openldap-technical

openldap-technical@openldap.org

12 participants
9794 discussions

Allow particular LDAP group users login
by Frank Yu 09 Jan '17

09 Jan '17

Hi, I have a case, allow particular LDAP group user can login host. I get a method from google, which use pam_listfile.so , I tried as description( https://www.cyberciti.biz/tips/howto-deny-allow-linux-user-group-login.html), but it failed to restrict particular group. Below is what I did: 1. add pam_listfile.so to system-auth # grep pam_listfile.so system-auth -A2 auth required pam_listfile.so \ onerr=fail item=group sense=allow file=/etc/login.group.allowed 2. create file login.group.allowed, and add group name in this file # ll /etc/login.group.allowed -rwxr-xr-x. 1 root root 12 Jan 7 19:28 /etc/login.group.allowed # cat /etc/login.group.allowed hogpu-users 3. try to login a user, which is not in group hogpu-users. $ ssh test.lu(a)10.10.10.37 luo.lu(a)101.100.10.37's password: Last login: Sat Jan 7 19:30:04 2017 from 10.31.32.72 id: cannot find name for group ID 501 [luo.lu@xyz-gpu100 ~]$ id test.lu uid=10138(test.lu) gid=501 groups=501,503(hogpu-algorithm-intern) so user test.lu is not in group hogpu-users, but I still can login the host. What I missed? any suggestion about this? Thanks -- Regards Frank Yu

2 2

Re: [SOLVED] /etc/ldap/slapd.conf: line 27: unknown directive <TLSCertificateFile:> outside backend info and database definitions.
by MrBiTs 08 Jan '17

08 Jan '17

Hi, Everybody Thanks a lot for interesting in my problem. I've fixed it. The problem was permissions. User openldap wasn't able to read /etc/ssl/certs directory. CheerS On Sun, Jan 8, 2017 at 10:20 AM, MrBiTs <mrbits.dcf(a)gmail.com> wrote: > Hello, all. Happy 2017 > > From the years 2009 to 2012 I've administrate as OpenLDAP cluster using > SSL configurations, something like that: > > backend hdb > sizelimit unlimited > allow bind_v2 > concurrency 100 > > TLSCipherSuite HIGH:MEDIUM:+SSLv2 > TLSCACertificateFile: /etc/ssl/certs/ca_server.pem > TLSCertificateFile: /etc/ssl/certs/ldap_server.pem > TLSCertificateKeyFile: /etc/ssl/private/ldap_server.key > TLSVerifyClient never > > access to attrs=userPassword by anonymous auth by self write by * none > access to * by self write by * none > > > loglevel 3 > # Database configuration > > database hdb > suffix "dc=example,dc=com" > > This year I'll start to admin another cluster, now installed in Ubuntu > 16.04 using: > > slapd/xenial-updates,now 2.4.42+dfsg-2ubuntu3.1 amd64 [installed] > OpenLDAP server (slapd) > > If I remove TLS directives from slapd.conf, the server runs fine but, of > course, just using LDAP protocol without any kind of cryptography. Using > the TLS directives, I always have the error > > /etc/ldap/slapd.conf: line 27: unknown directive <TLSCertificateFile:> > outside backend info and database definitions. > > I did research in Google and read man 5 slapd.conf and I GUESS directives > are in the right place in slapd.conf. > > Anybody face this error recently and can help me with some tips? > > Thanks in advance > > > > -- > > LLAP > > .0. MrBiTs - mrbits.dcf(a)gmail.com > ..0 GnuPG - http://keyserver.fug.com.br:11371/pks/lookup?op=get& > search=0x6EC818FC2B3CA5AB > 000 http://www.mrbits.com.br > -- LLAP .0. MrBiTs - mrbits.dcf(a)gmail.com ..0 GnuPG - http://keyserver.fug.com.br:11371/pks/lookup?op=get&search=0x6EC818FC2B3CA5… 000 http://www.mrbits.com.br

1 0

/etc/ldap/slapd.conf: line 27: unknown directive <TLSCertificateFile:> outside backend info and database definitions.
by MrBiTs 08 Jan '17

08 Jan '17

Hello, all. Happy 2017 >From the years 2009 to 2012 I've administrate as OpenLDAP cluster using SSL configurations, something like that: backend hdb sizelimit unlimited allow bind_v2 concurrency 100 TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile: /etc/ssl/certs/ca_server.pem TLSCertificateFile: /etc/ssl/certs/ldap_server.pem TLSCertificateKeyFile: /etc/ssl/private/ldap_server.key TLSVerifyClient never access to attrs=userPassword by anonymous auth by self write by * none access to * by self write by * none loglevel 3 # Database configuration database hdb suffix "dc=example,dc=com" This year I'll start to admin another cluster, now installed in Ubuntu 16.04 using: slapd/xenial-updates,now 2.4.42+dfsg-2ubuntu3.1 amd64 [installed] OpenLDAP server (slapd) If I remove TLS directives from slapd.conf, the server runs fine but, of course, just using LDAP protocol without any kind of cryptography. Using the TLS directives, I always have the error /etc/ldap/slapd.conf: line 27: unknown directive <TLSCertificateFile:> outside backend info and database definitions. I did research in Google and read man 5 slapd.conf and I GUESS directives are in the right place in slapd.conf. Anybody face this error recently and can help me with some tips? Thanks in advance -- LLAP .0. MrBiTs - mrbits.dcf(a)gmail.com ..0 GnuPG - http://keyserver.fug.com.br:11371/pks/lookup?op=get&search=0x6EC818FC2B3CA5… 000 http://www.mrbits.com.br

1 0

Regarding the conclusion from ITS# 8521 and cn=config replication
by Nikos Voutsinas 07 Jan '17

07 Jan '17

I was looking at the latest issues/commits and came across ITS#8521 which discusses the correct sequence of setting up the serverID, the syncprov overlay and uploading the actual data in a replication scheme. So there, the conclusion is: "Bottom line, *always* inject the serverID and syncprov *before injecting some data, or be ready to do an update after having injected syncprov and serverID" This made me wonder how can we accomplish this with the replication of cn=config, and if the replication of cn=config requires any extra precaution at the initialization phase. Nikos

1 0

Re: Syncrepl and multipe values
by Quanah Gibson-Mount 06 Jan '17

06 Jan '17

--On Tuesday, January 03, 2017 10:03 PM +0000 Matheus Eduardo Bonifacio Morais <matheus_morais(a)sicredi.com.br> wrote: > > > Hi, > > > > I have one replication tool which makes some modifications in my OpenLDAP > master. For some shitty reason, that tool tries to modify one dn with > duplicated attributes. Here is the snippet of accesslog: Please file an ITS for this issue at http://www.openldap.org/its/ Preferably, include an example ldapmodify command triggering the behavior. Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 2

Re: help with ACL
by Quanah Gibson-Mount 06 Jan '17

06 Jan '17

--On Wednesday, January 04, 2017 2:44 PM +0100 Alberto Aldrigo <alberto.aldrigo(a)h-farm.com> wrote: > So an ACL could be: > > to dn.subtree="o=company1,dc=domain,dc=com" by group="c > cn=admins_company1,o=company1,dc=domain,dc=com" write > > I have 25 of these groups, so I need 25 ACLs like the one above: having > one per line can lead to a performance issue? Generally it should be fine, as it's not a particularly complex ACL. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Antw: Re: ppolicy overlay unable to set pwdAccountLockedTime on to-be-locked users due to ACLs
by Quanah Gibson-Mount 06 Jan '17

06 Jan '17

--On Tuesday, January 03, 2017 2:49 PM +0100 Matthieu Cerda <matthieu.cerda(a)nbs-system.com> wrote: > > > Le 03/01/2017 à 08:05, Ulrich Windl a écrit : >>>>> Quanah Gibson-Mount <quanah(a)symas.com> schrieb am 03.01.2017 um 00:11 >>>>> in >> Nachricht <F365AC223D2A1E22A5345243(a)[192.168.1.30]>: >>> (...) >>> >>> Note the bit about "all the operations, ..." >>> >>> If you think of a way to reword it that you feel is a better >>> explanation, that could certainly be considered. :) >> >> I think a notice who is the modifier on ppolicy changes would be woth >> it; specifically if it's related to RootDN ;-) I think I had already >> asked earlier about some notice on ACLs that ppolicy may or may not need >> to work. > > Well I certainly didn't understand the message as 'every operation will > be done assuming the rootdn identity' indeed. > > I agree with Ulrich, maybe a small note in the manpage saying exactly > that might help, just in case ? > > Here is a proposal patch on slapo-ppolicy.5 manpage to clarify that. Submissions need to be via the ITS system, http://www.openldap.org/its/ Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(host) and (uid) not indexed (after creating an account)
by Peng Yu 04 Jan '17

04 Jan '17

Hi, I can use the following command to change the password in openldap after I create an entry le. ~~~ $ sudo ldapsetpasswd le Changing password for user uid=le,ou=Users,dc=mydomain,dc=example New Password: Retype New Password: Successfully set password for user uid=le,ou=Users,dc=mydomain,dc=example ~~~ And I can see the userPassword field is changed upon calling the above command. ~~~ $ sudo ldapmodifyuser le [sudo] password for pengy: # About to modify the following entry : dn: uid=le,ou=Users,dc=mydomain,dc=example objectClass: account objectClass: posixAccount objectClass: shadowAccount cn: le uid: le uidNumber: 10103 gidNumber: 10002 homeDirectory: /home/le loginShell: /bin/bash gecos: le description: User account shadowMax: 180 shadowLastChange: 0 userPassword:: e1NTSEF9VzZHdlFnTkdDMitzUk5BRStpMGMzcElVWG9hVTYzRjk= # Enter your modifications here, end with CTRL-D. dn: uid=le,ou=Users,dc=mydomain,dc=example Successfully modified user entry uid=le,ou=Users,dc=mydomain,dc=example in LDAP ~~~ (BTW, why whenever I run ldapsetpasswd to set the same password, the userPassword field is set differently?) But the user le is not able to login to the servers (the servers connected to openldap for authentication) with the new password. In /var/log/syslog of the openldap server (ubuntu), I see the following lines. ~~~ Jan 2 12:17:22 openldapserver slapd[1082]: conn=2884 fd=39 ACCEPT from IP=172.17.1.6:51975 (IP=0.0.0.0:389) Jan 2 12:17:22 openldapserver slapd[1082]: conn=2884 op=0 BIND dn="" method=128 Jan 2 12:17:22 openldapserver slapd[1082]: conn=2884 op=0 RESULT tag=97 err=0 text= Jan 2 12:17:22 openldapserver slapd[1082]: conn=2884 op=1 SRCH base="dc=domain,dc=example" scope=2 deref=0 filter="(&(&(|(host=\2A)(host=elnath))(!(host=!elnath)))(&(|(host=\2A)(host=elnath))(!(host=!elnath)))(uid=le))" Jan 2 12:17:22 openldapserver slapd[1082]: <= bdb_equality_candidates: (host) not indexed Jan 2 12:17:22 openldapserver slapd[1082]: message repeated 3 times: [ <= bdb_equality_candidates: (host) not indexed] Jan 2 12:17:22 openldapserver slapd[1082]: <= bdb_equality_candidates: (uid) not indexed Jan 2 12:17:22 openldapserver slapd[1082]: conn=2884 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= ~~~ On the server to be logged in (named as elnath and is also a ubuntu server), /var/log/auth.log has the following line. ~~~ Jan 2 12:17:22 elnath sshd[21249]: Failed password for le from xxx.xx.xx.xx port 57155 ssh2 ~~~ I have tried to stop slapd service then run slapindex as root and then start slapd service on the openldapserver. But it still does not work. Could anybody let me know how to fix this issue? Thanks. -- Regards, Peng

3 4

Re: mdb_stat question
by Howard Chu 04 Jan '17

04 Jan '17

Frank Swasey wrote: > I have noticed that the mdb_stat (-e parameter) now shows the number of pages > used, so I can use that instead of running a du and compare it to the Max > pages value to see how "full" the data.mdb has become. > > We use nagios to monitor such things... is there a frequency of running > mdb_stat that would be too frequent and could cause issues with a moderately > loaded (handling 14 million operations per day) ldap server? It takes more CPU time to fork a process and load the mdb_stat binary than it takes to read and print the statistic. > Should I have nagios not perform the mdb_stat check more frequently than some > recommended amount of time? Whatever, it's your CPU load. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

mdb_stat question
by Frank Swasey 04 Jan '17

04 Jan '17

I have noticed that the mdb_stat (-e parameter) now shows the number of pages used, so I can use that instead of running a du and compare it to the Max pages value to see how "full" the data.mdb has become. We use nagios to monitor such things... is there a frequency of running mdb_stat that would be too frequent and could cause issues with a moderately loaded (handling 14 million operations per day) ldap server? Should I have nagios not perform the mdb_stat check more frequently than some recommended amount of time? Thanks, Frank

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical