each. It seems that a server should be able to act as both a producer and a consumer, but in my experience with 2.4.25 this will cause a repeatable segfault within a days time. (test_filter() is passed a NULL filter in syncrepl.c) I think this would probably be the best solution if I could resolve the segfault issue. The other option I've tried is pointing all 125 slaves at a single master. This works if I bring the slaves up gradually, but if they all attempt to connect at once (like after a master restart) the initial sync process seems to monopolize a thread per replica which causes any other searches to fail for a period of greater than 30 seconds. Bumping the threads up to over 125 seems to solve the issue on a test machine but I'm hesitant to do this on the production master which is used heavily for a variety of other purposes. Can anyone offer advice on how I could go about resolving these issues or other methods for successfully replicating to this many slaves? Thanks, Duncan.

2 1

Migrating from RHDS to openldap
by Allgood, John 10 Jun '11

10 Jun '11

Hey Guys We are looking to migrate off our current RHDS environment to openldap. I have searched the internet and have found documentation that migrates to RHDS. RHDS is pretty expensive and we will like to move away from that platform. Has anyone had any experience with doing this type of migration? Any suggestions are welcome. Best Regards John Allgood Sr. Systems Engineer OHL - North American Transportation 2419 West Park Drive SW, Suite 100 Gainesville, GA 30504 Office (800) 532-2239 Ext. 2051 jallgood(a)ohl.com<mailto:jallgood@ohl.com> www.ohl.com<http://www.ohl.com> ______________________________________________________ This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you are not the intended recipient or their designee, please notify the sender immediately by return e-mail and delete all copies.

2 2

phpldapadmin and openldap
by Juan Diego Calle 10 Jun '11

10 Jun '11

Hi, I have being trying to solve this for more than a month. I installed Openldap, Samba, smbldap-tools, and phpmyadmin in a Red Hat 5.6 server. I have many users created with smbldap-tools. Almost everything works, there are 2 things that I need help with. One is with phpldapadmin. I can log with the user administrator, but can not change anything, this is the error in phpldapadmin Could not perform ldap_modify operation. LDAP said: Insufficient access Error number: 0x32 (LDAP_INSUFFICIENT_ACCESS) Description: You do not have sufficient permissions to perform that operation. This error on the log Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 fd=11 ACCEPT from IP=127.0.0.1:59487 (IP=0.0.0.0:389) Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 op=0 BIND dn="uid=Administrator,ou=People,dc=mydomain,dc=com,dc=ec" method=128 Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 op=0 BIND dn="uid=Administrator,ou=People,dc=mydomain,dc=com,dc=ec" mech=SIMPLE ssf=0 Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 op=0 RESULT tag=97 err=0 text= Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 op=1 MOD dn="uid=Administrator,ou=People,dc=mydomain,dc=com,dc=ec" Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 op=1 MOD attr=loginShell Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 op=1 RESULT tag=103 err=50 text= Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 op=2 UNBIND Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 fd=11 closed This is my slapd.conf ############################################ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath /usr/lib64/openldap # Modules available in openldap-servers-overlays RPM package # Module syncprov.la is now statically linked with slapd and there # is no need to load it here # moduleload accesslog.la # moduleload auditlog.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload smbk5pwd.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # modules available in openldap-servers-sql RPM package: # moduleload back_sql.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! #access to * # by self write # by users read # by anonymous auth #access to attrs=userpassword # by self =xw # by anonymous auth by anonymous auth #access to * # by self write # by users read #access to attrs=userpassword by self write by anonymous auth by * none #access to * by self write by users read by anonymous read by * none #access to * by uid=Administrator,ou=People,dc=mydomain,dc=com,dc=ec write #access to dn.regex = "ou = personal_addressbook or =(.+),, dc = korrigan, dc = org" #by dn.regex="cn=$1,ou=Users,dc=korrigan,dc=org" write by dn.regex = "cn = $ 1, ou = Users, dc = korrigan, dc = org" write #by dn="cn=admin,dc=korrigan,dc=org" write by dn = "cn = admin, dc = korrigan, dc = org" write #by * none by * none ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=mydomain,dc=com,dc=ec" rootdn "cn=Manager,dc=mydomain,dc=com,dc=ec" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXX # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM # Extras para ser servidor master de ldap loglevel 256 (I already posted this once) ##########################################3 When i add this line access to * by self write by users read by anonymous read by * none Users are allowed to change their info. I just want a group of users that can change the info of other users, users that have more privileges . I also tried adding a group called miniadmins, it didnt work. dn: cn=MiniAdmins,ou=People,dc=mydomain,dc=com,dc=ec objectClass: groupOfNames objectClass: top cn: MiniAdmins member: uid=jdc,ou=People,dc=mydomain,dc=com,dc=ec member: uid=user2,ou=People,dc=mydomain,dc=com,dc=ec structuralObjectClass: groupOfNames entryUUID: a3e66d90-19b0-1030-9c61-73ebddf12515 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110523174841Z modifyTimestamp: 20110523174841Z entryCSN: 20110523174841Z#000012#00#000000 with the following acl access to * by group/groupOfNames/member="cn=MiniAdmins,ou=People,dc=iess,dc=gob,dc=ec" write Also for the second part I dont know if you are able to do this with openldap: All users are part of dn: cn=Domain Users,ou=Group,dc=mydomain,dc=com,dc=ec. Also this users belong to others groups like city1, city2, city3. In each city there is and admin that has control over that group, example admincity1, admincity2,etc. They can manage users in their respective cities, but they can not change anything on another city. I need help with the slapd.conf, I have a basic understanding, but my logic here is failing. I have found people with similar problems but no answers. Thanks, Juan Diego

2 3

cannot restore db
by Bidwell, Matt 09 Jun '11

09 Jun '11

I'm using both openldap-2.4.24 and db-5.1.25 from source. I was experiencing corrupted entries from the running database. I tried moving the openldap-data folder, created a new one, and tried running slapadd with the -f and -l flags with my conf file and backup ldif. I get back an error that tells me id2entry.bdb can't be opened because it is missing. Isn't slapadd supposed to create id2entry.bdb? The flags I used to configure BDB are --enable-cxx -C, did I miss something? Matt

2 3

retrieving dn via proxy ldap
by Ron Peterson 08 Jun '11

08 Jun '11

Hi, I'm having trouble retrieving the DN, and only the DN, when using the 'ldap' back end to proxy my master directory database. 2656$ ldapsearch -LLL -x -w apass -D "uid=test,ou=admin" -b "ou=test" '(uid=auser)' dn: yDirectoryID=442E65DA-678E-BEB5-3378-56331AEE1AA0,ou=test eduPersonPrimaryAffiliation: staff sn: Peterson ... 2657$ ldapsearch -LLL -x -w apass -D "uid=test,ou=admin" -b "ou=test" '(uid=auser)' 1.1 Why would I not see the DN when asking for just 1.1? TIA -- Ron Peterson Network & Systems Administrator Mount Holyoke College http://www.mtholyoke.edu/~rpeterso

1 1

Setup syncrepl on Redhat Fedora
by Daniel Qian 08 Jun '11

08 Jun '11

Hi, I used to be fine with slapd.conf way but now with slapd.d/ I am kind of lost. From the reading I did so far I have to load the syncprov module but I couldn't find a single document or example how to enable that on Redhat Fedora platform. The following list is all that comes with Redhat distribution: [root@ldaprov1 cn=config]# pwd /etc/openldap/slapd.d/cn=config [root@ldaprov1 cn=config]# ll total 72 drwx------. 2 ldap ldap 4096 Jun 6 02:21 cn=schema -rw-------. 1 ldap ldap 52268 Jun 6 02:21 cn=schema.ldif -rw-------. 1 ldap ldap 572 Jun 6 02:55 olcDatabase={0}config.ldif -rw-------. 1 ldap ldap 1377 Jun 6 02:54 olcDatabase={1}bdb.ldif -rw-------. 1 ldap ldap 525 Jun 6 02:21 olcDatabase={-1}frontend.ldif -rw-------. 1 ldap ldap 556 Jun 6 03:00 olcDatabase={2}monitor.ldif Can anyone point out to me how I can add the module required to do replication on the provider side? I will make a document if I am able to set it up eventually. Thanks, Daniel

8 27

OID orcluser, orcluserv2, orclgroup objectclasses openldap compatability
by Ali Okan YÜKSEL 08 Jun '11

08 Jun '11

oracle identity management has some objectclasses that i need for our openldap directory. (orcluser, orcluserv2, orclgroup) i want to export .schema .ldif files from OID and import them to openldap 2.4? if you have experience about this subject can you guide me? i don't want to use OID anymore but i need these objectclasses for our project, regards, -- http://www.siyahsapka.org

1 0

Schema definitions: from Sun DS to OpenLDAP
by Silvio Verrecchia 08 Jun '11

08 Jun '11

Hello gurus, I'm migrating a Sun DS to Openldap and I've an highly personalized 99user.ldif file with user defined objectclass and attributes (hundreds... :( :( ) Regarding personalized schema definitions, is there a way (script/batch/etc) to convert quickly and easly a Sun DS 99user.ldif file to the standard OpenLDAP schema files ? Any suggestion is highly appreciated ! Thank you very much! Silvano

6 6

How to reply with parent attributes ?
by Aurélien Lafranchise 07 Jun '11

07 Jun '11

Hi all, When I am doing a user search I would like to get an answer with parent attributes. In another way, I would like to get common attribute shared by people from the same group ? Do I have to look in menberOf or in Collective attribute in my schema ? or others ideas ? Thanks ! Aurélien Lafranchise | Consultant Tél. : +33 (0)1 75 43 55 12 | Fax : +33 (0)1 75 43 55 11 www.snype-consulting.com

2 1

Issue with memberof overlay
by sachin mishra 07 Jun '11

07 Jun '11

Hi all, I am facing problem with "memberof" overlay. I have followed following steps for installation on my CentOS release 5.5: env LIBS=-ldb ./configure --enable-overlays [I also tried with env LIBS=-ldb ./configure --enable-memberof] make depend make make install in my slapd.conf file, I have enable memberof overlay: include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/local.schema ... modulepath /usr/local/libexec/openldap moduleload memberof.la ... database bdb suffix "dc=mybrocade,dc=com" rootdn "cn=Manager,dc=xxx,dc=com" rootpw {SSHA}HL8uT5hPaWyIdcP6yAheMT8n0GoWubr3 index objectClass eq overlay memberof When I start slapd (slapd -d -1), it gives these lines in log: line 27 (modulepath /usr/local/libexec/openldap) /usr/local/etc/openldap/slapd.conf: line 27: keyword <modulepath> ignored line 31 (moduleload memberof.la) /usr/local/etc/openldap/slapd.conf: line 31: keyword <moduleload> ignored When I try searching for memberof Attribute, it doesn't return the value: ldapsearch -LL -D cn=Manager,dc=xxx,dc=com -w secret "cn=sachin" -b dc=xxx,dc=com memberOf version: 1 dn: cn=Sachin,cn=Users,dc=xxx,dc=com <there is no entry for memberof> I tried searching for memberof.la but I could not find any instance of it in the system. Am I missing something here? Here is the place, where I have specified the "member" attribute: ldapsearch -LL -D cn=Manager,dc=xxx,dc=com -w ***** "cn=admin" -b dc=xxx,dc=com version: 1 dn: cn=admin,ou=groups,dc=xxx,dc=com objectClass: groupOfNames cn: admin description: Members having admin permission member: cn=sachin,cn=Users,dc=xxx,dc=com Thanks, Sachin

2 1

olcAccess problem
by Aurélien Lafranchise 07 Jun '11

07 Jun '11

Hi, On my olcDatabase={1}bdb,cn=config I added an ACL : {0}to * by dn="cn=user1,dc=truc" write by dn="cn=user2,dc=mbqt" read by * auth I don't understand why I have to add by * auth to allow the two previous users to be logged in ? Thanks Aurélien Lafranchise | Consultant Tél. : +33 (0)1 75 43 55 12 | Fax : +33 (0)1 75 43 55 11 www.snype-consulting.com

2 2

Slapd 2.4 upgrade woes.
by ray klassen 06 Jun '11

06 Jun '11

I recently upgraded to debian squeeze and found that the slapd configuration had been completely revamped. It's now using the cn=config setup. I was authenticating against a locally replicated copy of my directory behind a firewall. I was using anonymous binding for my own purposes and I want to continue using it that way. I don't really want to enter into a prolonged discussion of why I shouldn't. I just want to know if there is a simple way of reconfiguring under the new regime so that it will work the same way it did before. Any Takers?

2 1

Novice problem
by Aurélien Lafranchise 06 Jun '11

06 Jun '11

Hi all, I am a very novice (less than a week) with OpenLDAP and I have some basics problems. First, I have the 2.4.25 version and I downloaded the Admin Guide as a documentation. I understood that the way to configure the server change from slapd.conf to cn=config and this change is not clear by reading the documention. My question is simple, how to create my own DIT without interfering with the default configuration ? The end goal of this server is to have a radius server interrogating the LDAP one to deliver IP address to a GGSN (GPRS équipement). Thanks for the help provided. Aurélien Lafranchise | Consultant Tél. : +33 (0)1 75 43 55 12 | Fax : +33 (0)1 75 43 55 11 www.snype-consulting.com

2 3

Re: Proper values for threads and tool-threads
by Mark 06 Jun '11

06 Jun '11

Does IIRC mean If I Remember Correctly? Each machine has 4 physical CPUs. Each CPU has 6 cores. ( http://ark.intel.com/Product.aspx?id=46491) So that's 24 real cores, correct?. So if I'm understanding you're suggestion: tool-threads = 24 threads <= 96 If I set threads above 32 I get the warning mentioned earlier (I assume YMMV means: Your Mileage May Vary). Should I be concerned? Thank you for replying on a weekend. On Sun, Jun 5, 2011 at 8:26 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Sunday, June 05, 2011 5:41 PM -0500 Mark <mah042(a)gmail.com> wrote: > > I'm setting up a new installation of OpenLDAP 2.4.25 on RHEL machines >> each with 128GB RAM and 4 Intel Xeon E7530 CPUs (6 cores each, each core >> supporting two threads). /proc/cpuinfo shows there are 48 processors. The >> backend hdb database will eventually have millions of records with >> thousands of concurrent readers and writers. Is there a good equation to >> use for determining a value for threads and tool-threads? I'd like to >> take advantage of the hardware available. I get a warning if I set >> threads higher than 32: >> >> olcThreads: value #0: warning, threads=48 larger than twice the default >> (2*16=32); YMMV. >> >> I shouldn't be slapcat'ing and slapadd'ing it very often, but like to set >> tool-threads to an appropriate value for the hardware. >> > > How many real cores do you have? > > Generally tool-threads should be set to that number. > > Generally threads should be set to no more than 4 threads per real core > IIRC (8 is generally good for 1 or 2 cores, 16 for 4 cores, etc). > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Proper values for threads and tool-threads
by Mark 06 Jun '11

06 Jun '11

I'm setting up a new installation of OpenLDAP 2.4.25 on RHEL machines each with 128GB RAM and 4 Intel Xeon E7530 CPUs (6 cores each, each core supporting two threads). /proc/cpuinfo shows there are 48 processors. The backend hdb database will eventually have millions of records with thousands of concurrent readers and writers. Is there a good equation to use for determining a value for threads and tool-threads? I'd like to take advantage of the hardware available. I get a warning if I set threads higher than 32: olcThreads: value #0: warning, threads=48 larger than twice the default (2*16=32); YMMV. I shouldn't be slapcat'ing and slapadd'ing it very often, but like to set tool-threads to an appropriate value for the hardware. Any suggestions? Thank you, Mark

2 1

when use overlay translucent error
by daydayeat 03 Jun '11

03 Jun '11

openldap-2.4.23 man slapo-translucent says: If neither translucent_local nor translucent_remote are specified, the default behavior is to search the remote database with the complete search filter. If only translucent_local is specified, searches will only be run on the local database. Likewise, if only translu- cent_remote is specified, searches will only be run on the remote database. In any case, both the local and remote entries corresponding to a search result will be merged before being returned to the client. but when i test： local proxy conf: ####################################################### # Primary database definitions ####################################################### ###################################################### #databse bdb ##################################################### database bdb suffix "dc=test,dc=com" rootdn "cn=Manager,dc=test,dc=com" rootpw "123456" directory /usr/local/ldap/var/openldap-data index objectClass eq ###################################################### #overlays ###################################################### overlay translucent #translucent_remote street #translucent_local street uri ldap://remote:388 lastmod off idassert-bind bindmethod=simple binddn="cn=Manager,dc=test,dc=com" ###################################################### remote conf: ####################################################### # Primary database definitions ####################################################### database bdb suffix "dc=test,dc=com" rootdn "cn=Manager,dc=ec,dc=com" rootpw "123456" directory "/usr/local/ldap1/var/openldap-data" index objectClass eq ####################################################### remote database have a entry: # 111, GF3, ec.com dn: o=111,o=GF3,dc=test,dc=com objectClass: organization o: 111 street: remote and in the local database change the street value: # 111, GF3, ec.com dn: o=111,o=GF3,dc=test,dc=com objectClass: organization o: 111 street: local then change the value "translucent_remote and translucent_local" in the local proxy conf。Do search in local: 1 set "translucent_local street" "ldapsearch -D "cn=Manager,dc=test,dc=com" -x -w 123456 -b "dc=test,dc=com" street=local" the result is: # extended LDIF # # LDAPv3 # base <dc=test,dc=com> with scope subtree # filter: street=local # requesting: ALL # # 111, GF3, ec.com dn: o=111,o=GF3,dc=ec,dc=com objectClass: organization o: 111 street: local It is right. 2 set "translucent_remote street" "ldapsearch -D "cn=Manager,dc=test,dc=com" -x -w 123456 -b "dc=test,dc=com" street=local" have no result. "ldapsearch -D "cn=Manager,dc=test,dc=com" -x -w 123456 -b "dc=test,dc=com" street=remote" have no result why? 3 do not set any "ldapsearch -D "cn=Manager,dc=test,dc=com" -x -w 123456 -b "dc=test,dc=com" street=local" have no result. "ldapsearch -D "cn=Manager,dc=test,dc=com" -x -w 123456 -b "dc=test,dc=com" street=remote" have no result why?

2 1

Authenticate with smartcard or other certificate
by Thomas Gäbler 03 Jun '11

03 Jun '11

Hi @ all, is it possible, to authenticate with any kind of certificate (smartcard, softwaretoken, ...)? Now, I have the following solution: I have an additional attribute for the serialNumber of the certificate stored in the ldap-entry. If a user will auth with certificate, i search for all entries, where the serial-attribute match. for the matching entries i read the certificate from ldap and check the public key. but for an other implementation i need a possibility to auth directly with certificate. Any idea? Thanks for help! procilon IT-Solutions GmbH Leipziger Stra�e 110 04425 Taucha bei Leipzig tel: +49 34298 4878-10 fax: +49 34298 4878-11 www.procilon.de Sitz der Gesellschaft: Leipziger Stra�e 110, 04425 Taucha bei Leipzig Amtsgericht Leipzig HRB 18003 , Gesch�ftsf�hrer Steffen Scholz Diese E-Mail kann Betriebs- oder Gesch�ftsgeheimnisse oder sonstige vertrauliche Informationen enthalten. Sollten Sie diese E-Mail irrt�mlich erhalten haben, ist Ihnen eine Kenntnisnahme des Inhalts, eine Vervielf�ltigung oder Weitergabe der E-Mail ausdr�cklich untersagt. Bitte benachrichtigen Sie uns und vernichten Sie die empfangene E-Mail. Vielen Dank. This e-mail may contain trade secrets or privileged, undisclosed, or otherwise confidential information. If you have received this e-mail in error, you are hereby notified that any review, copying, or distribution of it is strictly prohibited. Please inform us immediately and destroy the original transmittal. Thank you for your cooperation.

2 1

OpenLDAP search filters
by Anita Luca 03 Jun '11

03 Jun '11

Hello all, I need to replace the standard AD filters with OpenLDAP filters. Basically, I assume that what changes is the value of the property (e.g. objectType=user might become objectType=person or any other value, not sure what OpenLDAP works with). Below the queries on AD: User search filter: (objectClass=user) User attribute: sAMAccountName User browse filter: (|(objectClass=user)(objectClass=organizationalUnit)) Group search filter: (objectClass=group) Group attribute: member Group browse filter: (|(objectClass=group)(objectClass=organizationalUnit)) User member of attribute: memberOf OU search filter: (objectClass=organizationalUnit) Hope you can help with a suggestion, or at least a list of properties and values for objects, where I could search. Thanks, Anita Luca

3 3

ldapsearch and sambaAcctFlags
by Dennis Leeuw 03 Jun '11

03 Jun '11

Hi all, I am using SAMBA with OpenLDAP. And I wanted to find the computer trust accounts within the LDAP tree. These are identified by having the S type set in the sambaAcctFlags field. In LDIF format this looks like this: sambaAcctFlags: [S ] The initial search was: ldapsearch -x -LLL '(&(objectClass=device)(sambaAcctFlags=*S*))' dn This revealed nothing. Which I knew for sure is incorrect. To test I used: ldapsearch -x -LLL '(&(objectClass=device)(sambaAcctFlags=[S ]))' dn which returned the DNs of the trust accounts. Searching for: ldapsearch -x -LLL '(&(objectClass=device)(sambaSID=*1-5-21*))' dn also returned all DNs, so it is not a generic search filter problem. It seems to be related to [] and spaces. On the sambaAcctFlags search it doesn't matter if I replace [ and/or ] for * or the spaces for *, nothing is returned. The only working search is searching for the entire string. Am I doing something wrong? Or is this a bug in the search filter system? With kind regards, Dennis Leeuw

3 2

Strange hang scenario, resumes after idletimeout, but plenty of FDs available
by Kartik Subbarao 03 Jun '11

03 Jun '11

I'm running into the following scenario. Shortly after slapd gets bombarded by a burst of operations (from several different clients) on existing connections (well under the max number of connections, about 3000 out of 16384), it suddenly hangs. It's not responsive to any new connections, and doesn't process operations on existing connections. Load average is near zero during this time, so it's not doing anything. After 20 minutes (idletimeout), slapd frees several connections (maybe say 1000), and resumes working again as if nothing happened. The load pattern that gets it into this state happens every hour, almost on the hour (most likely associated with nslcd and cron jobs, which we're looking to mitigate elsewise). Another strange thing is that slapd will survive one instance's worth of bombardment without hanging, but the *next* hour will go into a hang state. Are there any resources other than file descriptors that are freed up during the idletimeout processing? Are there any other parameters that can be tuned besides idletimeout here? Could it possibly be a case of deadlock somewhere, something grabbing all the locks? Would things like set_lk_max_locks be relevant to investigate here? Any log level settings that might reveal more of what's happening here? Thanks for any suggestions on things to look at and try. -Kartik

4 12

ACL Problem?
by Nanoic Dalflanlun 03 Jun '11

03 Jun '11

I'm still seeking assistance. Something I noticed is that slapd appears to be ignoring the logging detail parameter regardless of whether I run it on Windows or CentOS. I tried setting the detail level to "any" and never had anything logged. Thanks, Nanoic ---------- Forwarded message ---------- From: Nanoic Dalflanlun <nanoic(a)gmail.com> Date: Tue, May 17, 2011 at 7:40 PM Subject: Restricted Active Directory Proxy for SaaS Vendors To: openldap-technical(a)openldap.org I am trying to setup an OpenLDAP server in my DMZ to proxy requests from Software as a Service vendors to my internal Active Directory domain. Specifically, I want to disallow anonymous access; make access read only; and restrict access to return only displayName, distinguishedName, mail, proxyAddresses, member, memberOf, mailNickname, and homeMDB. I also need to provide authentication capability for single sign on at the vendor. I don't think I have a proper understanding of OpenLDAP's ACLs, yet, so I am probably missing some things. I may even be approaching this completely wrong. I suspect I need to add "auth" access somewhere. Currently, I receive "result: 50 Insufficient access" when I try to query the OpenLDAP server. I don't have an authentication trace yet from the SaaS vendor, but it if it work like Cisco Ironport, it will try to bind to the LDAP server using the user's supplied credentials and look for a success, then switch back to using the LDAP query account. Thanks for any assistance, Nanoic -------------------------Begin slapd.conf------------------------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/saas.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args logfile /var/log/openldap.log loglevel none #Disallow anonymous binds disallow bind_anon #### Define access to Active Directory database ldap # Set proxy to read-only readonly on suffix "dc=example,dc=com" rootdn "dc=example,dc=com" rebind-as-user #List domain controllers to access. ldap for non-SSL/debug & ldaps for SSL/production uri "ldap://DomainController1" uri "ldap://DomainController2" lastmod off # set chase-referrals to no to keep from querying all DCs chase-referrals no ### access lists # Allow defined access to Active Directory, deny all others. access to dn.subtree="dc=example,dc=com" attrs=displayName,distinguishedName,mail,proxyAddresses,member,mailNickname,homeMDB by dn.exact="CN=saasqueryacct,OU=Service Accounts,DC=example,DC=com" read by * none # Deny access to all undefined resources by all undefined users access to * by * none -------------------------End slapd.conf------------------------- -------------------------Begin saas.schema------------------------- attributetype ( 1.2.840.113556.1.2.210 NAME 'proxyAddresses' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' ) attributetype ( 1.2.840.113556.1.2.244 NAME 'homeMDB' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' ) attributetype ( 1.2.840.113556.1.2.447 NAME 'mailNickname' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' ) -------------------------End saas.schema-------------------------

2 1

Re: Compiling OpenLDAP against static OpenSSL libraries
by The Uhu 03 Jun '11

03 Jun '11

Is there an IF statement missing in configure? Line 19408 specifies that RSAglue and rsaref libraries should be used without verifying whether they are needed. LIBS="-lssl -lcrypto -lRSAglue -lrsaref $LIBS" Changing this to check for rsaref would stop configure failing when using the newer versions of OpenSSL that no longer support rsaref. P. The Uhu <the_uhu(a)hotmail.com> wrote: Apologies, I didn't add the configure command and output. The static libraries are present in the included directory specified in the configure command. >CC="/usr/sfw/bin/gcc" LIBS="-lssl -lcrypto -lresolv -lgen -lnsl -lsocket" LDFLAGS="-L/workingdir/openssl-0.9.8r/build-SOLARIS/usr/local/openssl-0.9.8r/lib -R/workingdir/openssl-0.9.8r/build-SOLARIS/usr/local/openssl-0.9.8r/lib" CPPFLAGS="-I/workingdir/openssl-0.9.8r/build-SOLARIS/usr/local/openssl-0.9.8r/include" >./configure --prefix=/workingdir/openldap-2.4.23/build-SOLARIS/usr/local/openldap-2.4.23 --disable-slapd --disable-shared --disable-dynamic --with-tls=openssl --with-ssl >Configuring OpenLDAP 2.4.23-Release ... >checking build system type... sparc-sun-solaris2.10 >checking host system type... sparc-sun-solaris2.10 >checking target system type... sparc-sun-solaris2.10 >... >(other checks) >... >checking struct sockaddr_storage... yes >checking sys/un.h usability... yes >checking sys/un.h presence... yes >checking for sys/un.h... yes >checking openssl/ssl.h usability... yes >checking openssl/ssl.h presence... yes >checking for openssl/ssl.h... yes >checking for SSL_library_init in -lssl... no >checking for ssl3_accept in -lssl... no >configure: error: Could not locate TLS/SSL package The Uhu <the_uhu(a)hotmail.com> wrote: Hi, First off I have tried searching the net about this and all I find is that OpenSSL has to be built with shared libraries. However I have a need to use static OpenSSL libraries for supportability purposes (avoid conflicts with the older system version and for portability across hosts). Is it really not possible to do this? If not, and out of interest, what's the rationale? Thanks in advance. P.

1 0

Re: Compiling OpenLDAP against static OpenSSL libraries
by The Uhu 02 Jun '11

02 Jun '11

Apologies, I didn't add the configure command and output. The static libraries are present in the included directory specified in the configure command. >CC="/usr/sfw/bin/gcc" LIBS="-lssl -lcrypto -lresolv -lgen -lnsl -lsocket" LDFLAGS="-L/workingdir/openssl-0.9.8r/build-SOLARIS/usr/local/openssl-0.9.8r/lib -R/workingdir/openssl-0.9.8r/build-SOLARIS/usr/local/openssl-0.9.8r/lib" CPPFLAGS="-I/workingdir/openssl-0.9.8r/build-SOLARIS/usr/local/openssl-0.9.8r/include" >./configure --prefix=/workingdir/openldap-2.4.23/build-SOLARIS/usr/local/openldap-2.4.23 --disable-slapd --disable-shared --disable-dynamic --with-tls=openssl --with-ssl >Configuring OpenLDAP 2.4.23-Release ... >checking build system type... sparc-sun-solaris2.10 >checking host system type... sparc-sun-solaris2.10 >checking target system type... sparc-sun-solaris2.10 >... >(other checks) >... >checking struct sockaddr_storage... yes >checking sys/un.h usability... yes >checking sys/un.h presence... yes >checking for sys/un.h... yes >checking openssl/ssl.h usability... yes >checking openssl/ssl.h presence... yes >checking for openssl/ssl.h... yes >checking for SSL_library_init in -lssl... no >checking for ssl3_accept in -lssl... no >configure: error: Could not locate TLS/SSL package The Uhu <the_uhu(a)hotmail.com> wrote: Hi, First off I have tried searching the net about this and all I find is that OpenSSL has to be built with shared libraries. However I have a need to use static OpenSSL libraries for supportability purposes (avoid conflicts with the older system version and for portability across hosts). Is it really not possible to do this? If not, and out of interest, what's the rationale? Thanks in advance. P.

1 0

Compiling OpenLDAP against static OpenSSL libraries
by The Uhu 02 Jun '11

02 Jun '11

Hi, First off I have tried searching the net about this and all I find is that OpenSSL has to be built with shared libraries. However I have a need to use static OpenSSL libraries for supportability purposes (avoid conflicts with the older system version and for portability across hosts). Is it really not possible to do this? If not, and out of interest, what's the rationale? Thanks in advance. P.

1 0

Re: Combining dynlist + memberOf overlay?
by Gerry Calderhead 02 Jun '11

02 Jun '11

Failed to send yesterday, re-trying. On 1 June 2011 10:37, Gerry Calderhead <gerry(a)everythingsucks.co.uk> wrote: > Greetings, > > What we're trying to achieve is: > > Multiple organisations (Company, ThirdParty). > Groups, under each organisation, where their members can be added to gain > access to tools (such as JIRA). > dynlist aggregates membership of organisations groups into a "super" > group of all users with access to tools. > > e.g. all_jira_users = Company.jira_users + ThirdParty.jira_users > > We use a dynlist to acheive this. > > However we are unable to perform a search for memberOf=<dynlist>. > > Should this work or are we flogging a dead horse? > Can it be achieved by another standard-ish mechanism? > > Wisdom gratefully received. > > G > > > > > > > >

1 0

Setting idletimeout based upon bind DN
by Mark 01 Jun '11

01 Jun '11

Is there a way to set idletimeout based upon bind DN (like the limits config option). I'd like to set an idletimeout to drop connections no longer in use, but I don't want to affect my refreshAndPersist syncrepls. Thank you, Mark

2 2

Client expects response to change-password extended operation
by Michael Smith 01 Jun '11

01 Jun '11

I noted some old correspondence about this topic in the mailing-list archives, but now it has bitten me. We have an email server in my shop (from Mirapoint) which offers users an option to change their password. It sends the password-modify extended operation, but the user's session hangs, apparently unless Mirapoint gets a response. I understand that this is non-standard behavior. But unfortunately I'm stuck with this not-very-satisfactory product. Is there any way I can tweak openLDAP to respond to the password-modify ex-op? -- -- Michael J. Smith mjs(a)smithbowen.net http://stopmebeforeivoteagain.org http://www.cars-suck.org http://fakesprogress.blogspot.com

3 2

slapo-rwm to change userPassword attribute into a string
by Lucio Capuani 01 Jun '11

01 Jun '11

That is, in OpenLDAP the userPassword attribute is binary, even when its content is cleartext. I would need to have an extra attribute of "String" type, containing that very password. Is it possible to achieve this by using slapo-rmw (or maybe translucent?), by creating a view that "offers" that "fake" string attribute, rather than being forced to duplicate the real source attribute into a second one, only differently encoded? Thank you so much, -- Lucio

1 1

Valid reasons to choose OpenLDAP over Oracle Directory Server for Linux clients?
by Pieter Baele 01 Jun '11

01 Jun '11

Right now, our primary LDAP systems are Sun Directory Server and AD. All Solaris boxes connect to the Directory Server, but isn't it better to set up seperate OpenLDAP servers for a Linux environment? I am also thinking about customisation. For example, integration with krb, puppet.... Greetings, Pieter Baele

2 1

Should Berkeley DB backends be reloaded occasionally?
by Mark 01 Jun '11

01 Jun '11

Back in the days of OpenLDAP 2.1 with Berkeley DB 4.1.25.3 we used to have to 'reload' out backend database occasionally as non-indexed reads would get slower and slower over time. The 'reload' entailed: - stop slapd - slapcat the contents to an .ldif file - remove the database files - slapadd the .ldif file to create a new, fresh db instance - start slapd Then our performance problems went away. Re-indexing didn't do the trick. Is such occasional re-building of the backend database recommended in OpenLDAP 2.4.25 with Berkeley DB 4.8.30? Thank you, Mark

4 6

"best" way to check if OpenLDAP replication is working
by Tim Gustafson 01 Jun '11

01 Jun '11

Hi, Is there a "best" way to check to see if OpenLDAP replication is working? I have one script that checks the ContextCSN of the root of the database, which works to a certain degree. However, even when that matches it seems that sometimes a "deep inspection" (actually traversing the whole database and comparing each entry individually) of the directory shows differences even when the ContextCSN of the directory root matches. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Tim Gustafson tjg(a)soe.ucsc.edu Baskin School of Engineering 831-459-5354 UC Santa Cruz Baskin Engineering 317B -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

8 11

Re: Should Berkeley DB backends be reloaded occasionally?
by Mark 01 Jun '11

01 Jun '11

Thank you both for your quick response. I understand non-indexed reads will always be slower than indexed, but it was a batch process and I didn't want to incur the overhead of another write-impacting index. I've recently come back to OpenLDAP and so wasn't sure whether the new version's backend became 'fragmented' (for lack of a better term) like the old ones (<=2.1.25) seemed to. I hoped they did not, but I wanted to confirm as I haven't been running 2.4.25 w/BDB 4.8.30 long enough or under enough load yet to tell. I'm glad to hear 'defraging' is not required in newer versions. I will begin testing BDB 5.x as a replacement to our current BDB 4.8.30 backend. Is anyone aware of any technical reasons why one should use 5.1.25 over 4.8.30? On Tue, May 31, 2011 at 5:27 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, May 31, 2011 4:49 PM -0500 Mark <mah042(a)gmail.com> wrote: > > Back in the days of OpenLDAP 2.1 with Berkeley DB 4.1.25.3 we used to >> have to 'reload' out backend database occasionally as non-indexed reads >> would get slower and slower over time. The 'reload' entailed: >> >> • stop slapd >> • slapcat the contents to an .ldif file >> >> • remove the database files >> • slapadd the .ldif file to create a new, fresh db instance >> • start slapd >> >> Then our performance problems went away. Re-indexing didn't do the trick. >> >> Is such occasional re-building of the backend database recommended in >> OpenLDAP 2.4.25 with Berkeley DB 4.8.30? >> > > No. You are having this problem by running ancient releases of OpenLDAP > and BDB. BTW, BDB 5.x (5.1 and 5.0) are also fully supported by OpenLDAP > 2.4.23 and later. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

slapcating multi-master database to add new multi-master
by Mark 31 May '11

31 May '11

If I wanted to add another multi-master with a unique ServerID to a current set, I've read that in most instances it's best to slapcat one of the current multi-master's data, then slapadd that data into the new multi-master rather than wait for the new mmaster to 'catch up'. Q: Should I do something with the contextCSN at the top of the tree before I import it or will the new server create a new contextCSN using it's own ServerID? Q Should all multi-master instances include a contextCSN for each of the multi-master instances or just a contextCSN for itself? I have a 2-way mmaster duo where each mmaster only has it's own contextCSN. And another 4-way mmaster setup where each mmaster has a 4 contextCSNs, one for each of the mmasters in the group. Thank you, Mark

1 0

replace running LDAP-server in multimaster configuration
by Andreas Haubod 31 May '11

31 May '11

Hello, at the moment, I have running two LDAP-Server (2.4.23) on two sites (AP and Europe) with multi master replication. All is running very well. On both sites will be written from applications to the local LDAP-server and the complete database is replicated to the other site (syncrepl/push). A third LDAP-server (read-only replica) on one site is used to make a backup hourly. The LDAP is stopped an the database is saved with slapcat. Now I want replace one of the LDAP-Server because of better Hardware. So I know, I have two choices: 1) Only setup the new LDAP-Server with a empty Database and wait till the replication is finished 2) Fill the Database with one of the hourly backup and start the server and wait till the replication is finished. What will happen, when I use method 1) and the application write during the (initial) replication to the (for explamle only 2% filled) Database? (I checked the initial replication. It needs about one hour because of the old slow hardware.) Does this work without expecting any problems or should I avoid the writing till the initial replication has finished? When I use method 2) and for example the saved database is 10h old and during this time are many (>10000) changes made in the productive system? Is then this method then recommended or is method 1) better in this situation? Are there any comparison or recommendations for backup/recover and migration in such multi master setups? A second Question I have. Is it possible, to mix the openldap (minor) versions (eg. 2.4.23 and 2.4.25)? I ask this, because I want update the servers on different times. Thanks for help and the great openLDAP !!! Andreas

2 1

Last Bind (Last logon) attribute
by Andy Carlson 31 May '11

31 May '11

As far as I am aware, there is no attribute in the OpenLDAP shema that holds the last logon (or last bind) time or built-in slapd functionality to do so. If I am incorrect, please let me know. If I am correct, I am wondering if there is any way to implement triggers that can be executed when a successful bind operation happens such as executing a shell script that will modify a user-defined attribute that holds a timestamp. Thanks much, Andy Carlson Identity Administrator | Information Systems 312-329-4385

3 2

back-sql configuration
by Chris Card 30 May '11

30 May '11

I am trying to set up openldap to use back-sql and mysql (currently on Fedora 14 with packages openldap-servers-sql-2.4.23-4.fc14.x86_64, openldap-2.4.23-4.fc14.x86_64, openldap-clients-2.4.23-4.fc14.x86_64, openldap-servers-2.4.23-4.fc14.x86_64). Is it true that to do this openldap must use the old slapd.conf method rather than the newer dynamic configuration method using slapd.d? I can get back-sql working using config from /etc/openldap/slapd.conf, but when I try to create the equivalent config under slapd.d I can't see any where to put the equivalent of dbname, subtree_cond etc., and I see a warning "No dynamic config support for database sql". If it *is* true that slapd.conf must be used for back-sql config, can openldap use slapd.conf and slapd.d config at the same time, or must all the openldap config come from slapd.conf? Chris

3 3

How to write an overlay that perform search from within an overlay?
by hptf 30 May '11

30 May '11

Hello all, I am trying to write an overlay that is able to get the previous/old values of an Entity, before it is updated by a modify/delete. For that purpose, my first tries were to use a search from within the overlay, or pre-read. I try many method, (inspired by existing overlay), but none seems to work for now: - use of pre-read seems to be very complicated; moreover, pre-read ctrl seems to be returned as already ber-encoded, meaning that I need to re-decode the ber to get the value ... this is (too) expensive - use of search from within overlay raise, for now, some problems: * if using translucent like call to 'be_entry_get_rw' I got deadlock on hdb * if using rc = nop->o_bd->be_search(nop,&nrs); from within overlay, it seems that response is sent also to remote client socket, and not stay confined to overlay call ( and, btw, I fail to get the result: rs->sr_un.sru_search.r_entry is NULL ) I, for sure, miss something. Do you have any clue, example, advice that may help me to continue ? Thanks in advance for your help. hp tf PS: This is a repost in the good mailing list, initial message post in openldap-devel(a)openldap.org, sorry for the inconvenience.

2 1

Fail to test uid of OpenLDAP with TLS...
by Nguyen, Quoc Khanh 29 May '11

29 May '11

Hi all, Please help me about this problem... I want to use testsaslauthd to test uid of OpenLDAP with TLS, but it fail... Here is my config: /usr/local/etc/saslauthd.conf: ldap_servers: ldap://localhost ldap_bind_dn: cn=admin,dc=abc,dc=com ldap_bind_pw: 123456789 ldap_search_base: dc=abc,dc=com ldap_start_tls: yes ldap_tls_cacert_dir: /var/myCA ldap_tls_cacert_file: /var/myCA/cacert.crt ldap_debug: -1 start LDAP: root@ldap:~# /usr/local/openldap/libexec/slapd -h 'ldap:///' start saslauthd: root@ldap:~# /usr/local/sasl2/sbin/saslauthd -a ldap -O /usr/local/etc/saslauthd.conf -d saslauthd[765] :main : num_procs : 5 saslauthd[765] :main : mech_option: /usr/local/etc/saslauthd.conf saslauthd[765] :main : run_path : /var/run saslauthd[765] :main : auth_mech : ldap saslauthd[765] :ipc_init : using accept lock file: /var/run/mux.accept saslauthd[765] :detach_tty : master pid is: 0 saslauthd[765] :ipc_init : listening on socket: /var/run/mux saslauthd[765] :main : using process model saslauthd[765] :have_baby : forked child: 766 saslauthd[765] :have_baby : forked child: 767 saslauthd[765] :have_baby : forked child: 768 saslauthd[765] :have_baby : forked child: 769 saslauthd[765] :get_accept_lock : acquired accept lock test uid: root@ldap:~# /usr/local/sasl2/sbin/testsaslauthd -u khanhnq -p 123456 0: NO "authentication failed" I have a debug result: saslauthd[765] :rel_accept_lock : released accept lock saslauthd[767] :get_accept_lock : acquired accept lock ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 10 ldap_prepare_socket: 10 ldap_connect_to_host: Trying ::1 389 ldap_pvt_connect: fd: 10 tm: 5 async: 0 ldap_ndelay_on: 10 ldap_int_poll: fd: 10 tm: 5 ldap_is_sock_ready: 10 ldap_ndelay_off: 10 ldap_pvt_connect: 0 ldap_open_defconn: successful ldap_send_server_request ldap_result ld 0x9cef220 msgid 1 wait4msg ld 0x9cef220 msgid 1 (infinite timeout) wait4msg continue ld 0x9cef220 msgid 1 all 1 ** ld 0x9cef220 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Fri May 27 16:40:05 2011 ** ld 0x9cef220 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x9cef220 request count 1 (abandoned 0) ** ld 0x9cef220 Response Queue: Empty ld 0x9cef220 response count 0 ldap_chkResponseList ld 0x9cef220 msgid 1 all 1 ldap_chkResponseList returns ld 0x9cef220 NULL ldap_int_select read1msg: ld 0x9cef220 msgid 1 all 1 read1msg: ld 0x9cef220 msgid 1 message type extended-result read1msg: ld 0x9cef220 0 new referrals read1msg: mark request completed, ld 0x9cef220 msgid 1 request done: ld 0x9cef220 msgid 1 res_errno: 0, res_error: , res_matched: ldap_free_request (origid 1, msgid 1) ldap_parse_extended_result ldap_parse_result ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 0, subject: /CN=abc.com/ST=HCM/C=VN/emailAddress=root(a)abc.com/O=SGT/OU=NW Department, issuer: /CN=abc.com/ST=HCM/C=VN/emailAddress=root(a)abc.com/O=SGT/OU=NW Department TLS certificate verification: depth: 0, err: 7, subject: /CN=abc.com/ST=HCM/C=VN/emailAddress=root(a)abc.com/O=SGT/OU=NW, issuer: /CN=abc.com/ST=HCM/C=VN/emailAddress=root(a)abc.com/O=SGT/OU=NW Department TLS certificate verification: Error, certificate signature failure TLS trace: SSL3 alert write:fatal:decrypt error TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:func(144):reason(134) (certificate signature failure). ldap_err2string ldap_unbind ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed saslauthd[765] :do_auth : auth failure: [user=khanhnq] [service=imap] [realm=] [mech=ldap] [reason=Unknown] saslauthd[765] :do_request : response: NO What i'm doing wrong? I think my TLS is OK... Here is my ldapsearch result: root@ldap:/usr/local/openldap/bin# ./ldapsearch -xLL -b dc=abc,dc=com uid=khanhnq -d -1 ldap_create ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP abc.com:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying ::1 389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x9023e88 ptr=0x9023e88 end=0x9023e96 len=14 0000: 30 0c 02 01 01 60 07 02 01 03 04 00 80 00 0....`........ ber_scanf fmt ({i) ber: ber_dump: buf=0x9023e88 ptr=0x9023e8d end=0x9023e96 len=9 0000: 60 07 02 01 03 04 00 80 00 `........ ber_flush2: 14 bytes to sd 3 0000: 30 0c 02 01 01 60 07 02 01 03 04 00 80 00 0....`........ ldap_write: want=14, written=14 0000: 30 0c 02 01 01 60 07 02 01 03 04 00 80 00 0....`........ ldap_result ld 0x901b540 msgid 1 wait4msg ld 0x901b540 msgid 1 (infinite timeout) wait4msg continue ld 0x901b540 msgid 1 all 1 ** ld 0x901b540 Connections: * host: abc.com port: 389 (default) refcnt: 2 status: Connected last used: Fri May 27 16:42:21 2011 ** ld 0x901b540 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x901b540 request count 1 (abandoned 0) ** ld 0x901b540 Response Queue: Empty ld 0x901b540 response count 0 ldap_chkResponseList ld 0x901b540 msgid 1 all 1 ldap_chkResponseList returns ld 0x901b540 NULL ldap_int_select read1msg: ld 0x901b540 msgid 1 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 0c 02 01 01 61 07 0a 0....a.. ldap_read: want=6, got=6 0000: 01 00 04 00 04 00 ...... ber_get_next: tag 0x30 len 12 contents: ber_dump: buf=0x9025488 ptr=0x9025488 end=0x9025494 len=12 0000: 02 01 01 61 07 0a 01 00 04 00 04 00 ...a........ read1msg: ld 0x901b540 msgid 1 message type bind ber_scanf fmt ({eAA) ber: ber_dump: buf=0x9025488 ptr=0x902548b end=0x9025494 len=9 0000: 61 07 0a 01 00 04 00 04 00 a........ read1msg: ld 0x901b540 0 new referrals read1msg: mark request completed, ld 0x901b540 msgid 1 request done: ld 0x901b540 msgid 1 res_errno: 0, res_error: , res_matched: ldap_free_request (origid 1, msgid 1) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x9025488 ptr=0x902548b end=0x9025494 len=9 0000: 61 07 0a 01 00 04 00 04 00 a........ ber_scanf fmt (}) ber: ber_dump: buf=0x9025488 ptr=0x9025494 end=0x9025494 len=0 ldap_msgfree version: 1 ldap_search_ext put_filter: "uid=khanhnq" put_filter: default put_simple_filter: "uid=khanhnq" ldap_build_search_req ATTRS: * ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x9023e88 ptr=0x9023e88 end=0x9023ebf len=55 0000: 30 35 02 01 02 63 30 04 0d 64 63 3d 61 62 63 2c 05...c0..dc=abc, 0010: 64 63 3d 63 6f 6d 0a 01 02 0a 01 00 02 01 00 02 dc=com.......... 0020: 01 00 01 01 00 a3 0e 04 03 75 69 64 04 07 6b 68 .........uid..kh 0030: 61 6e 68 6e 71 30 00 anhnq0. ber_scanf fmt ({) ber: ber_dump: buf=0x9023e88 ptr=0x9023e8d end=0x9023ebf len=50 0000: 63 30 04 0d 64 63 3d 61 62 63 2c 64 63 3d 63 6f c0..dc=abc,dc=co 0010: 6d 0a 01 02 0a 01 00 02 01 00 02 01 00 01 01 00 m............... 0020: a3 0e 04 03 75 69 64 04 07 6b 68 61 6e 68 6e 71 ....uid..khanhnq 0030: 30 00 0. ber_flush2: 55 bytes to sd 3 0000: 30 35 02 01 02 63 30 04 0d 64 63 3d 61 62 63 2c 05...c0..dc=abc, 0010: 64 63 3d 63 6f 6d 0a 01 02 0a 01 00 02 01 00 02 dc=com.......... 0020: 01 00 01 01 00 a3 0e 04 03 75 69 64 04 07 6b 68 .........uid..kh 0030: 61 6e 68 6e 71 30 00 anhnq0. ldap_write: want=55, written=55 0000: 30 35 02 01 02 63 30 04 0d 64 63 3d 61 62 63 2c 05...c0..dc=abc, 0010: 64 63 3d 63 6f 6d 0a 01 02 0a 01 00 02 01 00 02 dc=com.......... 0020: 01 00 01 01 00 a3 0e 04 03 75 69 64 04 07 6b 68 .........uid..kh 0030: 61 6e 68 6e 71 30 00 anhnq0. ldap_result ld 0x901b540 msgid -1 wait4msg ld 0x901b540 msgid -1 (infinite timeout) wait4msg continue ld 0x901b540 msgid -1 all 0 ** ld 0x901b540 Connections: * host: abc.com port: 389 (default) refcnt: 2 status: Connected last used: Fri May 27 16:42:21 2011 ** ld 0x901b540 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x901b540 request count 1 (abandoned 0) ** ld 0x901b540 Response Queue: Empty ld 0x901b540 response count 0 ldap_chkResponseList ld 0x901b540 msgid -1 all 0 ldap_chkResponseList returns ld 0x901b540 NULL ldap_int_select read1msg: ld 0x901b540 msgid -1 all 0 ber_get_next ldap_read: want=8, got=8 0000: 30 82 01 13 02 01 02 64 0......d ldap_read: want=271, got=271 0000: 82 01 0c 04 28 63 6e 3d 4b 68 61 6e 68 20 4e 67 ....(cn=Khanh Ng 0010: 75 79 65 6e 2c 6f 75 3d 6e 65 74 77 6f 72 6b 2c uyen,ou=network, 0020: 64 63 3d 61 62 63 2c 64 63 3d 63 6f 6d 30 81 df dc=abc,dc=com0.. 0030: 30 1e 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 31 0...objectClass1 0040: 0f 04 0d 69 6e 65 74 4f 72 67 50 65 72 73 6f 6e ...inetOrgPerson 0050: 30 27 04 02 63 6e 31 21 04 0c 4b 68 61 6e 68 20 0'..cn1!..Khanh 0060: 4e 67 75 79 65 6e 04 11 4b 68 61 6e 68 20 4e 67 Nguyen..Khanh Ng 0070: 75 79 65 6e 20 51 75 6f 63 30 0d 04 02 73 6e 31 uyen Quoc0...sn1 0080: 07 04 05 4b 68 61 6e 68 30 10 04 03 75 69 64 31 ...Khanh0...uid1 0090: 09 04 07 6b 68 61 6e 68 6e 71 30 18 04 0c 75 73 ...khanhnq0...us 00a0: 65 72 50 61 73 73 77 6f 72 64 31 08 04 06 31 32 erPassword1...12 00b0: 33 34 35 36 30 48 04 04 6d 61 69 6c 31 40 04 0f 34560H..mail1@.. 00c0: 6b 68 61 6e 68 6e 71 40 61 62 63 2e 63 6f 6d 04 khanhnq(a)abc.com [1]. 00d0: 12 6e 71 6b 32 38 37 30 33 40 79 61 68 6f 6f 2e .nqk28703@yahoo. 00e0: 63 6f 6d 04 19 6b 68 61 6e 68 6e 71 40 73 61 69 com..khanhnq@sai 00f0: 67 6f 6e 74 65 63 68 2e 65 64 75 2e 76 6e 30 0f gontech.edu.vn0. 0100: 04 02 6f 75 31 09 04 07 6e 65 74 77 6f 72 6b ..ou1...network ber_get_next: tag 0x30 len 275 contents: ber_dump: buf=0x90255f0 ptr=0x90255f0 end=0x9025703 len=275 0000: 02 01 02 64 82 01 0c 04 28 63 6e 3d 4b 68 61 6e ...d....(cn=Khan 0010: 68 20 4e 67 75 79 65 6e 2c 6f 75 3d 6e 65 74 77 h Nguyen,ou=netw 0020: 6f 72 6b 2c 64 63 3d 61 62 63 2c 64 63 3d 63 6f ork,dc=abc,dc=co 0030: 6d 30 81 df 30 1e 04 0b 6f 62 6a 65 63 74 43 6c m0..0...objectCl 0040: 61 73 73 31 0f 04 0d 69 6e 65 74 4f 72 67 50 65 ass1...inetOrgPe 0050: 72 73 6f 6e 30 27 04 02 63 6e 31 21 04 0c 4b 68 rson0'..cn1!..Kh 0060: 61 6e 68 20 4e 67 75 79 65 6e 04 11 4b 68 61 6e anh Nguyen..Khan 0070: 68 20 4e 67 75 79 65 6e 20 51 75 6f 63 30 0d 04 h Nguyen Quoc0.. 0080: 02 73 6e 31 07 04 05 4b 68 61 6e 68 30 10 04 03 .sn1...Khanh0... 0090: 75 69 64 31 09 04 07 6b 68 61 6e 68 6e 71 30 18 uid1...khanhnq0. 00a0: 04 0c 75 73 65 72 50 61 73 73 77 6f 72 64 31 08 ..userPassword1. 00b0: 04 06 31 32 33 34 35 36 30 48 04 04 6d 61 69 6c ..1234560H..mail 00c0: 31 40 04 0f 6b 68 61 6e 68 6e 71 40 61 62 63 2e 1@..khanhn [2]q@abc. 00d0: 63 6f 6d 04 12 6e 71 6b 32 38 37 30 33 40 79 61 com..nqk28703@ya 00e0: 68 6f 6f 2e 63 6f 6d 04 19 6b 68 61 6e 68 6e 71 hoo.com..khanhnq 00f0: 40 73 61 69 67 6f 6e 74 65 63 68 2e 65 64 75 2e @saigontech.edu. 0100: 76 6e 30 0f 04 02 6f 75 31 09 04 07 6e 65 74 77 vn0...ou1...netw 0110: 6f 72 6b ork read1msg: ld 0x901b540 msgid 2 message type search-entry ldap_get_dn_ber ber_scanf fmt ({ml{) ber: ber_dump: buf=0x90255f0 ptr=0x90255f3 end=0x9025703 len=272 0000: 64 82 01 0c 04 28 63 6e 3d 4b 68 61 6e 68 20 4e d....(cn=Khanh N 0010: 67 75 79 65 6e 2c 6f 75 3d 6e 65 74 77 6f 72 6b guyen,ou=network 0020: 2c 64 63 3d 61 62 63 2c 64 63 3d 63 6f 6d 30 81 ,dc=abc,dc=com0. 0030: df 30 1e 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 .0...objectClass 0040: 31 0f 04 0d 69 6e 65 74 4f 72 67 50 65 72 73 6f 1...inetOrgPerso 0050: 6e 30 27 04 02 63 6e 31 21 04 0c 4b 68 61 6e 68 n0'..cn1!..Khanh 0060: 20 4e 67 75 79 65 6e 04 11 4b 68 61 6e 68 20 4e Nguyen..Khanh N 0070: 67 75 79 65 6e 20 51 75 6f 63 30 0d 04 02 73 6e guyen Quoc0...sn 0080: 31 07 04 05 4b 68 61 6e 68 30 10 04 03 75 69 64 1...Khanh0...uid 0090: 31 09 04 07 6b 68 61 6e 68 6e 71 30 18 04 0c 75 1...khanhnq0...u 00a0: 73 65 72 50 61 73 73 77 6f 72 64 31 08 04 06 31 serPassword1...1 00b0: 32 33 34 35 36 30 48 04 04 6d 61 69 6c 31 40 04 234560H..mail1@. 00c0: 0f 6b 68 61 6e 68 6e 71 40 61 62 63 2e 63 6f 6d .khanhnq(a)abc.com 00d0: 04 12 6e 71 6b 32 38 37 30 33 40 79 61 68 6f 6f ..nqk28703@yahoo 00e0: 2e 63 6f 6d 04 19 6b 68 61 6e 68 6e 71 40 73 61 .com..khanhnq@sa 00f0: 69 67 6f 6e 74 65 63 68 2e 65 64 75 2e 76 6e 30 igontech.edu.vn0 0100: 0f 04 02 6f 75 31 09 04 07 6e 65 74 77 6f 72 6b ...ou1...network dn: cn=Khanh Nguyen,ou=network,dc=abc,dc=com ber_scanf fmt ({xx) ber: ber_dump: buf=0x90255f0 ptr=0x90255f3 end=0x9025703 len=272 0000: 64 82 01 0c 04 28 63 6e 3d 4b 68 61 6e 68 20 4e d....(cn=Khanh N 0010: 67 75 79 65 6e 2c 6f 75 3d 6e 65 74 77 6f 72 6b guyen,ou=network 0020: 2c 64 63 3d 61 62 63 2c 64 63 3d 63 6f 6d 00 81 ,dc=abc,dc=com.. 0030: df 30 1e 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 .0...objectClass 0040: 31 0f 04 0d 69 6e 65 74 4f 72 67 50 65 72 73 6f 1...inetOrgPerso 0050: 6e 30 27 04 02 63 6e 31 21 04 0c 4b 68 61 6e 68 n0'..cn1!..Khanh 0060: 20 4e 67 75 79 65 6e 04 11 4b 68 61 6e 68 20 4e Nguyen..Khanh N 0070: 67 75 79 65 6e 20 51 75 6f 63 30 0d 04 02 73 6e guyen Quoc0...sn 0080: 31 07 04 05 4b 68 61 6e 68 30 10 04 03 75 69 64 1...Khanh0...uid 0090: 31 09 04 07 6b 68 61 6e 68 6e 71 30 18 04 0c 75 1...khanhnq0...u 00a0: 73 65 72 50 61 73 73 77 6f 72 64 31 08 04 06 31 serPassword1...1 00b0: 32 33 34 35 36 30 48 04 04 6d 61 69 6c 31 40 04 234560H..mail1@. 00c0: 0f 6b 68 61 6e 68 6e 71 40 61 62 63 2e 63 6f 6d .khanhnq(a)abc.com 00d0: 04 12 6e 71 6b 32 38 37 30 33 40 79 61 68 6f 6f ..nqk28703@yahoo 00e0: 2e 63 6f 6d 04 19 6b 68 61 6e 68 6e 71 40 73 61 .com..khanhnq@sa 00f0: 69 67 6f 6e 74 65 63 68 2e 65 64 75 2e 76 6e 30 igontech.edu.vn0 0100: 0f 04 02 6f 75 31 09 04 07 6e 65 74 77 6f 72 6b ...ou1...network ldap_get_attribute_ber ber_scanf fmt ({mM}) ber: ber_dump: buf=0x90255f0 ptr=0x9025624 end=0x9025703 len=223 0000: 30 1e 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 31 0...objectClass1 0010: 0f 04 0d 69 6e 65 74 4f 72 67 50 65 72 73 6f 6e ...inetOrgPerson 0020: 30 27 04 02 63 6e 31 21 04 0c 4b 68 61 6e 68 20 0'..cn1!..Khanh 0030: 4e 67 75 79 65 6e 04 11 4b 68 61 6e 68 20 4e 67 Nguyen..Khanh Ng 0040: 75 79 65 6e 20 51 75 6f 63 30 0d 04 02 73 6e 31 uyen Quoc0...sn1 0050: 07 04 05 4b 68 61 6e 68 30 10 04 03 75 69 64 31 ...Khanh0...uid1 0060: 09 04 07 6b 68 61 6e 68 6e 71 30 18 04 0c 75 73 ...khanhnq0...us 0070: 65 72 50 61 73 73 77 6f 72 64 31 08 04 06 31 32 erPassword1...12 0080: 33 34 35 36 30 48 04 04 6d 61 69 6c 31 40 04 0f 34560H..mail1@.. 0090: 6b 68 61 6e 68 6e 71 40 61 62 63 2e 63 6f 6d 04 khanhnq(a)abc.com [3]. 00a0: 12 6e 71 6b 32 38 37 30 33 40 79 61 68 6f 6f 2e .nqk28703@yahoo. 00b0: 63 6f 6d 04 19 6b 68 61 6e 68 6e 71 40 73 61 69 com..khanhnq@sai 00c0: 67 6f 6e 74 65 63 68 2e 65 64 75 2e 76 6e 30 0f gontech.edu.vn0. 00d0: 04 02 6f 75 31 09 04 07 6e 65 74 77 6f 72 6b ..ou1...network objectClass: inetOrgPerson ldap_get_attribute_ber ber_scanf fmt ({mM}) ber: ber_dump: buf=0x90255f0 ptr=0x9025644 end=0x9025703 len=191 0000: 00 27 04 02 63 6e 31 21 04 0c 4b 68 61 6e 68 20 .'..cn1!..Khanh 0010: 4e 67 75 79 65 6e 04 11 4b 68 61 6e 68 20 4e 67 Nguyen..Khanh Ng 0020: 75 79 65 6e 20 51 75 6f 63 30 0d 04 02 73 6e 31 uyen Quoc0...sn1 0030: 07 04 05 4b 68 61 6e 68 30 10 04 03 75 69 64 31 ...Khanh0...uid1 0040: 09 04 07 6b 68 61 6e 68 6e 71 30 18 04 0c 75 73 ...khanhnq0...us 0050: 65 72 50 61 73 73 77 6f 72 64 31 08 04 06 31 32 erPassword1...12 0060: 33 34 35 36 30 48 04 04 6d 61 69 6c 31 40 04 0f 34560H..mail1@.. 0070: 6b 68 61 6e 68 6e 71 40 61 62 63 2e 63 6f 6d 04 khanhnq(a)abc.com [4]. 0080: 12 6e 71 6b 32 38 37 30 33 40 79 61 68 6f 6f 2e .nqk28703@yahoo. 0090: 63 6f 6d 04 19 6b 68 61 6e 68 6e 71 40 73 61 69 com..khanhnq@sai 00a0: 67 6f 6e 74 65 63 68 2e 65 64 75 2e 76 6e 30 0f gontech.edu.vn0. 00b0: 04 02 6f 75 31 09 04 07 6e 65 74 77 6f 72 6b ..ou1...network cn: Khanh Nguyen cn: Khanh Nguyen Quoc ldap_get_attribute_ber ber_scanf fmt ({mM}) ber: ber_dump: buf=0x90255f0 ptr=0x902566d end=0x9025703 len=150 0000: 00 0d 04 02 73 6e 31 07 04 05 4b 68 61 6e 68 30 ....sn1...Khanh0 0010: 10 04 03 75 69 64 31 09 04 07 6b 68 61 6e 68 6e ...uid1...khanhn 0020: 71 30 18 04 0c 75 73 65 72 50 61 73 73 77 6f 72 q0...userPasswor 0030: 64 31 08 04 06 31 32 33 34 35 36 30 48 04 04 6d d1...1234560H..m 0040: 61 69 6c 31 40 04 0f 6b 68 61 6e 68 6e 71 40 61 ail1@..khanhn [5]q@a 0050: 62 63 2e 63 6f 6d 04 12 6e 71 6b 32 38 37 30 33 bc.com..nqk28703 0060: 40 79 61 68 6f 6f 2e 63 6f 6d 04 19 6b 68 61 6e @yahoo.com..khan 0070: 68 6e 71 40 73 61 69 67 6f 6e 74 65 63 68 2e 65 hnq(a)saigontech.e 0080: 64 75 2e 76 6e 30 0f 04 02 6f 75 31 09 04 07 6e du.vn0...ou1...n 0090: 65 74 77 6f 72 6b etwork sn: Khanh ldap_get_attribute_ber ber_scanf fmt ({mM}) ber: ber_dump: buf=0x90255f0 ptr=0x902567c end=0x9025703 len=135 0000: 00 10 04 03 75 69 64 31 09 04 07 6b 68 61 6e 68 ....uid1...khanh 0010: 6e 71 30 18 04 0c 75 73 65 72 50 61 73 73 77 6f nq0...userPasswo 0020: 72 64 31 08 04 06 31 32 33 34 35 36 30 48 04 04 rd1...1234560H.. 0030: 6d 61 69 6c 31 40 04 0f 6b 68 61 6e 68 6e 71 40 mail1@..khanhn [6]q@ 0040: 61 62 63 2e 63 6f 6d 04 12 6e 71 6b 32 38 37 30 abc.com..nqk2870 0050: 33 40 79 61 68 6f 6f 2e 63 6f 6d 04 19 6b 68 61 3@yahoo.com..kha [7] 0060: 6e 68 6e 71 40 73 61 69 67 6f 6e 74 65 63 68 2e nhnq@saigontech. 0070: 65 64 75 2e 76 6e 30 0f 04 02 6f 75 31 09 04 07 edu.vn0...ou1... 0080: 6e 65 74 77 6f 72 6b network uid: khanhnq ldap_get_attribute_ber ber_scanf fmt ({mM}) ber: ber_dump: buf=0x90255f0 ptr=0x902568e end=0x9025703 len=117 0000: 00 18 04 0c 75 73 65 72 50 61 73 73 77 6f 72 64 ....userPassword 0010: 31 08 04 06 31 32 33 34 35 36 30 48 04 04 6d 61 1...1234560H..ma 0020: 69 6c 31 40 04 0f 6b 68 61 6e 68 6e 71 40 61 62 il1@..khanhn [8]q@ab 0030: 63 2e 63 6f 6d 04 12 6e 71 6b 32 38 37 30 33 40 c.com..nqk28703@ 0040: 79 61 68 6f 6f 2e 63 6f 6d 04 19 6b 68 61 6e 68 yahoo.com..khanh 0050: 6e 71 40 73 61 69 67 6f 6e 74 65 63 68 2e 65 64 nq(a)saigontech.ed [9] 0060: 75 2e 76 6e 30 0f 04 02 6f 75 31 09 04 07 6e 65 u.vn0...ou1...ne 0070: 74 77 6f 72 6b twork userPassword:: MTIzNDU2 ldap_get_attribute_ber ber_scanf fmt ({mM}) ber: ber_dump: buf=0x90255f0 ptr=0x90256a8 end=0x9025703 len=91 0000: 00 48 04 04 6d 61 69 6c 31 40 04 0f 6b 68 61 6e .H..mail1@..khan 0010: 68 6e 71 40 61 62 63 2e 63 6f 6d 04 12 6e 71 6b hnq@abc.com..nqk [10] 0020: 32 38 37 30 33 40 79 61 68 6f 6f 2e 63 6f 6d 04 28703(a)yahoo.com [11]. 0030: 19 6b 68 61 6e 68 6e 71 40 73 61 69 67 6f 6e 74 .khanhnq@saigont 0040: 65 63 68 2e 65 64 75 2e 76 6e 30 0f 04 02 6f 75 ech.edu.vn0...ou 0050: 31 09 04 07 6e 65 74 77 6f 72 6b 1...network mail: khanhnq(a)abc.com [12] mail: nqk28703(a)yahoo.com [13] mail: khanhnq(a)saigontech.edu.vn [14] ldap_get_attribute_ber ber_scanf fmt ({mM}) ber: ber_dump: buf=0x90255f0 ptr=0x90256f2 end=0x9025703 len=17 0000: 00 0f 04 02 6f 75 31 09 04 07 6e 65 74 77 6f 72 ....ou1...networ 0010: 6b k ou: network ldap_get_attribute_ber ldap_msgfree ldap_result ld 0x901b540 msgid -1 wait4msg ld 0x901b540 msgid -1 (infinite timeout) wait4msg continue ld 0x901b540 msgid -1 all 0 ** ld 0x901b540 Connections: * host: abc.com port: 389 (default) refcnt: 2 status: Connected last used: Fri May 27 16:42:21 2011 ** ld 0x901b540 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x901b540 request count 1 (abandoned 0) ** ld 0x901b540 Response Queue: Empty ld 0x901b540 response count 0 ldap_chkResponseList ld 0x901b540 msgid -1 all 0 ldap_chkResponseList returns ld 0x901b540 NULL ldap_int_select read1msg: ld 0x901b540 msgid -1 all 0 ber_get_next ldap_read: want=8, got=8 0000: 30 0c 02 01 02 65 07 0a 0....e.. ldap_read: want=6, got=6 0000: 01 00 04 00 04 00 ...... ber_get_next: tag 0x30 len 12 contents: ber_dump: buf=0x90252d8 ptr=0x90252d8 end=0x90252e4 len=12 0000: 02 01 02 65 07 0a 01 00 04 00 04 00 ...e........ read1msg: ld 0x901b540 msgid 2 message type search-result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x90252d8 ptr=0x90252db end=0x90252e4 len=9 0000: 65 07 0a 01 00 04 00 04 00 e........ read1msg: ld 0x901b540 0 new referrals read1msg: mark request completed, ld 0x901b540 msgid 2 request done: ld 0x901b540 msgid 2 res_errno: 0, res_error: , res_matched: ldap_free_request (origid 2, msgid 2) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x90252d8 ptr=0x90252db end=0x90252e4 len=9 0000: 65 07 0a 01 00 04 00 04 00 e........ ber_scanf fmt (}) ber: ber_dump: buf=0x90252d8 ptr=0x90252e4 end=0x90252e4 len=0 ldap_msgfree ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 3 0000: 30 05 02 01 03 42 00 0....B. ldap_write: want=7, written=7 0000: 30 05 02 01 03 42 00 0....B. ldap_free_connection: actually freed Please help, Best Regards, -- *********************************** EVERYTHING HAS JUST BEGUN... Links: ------ [1] mailto:khanhnq@abc.com [2] mailto:1@..khanhn [3] mailto:khanhnq@abc.com [4] mailto:khanhnq@abc.com [5] mailto:ail1@..khanhn [6] mailto:mail1@..khanhn [7] mailto:3@yahoo.com..kha [8] mailto:il1@..khanhn [9] mailto:nq@saigontech.ed [10] mailto:hnq@abc.com..nqk [11] mailto:28703@yahoo.com [12] mailto:khanhnq@abc.com [13] mailto:nqk28703@yahoo.com [14] mailto:khanhnq@saigontech.edu.vn

2 1

Should multiple cn entries in a dn be accepted?
by Ian Collins 27 May '11

27 May '11

I am trying to import data from another server into OpenLDAP and I've hit a snag with some dns which contain multiple cn entries: cn=Services_PM_Champions,cn=Services_PM_Team,ou=groups,o=staff,dc=client ADD is failing with error 32 (No such object): conn=1005 op=1236 ADD dn="cn=Service.Admin,ou=groups,o=staff,dc=client" conn=1005 op=1236 RESULT tag=105 err=0 text= conn=1005 op=1237 ADD dn="cn=Services_PM_Champions,cn=Services_PM_Team,ou=groups,o=staff,dc=client" conn=1005 op=1237 RESULT tag=105 err=32 text= Should this be accepted? -- Ian.

3 4

New consumer replication issues
by Christopher Strider Cook 27 May '11

27 May '11

I've got a mirrormode cluster of 2.4.25 running and using test059 as an example I had setup a script that would create new consumers of this cluster. It worked fine.. until now. Now when I run it I seem to run into, what I can only describe as, an ordering problem with the initial replication. The server is replicating parts of cn=config over but seems to complain because of an syntax check. Am I missing some flag in the sync or do entyCSNs need to be in a particular order...or am I missing something else altogether? Hear are some logs and configs In this case it looks like a needed schema wasn't synced first: May 26 15:02:49 ramones slapd[10377]: syncrepl_message_to_entry: rid=001 mods check (olcSuffix: value #0 invalid per syntax) May 26 15:02:49 ramones slapd[10377]: do_syncrepl: rid=001 rc 21 retrying And here I tried to sync the schema specifically and it errors on not understanding the creatorsName, because the database that contains it hasn't been synced yet: May 26 14:58:10 ramones slapd[7260]: syncrepl_message_to_entry: rid=001 mods check (creatorsName: value #0 invalid per syntax) May 26 14:58:10 ramones slapd[7260]: do_syncrepl: rid=001 rc 21 retrying Here is a debug: ==> rewrite_context_apply [depth=1] string='olcDatabase={1}hdb,cn=config,cn=slave' ==> rewrite_rule_apply rule='(.*)cn=config,cn=slave$' string='olcDatabase={1}hdb,cn=config,cn=slave' [1 pass(es)] ==> rewrite_context_apply [depth=1] res={0,'olcDatabase={1}hdb,cn=config'} ber_scanf fmt ({mW}) ber: ber_dump: buf=0xb155b0 ptr=0xb16005 end=0xb16046 len=65 0000: 30 23 04 11 73 75 62 73 63 68 65 6d 61 53 75 62 0#..subschemaSub 0010: 65 6e 74 72 79 31 0e 04 0c 63 6e 3d 53 75 62 73 entry1...cn=Subs 0020: 63 68 65 6d 61 30 1a 04 0f 68 61 73 53 75 62 6f chema0...hasSubo 0030: 72 64 69 6e 61 74 65 73 31 07 04 05 46 41 4c 53 rdinates1...FALS 0040: 45 E ==> rewrite_context_apply [depth=1] string='cn=Subschema' ==> rewrite_rule_apply rule='(.*)cn=config,cn=slave$' string='cn=Subschema' [1 pass(es)] ==> rewrite_context_apply [depth=1] res={0,'cn=Subschema'} ber_scanf fmt ({mW}) ber: ber_dump: buf=0xb155b0 ptr=0xb1602a end=0xb16046 len=28 0000: 30 1a 04 0f 68 61 73 53 75 62 6f 72 64 69 6e 61 0...hasSubordina 0010: 74 65 73 31 07 04 05 46 41 4c 53 45 tes1...FALSE >>> dnPretty: <dc=savagebeast,dc=com> => ldap_bv2dn(dc=savagebeast,dc=com,0) <= ldap_bv2dn(dc=savagebeast,dc=com)=0 syncrepl_message_to_entry: rid=001 mods check (olcSuffix: value #0 invalid per syntax) ldap_msgfree And here is the consumer's olcDatabase={0}config.ldif before the sync starts-- dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config structuralObjectClass: olcDatabaseConfig entryUUID: 3ff5aef4-ff02-102f-8945-2f8fc203546c creatorsName: cn=admin,cn=config createTimestamp: 20110419185450Z olcRootDN: cn=admin,cn=config olcRootPW:: xxx olcSyncrepl: {0}rid=001 provider=ldaps://ldap.savagebeast.com binddn="cn= admin,cn=config,cn=slave" bindmethod=simple credentials=xxx searchbase="cn= config,cn=slave" type=refreshAndPersist retry="60 +" timeout=3 suffixmassage= "cn=config" schemachecking=off entryCSN: 20110420231921.726316Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20110420231921Z And here is the consumer's olcDatabase={0}config.ldif at the point it fails. dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config structuralObjectClass: olcDatabaseConfig entryUUID: 3ff5aef4-ff02-102f-8945-2f8fc203546c creatorsName: cn=admin,cn=config createTimestamp: 20110419185450Z olcRootDN: cn=admin,cn=config olcRootPW:: xxx olcUpdateRef: ldaps://ldap.savagebeast.com olcSyncrepl: {0}rid=001 provider=ldaps://guess-who.savagebeast.com binddn="cn= admin,cn=config,cn=slave" bindmethod=simple credentials=xxx searchbase="cn= config,cn=slave" schemachecking=off type=refreshAndPersist retry="60 +" timeo ut=3 suffixmassage="cn=config" entryCSN: 20110526212623.826014Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20110526212623Z -- and here it is on the provider dn: olcDatabase={0}config,cn=config,cn=slave objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: {SHA}/xxx olcSyncrepl: {0}rid=001 provider=ldaps://guess-who.savagebeast.com binddn="c n=admin,cn=config,cn=slave" bindmethod=simple credentials=xxx searchbase= "cn=config,cn=slave" schemachecking=off type=refreshAndPersist retry="60 +" timeout=3 suffixmassage="cn=config" olcUpdateRef: ldaps://ldap.savagebeast.com createTimestamp: 20110419185450Z creatorsName: cn=admin,cn=config entryCSN: 20110526212623.826014Z#000000#001#000000 entryDN: olcDatabase={0}config,cn=config,cn=slave entryUUID:: M2ZmNWFlZjQtZmYwMi0xMDJmLTg5NDUtMmY4ZmMyMDM1NDZj hasSubordinates: FALSE modifiersName: cn=admin,cn=config modifyTimestamp: 20110526212623Z structuralObjectClass: olcDatabaseConfig subschemaSubentry: cn=Subschema Thanks for reading this far down!

1 0

Syncrep size limit exceeded
by Darouichi, Aziz 26 May '11

26 May '11

Hi, After configuring Openldap -2.4.23 Multi-master Syncrep with TLS. Replication never completes, log shows slapd[13578]: do_syncrep2: rid=003 (4) Size limit exceeded. This is slapd.conf syncrepl rid=002 provider=ldap://xxx.xxx.xxx tls_cert=/etc/pki/tls/certs/ldapcert.pem tls_key=/etc/pki/tls/private/ldapkey.pem tls_cacert=/etc/pki/tls/certs/ldapcert.pem tls_reqcert=demand searchbase="dc=establishment,dc=edu" schemachecking=on timelimit=unlimited sizelimit=unlimited type=refreshAndPersist retry="60 +" Thanks,

3 2

OpenLdap Proxy for testing network behaviour
by Echedey Lorenzo 26 May '11

26 May '11

Hi, I need to simulate 3 OpenLdaps instances. I was thinking about using a proxy that could listen to 3 different ports and route all the packets to the the standard 389 in which OpenLdap is listening. The proxy should be capable of open/close these ports dinamically and also throw custom error codes. I would like someone to point me in the right direction to start working. Thanks a lot

2 2

Schemas design
by jm.rodriguez＠andaluciajunta.es 25 May '11

25 May '11

Hi, I have doubts when designing new schemes. What advantages and drawbacks exist when creating a new structural objectclass with attributes that inherit from other basic attributes or define auxiliary objectclass with attributes completely new ? Is it harmful to define new attributes or objectclass assigning oids? Thanks. -- Jose Manuel Rodriguez Caro jm.rodriguez(a)andaluciajunta.es

1 0

Openldap ssl with translucent proxy
by joaosf 24 May '11

24 May '11

Hi all, I'm trying to configure a ldap server proxy with overlay translucent, in this way I can add group's to users on the default Ldap Server. Everything is ok until I try to use the SSL: Ldap Server (solaris)<----(389 ldap)---> My Openladap proxy <------(389 ldap)---> Client (everything ok) When I try to use certificates and secure Ldap, I have a problem: Ldap Server (solaris)<----(389 ldap)---> My Openladap proxy <------(636 ldaps)---> Client (still ok) But I have no success when I try to configure the 636 ldaps between main Ldap server (on solaris) and my openldap proxy :( the answer is "No such user". My slapd.conf on my openldap proxy: database bdb suffix "dc=mycompany,dc=pt" rootdn "cn=Admin,dc=mycompany,dc=pt" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg rootpw {SSHA}blablabla overlay translucent #uri ldaps://solaris_ldap_server02:636 uri ldaps://solaris_ldap_server01:636 #uri ldap://solaris_ldap_server01 #uri ldap://solaris_ldap_server02 So, if I use the "uri ldap://solaris_ldap_server01" everything is ok and wonderful but if I want something more secure like "uri ldaps://solaris_ldap_server01:636" I got a "No such user" grrrrrr. The beautifull part is that I have all certificates and I can use wiht success the ldapsearch (636 ldaps) against the solaris_ldap_server from my openldap proxy and/or from my linux client, like: ldapsearch -H ldaps://solaris_ldap_server01:636 -x -b "dc=mycompany,dc=pt" And if I configure a Linux client to connect directly to Solaris Server on port 636 ldaps (without my proxy), everything is ok and no problem. When I put a tcpdump running on my Ldap Proxy the Solaris server answer with a "TLSv1 Record Layer: Alert (Level: Fatal, Description: Unknown CA)" but this is bull sheet, I have the correct certificate other way I was not able to do search querys. The big question is, why the "overlay translucent" (proxy) does not work on secure mode? what I'm doing wrong?

1 0

Re: (ITS#6666) Feature Request: Triggers implementation
by Buchan Milne 24 May '11

24 May '11

On Thursday, 7 October 2010 20:32:49 Nick Milas wrote: > It all started for me when I wanted to watch a serial number value from > an ldap-stored SOArecord (using powerdns with openldap backend) and when > it changes to fire a bash script. I reached the conclusion it was not > easy to be done with higher-level means within openldap and I created a > bash script which scans (using ldapsearch and other linux tools) the > SOArecords regularly (using cron) to find out if any change has happend > and do whatever is required. It would be much more elegant if I could > get a trigger from openldap when the SOArecord changes. Maybe you need this: http://memberwebs.com/stef/software/slapi-dnsnotify/ A more generic solution would be nice, but as far as I can tell, this software satisfies your current need. Regards, Buchan

7 18

Error updating entry with openldap 2.4.23
by JOSE L MARTINEZ-AVIAL 24 May '11

24 May '11

Hi all, I'm triying to update an entry, and it's failing. The server just crashes, so I started it with debug 4, and that's what I got: connection_get(15) conn=1002 op=2 do_modify: dn (cn=xxxxxxx,ou=External Users,dc=eco,dc=spb,dc=com) => ldap_bv2dn(cn=xxxxxxx,ou=External Users,dc=eco,dc=spb,dc=com,0) <= ldap_bv2dn(cn=xxxxxxx,ou=External Users,dc=eco,dc=spb,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=xxxxxxx,ou=External Users,dc=eco,dc=spb,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=xxxxxxx,ou=external users,dc=eco,dc=spb,dc=com)=0 conn=1002 op=2 modifications: add: displayName one value, length 19 add: mail one value, length 16 add: sAMAccountName one value, length 8 add: givenName one value, length 6 add: userPassword one value, length 10 add: objectclass multiple values add: sn one value, length 12 base_candidates: base: "cn=xxxxxxx,ou=external users,dc=eco,dc=spb,dc=com" (0x0000000d) send_ldap_result: err=0 matched="" text="" bdb_modify: cn=xxxxxxx,ou=External Users,dc=eco,dc=spb,dc=com bdb_modify_internal: add displayName slapd: attr.c:478: attr_merge: Assertion `( nvals == ((void *)0) && (*a)->a_nvals == (*a)->a_vals ) || ( nvals != ((void *)0) && ( ( (*a)->a_vals == ((void *)0) && (*a)->a_nvals == ((void *)0) ) || ( (*a)->a_nvals != (*a)->a_vals ) ) )' failed. Aborted The attribute displayName is defined as follows: attributetype ( 1.2.840.113556.1.2.13 NAME 'displayName' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE ) What am I doing wrong? Thanks. Jose

1 0

Get last SSL Error?
by Eric Nichols (DirWiz) 24 May '11

24 May '11

After attempting ldap_sasl_bind on a LDAPS connection I am trying to determine the return error message from openssl. I am using the following: ldap_get_option(ld,LDAP_OPT_X_TLS_SSL_CTX,&sslptr); rc=SSL_get_error(sslptr,ret); What I cannot find is how to populate 'ret' for the SSL_get_error function. Is the last return code from OpenSSL stored in OpenLDAP somewhere so I can get a clearer picture on an SSL connection failure? Many thanks in advance, Eric

1 0

Re: Need help to create a new DN "myNewDN: cn=testUser, ou=testOU, dc=test, dc=local"
by Mahmudur Rahman Jami 24 May '11

24 May '11

Hi Bill, May thanks for your reply. I am running an openldap server with around 12,000 users. I was looking to replace "dn:" with "myNewDN:". However, i have got the solution. I have added the following to schema, ### attributetype ( 1.3.6.1.4.1.XXXX.2.3.XXX NAME 'myNewDN' DESC 'Test DN replacement' SUP distinguishedName ) ## Cheers........JAMI. On Mon, May 23, 2011 at 5:31 PM, Bill MacAllister <whm(a)stanford.edu> wrote: > > > --On Monday, May 23, 2011 11:01:33 AM +1000 Mahmudur Rahman Jami < > infojami(a)gmail.com> wrote: > > Hi, >> >> I want to create a new distinguishedName as follows (NOT as "dn: >> cn=testUser,ou=testOU,dc=test,dc=local"), >> >> "myNewDN: cn=testUser,ou=testOU,dc=test,dc=local" >> >> I have got a ldif with similar definition to import. I googled and found >> lot >> of examples related to "attributetype" and "objectClass" only, not related >> to this. >> Any help will be highly appreciated. >> >> Thanks, >> Jami >> > > Assuming that the root of your directory is dc=test,dc=local then you > need to created an entry for ou=testOU before you attempt to create > the entry for cn=testUser. > > For example you might try: > > ldapadd -h somehost -b dc=test,dc=local<<EOF > dn: ou=testOU,dc=test,dc=local > objectClass: top > objectClass: organizationalUnit > ou: testOU > > > dn: cn=testUser,ou=testOU,dc=test,dc=local > objectclass: top > objectclass: person > cn: testUser > sn: Smith > EOF > > Of course, you will need to bind to the directory some credentials > that will allow you to write to the directory. > > Bill > > -- > > Bill MacAllister > Infrastructure Delivery Group, Stanford University > >

1 0

Need help to create a new DN "myNewDN: cn=testUser, ou=testOU, dc=test, dc=local"
by Mahmudur Rahman Jami 24 May '11

24 May '11

Hi, I want to create a new distinguishedName as follows (NOT as "dn: cn=testUser,ou=testOU,dc=test,dc=local"), "myNewDN: cn=testUser,ou=testOU,dc=test,dc=local" I have got a ldif with similar definition to import. I googled and found lot of examples related to "attributetype" and "objectClass" only, not related to this. Any help will be highly appreciated. Thanks, Jami

3 3

syncrepl unbinds every 24 hours
by Curt Blank 23 May '11

23 May '11

We're using openLDAP 2.3.43 on RedHat 5 ES with delta syncrepl, one master four consumers. Every 24 hours at the same time syncrepl on the four consumers disconnect from the master then don't reconnect for 60 seconds. We have retry=60 so we know that but the question is can this disconnect behavior be stopped completely? We have type=refreshAndPersist set, that to me means refresh and persist not refresh and persist for 24 hours. Data getting to the consumers is time sensitive to the point that 5 seconds might be too long and cause confusion for our users from an authentication standpoint. Is there any way to stop this syncrepl disconnect behavior? -- Curt Blank Systems Administrator Technical Services Specialist University Information Technology Services University of Wisconsin-Milwaukee e-mail: curt(a)uwm.edu phone : (414) 229-3814

3 2

TLS replication/SALS bindmethod
by Darouichi, Aziz 23 May '11

23 May '11

Hi, I configured Muti-master replication, everything worked fine till I hashed rootpw to confirm to a hardcoded password in Oracle. I configured OpenLDAP servers to us SALS. This is my configuration. provider=ldap://xxx.xxx.xxx:389 bindmethod=sasl saslmech=external starttls=yes tls_cert=/etc/pki/tls/certs/slapd.pem tls_key=/etc/pki/tls/private/ldap.pem tls_cacert=/etc/pki/tls/certs/ca-bundle.crt tls_reqcert=demand binddn="cn=ldap,dc=establishment,dc=edu" credentials={SSHA}2vNffW+5hEolqIykgH9tCpxq9jTTVSSu searchbase="dc=establishment,dc=edu" schemachecking=on type=refreshAndPersist retry="60 +" when I run ldapsearch against servers I get response from both machines. ldapsearch -H ldap://server.establishment.edu -D "cn=ldap,dc=establishment,dc=edu" -w "PASSWORD" -x -b "dc=establishment ,dc=edu" "(objectclass=*)" uid. This what I get in the logs: May 23 09:37:01 ldap1 slapd[1559]: slap_client_connect: URI=ldap://xxx.xxx.edu:389 ldap_sasl_interactive_bind_s failed (-6) May 23 09:37:01 ldap1 slapd[1559]: do_syncrepl: rid=002 rc -6 retrying May 23 09:37:58 ldap1 slapd[1559]: conn=5220 op=0 do_extended: unsupported operation "1.3.6.1.4.1.1466.20037" May 23 09:38:01 ldap1 slapd[1559]: slap_client_connect: URI=ldap://xxx.xxx.edu:389 Warning, ldap_start_tls failed (2) May 23 09:38:01 ldap1 slapd[1559]: slap_client_connect: URI=ldap://xxx.xxx.edu:389 ldap_sasl_interactive_bind_s failed (-6) May 23 09:38:01 ldap1 slapd[1559]: do_syncrepl: rid=002 rc -6 retrying Thanks

2 2

OpenLDAP Windows Compilation Failed
by mammar 23 May '11

23 May '11

Hi All, I am trying to compile the stable openldap-2.4.23 using the instructions mentioned in INSTALL file in the package. ./configure make depend The above two commands completed successfully make gives the following error Entering subdirectory libldap make[2]: Entering directory `/cygdrive/c/Documents and Settings/ma/Desktop/openldap-2.4.23/libraries/libldap' cc -g -O2 -I../../include -I../../include -c -o apitest.o apitest.c /bin/sh ../../libtool --mode=link cc -static -g -O2 -o apitest apitest.o libldap.la ../../libraries/liblber/liblber.la../../libraries/liblutil/liblutil.a -lsasl2 -lssl -lcrypto libtool: link: cannot find the library `Settings/ma/Desktop/openldap-2.4.23/libraries/liblber/liblber.la' or unhandled argument `Settings/ma/Desktop/openldap-2.4.23/libraries/liblber/ liblber.la' make[2]: *** [apitest] Error 1 make[2]: Leaving directory `/cygdrive/c/Documents and Settings/ma/Desktop/openldap-2.4.23/libraries/libldap' make[1]: *** [all-common] Error 1 make[1]: Leaving directory `/cygdrive/c/Documents and Settings/ma/Desktop/openldap-2.4.23/libraries' make: *** [all-common] Error 1 Can anyone suggest a solution/workaround? Regards,

1 0

Issue while Centralizing SUDO with OpenLDAP
by pradyumna dash 23 May '11

23 May '11

Hi, I am trying to acheive centralizing SUDO, but facing an issue,i suspect its something to do with sudoers.schema, May be am wrong. I think somehow the slapd process is not able to read it. Please suggest how to fix the issue. My LDAP structure is like : dc=example,dc=com Under this I have OU=People and i have created a OU called SUDOers. Then i have used the sudoers2ldif to generate the LDIF file for me. I have setted the env variable SUDOERS_BASE=ou=SUDOers,dc=example,dc=com. Then when am trying to add the ldif file it shows me below error. t710x02-6:/etc/openldap/schema # ldapadd -f /opt/newsudo.ldif -h 127.0.0.1 -D cn=Manager,dc=example,dc=com -W -x Enter LDAP Password: adding new entry "cn=defaults,ou=SUDOers,dc=example,dc=com" ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax sudoers.ldif dn: cn=defaults,ou=SUDOers,dc=example,dc=com #objectClass: top objectClass: sudoRole cn: defaults description: Default sudoOption's go here sudoOption: always_set_home sudoOption: env_reset sudoOption: env_keep = "LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS XDG_SESSION_COOKIE" sudoOption: targetpw dn: cn=ALL,ou=SUDOers,dc=example,dc=com objectClass: top objectClass: sudoRole cn: ALL sudoUser: ALL sudoHost: ALL sudoRunas: ALL sudoCommand: ALL dn: cn=root,ou=SUDOers,dc=example,dc=com objectClass: top objectClass: sudoRole cn: root sudoUser: root sudoHost: ALL sudoRunas: ALL sudoCommand: ALL dn: cn=prad,ou=SUDOers,dc=example,dc=com objectClass: top objectClass: sudoRole cn: prad sudoUser: prad sudoHost: ALL sudoRunas: ALL sudoCommand: ALL sudoers.schema # # OpenLDAP schema file for Sudo # Save as /etc/openldap/schema/sudo.schema # attributetype ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Command(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s) impersonated by sudo (deprecated)' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Options(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.6 NAME 'sudoRunAsUser' DESC 'User(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.7 NAME 'sudoRunAsGroup' DESC 'Group(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) objectclass ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top STRUCTURAL DESC 'Sudoer Entries' MUST ( cn ) MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoRunAsUser $ sudoRunAsGroup $ sudoOption $ description ) ) Please help me to solve this issue. I am using SLES 11 and SUDO 1.6.9p17 Regards, Neo

3 3

Slapd, GNUTLS on Debian/Squeeze
by David Dumortier 23 May '11

23 May '11

Hi everybody, I try to setup a slapd with TLS. ldd /usr/sbin/slapd returns gnutls.so as waited. I generated a self-signed certificate with these options : certtool --generate-privkey --outfile /etc/ldap/ssl/mykey.key certtool --generate-request --load-privkey /etc/ldap/ssl/mykey.key --outfile /etc/ldap/ssl/mycsr.csr Basic Constraints (critical): Certificate Authority (CA): TRUE Key Purpose (not critical): TLS WWW Client. TLS WWW Server. Code signing. OCSP signing. Time stamping. Key Usage (critical): Digital signature. Key encipherment. Certificate signing. CRL signing. My slapd start but when I try a debug I have : # gnutls-cli-debug -p 636 myip Checking for TLS 1.1 support... no Checking fallback from TLS 1.1 to... failed Checking for TLS 1.0 support... no Checking for SSL 3.0 support... no Server does not support any of SSL 3.0, TLS 1.0 and TLS 1.1 Here is my slapd conf : olcTLSVerifyClient: demand olcTLSCertificateFile: /etc/ldap/ssl/mycsr.csr olcTLSCertificateKeyFile: /etc/ldap/ssl/mykey.key Any help would be appreciate -- David Dumortier

5 12

smbk5pwd tries to load krb when not configured
by Mike Noordermeer 22 May '11

22 May '11

Hi, I'm running slapd v2.4.23 with a cn=config configuration format. The LDAP tree both has the Kerberos as well as the Samba scheme loaded. I'm trying to setup smbk5pwd to sync Samba passwords with the LDAP passwords. Note that I do not want to do anything with the Kerberos passwords. I use the following configuration snippet: dn: olcOverlay={2}smbk5pwd objectClass: olcOverlayConfig objectClass: olcSmbK5PwdConfig olcOverlay: {2}smbk5pwd olcSmbK5PwdEnable: samba olcSmbK5PwdMustChange: 0 This leads to an error in the logs and the module not loading: May 22 11:02:55 host slapd[3160]: smbk5pwd: unable to initialize krb5 admin context: failed to open /var/lib/heimdal-kdc/m-key: Permission denied (13). Seems like smbk5pwd still wants to load the Kerberos stuff... Any ideas? -- tia, Mike Noordermeer mike(a)normi.net

1 0

SSL Connect Error message?
by Eric Nichols (DirWiz) 21 May '11

21 May '11

I checked through the archives and couldn't find a real mention of this. When a failed connection happens over SSL (OpenSSL) the most information I can get back is what ldap_err2string returns. The problem is I don't know if it's a true connection failure or a SSL session error or even a certificate error. Is there a way to get more useful information out of a failed SSL connection. I do know about LDAP_OPT_X_TLS_SSL_CTX but can't figure out if that points to an error message somewhere. -- Many thanks Eric

1 0

Can a Shadow Server "Proxy" UpdateRef?
by Ben Rockwood 20 May '11

20 May '11

I want to shadow my directory into multiple locations. I'd like to use updateref to provide a way to make writes back to the master. The problem is that updateref hands a new LDAP URI back to the client who then tries to connect to the appropriate server... this is a problem if the client does not have access to connect directly to the referred server. In my case the shadow server has access to the master but the clients do not (private subnet). Is there a way for the shadow server to send the write operation to the master itself, as though its proxying it, rather than returning a referral to the client? benr.

2 2

Objects that have no objectClass ?
by Torsten Schlabach (Tascel eG) 20 May '11

20 May '11

Hi all! I am querying an Active Directory, using the ldapsearch utility provided by OpenLDAP. Normally, for each entry that ldapsearch returns, I am used to finding at least one line which starts with dn: and one (or more) which start with objectClass:. This is the case for the majority of the objects which I can find in the given AD tree, but I can spot at least one which does have a dn: and a couple of other attributed (in other words: the entry exists) but just no objectClass. Any idea how this is possible? Regards, Torsten

2 1

Re: MirrorMode vs MultiMaster Questions
by Ben Rockwood 20 May '11

20 May '11

Looking even more at the code and the commit history, it turns out that in 2006 when MirrorMode was added it was in fact called "multimaster"... the name was simply changed to mirrormode later with no major changes to the code. So, it really looks like MirrorMode is MultiMaster, the only difference being a 2 node multimaster shadows only its peer, whereas a 3+ node multimaster shadows multiple. This is perhaps best seen in the modify code, where if the configuration is not SINGLE_SHADOW (ie: MultiMaster) it passes a referral instead of accepting the operation. Therefore, the language in the docs is more specific than I realized. "Active/Active MirrorMode" and "N-Way MultiMaster" are accurate and if you omit them you miss the point. The real point here is that in MirrorMode you're told to only send writes to a single node. I want a 2-Way Multimaster in which I can send writes to either. And it in practice you can, but you're not (according to the docs) supposed to. Its like the authors didn't trust their own synchronization code. I can only infer that there might be problems in high write environments to 2 nodes... from which I further infer that for environments using LDAP for NIS-Replacement where writes are very rare its not a practical problem. In this type of setup I just want basic HA, I don't want load balancers and multiple shadows, just 2 slapds in A/A config. benr. On 5/16/11 2:32 AM, Marcel van Dorp wrote: > Hi, > > I'm investigating the same thing. I found some interesting docs on > www.zytrax.com/books/ldap > > On 05/16/2011 10:24 AM, Ben Rockwood wrote: > > I'm having some problems understanding the subtleties of MirrorMode vs > > MultiMaster configurations. Any help with the following questions would > > be helpful: > > > 1) It looks like the only real difference between a MirrorMode and > > Multimaster configuration is whether or not the RIDs are different. In > > MirrorMode both sides have the same rid, in Multimaster they are > > different. Is that so? > > - From what I understand, with mirrormode=FALSE the consumers are > readonly, and updates are referred back to the provider. > > with mirrormode=TRUE, the consumers are mirrors of the provider, and > updates can be processed locally. The multimaster config (using > syncrepl) then updates all other masters. > > > > 2) Passing through the code, "MirrorMode" is really "Single Master" and > > MultiMaster is just "not Single Master". But the code path to determine > > whether it is single master or not confuses me. How does slapd actually > > determine this? > > > During startup, the deamon is provided with the URI to listen on. I'm on > Debian, where this is configured in /etc/default/slapd. Doing a 'ps ax > |grep slapd' shows this: > > 7741 ? Ssl 0:00 /usr/sbin/slapd -h ldap://127.0.0.1:389/ > ldap://hostname.domain.com/ ldaps://hostname.domain.com/ ldapi:/// -g > openldap -u openldap -F /etc/ldap/slapd.d/ > > The serverID also refers to this URI, to determine the local process > (after all, serverIDs will also be syncrepl'd): > > olcServerID: 11 ldaps://hostname.domain.com/ > olcServerID: 12 ldaps://another.domain.com/ > olcServerID: 13 ldaps://thirdhost.domain.com/ > > > > > 3) For MultiMaster, the docs show using syncrepl to replicate cn=config > > and the directory (or directories if you have more than one) > > independently. Is it really necessary to replicate cn=config if the > > configuration isn't changing? (What I'm really looking for here is to > > find out if there is state information in cn=config thats being used or > > if its simply a good idea to ensure the configs are the same by using > > syncrepl.) > > > The main issue for me, is that I need to have the ACLs in sync, and > those are in cn=config. I'm still working on this, so please bear with > me if above info is not completely correct. > > Regards, > > Marcel > > > > Thanks, > > > benr. > > >

3 2

one-to-many rwm objectclass map
by Ron Peterson 19 May '11

19 May '11

I'm trying to map a single objectclass to more than one objectclass using the rwm overlay. e.g. myclass -> inetOrgPerson -> eduPerson ...because 'myclass' contains some attributes I want to rewrite to attributes belonging to inetOrgPerson, and some attributes I want to rewrite to attributes belonging to eduPerson. The attribute rewriting seems to happen OK even if the resultant object presented by back-ldap doesn't include an objectclass that includes the relevant attributes, but I'd prefer to present something that appears more strictly correct. Is there another overlay I should use instead? I control the source directory, so one workaround would be to simple add some dummy objectclasses to my original objects. Then I could do something like: rwm-map objectClass inetOrgPerson myclass rwm-map objectClass eduPerson dummyclass Is there a better way? TIA -- Ron Peterson Network & Systems Administrator Mount Holyoke College http://www.mtholyoke.edu/~rpeterso

1 0

LDAP startTLS is taking time
by Sayantan Ray 18 May '11

18 May '11

Hi, During initial communication setup with LDAP server with TLS on we are doing: ldap_initialize() ldap_set_option() ldap_start_tls_s() ldap_sasl_bind_s() and We are running the LDAP server remotely We observed that ldap_start_tls_s() is taking around 15 sec time to execute. Anybody has any idea why this is taking this much time? Please help Thanks, Sayantan Ray

2 1

Restricted Active Directory Proxy for SaaS Vendors
by Nanoic Dalflanlun 18 May '11

18 May '11

I am trying to setup an OpenLDAP server in my DMZ to proxy requests from Software as a Service vendors to my internal Active Directory domain. Specifically, I want to disallow anonymous access; make access read only; and restrict access to return only displayName, distinguishedName, mail, proxyAddresses, member, memberOf, mailNickname, and homeMDB. I also need to provide authentication capability for single sign on at the vendor. I don't think I have a proper understanding of OpenLDAP's ACLs, yet, so I am probably missing some things. I may even be approaching this completely wrong. I suspect I need to add "auth" access somewhere. Currently, I receive "result: 50 Insufficient access" when I try to query the OpenLDAP server. I don't have an authentication trace yet from the SaaS vendor, but it if it work like Cisco Ironport, it will try to bind to the LDAP server using the user's supplied credentials and look for a success, then switch back to using the LDAP query account. Thanks for any assistance, Nanoic -------------------------Begin slapd.conf------------------------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/saas.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args logfile /var/log/openldap.log loglevel none #Disallow anonymous binds disallow bind_anon #### Define access to Active Directory database ldap # Set proxy to read-only readonly on suffix "dc=example,dc=com" rootdn "dc=example,dc=com" rebind-as-user #List domain controllers to access. ldap for non-SSL/debug & ldaps for SSL/production uri "ldap://DomainController1" uri "ldap://DomainController2" lastmod off # set chase-referrals to no to keep from querying all DCs chase-referrals no ### access lists # Allow defined access to Active Directory, deny all others. access to dn.subtree="dc=example,dc=com" attrs=displayName,distinguishedName,mail,proxyAddresses,member,mailNickname,homeMDB by dn.exact="CN=saasqueryacct,OU=Service Accounts,DC=example,DC=com" read by * none # Deny access to all undefined resources by all undefined users access to * by * none -------------------------End slapd.conf------------------------- -------------------------Begin saas.schema------------------------- attributetype ( 1.2.840.113556.1.2.210 NAME 'proxyAddresses' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' ) attributetype ( 1.2.840.113556.1.2.244 NAME 'homeMDB' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' ) attributetype ( 1.2.840.113556.1.2.447 NAME 'mailNickname' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' ) -------------------------End saas.schema-------------------------

1 0

problem making a copy of ldap
by deconya 17 May '11

17 May '11

Hi guys I'm making a openldap slave server of my PDC server and I installed ubuntu 9.04 with openldap 2.4.15. I just copy /etc/ldap/ and I check it, but fails when starts. Logs (syslog) said: slapd[30344]: @(#) $OpenLDAP: slapd 2.4.15 (Jul 30 2010 00:41:48) $ ^Ibuildd@palmer:/build/buildd/openldap-2.4.15/debian/build/servers/slapd slapd[30344]: config error processing olcOverlay={0}syncprov,olcDatabase={0}config,cn=config: slapd[30344]: slapd stopped. slapd[30344]: connections_destroy: nothing to destroy. I check all permissions and are the same of my PDC server. Any guide to make it correctly? Thanks And best Regards

2 4

authentication problem
by Mohammad D 17 May '11

17 May '11

Hi all I have installed openldap 2.4.23 on windows server 2003. when I run this query on ldapsearch: ldapsearch -h directory.verisign.com -b "cn=<*>" "(o=*)" "certificaterevocationlist" I get the following error: SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: I installed MIT kerberos but it did not solve the problem. any one know whats the issue and how can it be solved?

5 8

AD and Openldap integration
by Darouichi, Aziz 17 May '11

17 May '11

Hi, We are in the final stage of single sign on project. We are looking to integrate Active directory with LDAP. But our MS Domain ppolicy is different than LDAP ppolicy. My question is do the policies have to be identical for the integration to work? Thanks, Aziz

1 0

LDAP with Canon IRC2380
by Metropolitan College <Eric Kom> 17 May '11

17 May '11

Hi all! Please I wanna know if it's possible to bind OpenLDAP server to Canon Printer machine so users can authenticate before use? -- -- YouTruly Eric Kom System Administrator - Metropolitan College 2 Hennie Van Till, White River, 1240 erickom(a)kom.za.net | erickom(a)namekom.co.za | erickom(a)erickom.co.za www.kom.za.net | www.kom.za.org | www.erickom.co.za Key fingerprint: 513E E91A C243 3020 8735 09BB 2DBC 5AD7 A9DA 1EF5

2 1

Re: overlay memberof fails
by JOSE L MARTINEZ-AVIAL 17 May '11

17 May '11

Never mind, I just need to compile it using ./configure --enable-memberof, and that solved the problem. Thanks! 2011/5/16 Quanah Gibson-Mount <quanah(a)zimbra.com> > > > --On May 16, 2011 6:17:37 PM -0400 JOSE L MARTINEZ-AVIAL <jlmagc(a)gmail.com> > wrote: > > I did that, and the problem is that I compiled openldap without enabling >> the modules. The issue now is that it fails to compile when I enable the >> modules because libtools-ldtd is not installed, and that seems to be >> related with the fact the I use RHEL4, which doesn't include that library. >> > > So download and build it yourself. ;) > > > --Quanah > > > -- > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

1 1

overlay memberof fails
by JOSE L MARTINEZ-AVIAL 17 May '11

17 May '11

Hi, I've built openldap2.4.23 in my RHEL4, and it works fine. I'm able to do queries, updates, etc. But when I try to use the overlay memberof, the server does not start. It doesn't give any error message, it just fails to start. It works if I put the moduleload memberof.la, but the moment I add the overlay memberof, it just doesn't work. Any ideas about what I'm doing wrong? Thanks Jose Luis

2 3

Storing secondary gid's in openldap
by Mauro Parra 16 May '11

16 May '11

Hello, Do know of any manual/howto/doc about how to configure linux gid's thru openldap? This is, my openldap tree assigns different groups to my linux user, then i run: $ id uid=1000(mauro) gid=1000(mauro) groups=4(adm),20(dialout),24(cdrom),44(video),46(plugdev),104(lpadmin),115(admin),120(sambashare),1000(mauro) and i get all the groups I'm part of. But, I repeat the operation: $ id uid=1000(mauro) gid=1000(mauro) and I just lost all the secondary groups. All this with SLES9+openldap 2.2.3-43. Thanks in advance, Mauro -- Saludos, Mauro Parra-Miranda Consultor Senior Novell - mparra(a)novell.com openSUSE Developer - mauro(a)openSUSE.org BB PIN - 22600AE9

2 1

Re: Auth problem with openldap and nss_ldap
by Johnny PINSON 16 May '11

16 May '11

Hye, problem has been solved, thank you. Since I was using slackware without PAM, I wasn't able to auth as an ldap user. nsswitch.conf was good, nss_ldap was installed but I needed PAM for the auth part. After installing PAM and having it configured, auth is working. I now need to recompile most of my files in order to get su, ssh and other programs to work with LDAP auth (and PAM). Thank you, Johnny PINSON Le 05/10/2011 03:01 PM, Johnny PINSON a écrit : > Hey, > > I installed an openldap client and nss_ldap on a linux computer running > slackware. Then I modified /etc/nsswitch.conf, adding ldap to authentify > thanks a ldap server. > > The commands "getent password" and "id" are working. When I'm root and > doing a "su $user", I'm able to su as $user. But, if I try to log in as > $user, I get everytime an "invalid password". > > What can I do please to get i working? Would you need copy of my config > files? > > Thanks a lot, > > Johnny PINSON > >

1 0

MirrorMode vs MultiMaster Questions
by Ben Rockwood 16 May '11

16 May '11

I'm having some problems understanding the subtleties of MirrorMode vs MultiMaster configurations. Any help with the following questions would be helpful: 1) It looks like the only real difference between a MirrorMode and Multimaster configuration is whether or not the RIDs are different. In MirrorMode both sides have the same rid, in Multimaster they are different. Is that so? 2) Passing through the code, "MirrorMode" is really "Single Master" and MultiMaster is just "not Single Master". But the code path to determine whether it is single master or not confuses me. How does slapd actually determine this? 3) For MultiMaster, the docs show using syncrepl to replicate cn=config and the directory (or directories if you have more than one) independently. Is it really necessary to replicate cn=config if the configuration isn't changing? (What I'm really looking for here is to find out if there is state information in cn=config thats being used or if its simply a good idea to ensure the configs are the same by using syncrepl.) Thanks, benr.

2 1

Administrator for groups OpenLDAP with Samba Admins
by Juan Diego Calle 16 May '11

16 May '11

Hi, For weeks I have being reading about openldap, in the mailing lists, etc. Basically I have Samba with ldap and I need a GUI to administrate the users(I can use smbldap-tools and a shell, but not some of the administrators). I installed phpldapadmin, and I can log in with the user "Administrator", but I can change, remove or add any user or anything. I have read about people that have similar configurations to mine and solve this problem. Besides the user interface everything seems to work fine, the machines are logged to the domain, the samba server is a PDC. As far as I understand I need to create an ACL in /etc/openldap/slapd.conf for the group that is going to administrate, and the problem is because I am trying to grant permisions to the Group "Domain Admins", and domain admins is more like samba group. So far I can figure out why is not working the stuff I try, but I dont know how to fix it. It has to do with the objectclass. One of my ideas was to create an extra group, just for administrators, and called something like bofhs. I used this as a reference http://www.openldap.org/faq/data/cache/52.html dn: cn=bofh,dc=mydomain,dc=com,dc=ec cn: bofhs objectclass: groupofNames member: cn=administrator,dc=mydomain,dc=com,dc=ec Can I add something to the "Domain Admins" group so they can change data. But i had problems creating this group, didnt work, in some examples they use ou=Group, I dont understand what the ou thing does. Here is a sample of a backup of the ldap db, dn: dc=mydomain,dc=com,dc=ec objectClass: dcObject objectClass: organization o: Company dc: mydomain structuralObjectClass: organization entryUUID: 9c8201ce-ccc9-102f-9758-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210326Z entryCSN: 20110214210326Z#000000#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210326Z dn: cn=Manager,dc=mydomain,dc=com,dc=ec objectClass: organizationalRole cn: Manager structuralObjectClass: organizationalRole entryUUID: 9c82917a-ccc9-102f-9759-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210326Z entryCSN: 20110214210326Z#000001#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210326Z dn: ou=People,dc=mydomain,dc=com,dc=ec objectClass: top objectClass: organizationalUnit ou: People structuralObjectClass: organizationalUnit entryUUID: b071f8b0-ccc9-102f-975a-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210400Z entryCSN: 20110214210400Z#000000#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210400Z dn: ou=Group,dc=mydomain,dc=com,dc=ec objectClass: top objectClass: organizationalUnit ou: Group structuralObjectClass: organizationalUnit entryUUID: b0727074-ccc9-102f-975b-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210400Z entryCSN: 20110214210400Z#000001#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210400Z dn: ou=Computers,dc=mydomain,dc=com,dc=ec objectClass: top objectClass: organizationalUnit ou: Computers structuralObjectClass: organizationalUnit entryUUID: b072cd3a-ccc9-102f-975c-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210400Z entryCSN: 20110214210400Z#000002#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210400Z dn: ou=Idmap,dc=mydomain,dc=com,dc=ec objectClass: top objectClass: organizationalUnit ou: Idmap structuralObjectClass: organizationalUnit entryUUID: b07343a0-ccc9-102f-975d-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210400Z entryCSN: 20110214210400Z#000003#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210400Z dn: uid=Administrator,ou=People,dc=mydomain,dc=com,dc=ec cn: Administrator sn: Administrator objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: sambaSamAccount objectClass: posixAccount objectClass: shadowAccount gidNumber: 0 uid: Administrator uidNumber: 0 homeDirectory: /home/Administrator sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 sambaHomePath: \\IESS\Administrator sambaHomeDrive: H: sambaProfilePath: \\IESS\profiles\Administrator sambaPrimaryGroupSID: S-1-5-21-2323392562-1448967901-2038806033-512 sambaSID: S-1-5-21-2323392562-1448967901-2038806033-500 loginShell: /bin/false gecos: Netbios Domain Administrator structuralObjectClass: inetOrgPerson entryUUID: b0739f26-ccc9-102f-975e-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210400Z sambaLMPassword: 71DAB35FA93A2AB817306D272A9441BB sambaAcctFlags: [U] sambaNTPassword: AB9EA058E462D1881CD7AAC70FC462F2 sambaPwdLastSet: 1305237753 sambaPwdMustChange: 1309125753 userPassword:: e1NTSEF9Mnl6SUJjNTZEN1AxaW5oVmhFaE05dWtLNE1CdGR6Tkw= shadowLastChange: 15106 shadowMax: 45 entryCSN: 20110512220224Z#000001#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110512220224Z dn: uid=nobody,ou=People,dc=mydomain,dc=com,dc=ec cn: nobody sn: nobody objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: sambaSamAccount objectClass: posixAccount objectClass: shadowAccount gidNumber: 514 uid: nobody uidNumber: 999 homeDirectory: /dev/null sambaPwdLastSet: 0 sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 sambaPwdMustChange: 2147483647 sambaHomePath: \\IESS\nobody sambaHomeDrive: H: sambaProfilePath: \\IESS\profiles\nobody sambaPrimaryGroupSID: S-1-5-21-2323392562-1448967901-2038806033-514 sambaLMPassword: NO PASSWORDXXXXXXXXXXXXXXXXXXXXX sambaNTPassword: NO PASSWORDXXXXXXXXXXXXXXXXXXXXX sambaAcctFlags: [NUD ] sambaSID: S-1-5-21-2323392562-1448967901-2038806033-2998 loginShell: /bin/false structuralObjectClass: inetOrgPerson entryUUID: b07615da-ccc9-102f-975f-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210400Z entryCSN: 20110214210400Z#000005#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210400Z dn: cn=Domain Admins,ou=Group,dc=mydomain,dc=com,dc=ec objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 512 cn: Domain Admins memberUid: Administrator description: Netbios Domain Administrators sambaSID: S-1-5-21-2323392562-1448967901-2038806033-512 sambaGroupType: 2 displayName: Domain Admins structuralObjectClass: posixGroup entryUUID: b0769776-ccc9-102f-9760-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210400Z entryCSN: 20110214210400Z#000006#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210400Z dn: cn=Domain Users,ou=Group,dc=mydomain,dc=com,dc=ec objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 513 cn: Domain Users description: Netbios Domain Users sambaSID: S-1-5-21-2323392562-1448967901-2038806033-513 sambaGroupType: 2 displayName: Domain Users structuralObjectClass: posixGroup entryUUID: b07735b4-ccc9-102f-9761-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210400Z memberUid: user1 memberUid: user2 memberUid: user3 entryCSN: 20110511142120Z#000002#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110511142120Z dn: cn=Domain Guests,ou=Group,dc=mydomain,dc=com,dc=ec objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 514 cn: Domain Guests description: Netbios Domain Guests Users sambaSID: S-1-5-21-2323392562-1448967901-2038806033-514 sambaGroupType: 2 displayName: Domain Guests structuralObjectClass: posixGroup entryUUID: b077a364-ccc9-102f-9762-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210400Z entryCSN: 20110214210400Z#000008#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210400Z dn: cn=Domain Computers,ou=Group,dc=mydomain,dc=com,dc=ec objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 515 cn: Domain Computers description: Netbios Domain Computers accounts sambaSID: S-1-5-21-2323392562-1448967901-2038806033-515 sambaGroupType: 2 displayName: Domain Computers structuralObjectClass: posixGroup entryUUID: b0781966-ccc9-102f-9763-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210400Z entryCSN: 20110214210400Z#000009#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210400Z dn: cn=Administrators,ou=Group,dc=mydomain,dc=com,dc=ec objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 544 cn: Administrators description: Netbios Domain Members can fully administer the computer/sambaDom ainName sambaSID: S-1-5-32-544 sambaGroupType: 5 displayName: Administrators structuralObjectClass: posixGroup entryUUID: b07892b0-ccc9-102f-9764-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210400Z entryCSN: 20110214210400Z#00000a#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210400Z dn: cn=Account Operators,ou=Group,dc=mydomain,dc=com,dc=ec objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 548 cn: Account Operators description: Netbios Domain Users to manipulate users accounts sambaSID: S-1-5-32-548 sambaGroupType: 5 displayName: Account Operators structuralObjectClass: posixGroup entryUUID: b07907c2-ccc9-102f-9765-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210400Z entryCSN: 20110214210400Z#00000b#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210400Z dn: cn=Print Operators,ou=Group,dc=mydomain,dc=com,dc=ec objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 550 cn: Print Operators description: Netbios Domain Print Operators sambaSID: S-1-5-32-550 sambaGroupType: 5 displayName: Print Operators structuralObjectClass: posixGroup entryUUID: b079790a-ccc9-102f-9766-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210400Z entryCSN: 20110214210400Z#00000c#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210400Z dn: cn=Backup Operators,ou=Group,dc=mydomain,dc=com,dc=ec objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 551 cn: Backup Operators description: Netbios Domain Members can bypass file security to back up files sambaSID: S-1-5-32-551 sambaGroupType: 5 displayName: Backup Operators structuralObjectClass: posixGroup entryUUID: b079eab6-ccc9-102f-9767-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210400Z entryCSN: 20110214210400Z#00000d#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210400Z dn: cn=Replicators,ou=Group,dc=mydomain,dc=com,dc=ec objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 552 cn: Replicators description: Netbios Domain Supports file replication in a sambaDomainName sambaSID: S-1-5-32-552 sambaGroupType: 5 displayName: Replicators structuralObjectClass: posixGroup entryUUID: b07a6950-ccc9-102f-9768-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210400Z entryCSN: 20110214210400Z#00000e#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210400Z dn: sambaDomainName=IESS,dc=mydomain,dc=com,dc=ec structuralObjectClass: sambaDomain entryUUID: b07ad228-ccc9-102f-9769-316f6ec95723 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210400Z sambaPwdHistoryLength: 0 sambaLockoutThreshold: 0 sambaMaxPwdAge: -1 gidNumber: 1000 uidNumber: 1000 objectClass: top objectClass: sambaDomain objectClass: sambaUnixIdPool sambaSID: S-1-5-21-2323392562-1448967901-2038806033 sambaNextRid: 1000 sambaDomainName: IESS entryCSN: 20110512220215Z#000000#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110512220215Z dn: uid=user1,ou=People,dc=mydomain,dc=com,dc=ec objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSamAccount cn: user1 sn: user1 givenName: user1 uid: user1 uidNumber: 1002 gidNumber: 513 homeDirectory: /home/user1 loginShell: /bin/false gecos: System User userPassword:: e2NyeXB0fXg= structuralObjectClass: inetOrgPerson entryUUID: e660228a-ccc9-102f-9447-ffc7e9a6c1f6 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210530Z sambaPwdLastSet: 0 sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 sambaPwdMustChange: 2147483647 displayName: rloor sambaAcctFlags: [UX] sambaSID: S-1-5-21-2323392562-1448967901-2038806033-3004 sambaLMPassword: XXX sambaPrimaryGroupSID: S-1-5-21-2323392562-1448967901-2038806033-513 sambaNTPassword: XXX sambaLogonScript: logon.bat sambaHomePath: \\IESS\user1 sambaHomeDrive: H: entryCSN: 20110214210530Z#000006#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210530Z dn: uid=user2,ou=People,dc=mydomain,dc=com,dc=ec objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSamAccount cn: user2 sn: user2 givenName: user2 uid: user2 uidNumber: 1003 gidNumber: 513 homeDirectory: /home/user2 loginShell: /bin/false gecos: System User userPassword:: e2NyeXB0fXg= structuralObjectClass: inetOrgPerson entryUUID: e692c104-ccc9-102f-9448-ffc7e9a6c1f6 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210530Z sambaPwdLastSet: 0 sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 sambaPwdMustChange: 2147483647 displayName: user2 sambaAcctFlags: [UX] sambaSID: S-1-5-21-2323392562-1448967901-2038806033-3006 sambaLMPassword: XXX sambaPrimaryGroupSID: S-1-5-21-2323392562-1448967901-2038806033-513 sambaNTPassword: XXX sambaLogonScript: logon.bat sambaHomePath: \\IESS\user2 sambaHomeDrive: H: entryCSN: 20110214210530Z#00000b#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110214210530Z dn: uid=user3,ou=People,dc=mydomain,dc=com,dc=ec objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSamAccount cn: user3 sn: user3 givenName: user3 uid: user3 uidNumber: 1204 gidNumber: 513 homeDirectory: /home/user3 loginShell: /bin/false gecos: System User structuralObjectClass: inetOrgPerson entryUUID: e6c4c500-ccc9-102f-9449-ffc7e9a6c1f6 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110214210531Z sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 displayName: user3 sambaSID: S-1-5-21-2323392562-1448967901-2038806033-3008 sambaPrimaryGroupSID: S-1-5-21-2323392562-1448967901-2038806033-513 sambaLogonScript: logon.bat sambaHomePath: \\IESS\user3 sambaHomeDrive: H: sambaLMPassword: 57D26D340E8A2411AAD3B435B51404EE sambaAcctFlags: [U] sambaNTPassword: 79715183CF6136D501018FF3F5C381E4 sambaPwdLastSet: 1297878031 sambaPwdMustChange: 1301766031 userPassword:: e1NTSEF9MXQ3dHJoWUxRT05hUnFuQWQ0N3A5QTAwQUNkR05tZGg= shadowLastChange: 15021 shadowMax: 45 entryCSN: 20110216174031Z#000003#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec modifyTimestamp: 20110216174031Z And here is my slapd.conf, I erased the acls I created to test most of it, none worked. # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath /usr/lib64/openldap # Modules available in openldap-servers-overlays RPM package # Module syncprov.la is now statically linked with slapd and there # is no need to load it here # moduleload accesslog.la # moduleload auditlog.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload smbk5pwd.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # modules available in openldap-servers-sql RPM package: # moduleload back_sql.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! #access to * # by self write # by users read # by anonymous auth #access to attrs=userpassword # by self =xw # by anonymous auth by anonymous auth #access to * # by self write # by users read access to attrs=userpassword by self write by anonymous auth by * none access to * by self write by users read by anonymous read by * none access to * by uid=Administrator,ou=People,dc=mydomain,dc=com,dc=ec write #access to dn.regex = "ou = personal_addressbook or =(.+),, dc = korrigan, dc = org" #by dn.regex="cn=$1,ou=Users,dc=korrigan,dc=org" write by dn.regex = "cn = $ 1, ou = Users, dc = korrigan, dc = org" write #by dn="cn=admin,dc=korrigan,dc=org" write by dn = "cn = admin, dc = korrigan, dc = org" write #by * none by * none ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=mydomain,dc=com,dc=ec" rootdn "cn=Manager,dc=mydomain,dc=com,dc=ec" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXX # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM # Extras para ser servidor master de ldap loglevel 256 Sorry for the long email. JDC

2 1

pwdInHistory question
by Bidwell, Matt 13 May '11

13 May '11

I'm running OpenLDAP 2.5.24 on 2 servers. I'm trying to enforce some security rules on client machines through the ppolicy overlay. All the lockout stuff works fine. I understand that pwdMinLength will not work by design because the password is hashed. I can't get pwdInHistory to work. If I set it to 5 I clearly see 5 pwdHistory entries, all hashed {crypt}, but I can go back and forth between two passwords without it rejecting them for being reused. My current theory is that it's not looking at the actual password to prevent reuse, but the hashed password, which is not going to be the same. Should it be working? Follow up question, shouldn't the password be stored {SSHA} and not {CRYPT} by default? Just to be clear, the password is being set on the client machine using passwd, not on the servers running OpenLDAP. Matt

4 4

Replication OpenLDAP...
by Nguyen, Quoc Khanh 13 May '11

13 May '11

Hi all, I'm setting up a Master and Slave OpenLDAP (ver. 2.4.25) use Replication method following https://help.ubuntu.com/community/OpenLDAPServer. When i used slapdcat (slapdcat -l master_dump.ldif), I got a messeage: root@ldap:/usr/local/openldap/sbin# ./slapcat -l master_dump.ldif /usr/local/openldap/etc/openldap/slapd.conf: line 89: keyword is obsolete (ignored) /usr/local/openldap/etc/openldap/slapd.conf: line 91: keyword is obsolete (ignored) bdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/openldap/var/openldap-data: (2). Expect poor performance for suffix "dc=abc,dc=com". bdb_monitor_db_open: monitoring disabled; configure monitor database to enable What i'm doing wrong? Please help... My Master slapd.conf is: # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! # CA signed certificate and server cert entries: TLSCipherSuite HIGH:MEDIUM:+SSLv3 TLSCACertificateFile /var/myCA/cacert.crt TLSCertificateFile /var/myCA/master_ldap_crt.pem TLSCertificateKeyFile /var/myCA/master_ldap_key.pem # Use the following if client authentication is required #TLSVerifyClient demand # ... or not desired at all TLSVerifyClient never ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=abc,dc=com" rootdn "cn=rootldap,dc=abc,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw 123456789 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/openldap/var/openldap-data # Indices to maintain index objectClass eq index uid eq index cn,gn,mail eq,sub index sn eq,sub index ou eq replogfile /usr/local/openldap/var/openldap-data/replogfile replica uri="ldaps://mail1.abc.com" starttls=yes bindmethod=simple binddn="cn=rootldap,dc=abc,dc=com" credentials="123456789" My Slave slapd.conf is similar configuraion to the Master Server... *********************************** EVERYTHING HAS JUST BEGUN...

1 0

Getting more info from ldap_auth in case of a quiet failure?
by a z 13 May '11

13 May '11

Hi everyone, I am definitely new to the list, openLDAP, Ldap in general, nssswitch, shadow, samba etc, but heck, we all have to start somewhere. Not really -that- new to application code, but yeah, I'm kinda young and working at an amateur/unemployed small business level, so by default yeah .. technical noob alert... I am having problems finding out why domain login is failing: Up until now I have had pretty good luck being able to figure out how to, for example, Get Ldap and nsswitch running well enough that ldap authenticates my ssh sessions against shadow.. Get a valid sambaSID or objectClass: sambaSamAccount into an ldif without relying on the smbldap_tools library, or writing new acls to put the samba domain admin in a different ou=. (This is why I am trying to work around smbldap_tools, of course I could probably change the UID) I have been through slapd.conf loglevel -1 all day long watching it request attributes that weren't in the ldif, I cannot see yet where in smbldap_tools it decides it needs root's uid, but it goes ahead and uses it to write updates even though there is another user with write access to the right attributes) I can join windows machines to the samba workgroup MYDOMAIN, and be given an opportunity to login to the samba server, so despite the weird unupported things I do, perhaps senselessly, I -think- I have the premise correct.. So I think this is failing on a bdb_index_read: failed (-30988) report. If anyone is still with me, thanks a ton. Before I go nuts enough to post the parts of slapd logging output I am pretty sure are okay, this is what the probable problems are: It just seems that uid=testuser and objectClass=sambaSamAccount should match this con=1011 string and the next time it fails it should be for the next problem Ill have, and not this one. May 14 00:13:34 localhost slapd[30055] => conn=1011 op=3 SRCH base="dc=MYDOMAIN,dc=com" scope=2 deref=0 filter="(&(uid=testuser)(objectClass=sambaSamAccount))" . . . May 13 00:13:34 localhost slapd[30055]: => slap_access_allowed: search access granted by read(=rscxd) May 13 00:13:34 localhost slapd[30055]: => access_allowed: search access granted by read(=rscxd) May 13 00:13:34 localhost slapd[30055]: search_candidates: base="dc=MYDOMAIN.dc=com" (0x00000001) scope=2 . . . May 13 00:13:34 localhost slapd[30055]: <= bdb_index_read: failed (-30988) and of course, the ldif I think it should be matching: dn: cn=testuser,ou=People,dc=MYDOMAIN,dc=com changetype: add objectClass: inetOrgPerson sn: testuser uid: testuser sambaSID: S-1-5-21-28598429-1396753209-3957328313-513 objectClass: sambaSamAccount sambaDomainName: MYDOMAIN Again, thanks. I look forward to seeing the list traffic every day, and yet more slapd -1 logs -- ⎼⎺⎺├@┼␊├├≤-␍⎼␊▒␍:/␤⎺└␊/⎼␤⎺#

1 0

Suitability of LDAP as DNS backend - PowerDNS LDAP backend moving to unmaintained status
by Nick Milas 12 May '11

12 May '11

Hi, We've been using for several months PowerDNS Authoritative Server v9.22 with LDAP backend (simple mode), using OpenLDAP (v2.4.22) for hosting our organization's domains (and reverse zones) and it has been working fine (low query times, reliable etc.) so we enjoy having all our organization's data stored/maintained in the same DIT in LDAP. However, as PowerDNS Authoritative Server is preparing for the next version (3.0), it seems that the LDAP backend will be unmaintained (see: http://mailman.powerdns.com/pipermail/pdns-users/2011-March/007547.html) as the LDAP backend developer is no more working on it (see: http://www.mail-archive.com/pdns-users@mailman.powerdns.com/msg03625.html). It has been alleged (see ref. above) that "We don't think that LDAP is a particularly good or interesting place to store DNS data. It will for example have big problems with PowerDNSSEC because of lack of ordering." Moreover, PowerDNS LDAP backend (although current open bugs are very few and of relatively low severity) lacks features (e.g. Notify, which we implement using custom script, cron and notify-dns-slaves, see: http://mailman.powerdns.com/pipermail/pdns-users/2010-October/007109.html) and is not being evolved any more. Additionally, LDAP/database backend projects for BIND9 (SDB and DLZ) do not seem very well maintained either. In any case we prefer PowerDNS approach where backend implementation is cleaner and direct. So, my questions: * From the above and your experience, do you consider LDAP should not be preferred as DNS backend? * Should LDAP be avoided as a DNS/DNSSEC backend? * Would any companies / developer(s) from the OpenLDAP world - perhaps already using or interested in using DNS with LDAP backend - would be willing to devote some time to fix a couple of small bugs and keep the very well-designed and developed PowerDNS LDAP backend in shape? We could even start some community donation effort (to support this development), but I don't know if there is sufficient usage/interest in the LDAP backend that would generate enough funds. In essence, should we drop LDAP as a DNS Record datastore, due to the lack of a properly maintained backend and/or unsuitability for (e.g. DNSSEC) evolution, or you think there IS interest for the maintenance / evolution of the LDAP backend by the OpenLDAP developers/community (even by becoming more openldap-oriented rather than being cross-platform)? Best Regards, Nick

6 22

[Q] objectClass mapping data of back_sql for RFC2307
by Hiroyuki Sato 12 May '11

12 May '11

Dear lists. Could you please tell me the following. Does anybody tried to create objectClass mapping data of back_sql for RFC2307?? Especially, posixAccount and posixGroup. I would like to use SQL Database to store account informations of LDAP. Sincerely. -- Hiroyuki Sato.

1 0

Xymon syncrepl monitoring
by Johan Karlsson 12 May '11

12 May '11

Hi! While looking for OpenLDAP monitoring solutions, i found Buchan's Xymon/Hobbit script at http://staff.telkomsa.net/~bgmilne/xymon/ol/ I saw some previous discussion about it on this list so I thought I'd give it a shot. I'm wondering how it determines a syncrepl slave, cause when I added the test in Xymon on my syncrepl slave I get "Not a syncrepl slave". The graphs and counters are working though. Regards, Johan

2 2

Search by customized attribute in OpenLdap
by JOSE L MARTINEZ-AVIAL 12 May '11

12 May '11

Hi, I've installed OpenLdap, and defiened the following schema: attributetype ( 1.2.840.113556.1.4.221 NAME 'sAMAccountName' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE ) objectclass ( 1.2.840.113556.1.5.6 NAME 'securityPrincipal' SUP top AUXILIARY MUST (sAMAccountName ) MAY (mail)) I've created an entry as follows: dn: cn=John Smith,ou=External Users,dc=xxx,dc=yyy,dc=com cn: John Smith objectClass: person objectClass: securityPrincipal mail: test(a)test.com sn: Smith userPassword: myPassword sAMAccountName: smith Then I try to get the entry looking for (sAMAccountName='smith'), but it doesn't work. If I look for (cn='John Smith') it founds the entry. So what do I need to do in order to be able to search by sAMAccountName? Thanks Jose

1 0

Re: Not able start TLS.
by Meghanand Acharekar 11 May '11

11 May '11

Sorry for the spelling mistake using /usr/local/libexec/slapd -s 256 -h "ldaps:///" And getting the error "daemon: TLS not supported (ldaps:///)" is syslog, I have searched mailing list, the one possible reason mentioned was "openldap is not compiled with TLS support" but I have verified this using ldd. ldd /usr/local/libexec/slapd linux-vdso.so.1 => (0x00007fff1f7ff000) libdb-4.7.so => /usr/lib/libdb-4.7.so (0x00007f80960b4000) libpthread.so.0 => /lib/libpthread.so.0 (0x00007f8095e98000) libsasl2.so.2 => /usr/lib/libsasl2.so.2 (0x00007f8095c7e000) libdl.so.2 => /lib/libdl.so.2 (0x00007f8095a7a000) libcrypt.so.1 => /lib/libcrypt.so.1 (0x00007f8095843000) libresolv.so.2 => /lib/libresolv.so.2 (0x00007f809562c000) libwrap.so.0 => /lib/libwrap.so.0 (0x00007f8095423000) libc.so.6 => /lib/libc.so.6 (0x00007f80950c2000) /lib64/ld-linux-x86-64.so.2 (0x00007f8096428000) libnsl.so.1 => /lib/libnsl.so.1 (0x00007f8094ea9000) I'm not sure whether the problem in certificates could be the reason for this. In my slapd.conf I've following lines related to TLS. TLSCACertificateFile /usr/local/etc/openldap/ca-bundle.crt TLSCertificateFile /usr/local/etc/openldap/slapd.pem TLSCertificateKeyFile /usr/local/etc/openldap/slapd.pem Regards, Meghanand N. Acharekar On Tue, May 10, 2011 at 8:50 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, May 10, 2011 4:56 PM +0530 Meghanand Acharekar < > vasco.debian(a)gmail.com> wrote: > > using /usr/local/libexec/slapd -s 256 -h "ldap:///" >> daemon: TLS not supported (ldaps:///) >> > > You didn't tell slapd to start with ldaps:///, you told it to start with > ldap:///. What exactly is the question? > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 3

Confused about SASL behavoir
by Ski Kacoroski 10 May '11

10 May '11

Hi, I have a black box windows app that I was able to get working with SASL authentication. I am now doing some additional testing so I want to get the SASL auth working from ldapsearch for testing, but am not able to. My details are: Running openldap 2.4.23 on debian. slapd.conf SASL section is: password-hash {CLEARTEXT} sasl-host ldap.nsd.org sasl-realm OL.NSD.ORG authz-regexp uid=(.*),cn=OL.NSD.ORG,cn=digest-md5,cn=auth uid=$1,ou=people,dc=nsd,dc=org authz-regexp uid=(.*),cn=digest-md5,cn=auth uid=$1,ou=people,dc=nsd,dc=org When the windows app connects I get in the logs: 1 slap_sasl_getdn: dn:id converted to uid=ckacoroski,ou=people,dc=nsd,dc=org 2 SASL Canonicalize [conn=1003]: slapAuthcDN="uid=ckacoroski,ou=people,dc=nsd,dc=org" 3 => bdb_search 4 bdb_dn2entry("uid=ckacoroski,ou=people,dc=nsd,dc=org") 5 base_candidates: base: "uid=ckacoroski,ou=people,dc=nsd,dc=org" (0x000000ef) 6 slap_ap_lookup: str2ad(cmusaslsecretDIGEST-MD5): attribute type undefined 7 send_ldap_result: conn=1003 op=2 p=3 8 send_ldap_result: err=0 matched="" text="" 9 SASL Canonicalize [conn=1003]: authzid="ckacoroski" 10 SASL proxy authorize [conn=1003]: authcid="ckacoroski(a)OL.NSD.ORG" authzid="ckacoroski(a)OL.NSD.ORG" 11 conn=1003 op=2 BIND authcid="ckacoroski(a)OL.NSD.ORG" authzid="ckacoroski(a)OL.NSD.ORG" When I connect with ldapsearch -Y DIGEST-MD5 -U ckacoroski -h ldapm '(objectclass=*)' I get in the logs: 12 slap_sasl_getdn: dn:id converted to uid=ckacoroski,ou=people,dc=nsd,dc=org 13 SASL Canonicalize [conn=1000]: slapAuthcDN="uid=ckacoroski,ou=people,dc=nsd,dc=org" 14 => bdb_search 15 bdb_dn2entry("uid=ckacoroski,ou=people,dc=nsd,dc=org") 16 => bdb_dn2id("ou=people,dc=nsd,dc=org") 17 <= bdb_dn2id: got id=0x2 18 => bdb_dn2id("uid=ckacoroski,ou=people,dc=nsd,dc=org") 19 <= bdb_dn2id: got id=0xef 20 entry_decode: "uid=ckacoroski,ou=People,dc=nsd,dc=org" 21 <= entry_decode(uid=ckacoroski,ou=People,dc=nsd,dc=org) 22 base_candidates: base: "uid=ckacoroski,ou=people,dc=nsd,dc=org" (0x000000ef) 23 bdb_search: 239 does not match filter 24 send_ldap_result: conn=1000 op=1 p=3 25 send_ldap_result: err=0 matched="" text="" 26 SASL Canonicalize [conn=1000]: authzid="ckacoroski" 27 SASL [conn=1000] Failure: no secret in database It seems to break at line 23 and 27. I am not sure what is different about how the windows app and ldapsearch use SASL, but something sure is :). So my question is how do I get ldapsearch to work using SASL? Thanks in advance for your help. cheers, ski -- "When we try to pick out anything by itself, we find it connected to the entire universe" John Muir Chris "Ski" Kacoroski, ckacoroski(a)nsd.org, 206-501-9803 or ski98033 on most IM services

1 0

Not able start TLS.
by Meghanand Acharekar 10 May '11

10 May '11

Hi, I have installed openldap from source code on debian squeeze. with following options. ./configure --prefix=/usr/local --enable-slapd --enable-crypt --enable-syslog --enable-wrappers --disable-ipv6 --enable-ppolicy --with-cyrus-sasl --with-threads --with-tls While trying to start LDAPS, using /usr/local/libexec/slapd -s 256 -h "ldap:///" getting following error in the error log. daemon: TLS not supported (ldaps:///) I have installed required certificates, ldd output is as follows. ldd /usr/local/libexec/slapd linux-vdso.so.1 => (0x00007fff1f7ff000) libdb-4.7.so => /usr/lib/libdb-4.7.so (0x00007f80960b4000) libpthread.so.0 => /lib/libpthread.so.0 (0x00007f8095e98000) libsasl2.so.2 => /usr/lib/libsasl2.so.2 (0x00007f8095c7e000) libdl.so.2 => /lib/libdl.so.2 (0x00007f8095a7a000) libcrypt.so.1 => /lib/libcrypt.so.1 (0x00007f8095843000) libresolv.so.2 => /lib/libresolv.so.2 (0x00007f809562c000) libwrap.so.0 => /lib/libwrap.so.0 (0x00007f8095423000) libc.so.6 => /lib/libc.so.6 (0x00007f80950c2000) /lib64/ld-linux-x86-64.so.2 (0x00007f8096428000) libnsl.so.1 => /lib/libnsl.so.1 (0x00007f8094ea9000) Thanks in advance. Regards, मेघानंद नं. आचरेकर Meghanand N. Acharekar " A proud Linux User " Reg Linux User #397975 ------------------------------------------ The gates in my computer are AND, OR and NOT; they are not Bill..

2 1

Replication Advise
by Ben Rockwood 10 May '11

10 May '11

Hello, I have a mirror-mode configuration between two nodes in a single data center now. I'd like to expand this to 2 additional data centers. The intent would be to have read-only HA pairs in each of the new data centers that will continue to function even if the data center is cut off from the primary pair. I have some ideas on how to implement this, but I'm looking for any best practice advise people would like to offer before I do. Thanks! benr.

2 1

API in openldap to set the DSCP values
by sachinv1821＠gmail.com 10 May '11

10 May '11

HI All, I need to set the DSCP (QOS ) values how can I do it, I have a wrapper application over openldap server which sends request and receives reply. It would be of great help if u tell me the API to do that. Thanks in advance Regards, Sachin Vastrad

1 0

Auth problem with openldap and nss_ldap
by Johnny PINSON 10 May '11

10 May '11

Hey, I installed an openldap client and nss_ldap on a linux computer running slackware. Then I modified /etc/nsswitch.conf, adding ldap to authentify thanks a ldap server. The commands "getent password" and "id" are working. When I'm root and doing a "su $user", I'm able to su as $user. But, if I try to log in as $user, I get everytime an "invalid password". What can I do please to get i working? Would you need copy of my config files? Thanks a lot, Johnny PINSON

1 0

Password Modify Extended Operation Tool
by Shelley Waltz 09 May '11

09 May '11

I searched and did not find a suitable answer, so I am posting. Somehow I feel there is an answer, but it has eluded me. I have RHEL5 with openldap with the ppolicy module. I wish to have a script or web cgi which I can have the users access to change their password and have them obey the ppolicy restrictions. I have not been able to find a suitable tool which will provide feedback regarding their selection requirements and errors. If there is one, please point me in the right direction. regards Shelley

4 3

Openldap cannot start.
by lfs lfs 09 May '11

09 May '11

Hi, Openldap server cannot start after sudden power failure. Any idea? How can I troubleshoot? thanks,Mark

2 1

Adding new BDB databases to servers with N-Way multimaster replication
by paolo penzo 09 May '11

09 May '11

Hi, I set up some servers with N-Way Multimaster replication which work fine (cn config is correctly replicated) but I'm not able to add add new bdb databases if the database directories do not exist on all the servers. Is this correct or I made something wrong? Regards, Paolo. ________________________________ Prima di stampare questa e-mail, assicurarsi che sia davvero necessario. Questo documento e' formato esclusivamente per il destinatario. Tutte le informazioni ivi contenute, compresi eventuali allegati, sono soggette a riservatezza a termini del vigente D.Lgs. 196/2003 in materia di privacy e quindi ne e' proibita l'utilizzazione. Se avete ricevuto per errore questo messaggio, Vi preghiamo cortesemente di contattare immediatamente il mittente e cancellare la e-mail. Grazie. Please don't print this e-mail unless you really need to. Confidentiality Notice - This e-mail message including any attachments is for the sole use of the intended recipient and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

1 0

masking LDAP search responses
by paul.osborne＠canterbury.ac.uk 09 May '11

09 May '11

Hi, I have an OpenLDAP to AD proxy up and running, and want to restrict the data being returned when a search has completed. For example if I search for cn=abc1 I get a full response of all data held in our AD for that CN, ie: filter: (cn=abc1) dn: cn=abc1...... displayName: Andrew Bertram Carlisle objectClass: person mail: abc1(a)mydomain.com MEMBEROF: OU=....... homeDirectory: \\fileserver1.myad.mydomain.com\abc1 . . . Naturally I want to be able to limit the data that is returned to the barest minimum required for the querying service. I looked at the rwm overlay (slapo-rwm) and think I should be able to do: overlay rwm rwm-rewriteEngine on rwm-map attribute displayName displayName rwm-map attribute * So that ONLY the displayName gets shown on the output and the rest of the data is filtered out. This does not seem to be working though and I am at the point where I have no idea why. Does anyone have any suggestions that may help? Thanks Paul

2 2

functions using postfix +ldap
by deconya 06 May '11

06 May '11

Hi Im using a mail server using postfix + ldap and Im lost with how to config openldap to made aliases inside postfix. I don't know where can be information about this option. Any idea? Thanks

3 2

Fw: openldap-technical Digest, Vol 42, Issue 4
by Brijesh 06 May '11

06 May '11

On Wednesday, 4 May 2011 09:28:15 Brijesh wrote: > On Tue, 3 May 2011 08:23:27 +0200 (SAST) > i have just submitted a bug to mandriva > > https://qa.mandriva.com/show_bug.cgi?id=63191 > As you said it looks like its a mandriva specific problem so i am > thinking of either downgrading the package or upgrading to the package > available in 2011( not sure whether upgraded package will work or not > though) Cooker has an openldap-smbk5pwd-2.4.24, and that actually needs to be updated to match the openldap-servers which is at 2.4.25. However, a 2.4.22 should soon (within an hour or two) be available in contrib/testing for 2010.1/2 (as noted in the bug report). Please test and report back in bugzilla. Regards, Buchan Its working after the installing version 2.4.22 Thanks Brijesh

1 0

help with smbk5pwd-enable
by Brijesh 05 May '11

05 May '11

Hi, I have recently upgraded the openldap and now it doen't start it stops saying that unknown directive <smbk5pwd-enable> inside backend database definition It has been working fine untill the upgrade. I am using heimdal and openldap on mandriva. Following are the details of those packages. openldap-smbk5pwd- 2.4.21-3mdv2010.1 openldap-servers- 2.4.22-2.2mdv2010.2 Any help would be arrciated. Thanks Brijesh

4 7

conditional bind authentication against external ldap server
by Patrick H. 04 May '11

04 May '11

I'm trying to setup a way to have bind requests authenticated by logging into an external ldap server. But to make things more complicated, I only want to do it if a certain attribute is defined on the user's entry. The details: When a user binds, check to see if the 'seeAlso' attribute is defined for the user. If 'seeAlso' is not defined, try to authenticate as normal using the 'userPassword' stored in the local database. If it is defined, 'seeAlso' will contain the DN of the user in another ldap database (Active Directory in this case). Use the seeAlso DN to determine the URI of the ldap db to connect to (right now there is only one Active Directory server, but it would be nice to be able to use different URIs for different suffixes down the road). Attempt to bind to the remote database using the seeAlso DN. If the remote bind succeeds, the local bind also succeeds. The goal here is to allow users to opt into using their Active Directory password for authentication. No data will be pulled from the remote ldap and overlayed on the local account, it is strictly bind authentication only. From searching around, I'm not sure what to use to do this. It seems like slapd-ldap and slapo-chain might both do the remote ldap thing, and then I might use slapo-rwn to somehow do a conditional test for the seeAlso attribute and rewrite the bind DN, but I'm not sure. If anyone could tell me if my idea is even possible, and some starting points if so, it would be much appreciated.

2 2

Re:Alternate target for slapd-meta ?
by michel.gruau 04 May '11

04 May '11

Could anyone confirm my understanding below regarding URI lists ? After the first URI has become unreachable, for how long time is the second URI used. ? Does it switch back immediatly to the first URI when it become aivailable again. Thanks, Michel > Did you read slapd-meta about the uri directive: > "the directive > suffix "dc=foo,dc=com" > uri "ldap://l1.foo.com/dc=foo,dc=com"; "ldap://l2.foo.com/"; > causes l2.foo.com to be contacted whenever l1.foo.com does not > respond. In that case, the URI list is internally rearranged, > by moving unavailable URIs to the end, so that further connec- > tion attempts occur with respect to the last URI that succeeded." > > Or is this not, what you mean? Thank you very much for your reply, I read it but too quickliy, and I missed this possibility. However, my need is that the first URI remains the prefered one. As soon as it become available again, I'd like to switch back to l1.foo.com. Unfortunately, I guess that the current behaviour is to keep using l2.foo.com until it become unavailable too ? Do you confirm this behaviour ? Michel Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

1 0

Re: openldap-technical Digest, Vol 42, Issue 2
by Brijesh 04 May '11

04 May '11

On Mon, 02 May 2011 12:00:01 +0000 openldap-technical-request(a)OpenLDAP.org wrote: > Are you loading the required module? > > moduleload smbk5pwd yes i do load the module > > > Are you defining the overlay prior to trying to enable the different > drivers? > > overlay smbk5pwd > the overlay is defined the overlay before enabling the module and i am using the same config which use to work with previous package. Thanks Brijesh > > Regards, > > Hugo Monteiro.

1 0

Invalid DN Syntax in Shell Script
by Inácio Alves 03 May '11

03 May '11

Hi to all, I'm trying write a script shell to simplifies the change of pass of users. Then I write function verificaSenha(){ whoAmI=`whoami` param=`echo "ldapsearch -x -W -D \"uid=$whoAmI,ou=People,dc=ifce,dc=edu,dc=br\" -b \"dc=ifce,dc=edu,dc=br\" \"(uid=$whoAmI)\""` exec `echo "$param"` } the line param=... produces a command line that when I write directly in the term it works, however in the line exec "$param" I am solicitated my LDAP pass (like in directly term) but when I type I get ldapsearch -x -W -D "uid=inacio,ou=People,dc=ifce,dc=edu,dc=br" -b "dc=ifce,dc=edu,dc=br" "(uid=inacio)" Enter LDAP Password: ldap_bind: Invalid DN syntax (34) additional info: invalid DN what is wrong? Best regards!! -- Atenciosamente, prof. Inácio Alves IFCE/Campus Maracanaú Bacharel em Matemática (UFC)/ Técnico em Conectividade(IFCE) http://www.polluxweb.com/inacioalves/site/

4 3

overlay questions
by Maarten Vanraes 03 May '11

03 May '11

Hey, I'm trying to write an overlay (that triggers an external command after modifications), and it seems the overlay is initialized correctly, but the handler callbacks are not being executed. Do i need to set some kind of flags for it to work properly? (not even _config is being called back). so the extra configuration settings aren't being picked up either...

1 0

tree design
by E.S. Rosenberg 02 May '11

02 May '11

Hello all, I am considering redoing our LDAP tree since it's current design is fairly unfortunate. I have read several articles that said that groups should be a general (and broad) as possible, and as a result of that the LDAP tree should be as free of hierarchy as possible. (An ou for people an ou for machines etc, but no ou for Departments). The reasoning seems to be that since the design of LDAP is optimized for reads and not for writes and managing moves between branches is/was a pain. A lot of said articles seem to be from several years ago and the management tools I have seen seem to make managing more hierarchical trees possible/easy. So I was wondering what the opinions of other users are, do you maybe have suggestions of good articles that are more up to date on this subject? Thanks and best regards, Eli

2 1

Alternate target for slapd-meta ?
by michel.gruau 02 May '11

02 May '11

Hello, I implemented a slapd-meta configuration with several backend directories. I would like to know whether slapd-meta is capable to switch requests to an « alternate target » when a given target is unavailable. Reading all the documentation, I have the feeling this is not possible but I would like to be sure. Thanks in advance, Michel Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

2 2

Red Hat Enterprise 6 client issues
by Sotomayor, Vicente (ITD) 02 May '11

02 May '11

Hello, I'm testing RH 6 Openldap clients and I getting a lot of errors and poor performance while trying to login and also takes serveral minutes for a su - command to work. We are using SSL. I'm seeing plenty of "errors ldap_result() timed out" in the messages file and it also states that it can not contact either ldap server. I enabled root to temporarily ssh and that even takes up 2 minutes. Our RH 5 clients are having no issues. Does anyone know the fix? Thanks pam_ldap.conf : base dc=x,dc=x,dc=x,dc=x uri ldaps://x ldaps://x tls_cacertdir /etc/openldap/cacerts pam_password md5 sudoers_base ou=SUDOers,dc=x,dc=x,dc=x,dc=x nslcd.conf: uid nslcd gid ldap uri ldaps://x ldaps://x base dc=x,dc=x,dc=x,dc=x tls_cacertdir /etc/openldap/cacerts

3 2

EnableXPS
by Leonardo 02 May '11

02 May '11

Dear Friends, I configured XPS in slapd.conf, but when i start my OpenLDAP, it stop and show the following msg "unknown directive <EnableXPS> outside backend info and database definitions.", anybody could help me? Thanks.

3 3

[OpenLDAP 2.4.23-7 ] Trouble using rwm to delete ObjectClass & attribute
by Cédric COPY 02 May '11

02 May '11

Hi there, I have some trouble using rwm overlay. In fact, i am not sure it fits my need, but the documentation isn't explicit about that point. I am trying to make some replication from a master OpenLDAP server to some other server in my DMZ, through a proxy. The proxy retrieve what i need from the master, then push it to DMZ server. There is some attribute on my master server that I don't want on the DMZ server, for instance sambaGroupMapping & sambaSamAccount. The idea was using rwm to delete those objectClass, and attribute. But it doesn't work, i can change objectClass name, but i can't delete them, and i can delete attribute, not rename them (doesn't matter in my case). Here is my configuration, i tried something with the relay backend, but it doesn't matter, focus on rwm configuration. ######################################################## include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/authldap.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel -1 modulepath /usr/lib/ldap moduleload back_ldap moduleload back_relay moduleload syncprov moduleload rwm database ldap suffix "ou=proxy,o=ca,c=net" uri ldap://ldap-dmz acl-bind bindmethod=simple idassert-bind bindmethod=simple binddn="cn=admin,ou=real,o=ca,c=net" credentials="secret" database relay suffix "ou=real,o=ca,c=net" relay "ou=proxy,o=ca,c=net" rootdn "cn=admin,ou=real,o=ca,c=net" lastmod on restrict all overlay rwm rwm-rewriteEngine on #Don't work rwm-map objectclass sambaGroupMapping #Work rwm-map objectclass sambaSamAccount sa #Don't work rwm-map objectclass * syncrepl rid=001 provider=ldap://ldap attrs="@inetOrgPerson,@posixAccount,@shadowAccount,@organizationalPerson,@person" bindmethod=simple searchbase="ou=people,ou=real,o=ca,c=net" type=refreshAndPersist retry="60 +" interval=00:00:01:00 schemachecking=off overlay syncprov ######################################################## Documentation about rwm overlay does not indicate that objectClass can't be renamed. I also tried to filter those attribute thanks to exattrs / attrs of my syncrepl overlay, but don't work either, it doesn't delete the objectClass (seen with wireshark). Maybe it's not the right way to delete those things. If you have any idea about how to do it. Thanks you for help. Regards, Cédric.

1 1

Replicating a translucent proxy
by Jonathan Hanks 30 Apr '11

30 Apr '11

Is it possible to replicate a translucent proxy? In our project we have a central LDAP repository that is populated with generic information about our collaboration and its users. This is replicated out to various sites in a master -> slave setup via syncrepl. At the sites we may need site local information. We have been addressing this via a translucent overlay. However it would be nice to have some redundancy on the translucent overlay. What is the best way to approach this? My ldap servers (including the translucent proxy) are on CentOS 5 running OpenLDAP 2.4.18 (built from source). The master is running on a Debian system on 2.4.x. -- Jonathan Hanks General Computing Sys Admin LIGO Hanford Observatory

1 0

Recover User Password?
by Alberto Moreno 29 Apr '11

29 Apr '11

Hi. I had been using samba with openldap as a backend. But I had never need to recover a user password from LDAP. Exist a way to recover user passwords? Ldap running on Centos 5.5 2.3.43.x Samba 3.3.x DB: dbd. Thanks!!! -- LIving the dream...

2 2

RE: Problem Compiling openldap-2.4.23
by Darouichi, Aziz 29 Apr '11

29 Apr '11

Thanks I got it to work after I re-checked my env. -----Original Message----- From: Michael Ströder [mailto:michael@stroeder.com] Sent: Friday, April 29, 2011 11:30 AM To: Darouichi, Aziz Subject: Re: Problem Compiling openldap-2.4.23 Please keep responses on the mailing list. Darouichi, Aziz wrote: > But I am using BDB 5.1.23 It seems this is not used. Maybe a typo in this path: /usr/local/Berkely-5.1 ^^ missing "e"? Ciao, Michael. > -----Original Message----- > From: Michael Ströder [mailto:michael@stroeder.com] > Sent: Friday, April 29, 2011 11:20 AM > To: Darouichi, Aziz > Cc: openldap-technical(a)openldap.org > Subject: Re: Problem Compiling openldap-2.4.23 > > Darouichi, Aziz wrote: >> I installed Berkeley 5.1.25.NC in RHEL 32 when I try to compile >> openldap-2.4.23 using the followings. >> >> CPPFLAGS="-I/usr/local/Berkely-5.1/include" >> LDFLAGS="-L/usr/local/Berkley-5.1/lib" ./configure --prefix=/opt/local >> >> LD_LIBRARY_PATH=/usr/local/Berkley-5.1/lib , export LD_LIBRARY_PATH. >> >> I get the error message. >> >> checking for Berkeley DB major version in db.h... 4 >> checking for Berkeley DB minor version in db.h... 3 >> checking if Berkeley DB version supported by BDB/HDB backends... no >> configure: error: BerkeleyDB version incompatible with BDB/HDB backends > > BDB 4.3.x should not be used because of severe issues with this version: > > http://www.openldap.org/faq/data/cache/44.html > > Ciao, Michael.

1 0

RE: Problem Compiling openldap-2.4.23
by Darouichi, Aziz 29 Apr '11

29 Apr '11

Sorry about that. The path to BDB is correct. I made typo when I created the prefix. When I grep for BDB _VERSION. grep DB_VERSION_STRING /usr/local/Berkley-5.1/include/db.h #define DB_VERSION_STRING "Berkeley DB 5.1.25: (January 28, 2011) -----Original Message----- From: Michael Ströder [mailto:michael@stroeder.com] Sent: Friday, April 29, 2011 11:30 AM To: Darouichi, Aziz Subject: Re: Problem Compiling openldap-2.4.23 Please keep responses on the mailing list. Darouichi, Aziz wrote: > But I am using BDB 5.1.23 It seems this is not used. Maybe a typo in this path: /usr/local/Berkely-5.1 ^^ missing "e"? Ciao, Michael. > -----Original Message----- > From: Michael Ströder [mailto:michael@stroeder.com] > Sent: Friday, April 29, 2011 11:20 AM > To: Darouichi, Aziz > Cc: openldap-technical(a)openldap.org > Subject: Re: Problem Compiling openldap-2.4.23 > > Darouichi, Aziz wrote: >> I installed Berkeley 5.1.25.NC in RHEL 32 when I try to compile >> openldap-2.4.23 using the followings. >> >> CPPFLAGS="-I/usr/local/Berkely-5.1/include" >> LDFLAGS="-L/usr/local/Berkley-5.1/lib" ./configure --prefix=/opt/local >> >> LD_LIBRARY_PATH=/usr/local/Berkley-5.1/lib , export LD_LIBRARY_PATH. >> >> I get the error message. >> >> checking for Berkeley DB major version in db.h... 4 >> checking for Berkeley DB minor version in db.h... 3 >> checking if Berkeley DB version supported by BDB/HDB backends... no >> configure: error: BerkeleyDB version incompatible with BDB/HDB backends > > BDB 4.3.x should not be used because of severe issues with this version: > > http://www.openldap.org/faq/data/cache/44.html > > Ciao, Michael.

1 0

Problem Compiling openldap-2.4.23
by Darouichi, Aziz 29 Apr '11

29 Apr '11

Hi, I installed Berkeley 5.1.25.NC in RHEL 32 when I try to compile openldap-2.4.23 using the followings. CPPFLAGS="-I/usr/local/Berkely-5.1/include" LDFLAGS="-L/usr/local/Berkley-5.1/lib" ./configure --prefix=/opt/local LD_LIBRARY_PATH=/usr/local/Berkley-5.1/lib , export LD_LIBRARY_PATH. I get the error message. checking for Berkeley DB major version in db.h... 4 checking for Berkeley DB minor version in db.h... 3 checking if Berkeley DB version supported by BDB/HDB backends... no configure: error: BerkeleyDB version incompatible with BDB/HDB backends Thanks, Aziz

2 1

Re: Installation openLDAP in Debian
by Hallvard B Furuseth 29 Apr '11

29 Apr '11

Olivier Guillard writes: > How to survive in operational environnement without comments > in files ( nor a way to track change logs btw ) ? I suppose you could put slapd.d/ under version control. After making a change or a set of changes, commit your modified slapd.d/ with your comments in the commit message. Or put comments in other files under slapd.d/. If these filenames do not resemble DNs, e.g. have filetype .txt and no '=' in them, they won't clash with cn=config's filenames. I haven't tried how cumbersome this is/isn't in practice though. -- Hallvard

4 5

"DIT content rule" usage patterns?
by Marco Pizzoli 29 Apr '11

29 Apr '11

Hi list, could someone point me to some resources, in particular usage examples, about DIT content rules? Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

4 6

slapi_get_client_ip in openldap?
by Jani Salonen 29 Apr '11

29 Apr '11

Hi, I've written a prebind plugin for slapd, and I was wondering if there is a way to resolve connected client's IP address somehow, like IBM Tivoli has slapi_get_client_ip()/slapi_get_source_ip() functions? If there is no suitable functions already in openldap, does anyone know a feasible way to do it? -- /} @###{]::::::Jani Salonen::::::> \}

2 1

RE: Finding issue with LDAP_OPT_NETWORK_TIMEOUT
by Singh, Pravat (NSN - IN/Bangalore) 28 Apr '11

28 Apr '11

Hi, I am facing problem while in ldap_simple_bind () while setting LDAP_OPT_NETWORK_TIMEOUT. Can anybody let me know if I am missing something. Just to add some information that I have compiled the openldap-2.4.23 version on solaris 10 with sun studio compiler. The bind api "ldap_simple_bind()" is successful if don't use LDAP_OPT_NETWORK_TIMEOUT but fails if I use. >From my application bind() method I am using the following apis struct timeval tempTime; tempTime.tv_usec = 0; tempTime.tv_sec = 10; ldap_init((char*)theHost.c_str(), thePort); ldap_set_option(theLDAP, LDAP_OPT_PROTOCOL_VERSION, &desired_version); ldap_set_option(theLDAP, LDAP_OPT_DEREF, &desired_deref); ldap_set_option( theLDAP, LDAP_OPT_NETWORK_TIMEOUT, (void *)&tempTime ); ldap_simple_bind(theLDAP, (char*)theUserDN, (char*)theUserPW); here I am getting a bind failure and from openldap library in ldap_sasl_bind(...) of libldap_r/sasl.c where the following code fails and ld->ld_errno returns -1 /* send the message */ *msgidp = ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber, id ); printf("returning ld->ld_errno %d\n",ld->ld_errno); Could anybody help me to know if I am missing anything here (Don't know may be to set some ldap options or missed some compilation flag, not sure). Hope someone will help me to solve this issue. If anybody has a sample client code with ldap option set to LDAP_OPT_NETWORK_TIMEOUT. Please send me. Regards, Pravat

2 1

Re: Problem regarding OpenLdap installation and Berkeley DB
by Marco Pizzoli 28 Apr '11

28 Apr '11

On Thu, Apr 28, 2011 at 7:33 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, April 28, 2011 11:21 AM +0200 Marco Pizzoli > <marco.pizzoli(a)gmail.com> wrote: > >> Hi, >> OpenLDAP is officially supported only with BerkeleyDB versions at >> maximum equal to 5.0.x, and this particular version only since 2.4.24. > > No. Read the change log again: > > Added slapd support for BDB 5.0+ (ITS#6698) > > It says 5.0+. That means 5.0 and higher. Not maximal at 5.0. I saw right but interpreted wrong, it seems... 5.0+ to me appeared as whatever version 5.0.0/5.0.1/5.0.2/etc... My fault

1 0

Problem regarding OpenLdap installation and Berkeley DB
by Frederick William Borges Pohl 28 Apr '11

28 Apr '11

Hello, I am a new user to Openldap and I´ve been struggling to install on my RedHat box for quite some time. I´ve googled and read past messages from this forum but i´m still unable to solve my problem which. I have installed Berkeley Db db-5.1.25 with success but when I try to install openldap, I get the following error: [root@redqas01 openldap-2.4.23]# ./configure ... checking db.h usability... yes checking db.h presence... yes checking for db.h... yes checking for Berkeley DB major version in db.h... 5 checking for Berkeley DB minor version in db.h... 1 checking if Berkeley DB version supported by BDB/HDB backends... yes checking for Berkeley DB link (default)... no configure: error: BDB/HDB: BerkeleyDB not available Searching this mailing list, I found some information regarding setting the LDFLAGS and CPPFLAGS for the BDB installation. So I did the following commands: (considering that the installation for the BDB was in the /usr/local directory) LD_LIBRARY_PATH="/usr/lib:/usr/local/lib:/usr/local/BerkeleyDB.5.1/lib:/usr/local/berkeley/lib" LDFLAGS="-L/usr/local/lib -L/usr/local/BerkeleyDB.5.1/lib -L/usr/local/berkeley/lib" CPPFLAGS="-I/usr/local/include -I/usr/local/BerkeleyDB.5.1/include -I/usr/local/berkeley/include" I checked the /usr/local/lib/ directory and the libdb-5* files are there. I also checked the /usr/local/include/ and the db.h file is also there. But I still get the same error message. Any tips? Att Frederick Pohl

4 3

Multi-Master Question when network partition
by Tony Dong 28 Apr '11

28 Apr '11

> Hi, > > In OpenLDAP 2.4 admin guide "chapter 18: Replication" 18.2.2.3. Arguments against Multi-Master replication: > > If a network is partitioned and multiple clients start writing to each of the "masters" then reconciliation will be a pain; it may be best to simply deny writes to the clients that are partitioned from the single provider. > > How to configure to deny writes in a LDAP master? > > My environment is 3-way MMR, of A, B, C three servers. If connection between server A and server B is lost, how can server A and B automatically deny writes and become read-only? As server C can still accept write operations, and sync with both server A and B, so data in server A and B is up-to-date and thus can act as slaves temporarily. > > > Best Regards, > Tony Dong > > >

1 0

Deleted DNs, and the great quest.
by Jorgen Lundman 28 Apr '11

28 Apr '11

SunOS ldapslave01.unix 5.10 Generic_141445-09 i86pc i386 i86pc db-4.8.30.NC.tar.gz openldap-2.4.23.tgz Hello list, We have had a rare bug hit us now and then, that appears to be quite persistent. I know it isn't fun to read through someone else's setup and troubles, but I am hoping to at least get some hints at what to look at next. Let us imagine our setup as: uid=user1,o=a.gmail.com,ou=mail,dc=company,dc=com uid=user2,o=a.gmail.com,ou=mail,dc=company,dc=com uid=user1,o=b.gmail.com,ou=mail,dc=company,dc=com uid=user1,o=c.gmail.com,ou=mail,dc=company,dc=com (Not literally gmail.com, replacing customer domains manually, but same "style" of service). ldapmaster -> slave1 -> localhost slapd (pop/imap) -> slave2 -> localhost slapd (postfix) -> slave3 -> localhost slapd (ftp) -> slave4 -> localhost slapd (smtp/forward) All using syncrepl. One master, only ever updated by the provisioning engine. 4 immediate slaves (full ldap tree), then about 150 work servers, running localhost slapd with only applicable tree. Ie, only "ou=mail" for the mail-related servers. What happens now and then, is that: o=b.gmail.com,ou=mail,dc=company,dc=com gets deleted. Gone. But you can access record "uid=user1,o=b.gmail.com,ou=mail,dc=company,dc=com" just fine. But not "o=b.gmail.com,ou=mail,dc=company,dc=com". How is that possible? Mismatching indexes? Amusingly, POP and IMAP work fine since they authenticate against the final user record "uid=user1,o=b.gmail.com,ou=mail,dc=company,dc=com". but Postfix will fail, as it verifies that the domain exists "o=b.gmail.com,ou=mail,dc=company,dc=com". syncrepl for accounts under tree "o=b.gmail.com,ou=mail,dc=company,dc=com" appear to stop until the record is fixed. There is an easy fix, if we modify the record "o=b.gmail.com,ou=mail,dc=company,dc=com" on the master, it gets pushed out. It is not always the same record, but it does seem to be a class of certain records. And the missing records seem to happen most on certain servers. 80% of the time, on the vmx servers. It far worse when they disappear on the slaves, since many localhost slapds will then not get synced. Now, this happens more frequently when we do deletions. Usually around the first of the month, since that is when we delete customers who left. Alas, we moved the entire LDAP DNS tree to its own LDAP master, so have been deleting this tree for 20 days, and will keep deleting for 12 more days. So, at the moment, we have this error once, or twice, a day. At the moment, I do not really know what goes wrong. I am hoping that perhaps I can get some good ideas on where to look, and what to look for. This morning, we lost "i.gmail.com" on vmx02. If I grep for it in the logs, we only find: Apr 27 09:17:51 vmx02.unix slapd[13990]: [ID 338579 local4.debug] nonpresent_cal lback: rid=275 nonpresent UUID 82d9570a-cdd6-102f-9364-65cc77dfbe36, dn o=i.gmail.com,ou=mail,dc=company,dc=com Apr 27 09:18:11 vmx02.unix slapd[13990]: [ID 905397 local4.debug] syncrepl_del_nonpresent: rid=275 be_delete o=i.gmail.com,ou=mail,dc=company,dc=com (66) # grep nonpresent_callback /var/log/slaplog| wc -l 517707 # grep syncrepl_del_nonpresent /var/log/slaplog|wc -l 9 What is also curious, is the UUID, for example: slaplog.20110424.gz:Apr 24 15:31:26 vmx02.unix slapd[13990]: [ID 338579 local4.debug] nonpresent_callback: rid=275 nonpresent UUID 82d9570a-cdd6-102f-9364-65cc77dfbe36, dn o=i.gmail.com,ou=mail,dc=company,dc=com slaplog.20110424.gz:Apr 24 23:41:00 vmx02.unix slapd[13990]: [ID 338579 local4.debug] nonpresent_callback: rid=275 nonpresent UUID 82d9570a-cdd6-102f-9364-65cc77dfbe36, dn o=i.gmail.com,ou=mail,dc=company,dc=com Persistent uuid? Is it ok that UUID is repeated? Are unique over time, or sometimes recycled? If I move from vmx02, to its LDAP provider, in this case, ldapslave03 (rid = 329) Apr 27 09:12:27 ldapslave03.unix slapd[20759]: [ID 338579 local4.debug] nonprese nt_callback: rid=329 present UUID d6215e0e-1c55-102f-8da7-0b6e3175d2bb, dn o=i.gmail.com,ou=mail,dc=company,dc=com /export/backup/ldapslave03.unix# gzgrep d6215e0e-1c55-102f-8da7-0b6e35d2bb slaplog.20110* Jan 6 07:15:39 Feb 8 18:47:48 Apr 24 15:22:21 Apr 24 23:36:22 Is it worth pursuing the repeated UUID? Is that some stuck record that keeps retrying over and over? Is it that is constantly trying to delete these records, and correctly failing, except now and then, it succeeds like that of vmx02 this morning? Then there is the slightly different message, with error "66". Apr 27 09:20:06 ldapslave03.unix slapd[20759]: [ID 976560 local4.debug] syncprov_sendresp: cookie= Apr 27 09:20:06 ldapslave03.unix last message repeated 1 time Apr 27 09:20:06 ldapslave03.unix slapd[20759]: [ID 905397 local4.debug] syncrepl _del_nonpresent: rid=329 be_delete o=i.gmail.com,ou=ftp,dc=company,dc=com (66) Apr 27 09:20:06 ldapslave03.unix slapd[20759]: [ID 976560 local4.debug] syncprov_sendresp: cookie= Apr 27 09:20:06 ldapslave03.unix last message repeated 4 times I believe 66 is LDAP_NOT_ALLOWED_ON_NONLEAF, which is correct. It has thousands of accounts in there, so it definitely should not delete it. But why does it try to delete it in the first place? It is not us trying to delete half the tree (well, you know, pretty sure...ish.. it isn't us) so where is it coming from? Or should I look at that empty "cookie="? Why that empty, it starts back at: Apr 27 09:17:29 ldapslave03.unix slapd[20759]: [ID 859137 local4.debug] slap_queue_csn: queing 21798d80 20110427000316.304365Z#000000#000#000000 Apr 27 09:17:29 ldapslave03.unix slapd[20759]: [ID 976560 local4.debug] syncprov_sendresp: cookie=rid=268,csn=20110427000316.304365Z#000000#000#000000 Apr 27 09:17:29 ldapslave03.unix slapd[20759]: [ID 976560 local4.debug] syncprov_sendresp: cookie=rid=278,csn=20110427000316.304365Z#000000#000#000000 Apr 27 09:17:29 ldapslave03.unix slapd[20759]: [ID 775493 local4.debug] slap_graduate_commit_csn: removing a2bee60 0110427000316.304365Z#000000#000#000000 Apr 27 09:17:29 ldapslave03.unix slapd[20759]: [ID 905397 local4.debug] syncrepl_del_nonpresent: rid=329 be_delete uid=$account,ou=users,ou=radius,dc=company,dc=com (0) Apr 27 09:17:29 ldapslave03.unix slapd[20759]: [ID 502419 local4.debug] Entry uid=userX,o=$customerdomain.com,ou=mail,dc=company,dc=com CSN 20110426223343.974235Z#000000#000#000000 older or equal to ctx 20110426223343.974235Z#000000 #000#000000 Apr 27 09:17:29 ldapslave03.unix last message repeated 1 time Apr 27 09:17:29 ldapslave03.unix slapd[20759]: [ID 976560 local4.debug] syncprov_sendresp: cookie= Apr 27 09:17:29 ldapslave03.unix last message repeated 1 time then a few hundred lines of empty "cookie=" lines. It is also worth to note that very close to the time that it lost the record today, we have: Apr 27 09:11:25 vmx02.unix slapd[13990]: [ID 763815 local4.debug] connection_input: conn=6946 deferring operation: too many executing and it is almost as if, it kills the replication connection randomly when it gets busy. Whatever record it was working on at the time is half processed? Alas, there are no entries at all for any of these on the master. Possibly because master's loglevel is "sync", which don't seem to do much when it is the provider. Recommended log level would be? Now, there is version openldap-2.4.24 out, with a very large list of fixes, but I did not see anything immediately obvious. If there is a fix that "looks good" to fix this, I can go through the upgrade. But it is a 3 week process to make it happen on all servers. Worse is, I have tried to replicate the trouble in a test network, running the exact same data, and binaries, with a master, slave and localhost slapd all on one machine. But I can not make the trouble happen in a simulated environment. Possibly as I am not generating the same load. Quite annoying. slapd.conf is pushed out with git, and is the same everywhere, except that slaves have the syncrepl section, with separate rids, and memory cache size are set differently. include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/qmail.schema include /usr/local/etc/openldap/schema/local.schema include /usr/local/etc/openldap/schema/RADIUS-LDAPv3.schema include /usr/local/etc/openldap/schema/AmavisdLDAP.schema include /usr/local/etc/openldap/schema/analyse.schema include /usr/local/etc/openldap/schema/formail.schema include /usr/local/etc/openldap/schema/dlz.schema include /usr/local/etc/openldap/schema/filter.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args loglevel sync database monitor access to dn.subtree="cn=Monitor" by dn="cn=admin,dc=company,dc=com" read by * none access to attrs=userPassword by self write by anonymous auth by * none access to * by self write by dn="cn=admin,dc=company,dc=com" write by * read password-hash {CRYPT} database hdb suffix "dc=company,dc=com" rootdn "cn=admin,dc=company,dc=com" directory /usr/local/var/openldap-data rootpw $secret index objectClass eq index uid eq index uidNumber eq index mail eq index mailAlternateAddress pres,eq index deliveryMode eq index accountStatus eq index gecos eq index radiusGroupName eq index o pres,eq index entryCSN,entryUUID eq index gidNumber eq index DNSType eq index DNSIPAddr eq index DNSData eq index DNSHostName eq checkpoint 128 15 cachesize 6000 idlcachesize 18000 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 1000 dbconfig set_lk_detect DB_LOCK_DEFAULT dbconfig set_lg_max 52428800 dbconfig set_cachesize 4 0 1 dbconfig set_flags db_log_autoremove dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 syncrepl rid=( $IP-4TH-OCTET + 256 ) provider=ldap://172.20.12.163 type=refreshAndPersist interval=00:00:00:30 searchbase="dc=company,dc=com" filter="(objectClass=*)" attrs="*,+" scope=sub schemachecking=off bindmethod=simple binddn="cn=admin,dc=company,dc=com" credentials="$secret" retry="60 10 300 +" updateref ldap://172.20.12.113 (Actually, 172.20.12.163 and 172.20.12.113 are the same server, just aliases on same nic. But updateref is never actually used, we only one writer that talks directly to master).

3 14

Re: Deleted DNs, and the great quest.
by xsun 27 Apr '11

27 Apr '11

I agree with that, I've been using delta-syncrepl here for a while and its much more reliable than syncrepl IMO. I did not found any consistency issue with the replication so far. Thanks, Matheus Morais 2011/4/27 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Wednesday, April 27, 2011 8:01 PM +0200 Michael Ströder < > michael(a)stroeder.com> wrote: > > Correct. >>> >> >> Couldn't this be the cause for delta-syncrepl to seem more reliable than >> normal syncrepl (without slapo-accesslog)? >> > > I don't think so, because that is on the master, not on the replicas. > Replicas still get changes in the order they were written to the master > (supposedly anyhow. ;) ). > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

1 0

'Operations error' possible from self signed cert?
by paul.osborne＠canterbury.ac.uk 27 Apr '11

27 Apr '11

Hi, I have a working (I think) LDAP proxy using TLS between other systems and our Active Directory. I am though slightly confused as to why when the proxy is working it is generating the following operations error messages. An example of the query and response: ldapsearch -x -LLL "(cn=ta99)" -D "CN=ldapproxy,OU=Service Accounts,DC=myad,DC=canterbury,DC=ac,DC=uk" -w password -Z ldap_start_tls: Operations error (1) additional info: TLS already started dn: cn=ta99,ou=Test Accounts,ou=OU Canterbury,dc=myad,dc=canterbury,dc=ac, dc=uk cn: ta99 SAMACCOUNTNAME: ta99 # refldaps://ForestDnsZones.myad.canterbury.ac.uk/DC=ForestDnsZones,DC=cca d,D C=canterbury,DC=ac,DC=uk # refldaps://ccad.canterbury.ac.uk/CN=Configuration,DC=myad,DC=canterbury, DC= ac,DC=uk # refldaps://DomainDnsZones.ccad.canterbury.ac.uk/DC=DomainDnsZones,DC=mya d,D C=canterbury,DC=ac,DC=uk # refldaps://ccad.canterbury.ac.uk/CN=Schema,CN=Configuration,DC=myad,DC=c ant erbury,DC=ac,DC=uk Operations error (1) Note that the response LDIF has been filtered somewhat via use of the rwm overlay and this is deliberate. My concern though is the 'Operations error (1)' at the beginning and end of the operation. I *think* that this is because I am using a self signed cert which I am politely allowing though (TLS_REQCERT allow) - but would like to be sure that this is the cause of the error before I have to start getting things up on a real server with a properly trusted certificate and appropriate chain. Many thanks Paul

1 0

Mailbox Limitation
by Vinayagamoorthi.Kvi＠wipro.com 27 Apr '11

27 Apr '11

Hi, My mail server setup is having openldap-2.3.43-3.el5 for virtual users, postfix as MTA and courier-IMAP as IMAP. Now I need to limit the Maildir size via open dap but I don't know how to implement. Please help. Regards, Vinay. Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

Installation openLDAP in Debian
by D. R. Paudel 27 Apr '11

27 Apr '11

Hi, I tried to install openLDAP in my debian 6.0.1 Squeeze but I got problem as there is no slapd.conf inside /etc/ldap/ directory. Is there any easy process for installation and configuration for beginners. regards, -- Dambar Raj Paudel (Wireless Technology - Researcher) WAKHOK University, Wakkanai, Japan Skype: drpaudel

12 27

integrating a new overlay to the server
by Cohen Roi 27 Apr '11

27 Apr '11

I'm working with rhel 5.5 I want to write a new overlay which also uses another library How do I compile\configure it to work within the server?? Thanks, Roi. ________________________________ "This e-mail message may contain confidential, commercial or privileged information that constitutes proprietary information of Comverse Technology or its subsidiaries. If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies and contact us by e-mailing to: security(a)comverse.com. Thank You."

1 0

LDAP proxy to AD - fails to bind
by paul.osborne＠canterbury.ac.uk 26 Apr '11

26 Apr '11

Hi, I am going through the hoops of setting up an LDAP proxy (OpenLDAP 2.3 as supplied with Red Hat 5.6) in order to expose parts of our Active Directory to other services which for political and security reasons (that I have no influence in) we do not want talking directly to the AD. In order to achieve this I would like to use ldap-back as the database to act as the proxy to the AD and then a module such as translucent to mask out the bits of the AD that we do not want exposed. So far I am fighting to get ldap-back working as I would expect, at the moment no matter what I do it fails to bind against the AD and a tcp dump demonstrates this failure. Anonymously binding and querying the AD is not an option and so I have to specify a user and get ID assertion working to force a bind against the AD as a specific known user. This does mean that anything (at the moment) could query our proxy and so get at the exposed parts of the AD and for the moment that is intentional. I am also aware that TLS etc are not enabled - this is deliberate as it makes packet sniffing for debugging easier. So for my slapd.conf I have: [slapd.conf] database ldap uri "ldap://myad.canterbury.ac.uk/" suffix "dc=myad,dc=canterbury,dc=ac,dc=uk" acl-bind bindmethod=simple binddn="CN=ldapproxy,OU=AD Administrators,DC=myad,DC=canterbury,DC=ac,DC=uk" credentials="password" access to * by * read idassert-bind bindmethod=simple authzId=dn:CN=ldapproxy,OU=Administrators,DC=myad,DC=canterbury,DC=ac,DC =uk binddn="CN=ldapproxy,OU=Administrators,DC=myad,DC=canterbury,DC=ac,DC=uk " credentials="password" idassert-authzFrom "dn.regex:.*" [end slapd.conf] At the moment I don't really care that anyone can read anything from the AD since I can't even bind, that will be tightened up in due course. I have seen others over the years have had similar issues and I have noted the responses they have received as well as reading the man pages and the Admin Guide, but am now at the point where some community support would be appreciated. Thanks Paul

1 0

Problem about CA Issue Certificate with LDAP
by Nguyen, Quoc Khanh 26 Apr '11

26 Apr '11

Hi all, I'm a new comer, I'm trying to config a CA with LDAP follow this site http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html#4.2. 4.2 CA Issue Certificate When going to step 4, I have receieved an error messeage. root@ldap:/usr/local/openssl/bin# /usr/local/openssl/ssl/misc/CA.sh -sign Using configuration from /usr/lib/ssl/openssl.cnf Error opening CA private key ./demoCA/private/cakey.pem 665:error:02001002:system library:fopen:No such file or directory:bss_file.c:356:fopen('./demoCA/private/cakey.pem','r') 665:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:358: unable to load CA private key cat: newcert.pem: No such file or directory Signed certificate is in newcert.pem I think it's very simple, but i don't know how to solve it. I have tried to many ways but fail to fix it. Maybe i don't understand about the CA Certificate. I... I am so confusing. Please help, khanhnq -- *********************************** EVERYTHING HAS JUST BEGUN...

1 0

clarifications on cachesize, preferred db, et. al. from admin guide
by Tim Mooney 21 Apr '11

21 Apr '11

All- I'm getting back to the project of upgrading our OpenLDAP infrastructure, which I started last summer but was interrupted by email outsourcing... As things currently stand, I'll be deploying 2.4.25 + BDB 4.8.30 on RHEL 5.6. I'm starting with a DB_CONFIG of set_cachesize 0 536870912 1 set_lg_regionmax 262144 set_lg_bsize 2097152 set_flags DB_LOG_AUTOREMOVE though I suspect I will tune further, as the servers are quite beefy and our OpenLDAP databases are pretty modest (60K dn, 80 MB id2entry), so we have horsepower and RAM to spare. I've been carefully reviewing the docs and admin guide and have several questions as points of clarification. - Admin Guide, section 21.4.1.1. The tuning chapter is a godsend and the section on the calculations for Berkeley DB cache sizing is extremely helpful, but I've noted that the docs indicate that each index is a hash structure and proceed to describe how to calculate how much additional cache you will want for each index you have, beyond what you need for the (Btree) id2entry and dn2id. Every single one of my index .bdb files is of type Btree, though, not Hash. Is that section of the docs outdated, and all indexed attributes are now in Btree databases (for back-bdb and presumably back-hdb), or am I fundamentally misunderstanding what the index-related cache calculations are saying? - Admin Guide, section 5. The last note in the intro section of chapter 5 mentions that some backends and overlays do not support slapd-config, without listing what those backends are. Looking through the documentation-related ITS's, it appears that at one point slapo-rwm didn't support slapd-config, but that's apparently changed. I realize it's more work to spell out what backends would prevent someone from using slapd-config, especially since it must be kept up to date as things change, but I think that explicitly listing the backends (and overlays) that don't work with slapd-config will make people more likely to choose slapd-config moving forward. As things stand, most people aren't going to know whether they can use slapd-config or not because they don't know which backends work with it and which don't. If you agree that it would be useful to explicitly list which backends would block the use of slapd-config and someone can provide me with the list of blockers, I would be happy to file an ITS and provide a patch to the current docs to spell things out. I personally think it will help adoption of slapd-config. - man page for slapd.backends(5). The man page entry states that bdb is the preferred backend. I've seen enough hints and comments on the mailing list to suggest that it will eventually be supplanted by hdb. How soon is that going to happen (2.5?), and is it worth mentioning that hdb is as good as bdb now and will be the new preferred backend soon? Again, I'll submit the ITS with the doc patch if it's worth making that assertion in the docs now. - Admin Guide, chapter 21. The tuning chapter doesn't mention the potential benefits of using an alternate memory allocator on Linux, as Quanah clued me in to on the mailing list last month. Should it? If people feel it would be worthwhile to mention, I would be happy to write the first draft and supply the patch in an ITS. - Admin Guide, chapter 21. The tuning chapter doesn't mention the potential benefits of using sysv shared memory vs. mmap'ed files on some platforms. Should it? Same offer for documentation patch applies, though I expect this one will need more feedback from the experts. Thanks, Tim -- Tim Mooney Tim.Mooney(a)ndsu.edu Enterprise Computing & Infrastructure 701-231-1076 (Voice) Room 242-J6, IACC Building 701-231-8541 (Fax) North Dakota State University, Fargo, ND 58105-5164

4 7

parsing output from ldap_search_ext_s C API
by sim123 21 Apr '11

21 Apr '11

Hi All, I am using ldap_search_ext_s C API and having strange results, not sure if I am missing something or its an API bug: My Directory Tree looks like this: | -- dc=example,dc=com | ------ ou=users,dc=example,dc=com | ---------- uid=1,ou=users,dc=example,dc=com | --------------- cn=john | ------ ou=departments,dc=example,dc=com | ---------- uid=11,ou=departments,dc=example,dc=com | --------------- cn=hr | --------------- member=uid=1 | ---------- uid=12,ou=departments,dc=example,dc=com | --------------- cn=sales | --------------- member=uid=1 | ---------- uid=13,ou=departments,dc=example,dc=com | --------------- cn=marketing | --------------- member=uid=1 First I get all the departments for "john" by using *memberof* in sarch attribute. for this query my search filter contains only one criteria ("uid=1") Then I construct another search filter for getting names of all the departments john belongs to : (|(uid=11)(uid=12)(uid=13)) I pass this filter to ldap_search_ext_s, where base is "ou=departments,dc=example,dc=com", scope is one level down, and I want "cn" in the attribute LDAPMessage* output; int retCode = ldap_search_ext_s(ld,base.c_str(), scope,filter.c_str(),attrs,false,NULL,NULL,NULL,0,&output); if(retCode == LDAP_SUCCESS){ //log success //send result to a static method for parsing LDAPUtil::parseResult(ld,output,result); ldap_msgfree(output); }else{ //log error & throw exception } LDAPUtil parse result implementation void LDAPUtil::parseResult(LDAP* ld, LDAPMessage* ldapResponse, LDAPSearchResult* parsedResult){ int numEntries = ldap_count_entries(ld,ldapResponse); cout << "number of entries" << numEntries << endl;* // I get 3 here* if(numEntries > 0){ //parse result LDAPMessage * entry; BerElement * ber; char * attr; BerVarray* vals ; map<string,LDAPAttribute*> attributeValueMap ; int count = 0; * //If I don't use count < numEntries this loop becomes an infinite loop, this loop runs 3 times, however the dn value output is:* *// run 1 :: dn: uid=11,ou=departments,dc=examples,dc=com //run 2 :: dn: uid=12,ou=departments,dc=examples,dc=com // run 3 :: dn: uid=12,ou=departments,dc=examples,dc=com* for ( entry = ldap_first_entry(ld,ldapResponse);entry != NULL && count < numEntries; entry = ldap_next_entry(ld,ldapResponse)){ count++; //create LDAP Attributes LDAPAttribute* attribute = new LDAPAttribute(); //set DN attribute->setDn(ldap_get_dn(ld,entry)); cout << "dn is " << ldap_get_dn(ld,entry) <<endl; for(attr = ldap_first_attribute(ld,entry,&ber); attr != NULL; attr=ldap_next_attribute(ld,entry,ber)) { string temp = attr; cout << "attribute :: " << attr << endl; vals = ldap_get_values_len(ld,entry,attr); if((ldap_count_values_len(vals))> 0 ){ LDAPUtil::processAttribute(attribute,temp,vals); } ldap_value_free_len(vals); } attributeValueMap.insert(pair<string,LDAPAttribute*>(attribute->getDn(),attribute)); } parsedResult->setAttributeValueMap(attributeValueMap); } } Basically above code is working only if I have one entry returned in the output. I would really appreciate if someone can help me with this. As I have hard time beliving its an API bug since I am just doing basic operation. Thanks, - Simon

1 1

Re: Installation openLDAP in Debian
by Jose Ildefonso Camargo Tolosa 21 Apr '11

21 Apr '11

On Thu, Apr 21, 2011 at 11:47 AM, Olivier Guillard <olivier(a)guillard.nom.fr> wrote: >> No, that is not the meaning of "add". > > In that case, how can you change > olcRootPW: MySecretPassword If you forgot your rootdn pass, and have no other user that with write privileges to cn=config, I guess you would need to slapcat your config, edit it, delete old config, and reload with slapadd. Or... take the risk and just edit the file by hand. Ildefonso.

2 5

Re: Installation openLDAP in Debian
by Olivier 21 Apr '11

21 Apr '11

>> No, that is not the meaning of "add". In that case, how can you change olcRootPW: MySecretPassword If it already exists but you want to change it ? --- Olivier

2 1

new entry lost on multi-master setup (two scenarios)
by Jose Ildefonso Camargo Tolosa 21 Apr '11

21 Apr '11

Greetings, At first, I was going to create a bug report, but decided to send to list first. I tried this with both: 2.4.23 (Debian package), and 2.4.25, compiled from source, bdb 4.8. After a couple of entries just disappeared on one multi-master setup I had, I decided to further investigate, and found this (there are two cases, for the same procedure): 1. Configure two LDAP servers in multi-master setup. 2. Make sure they replicate correctly (off course). 3. Shutdown one of the two ldap servers. 4. Create a new entry (say, ou1) on the LDAP server that is left up. 5. Shutdown the last LDAP server. 6. Start the *other* LDAP server, the one where you didn't create the entry. 7. Create another entry, say: ou2, so that both servers has a new entry, that is *not* on the other server. 8. Shutdown the LDAP server (both servers down now). 9. Start both LDAP servers. Result (case 1): one of the two newly created entries is missing on *one* of the servers, and only one of the entries is missing on the other server. Result (case 2): one entry is missing on *both* servers. Both servers has NTP, and has the same timezone (ie, time is synchronized). I'm *not* replicating cn=config (I shouldn't, because I have different SSL certificates on each server). Now, more details: slapd with -d 16384 gives me this on the server that misses both entries, on this server I created the entry dn ou=ou2,dc=st-andes,dc=com (and the server decided to delete it!, and, for some reason, it didn't detected the new ou1 entry created on the other server): http://www.st-andes.com/openldap/case1/log-server2-case1.txt The other server (the one that kept one entry and lost the other), on this server I created the entry ou=ou1,dc=st-andes,dc=com, and it says it was changed by peer.....: http://www.st-andes.com/openldap/case1/log-server1-case1.txt Now, I'm seeing here that it is using 000 server id... but on the cn=config.ldif I have: olcServerID: 1 ldap://ldap.ildetech.com:389/ olcServerID: 2 ldap://ldap2.ildetech.com:389/ And the syncrepl: olcSyncRepl: rid=001 provider=ldap://ldap.ildetech.com:389 binddn="cn=admin,dc=st-andes,dc=com" bindmethod=simple credentials="secret" searchbase="dc=st-andes,dc=com" type=refreshAndPersist retry="3 5 5 +" timeout=7 starttls=critical olcSyncRepl: rid=002 provider=ldap://ldap2.ildetech.com:389 binddn="cn=admin,dc=st-andes,dc=com" bindmethod=simple credentials="secret" searchbase="dc=st-andes,dc=com" type=refreshAndPersist retry="3 5 5 +" timeout=7 starttls=critical olcMirrorMode: TRUE And, as you can see on the command line, I have the URL specified on the -h parameter, but it seems to be ignoring it!. Or, should I specify the *whole* urls that I put on the -h parameter? (ldap://ldap2.ildetech.com:389 ldap://127.0.0.1:389/ ldaps:/// ldapi:///) So, I decided to change the config: On server 1 (kirara): olcServerID: 1 and olcSyncRepl: rid=002 provider=ldap://ldap2.ildetech.com:389 binddn="cn=admin,dc=st-andes,dc=com" bindmethod=simple credentials="secret" searchbase="dc=st-andes,dc=com" type=refreshAndPersist retry="3 5 5 +" timeout=7 starttls=critical olcMirrorMode: TRUE On server 2 (happy): olcServerID: 2 and olcSyncRepl: rid=002 provider=ldap://ldap2.ildetech.com:389 binddn="cn=admin,dc=st-andes,dc=com" bindmethod=simple credentials="secret" searchbase="dc=st-andes,dc=com" type=refreshAndPersist retry="3 5 5 +" timeout=7 starttls=critical olcMirrorMode: TRUE With this new setup, and following the same procedure, I get one missing entry on *both* servers (at least servers gets to a consistent state), but I still have a missing entry. The logs for this setup: Server 2 (ID 2, where I created entry: ou2 while the other server was down), this server decided, wrongly, to delete entry ou2: http://www.st-andes.com/openldap/case2/log-server2-case2.txt And the other server (where I created ou1): http://www.st-andes.com/openldap/case2/log-server1-case2.txt This one never saw the other entry, ou2. For both cases, the syncprov module was with default configuration: dn: olcOverlay={0}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 24354488-e5bf-102f-9e6a-ad3cba95f7f1 creatorsName: cn=config createTimestamp: 20110318152128Z entryCSN: 20110318152128.935227Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20110318152128Z What do you think? Thanks in advance! Ildefonso Camargo

3 5

Re: Installation openLDAP in Debian
by Jose Ildefonso Camargo Tolosa 21 Apr '11

21 Apr '11

Resending on-list. On Wed, Apr 20, 2011 at 1:33 PM, Simone Piccardi <piccardi(a)truelite.it> wrote: > On 20/04/2011 17:42, Jose Ildefonso Camargo Tolosa wrote: >>> >>> Modern OpenLDAP does not use slapd.conf. Please read the OpenLDAP Admin >>> guide. >> >> Quanah: actually, documentation is not yet complete for cn=config, I >> had to actually convert my slapd.conf to cn=config using slaptest in >> order to find out how to do the same I had on slapd.conf on cn=config. >> >> Ildefonso > > That's the way I'm using it. And I suggest to anyone not needing to modify > configurations on the fly to use it that way. > > Because apart the missing documentation, I found difficult having to deal > with the obscure attribute names and the complex directory structure (and > the not so explicative file names used under it) that I found in > /etc/ldap/slapd.d/. Well, I actually got used to cn=config pretty quickly, nevertheless, I still find easier to understand and modify the slapd.conf file than the directory structure under slapd.d... it is definitely more complex (and I don't think it is easier to modify using a LDAP administration tool). The "cn=config" replication suggested on the docs becomes useless when you need to use TLS, because, AFAIK, we don't have a way of having different TLS parameters for each replica (and, on a multi-master setup, you will likely have different servers, with different names, and thus: different SSL certificate). > > I understand the needs for cn=config, but for the moment I don't need it. > Having a file with a simple syntax that I can read and modify instead of a > tree of LDIF files is far more convenient for me. So I hope that slapd.conf > will remain supported. +1, we shouldn't drop slapd.conf file. > > Simone > -- > Simone Piccardi Truelite Srl > piccardi(a)truelite.it (email/jabber) Via Monferrato, 6 > Tel. +39-347-1032433 50142 Firenze > http://www.truelite.it Tel. +39-055-7879597 Fax. +39-055-7333336 >

5 5

Re: Installation openLDAP in Debian
by Howard Chu 21 Apr '11

21 Apr '11

Olivier Guillard wrote: >> On a fresh installation that has not yet been configured: ... > > Thanks howard, it helps. > > For other readers I add this found in the slapadd doc : > >> LIMITATIONS >> Your slapd(8) should not be running when you do this to ensure consis‐ >> tency of the database. > > Something I have to test : > > What happens if you attempt to add an entry or change an attribute > that already exists using "slapadd" (I suspect that the old entry is > replaced). No, that is not the meaning of "add". -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Simple LDAP to LDAP Integration
by Alejandro Imass 20 Apr '11

20 Apr '11

On Wed, Apr 20, 2011 at 12:39 PM, Bill MacAllister <whm(a)stanford.edu> wrote: > > > --On Wednesday, April 20, 2011 10:23:20 AM -0400 Alejandro Imass > <ait(a)p2ee.org> wrote: > >> Hello, >> [...] > One way to do this is to configure your OpenLDAP server to generate an > accesslog. They you read the accesslog looking for any changes and > apply the changes to your downstream datastore whatever it is. We do > this using perl and Net::LDAPapi. I can provide an example if you are > interested. > Hi Bill, thank you *very* much for your prompt reply. One question (actually 2) though before I ask for the trouble of providing an example.... do you get the clear text passwd on the accesslog? is the the log an LDIF format? It's not that I really need clear text, but I need to compute the corresponding password hashes for MS-AD. are you guys able to change the password fields as well? or are you just copying the hashes from one to the other? how does this work with the accesslog method? Again many thanks because I really feel that this could be a practical KISS way of integrating this. Thanks!!! Alex > Bill > > -- > > Bill MacAllister > Infrastructure Delivery Group, Stanford University > >

2 1

Simple LDAP to LDAP Integration
by Alejandro Imass 20 Apr '11

20 Apr '11

Hello, I am seeking a simple integration between OpenLDAP and MS AD. The DIT structures are completely different but the Posix UIDs are the same. The integration is very simple because all we need to do is update the corresponding UID in AD whenever an entry changes in OpenLDAP (i.e. OpenLDAP is the master here). I though it would be easy to use the overlays for this but after careful examination it is not what we need. All we need for the moment is to capture the entry write event in OpenLDAP and run an external subroutine/program/lib that connects to the AD and does the changes there. We already have the second part developed in Perl, that is, we have a Perl program that connects to AD and changes whatever we want. We now need to pass this program the data that have changed in OpenLDAP. We could turn the Perl program into an LDAP server as well so we could maybe use the overlays, so in this case, the Perl program would receive the LDAP, and translate that to AD. The other option is to use SLAPI and capture the change event and use that to connect to AD, maybe spawning a daemonized process in Perl in order not to hang OpenLDAP waiting for AD. Anyway, if anyone can give us a hand as to how to approach this and what are the best alternatives to do this integration would be great. We would gladly publish this OpenLDAP to AD integration as OpenSource. Or if anyone happens to know if this already exists (but needs to be flexible because we need to translate from one DIT structure to the other with different schemas on each). Thanks! Alex

3 3

Re: Installation openLDAP in Debian
by Jose Ildefonso Camargo Tolosa 20 Apr '11

20 Apr '11

On Wed, Apr 20, 2011 at 10:53 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, April 20, 2011 6:51 PM +0900 "D. R. Paudel" > <rajme690(a)gmail.com> wrote: > >> Hi, >> I tried to install openLDAP in my debian 6.0.1 Squeeze but I got problem >> as there is no slapd.conf inside /etc/ldap/ directory. Is there any easy >> process for installation and configuration for beginners. > > Modern OpenLDAP does not use slapd.conf. Please read the OpenLDAP Admin > guide. Quanah: actually, documentation is not yet complete for cn=config, I had to actually convert my slapd.conf to cn=config using slaptest in order to find out how to do the same I had on slapd.conf on cn=config. Ildefonso > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

2 1

proxy Auth and authzto
by LALOT Dominique 20 Apr '11

20 Apr '11

Hello, I tried some configuration in order to get porxyAuth working. I would like to know if it's restricted to SASL. We use PLAIN LOGIN over TLS in order to work with all auth method, SSO and so on. Could you confirm? Thanks Dom -- Dominique LALOT Ingénieur Systèmes et Réseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

2 1

"Name forms" with slapo-constraint
by Michael Ströder 20 Apr '11

20 Apr '11

HI! I tried to use slapo-constraint on entryDN when adding new entries. Kind of poor man's name forms... constraint_attribute entryDN regex mail=[^,],departmentNumber=[0-9]+,O=MyOrg restrict="ldap:///O=MyOrg??sub?(objectClass=inetOrgPerson)" But looking at the trace log it seems this is not evaluated at all probably entryDN is not present in the added entry and not yet generated. Any hints whether that might work? Ciao, Michael.

1 0

Data aggregator
by Hugo Monteiro 20 Apr '11

20 Apr '11

Hello all, This post may be a little OT, but i'm sure this subject has bitten some of you some time. So, i'm willing to take the chance. Anyway, feel free to redirect me and this conversation elsewhere. Background: There's an LDAP infrastructure set up, which has been fed and maintained by a "in the house" made management system. This management system primary role is NOT to manage LDAP data, but it was where the data lived, some extensions where developed to provide that extra functionality. Years have passed and more and more we depend on our LDAP service. But we also have more and more the need to add other data to LDAP, which doesn't exist in the still in place management system. Changing the LDAP data model has also become a major headache since that type of change will also force maintenance to the management system accordingly. Objective: I'm currently delegated to find a modular solution that can aggregate data from several sources, relational databases, other ldap servers, flat text files, whatever, and be able to maintain a centrally managed information database which can then be exported to/served by an LDAP server. The solution could aggregate data directly into an LDAP database, or it could maintain it's own database that could be later exported to ldif, or sync to LDAP. The main purpose here would also to be able to find something that would do this, or that could be set with some minimal changes to perform as described, WITHOUT being an "in the house" solution. Sorry if it felt like i'm daydreaming, but i would love to hear peoples thoughts on this matter. Best regards, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

3 2

userCertificate
by Leonardo 20 Apr '11

20 Apr '11

Would i like to know if it is possible to read a certificate field directly from openldap? This certificate is stored on openldap. It attribute on OpenLDAP is userCertificate.

3 3

difficulties to stop slapd
by LALOT Dominique 20 Apr '11

20 Apr '11

Hello, Our openldap is sometimes long to stop and init scripts failed to stop. Apr 20 09:10:47 ldap1 slapd[15105]: daemon: shutdown requested and initiated. Apr 20 09:10:47 ldap1 slapd[15105]: slapd shutdown: *waiting for 0 operations/tasks to finish* Apr 20 09:*12:46 *ldap1 slapd[15105]: slapd stopped. It tooks 2 minutes to stop. So the init scrit failed and restart is not safe. An auto update on ubuntu leaves slapd in a strange state once and the cause was that long wait for 0 task to finish. Normaly, zero means immediate. Here two minutes! We have 5 glued bdb databases. Is it due to the bdb close for these databases? Is there a way to get things more reliable OpenLDAP: slapd 2.4.23 (Mar 30 2011 16:20:41) $ ^Ibuildd@crested :/build/buildd/openldap-2.4.23/debian/build/servers/slapd Description: Ubuntu 10.10 2.6.35-27-server #48-Ubuntu SMP Tue Feb 22 21:53:16 UTC 2011 x86_64 GNU/Linux libdb-4.8.so Thanks Dom -- Dominique LALOT Ingénieur Systèmes et Réseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

2 1

cn=config replication to consumer / slave servers
by Christopher Strider Cook 20 Apr '11

20 Apr '11

I have a pair of mirror mode master servers that I would like to be able to provide cn=config replication to a series of slave servers, primarily, to keep ACLs in sync across servers. I've tried syncrepl to the cn=config of the primary servers trying to exclude certain objects and attributes to prevent the slave from also taking the syncprov role. This did not seem to work well enough as I was unable to prevent some unwanted entry or another from making it's way through and overwriting the syncrepl line itself. Alternately, I tried to setup a separate database cn=config_slave and have that snycrepl to the slave into cn=config... but that creates a naming missmatch. Is there an approved practice to achieve this, or some other pointers on avenues to explore? Thanks, Chris

3 8

memberof/accesslog overlays together
by Michael Ströder 19 Apr '11

19 Apr '11

HI! Unfortunately for privacy reasons I can't provide example data. I'm using slapo-memberof, slapo-refint and slapo-access in exactly this order. Now I'm analysing some strange things where modifications to group entries and the subsequent modifications by slapo-memberof are not correctly written to the accesslog DB. Questions: 1. Is this overlay order a correct setup? Should this work? Or should slapo-memberof be invoked after slapo-access? 2. CHANGES of release 2.4.24 lists a bunch of fixes to slapo-memberof. Any changes which possibly affect writing to accesslog DB? (I'm not sure whether we had problems like this with 2.4.23 or not though.) Ciao, Michael.

2 2

delta-syncrepl and N-Way Multi-Master
by Al 19 Apr '11

19 Apr '11

Hi All, I am researching implementation options, and am not 100% clear on whether delta-syncrepl and N-Way Multi-Master are compatible. Can you confirm or deny? If so, have people found success using this? Thanks in advance, Al

2 1

newbie slapd.conf VS slapd.d management ?
by Olivier 18 Apr '11

18 Apr '11

Hi everyone, SUMMARY : IN A DAY TO DAY ADMINISTRATION, SHOULD I EDIT SLAPD.CONF AND USE SLAPTEST TO TRANSLATE INTO SLAPD.D STYLE OR SHOULD I EDIT DIRECTLY FILES IN SLAPD.D AND DEFINITIVELY REMOVE THE SLAPD.CONF FILE ? IN THE FORMER CASE, IS THERE A DOCUMENTATION THAT DOESN'T MIX SLAPD.CONF WITH SLAPD.D STYLE (I'm a bit confused with examples I find to be honnest). Additional info about my question : I just start with ldap and I want to deploy an internal ldap directory that will be used for various application (authentication, information about staff in the company, etc). We are fresh, therefore we start "from scratch". I'm playing with tan openldap server 2.4 installed on a fedora. The documentation about the slapd configuration file(s) is not quite clear to me : I find information about how to configure the server by editing "slapd.conf", and at the same time this documentation says that this file is obsolete and configuration files should now now be stored in "slapd.d" directory. I have managed to edit a correct slapd.conf file and I translated it to a slapd.d style using slaptest utility : slapd is runing and I can query my directory... ok ! But could some tell me what is the PROPER way to now maintain and admininistrate an operational openldap directory : slapd.conf or slapd.d style ? THANKS FOR YOUR HELP ! --- Olivier

3 2

AD sporadically gives LDAP_SERVER_DOWN after the first request
by Markus Sander 18 Apr '11

18 Apr '11

My employer ships software for Linux and other Unix-like OSes that binds to Active Directory in order to, basically, integrate it to AD. Functionally, it is not too dissimilar to pam_krb5 and nss_ldap. OpenLDAP 2.4.18 is used to bind to Active Directory LDAP servers. Authentication (to a machine trust account) is done using a Kerberos keytab. MIT Kerberos is used. Group membership data are stored in LDAP objects of class Group which have the `member' attribute (multiply) filled with the DN of all members. Those DNs are of type Group or of type User (I'm just chasing users for now), and their `sAMAccountName' value is what I need to give to NSS as the group member's name. My procedure is as follows: First, I bind to one of several configured LDAP servers using SASL2/GSSAPI, i.e. Kerberos 5. Then I inquire all of the result set's `member' attributes and resolve the resulting DNs one by one to build a DN => sAMAccountName map in memory (that's about 10k entries, so, not a problem here). Then, I request the actual group entries and look up the DNs in the `member' attribute in the map. Last, the connection is terminated. The group members' `sAMAccountName' is inquired one by one with the base set to the DN (which I already know), the scope set to flat, and the filter set to (objectClass=*). So that's about 10k single queries in quick succession. The whole group query typically takes about 6 seconds. The problem is: OpenLDAP sometimes gives me LDAP_SERVER_DOWN during the `sAMAccountName' queries. This occurs sporadically but then typically for the rest of the `sAMAccountName' queries. The group entry query that follows does succeed. Most of the time the first of those errors immediately follows a GSSAPI error, nameley, DES key is a weak key, which may be true but appears unrelated, since only AES512, AES256 and HMAC are used in the keytab. The customer's DC admins say that the DCs are not at fault. We asked them to try to increase the server limits (such as max number of active queries per worker thread, which defaults to 4 or something), since about 2k client workstations molest 4 DCs every 30 minutes with the mentioned query (and others). They are very reluctant to do that and we have trouble replicating the problem in-house anyway, so overload need not be the root cause. The DC logs reportedly show nothing unusual. My software has been in use for about three months now, but the rollout was still on-going until lately. Customer acceptance tests did not report the problem. The first incident has been reported about two weeks ago. They set up monitoring and the bell now rings every couple of minutes somewhere. Most queries still get through without problem, though. Other queries, such as those for Netgroups, do not seem to have any problem. They also doubled the number of DCs (to four) four weeks ago, since the two they had were quite busy. The new DCs are similar in hardware but are significantly less under load, which seems odd since all four of those DCs exist just to serve our software and our software can be shown to distribute the queries fairly. Restricting our software to only the old or only the new DCs does not have any effect on the failure rate. I increased the OpenLDAP log level, but nothing enlightening turned up. What could be the cause of the failures during the group member resolution?

2 2

Configuration on Windows xp of OpenLDAP
by Mahesh Birajdar 18 Apr '11

18 Apr '11

Hi all, I am new to the OpenLDAp stuff. I want to configure OpenLDAP On windows platform and create users and administer them. Please anyone can help me.. Any Document stating how to configure and create users n administer them would be very much helpful... Thanks and Regards, MAHESH BIRAJDAR DISCLAIMER ========== This e-mail may contain privileged and confidential information which is the property of Persistent Systems Ltd. It is intended only for the use of the individual or entity to which it is addressed. If you are not the intended recipient, you are not authorized to read, retain, copy, print, distribute or use this message. If you have received this communication in error, please notify the sender and delete all copies of this message. Persistent Systems Ltd. does not accept any liability for virus infected mails.

1 0

return an attribute of all users belonging to a group
by George Mamalakis 17 Apr '11

17 Apr '11

Dear all, I have a question regarding my openldap DIT design. My design so far is based on the model: ou=people,dc=example,dc=com. It is very possible that I'll have to be able to find attributes of people belonging to some specific group (eg, student, postgrad, etc). The easiest way to address this issue for me would be to branch my DIT like this: ou=undergrads,ou=people,dc=example,dc=com and ou=postgrads,ou=people,dc=example,dc=com. On the other hand, I have several classes that I would like to distinguish my users to apart from this (like stuff, student, professors, etc.) but further sub-brunching shows to me that there's something wrong with my design (since those classes may dynamically change in the future). As a second solution I thought that it would be very easy to make my users in ou=people,dc=example,dc=com belong to some group located in ou=groups,dc=example,dc=com. This way I feel much more flexible in making such classifications, but my problem is how to formulate ldapsearch filters so as to return an attribute of some user only if the specific user belongs to one or more of my groups (for example to find all email accounts from my people that belong to the undergrads group). Thank you all for your time in advance, kind regards, George Mamalakis. PS. In the case that this is not the right place to ask questions regarding ldap programming, please address me to some related resource. The truth is that I haven't found such a place by googling, meaning that the places I've found did not seem to be maintained well. -- George Mamalakis IT Officer Electrical and Computer Engineer (Aristotle Un. of Thessaloniki), MSc (Imperial College of London) Department of Electrical and Computer Engineering Faculty of Engineering Aristotle University of Thessaloniki phone number : +30 (2310) 994379

2 2

Re: return an attribute of all users belonging to a group
by George Mamalakis 17 Apr '11

17 Apr '11

On 17/04/2011 14:03, Stefan Seelmann wrote: > Hi George, > > On Sun, Apr 17, 2011 at 12:07 PM, George Mamalakis<mamalos(a)eng.auth.gr> wrote: >> Dear all, >> >> I have a question regarding my openldap DIT design. My design so far is >> based on the model: ou=people,dc=example,dc=com. It is very possible that >> I'll have to be able to find attributes of people belonging to some specific >> group (eg, student, postgrad, etc). The easiest way to address this issue >> for me would be to branch my DIT like this: >> >> ou=undergrads,ou=people,dc=example,dc=com and >> ou=postgrads,ou=people,dc=example,dc=com. On the other hand, I have several >> classes that I would like to distinguish my users to apart from this (like >> stuff, student, professors, etc.) but further sub-brunching shows to me that >> there's something wrong with my design (since those classes may dynamically >> change in the future). >> >> As a second solution I thought that it would be very easy to make my users >> in ou=people,dc=example,dc=com belong to some group located in >> ou=groups,dc=example,dc=com. This way I feel much more flexible in making >> such classifications, but my problem is how to formulate ldapsearch filters >> so as to return an attribute of some user only if the specific user belongs >> to one or more of my groups (for example to find all email accounts from my >> people that belong to the undergrads group). > A third approach is to to store the group as attribute in the user > entries. The eduPerson schema [1] should fit your needs. Add the > eduPerson object class to your user entries and use the > eduPersonAffiliation multi-valued attribute to add the groups. > > Kind Regards, > Stefan > > [1] http://middleware.internet2.edu/eduperson/ > Stefan, thank you very much for your advise. I had already included the eduperson schema in my configuration, but I had never seen this attribute in use. I will definitely take advantage of it, now that you told me its use. Thanks again for your help, regards, George. -- George Mamalakis IT Officer Electrical and Computer Engineer (Aristotle Un. of Thessaloniki), MSc (Imperial College of London) Department of Electrical and Computer Engineering Faculty of Engineering Aristotle University of Thessaloniki phone number : +30 (2310) 994379

1 0

Local home directory with ADS LDAP authentication
by Madhusudan Singh 17 Apr '11

17 Apr '11

Hello I have an LDAP authentication setup that authenticates users against a server that I do not control. However, whenever a user logs in, the default home directory is set to an NFS mount on another server. I want to change the settings so that the user's home directory is local, say, /home/CAMPUS/username. How do I do that ? With regards.

5 8

differing behavior of ldapsearch
by Michael Slack 15 Apr '11

15 Apr '11

I have an openldap server where I have people entered in basic inetOrgPerson format. I am having an issue where it can't authenticate some users. I have narrowed things down to an issue where if I run: ldapsearch -x -L -D "<myRootDn>" -W -b "<myBaseOU>" "uid=tony" It successfully returns my user object. BUT if I run: ldapsearch -x -L -D "<myRootDn>" -W -b "<myBaseOU>" -h localhost "uid=tony" it will not find the object. I seem to remember that ldapsearch with the default connect will open the DB files directly and read them ??? If so, why can ldapsearch find the object, but slapd can't. If not, what is happening that allows the previous option set to succeed while the second option set fails? BTW: before I get asked, only some user objects are not found. i.e. "uid=kent" is found fine both ways. I tried to generalize my user object such that it isn't the content of the object that would cause the problem, but I also recognize that it is still a possible culprit. This is running on a CentOS box. The RPM is openldap-servers-2.3.27-8.el5_1.3 Thanks in advance for any insight... -- Tony Slack

2 1

Database meta does not have any root node
by michel.gruau 15 Apr '11

15 Apr '11

Hello, I am trying to configure an LDAP proxy towards 2 LDAP targets and I'm using the meta backend as follows: database meta suffix ou=A,o=B,c=C uri ldap://server1/ou=S1,ou=A,o=B,c=C uri ldap://server2/ou=S2,ou=A,o=B,c=C It is working fine except for one point : I'm unable to peform a base search on my root node "ou=A,o=B,c=C". It always respond with error code 32 (no such object). Reading the man page slapd-meta, I understand this is the normal behaviour. But is there a mean to make this root suffix becoming à concrete node ? This point is mandatory for me as many of my client applications are looking for this entry. I tried to create another backend above this one (using subordinate keyword) in order to host this root note but slapd always complain about the fact the suffix is defined twice. Thank you very much for your help. Michel Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

4 6

fedora and openldap
by Judith Flo Gaya 15 Apr '11

15 Apr '11

Hello, After some time dealing with ldap and fedora, I'm stuck with an strange behaviour. I can successfully change the password for a certain user using the ldappasswd command, after this change (either done by the manager of the ldap or the same user) I can successfully ssh to the machine using this password. In this moment if I do slapcat I can see a password with this form: e01ENX1pMjcvdjYyeEFvNmI4R212YUdQeDZ3PT0= Instead if I change the password using the password command, I can see passwords much longer than the above one, this is what I can see after changing the passwd. e2NyeXB0fSQxJER1VDNiMEtQJE1GNmQ5UGo4YXhSQXp0RW9VNDVUNDA= I configured the client to use ldap with this command: authconfig --enableforcelegacy --disablecachecreds --enableldap --enableldapauth --ldapserver=172.19.5.13 --ldapbasedn=dc=linux,dc=imppc,dc=org --disableldaptls --disablefingerprint --disablewinbind --disablewins --disablesssd --disablesssdauth --disablenis --enablecache --enablelocauthorize --usemd5 --updateall This command takes care of all the pam.d files, and considering that the ssh does work with the password set by the ldappasswd command, where is the problem? The server is an openldap-2.4.25. Am I missing something? I though that it was perfectly possible to use passwd instead of ldappasswd. Any help will be extremely appreciated. Thanks a lot, j

8 50

Solaris10+openldap+nss_ldap+pam_ldap=nightmare
by Juergen.Sprenger＠swisscom.com 15 Apr '11

15 Apr '11

If everything else works fine, and only ssh fails check sshd_config for this parameter: PAMAuthenticationViaKBDInt yes pam.conf: Try moving statements with ldap.so.1 to the end of each section and add debug switch: login auth requisite pam_authtok_get.so.1 login auth required pam_dhkeys.so.1 login auth required pam_unix_cred.so.1 login auth sufficient pam_unix_auth.so.1 login auth required pam_dial_auth.so.1 login auth sufficient pam_ldap.so.1 try_first_pass debug If it's not only ssh-login: - is output of 'getent passwd' ok? - provide output of 'ldaplist' - provide output of 'ldapclient list' - check setup of nscd (svc:/system/name-service-cache:default) Jürgen Sprenger

1 0

keyword <modulepath> ignored
by sarath chandra 15 Apr '11

15 Apr '11

Hi, When starting openldap, i'm getting this error: line 27 (modulepath /usr/lib/openldap) /usr/local/etc/openldap/slapd.conf: line 27: keyword <modulepath> ignored I'm using openldap-2.4.25 on CentOs 5. The config command was: export LDFLAGS='-L/usr/local/lib -L/usr/local/lib -L/usr/local/lib' export CPPFLAGS='-I/usr/local/include -I/usr/local/include -I/usr/local/include' ./configure --enable-bdb --enable-crypt --with-tls --enable-overlays=mod --enable-modules=yes --enable-ppolicy=mod --libexecdir=/usr/sbin Any help ??? TIA Sarath

6 21

Solaris10+openldap+nss_ldap+pam_ldap=nightmare
by Nathanael Anderson 13 Apr '11

13 Apr '11

I've been working on configuring solaris 10 to auth against openldap. Currently i have a centos 5.4 box authing against the same ldap server, and all local solaris openldap tools work on the solaris host that i'm having issues with. I believe the issue is related to pam or ssh, as I don't see any of the expected ldap related information in the output of truss on the debug ssh process I ran (included below). Anyone on the list see an issue like this before? Here are relevant config files: # /etc/pam.conf # Authentication management # # login service (explicit because of pam_dial_auth) # login auth sufficient /lib/security/pam_ldap.so.1 debug login auth requisite pam_authtok_get.so.1 debug login auth required pam_dhkeys.so.1 debug login auth required pam_unix_cred.so.1 debug login auth required pam_dial_auth.so.1 debug login auth required pam_unix_auth.so.1 server_policy debug # # rlogin service (explicit because of pam_rhost_auth) # rlogin auth sufficient /lib/security/pam_ldap.so.1 debug rlogin auth sufficient pam_rhosts_auth.so.1 debug rlogin auth requisite pam_authtok_get.so.1 debug rlogin auth required pam_dhkeys.so.1 debug rlogin auth required pam_unix_cred.so.1 debug rlogin auth required pam_unix_auth.so.1 server_policy debug # # rsh service (explicit because of pam_rhost_auth, # and pam_unix_auth for meaningful pam_setcred) # rsh auth sufficient /lib/security/pam_ldap.so.1 debug rsh auth sufficient pam_rhosts_auth.so.1 rsh auth required pam_unix_cred.so.1 rsh auth required pam_unix_auth.so.1 server_policy debug # # PPP service (explicit because of pam_dial_auth) # ppp auth sufficient /lib/security/pam_ldap.so.1 debug ppp auth requisite pam_authtok_get.so.1 ppp auth required pam_dhkeys.so.1 ppp auth required pam_dial_auth.so.1 ppp auth required pam_unix_auth.so.1 server_policy debug # # Default definitions for Authentication management # Used when service name is not explicitly mentioned for # authentication # other auth sufficient /lib/security/pam_ldap.so.1 debug other auth requisite pam_authtok_get.so.1 other auth required pam_dhkeys.so.1 other auth required pam_unix_cred.so.1 other auth required pam_unix_auth.so.1 server_policy debug # # passwd command (explicit because of a different authentication # module) # passwd auth sufficient /lib/security/pam_ldap.so.1 debug passwd auth required pam_passwd_auth.so.1 server_policy debug # # cron service (explicit because of non-usage of pam_roles.so.1) # cron account required pam_unix_account.so.1 # # Default definition for Account management # Used when service name is not explicitly mentioned for account # management # other account sufficient /lib/security/pam_ldap.so.1 debug other account requisite pam_roles.so.1 other account required pam_unix_account.so.1 server_policy # # Default definition for Session management # Used when service name is not explicitly mentioned for session #management # other session required pam_unix_session.so.1 #other session required pam_mkhomedir.so.1 # # Default definition for Password management # Used when service name is not explicitly mentioned for password # management # other password required pam_dhkeys.so.1 other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 other password required pam_authtok_store.so.1 server_policy # # Support for Kerberos V5 authentication and example configurations # can # be found in the pam_krb5(5) man page under the "EXAMPLES" section. sshd-pubkey account required pam_unix_account.so.1 # /etc/ldap.conf ssl start_tls HOST hostname.domain:389 hostname.domain:389 BASE ou=people,dc=hostname,dc=domain pam_filter objectclass=posixAccount pam_login_attribute uid TLS_CACERT /etc/openldap/cacerts/hostname.domain.cert.pem TLS_REQCERT allow # /etc/nsswitch.conf passwd: files ldap group: files ldap # You must also set up the /etc/resolv.conf file for DNS name # server lookup. See resolv.conf(4). hosts: files dns # Note that IPv4 addresses are searched for in all of the ipnodes databases # before searching the hosts databases. ipnodes: files dns networks: files protocols: files rpc: files ethers: files netmasks: files bootparams: files publickey: files # At present there isn't a 'files' backend for netgroup; the system will # figure it out pretty quickly, and won't use netgroups at all. netgroup: files automount: files aliases: files services: files printers: user files auth_attr: files prof_attr: files project: files tnrhtp: files tnrhdb: files # truss of ssh debug process on attempted login: execve("/usr/lib/ssh/sshd", 0x08047C34, 0x08047C48) argc = 4 mmap(0x00000000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_ANON, -1, 0) = 0xCE7F0000 resolvepath("/usr/lib/ld.so.1", "/lib/ld.so.1", 1023) = 12 resolvepath("/usr/lib/ssh/sshd", "/usr/lib/ssh/sshd", 1023) = 17 stat64("/usr/lib/ssh/sshd", 0x080479C0) = 0 open("/var/ld/ld.config", O_RDONLY) Err#2 ENOENT sysconfig(_CONFIG_PAGESIZE) = 4096 stat64("/usr/sfw/lib/libsocket.so.1", 0x08047260) Err#2 ENOENT stat64("/lib/libsocket.so.1", 0x08047260) = 0 resolvepath("/lib/libsocket.so.1", "/lib/libsocket.so.1", 1023) = 19 open("/lib/libsocket.so.1", O_RDONLY) = 3 mmap(0x00010000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_ALIGN, 3, 0) = 0xCE7B0000 mmap(0x00010000, 114688, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE790000 mmap(0xCE790000, 44002, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xCE790000 mmap(0xCE7AB000, 2645, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 45056) = 0xCE7AB000 munmap(0xCE79B000, 65536) = 0 memcntl(0xCE790000, 12080, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(3) = 0 stat64("/usr/sfw/lib/libnsl.so.1", 0x08047260) Err#2 ENOENT stat64("/lib/libnsl.so.1", 0x08047260) = 0 resolvepath("/lib/libnsl.so.1", "/lib/libnsl.so.1", 1023) = 16 open("/lib/libnsl.so.1", O_RDONLY) = 3 mmap(0xCE7B0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xCE7B0000 mmap(0x00010000, 647168, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE6F0000 mmap(0xCE6F0000, 526365, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xCE6F0000 mmap(0xCE781000, 19893, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 528384) = 0xCE781000 mmap(0xCE786000, 30056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_ANON, -1, 0) = 0xCE786000 munmap(0xCE771000, 65536) = 0 memcntl(0xCE6F0000, 58076, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(3) = 0 stat64("/usr/sfw/lib/libz.so.1", 0x08047260) Err#2 ENOENT stat64("/lib/libz.so.1", 0x08047260) Err#2 ENOENT stat64("/usr/lib/libz.so.1", 0x08047260) = 0 resolvepath("/usr/lib/libz.so.1", "/usr/lib/libz.so.1", 1023) = 18 open("/usr/lib/libz.so.1", O_RDONLY) = 3 mmap(0xCE7B0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xCE7B0000 mmap(0x00010000, 126976, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE6D0000 mmap(0xCE6D0000, 58404, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xCE6D0000 mmap(0xCE6EE000, 2602, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_FIXED|MAP_INITDATA, 3, 57344) = 0xCE6EE000 munmap(0xCE6DF000, 61440) = 0 memcntl(0xCE6D0000, 4104, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(3) = 0 stat64("/usr/sfw/lib/libpam.so.1", 0x08047260) Err#2 ENOENT stat64("/lib/libpam.so.1", 0x08047260) = 0 resolvepath("/lib/libpam.so.1", "/lib/libpam.so.1", 1023) = 16 open("/lib/libpam.so.1", O_RDONLY) = 3 mmap(0xCE7B0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xCE7B0000 mmap(0x00010000, 94208, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE6B0000 mmap(0xCE6B0000, 21939, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xCE6B0000 mmap(0xCE6C6000, 3129, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 24576) = 0xCE6C6000 munmap(0xCE6B6000, 65536) = 0 mmap(0x00000000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_ANON, -1, 0) = 0xCE7C0000 memcntl(0xCE6B0000, 3384, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(3) = 0 stat64("/usr/sfw/lib/libbsm.so.1", 0x08047260) Err#2 ENOENT stat64("/lib/libbsm.so.1", 0x08047260) = 0 resolvepath("/lib/libbsm.so.1", "/lib/libbsm.so.1", 1023) = 16 open("/lib/libbsm.so.1", O_RDONLY) = 3 mmap(0xCE7B0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xCE7B0000 mmap(0x00010000, 208896, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE670000 mmap(0xCE670000, 118546, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xCE670000 mmap(0xCE69D000, 16558, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 118784) = 0xCE69D000 mmap(0xCE6A2000, 248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_ANON, -1, 0) = 0xCE6A2000 munmap(0xCE68D000, 65536) = 0 memcntl(0xCE670000, 27028, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(3) = 0 stat64("/usr/sfw/lib/libwrap.so.1", 0x08047260) = 0 resolvepath("/usr/sfw/lib/libwrap.so.1", "/usr/sfw/lib/libwrap.so.1.0", 1023) = 27 open("/usr/sfw/lib/libwrap.so.1", O_RDONLY) = 3 mmap(0xCE7B0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xCE7B0000 mmap(0x00010000, 98304, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE650000 mmap(0xCE650000, 23669, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xCE650000 mmap(0xCE666000, 3810, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 24576) = 0xCE666000 mmap(0xCE667000, 1328, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_ANON, -1, 0) = 0xCE667000 munmap(0xCE656000, 65536) = 0 memcntl(0xCE650000, 7968, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(3) = 0 stat64("/usr/sfw/lib/libcrypto.so.0.9.7", 0x08047260) = 0 resolvepath("/usr/sfw/lib/libcrypto.so.0.9.7", "/usr/sfw/lib/libcrypto.so.0.9.7", 1023) = 31 open("/usr/sfw/lib/libcrypto.so.0.9.7", O_RDONLY) = 3 mmap(0xCE7B0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xCE7B0000 mmap(0x00010000, 1126400, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE530000 mmap(0xCE530000, 970196, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xCE530000 mmap(0xCE62D000, 81450, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 970752) = 0xCE62D000 mmap(0xCE641000, 7952, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_ANON, -1, 0) = 0xCE641000 munmap(0xCE61D000, 65536) = 0 memcntl(0xCE530000, 187192, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(3) = 0 stat64("/usr/sfw/lib/libgss.so.1", 0x08047260) Err#2 ENOENT stat64("/lib/libgss.so.1", 0x08047260) Err#2 ENOENT stat64("/usr/lib/libgss.so.1", 0x08047260) = 0 resolvepath("/usr/lib/libgss.so.1", "/usr/lib/libgss.so.1", 1023) = 20 open("/usr/lib/libgss.so.1", O_RDONLY) = 3 mmap(0xCE7B0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xCE7B0000 mmap(0x00010000, 114688, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE510000 mmap(0xCE510000, 44434, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xCE510000 mmap(0xCE52B000, 1287, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 45056) = 0xCE52B000 munmap(0xCE51B000, 65536) = 0 mmap(0x00000000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_ANON, -1, 0) = 0xCE7A0000 memcntl(0xCE510000, 6860, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(3) = 0 stat64("/usr/sfw/lib/libcmd.so.1", 0x08047260) Err#2 ENOENT stat64("/lib/libcmd.so.1", 0x08047260) = 0 resolvepath("/lib/libcmd.so.1", "/lib/libcmd.so.1", 1023) = 16 open("/lib/libcmd.so.1", O_RDONLY) = 3 mmap(0xCE7B0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xCE7B0000 mmap(0x00010000, 81920, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE4F0000 mmap(0xCE4F0000, 8996, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xCE4F0000 mmap(0xCE503000, 505, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 12288) = 0xCE503000 munmap(0xCE4F3000, 65536) = 0 memcntl(0xCE4F0000, 2584, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(3) = 0 stat64("/usr/sfw/lib/libcontract.so.1", 0x08047260) Err#2 ENOENT stat64("/lib/libcontract.so.1", 0x08047260) = 0 resolvepath("/lib/libcontract.so.1", "/lib/libcontract.so.1", 1023) = 21 open("/lib/libcontract.so.1", O_RDONLY) = 3 mmap(0xCE7B0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xCE7B0000 mmap(0x00010000, 86016, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE4D0000 mmap(0xCE4D0000, 12311, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xCE4D0000 mmap(0xCE4E4000, 392, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 16384) = 0xCE4E4000 munmap(0xCE4D4000, 65536) = 0 memcntl(0xCE4D0000, 4704, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(3) = 0 stat64("/usr/sfw/lib/libc.so.1", 0x08047260) Err#2 ENOENT stat64("/lib/libc.so.1", 0x08047260) = 0 resolvepath("/lib/libc.so.1", "/lib/libc.so.1", 1023) = 14 open("/lib/libc.so.1", O_RDONLY) = 3 mmap(0xCE7B0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xCE7B0000 mmap(0x00010000, 1212416, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE3A0000 mmap(0xCE3A0000, 1105861, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xCE3A0000 mmap(0xCE4BE000, 30311, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_FIXED|MAP_INITDATA, 3, 1105920) = 0xCE4BE000 mmap(0xCE4C6000, 4256, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_FIXED|MAP_ANON, -1, 0) = 0xCE4C6000 munmap(0xCE4AE000, 65536) = 0 memcntl(0xCE3A0000, 124344, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(3) = 0 mmap(0x00000000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_ANON, -1, 0) = 0xCE6E0000 stat64("/lib/libmd.so.1", 0x08047260) = 0 resolvepath("/lib/libmd.so.1", "/lib/libmd.so.1", 1023) = 15 open("/lib/libmd.so.1", O_RDONLY) = 3 mmap(0xCE7B0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xCE7B0000 mmap(0x00010000, 126976, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE380000 mmap(0xCE380000, 56424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xCE380000 mmap(0xCE39E000, 552, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 57344) = 0xCE39E000 munmap(0xCE38E000, 65536) = 0 memcntl(0xCE380000, 1464, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(3) = 0 stat64("/lib/libsecdb.so.1", 0x08047260) = 0 resolvepath("/lib/libsecdb.so.1", "/lib/libsecdb.so.1", 1023) = 18 open("/lib/libsecdb.so.1", O_RDONLY) = 3 mmap(0xCE7B0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xCE7B0000 mmap(0x00010000, 81920, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE360000 mmap(0xCE360000, 11898, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xCE360000 mmap(0xCE373000, 698, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 12288) = 0xCE373000 munmap(0xCE363000, 65536) = 0 memcntl(0xCE360000, 4128, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(3) = 0 stat64("/usr/sfw/lib/libc.so.1", 0x08047260) Err#2 ENOENT stat64("/usr/sfw/lib/libsocket.so.1", 0x08047260) Err#2 ENOENT stat64("/usr/sfw/lib/libnsl.so.1", 0x08047260) Err#2 ENOENT stat64("/lib/libnvpair.so.1", 0x08047260) = 0 resolvepath("/lib/libnvpair.so.1", "/lib/libnvpair.so.1", 1023) = 19 open("/lib/libnvpair.so.1", O_RDONLY) = 3 mmap(0xCE7B0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xCE7B0000 mmap(0x00010000, 98304, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE340000 mmap(0xCE340000, 27786, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xCE340000 mmap(0xCE357000, 620, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 28672) = 0xCE357000 munmap(0xCE347000, 65536) = 0 mmap(0x00000000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_ANON, -1, 0) = 0xCE6C0000 memcntl(0xCE340000, 7604, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(3) = 0 stat64("/usr/sfw/lib/libcrypto_extra.so.0.9.7", 0x08047040) = 0 resolvepath("/usr/sfw/lib/libcrypto_extra.so.0.9.7", "/usr/sfw/lib/libcrypto_extra.so.0.9.7", 1023) = 37 open("/usr/sfw/lib/libcrypto_extra.so.0.9.7", O_RDONLY) = 3 mmap(0xCE7B0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xCE7B0000 mmap(0x00010000, 110592, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE320000 mmap(0xCE320000, 38069, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xCE320000 mmap(0xCE33A000, 1452, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 40960) = 0xCE33A000 munmap(0xCE32A000, 65536) = 0 memcntl(0xCE320000, 4432, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(3) = 0 mmap(0x00010000, 24576, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_ANON|MAP_ALIGN, -1, 0) = 0xCE690000 munmap(0xCE7B0000, 32768) = 0 getcontext(0x08047830) getrlimit(RLIMIT_STACK, 0x08047828) = 0 getpid() = 21519 [21518] lwp_private(0, 1, 0xCE692A00) = 0x000001C3 setustack(0xCE692A60) sigfillset(0xCE4C5DE0) = 0 sysi86(SI86FPSTART, 0xCE4C6750, 0x0000133F, 0x00001F80) = 0x00000001 sysconfig(_CONFIG_PAGESIZE) = 4096 brk(0x080B4B10) = 0 brk(0x080B6B10) = 0 stat64("/usr/lib/locale/en_US.ISO8859-1/en_US.ISO8859-1.so.3", 0x080462B0) = 0 resolvepath("/usr/lib/locale/en_US.ISO8859-1/en_US.ISO8859-1.so.3", "/usr/lib/locale/en_US.ISO8859-1/en_US.ISO8859-1.so.3", 1023) = 52 open("/usr/lib/locale/en_US.ISO8859-1/en_US.ISO8859-1.so.3", O_RDONLY) = 3 mmap(0x00010000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_ALIGN, 3, 0) = 0xCE7B0000 mmap(0x00000000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_ANON, -1, 0) = 0xCE660000 mmap(0x00010000, 86016, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE300000 mmap(0xCE300000, 16042, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xCE300000 mmap(0xCE313000, 6074, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_FIXED|MAP_INITDATA, 3, 12288) = 0xCE313000 munmap(0xCE304000, 61440) = 0 memcntl(0xCE300000, 5508, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(3) = 0 munmap(0xCE7B0000, 32768) = 0 brk(0x080B6B10) = 0 brk(0x080B8B10) = 0 getpid() = 21519 [21518] getpid() = 21519 [21518] open("/dev/urandom", O_RDONLY|O_NONBLOCK|O_NOCTTY) = 3 pollsys(0x080470F0, 1, 0x08047168, 0x00000000) = 1 read(3, " rFE8288CA05 NC28A89B1 5".., 32) = 32 close(3) = 0 getpid() = 21519 [21518] getpid() = 21519 [21518] getuid() = 0 [0] getpid() = 21519 [21518] time() = 1302129784 getpid() = 21519 [21518] open64("/etc/ssh/sshd_config", O_RDONLY) = 3 fstat64(3, 0x08046DC0) = 0 brk(0x080B8B10) = 0 brk(0x080BAB10) = 0 fstat64(3, 0x08046D00) = 0 ioctl(3, TCGETA, 0x08046D94) Err#25 ENOTTY read(3, " #\n # C o p y r i g h".., 8192) = 5215 open("/etc/netconfig", O_RDONLY|O_LARGEFILE) = 4 time() = 1302129784 rctlsys(0, "process.max-file-descriptor", 0x00000000, 0x080B6240, 0, 0) = 0 read(4, " # p r a g m a i d e n".., 1024) = 1024 read(4, " t s t p i _ c".., 1024) = 215 read(4, 0x080BA620, 1024) = 0 lseek(4, 0, SEEK_SET) = 0 read(4, " # p r a g m a i d e n".., 1024) = 1024 read(4, " t s t p i _ c".., 1024) = 215 brk(0x080BAB10) = 0 brk(0x080BCB10) = 0 read(4, 0x080BA620, 1024) = 0 close(4) = 0 open("/dev/udp", O_RDONLY) = 4 ioctl(4, SIOCGLIFNUM, 0x08046B60) = 0 close(4) = 0 brk(0x080BCB10) = 0 brk(0x080BEB10) = 0 getuid() = 0 [0] getuid() = 0 [0] read(3, 0x080B81FC, 8192) = 0 llseek(3, 0, SEEK_CUR) = 5215 close(3) = 0 open("/etc/default/login", O_RDONLY) = 3 llseek(3, 0, SEEK_CUR) = 0 llseek(3, 0, SEEK_SET) = 0 fstat64(3, 0x080471A0) = 0 fstat64(3, 0x080470E0) = 0 ioctl(3, TCGETA, 0x08047174) Err#25 ENOTTY read(3, " # i d e n t\t " @ ( # )".., 8192) = 2258 read(3, 0x080BB164, 8192) = 0 llseek(3, 0, SEEK_CUR) = 2258 llseek(3, 0, SEEK_SET) = 0 read(3, " # i d e n t\t " @ ( # )".., 8192) = 2258 read(3, 0x080BB164, 8192) = 0 llseek(3, 0, SEEK_CUR) = 2258 close(3) = 0 fstat64(2, 0x08045B50) = 0 debug1: sshd version Sun_SSH_1.1.3write(2, " d e b u g 1 : s s h d".., 34) = 34 write(2, "\r\n", 2) = 2 open64("/etc/ssh/ssh_host_rsa_key", O_RDONLY) = 3 fstat64(3, 0x080471F0) = 0 getuid() = 0 [0] llseek(3, 0, SEEK_END) = 887 llseek(3, 0, SEEK_SET) = 0 read(3, " - - - - - B E G I N R".., 887) = 887 llseek(3, 0, SEEK_SET) = 0 fcntl(3, F_GETFD, 0x00000000) = 0 fstat64(3, 0x08046A90) = 0 fstat64(3, 0x080469D0) = 0 ioctl(3, TCGETA, 0x08046A64) Err#25 ENOTTY read(3, " - - - - - B E G I N R".., 8192) = 887 llseek(3, 0, SEEK_CUR) = 887 close(3) = 0 debug1: read PEM private key done: type RSAwrite(2, " d e b u g 1 : r e a d".., 43) = 43 write(2, "\r\n", 2) = 2 debug1: private host key: #0 type 1 RSAwrite(2, " d e b u g 1 : p r i v".., 39) = 39 write(2, "\r\n", 2) = 2 open64("/etc/ssh/ssh_host_dsa_key", O_RDONLY) = 3 fstat64(3, 0x080471F0) = 0 getuid() = 0 [0] llseek(3, 0, SEEK_END) = 668 llseek(3, 0, SEEK_SET) = 0 read(3, " - - - - - B E G I N D".., 668) = 668 llseek(3, 0, SEEK_SET) = 0 fcntl(3, F_GETFD, 0x00000000) = 0 fstat64(3, 0x08046A90) = 0 fstat64(3, 0x080469D0) = 0 ioctl(3, TCGETA, 0x08046A64) Err#25 ENOTTY read(3, " - - - - - B E G I N D".., 8192) = 668 llseek(3, 0, SEEK_CUR) = 668 close(3) = 0 debug1: read PEM private key done: type DSAwrite(2, " d e b u g 1 : r e a d".., 43) = 43 write(2, "\r\n", 2) = 2 debug1: private host key: #1 type 2 DSAwrite(2, " d e b u g 1 : p r i v".., 39) = 39 write(2, "\r\n", 2) = 2 setgroups(0, 0x00000000) = 0 auditsys(BSM_SETAUID, 0x08047C04) = 0 getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] chdir("/") = 0 schedctl() = 0xCE7B8000 sigaction(SIGPIPE, 0x08047210, 0x08047290) = 0 so_socket(PF_INET6, SOCK_STREAM, IPPROTO_IP, "", SOV_DEFAULT) = 3 fcntl(3, F_SETFL, FNONBLOCK) = 0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, 0x08047C00, 4, SOV_DEFAULT) = 0 debug1: Bind to port 222 on ::.write(2, " d e b u g 1 : B i n d".., 31) = 31 write(2, "\r\n", 2) = 2 bind(3, 0x080B7010, 32, SOV_SOCKBSD) = 0 Server listening on :: port 222.write(2, " S e r v e r l i s t e".., 32) = 32 write(2, "\r\n", 2) = 2 listen(3, 5, SOV_DEFAULT) = 0 sigaction(SIGHUP, 0x08047210, 0x08047290) = 0 sigaction(SIGTERM, 0x08047210, 0x08047290) = 0 sigaction(SIGQUIT, 0x08047210, 0x08047290) = 0 sigaction(SIGCLD, 0x08047210, 0x08047290) = 0 pollsys(0x08047230, 1, 0x00000000, 0x00000000) (sleeping...) pollsys(0x08047230, 1, 0x00000000, 0x00000000) = 1 accept(3, 0x080477A0, 0x08047C08, SOV_DEFAULT) = 4 fcntl(4, F_SETFL, (no flags)) = 0 pipe() = 5 [6] debug1: Server will not fork when running in debugging mode.write(2, " d e b u g 1 : S e r v".., 60) = 60 write(2, "\r\n", 2) = 2 close(3) = 0 getpid() = 21519 [21518] auditsys(BSM_AUDITCTL, 0x00000014) Err#22 EINVAL getpeername(4, 0x08047250, 0x08047298, SOV_DEFAULT) = 0 getsockname(4, 0x08047270, 0x0804729C, SOV_DEFAULT) = 0 alarm(0) = 0 sigaction(SIGALRM, 0x08047210, 0x08047290) = 0 sigaction(SIGHUP, 0x08047210, 0x08047290) = 0 sigaction(SIGTERM, 0x08047210, 0x08047290) = 0 sigaction(SIGQUIT, 0x08047210, 0x08047290) = 0 sigaction(SIGCLD, 0x08047210, 0x08047290) = 0 sigaction(SIGINT, 0x08047210, 0x08047290) = 0 setsockopt(4, SOL_SOCKET, SO_KEEPALIVE, 0x08047C00, 4, SOV_DEFAULT) = 0 getpeername(4, 0x08046D40, 0x08047280, SOV_DEFAULT) = 0 getpeername(4, 0x08047170, 0x0804729C, SOV_DEFAULT) = 0 getpid() = 21519 [21518] getpeername(4, 0xCE667130, 0x080472B4, SOV_DEFAULT) = 0 getsockname(4, 0xCE667110, 0x080472B4, SOV_DEFAULT) = 0 open("/etc/hosts.allow", O_RDONLY) Err#2 ENOENT open("/etc/hosts.deny", O_RDONLY) Err#2 ENOENT Connection from 192.168.129.13 port 46088write(2, " C o n n e c t i o n f".., 41) = 41 write(2, "\r\n", 2) = 2 write(4, " S S H - 2 . 0 - S u n _".., 22) = 22 read(4, " S", 1) = 1 read(4, " S", 1) = 1 read(4, " H", 1) = 1 read(4, " -", 1) = 1 read(4, " 2", 1) = 1 read(4, " .", 1) = 1 read(4, " 0", 1) = 1 read(4, " -", 1) = 1 read(4, " O", 1) = 1 read(4, " p", 1) = 1 read(4, " e", 1) = 1 read(4, " n", 1) = 1 read(4, " S", 1) = 1 read(4, " S", 1) = 1 read(4, " H", 1) = 1 read(4, " _", 1) = 1 read(4, " 5", 1) = 1 read(4, " .", 1) = 1 read(4, " 5", 1) = 1 read(4, " p", 1) = 1 read(4, " 1", 1) = 1 read(4, " ", 1) = 1 read(4, " D", 1) = 1 read(4, " e", 1) = 1 read(4, " b", 1) = 1 read(4, " i", 1) = 1 read(4, " a", 1) = 1 read(4, " n", 1) = 1 read(4, " -", 1) = 1 read(4, " 4", 1) = 1 read(4, " u", 1) = 1 read(4, " b", 1) = 1 read(4, " u", 1) = 1 read(4, " n", 1) = 1 read(4, " t", 1) = 1 read(4, " u", 1) = 1 read(4, " 5", 1) = 1 read(4, "\r", 1) = 1 read(4, "\n", 1) = 1 debug1: Client protocol version 2.0; client software version OpenSSH_5.5p1 Debian-4ubuntu5write(2, " d e b u g 1 : C l i e".., 90) = 90 write(2, "\r\n", 2) = 2 debug1: match: OpenSSH_5.5p1 Debian-4ubuntu5 pat OpenSSH*write(2, " d e b u g 1 : m a t c".., 57) = 57 write(2, "\r\n", 2) = 2 debug1: Enabling compatibility mode for protocol 2.0write(2, " d e b u g 1 : E n a b".., 52) = 52 write(2, "\r\n", 2) = 2 debug1: Local version string SSH-2.0-Sun_SSH_1.1.3write(2, " d e b u g 1 : L o c a".., 50) = 50 write(2, "\r\n", 2) = 2 fcntl(4, F_SETFL, FNONBLOCK) = 0 dup(4) = 3 brk(0x080BEB10) = 0 brk(0x080C0B10) = 0 pipe() = 7 [8] fcntl(7, F_SETFD, 0x00000001) = 0 fcntl(8, F_SETFD, 0x00000001) = 0 getpid() = 21519 [21518] fork1() = 21520 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] brk(0x080C0B10) = 0 brk(0x080C2B10) = 0 monitor debug1: list_hostkey_types: ssh-rsa,ssh-dsswrite(2, " m o n i t o r d e b u".., 51) = 51 write(2, "\r\n", 2) = 2 pipe() = 9 [10] access("/bin/sh", X_OK) = 0 fcntl(9, F_GETFD, 0x080BAC68) = 0 lwp_sigmask(SIG_SETMASK, 0xFFBFFEFF, 0x0000FFFF) = 0x00000000 [0x00000000] vfork() = 21521 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] close(10) = 0 fstat64(9, 0x08047140) = 0 fstat64(9, 0x08047080) = 0 ioctl(9, TCGETA, 0x08047114) Err#22 EINVAL read(9, " C\n P O S I X\n e n _ C".., 5120) = 218 read(9, 0x080C049C, 5120) = 0 llseek(9, 0, SEEK_CUR) Err#29 ESPIPE close(9) = 0 waitid(P_PID, 21521, 0x08047170, WEXITED|WTRAPPED) = 0 close(8) = 0 write(7, "10 T\0\0", 4) = 4 debug1: use_engine is 'yes' debug1: pkcs11 engine initialized, now setting it as default for RSA, DSA, and symmetric ciphers debug1: pkcs11 engine initialization complete debug1: list_hostkey_types: ssh-rsa,ssh-dss dup(7) = 8 close(4) = 0 close(-1) Err#9 EBADF monitor debug1: reading the context from the childwrite(2, " m o n i t o r d e b u".., 50) = 50 write(2, "\r\n", 2) = 2 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: client->server aes128-ctr hmac-md5 none debug1: kex: server->client aes128-ctr hmac-md5 none debug1: Peer sent proposed langtags, ctos: debug1: Peer sent proposed langtags, stoc: debug1: We proposed langtags, ctos: en-CA,en-US,es,es-MX,fr,fr-CA,i-default debug1: We proposed langtags, stoc: en-CA,en-US,es,es-MX,fr,fr-CA,i-default debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent debug1: dh_gen_key: priv key bits set: 145/256 debug1: bits set: 526/1024 debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT debug1: bits set: 504/1024 debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent debug1: newkeys: mode 1 debug1: set_newkeys: setting new keys for 'out' mode debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: newkeys: mode 0 debug1: set_newkeys: setting new keys for 'in' mode debug1: SSH2_MSG_NEWKEYS received debug1: KEX done debug1: userauth-request for user anderson service ssh-connection method none debug1: attempt 0 initial attempt 0 failures 0 initial failures 0 Failed none for anderson from 192.168.129.13 port 46088 ssh2 debug1: userauth-request for user anderson service ssh-connection method keyboard-interactive debug1: attempt 1 initial attempt 0 failures 1 initial failures 0 debug1: keyboard-interactive devs Failed keyboard-interactive for anderson from 192.168.129.13 port 46088 ssh2 pollsys(0x08045190, 1, 0x00000000, 0x00000000) (sleeping...) debug1: userauth-request for user anderson service ssh-connection method password debug1: attempt 2 initial attempt 1 failures 2 initial failures 1 Accepted password for anderson from 192.168.129.13 port 46088 ssh2 debug1: permanently_set_uid: 1088/10 debug1: sending auth context to the monitor debug1: will send 42 bytes of auth context to the monitor pollsys(0x08045190, 1, 0x00000000, 0x00000000) = 1 read(7, "\0\0\0 4\tFE05\0\004 @\0".., 8192) = 56 monitor debug1: finished reading the contextwrite(2, " m o n i t o r d e b u".., 44) = 44 write(2, "\r\n", 2) = 2 fcntl(7, F_SETFL, FNONBLOCK) = 0 close(-1) Err#9 EBADF monitor debug1: use_engine is 'yes'write(2, " m o n i t o r d e b u".., 35) = 35 write(2, "\r\n", 2) = 2 stat64("/usr/lib/libpkcs11.so.1", 0x08046A00) = 0 resolvepath("/usr/lib/libpkcs11.so.1", "/usr/lib/libpkcs11.so.1", 1023) = 23 open("/usr/lib/libpkcs11.so.1", O_RDONLY) = 4 mmap(0x00010000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_ALIGN, 4, 0) = 0xCE620000 mmap(0x00010000, 172032, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE2D0000 mmap(0xCE2D0000, 77944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 4, 0) = 0xCE2D0000 mmap(0xCE2F4000, 23616, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 4, 81920) = 0xCE2F4000 munmap(0xCE2E4000, 65536) = 0 memcntl(0xCE2D0000, 7936, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(4) = 0 stat64("/lib/libcryptoutil.so.1", 0x08046960) Err#2 ENOENT stat64("/usr/lib/libcryptoutil.so.1", 0x08046960) = 0 resolvepath("/usr/lib/libcryptoutil.so.1", "/usr/lib/libcryptoutil.so.1", 1023) = 27 open("/usr/lib/libcryptoutil.so.1", O_RDONLY) = 4 mmap(0xCE620000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) = 0xCE620000 mmap(0x00010000, 98304, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE2B0000 mmap(0xCE2B0000, 21998, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 4, 0) = 0xCE2B0000 mmap(0xCE2C6000, 4823, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 4, 24576) = 0xCE2C6000 munmap(0xCE2B6000, 65536) = 0 memcntl(0xCE2B0000, 4460, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(4) = 0 stat64("/lib/libdoor.so.1", 0x08046960) = 0 resolvepath("/lib/libdoor.so.1", "/lib/libdoor.so.1", 1023) = 17 open("/lib/libdoor.so.1", O_RDONLY) = 4 mmap(0xCE620000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) = 0xCE620000 mmap(0x00010000, 77824, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE290000 mmap(0xCE290000, 6971, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 4, 0) = 0xCE290000 mmap(0xCE2A2000, 488, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 4, 8192) = 0xCE2A2000 munmap(0xCE292000, 65536) = 0 mmap(0x00000000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_ANON, -1, 0) = 0xCE7B0000 memcntl(0xCE290000, 3220, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(4) = 0 stat64("/lib/libscf.so.1", 0x08046960) = 0 resolvepath("/lib/libscf.so.1", "/lib/libscf.so.1", 1023) = 16 open("/lib/libscf.so.1", O_RDONLY) = 4 mmap(0xCE620000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) = 0xCE620000 mmap(0x00010000, 163840, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE260000 mmap(0xCE260000, 90168, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 4, 0) = 0xCE260000 mmap(0xCE287000, 1873, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 4, 94208) = 0xCE287000 munmap(0xCE277000, 65536) = 0 memcntl(0xCE260000, 14640, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(4) = 0 stat64("/lib/libuutil.so.1", 0x08046960) = 0 resolvepath("/lib/libuutil.so.1", "/lib/libuutil.so.1", 1023) = 18 open("/lib/libuutil.so.1", O_RDONLY) = 4 mmap(0xCE620000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) = 0xCE620000 mmap(0x00010000, 94208, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE240000 mmap(0xCE240000, 22748, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 4, 0) = 0xCE240000 mmap(0xCE256000, 1043, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 4, 24576) = 0xCE256000 munmap(0xCE246000, 65536) = 0 memcntl(0xCE240000, 5032, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(4) = 0 stat64("/lib/libgen.so.1", 0x08046960) = 0 resolvepath("/lib/libgen.so.1", "/lib/libgen.so.1", 1023) = 16 open("/lib/libgen.so.1", O_RDONLY) = 4 mmap(0xCE620000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) = 0xCE620000 mmap(0x00010000, 94208, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE220000 mmap(0xCE220000, 20573, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 4, 0) = 0xCE220000 mmap(0xCE236000, 1655, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 4, 24576) = 0xCE236000 munmap(0xCE226000, 65536) = 0 mmap(0x00000000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_ANON, -1, 0) = 0xCE520000 memcntl(0xCE220000, 5192, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(4) = 0 munmap(0xCE620000, 32768) = 0 stat64("/usr/lib/security/pkcs11_kernel.so.1", 0x080468D0) = 0 resolvepath("/usr/lib/security/pkcs11_kernel.so.1", "/usr/lib/security/pkcs11_kernel.so.1", 1023) = 36 open("/usr/lib/security/pkcs11_kernel.so.1", O_RDONLY) = 4 mmap(0x00010000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_ALIGN, 4, 0) = 0xCE620000 mmap(0x00010000, 167936, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE1F0000 mmap(0xCE1F0000, 95014, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 4, 0) = 0xCE1F0000 mmap(0xCE218000, 1624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 4, 98304) = 0xCE218000 munmap(0xCE208000, 65536) = 0 memcntl(0xCE1F0000, 5956, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(4) = 0 stat64("/lib/libcryptoutil.so.1", 0x08046830) Err#2 ENOENT munmap(0xCE620000, 32768) = 0 getpid() = 21519 [21518] open("/dev/crypto", O_RDWR) = 4 fcntl(4, F_SETFD, 0x00000001) = 0 ioctl(4, CRYPTO_GET_PROVIDER_LIST, 0x080BAE60) = 0 getpid() = 21519 [21518] open("/etc/crypto/pkcs11.conf", O_RDONLY) = 9 fstat64(9, 0x08046CB0) = 0 brk(0x080C2B10) = 0 brk(0x080C4B10) = 0 fstat64(9, 0x08046BF0) = 0 ioctl(9, TCGETA, 0x08046C84) Err#25 ENOTTY read(9, " #\n # C o p y r i g h".., 8192) = 1074 brk(0x080C4B10) = 0 brk(0x080C6B10) = 0 read(9, 0x080C250C, 8192) = 0 llseek(9, 0, SEEK_CUR) = 1074 close(9) = 0 stat64("/usr/lib/security/pkcs11_kernel.so", 0x080468C0) = 0 resolvepath("/usr/lib/security/pkcs11_kernel.so", "/usr/lib/security/pkcs11_kernel.so.1", 1023) = 36 getpid() = 21519 [21518] close(4) = 0 stat64("/usr/lib/security/pkcs11_softtoken_extra.so", 0x080468C0) = 0 resolvepath("/usr/lib/security/pkcs11_softtoken_extra.so", "/usr/lib/security/pkcs11_softtoken_extra.so.1", 1023) = 45 open("/usr/lib/security/pkcs11_softtoken_extra.so", O_RDONLY) = 4 mmap(0x00010000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_ALIGN, 4, 0) = 0xCE620000 mmap(0x00010000, 323584, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE|MAP_ANON| MAP_ALIGN, -1, 0) = 0xCE1A0000 mmap(0xCE1A0000, 243920, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 4, 0) = 0xCE1A0000 mmap(0xCE1EC000, 7553, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 4, 245760) = 0xCE1EC000 mmap(0xCE1EE000, 776, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_ANON, -1, 0) = 0xCE1EE000 munmap(0xCE1DC000, 65536) = 0 memcntl(0xCE1A0000, 7564, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0 close(4) = 0 stat64("/lib/libcryptoutil.so.1", 0x08046820) Err#2 ENOENT munmap(0xCE620000, 32768) = 0 getpid() = 21519 [21518] open("/var/run/kcfd_door", O_RDONLY) = 4 fcntl(4, F_SETFD, 0x00000001) = 0 door_call(4, 0x08047140) = 0 close(4) = 0 getuid() = 0 [0] getuid() = 0 [0] getpid() = 21519 [21518] open("/proc/21519/psinfo", O_RDONLY) = 4 read(4, "\0\0\00201\0\0\00F T\0\0".., 336) = 336 close(4) = 0 mmap(0x00010000, 65536, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_ANON|MAP_ALIGN, -1, 0) = 0xCE180000 getuid() = 0 [0] getuid() = 0 [0] open64("/var/run/name_service_door", O_RDONLY) = 4 fcntl(4, F_SETFD, 0x00000001) = 0 door_info(4, 0xCE4BF4C4) = 0 door_call(4, 0x08045FB8) = 0 xstat(2, "//.sunw/pkcs11_softtoken/objstore_info", 0x08046E28) = 0 open("//.sunw/pkcs11_softtoken/objstore_info", O_RDONLY|O_NONBLOCK) = 9 fcntl(9, F_SETFD, 0x00000001) = 0 fcntl(9, F_SETLKW, 0x08046A10) = 0 fxstat(2, 9, 0x08046920) = 0 xstat(2, "//.sunw/pkcs11_softtoken/objstore_info", 0x080469A8) = 0 lseek(9, 32, SEEK_SET) = 32 read(9, "\0\0\0\0", 4) = 4 fcntl(9, F_SETLKW, 0x08046E54) = 0 close(9) = 0 open("//.sunw/pkcs11_softtoken/objstore_info", O_RDONLY|O_NONBLOCK) = 9 fcntl(9, F_SETFD, 0x00000001) = 0 fcntl(9, F_SETLKW, 0x08046A20) = 0 fxstat(2, 9, 0x08046930) = 0 xstat(2, "//.sunw/pkcs11_softtoken/objstore_info", 0x080469B8) = 0 lseek(9, 40, SEEK_SET) = 40 read(9, "\0\0\0\0\0\0\0\0\0\0\0\0".., 16) = 16 fcntl(9, F_SETLKW, 0x08046E64) = 0 close(9) = 0 open("//.sunw/pkcs11_softtoken/objstore_info", O_RDONLY|O_NONBLOCK) = 9 fcntl(9, F_SETFD, 0x00000001) = 0 fcntl(9, F_SETLKW, 0x08046AE0) = 0 fxstat(2, 9, 0x080469F0) = 0 xstat(2, "//.sunw/pkcs11_softtoken/objstore_info", 0x08046A78) = 0 lseek(9, 40, SEEK_SET) = 40 read(9, "\0\0\0\0\0\0\0\0\0\0\0\0".., 16) = 16 fcntl(9, F_SETLKW, 0x08046F24) = 0 close(9) = 0 open("//.sunw/pkcs11_softtoken/objstore_info", O_RDONLY|O_NONBLOCK) = 9 fcntl(9, F_SETFD, 0x00000001) = 0 fcntl(9, F_SETLKW, 0x08046AE0) = 0 fxstat(2, 9, 0x080469F0) = 0 xstat(2, "//.sunw/pkcs11_softtoken/objstore_info", 0x08046A78) = 0 lseek(9, 40, SEEK_SET) = 40 read(9, "\0\0\0\0\0\0\0\0\0\0\0\0".., 16) = 16 fcntl(9, F_SETLKW, 0x08046F24) = 0 close(9) = 0 schedctl() = 0xCE7B8000 getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] getpid() = 21519 [21518] monitor debug1: pkcs11 engine initialized, now setting it as default for RSA, DSA, and symmetric cipherswrite(2, " m o n i t o r d e b u".., 104) = 104 write(2, "\r\n", 2) = 2 monitor debug1: pkcs11 engine initialization completewrite(2, " m o n i t o r d e b u".., 53) = 53 write(2, "\r\n", 2) = 2 getpid() = 21519 [21518] getpeername(3, 0x080B0660, 0x080B065C, SOV_DEFAULT) = 0 getpeername(3, 0x08046500, 0x08047248, SOV_DEFAULT) = 0 brk(0x080C6B10) = 0 brk(0x080C8B10) = 0 mmap(0x00010000, 65536, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_ANON|MAP_ALIGN, -1, 0) = 0xCE160000 getuid() = 0 [0] getuid() = 0 [0] door_info(4, 0x08046150) = 0 door_call(4, 0x080461A8) = 0 getuid() = 0 [0] getuid() = 0 [0] door_info(4, 0x08046FE0) = 0 door_call(4, 0x08047038) = 0 getuid() = 0 [0] stat64("/var/adm/lastlog", 0x08046D60) = 0 open64("/var/adm/lastlog", O_RDWR|O_CREAT, 01003052030) = 9 llseek(9, 30464, SEEK_SET) = 30464 write(9, " }EC9C M\0\0\0\0\0\0\0\0".., 28) = 28 close(9) = 0 open64("/var/adm/wtmpx", O_WRONLY|O_APPEND) = 9 fstat64(9, 0x08047030) = 0 write(9, " a n d e r s o n\0\0\0\0".., 372) = 372 close(9) = 0 sysconfig(_CONFIG_NGROUPS) = 16 open("/etc/default/nss", O_RDONLY|O_LARGEFILE) = 9 fcntl(9, F_DUPFD, 0x00000100) Err#22 EINVAL read(9, " # i d e n t\t " @ ( #".., 1024) = 1024 read(9, " y t h o s e\n # f u n".., 1024) = 211 read(9, 0xCE692400, 1024) = 0 close(9) = 0 getuid() = 0 [0] getuid() = 0 [0] door_info(4, 0x08046C50) = 0 door_call(4, 0x08046CA8) = 0 setgroups(2, 0x080C5418) = 0 auditsys(BSM_AUDITCTL, 0x00000014) Err#22 EINVAL getprivimplinfo(0x08046A00, 2076) = 0 mmap(0x00010000, 65536, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_ANON|MAP_ALIGN, -1, 0) = 0xCE140000 sysconfig(_CONFIG_NGROUPS) = 16 zone_lookup("") = 0 zone_getattr(0, ZONE_ATTR_PRIVSET, 0xCE690488, 12) = 12 ucred_get(21520, 0x080C5418) = 0 monitor debug1: Entering monitor loop.write(2, " m o n i t o r d e b u".., 38) = 38 write(2, "\r\n", 2) = 2 sigaction(SIGHUP, 0x00000000, 0x08047210) = 0 sigaction(SIGHUP, 0x080471B0, 0x00000000) = 0 sigaction(SIGINT, 0x00000000, 0x08047210) = 0 sigaction(SIGINT, 0x080471B0, 0x00000000) = 0 sigaction(SIGTERM, 0x00000000, 0x08047210) = 0 sigaction(SIGTERM, 0x080471B0, 0x00000000) = 0 sigaction(SIGCLD, 0x00000000, 0x08047210) = 0 sigaction(SIGCLD, 0x080471B0, 0x00000000) = 0 pipe() = 9 [10] fcntl(9, F_SETFD, 0x00000001) = 0 fcntl(10, F_SETFD, 0x00000001) = 0 fcntl(9, F_GETFL) = 2 monitor debug1: fd 9 setting O_NONBLOCKwrite(2, " m o n i t o r d e b u".., 39) = 39 write(2, "\r\n", 2) = 2 fcntl(9, F_SETFL, FWRITE|FNONBLOCK) = 0 fcntl(10, F_GETFL) = 2 monitor debug1: fd 10 setting O_NONBLOCKwrite(2, " m o n i t o r d e b u".., 40) = 40 write(2, "\r\n", 2) = 2 fcntl(10, F_SETFL, FWRITE|FNONBLOCK) = 0 pollsys(0x08047170, 2, 0x00000000, 0x00000000) = 1 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] write(7, "\0\0\0\f\nFE\0\0\0\0\0\0".., 16) = 16 debug1: Entering interactive session for SSH2. debug1: fd 11 setting O_NONBLOCK debug1: fd 12 setting O_NONBLOCK debug1: server_init_dispatch_20 debug1: server_input_channel_open: ctype session rchan 0 win 1048576 max 16384 debug1: input_session_request debug1: channel 0: new [server-session] debug1: session_new: init debug1: session_new: session 0 debug1: session_open: channel 0 debug1: session_open: session 0: link with channel 0 debug1: server_input_channel_open: confirm session debug1: server_input_channel_req: channel 0 request pty-req reply 1 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req pty-req debug1: Allocating pty. debug1: session_pty_req: session 0 alloc /dev/pts/7 debug1: server_input_channel_req: channel 0 request env reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req env debug1: server_input_channel_req: channel 0 request shell reply 1 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req shell debug1: Setting controlling tty using TIOCSCTTY. pollsys(0x08047170, 2, 0x00000000, 0x00000000) = 1 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] read(7, "\0\0\01C07FE02\0\0 T16\0".., 16384) = 32 stat64("/proc/21526", 0x08047190) = 0 stat64("/dev/pts/7", 0x08047190) = 0 getuid() = 0 [0] getuid() = 0 [0] door_info(4, 0x08046ED0) = 0 door_call(4, 0x08046F28) = 0 getuid() = 0 [0] stat64("/var/adm/lastlog", 0x08046C50) = 0 open64("/var/adm/lastlog", O_RDWR|O_CREAT, 01003052030) = 11 llseek(11, 30464, SEEK_SET) = 30464 write(11, " }EC9C M p t s / 7\0\0\0".., 28) = 28 close(11) = 0 open("/var/adm/utmpx", O_RDWR|O_CREAT, 0644) = 11 open("/var/adm/utmpx", O_RDWR) = 12 fstat64(12, 0x08046BA0) = 0 fstat64(12, 0x08046AE0) = 0 ioctl(12, TCGETA, 0x08046B74) Err#25 ENOTTY read(12, "\0\0\0\0\0\0\0\0\0\0\0\0".., 8192) = 5952 getuid() = 0 [0] lseek(12, 0xFFFFFA30, SEEK_CUR) = 4464 write(12, " a n d e r s o n\0\0\0\0".., 372) = 372 open("/etc/utmppipe", O_RDWR|O_NDELAY|O_NONBLOCK) = 13 write(13, "01\0\0\016 T\0\0", 8) = 8 close(13) = 0 close(11) = 0 llseek(12, 0, SEEK_CUR) = 4836 close(12) = 0 open64("/var/adm/wtmpx", O_WRONLY|O_APPEND) = 11 fstat64(11, 0x08046F10) = 0 write(11, " a n d e r s o n\0\0\0\0".., 372) = 372 close(11) = 0 pollsys(0x08047170, 2, 0x00000000, 0x00000000) = 1 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] write(7, "\0\0\0\f\nFE\0\0\0\0\0\0".., 16) = 16 debug1: fd 4 setting TCP_NODELAY debug1: fd 14 setting O_NONBLOCK pollsys(0x08047170, 2, 0x00000000, 0x00000000) (sleeping...) debug1: Received SIGCHLD. debug1: session_by_pid: pid 21526 debug1: session_exit_message: session 0 channel 0 pid 21526 debug1: channel request 0: exit-status debug1: session_exit_message: release channel 0 debug1: channel 0: write failed debug1: channel 0: close_write debug1: channel 0: output open -> closed debug1: session_close: session 0 pid 21526 debug1: session_pty_cleanup: session 0 release /dev/pts/7 pollsys(0x08047170, 2, 0x00000000, 0x00000000) = 1 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] read(7, "\0\0\0\f05FE03\0\0 T16\0".., 16384) = 16 getuid() = 0 [0] getuid() = 0 [0] door_info(4, 0x08046F60) = 0 door_call(4, 0x08046FB8) = 0 getuid() = 0 [0] open("/var/adm/utmpx", O_RDWR|O_CREAT, 0644) = 11 open("/var/adm/utmpx", O_RDWR) = 12 fstat64(12, 0x08046C30) = 0 fstat64(12, 0x08046B70) = 0 ioctl(12, TCGETA, 0x08046C04) Err#25 ENOTTY read(12, "\0\0\0\0\0\0\0\0\0\0\0\0".., 8192) = 5952 getuid() = 0 [0] lseek(12, 0xFFFFFA30, SEEK_CUR) = 4464 write(12, " a n d e r s o n\0\0\0\0".., 372) = 372 open("/etc/utmppipe", O_RDWR|O_NDELAY|O_NONBLOCK) = 13 write(13, "02\0\0\016 T\0\0", 8) = 8 close(13) = 0 close(11) = 0 llseek(12, 0, SEEK_CUR) = 4836 close(12) = 0 open64("/var/adm/wtmpx", O_WRONLY|O_APPEND) = 11 fstat64(11, 0x08046FB0) = 0 write(11, " a n d e r s o n\0\0\0\0".., 372) = 372 close(11) = 0 pollsys(0x08047170, 2, 0x00000000, 0x00000000) = 1 lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] write(7, "\0\0\0\f\nFE\0\0\0\0\0\0".., 16) = 16 debug1: channel 0: read<=0 rfd 14 len 0 debug1: channel 0: read failed debug1: channel 0: close_read debug1: channel 0: input open -> drain debug1: channel 0: ibuf empty debug1: channel 0: send eof debug1: channel 0: input drain -> closed debug1: channel 0: send close debug1: channel 0: rcvd close debug1: channel 0: is dead debug1: channel 0: garbage collecting debug1: channel_free: channel 0: server-session, nchannels 1 Received disconnect from 192.168.129.13: 11: disconnected by user debug1: Calling cleanup 0x8074d63(0x0) debug1: Calling cleanup 0x8065f61(0x80c7958) debug1: Calling cleanup 0x808115c(0x0) Received signal #18, SIGCLD, in pollsys() [caught] siginfo: SIGCLD CLD_EXITED pid=21520 status=0x00FF pollsys(0x08047170, 2, 0x00000000, 0x00000000) Err#4 EINTR lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] monitor debug1: Monitor received SIGCHLD.write(2, " m o n i t o r d e b u".., 41) = 41 write(2, "\r\n", 2) = 2 sigaction(SIGCLD, 0x00000000, 0x08046E30) = 0 write(10, "\0", 1) = 1 setcontext(0x08046CA0) lwp_sigmask(SIG_SETMASK, 0x00020000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] waitid(P_PID, 21520, 0x08047170, WEXITED|WTRAPPED|WNOHANG) = 0 lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] shutdown(7, SHUT_RDWR, SOV_DEFAULT) Err#95 ENOTSOCK close(7) = 0 getpid() = 21519 [21518] getuid() = 0 [0] getuid() = 0 [0] door_info(4, 0x08046FE0) = 0 door_call(4, 0x08047038) = 0 getuid() = 0 [0] open64("/var/adm/wtmpx", O_WRONLY|O_APPEND) = 7 fstat64(7, 0x08047030) = 0 write(7, " a n d e r s o n\0\0\0\0".., 372) = 372 close(7) = 0 shutdown(3, SHUT_RDWR, SOV_DEFAULT) = 0 _exit(0)

1 0

"include" directive on slapd.conf
by Marco Pizzoli 13 Apr '11

13 Apr '11

Hi all, do you know if I could use filenames with relative paths in "include" directive on my slapd.conf configuration file? If yes, which is the root directory referred to? Thanks Marco --

1 0

how to use ldap_parse_sortresponse_control
by owen nirvana 13 Apr '11

13 Apr '11

I confuse with the use of ldap_parse_sortresponse_control because there is no example and document about it. Although it seems like ldap_parse_sort_control of Novell CLDAP and Mozilla C LDAP, it is wrong if using it on their way. the following is my code: ... LDAPControl *sortctrl = NULL; LDAPControl *serverctrls[2]; LDAPControl **resultctrls = NULL; LDAPSortKey **sortkeylist; ... ldap_create_sort_keylist(&sortkeylist, sort_attrs); /* Create the sort control. */ rc = ldap_create_sort_control(ldap, sortkeylist, 1, &sortctrl); ... requestctrls[0] = sortctrl; requestctrls[1] = NULL; /* Search for all entries in Sunnyvale */ rc = ldap_search_ext_s(...); ... parse_rc = ldap_parse_result(ldap, result, &rc, NULL, NULL, NULL, &resultctrls, 0); ... parse_rc = ldap_parse_sortresponse_control(ldap, *resultctrls, &rcode, NULL); ... for (...) { ... } nothing is searched. it is ok if no sort or sort by CLDAP gtalk:freeespeech@gmail.com

1 0

sizelimit
by Troy Knabe 13 Apr '11

13 Apr '11

I want to enforce a size limit to restrict normal users. But I have a particular proxy account that I need to be able to return the entire directory. Is there a way to set sizelimit for a particular user differently than it is set for the directory? Thanks -Troy

3 3

slapo-accesslog
by Tim Gustafson 12 Apr '11

12 Apr '11

Hi, I was wondering if there was an overlay that worked somewhat like the slapo-accesslog overlay, but instead of logging the information to another OpenLDAP database, I'd like the data to be written to a CSV file or something similar. Does such a beast exist? Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

3 6

Optimization help
by Chris Jackson 12 Apr '11

12 Apr '11

What can I do to maximize the performance of my setup? System has 16gb of ram. OpenLDAP 2.4.19-15 Import LDIF is 4,611,156 bytes. Backend is BDB. du -c -h *.bdb 6.5M cn.bdb 8.0K displayName.bdb 1.9M dn2id.bdb 3.3M givenName.bdb 17M id2entry.bdb 5.6M mail.bdb 740K objectClass.bdb 7.5M ou.bdb 3.2M sn.bdb 3.4M uid.bdb 8.0K uidNumber.bdb 48M total Portion of slapd.conf: database bdb checkpoint 1024 15 ##threads 8 cachesize 100000 idlcachesize 300000 ***no dncachesize (default infinite) Current DB_CONFIG: # one 0.25 GB cache ##set_cachesize 0 268435456 1 set_cachesize 1 0 1 # Data Directory #set_data_dir db # Transaction Log settings set_lg_regionmax 262144 set_lg_bsize 2097152 #set_lg_dir logs

2 2

access control for opattrs (memberof overlay)
by Peter Schober 12 Apr '11

12 Apr '11

How do I control access to operational attributes, in this case memberOf by the eponymous overlay? While I can put an index on 'memberOf' I can't seem to use it in an <attrlist> as part of an ACL: unknown attr "memberOf" in to clause (This is on 2.4.22 with all default settings for the memberof overlay and on a syncrepl consumer. The Changelog up to 2.4.25 does not show relevant issues from ITS, AFAICT.) Neither the slapd.access man page, FAQ or admin guide were of help wrt controlling access to operational attributes (but I may have overlooked something). (I also tried giving access to the 'entry' pseudo attribute, which didn't change the behaviour). How then are people controlling access to group memberships as provided by the memberof overlay? cheers, -peter

2 2

Re: Large "dynamic" groups and performance
by Al 12 Apr '11

12 Apr '11

>> cachesize 500000 > >> ###### DB_CONFIG > >> set_cachesize 2 0 1 >> set_flags DB_TXN_NOSYNC >> set_lg_bsize 5097152 >> set_lg_max 50485760 > > > You never state the size of your database (how many dns), or the disk size of your database (du -c -h *.bdb), so there is no way to tell if these settings are in any way valid. Thanks for getting back to me, I'm new here :) - here is some more data: Approximately 450,000 dns - about 200+/- are groups, the rest are users. du output: 163M cn.bdb 92M dn2id.bdb 415M id2entry.bdb 3.7M objectClass.bdb 16M uid.bdb 16M uniqueMember.bdb 703M total > I don't see a checkpoint setting for slapd.conf/cn=config, and I don't see an idlcachesize setting. I added those as well, no noticeable change in performance: cachesize 500000 idlcachesize 500000 checkpoint 10000 15 > Also, you are definitely not using "dynamic" groups in the OpenLDAP sense of the word, although they would probably perform significantly better for you. Yes, I understand that - thats why I put it in quotes. I looked into using OpenLDAP dynamic lists, but I think I'm limited by the fact that some of our systems requiring these groups need to do searchs off of it based on the dynamic membership (and from what I can tell, its not possible to use it that way), ie they need to search for (uniquemember=cn=xxxx,cn=users,...) on my group section of the tree. I'll openly admit some of the values I have been picking for caching and checkpoint are somewhat arbitrary. I've been trying many different values and have yet to settle on any that work well. I'll gladly try any recommendations. Thanks again, I appreciate your response. Al

3 2

Question about conversion from SunOne to OpenLDAP
by Elizabeth Good 11 Apr '11

11 Apr '11

Hello, I've been searching for information for about 2 days on how to convert a SunOne 5.2 ldif file to allow it for use with OpenLDAP 2.3.43. I'm trying to add the 99user.ldif file, which has our schema extension. When I try to do an ldapadd, I receive syntax errors: ldapadd -x -f 99user_new.ldif -D "cn=Directory Manager,o=xxxxx,c=xxxxx" -W adding new entry "cn=schema" ldapadd: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax I have already made a few syntax changes: attributeTypes to attributetype objectClasses to objectclass But still I'm receiving errors. I'm sure other people must have done something similar, but I've not been able to find anything. So, I would really appreciate some assistance. Thanks, --Beth [cid:image001.gif@01CBF853.69250940]<http://www.fuqua.duke.edu/>Beth Good Database Administrator (Oracle, SQL Server, Postgres) Duke University's Fuqua School of Business<http://www.fuqua.duke.edu/> 100 Fuqua Drive, Box 90120, Durham, NC 27708-0120 USA Tel +1.919.381.7625 | Fax +1.919.684.8620 Watch our video at www.fuqua.duke.edu/wakeup<http://www.fuqua.duke.edu/wakeup>

2 1

Large "dynamic" groups and performance
by Al 11 Apr '11

11 Apr '11

Hi All - We are currently attempting to migrate from a commercial LDAP server to OpenLDAP. Luckily our data is pretty standard, and the migration itself will be simple. I am having issues with our groups that programatically have large numbers of adds and deletes done to its member list. This transaction happens when a user logs into our website (the login mechanism compares their current groups with what they should have (from an external DB query) and makes the necessary adjustments). Other applications then use these groups for permissions. We are using the basic uniquemember within a groupOfUniqueNames. Uniquemember is indexed with equality. When the groups are small, performance is quite good - but once the groups begin growing, the adds and deletes of the members really starts suffering ( greater than 2 - 3 seconds per person). The reads still seem good. On our existing LDAP store, we see response times of less than a second for this same transaction. We have about 175 groups, that range in size from 10 members to 50,000 members. Most of the groups are around 1,000 members. I can go into more detail of the exact sizes if needed. I have a very basic configuration right now for testing. I've messed around with different transaction log settings, different caching settings and even played with DB_TXN_NOSYNC. DB_TXN_NOSYNC definitely helped, but its still not great. Can anyone recommend any settings that might help me improve the performance? Thanks in advance! My environment and settings: HP blade server, 8 cores @ 2.67Ghz, Redhat 5.3, OpenLDAP 2.4.25, Berkeley 5.1.25: ###### slapd.conf include /mypath/etc/openldap/schema/core.schema pidfile /mypath/var/run/slapd.pid argsfile /mypath/var/run/slapd.args access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to * by self write by users read by anonymous auth database bdb suffix "dc=my,dc=domain,dc=com" rootdn "cn=Manager,dc=my,dc=domain,dc=com" cachesize 500000 rootpw my_pass directory /mypath/var/openldap-data index objectClass eq index uniquemember eq index cn pres,eq,sub ###### DB_CONFIG set_cachesize 2 0 1 set_flags DB_TXN_NOSYNC set_lg_bsize 5097152 set_lg_max 50485760

2 1

pcache crashes after 2.4.25 upgrade; complains of unclean shutdowns and missing DB_CONFIGs after every restart
by Tyler Gates 11 Apr '11

11 Apr '11

After upgrading from 2.4.24 to 2.4.25 my pcache overlay using hdb backend first failed to start with messages complaining about a missing suffix. Now that I've added one I'm getting the following message: hdb_db_open: database "dc=example,dc=com": unclean shutdown detected; attempting recovery. hdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (14).#012Expect poor performance for suffix "dc=example,dc=com". slapd starting bdb(dc=example,dc=com): PANIC: fatal region error detected; run recovery last message repeated 3 times But DB_CONFIG does exist and has proper permissions and the unclean shutdown message repeats after every restart. I've never had to add the suffix to the pcache backend database before and the documentation examples (http://www.openldap.org/doc/admin24/proxycache.html) never mention it either. Is this a misconfiguration or do I need to file a bug? PCACHE OVERLAY: dn: olcOverlay={0}pcache objectClass: olcOverlayConfig objectClass: olcPcacheConfig olcOverlay: {0}pcache olcPcache: hdb 100000 3 1000 100 olcPcacheAttrset: 0 uid userPassword uidNumber gidNumber cn homeDirectory logi nShell gecos description memberUid uniqueMember objectClass olcPcacheAttrset: 1 cn automountInformation olcPcacheAttrset: 2 cn mail olcPcacheTemplate: "(|(cn=)(mail=)(sn=))" 2 7200 0 0 0 olcPcacheTemplate: "(&(objectClass=)(|(cn=)(cn=)(cn=)))" 1 3600 600 0 0 olcPcacheTemplate: "(&(objectClass=)(|(cn=)(cn=)))" 1 3600 600 0 0 olcPcacheTemplate: "(&(objectClass=)(|(cn=)(gidNumber=)))" 1 3600 600 0 0 olcPcacheTemplate: "(&(objectClass=)(gidNumber=))" 0 1800 0 0 0 olcPcacheTemplate: "(&(objectClass=)(uidNumber=))" 0 1800 0 0 0 olcPcacheTemplate: "(&(objectClass=)(uniqueMember=))" 0 1800 900 0 0 olcPcacheTemplate: "(&(objectClass=)(memberUid=))" 0 1800 900 0 0 olcPcacheTemplate: "(objectClass=)" 0 1800 0 0 0 olcPcacheTemplate: "(&(objectClass=))" 0 1800 0 0 0 olcPcacheTemplate: "(&(objectClass=)(cn=))" 0 1800 0 0 0 olcPcacheTemplate: "(&(objectClass=)(uid=))" 0 1800 0 0 0 olcPcacheTemplate: "(&(objectClass=)(|(memberUid=)(uniqueMember=)))" 0 1800 0 0 0 olcPcachePosition: tail olcPcacheMaxQueries: 10000 olcPcachePersist: FALSE olcPcacheValidate: FALSE olcPcacheOffline: FALSE HDB backend: dn: olcDatabase={0}hdb objectClass: olcHdbConfig objectClass: olcPcacheDatabase olcDatabase: {0}hdb olcDbDirectory: /var/lib/ldap olcDbCacheSize: 1000 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 3000 olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 createTimestamp: 20110225174535Z olcDbConfig: {0}set_cachesize 0 10485760 1 olcDbConfig: {1}set_lg_regionmax 262144 olcDbConfig: {2}set_lg_bsize 2097152 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbConfig: {4}set_lg_max 10485760 olcDbIndex: objectClass eq olcDbIndex: cn eq,subinitial olcDbIndex: uid eq,subinitial olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: userPassword eq olcDbIndex: description eq olcDbIndex: loginShell eq olcDbIndex: homeDirectory eq olcDbIndex: memberUid eq olcDbIndex: gecos eq olcDbIndex: automountInformation eq olcDbIndex: uniqueMember eq olcDbIndex: mail eq,subinitial olcDbIndex: sn eq,subinitial olcDbIndex: givenName eq,subinitial olcDbIndex: member eq olcDbIndex: nisMapName eq olcDbIndex: pcacheQueryID eq olcSuffix: dc=example,dc=com

3 4

help needed for tuning my openldap
by Stéphane PURNELLE 11 Apr '11

11 Apr '11

Hi all, I would like to know how I can tunning my ldap (openldap 2.4.23 on RHEL5.4 64-bits) installation: PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ SWAP COMMAND 13480 root 25 0 1378m 18m 4296 S 25.9 0.5 7241:07 1.3g slapd I already read the page http://www.openldap.org/faq/data/cache/1075.html (ex: Number of hash buckets ), but I not have all informations for calculate the size. [root@xxxxxxx openldap-data]# du -h . 43M . My BDB database take only 43M The accesslog take : 62M . How can I reduce memory (swap) usage and CPU usage (sometimes I see 134%) Thank you Stéphane Purnelle ----------------------------------- Stéphane PURNELLE Admin. Systèmes et Réseaux Service Informatique Corman S.A. Tel : 00 32 (0)87/342467

2 5

Renaming of node cause a segfault crash
by Peter Schütt 11 Apr '11

11 Apr '11

Hallo, we use 2.4.19 on RedHat 6.0, 64-Bit, Kernel 2.6.32 When I renamed a node with Apache Directory Studio (e.G. cn=mynode,ou=Groups,dc=mydomain,dc=de) the OpenLDAP-Server crashed. dmesg: slapd[13129]: segfault at 7fd1a9171fb0 ip 00007fd1c47a830f sp 00007fd1a9171fb0 error 6 in slapd[7fd1c46f5000+1f7000] When I restart then the change was successful. In the PastI had a similar error on a self compiled 2.4.23 on a CentOS 5.5, 64-Bit, Kernel 2.6.18: slapd[14668]: segfault at 0000000043a3bed8 rip 000000000047d77f rsp 0000000043a3bed0 error 6 Because of our company policy we prefer to use version from the official repository of our linux distribution. So we change from self compiled 2.4.23 in an old linux to RedHat 6.0 with the "official" OpenLDAP. I try to rename a node by ldapModify to exclude an error in Apache Directory Studio but I do not understand how. Perhaps someone has a hint. Is it possible this an error which is fixed in 2.4.25? Thanks for any hints. Ciao Peter Schütt

2 1

acls for a user to join/leave a group.
by George Mamalakis 11 Apr '11

11 Apr '11

Hello everybody, Is there a way to achieve what the subject says? For example, we can imagine users like: uid=user,ou=people,dc=example,dc=com And the group that I wish the users should be able to join using ldapmodify is: cn=group,dc=example,dc=com. What I wish to achieve is to let a user write in this dn, only the memberOf attribute, by containing only their specific dn. Moreover, the user will have to be able to remove this entry from this group if they wish, using ldapmodify again. Thank you very much for your help in advance, mamalos -- George Mamalakis IT Officer Electrical and Computer Engineer (Aristotle Un. of Thessaloniki), MSc (Imperial College of London) Department of Electrical and Computer Engineering Faculty of Engineering Aristotle University of Thessaloniki phone number : +30 (2310) 994379

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical