openldap-technical

openldap-technical@openldap.org

13 participants
9794 discussions

restrict openldap TLS version
by David Ward 01 Dec '16

01 Dec '16

I'm looking for a test method to restrict the level of TLS used with slapd. I'm running ver 2.4.40 which supports TLS 1.2. I see the undocumented command 'TLSProtocolMin' to require minimum strength. I would like to disable certain version. I saw in the thread 'Re: undocumented TLSProtocolMin' that there is mention of 'SSL_OP_NO_TLSv1_2'. Has this been implemented and how do you configure this in slapd.conf? This would be what I'm looking for in a method to toggle different version of TLS. -David

1 0

Change log timestamp: rsyslog changes don't work
by mdii 01 Dec '16

01 Dec '16

Hi all, I'm trying to change the timestamp appears in my openLDAP logs. Today it's the default timestamp (Nov 22 11:55:02), but for debugging reasons I need to show the milliseconds (something like Nov 22 11:55:02:987 or any other format with milliseconds). The logs output are managed by the /etc/rsyslog.d/openldap.conf file: > #Configuration specifique openldap > local4.* @10.2.32.95:514 > local4.* -/custom/log/openldap.log > local5.* @10.2.32.95:514 > local5.* -/custom/log/openldap-oldschema.log My /etc/rsyslog.conf configuration looks like: > # Use default timestamp format > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat For testing purposes, I change it to: > # Use default timestamp format > $ActionFileDefaultTemplate RSYSLOG_FileFormat Or even to: > # Use default timestamp format > $template myFormat,"PRI: %pri%, MSG: %msg%\n" > $ActionFileDefaultTemplate myFormat But I see no changes in the timestamp (I restart the rsyslog service at each modification) I also notice that I'm just getting the first instance log (-/custom/log/openldap.log), I'm not seeing the second one (-/custom/log/openldap-oldschema.log). Viewing this I have two questions: - why my second instance doesn't log? - why my log timestamp doesn't change when I change the configuration file? I would like to thank you in advance for all the help, Marc

2 1

Re: slapo-smbk5pwd build fixes
by Quanah Gibson-Mount 29 Nov '16

29 Nov '16

--On Saturday, November 05, 2016 7:30 PM -0700 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Saturday, November 05, 2016 6:30 PM +0200 Emmanuel Dreyfus > <manu(a)netbsd.org> wrote: > >> Hello >> >> slapo-smbk5pwd does not link with newer OpenSSL,because the old des_* >> API was removed. This simple patch uses the new (but available for a >> long time) DES_* API to fix that: >> http://www.openldap.org/its/index.cgi/Incoming?id=8525;selectid=8525 > > Hi Emmanuel, > > The openldap-devel list would be the appropriate place to raise and > discuss this. I will try and look into it further on Monday. This is now in RE24, scheduled for the 2.4.45 release. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

replicate cn=config with exception of "ACLs"
by Stanislav Kopp 29 Nov '16

29 Nov '16

Hello, at the moment we're using master<->slave setup with slapd 2.4.31 using old slapd.conf. I want to migrate all to "cn=config" and if possible replicate cn=config DB to slaves for sake maintenance simplicity, but with exception ofr ACLs rules, because master and slaves have different ACLs. Is it possible, or ist it a good idea in general? The plus of slapd.conf was that I can deploy the same ACL file on all slaves with some automation (e.g. puppet). Thanks, Stan

1 0

Re: OID syntax and NAMEs
by Howard Chu 29 Nov '16

29 Nov '16

Michael Ströder wrote: > Howard Chu wrote: >> Michael Ströder wrote: >>> Eventual I'd like to have a constraint like this: >>> >>> # check whether appropriate password policy is assigned >>> constraint_attribute structuralObjectClass,pwdPolicySubentry >>> set "this/structuralObjectClass & this/pwdPolicySubentry/aeApplicableSOC" >> >> Not possible without custom code. > > Hmm, are this/structuralObjectClass and this/pwdPolicySubentry generally > unusable in set-constraints? > > Or does it not work because of the different matching rules? Yes, because of the matching rule issue. This seems to be a deficiency in either ASN.1 or the LDAP spec, I'm not sure which. The problem is that numeric OIDs are obviously unique, but there's no guarantee that string names are. Moreover, the same name might apply to the OID of an attribute, or an objectclass, or a syntax, or some other entity, and there's no way to tell the objectIdentifierMatch rule which context is relevant. So, we can only match on numeric OIDs. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: OID syntax and NAMEs
by Howard Chu 28 Nov '16

28 Nov '16

Michael Ströder wrote: > HI! > > I've declared an attribute type like this with LDAP syntax OID: > > ( 1.3.6.1.4.1.5427.1.389.100.4.18 > NAME 'aeApplicableSOC' > DESC 'AE-DIR: structural object classes for which policy is applicable' > EQUALITY objectIdentifierMatch > SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 > X-ORIGIN 'AE-DIR' ) > > Which is pretty similar to this: > > ( 2.5.4.0 > NAME 'objectClass' > DESC 'RFC4512: object classes of the entity' > EQUALITY objectIdentifierMatch > SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) > > Now I wonder why I can't use the object class NAMEs instead of the OIDs as > attribute or assertion values, e.g. why I can't find the entries with filter > (aeApplicableSOC=aeUser). > > This reminds me a bit of the similar OID vs. NAME issue with 'pwdAttribute' in > 'pwdPolicy' entries. It's the exact same issue. The objectIdentifierMatch function only works with numeric OIDs. The ppolicy overlay inserts its own matching function to make the name work. > > Eventual I'd like to have a constraint like this: > > # check whether appropriate password policy is assigned > constraint_attribute structuralObjectClass,pwdPolicySubentry > set "this/structuralObjectClass & this/pwdPolicySubentry/aeApplicableSOC" Not possible without custom code. > > Ciao, Michael. > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: Ldap not reachable/tuning
by Quanah Gibson-Mount 28 Nov '16

28 Nov '16

--On Friday, November 25, 2016 7:05 PM +0100 Thomas Hummel <thomas.hummel(a)pasteur.fr> wrote: > Hello, > > I'm using a simple setup on CentOS Linux release 7.2.1511 > (Core)/openldap-servers-2.4.40-9 /cn=config/mdb : one provider with the > syncprov overlay and 2 syncrepl consumers. The DIT itself is about 10000 > dn in size (about 3000 active users). > > Everything works fine except that sometimes, some clients report > (temporary) failure to reach the consumers (NAS servers for instance). Hi Thomas, A few notes: a) The CentOS7 build is hacked to support a broken TLS implementation. b) The version (2.4.40) is quite old, and has numerous known problems (it was a particularly broken release). I would also note the CentOS7 build has on occassion had its own problems introduced by patches from RedHat that do not exist in stock OpenLDAP builds. See <http://www.openldap.org/software/release/changes.html> for a list of changes since 2.4.40 was released. c) Nothing you presented indicates any issue on the server side. It could, for example, be an issue with your clients, a firewall, packet shaper, etc. d) You should fully disable rate limiting for rsyslogd. Then find out what the server side reports during the periods of time when you see issues with the client connections. You may wish to examine the LTB builds (<http://ltb-project.org/wiki/download#openldap>) if you are unable to build OpenLDAP yourself, or if you require support for your OpenLDAP installation, Symas (the company I work for) has support options. Hope this helps! --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

OID syntax and NAMEs
by Michael Ströder 28 Nov '16

28 Nov '16

HI! I've declared an attribute type like this with LDAP syntax OID: ( 1.3.6.1.4.1.5427.1.389.100.4.18 NAME 'aeApplicableSOC' DESC 'AE-DIR: structural object classes for which policy is applicable' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 X-ORIGIN 'AE-DIR' ) Which is pretty similar to this: ( 2.5.4.0 NAME 'objectClass' DESC 'RFC4512: object classes of the entity' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) Now I wonder why I can't use the object class NAMEs instead of the OIDs as attribute or assertion values, e.g. why I can't find the entries with filter (aeApplicableSOC=aeUser). This reminds me a bit of the similar OID vs. NAME issue with 'pwdAttribute' in 'pwdPolicy' entries. Eventual I'd like to have a constraint like this: # check whether appropriate password policy is assigned constraint_attribute structuralObjectClass,pwdPolicySubentry set "this/structuralObjectClass & this/pwdPolicySubentry/aeApplicableSOC" Ciao, Michael.

1 0

"attr" Warning in slapcat
by Kilian 26 Nov '16

26 Nov '16

Hi, having a strange warning: # /usr/sbin/slapcat -b dc=foo,dc=bar,com 583422d0 /etc/ldap/slapd.d: line 1: "attr" is deprecated (and undocumented); use "attrs" instead. Then, the normal output of slapcat follows. The thing is, /etc/ldap/slapd.d is a *folder* and in the entire /etc/ldap folder, including subdirs, the string "attr" does not occur. Btw, The contents of /etc/ldap/slapd.d are: -rw------- 1 openldap openldap 2386 Jun 5 13:51 cn=config.ldif drwxr-x--- 6 openldap openldap 4096 Nov 20 20:32 cn=config Can anyone give me a hint, what is going on? Best, Kilian

3 3

Ldap not reachable/tuning
by Thomas Hummel 25 Nov '16

25 Nov '16

Hello, I'm using a simple setup on CentOS Linux release 7.2.1511 (Core)/openldap-servers-2.4.40-9 /cn=config/mdb : one provider with the syncprov overlay and 2 syncrepl consumers. The DIT itself is about 10000 dn in size (about 3000 active users). Everything works fine except that sometimes, some clients report (temporary) failure to reach the consumers (NAS servers for instance). All I see in the logs is that when this happens, the time windows loosely match a moment where log rate limiting is dropping messages (for debugging purpose, I disabled journald ratelimiting and doubled default rsyslog one - still some drops occur on a regular basis). So I assume it happens when slapd is kind of busy... Here are some question about that : - First tuning attempt : ------------------------- I noticed that olcDbMaxReaders value was set to 0 (not by me!) I changed it to olcDbMaxReaders: 512 I thought the problem didn't occur anymore but I was wrong. -> Is there any guideline about how to setup MaxReaders ? - Second tuning attempt : ------------------------- I thought maybe replication was responsible (I'm using refreshAndPersist mode) so I raised the size of the sessionLog (from 100 to 800). I read the doc again and I'd like to know if the following understanding is correct : - thanks to contextCSN and the sync cookies, replication CAN be stateless - if we want it stateless, syncprov HAS TO use the present phase, which basically is like sending the whole DIT except that for unchanged entries, only names are sent - if and ONLY IF a state is used (in the form of a sessionLog), then delete phase can be used (and if the sessionLog can hold enough since the last sync) As a matter of fact, at the opposite of the present phase, in the delete phase, syncprov has to 'remember' (i.e store in a sessionLog) which entries has been deleted. -> this assumes that delete phase is more efficient than the present phase, right ? -> if for some reason (for instance sessionLog being too small, delete phase can not be used) syncprov HAS TO fall back to present phase, correct ? -> does using the sessionLog MAKE SENSE AT ALL when using refreshAndPersist mode ? -> is there any guideline to choose the right size for the sessionLog ? - Third tuning attempt ------------------------- I also raised the checkpoint values. -> Is there any guideline here as well ? Thanks. -- Thomas HUMMEL

1 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical