openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

OpenLDAP, systemd and EL 7.7
by Abdelkader Chelouah 05 May '20

05 May '20

Hello, Since the upgrade to RHEL 7.7, my openldap service with property |Type=forking| and property |PIDFile| defined doesn't start and its status shows the following error messages: May 02 20:02:57 systemd[1]: New main PID 445254 does not belong to service, and PID file is not owned by root. Refusing. Actually, slapd is started with -u ldap -g ldap options, so the owner of the pid file slapd.pid is ldap. The problem was introduced by |systemd-219-67| to fix the security issue CVE-2018-16888. See https://access.redhat.com/solutions/4420581 for more details. Is there a way to overcome this issue ? Regards

3 3

MDB Backend database definition
by Beker 05 May '20

05 May '20

Hello I'm getting an error while trying to use MDB backend. The section that's giving issue is the following one: ####################################################################### # LMDB database definitions ####################################################################### # dn: olcDatabase=mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcDbMaxSize: 1073741824 olcSuffix: dc=test,dc=local olcRootDN: cn=mdbadm,test,dc=local # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd-config(5) for details. # Use of strong authentication encouraged. olcRootPW: {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. olcDbDirectory: /var/db/openldap-data # Indices to maintain olcDbIndex: objectClass eq with this section added to the end of slapd.ldif i get the error *5ea9641d <= str2entry: str2ad(olcDbMaxSize): attribute type undefined* while testing the import using *slapadd -v -n0 -F /etc/openldap/slapd.d -l /etc/openldap/slapd.ldif* if i comment the offending line *olcDbMaxSize: 1073741824* then I just get an error with another line in the same section. This is a fresh install, the slapd.d folder is empty and I'm using the example slapd.ldif.sample that comes with the software (it has mdb lodaded as module by default) # # Load dynamic backend modules: # dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib/openldap #olcModuleload: back_bdb.so #olcModuleload: back_hdb.so #olcModuleload: back_ldap.so olcModuleload: back_mdb.so #olcModuleload: back_passwd.so #olcModuleload: back_shell.so Thanks in dvance for any hint or help you can provide Best regards

3 3

OpenLDAP help - Import issue
by Pranjit Biswas 05 May '20

05 May '20

HI , We are trying to install openldap.x86_64 - 2.4.44-21.el7_6 on an Linux RHEL 7.7 on AWS . We have installed and made changes to the config files and did a slaptest of the config file as shown below . [root@efg-ac cn=config]# slaptest -u 5ea6064f ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={0}config.ldif" 5ea6064f ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif" config file testing succeeded Now we are importing the ldif file from our current on-prem server . Even though we were getting different errors earlier , after all the changes we have made to the config , the error that we are getting now is ldap_bind error for the credentials . [root@efg-dev cn=config]# ldapadd -w xxxxxxxx -x -D "cn=Manager,dc=bpost,dc=be" -f ldap_dump-27042020-DEV.ldif ldap_bind: Invalid credentials (49) We are not sure which password to give here . We have given the same credentials in the config file : olcDatabase={2}hdb.ldif olcRootDN: cn=Manager,dc=bpost,dc=be olcRootPW: xxxxxxxx Regards, Pranjit | Lead Consultant |B2B Cell:- +91-9573080955 pranjit_biswas(a)infosys.com<mailto:pranjit_biswas@infosys.com> PTO Plan :- None

3 6

Can not find object by attribute value
by xaled＠web.de 05 May '20

05 May '20

Hi, Could someone help me with this one? I have a user1 with inetUserStatus: active and user2 inetUserStatus: inactive. If I search for a user with a inetUserStatus=(in)active I don't get any results: # ldapsearch -x -H ldap://127.0.0.1:389 -D 'cn=admin,dc=gal,dc=example,dc=com' -w secret -LLL -b ou=people,dc=gal,dc=example,dc=com '(inetUserStatus=active)' # ldapsearch -x -H ldap://127.0.0.1:389 -D 'cn=admin,dc=gal,dc=example,dc=com' -w secret -LLL -b ou=people,dc=gal,dc=example,dc=com '(inetUserStatus=inactive)' What is wrong with my search or slapd config? If I search for a * as attribute value I get both users. # ldapsearch -x -H ldap://127.0.0.1:389 -D 'cn=admin,dc=gal,dc=example,dc=com' -w secret -LLL -b ou=people,dc=gal,dc=example,dc=com '(inetUserStatus=*)' dn: uid=user2,ou=people,dc=gal,dc=example,dc=com shadowWarning: 0 gidNumber: 100 shadowMax: 0 objectClass: top objectClass: account objectClass: posixAccount objectClass: shadowAccount objectClass: inetUser loginShell: /bin/bash userPassword:: e1NTSEF9TVk0WW432UzRxYjRBNWN1TFlTaXZCVFBHRFN3MzdoYWs= uid: user2 shadowLastChange: 0 cn: user2 homeDirectory: /home/user2 uidNumber: 1006 gecos: user2 inetUserStatus: inactive dn: uid=user1,ou=people,dc=gal,dc=example,dc=com objectClass: top objectClass: account objectClass: posixAccount objectClass: shadowAccount objectClass: inetUser cn: user1 uid: user1 uidNumber: 1005 gidNumber: 100 homeDirectory: /home/user1 loginShell: /bin/bash userPassword:: e1NTSEF9TVk0WW1HU231xYjRBNWN1TFlTaXZCVFBHRFN3MzdoYWs= shadowLastChange: 0 shadowMax: 0 shadowWarning: 0 inetUserStatus: active gecos: user1 # ldapsearch -LLLQY EXTERNAL -H ldapi:/// -b cn=schema,cn=config dn dn: cn=schema,cn=config dn: cn={0}core,cn=schema,cn=config dn: cn={1}cosine,cn=schema,cn=config dn: cn={2}nis,cn=schema,cn=config dn: cn={3}inetorgperson,cn=schema,cn=config dn: cn={4}ldapab,cn=schema,cn=config dn: cn={5}openxchange,cn=schema,cn=config dn: cn={6}evolutionperson,cn=schema,cn=config dn: cn={7}inetUser,cn=schema,cn=config s# ldapsearch -LLLQY EXTERNAL -H ldapi:/// -o ldif-wrap=no -b cn={7}inetUser,cn=schema,cn=config dn: cn={7}inetUser,cn=schema,cn=config objectClass: olcSchemaConfig cn: {7}inetUser olcAttributeTypes: {0}( 1.2.840.113556.1.2.102 NAME 'memberOf' DESC 'Group that the entry belongs to' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netscape Delegated Administrator' ) olcAttributeTypes: {1}( 2.16.840.1.113730.3.1.692 NAME 'inetUserStatus' DESC '"active", "inactive", or "deleted" status of a user' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape subscriber interoperability' ) olcAttributeTypes: {2}( 2.16.840.1.113730.3.1.693 NAME 'inetUserHttpURL' DESC 'A users Web addresses' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netscape subscriber interoperability' ) olcObjectClasses: {0}( 2.16.840.1.113730.3.2.130 NAME 'inetUser' DESC 'Auxiliary class which must be present in an entry for delivery of subscriber services' SUP top AUXILIARY MAY ( uid $ inetUserStatus $ inetUserHTTPURL $ userPassword $ memberOf ) X-ORIGIN 'Netscape subscriber interoperability' ) Thanks

2 2

Antw: [EXT] Can not find object by attribute value
by Ulrich Windl 05 May '20

05 May '20

>>> <xaled(a)web.de> schrieb am 04.05.2020 um 23:10 in Nachricht <3418_1588627588_5EB08884_3418_88_1_1c5701d62258$69c28330$3d478990$(a)web.de>: > Hi, > > > > Could someone help me with this one? I have a user1 with inetUserStatus: > active and user2 inetUserStatus: inactive. If I search for a user with a > inetUserStatus=(in)active I don't get any results: > > > > # ldapsearch ‑x ‑H ldap://127.0.0.1:389 ‑D > 'cn=admin,dc=gal,dc=example,dc=com' ‑w secret ‑LLL ‑b > ou=people,dc=gal,dc=example,dc=com '(inetUserStatus=active)' > > # ldapsearch ‑x ‑H ldap://127.0.0.1:389 ‑D > 'cn=admin,dc=gal,dc=example,dc=com' ‑w secret ‑LLL ‑b > ou=people,dc=gal,dc=example,dc=com '(inetUserStatus=inactive)' > > > > What is wrong with my search or slapd config? > > > > If I search for a * as attribute value I get both users. > > > > # ldapsearch ‑x ‑H ldap://127.0.0.1:389 ‑D > 'cn=admin,dc=gal,dc=example,dc=com' ‑w secret ‑LLL ‑b > ou=people,dc=gal,dc=example,dc=com '(inetUserStatus=*)' > > dn: uid=user2,ou=people,dc=gal,dc=example,dc=com > > shadowWarning: 0 > > gidNumber: 100 > > shadowMax: 0 > > objectClass: top > > objectClass: account > > objectClass: posixAccount > > objectClass: shadowAccount > > objectClass: inetUser > > loginShell: /bin/bash > > userPassword:: e1NTSEF9TVk0WW432UzRxYjRBNWN1TFlTaXZCVFBHRFN3MzdoYWs= > > uid: user2 > > shadowLastChange: 0 > > cn: user2 > > homeDirectory: /home/user2 > > uidNumber: 1006 > > gecos: user2 > > inetUserStatus: inactive > > > > dn: uid=user1,ou=people,dc=gal,dc=example,dc=com > > objectClass: top > > objectClass: account > > objectClass: posixAccount > > objectClass: shadowAccount > > objectClass: inetUser > > cn: user1 > > uid: user1 > > uidNumber: 1005 > > gidNumber: 100 > > homeDirectory: /home/user1 > > loginShell: /bin/bash > > userPassword:: e1NTSEF9TVk0WW1HU231xYjRBNWN1TFlTaXZCVFBHRFN3MzdoYWs= > > shadowLastChange: 0 > > shadowMax: 0 > > shadowWarning: 0 > > inetUserStatus: active > > gecos: user1 > > > > # ldapsearch ‑LLLQY EXTERNAL ‑H ldapi:/// ‑b cn=schema,cn=config dn > > dn: cn=schema,cn=config > > dn: cn={0}core,cn=schema,cn=config > > dn: cn={1}cosine,cn=schema,cn=config > > dn: cn={2}nis,cn=schema,cn=config > > dn: cn={3}inetorgperson,cn=schema,cn=config > > dn: cn={4}ldapab,cn=schema,cn=config > > dn: cn={5}openxchange,cn=schema,cn=config > > dn: cn={6}evolutionperson,cn=schema,cn=config > > dn: cn={7}inetUser,cn=schema,cn=config > > > > s# ldapsearch ‑LLLQY EXTERNAL ‑H ldapi:/// ‑o ldif‑wrap=no ‑b > cn={7}inetUser,cn=schema,cn=config > > dn: cn={7}inetUser,cn=schema,cn=config > > objectClass: olcSchemaConfig > > cn: {7}inetUser > > olcAttributeTypes: {0}( 1.2.840.113556.1.2.102 NAME 'memberOf' DESC 'Group > that the entry belongs to' EQUALITY distinguishedNameMatch SYNTAX > 1.3.6.1.4.1.1466.115.121.1.12 X‑ORIGIN 'Netscape Delegated Administrator' ) > > olcAttributeTypes: {1}( 2.16.840.1.113730.3.1.692 NAME 'inetUserStatus' DESC > '"active", "inactive", or "deleted" status of a user' SYNTAX > 1.3.6.1.4.1.1466.115.121.1.15 SINGLE‑VALUE X‑ORIGIN 'Netscape subscriber > interoperability' ) There's no EQUALITY. Does slapd log any message when you try to compare? > > olcAttributeTypes: {2}( 2.16.840.1.113730.3.1.693 NAME 'inetUserHttpURL' > DESC 'A users Web addresses' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X‑ORIGIN > 'Netscape subscriber interoperability' ) > > olcObjectClasses: {0}( 2.16.840.1.113730.3.2.130 NAME 'inetUser' DESC > 'Auxiliary class which must be present in an entry for delivery of > subscriber services' SUP top AUXILIARY MAY ( uid $ inetUserStatus $ > inetUserHTTPURL $ userPassword $ memberOf ) X‑ORIGIN 'Netscape subscriber > interoperability' ) > > > > Thanks

2 1

Antw: [EXT] RE: OpenLDAP help - Import issue
by Ulrich Windl 04 May '20

04 May '20

>>> Quanah Gibson-Mount <quanah(a)symas.com> schrieb am 04.05.2020 um 19:27 in Nachricht <31908_1588613249_5EB05081_31908_246_1_24A29F72442AE6729B2A09EC(a)[192.168.1.144]> > > ‑‑On Monday, May 4, 2020 10:51 AM +0000 Pranjit Biswas > <Pranjit_Biswas(a)infosys.com> wrote: > > >> This SSHA PW has been updated in olcDatabase={2}hdb.ldif. >> >> olcRootPW: {SSHA}wbMAL > > Each file in the cn=config DATABASE has this line at the start: > > # AUTO‑GENERATED FILE ‑ DO NOT EDIT!! Use ldapmodify. > > You may wish to read that line and understand what it's telling you. Maybe "Use ldapmodify." could be a bit more verbose ;-) > > Regards, > Quanah > > ‑‑ > > Quanah Gibson‑Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com>

1 0

Antw: [EXT] OpenLDAP, systemd and EL 7.7
by Ulrich Windl 04 May '20

04 May '20

>>> Abdelkader Chelouah <a.chelouah(a)gmail.com> schrieb am 02.05.2020 um 23:26 in Nachricht <30537_1588524939_5EAEF789_30537_298_1_913c1269-d74f-9b81-9715-9d956d39f12a@gmai .com>: > Hello, > > > Since the upgrade to RHEL 7.7, my openldap service with property > |Type=forking| and property |PIDFile| defined doesn't start and its > status shows the following error messages: > > > May 02 20:02:57 systemd[1]: New main PID 445254 does not belong to > service, and PID file is not owned by root. Refusing. Is it due to the fact that PIDs are larger than they used to be? > > > Actually, slapd is started with -u ldap -g ldap options, so the owner of > the pid file slapd.pid is ldap. The problem was introduced by > |systemd-219-67| to fix the security issue CVE-2018-16888. See > https://access.redhat.com/solutions/4420581 for more details. > > > Is there a way to overcome this issue ? > > > Regards

1 0

LTB packages for OpenLDAP 2.4.50 (was: OpenLDAP 2.4.50 available)
by Clément OUDOT 03 May '20

03 May '20

Hello, LDAP Tool Box packages for OpenLDAP 2.4.50 are available for RedHat/CentOS/Debian/Ubuntu : https://ltb-project.org/download#openldap Thanks to David Coutadeur for the Debian packages. Clément.

1 0

LDAP performance
by Technology Server 30 Apr '20

30 Apr '20

Dears, How to get a response time curve showing how fast queries are answered by each instance of LDAP ? How can we measure LDAP performance based on all possible aspects ? Regards, Tech Sever.

3 2

2.4.50 and pw-argon2
by Michael Ströder 29 Apr '20

29 Apr '20

HI! Anything special with installing the man-page of pw-argon2? It fails in openSUSE Build Service: [ 112s] mkdir -p `grep -e "^prefix =" ../../../../Makefile | cut -d= -f2`/share/man/man5 [ 112s] /usr/bin/install -m 644 slapd-pw-argon2.5 `grep -e "^prefix =" ../../../../Makefile | cut -d= -f2`/share/man/man5 [ 112s] /usr/bin/install: cannot create regular file '/usr/share/man/man5/slapd-pw-argon2.5': Permission denied [ 112s] make: *** [Makefile:70: install-man] Error 1 [ 112s] make: *** Waiting for unfinished jobs.... Ciao, Michael.

4 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical