openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

ldiftopasswd: Can it be done with SSHA hashes?
by Chuck Peters 06 Nov '15

06 Nov '15

Can I convert the ldif's userPassword:: "salted hash, aka SSHA" to "hash type$salt$hash" format of shadow passwords? Or do I need to force those users with SSHA hashed passwords to change their password? Most of the users passwords are in crypt format. I found a perl one liner to base64 decode those passwords hashes. (1) I'm attempting to create shadow passwd files with an old Debian 6.0.10 (squeeze) LDAP installation and Debian's slapd package (2.4.23-7.3+deb6u2 squeeze-lts patched oldoldstable) includes a perl script ldiftopasswd, which I thought came from upstream, but it's not included in the most recent source of openldap. If my reading of the perl is correct, it was meant for earlier iterations of shadow passwords that did not include hash format or salt. I'm not having any success using the script this far. 1. http://www.perlmonks.org/bare/?node_id=963814 alias ldapdecode="perl -MMIME::Base64 -n -00 -e 's/\n //g;s/(?<=:: )(\S+)/decode_base64(\$1)/eg;print'" and just do ldapsearch | ldapdecode Thanks, Chuck

4 4

accesslog purge starves kerberos kdc authentications
by Paul B. Henson 05 Nov '15

05 Nov '15

We're running MIT kerberos with the ldap backend, specifically 3 openldap servers doing delta syncrepl. We started having a problem a while back where once a day the kdc would time out authentication requests, and finally tracked it down to openldap purging the accesslog. We currently have the accesslog overlay configured to delete entries over 7 days old once a day, and it seems that while openldap is processing the purge the kdc is starved out and unable to process authentications in a timely fashion. We do (thanks to our ISO) have account lockout enabled, so every authentication involves not only a read but a write. Is it expected for the accesslog purge to be so disruptive? Is there any way to tune it so it doesn't overwhelm the system to the point of being unresponsive? Would it be better to purge the accesslog more frequently as to amortize the work across multiple intervals rather than being concentrated once a day? Thanks for any suggestions...

5 10

*** Error in `/usr/sbin/slapd': double free or corruption (top): 0x00007f2f9503a610 ***
by Andrei Valoshyn 04 Nov '15

04 Nov '15

Hello! I have ubuntu 14.04 and openldap-2.4.31 server which I had installed via apt-get. I tried configure it via slapd.conf configuration file. After all configurations steps and success config test I faced with: / root@v122:~# /etc/init.d/slapd start// // * Starting OpenLDAP slapd // // *** Error in `/usr/sbin/slapd': double free or corruption (top): 0x00007f2f9503a610 ***// //Aborted (core dumped)/ I can't find any reported bug about this issue. Please help! -- With Best Wishes Andrei Valoshyn Exadel Inc. System Administrator avaloshyn(a)exadel.com -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

3 2

library
by Friedrich Locke 04 Nov '15

04 Nov '15

Hi folks, i would like to write a library that implements ldap client connection to the server, as usual, the default routines: connect bind search unbind etc ... I wonder if there is a documentation showing how data is encoded with asn.1 ber encoding. Thanks a lot.

3 2

Question from a LMDB user
by Tao Chen 04 Nov '15

04 Nov '15

Hi Sir/Madam, Recently I'm trying to use LMDB to store and randomly acess large amount of features. Each feature blob is 16kB. Before trying LMDB, I just stack all the features together into one huge binay file, and use seek function in C++ to access each feature. Since the feature size is fixed, I can easily compute the address of each feature in the file. Then I tried LMDB. The value is the feature as it is. The key is "1", "2", "3", .... Since 16kB is exactly 4 x page_size, adding the key and header, each feature will occupy 5 x page_size, so the db file on disk is about 1.25 times of the previous binary file, this is already a disadvantage for LMDB, but I still hope there can be some efficiency trade-off. I use LDMB++ C++ wrapper to access features. Next, I compared two approach by accessing the same random 1% features from about 300k features. Before the test, I use vmtouch to evict both files from memory cache. The result is surprising. The one use LMDB is 1.5 times slower than the raw binary file (30s vs 20s). Is this because the size of feature (exactly 4 pages)? Do I understand the use of LMDB incorrectly? Thank your for your time! Best Regards, Tao Chen

2 1

Developing modules
by dev 04 Nov '15

04 Nov '15

Hi, I'd like to take a stab at porting the radius contrib module to FreeRadius. Can someone point me in the direction of documentation for the openldap module format? I see there is init_module() and term_module() defined in the source for the modules I've looked at but the rest is guesswork. I've poked around Google a bit but only so far ran across a post in 2011 asking the same question. Thanks

2 1

ldapsearch over SSL can not bind
by Matthias Apitz 02 Nov '15

02 Nov '15

Hello, I'm trying to make from FreeBSD a LDAPsearch in some Novell eDirectory with the following command: $ ldapsearch -Z -H ldaps://romega:1027 -b 'ou=person,o=uni' -D 'cn=XXXXXXXXXX,ou=service,o=uni' -w XXXXXXXXXX ldap_start_tls: Can't contact LDAP server (-1) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self signed certificate in certificate chain) ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) The credentials are fine and are working without any problem, for example from Windos clients (JXplore) or from a Java written client running on my laptop. Openssl can connect fine too. Any ideas what could be wrong? Btw: Someone here who managed to work JXplore in FreeBSD? There is an installer for it which can not find libstdc++.so.4 on my system (I have libstdc++.so.6). Vy 73 matthias -- Matthias Apitz, ✉ guru(a)unixarea.de, 🌐 http://www.unixarea.de/ ☎ +49-176-38902045

4 3

retrieving information about deleted objects
by Matthias Apitz 02 Nov '15

02 Nov '15

Hello, We produce for production environments an IDMsystem which is able to publish/dublicate changes in OpenLDAP/LDAP directories to other management databases and vice versa. This works fine in most of the cases of changes in LDAP. The only problem we see, is get information about deletion of objects (users) which were done while the IDMsystem was either down or network not available. What is the correct way to search for deleted objects. We have read about a filter search, based on 'isDeleted=*' or 'isDeleted=TRUE. But we can not get any result with this. Thanks for some hints about this. matthias -- Matthias Apitz, ✉ guru(a)unixarea.de, 🌐 http://www.unixarea.de/ ☎ +49-176-38902045

4 3

Consumer not Sync'ing
by Kartik Vashishta 02 Nov '15

02 Nov '15

Team, Consumer is connecting to master but not sync'ing. I am a newbie so any ideas will be appreciated. "test3" is the consumer "elasticsearch1" is the master [root@test3 tmp]# netstat -anlp | grep 389 tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 6745/slapd tcp 0 0 192.168.1.51:53121 192.168.1.196:389 TIME_WAIT - tcp 0 0 192.168.1.51:53120 192.168.1.196:389 TIME_WAIT - tcp 0 0 192.168.1.51:53113 192.168.1.196:389 TIME_WAIT - tcp 0 0 192.168.1.51:53118 192.168.1.196:389 TIME_WAIT - tcp 0 0 192.168.1.51:53119 192.168.1.196:389 TIME_WAIT - tcp 0 0 192.168.1.51:53122 192.168.1.196:389 TIME_WAIT - tcp 0 0 192.168.1.51:53124 192.168.1.196:389 TIME_WAIT - tcp 0 0 192.168.1.51:53123 192.168.1.196:389 TIME_WAIT - tcp6 0 0 :::389 :::* LISTEN 6745/slapd [root@test3 tmp]# I am following this document: http://www.server-world.info/en/note?os=CentOS_7&p=openldap&f=5 Regards, Kartik Vashishta

2 1

"memberof" function for memberUid attribute.
by Andi Zulfadli 01 Nov '15

01 Nov '15

Dear Master. Please help, What is the format for filter the member of group? we know that "memberof" format works in member attribute in openldap group entry format. example attribute : dn: cn=Admins,ou=Users,o=<org-id>,dc=jumpcloud,dc=com *member: uid=john,ou=Users,o=<org-id>,dc=jumpcloud,dc=commember: uid=mary,ou=Users,o=<org-id>,dc=jumpcloud,dc=com*objectClass: top objectClass: groupOfNames description: tagGroup cn: Admins ou: Admins example filter : example: (&(objectClass=person)(memberOf=CN=name-of-the-group,OU=xample,DC=com)) But how about if my openldap group member attribute using memberUid as attibute member's group. dn: cn=Admins,ou=Users,o=<org-id>,dc=jumpcloud,dc=com *memberUid: johnmemberUid: mary*objectClass: top objectClass: groupOfNames description: tagGroup cn: Admins ou: Admins How can i use "memberof" filter format in my openLDAP? Thank you very much. iam sorry for my ambiguity.

2 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical