openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Odd LDAP Behavior
by Borresen, John - 0444 - MITLL 22 Feb '16

22 Feb '16

Getting, for me, some strange LDAP errors/indicators. This is a OpenLDAP 2.4.40 on CentOS7. The sudoers rules are being "seen" but not implemented: # sudo -l -U jdoe Matching Defaults entries for jdoe on this host: requiretty, !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin User jdoe may run the following commands on this host: (root) /usr/sbin/tcpdump (root) ALL (ALL) ALL When user jdoe tries to run a sudo command: # sudo su - sudo: ldap_set_option: debug -> 0 sudo: ldap_set_option: tls_checkpeer -> 0 sudo: ldap_set_option: tls_cacertfile -> /etc/openldap/CA/cacert.pem sudo: ldap_set_option: tls_cacert -> /etc/openldap/CA/cacert.pem sudo: ldap_set_option: ldap_version -> 3 sudo: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT, 30) sudo: ldap_start_tls_s() ok sudo: ldap_sasl_bind_s() ok sudo: Looking for cn=defaults: cn=defaults sudo: no default options found in ou=sudoers,dc=example,dc=com sudo: ldap search '(|(sudoUser=jdoe)(sudoUser=#12345)(sudoUser=%Example)(sudoUser=%#12345)(sud oUser=%Admin)(sudoUser=%Group1)(sudoUser=%GROUP2)(sudoUser=%GROUP3)(sudo User=%GROUP4(sudoUser=ALL))' sudo: searching from base 'ou=sudoers,dc=example,dc=com' sudo: adding search result sudo: result now has 1 entries sudo: ldap search '(sudoUser=+*)' sudo: searching from base 'ou=sudoers,dc=example,dc=com' sudo: adding search result sudo: result now has 1 entries sudo: sorting remaining 1 entries sudo: searching LDAP for sudoers entries sudo: Command allowed sudo: LDAP entry: 0x7fdfb8bc2260 sudo: done with LDAP searches sudo: user_matches=1 sudo: host_matches=1 sudo: sudo_ldap_lookup(0)=0x02 Sorry, try again. Sorry, try again. Sorry, try again. sudo: 3 incorrect password attempts Also seeing in the log files, that bdb_substring_candidates: (sudoHost) not indexed But, it is indexed: oldDbIndex sudoHost eq Thanks in advance for assistance. This is a new environment, that is mimicking another LDAP environment running 2.4.39 on CentOS 5.12 which is running flawlessly. John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Email: <mailto:john.borresen@ll.mit.edu> john.borresen(a)ll.mit.edu

2 1

Invalid credentials
by Dave Beach 21 Feb '16

21 Feb '16

I'm trying to debug a new openldap install on Debian Jessie. Password has been set with slappasswd, no command line options. I get a {SSHA} hash returned - what am I putting in slapd.conf for the admin password: the hashed (as rootpw {SSHA} password) or unhashed (as rootpw password) password? Either returns ldap_bind: Invalid credentials (49) when I restart slapd and perform an ldapsearch. Rootdn has been correctly set in slapd.conf. What can I provide in terms of output or log info to help some kind soul help me?

5 16

Known uses of LMDB outside OpenLDAP
by Ethan Hamilton 21 Feb '16

21 Feb '16

Hi My name is Ethan Hamilton. I work as software engineer for TIBCO Software, http://www.tibco.com/ . As part of my current activities, I am evaluating embedded databases for use in a system of record scenario. LMDB is one of the several good databases that has picked our attention. There is lots of information available in the internet but we find lacking, especially when compared with the information available for other databases like RocksDB, is information about production uses outside OpenLDAP. Facebook makes a lot of information available about how they use RocksDB. They also have a lot of other companies presenting in their meetups on how they currently use (or plan to use) RocksDB. I am seeking information about uses of LMDB in system of record kind of situations, especially in large, replicated clusters where LMDB is used as the persistence layer to store mission critical data. Thank you in advance, Ethan

2 1

ssf settings for SASL and TLS
by Joshua Schaeffer 21 Feb '16

21 Feb '16

What is the proper way to setup SASL and TLS with different security strength factors? I've setup SASL on my OpenLDAP server so that it can connect to my Kerberos server using GSSAPI. I also have TLS setup for simple auth. My database config is below: root@baneling:~/ldif_files# slapcat -H "ldap:///olcDatabase={1}mdb,cn=config??base?" dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=harmonywave,dc=com olcAccess: {0}to attrs=userPassword,shadowLastChange,krbPrincipalKey by self write by anonymous auth by dn="cn=admin,dc=harmonywave,dc=com" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=harmonywave,dc=com olcRootPW:: e1NTSEF9dUhDcE1jUUJoWlpuc0twRHBNQkVCUGtmTFA5SC9EYUU= olcDbCheckpoint: 512 30 olcDbIndex: objectClass eq olcDbIndex: cn,uid eq olcDbIndex: uidNumber,gidNumber eq olcDbIndex: member,memberUid eq olcDbIndex: sudoUser eq olcDbIndex: krbPrincipalName eq,pres,sub olcDbMaxSize: 1073741824 structuralObjectClass: olcMdbConfig entryUUID: caa04334-6857-1035-9fbb-dd6671002504 creatorsName: cn=admin,cn=config createTimestamp: 20160215174631Z olcSecurity: sasl=56 simple_bind=256 ssf=256 entryCSN: 20160218030327.503814Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20160218030327Z When I set the security to "olcSecurity: sasl=56 simple_bind=256" then I can bind with SASL or simple auth. However if I set ssf=256 (or really anything higher then 56), like in the above configuration, I get an error when trying to bind with SASL: root@baneling:~/ldif_files# ldapsearch -LLL -Y GSSAPI -H ldapi:/// -b dc=harmonywave,dc=com -s base SASL/GSSAPI authentication started SASL username: jschaeffer(a)HARMONYWAVE.COM SASL SSF: 56 SASL data security layer installed. Confidentiality required (13) Additional information: stronger confidentiality required If I set tls instead of ssf to any number (tls=1 or greater) then I get a slightly different error message when trying to bind with SASL: root@baneling:~/ldif_files# ldapsearch -LLL -Y GSSAPI -H ldapi:/// -b dc=harmonywave,dc=com -s base SASL/GSSAPI authentication started SASL username: jschaeffer(a)HARMONYWAVE.COM SASL SSF: 56 SASL data security layer installed. Confidentiality required (13) Additional information: TLS confidentiality required It looks like slapd has its own preference when parsing through olcSecurity. I'm really just trying to understand the preferred method for setting this up. Perhaps this isn't a real-world situation or perhaps I already answered my own question by setting just sasl and simple_bind. Thanks, Joshua

4 9

can find slapd.conf fine in /etc/openldap under Centos7
by MichaelLeung 20 Feb '16

20 Feb '16

hi all i am not so sure it is the correct place to issue my problem but i really need some help sine i upgrade to Centos7 and install openldap-2.4.4 on it, i would not find slapd.conf in /etc/openldap, the only related file i can find is slapd.ldif . though i still can start slapd services does openldap need slapd.conf any more ?

2 1

chain-uri with a blank?
by Marc Patermann 18 Feb '16

18 Feb '16

Hi, should chain-uri work with an URI with a blank the DIT path? like in: chain-uri "ldap://servername/ou=far bar,c=de" I'm getting a parsing error here with 2.4.43. Feb 17 18:35:01 slapd[1765]: /etc/openldap/slapd.conf: line 156 (chain-uri "ldap://servername/ou=foo bar,c=de") Feb 17 18:35:01 slapd[1765]: /etc/openldap/slapd.conf: line 156: unable to parse uri "(null)" in "uri <uri>" line: URL doesn't begin with "[c]ldap[si]://". Is this a bug? Marc

5 6

slapo-accesslog: wrong timestamp microseconds
by Dario Zanzico 18 Feb '16

18 Feb '16

In adding an accesslog overlay I noticed something strange with the reqstart and reqend fields: the fractional part always begins with 000 and has this strange distribution. > $ ldapsearch ..... | awk -F . '/^reqStart: / {print $2}'| sort | uniq > -c 2 000000Z 351 000001Z 73 000002Z 70 000003Z 308 000004Z 81 000005Z > 97 000006Z 312 000007Z 97 000008Z 97 000009Z 297 000010Z 105 000011Z > 92 000012Z 294 000013Z 108 000014Z 95 000015Z 271 000016Z 128 000017Z > 97 000018Z 252 000019Z 126 000020Z 113 000021Z 240 000022Z 132 000023Z > 110 000024Z 230 000025Z 155 000026Z 118 000027Z 209 000028Z 150 > 000029Z 111 000030Z 193 000031Z 161 000032Z 103 000033Z 187 000034Z > 152 000035Z 117 000036Z 174 000037Z 145 000038Z 117 000039Z 140 > 000040Z 126 000041Z 94 000042Z 89 000043Z 98 000044Z 72 000045Z 51 > 000046Z 49 000047Z 27 000048Z 27 000049Z 26 000050Z 12 000051Z 13 > 000052Z 12 000053Z 9 000054Z 7 000055Z 6 000056Z 8 000057Z 10 > 000058Z 5 000059Z 3 000060Z 3 000061Z 5 000062Z 3 000063Z 7 > 000064Z 3 000065Z 7 000066Z 8 000067Z 1 000068Z 6 000069Z 5 > 000070Z 5 000071Z 4 000072Z 8 000073Z 2 000074Z 3 000075Z 11 > 000076Z 1 000077Z 4 000078Z 7 000079Z 6 000080Z 5 000081Z 6 > 000082Z 5 000083Z 2 000084Z 8 000085Z 3 000086Z 1 000087Z 9 > 000088Z 3 000089Z 3 000090Z 6 000091Z 3 000092Z 6 000093Z 5 > 000094Z 4 000095Z 4 000096Z 3 000097Z 4 000098Z 3 000099Z 4 > 000100Z 3 000101Z 6 000102Z 8 000103Z 1 000104Z 3 000105Z 4 > 000106Z 5 000107Z 2 000108Z 4 000109Z 4 000111Z 10 000112Z 5 > 000113Z 2 000114Z 3 000115Z 2 000116Z 4 000117Z 3 000118Z 4 > 000119Z 1 000120Z 4 000121Z 2 000122Z 4 000123Z 8 000124Z 3 > 000125Z 4 000126Z 4 000127Z 2 000128Z 3 000129Z 4 000130Z 5 > 000131Z 2 000132Z 5 000133Z 1 000134Z 5 000135Z 3 000136Z 2 > 000137Z 1 000138Z 2 000139Z 3 000140Z 2 000141Z 4 000142Z 1 > 000143Z 4 000144Z 4 000145Z 3 000146Z 4 000147Z 1 000148Z 1 > 000149Z 1 000150Z 2 000151Z 2 000152Z 2 000153Z 2 000154Z 3 > 000155Z 3 000156Z 2 000157Z 2 000158Z 1 000160Z 1 000161Z 1 > 000165Z 1 000166Z 1 000169Z 1 000171Z 1 000177Z This is on the last 10 minutes of entries, which I expected to be 'kind of' randomly distributed; Instead no entry has a reqstart with a fractional part bigger than .000177, and the vast majority of them has it < .000050 Anybody knows what can be the cause of this, and how to correct it? Thanks, dario

2 3

ACL and set problem
by Cole 18 Feb '16

18 Feb '16

Hi, I have setup openldap and managed to get everything working, except for limiting access using an ACL with a set. Here is the output of the database and config: https://gist.github.com/onslauth/d6502df4d395dbdf9b19 What I want to achieve, is to limit ssh access to a computer, by adding users or groups to the cn=10.0.0.92,ou=servers group. When I try to bind to openldap with a user in the afore mentioned group, I get "Invalid credentials" error. I have included at the bottom of the gist the ACL log level output. As you can see, the set seems to be expanded correctly, but it doesn't seem to match the 'user' used for the bind. Can anyone see anything wrong with my setup? Thanks /Cole

1 0

LDAPMODIFY Error
by Borresen, John - 0444 - MITLL 17 Feb '16

17 Feb '16

All, New ldap server, running OpenLDAP (v 2.4.40), running CentOS 7. Trying to add/modify the Netgroup. # ldapmodify -d 4 -x -W -H ldap://ldapserver.ldap.net Enter Password Dn: cn=admin,ou=Netgroup,dc=ldap,dc=net Changetype: modify Add: nisNetgroupTriple nisNetgroupTriple: (lenldap,,) . Ldap_modify: Inappropriate matching(18) Additional info: modify/add: nisNetgroupTriple: no equality matching rule I've been googling, one suggestion was to restart slapd, which was done to no avail. Any help would be appreciated. John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Email: <mailto:john.borresen@ll.mit.edu> john.borresen(a)ll.mit.edu

2 3

Re: SSL/TLS passphrase not being prompted for at startup
by Raja T Nair 17 Feb '16

17 Feb '16

Hello Quanah, Thanks for the help. LTB build works superbly. It would be great if you can give me some hint about doing such background check as the broken mozNSS lib issue you mentioned.. Warm Regards, Raja. On 16 February 2016 at 21:56, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, February 16, 2016 8:28 PM +0530 Raja T Nair < > rtnair(a)gmail.com> wrote: > > >> >> >> >> >> Hi Quanah, >> >> Thanks for the response. I will try LTB builds. >> >> But just curious, I am using centos. are centos builds also known to be >> buggy? >> > > Yes. They are essentially the same thing as the RHEL builds. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc > -- :^)

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical