openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Replication Failing with TLS ... Sneaky Little Config Error
by Daniel Howard 15 Mar '16

15 Mar '16

I have set up OpenLDAP per the nice tutorial at https://help.ubuntu.com/lts/serverguide/openldap-server.html and on my previous run-throughs, I succeeded at setting up replication via TLS. But now that I'm implementing on the dedicated hardware, I am not able to replicate via TLS. SOLUTION: It turns out the solution was to add a space to an LDIF file ... On PROVIDER I will see, for example: Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 fd=49 ACCEPT from IP= 10.10.3.117:60277 (IP=0.0.0.0:389) Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 op=0 BIND dn="" method=128 Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 op=0 RESULT tag=97 err=0 text= Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 op=1 SRCH base="dc=qxxxxxxxxd,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=2043))" Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Mar 14 16:13:15 ldap0 slapd[1536]: <= bdb_equality_candidates: (uidNumber) not indexed Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 op=2 SRCH base="dc=qxxxxxxxxd,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=djh))" Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 op=2 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Mar 14 16:13:16 ldap0 slapd[1536]: conn=1392 op=3 UNBIND While on CONSUMER: Mar 14 16:13:15 ldap1 slapd[3672]: @(#) $OpenLDAP: slapd (Ubuntu) (Sep 15 2015 18:19:13) $#012#011buildd@lgw01-53 :/build/openldap-2QUgtL/openldap-2.4.31/debian/build/servers/slapd Mar 14 16:13:16 ldap1 slapd[3673]: slapd starting Mar 14 16:13:16 ldap1 slapd[3673]: do_syncrepl: rid=317 rc -1 retrying Mar 14 16:13:16 ldap1 sudo: pam_unix(sudo:session): session closed for user root Mar 14 16:13:23 ldap1 slapd[3673]: conn=1000 fd=13 ACCEPT from IP= 10.10.5.3:15197 (IP=0.0.0.0:389) Mar 14 16:13:23 ldap1 slapd[3673]: conn=1000 fd=13 closed (connection lost) I *CAN* to TLS from consumer to master: 0-16:18 djh@ldap1 ~$ *ldapsearch -LLL -x -ZZ -H ldap://ldap0.mtv.**qxxxxxxxxd.com uid=djh cn* dn: uid=djh,ou=People,dc=qxxxxxxxxd,dc=com cn: djh So, I increase olcLogLevel to add sync: Mar 14 16:22:09 ldap1 slapd[4133]: @(#) $OpenLDAP: slapd (Ubuntu) (Sep 15 2015 18:19:13) $#012#011buildd@lgw01-53 :/build/openldap-2QUgtL/openldap-2.4.31/debian/build/servers/slapd Mar 14 16:22:10 ldap1 slapd[4134]: slapd starting Mar 14 16:22:10 ldap1 sudo: pam_unix(sudo:session): session closed for user root Mar 14 16:22:10 ldap1 slapd[4134]: do_syncrep2: rid=317 cookie=rid=317,csn=20160314224255.836334Z#000000#000#000000 Mar 14 16:22:10 ldap1 slapd[4134]: slap_queue_csn: queing 0x7f0c5c114995 20160314224255.836334Z#000000#000#000000 Mar 14 16:22:10 ldap1 slapd[4134]: slap_graduate_commit_csn: removing 0x7f0c5c114d10 20160314224255.836334Z#000000#000#000000 Mar 14 16:22:10 ldap1 slapd[4134]: do_syncrepl: rid=317 rc -1 retrying THAT is the contextCSN on the provider! 0-16:24 djh@ldap0 ~$ *ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base -b dc=qxxxxxxxxd,dc=com contextCSN # provider* dn: dc=qxxxxxxxxd,dc=com contextCSN: 20160314224255.836334Z#000000#000#000000 0-16:22 djh@ldap1 ~$ *ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base -b dc=qxxxxxxxxd,dc=com contextCSN # consumer* dn: dc=qxxxxxxxxd,dc=com contextCSN: 20160314224152.708568Z#000000#000#000000 As best I can tell, the connection works, the replication works, but the consumer is not asking for TLS. 0-16:29 djh@ldap1 ~$ *sudo ldapsearch -Q -Y EXTERNAL -H ldapi:/// -LLL -b cn=config olcDatabase={1}hdb olcSyncRepldn: olcDatabase={1}hdb,cn=config* olcSyncrepl: {0}rid=317 provider=ldap://ldap0.mtv.qxxxxxxxxd.com bindmethod=si mple binddn="cn=admin,dc=qxxxxxxxxd,dc=com" credentials=secret searchbase ="dc=qxxxxxxxxd,dc=com" logbase="cn=accesslog" logfilter="(&(objectClass=audi tWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry=" 60 +" syncdata=accesslogstarttls=critical tls_reqcert=demand If I rip out starttls=critical tls_reqcert=demand then sync works no problem. If I enable logging on the PROVIDER I see: Mar 14 16:35:46 ldap0 slapd[6838]: @(#) $OpenLDAP: slapd (Ubuntu) (Sep 15 2015 18:19:13) $#012#011buildd@lgw01-53 :/build/openldap-2QUgtL/openldap-2.4.31/debian/build/servers/slapd Mar 14 16:35:46 ldap0 slapd[6839]: slapd starting Mar 14 16:35:46 ldap0 sudo: pam_unix(sudo:session): session closed for user root Mar 14 16:35:49 ldap0 slapd[6839]: conn=1000 fd=27 ACCEPT from IP= 10.10.5.3:17876 (IP=0.0.0.0:389) Mar 14 16:35:49 ldap0 slapd[6839]: conn=1000 fd=27 closed (connection lost) Mar 14 16:35:55 ldap0 slapd[6839]: conn=1001 fd=27 ACCEPT from IP= 10.10.3.117:60312 (IP=0.0.0.0:389) Mar 14 16:35:55 ldap0 slapd[6839]: conn=1001 op=0 BIND dn="cn=admin,dc= *qxxxxxxxxd*,dc=com" method=128 Mar 14 16:35:55 ldap0 slapd[6839]: conn=1001 op=0 BIND dn="cn=admin,dc= *qxxxxxxxxd*,dc=com" mech=SIMPLE ssf=0 Mar 14 16:35:55 ldap0 slapd[6839]: conn=1001 op=0 RESULT tag=97 err=0 text= Mar 14 16:35:55 ldap0 slapd[6839]: conn=1001 op=1 SRCH base="cn=accesslog" scope=2 deref=0 filter="(&(objectClass=auditWriteObject)(reqResult=0))" Mar 14 16:35:55 ldap0 slapd[6839]: conn=1001 op=1 SRCH attr=targetDN changeType changes newRDN deleteOldRDN newSuperior entryCSN Mar 14 16:35:55 ldap0 slapd[6839]: Entry reqStart=20160314224152.000005Z,cn=accesslog CSN 20160314224152.708568Z#000000#000#000000 older or equal to ctx 20160314224152.708568Z#000000#000#000000 Mar 14 16:35:55 ldap0 slapd[6839]: syncprov_search_response: cookie=rid=317,csn=20160314224255.836334Z#000000#000#000000 Mar 14 16:35:55 ldap0 slapd[6839]: conn=1001 op=2 UNBIND Mar 14 16:35:55 ldap0 slapd[6839]: conn=1001 fd=27 closed So .......... it looks like ... sync works until it doesn't because ... we're not binding consumer to provider TLS because .. ? WAIT A GOSH DARN SECOND HERE .... 0-16:41 djh@ldap1 ~$ *sudo ldapsearch -Q -Y EXTERNAL -H ldapi:/// -LLL -b cn=config olcDatabase={1}hdb olcSyncRepldn: olcDatabase={1}hdb,cn=config* olcSyncrepl: {0}rid=317 provider=ldap://ldap0.mtv.qxxxxxxxxd.com bindmethod=si mple binddn="cn=admin,dc=qxxxxxxxxd,dc=com" credentials=secret searchbase ="dc=qxxxxxxxxd,dc=com" logbase="cn=accesslog" logfilter="(&(objectClass=audi tWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry=" 60 +" *syncdata=accesslogstarttls=critical* tls_reqcert=demand Yeah ... 0-16:43 djh@ldap1 ~$ *cat consumer_sync_tls.ldif* dn: olcDatabase={1}hdb,cn=config replace: olcSyncRepl olcSyncRepl: rid=317 provider=ldap://ldap0.mtv.qxxxxxxxxd.com bindmethod=simple binddn="cn=admin,dc=qxxxxxxxxd,dc=com" credentials=secret searchbase="dc=qxxxxxxxxd,dc=com" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog starttls=critical tls_reqcert=demand 0-16:43 djh@ldap1 ~$ *sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f consumer_sync_tls.ldifSASL/EXTERNAL authentication started* SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={1}hdb,cn=config" No errors ... **edit consumer_sync_tls.ldif, add a space to the end of the line ending in syncdata=accesslog** 0-16:45 djh@ldap1 ~$ *sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f consumer_sync_tls.ldifSASL/EXTERNAL authentication started* SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={1}hdb,cn=config" Same result, no errors, aaand: 0-16:46 djh@ldap1 ~$ *ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base -b dc=**qxxxxxxxxd,dc=com contextCSN # consumer* dn: dc=qxxxxxxxxd,dc=com contextCSN: 20160314224255.836334Z#000000#000#000000 Well, I just paid some dues. I want to add olcLogLevel config perhaps? Would that have helped me here? Thanks ... -danny -- http://dannyman.toldme.com

1 0

Re: olcAccess/olcLimits modifications
by PenguinWhispererThe . 15 Mar '16

15 Mar '16

I tried exactly that notation however that replaced the whole entry (so only one index left). I only wanted to replace the 12th index. On Mar 14, 2016 15:12, "Cole" <cole(a)opteqint.net> wrote: > Hi, > Yes, it should be possible, so from your first example: > > dn: olcDatabase={2}mdb,cn=config > changetype:modify > add: olcAccess > olcAccess: {0}full accessrule > > > Change that to: > > dn: olcDatabase={2}mdb,cn=config > changetype:modify > replace: olcAccess > olcAccess: {0}full accessrule > > > Notice the use of "replace" instead of "add". > > Regards > /Cole > > On 14 March 2016 at 15:01, PenguinWhispererThe . < > th3penguinwhisperer(a)gmail.com> wrote: > >> I was successfully able to modify the olcLimits and olcAccess. >> >> What I still wonder if it's possible to just replace one index. I've >> tried but all the indexes got removed and replaced with the one I put. >> >> >> Thanks in advance! >> >> 2016-03-11 16:27 GMT+01:00 Cole <cole(a)opteqint.net>: >> >>> Hi, >>> >>> That is correct. Also if you leave out the {#} entry, the value will be >>> added at the end of any current values. >>> >>> I learnt most of these details from the zytrax book on openldap, as it >>> contained non-trivial examples. This section: >>> http://www.zytrax.com/books/ldap/ch6/slapd-config.html#use-security >>> describes the {} functionality. >>> >>> Regards >>> /Cole >>> >>> On 10 March 2016 at 22:56, PenguinWhispererThe . < >>> th3penguinwhisperer(a)gmail.com> wrote: >>> >>>> > That's completely missing the point of these ordering prefixes. >>>> I honestly don't see a lot of mentioning about this except for replace >>>> and deletes. Maybe it was my use of keywords. >>>> >>>> I did some tries but I failed. I couldn't find any clear examples on >>>> doing what I wanted. I mostly saw add/replace options but without the {} >>>> ordering. I'm very new to this. >>>> >>>> I'll try again tomorrow. >>>> >>>> So from the IETF I understand I should be using something like this to >>>> insert a row at the beginning: >>>> >>>> dn: olcDatabase={2}mdb,cn=config >>>> changetype:modify >>>> add: olcAccess >>>> olcAccess: {0}full accessrule >>>> >>>> >>>> Thanks for your responses! Greatly appreciated! >>>> >>>> >>>> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> 0 >>>> viruses found. www.avast.com >>>> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> >>>> <#1102690717_582214293_-541461954_-448044489_DDB4FAA8-2DD7-40BB-A1B8-4E2AA1F9FDF2> >>>> >>>> 2016-03-10 18:39 GMT+01:00 Ryan Tandy <ryan(a)nardis.ca>: >>>> >>>>> On Thu, Mar 10, 2016 at 05:18:01PM +0100, PenguinWhispererThe . wrote: >>>>> >>>>>> I've been looking for examples for inserting in between but couldn't >>>>>> find >>>>>> any. Maybe I use the wrong keywords in our favorite search engine. >>>>>> >>>>>> Is this deleting and adding or replacing the way to go to make these >>>>>> changes? >>>>>> Are there alternatives? >>>>>> >>>>> >>>>> You can add a new entry with the index {n} specified. Existing entries >>>>> will be re-numbered (their index incremented) to make room. >>>>> >>>> >>>> >>> >> >

3 2

After power reset, LMDB sub-DBs' key-pairs are missing
by Arto Bendiken 14 Mar '16

14 Mar '16

Here's a curious case that I had not encountered with LMDB as yet previously: 1. There was a power reset of a virtual machine with an active LMDB writer process (standalone use, not OpenLDAP) on an LMDB file containing three sub-DBs. 2. After rebooting, the previously-populated LMDB file (~7 GB in size) appears mostly empty, including when examined with mdb_stat or mdb_dump. Mostly empty meaning that each of three sub-DBs now has only one K/V entry, instead of 7M+ as they used to. In addition, the main DB now indicates six entries instead of the expected three (for the sub-DBs). 3. mdb_copy (with or without -c) does not remedy the situation, producing a mostly (logically) empty database. This is with LMDB release 0.9.18 running on Ubuntu 14.04.4 (kernel 3.13.0-79-generic) on an ext4 partition (noatime,nodev,nosuid,noexec) on Intel SSD storage in SW RAID-1 configuration. As mentioned, the LMDB file had three sub-DBs, each with 7M+ entries (as of last backup). No new sub-DBs are created after the database is initially initialized. After initial creation, these three sub-DBs only ever get appended to with new key/value pairs, no code ever deletes or modifies key/value pairs in them. The writer code inserts new entries one at a time, commits the LMDB transaction, and syncs to disk. I've enclosed mdb_stat output from before/after (before being from a backup, after which numerous more writes had been done). I've also included mdb_dump output of the main DB and three sub-DBs. The mdb_dump output for the sub-DBs indicates that they each now contain only a single entry (instead of 7M+), that entry being in each case the first key/value pair that was ever inserted into that sub-DB (ages ago). The mdb_dump output for the main DB is baffling--instead of the three expected entries, or the six that mdb_stat indicates after the reboot, the output includes a multitude of entries--some 2,590. (I've omitted most of them in the attached, but can provide a copy privately.) What are my options for recovering an LMDB database in this state, to the extent possible? Has anyone else experienced a similar scenario? Thanks, Arto -- Arto Bendiken | @bendiken | http://ar.to

2 4

How to find master server in dual master replica setup
by Kartik Vashishta 14 Mar '16

14 Mar '16

Hi, I followed this: http://www.server-world.info/en/note?os=CentOS_7&p=openldap&f=6 to set up Master-Master replica's. Now the ldif files in the tmp directory are gone and I need to figure out which one was the Master in the replica setup. I only have access to the replicated master server. I need to know the hostname of the "main" master server. Thanks in advance. Regards, Kartik Vashishta

1 0

Why is MDB_USE_PWRITEV disabled by default?
by Bryan Matsuo 13 Mar '16

13 Mar '16

I have tried to find information on the internet about the flag MDB_USE_PWRITEV but haven't had much luck. I was a little surprised to find that the pwritev() system call is never used by default (in liblmdb or openldap itself AFAICT). Because a naive analysis would suggest that pwritev() is always better than the alternative. The Makefile for liblmdb suggests that the defaults for flags should be correct for most platforms. So I am just left wondering why the default on all systems is to avoid pwritev(). Can anyone provide some insight on this matter for me? I maintain some bindings for the Go language and it has been asked that this flag be applied to all Linux builds by default. I am trying to make the most appropriate decision for general use of the library. Thanks, - Bryan

1 0

Enable memberof in static mode configuration
by Elias Pereira 12 Mar '16

12 Mar '16

Hello guys, In all searches that I did, I found only how to make in the dynamic configuration (cn=config). How do I enable the attribute in the old way (slapd.conf)? -- Elias Pereira

2 1

olcAccess/olcLimits modifications
by PenguinWhispererThe . 11 Mar '16

11 Mar '16

Good day to all, I'm currently looking into openldap and want to do some changes on an existing openldap directory. I've been able to apply my changes using delete and add in an ldif. For example: 10 olcLimits rules. Mine needs to be placed before the last olcLimit. - Delete current last line (with {10} specificier) - Add wanted line - Add previously deleted line This results in the intended config. However this looks like a hassle to me. For example in the case I had to insert on the 5th line I would have to delete 5 lines first, then add the line I want and then again add those 5 lines. Or I should use replace for replacing the whole list (what's the correct terminology for a list with {0}, {1}, ... ?). I need to copy paste all that data over to just add 1 new line(in case of olcLimits and olcAccess). I've been looking for examples for inserting in between but couldn't find any. Maybe I use the wrong keywords in our favorite search engine. Is this deleting and adding or replacing the way to go to make these changes? Are there alternatives? Thanks in advance for your responses. <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> 0 viruses found. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#DDB4FAA8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

4 4

[ LMBD ] Performance degradation
by nicolas prochazka 11 Mar '16

11 Mar '16

Hello, we are using lmbd in our product as database backend to save big key value ( 16K ) . First at all, lmbd is the best database in performance comparaison ( read / write) that we have tested. My question : # Databases data_dir:/data/cache/data lmdb version:LMDB 0.9.16: (August 14, 2015) db page size:4096 b-tree depath:4 branch pages:527 leaf pages:29287 overflow oages:6659875 data items:1331990 We have a lot of leaf pages, this is due to our big value size. When the database is empty, write and read are very fast, but when we delete all keys or a big part of keys, write and read (new keys) becomes very poor in performance ( / 100 ) . Is it a normal due to our big values ? The only solution we have found is to destroy database file rather than deleting keys Regards, Nicolas Prochazka

2 2

Collaborative work of MirrorMode replication and LDAP Sync Replication
by Andrei Valoshyn 10 Mar '16

10 Mar '16

Hello! slapd.conf configuration used *1.* I have test LDAP master and a consumer with LDAP Sync Replication type: Master: / overlay syncprov// // syncprov-checkpoint 100 10// // syncprov-sessionlog 100 /Consumer: syncrepl rid=115 provider=ldaps://master \ type=refreshOnly \ interval=00:00:00:30 \ scope=sub \ schemachecking=off \ searchbase="dc=exadel,dc=com" \ bindmethod=simple \ binddn="dc=exadel,dc=com" \ credentials=password \ retry="60 10 300 10" Sync is work. *2.* After that I have switched to MirrorMode replication via reconfiguring Master and Consumer: Master1(Master): /serverID 1/ / overlay syncprov// // syncprov-checkpoint 100 10// // syncprov-sessionlog 100 / / syncrepl rid=001 provider=ldaps://Master2 \// // bindmethod=simple \// // interval=00:00:00:30 \// // scope=sub \// // binddn="dc=exadel,dc=com" \// // credentials=password \// // searchbase="dc=exadel,dc=com" \// // schemachecking=off \// // type=refreshOnly \// // retry="60 +"// // // mirrormode on// / Master2(Consumer): /serverID 2/ / overlay syncprov// // syncprov-checkpoint 100 10// // syncprov-sessionlog 100 / / syncrepl rid=002 provider=ldaps://Master1 \// // bindmethod=simple \// // interval=00:00:00:30 \// // scope=sub \// // binddn="dc=exadel,dc=com" \// // credentials=password \// // searchbase="dc=exadel,dc=com" \// // schemachecking=off \// // type=refreshOnly \// // retry="60 +"// // // mirrormode on// / In this case SYNC is work(between Master1 -> Master2(NOT in Master2) -> Master1 direction) and other consumer pointed to Master1 or Master2) *3.* For fun I change configuration on Master1(Master) to previous state(Case 1) Master1: / overlay syncprov// // syncprov-checkpoint 100 10// // syncprov-sessionlog 100 / /Master2(Consumer): /serverID 2/ / overlay syncprov// // syncprov-checkpoint 100 10// // syncprov-sessionlog 100 / / syncrepl rid=002 provider=ldaps://Master1 \// // bindmethod=simple \// // interval=00:00:00:30 \// // scope=sub \// // binddn="dc=exadel,dc=com" \// // credentials=password \// // searchbase="dc=exadel,dc=com" \// // schemachecking=off \// // type=refreshOnly \// // retry="60 +"// // // mirrormode on// //In this case we have the same situation with SYNC as in CASE 2 - all work fine. Is it good working SYNC schema? What chance of breaking down db on Master1 I have? -- With Best Wishes Andrei Valoshyn Exadel Inc. System Administrator avaloshyn(a)exadel.com -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

2 4

SASL2 and Openldap
by Jerry 10 Mar '16

10 Mar '16

I just started creating a new server with FreeBSD 11. I installed the openldap port. Now I am trying to figure out how to get sasl2 up and running. Openldap is running fine now without it, but I want to secure it further. Can anyone suggest a good "How to" on how to accomplish this on a FreeBSD OS (if that makes any difference). Examples are welcomed :) -- Jerry

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical