openldap-technical

openldap-technical@openldap.org

9 participants
9902 discussions

Controlling rootdn access
by Michael Hierweck 10 Nov '15

10 Nov '15

Hi all, I'm trying to improve security by restricting rootdn access to localhost. See: http://www.openldap.org/doc/admin24/access-control.html#Controlling%20rootd… But I can't delete the olcRootPW attribute from the olcDatabase object: ldap_modify: Inappropriate matching (18) additional info: modify/delete: olcRootPW: no equality matching rule I suppose the access restriction to the rootdn's userPassword attribute does not take effect as the provided password will be compared against the olcRootPW attribute (directly). Thanks in advance Michael

4 7

modify ldap conn=-1
by Daniel Jung 10 Nov '15

10 Nov '15

Hi, Typically conn represents external connection number? Sometimes i see conn=-1. Does this mean this is local or sycnrepl connection modification? thanks

2 1

Synchronization/replication and testing with ldapsearch
by Rebecka Gulliksson 09 Nov '15

09 Nov '15

Hi! I’m trying to setup an instance of slapd that supports RFC4533 (Content Synchronization Operation) for use with a consumer that is *not* another slapd instance. So right now I want to test my slapd instance with ‘ldapsearch' instead of in an master-slave setup. I’m on Mac OS X with the following in my slapd.conf: overlay syncprov syncprov-checkpoint 100 1 syncprov-sessionlog 100 Then I use ldapsearch ldapsearch -x -h localhost -Esync=ro but I get no syncCookie. Essentially I want to achieve what has been asked (but not answered) here: http://www.openldap.org/lists/openldap-software/200907/msg00045.html. Is there anything else I need to add to slapd.conf or is my ldapsearch command missing something? Any pointers to documentation of how to set it up? Regards, --- Rebecka Gulliksson ICT Services and System Development (ITS) Umeå University SE-901 87 Umeå, Sweden rebecka.gulliksson(a)umu.se www.its.umu.se

2 2

OTP broken?
by Emmanuel Dreyfus 09 Nov '15

09 Nov '15

Hello It seems OTP was broken at some time, I wonder if it is just me (and why), or if it is more genral. I have a user with: cmusaslsecretOTP: sha1 0499 se2124 xxxxxxxxxxxxxxxx 00000000 slapd.conf contains: access to dn.regex="^uid=.+,dc=example,dc=net$" attrs=cmusaslsecretOTP by anonymous auth stop by self write stop by * none stop I try: $ ldapwhomai -Y OTP -X dn:${user_dn} SASL/OTP authentication started (delay) ldap_sasl_interactive_bind_s: Server is unavailable (52) additional info: SASL(-8): transient failure (e.g., weak key): simultaneous OTP authentications not permitted This is: OpenLDAP 2.4.42 Cyrusl SASL 2.1.26 While there, this uses sha1. Is there some new specs about doing it with sha256? Patching cyrus-sasl to add a new hashing algorithme is just a one liner. -- Emmanuel Dreyfus manu(a)netbsd.org

7 15

OpenLDAP & SSSD Question
by Borresen, John - 0444 - MITLL 08 Nov '15

08 Nov '15

Hopefully someone out there can shed some light on this. Running OpenLDAP 2.4.40 on our CentOS 5 servers, with an assortment of CentOS 5, 6, 7; Fedora20+, Ubuntu 12.04 to 14.04. The CentOS 5's are running as straight LDAP clients. The others are using SSSD / LDAP. On the CentOS 5, when running "getent hosts", it will return the entire LDAP Hosts dbase; which is the behavior we want. On all the systems running SSSD, they only return the local hosts file. If explicitly adding a host to the command "getent hosts some_host", it will only return if the host is in the local hosts file or DNS; never searching (watching the logs) either the LDAP or SSSD. Debug is at maximum. Again any help is appreciated. Thanks, JD Borresen

3 4

val/integerMatch="0"
by Michael Ströder 08 Nov '15

08 Nov '15

HI! Maybe I'm doing something obviously wrong but I don't see it. I want to limit the right to reset a counter value solely to zero with this ACL directive: add_content_acl yes [..] access to dn.subtree="ou=ae-dir" filter="(aeStatus=0)" attrs=oathHOTPCounter val/integerMatch="0" by group/aeGroup/member="cn=2fa admins,cn=2fa,ou=ae-dir" write by * break [..] The modify request looks like this (old value is 10): dn: serialNumber=yubikey-23,cn=2fa,ou=ae-dir changetype: modify replace: oathHOTPCounter oathHOTPCounter: 0 - It seems the ACL does not trigger, without the val= part the modification is allowed (but to any value). I also tried other forms: val="0" val=0 val.regex="^0$" Can somebody help me? Thanks in advance. Ciao, Michael.

2 3

ldiftopasswd: Can it be done with SSHA hashes?
by Chuck Peters 06 Nov '15

06 Nov '15

Can I convert the ldif's userPassword:: "salted hash, aka SSHA" to "hash type$salt$hash" format of shadow passwords? Or do I need to force those users with SSHA hashed passwords to change their password? Most of the users passwords are in crypt format. I found a perl one liner to base64 decode those passwords hashes. (1) I'm attempting to create shadow passwd files with an old Debian 6.0.10 (squeeze) LDAP installation and Debian's slapd package (2.4.23-7.3+deb6u2 squeeze-lts patched oldoldstable) includes a perl script ldiftopasswd, which I thought came from upstream, but it's not included in the most recent source of openldap. If my reading of the perl is correct, it was meant for earlier iterations of shadow passwords that did not include hash format or salt. I'm not having any success using the script this far. 1. http://www.perlmonks.org/bare/?node_id=963814 alias ldapdecode="perl -MMIME::Base64 -n -00 -e 's/\n //g;s/(?<=:: )(\S+)/decode_base64(\$1)/eg;print'" and just do ldapsearch | ldapdecode Thanks, Chuck

4 4

accesslog purge starves kerberos kdc authentications
by Paul B. Henson 05 Nov '15

05 Nov '15

We're running MIT kerberos with the ldap backend, specifically 3 openldap servers doing delta syncrepl. We started having a problem a while back where once a day the kdc would time out authentication requests, and finally tracked it down to openldap purging the accesslog. We currently have the accesslog overlay configured to delete entries over 7 days old once a day, and it seems that while openldap is processing the purge the kdc is starved out and unable to process authentications in a timely fashion. We do (thanks to our ISO) have account lockout enabled, so every authentication involves not only a read but a write. Is it expected for the accesslog purge to be so disruptive? Is there any way to tune it so it doesn't overwhelm the system to the point of being unresponsive? Would it be better to purge the accesslog more frequently as to amortize the work across multiple intervals rather than being concentrated once a day? Thanks for any suggestions...

5 10

*** Error in `/usr/sbin/slapd': double free or corruption (top): 0x00007f2f9503a610 ***
by Andrei Valoshyn 04 Nov '15

04 Nov '15

Hello! I have ubuntu 14.04 and openldap-2.4.31 server which I had installed via apt-get. I tried configure it via slapd.conf configuration file. After all configurations steps and success config test I faced with: / root@v122:~# /etc/init.d/slapd start// // * Starting OpenLDAP slapd // // *** Error in `/usr/sbin/slapd': double free or corruption (top): 0x00007f2f9503a610 ***// //Aborted (core dumped)/ I can't find any reported bug about this issue. Please help! -- With Best Wishes Andrei Valoshyn Exadel Inc. System Administrator avaloshyn(a)exadel.com -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

3 2

library
by Friedrich Locke 04 Nov '15

04 Nov '15

Hi folks, i would like to write a library that implements ldap client connection to the server, as usual, the default routines: connect bind search unbind etc ... I wonder if there is a documentation showing how data is encoded with asn.1 ber encoding. Thanks a lot.

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical