openldap-technical

openldap-technical@openldap.org

18 participants
9897 discussions

ldap_sasl_interactive_bind_s: Can't contact LDAP server
by Turbo Fredriksson 05 Dec '17

05 Dec '17

[I’ve posted this on the OpenStack list as well, but maybe someone here knows more] I’m setting up (Open)LDAP (v2.4.40) on my old Newton installation, with the LDAP servers behind a HAProxy LB. I’m trying to have one at a time enabled to see if I can get them working individually before I try them as a whole/group.. I tried all day yesterday, and I could do the initial connection, but not get any results: ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) I see the connection in syslog on the LDAP server, but don’t get any results back. Now, first thing I did this morning was to just run the exact same command (kinit && ldapwhoami) that I did last night. AND IT WORKED!! No idea why! It shouldn’t have. Glad it did, but since I can’t explain WHY it worked, it’s annoying!! :) So I then disabled that (working) LDAP server in the LB member list and enabled the second. And now that is experiencing the same problem as the first yesterday… I didn’t change anything else - last thing I did before I went to bed last night was try the ldapwhoami command -> “can’t contact ldap server”. And the very first thing I did this morning was kdestroy my ticket, get a new one and then run ldapwhoami. I’ve run with multiple types of debugging, but there’s nothing obvious that I can see, either from ‘-d -1’ or with KRB5_TRACE set). So … “something” internally in OS changed. Any suggestions to what or how to debug this? What is ldap_sasl_interactive_bind_s() actually doing? Why does the ldap_bind() earlier seem to work, but not the SASL bind? See http://bayour.com/misc/ldapwhoami_output.txt <http://bayour.com/misc/ldapwhoami_output.txt> for full output from KRB5_TRACE=/dev/stdout ldapwhoami -YGSSAPI -H ldaps://ldap.bayour.net -d -1 and while this is happening, this is the output from slapd in the logs (running with “loglevel sync stats): Nov 19 12:42:40 admin-auth-ldap-31 slapd[26613]: conn=1015 fd=29 ACCEPT from IP=10.0.17.34:53451 (IP=10.0.17.31:636) Nov 19 12:42:40 admin-auth-ldap-31 slapd[26613]: conn=1015 fd=29 TLS established tls_ssf=256 ssf=256 Nov 19 12:42:40 admin-auth-ldap-31 slapd[26613]: conn=1015 op=0 BIND dn="" method=163 Nov 19 12:43:09 admin-auth-ldap-31 slapd[26613]: conn=1013 fd=22 closed (connection lost) With ‘loglevel -1’ (and filtering out 'daemon: epoll: listen|daemon: activity on’ because it ends up filling the screen), I get: Nov 19 12:49:28 admin-auth-ldap-31 slapd[27043]: Nov 19 12:49:28 admin-auth-ldap-31 slapd[27043]: slap_listener_activate(12): Nov 19 12:49:28 admin-auth-ldap-31 slapd[27043]: >>> slap_listener(ldaps://admin-auth-ldap-31.bayour.net:636/) Nov 19 12:49:28 admin-auth-ldap-31 slapd[27043]: daemon: listen=12, new connection on 25 Nov 19 12:49:29 admin-auth-ldap-31 slapd[27043]: Nov 19 12:49:33 admin-auth-ldap-31 slapd[27043]: daemon: added 25r (active) listener=(nil) Nov 19 12:49:33 admin-auth-ldap-31 slapd[27043]: conn=1001 fd=25 ACCEPT from IP=10.0.17.34:54740 (IP=10.0.17.31:636) Nov 19 12:49:34 admin-auth-ldap-31 slapd[27043]: 25r Nov 19 12:49:34 admin-auth-ldap-31 slapd[27043]: Nov 19 12:49:34 admin-auth-ldap-31 slapd[27043]: daemon: read active on 25 Nov 19 12:49:34 admin-auth-ldap-31 slapd[27043]: connection_get(25) Nov 19 12:49:34 admin-auth-ldap-31 slapd[27043]: connection_get(25): got connid=1001 Nov 19 12:49:34 admin-auth-ldap-31 slapd[27043]: connection_read(25): checking for input on id=1001 Nov 19 12:49:35 admin-auth-ldap-31 slapd[27043]: 25r Nov 19 12:49:35 admin-auth-ldap-31 slapd[27043]: Nov 19 12:49:35 admin-auth-ldap-31 slapd[27043]: daemon: read active on 25 Nov 19 12:49:35 admin-auth-ldap-31 slapd[27043]: connection_get(25) Nov 19 12:49:35 admin-auth-ldap-31 slapd[27043]: connection_get(25): got connid=1001 Nov 19 12:49:35 admin-auth-ldap-31 slapd[27043]: connection_read(25): checking for input on id=1001 Nov 19 12:49:35 admin-auth-ldap-31 slapd[27043]: connection_read(25): unable to get TLS client DN, error=49 id=1001 Nov 19 12:49:35 admin-auth-ldap-31 slapd[27043]: conn=1001 fd=25 TLS established tls_ssf=256 ssf=256 Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: 25r Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: daemon: read active on 25 Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: connection_get(25) Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: connection_get(25): got connid=1001 Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: connection_read(25): checking for input on id=1001 Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: op tag 0x60, time 1511095776 Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: conn=1001 op=0 do_bind Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: >>> dnPrettyNormal: <> Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: <<< dnPrettyNormal: <>, <> Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: conn=1001 op=0 BIND dn="" method=163 Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: do_bind: dn () SASL mech GSSAPI Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: ==> sasl_bind: dn="" mech=GSSAPI datalen=617 Nov 19 12:49:37 admin-auth-ldap-31 slapd[27043]: Nov 19 12:49:54 admin-auth-ldap-31 slapd[27043]: Nov 19 12:49:55 admin-auth-ldap-31 slapd[27043]: Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: 25r Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: daemon: read active on 25 Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: connection_get(25) Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: connection_get(25): got connid=1001 Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: connection_read(25): checking for input on id=1001 Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: ber_get_next on fd 25 failed errno=0 (Success) Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: connection_read(25): input error=-2 id=1001, closing. Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: connection_closing: readying conn=1001 sd=25 for close Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: connection_close: deferring conn=1001 sd=25 Nov 19 12:50:27 admin-auth-ldap-31 slapd[27043]: Nov 19 12:50:28 admin-auth-ldap-31 slapd[27043]: So nothing obvious that I can see. Which is reasonable, because “eventually” it worked on the previous LDAP server, so can’t be a slapd problem. But I was hoping someone that have tried this on OS or behind a HAProxy setup might be able to shed some light on this. PS. I’ve done the exact same thing at work, in AWS and there it works just fine. So I’m fairly certain it’s something with OS/HAProxy, but I don’t know how to debug that bit..

4 9

Re:ldap_sasl_interactive_bind_s: Can't contact LDAP server
by Quanah Gibson-Mount 05 Dec '17

05 Dec '17

--On Sunday, December 03, 2017 12:44 PM -0800 Bill MacAllister <bill(a)ca-zephyr.org> wrote: > This is not a new problem. I am pretty sure I filed a bug report about > this years ago when I worked at Stanford, but I could not find it. I've filed <https://github.com/cyrusimap/cyrus-sasl/issues/494> --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: [LMDB] Large transactions
by Howard Chu 05 Dec '17

05 Dec '17

Jürgen Baier wrote: > Hi, > > I have a question about LMDB (I hope this is the right mailing list for such a > question). > > I'm running a benchmark (which is similar to my intended use case) which does > not behave as I hoped. I store 1 billion key/value pairs in a single LMDB > database. _In a single transaction._ The keys are MD5 hash codes from random > data (16 bytes) and the value is the string "test". > The documentation about mdb_page_spill says (as far as I understand) that this > function is called to prevent MDB_TXN_FULL situations. Does this mean that my > transaction is simply too large to be handled efficiently by LMDB? Yes. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 2

slapd-crash in web directory?
by Dave Horsfall 02 Dec '17

02 Dec '17

Not a problem as such, but I happened to notice this in my Apache log: 164.132.162.164 - - [03/Dec/2017:11:57:00 +1100] "GET /slapd-crash/ HTTP/1.1" 404 210 "-" "Mozilla/5.0 (compatible; AhrefsBot/5.2; +http://ahrefs.com/robot/)" AhrefsBot, for the uninitiated, is a web spider that tends to ignore such bothersome conventions as "content=noindex" and "robots.txt" etc, but anyway... Is it common practice to store SLAPD coredumps where every man and his dog can retrieve them? Note that I am not suggesting that OpenLDAP does this (but somebody obviously is), but I'm curious to know how widespread this silly practice is. -- Dave Horsfall DTM (VK2KFU) "Those who don't understand security will suffer."

1 0

Re: [LMDB] Large transactions
by Howard Chu 02 Dec '17

02 Dec '17

Jürgen Baier wrote: > Hi, > > thanks for the answer. However, I still have a follow-up question on this > benchmark. > > When I add 1 billion key/value pairs (16 byte MD5) to the LMDB database (in a > single transaction (but I also get similar results when I add the same data in > multiple transactions)) I get the following results: > > Windows, without MDB_WRITEMAP: 46h > Windows, with MDB_WRITEMAP: 6h (!) > Linux (ext4), without MDB_WRITEMAP: 75h > Linux (ext4), with MDB_WRITEMAP: 73h > > MDB_WRITEMAP seems to have a huge impact on write performance on Windows, but > on Linux I do not see similar improvements. > > So I have two questions: > > 1) Could the the difference between Linux and Windows performance regarding > the MDB_WRITEMAP option be related to the fact that LMDB currently uses sparse > files on Linux, but not on Windows? Unlikely. > 2) Is there a way to speed up Linux? Is there a way to pre-allocate the > data.mdb on startup? Try it and see. Use the env fd with fallocate(2). > Thanks, > > Jürgen > > > On 21.11.17 21:17, Howard Chu wrote: >> Jürgen Baier wrote: >>> Hi, >>> >>> I have a question about LMDB (I hope this is the right mailing list for >>> such a question). >>> >>> I'm running a benchmark (which is similar to my intended use case) which >>> does not behave as I hoped. I store 1 billion key/value pairs in a single >>> LMDB database. _In a single transaction._ The keys are MD5 hash codes from >>> random data (16 bytes) and the value is the string "test". >> >>> The documentation about mdb_page_spill says (as far as I understand) that >>> this function is called to prevent MDB_TXN_FULL situations. Does this mean >>> that my transaction is simply too large to be handled efficiently by LMDB? >> >> Yes. >> > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Monitoring Queries
by Tim Gustafson 01 Dec '17

01 Dec '17

Hi, I was wondering if there's anything like "iftop" for OpenLDAP. I'd like to monitor all queries to given base DN, but I don't need that information written to disk anywhere. I could use the accesslog overlay, but it seems like that might generate a huge amount of log data and likely tank performance. Is there any other way? -- Tim Gustafson BSOE Computing Director tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A To request BSOE IT support, please visit https://support.soe.ucsc.edu/ or send e-mail to help(a)soe.ucsc.edu or call 831-502-7536.

1 0

Re: Openldap-ldb-2.4.44-2 - Issu with Password Management
by Raja T Nair 29 Nov '17

29 Nov '17

Thanks for the timely response, Mike/Ulrich. It was a missing configuration. I missed this line in slapd.conf: ppolicy_hash_cleartext Once that got added, things started working fine. It was a server rebuild as the old one crashed, and I used conf file from a wrong backup :( Mike: Thanks for the explanation. It helped. Btw I was just explaining my observation. Never expected slapd to do that magic :) Best Regards, Raja. On 29 November 2017 at 14:09, Ulrich Windl < Ulrich.Windl(a)rz.uni-regensburg.de> wrote: > You should at least show us the whole $entry. > > > > > Hello All, > > > > I'm using openldap-ltb-2.4.44-2 > > Using password-hash {SSHA512} > > > > We have an in-house portal which allows people to change their passwords. > > It is written in PHP. > > > > version = php 5.6 > > lib = php-ldap > > $entry['userpassword'] = $newpasswd; > > ldap_modify($conn, $userdn, $entry); > > > > $newpasswd contains new password in plain text. > > > > It seems that the server does not encrypt the plain text string sent to > it > > from the portal, it only encodes it in base64. > > > > When an encrypted string is sent (SSHA512), the server rejects based on > > password policy since no special character is present. > > > > We would want to make the first method to work. Can somebody help me with > > this? > > > > ps: ldappasswd command works perfectly and the password gets encrypted in > > SSHA512 and encoded in base64. > > > > Best Regards, > > Raja. > > > > -- > > :^) > > -- :^)

1 0

Openldap-ldb-2.4.44-2 - Issu with Password Management
by Raja T Nair 29 Nov '17

29 Nov '17

Hello All, I'm using openldap-ltb-2.4.44-2 Using password-hash {SSHA512} We have an in-house portal which allows people to change their passwords. It is written in PHP. version = php 5.6 lib = php-ldap $entry['userpassword'] = $newpasswd; ldap_modify($conn, $userdn, $entry); $newpasswd contains new password in plain text. It seems that the server does not encrypt the plain text string sent to it from the portal, it only encodes it in base64. When an encrypted string is sent (SSHA512), the server rejects based on password policy since no special character is present. We would want to make the first method to work. Can somebody help me with this? ps: ldappasswd command works perfectly and the password gets encrypted in SSHA512 and encoded in base64. Best Regards, Raja. -- :^)

4 3

Convert SSHA userPassowrd attribute to use in /etc/shadow
by tran dung 28 Nov '17

28 Nov '17

Hi I have some servers that cannot connect to LDAP server so I have to create accounts on the servers which hash password from LDAP. Is it possible? >From userPassword attribute in LDAP, I can get hashed password and salt value in hex format. How can I convert these hex format values to use in /etc/shadow? Best Regards ----------------------- Tran Dung

1 0

Too Much LDAP Log Activity?
by Douglas Duckworth 23 Nov '17

23 Nov '17

Hi Thanks to several users on this list I have our cluster up and running. The databases look good as does performance. However, logs are increasing about 1MB every few minutes. Does everyone typically send all of local4 to a file or only filter out for example warning and above? Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690

4 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical