openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Re: Q: different SSF settings for ldapi:// than for ldap:
by Michael Ströder 30 Mar '15

30 Mar '15

Ulrich Windl wrote: >>>> Michael Ströder<michael(a)stroeder.com> schrieb am 29.03.2015 um 12:12 in >> I have this in my config: >> >> # SSF value for ldapi:// >> localSSF 256 > > What I don't understand here is: Doesn't "256" _require_ encryption for > ldapi:// then? There is a reason for everything I write, especially this sentence: >> See slapd.conf(5) for details. Learn to read the fine docs. Ciao, Michael.

1 0

Re: Antw: Re: external authentication source
by Dirk Kastens 30 Mar '15

30 Mar '15

Hi Ulrich, > Thanks for the hint, but I fail to use it: > > First it seems I cannot use it in olcSecurity (as I can use update_ssf), and then I fail to set it at the database level: It's a global option. Just set it as an attribute of cn=config. dn: cn=config olcLocalSSF: 256 Then use ldapsearch without TLS. This should work. Regards, Dirk

1 0

LMDB use of sparse or non-sparse data file
by Geoff Swan 30 Mar '15

30 Mar '15

I had to duplicate an LMDB database for replication recently, and used mdb_copy to do so. One server is using the original data.mdb database (which is sparse) and the other is using the mdb_copy non-sparse data.mdb file. The two servers are identical (hardware, OS, software and configuration). OpenLDAP-2.4.39 is being used, 64 bit Linux OS. mdb_stat shows the map size as the same, which is expected. Will the use of the non-sparse file cause any performance issues? The reason for asking is that I am seeing a difference in search times between the two. With 20 million objects, a search on modifyTimestamp (which is indexed) gives: server 1: approx 1s server 2: approx 60s server 2 started with the same search time as server 1 when the databases were originally copied, but has slowly increased its search time over about a week for this same search.

3 7

Re: LMDB use of sparse or non-sparse data file
by Quanah Gibson-Mount 29 Mar '15

29 Mar '15

--On Wednesday, March 25, 2015 5:11 PM +1100 Geoff Swan <gswan3(a)bigpond.net.au> wrote: >> Question is irrelevant since both are sparse files. > Thanks for the clarification Howard. > The data file from the mdb_copy snapshot was transferred over the > network to the other server using scp, which I understand does not > recognise sparse files, so the copy is likely to be non-sparse. I guess > this would be considered a corruption and best to start with a fresh copy? I've had no issue scp'ing files created from mdb_copy. Original host: zimbra@zre-ldap002:~/data/ldap/mdb/db$ ls -l total 432 -rw------- 1 zimbra zimbra 85899345920 Mar 25 14:53 data.mdb -rw------- 1 zimbra zimbra 8192 Mar 25 14:54 lock.mdb zimbra@zre-ldap002:~/data/ldap/mdb/db$ mkdir /tmp/mdb/ zimbra@zre-ldap002:~/data/ldap/mdb/db$ mdb_copy . /tmp/mdb zimbra@zre-ldap002:~/data/ldap/mdb/db$ ls -l /tmp/mdb/ total 428 -rw-r--r-- 1 zimbra zimbra 438272 Mar 25 14:54 data.mdb Destination host: [build@zre-ldap003 zcs-NETWORK-8.7.0_BETA1_1149.RHEL6_64.20150324181030]$ scp build@zre-ldap002:/tmp/mdb/data.mdb /tmp/mdb.002/ data.mdb 100% 428KB 428.0KB/s 00:00 [build@zre-ldap003 zcs-NETWORK-8.7.0_BETA1_1149.RHEL6_64.20150324181030]$ su Password: [root@zre-ldap003 zcs-NETWORK-8.7.0_BETA1_1149.RHEL6_64.20150324181030]# chmod a+rx /tmp/mdb.002 [root@zre-ldap003 zcs-NETWORK-8.7.0_BETA1_1149.RHEL6_64.20150324181030]# chmod a+r /tmp/mdb.002/data.mdb [root@zre-ldap003 zcs-NETWORK-8.7.0_BETA1_1149.RHEL6_64.20150324181030]# su - zimbra [zimbra@zre-ldap003 ~]$ cd data/ldap/mdb [zimbra@zre-ldap003 mdb]$ ls db.orig [zimbra@zre-ldap003 mdb]$ mkdir db [zimbra@zre-ldap003 mdb]$ ls db db.orig [zimbra@zre-ldap003 mdb]$ cd db [zimbra@zre-ldap003 db]$ cp /tmp/mdb.002/data.mdb . [zimbra@zre-ldap003 db]$ ls -l total 428 -rw-r-----. 1 zimbra zimbra 438272 Mar 25 14:57 data.mdb [zimbra@zre-ldap003 db]$ ldap start Started slapd: pid 32518 [zimbra@zre-ldap003 db]$ ls -l total 432 -rw-r-----. 1 zimbra zimbra 85899345920 Mar 25 14:57 data.mdb -rw-------. 1 zimbra zimbra 8192 Mar 25 14:57 lock.mdb --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

Questionable log entries
by Timo Eissler 29 Mar '15

29 Mar '15

Hello, i have found some weird messages in my syslog since i setup openldap and switched my users from local passwd/shadow to openldap. I have two notebooks using sssd and the openldap server is configured with pam_ldap/nss_ldap authentication. I didn't have any problems, but i'm unsure why those message are logged and so i decided to ask this on the list. Those are the messages in question: Mar 22 20:10:01 foobarsrv1 slapd[16923]: connection_input: conn=12652 deferring operation: binding Mar 22 15:36:33 foobarsrv1 slapd[16923]: connection_read(29): no connection! Mar 22 15:37:36 foobarsrv1 slapd[16923]: conn=10375 op=6 ABANDON msg=6 Mar 15 09:00:59 foobarsrv1 slapd[28731]: connection_input: conn=16081 deferring operation: too many executing Mar 12 18:33:54 foobarsrv1 slapd[699]: slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1 I have tried to find a solution or reason for this since two weeks or so, but i couldn't find the answer/solution. Regarding the "deferring operation: binding" message i'm just concerned, because their is absolutely no load on the system and i'm not sure what would happen if i had more than 3 clients (including the server) which use ldap. I already tried to match those messages with other things going on on the system, but i could get any match. Currently i get the "deferring operation: binding" anything between 2 and 10 times a day. I know that this may be more than one issue, but i hope that you are willing to help me solve this. This is my slapd.conf: Konsole output include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/samba.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args security tls=1 simple_bind=128 access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=userPassword by self write by anonymous auth by * none access to * by self write by * read access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none TLSCipherSuite HIGH:MEDIUM:-SSLv2:-SSLv3 TLSCertificateFile /etc/openldap/ssl/slapdcert.pem TLSCertificateKeyFile /etc/openldap/ssl/slapdkey.pem database hdb suffix "dc=foobar,dc=local" checkpoint 32 30 rootdn "cn=Manager,dc=foobar,dc=local" rootpw {SSHA}XXXX directory /var/lib/openldap-data index objectClass eq index uid pres,eq index memberUid pres,eq index uidNumber pres,eq index gidNumber pres,eq index uniqueMember pres,eq index sambaSID pres,eq index mail pres,sub,eq index cn pres,sub,eq index sn pres,sub,eq index dc eq database config My /etc/ldap.conf Konsole output host 127.0.0.1 base dc=foobar,dc=local uri ldap://localhost/ ldap_version 3 scope one bind_policy soft idle_timelimit 3600 pam_filter objectclass=posixAccount pam_member_attribute memberuid pam_min_uid 1000 pam_password exop nss_base_passwd ou=People,dc=foobar,dc=local?one nss_base_shadow ou=People,dc=foobar,dc=local?one nss_base_group ou=Groups,dc=foobar,dc=local?one nss_base_hosts ou=Hosts,dc=foobar,dc=local?one ssl start_tls nss_initgroups_ignoreusers root,bin,daemon,adm,lp,sync,shutdown,halt,news,uucp,operator,portage,nobody,man,sshd,cron,mail,postmaster,ldap,m ysql,mediatomb,dovecot,dovenull,apache,openvpn,clamav,bacula,asterisk,ntp The openldap server is an up to date Gentoo system. If you need more informations just let me know. Kind regards, Timo -- Timo Eissler Senior Project Engineer / Consultant Am Zuckerberg 54 D-71640 Ludwigsburg Tel.: +49 7141 4094003 Mobil.: +49 151 20650311 Email: timo(a)teissler.de

3 10

Q: different SSF settings for ldapi:// than for ldap:
by Ulrich Windl 29 Mar '15

29 Mar '15

Hi! I've configured slapd to require excryption (confidentiality). Now connections via ldapi:// fail with "13 Confidentiality required". When adding "-ZZ" for ldapsearch (e.g.), the connection fails, because the certificate does not match ldapi:// (I asked about that before, but got no answer). How can I configure slapd not to require confidentiality? Regards, Ulrich

2 1

still can't run ldapadd command after install openldap
by Wang, Hui 28 Mar '15

28 Mar '15

Hi, All Sorry to bother everyone on this list. I am new to OPENLDAP server and also this is first time I work as a linux admin to install something by myself. My openldap 2.4.40 is up and running, and I also I found the ldapadd commend under /opt/bin, is there anything else I missed which caused the ldapadd doesn't run? Thank you all Hui Wang from CSUN [root@oldaptest01 bin]# ps auxww | grep slapd root 3094 0.0 6.7 1411584 129248 ? Ssl Mar25 0:00 /opt/libexec/slapd root 32481 0.0 0.0 103252 840 pts/0 S+ 13:40 0:00 grep slapd [root@oldaptest01 bin]# pwd /opt/bin [root@oldaptest01 bin]# ls -l total 2268 lrwxrwxrwx 1 root root 10 Mar 25 10:34 ldapadd -> ldapmodify -rwxr-xr-x 1 root root 264824 Mar 25 10:34 ldapcompare -rwxr-xr-x 1 root root 265432 Mar 25 10:34 ldapdelete -rwxr-xr-x 1 root root 265624 Mar 25 10:34 ldapexop -rwxr-xr-x 1 root root 277336 Mar 25 10:34 ldapmodify -rwxr-xr-x 1 root root 265016 Mar 25 10:34 ldapmodrdn -rwxr-xr-x 1 root root 264216 Mar 25 10:34 ldappasswd -rwxr-xr-x 1 root root 287864 Mar 25 10:34 ldapsearch -rwxr-xr-x 1 root root 155256 Mar 25 10:34 ldapurl -rwxr-xr-x 1 root root 262648 Mar 25 10:34 ldapwhoami [root@oldaptest01 bin]# [root@oldaptest01 bin]# ldapadd -x -D "cn=Directory Manager,o=csun" -W -f example.ldif -bash: ldapadd: command not found [root@oldaptest01 bin]#

4 4

From: Suneet Shah
by Suneet Shah 27 Mar '15

27 Mar '15

Hi openldap http://malicemud.com/husband.php?dead=6ysg8ks7mhbhm2 suneetshah2000(a)gmail.com Sent from my iPhone

1 0

Re: can't run ldapsearch and slapadd command after install openldap
by Igor Shmukler 26 Mar '15

26 Mar '15

Sorry. I misunderstood your message. Thought that you were missing slapd. Did you install ldap-utils? I believe that ldapsearch(1) might a part of ldap-utils package [probably depends on the distro], and it is installed separately. On Thu, Mar 26, 2015 at 12:01 AM, Wang, Hui <holly.wang(a)csun.edu> wrote: > Igor > > What file I should look for under /usr/sbin? I got this > > [root@oldaptest01 sbin]# pwd > /usr/sbin > [root@oldaptest01 sbin]# ldapsearch > -bash: ldapsearch: command not found > > [root@oldaptest01 sbin]# ps auxww | grep slapd > root 3094 0.0 24.3 1411584 468476 ? Ssl 11:10 0:00 /opt/libexec/slapd > root 7574 0.0 0.0 103252 840 pts/0 S+ 14:59 0:00 grep slapd > > > > -----Original Message----- > From: Igor Shmukler [mailto:igor.shmukler@gmail.com] > Sent: Wednesday, March 25, 2015 12:40 PM > To: Wang, Hui > Subject: Re: can't run ldapsearch and slapadd command after install openldap > > Hello, > > Try: $ ps auxww | grep slapd > > BTW, did you check /usr/sbin as to whether binaries are there? On my machine they are in the /usr/sbin directory. > > Sincerely, > > Igor Shmukler > > On Wed, Mar 25, 2015 at 9:06 PM, Wang, Hui <holly.wang(a)csun.edu> wrote: >> Hi, All >> >> I am still working on set up a new openldap server on redhat linux machine. I am following the steps offered in following site: >> >> https://urldefense.proofpoint.com/v2/url?u=http-3A__www.openldap.org_d >> oc_admin24_quickstart.html&d=AwIBaQ&c=Oo8bPJf7k7r_cPTz1JF7vEiFxvFRfQtp >> -j14fFwh71U&r=GJzNE-na5kc9aOr5JDyH43J-pL3ONUA5CuZ1SXkuaxM&m=GBtUhh13Xy >> aRZP5tODMNFbEJJAg_qvoUiAUFCjZDrSU&s=MSNLQQwkvXAf76wBrcbRiZ0QF7U2GBM-Zd >> LZjQ5LAL8&e= >> >> I am at step 9, I started the slapd, but can't do LDAP search. I can't run slapadd command either. >> >> You can see my slapd is up and running, but there are nothing installed in /usr/local/bin. What should I install and how can I make ldapsearch and slapadd command run? >> >> Thanks >> >> >> >> [root@oldaptest01 sbin]# pgrep slapd >> 3094 >> [root@oldaptest01 openldap-2.4.40]# cd /usr/local/bin >> [root@oldaptest01 bin]# ldapsearch >> -bash: ldapsearch: command not found >> [root@oldaptest01 bin]# cd /usr/local/sbin >> [root@oldaptest01 sbin]# slapadd >> -bash: slapadd: command not found >> >> >> >> >> Hui Wang >>

2 1

can't run ldapsearch and slapadd command after install openldap
by Wang, Hui 25 Mar '15

25 Mar '15

Hi, All I am still working on set up a new openldap server on redhat linux machine. I am following the steps offered in following site: http://www.openldap.org/doc/admin24/quickstart.html I am at step 9, I started the slapd, but can't do LDAP search. I can't run slapadd command either. You can see my slapd is up and running, but there are nothing installed in /usr/local/bin. What should I install and how can I make ldapsearch and slapadd command run? Thanks [root@oldaptest01 sbin]# pgrep slapd 3094 [root@oldaptest01 openldap-2.4.40]# cd /usr/local/bin [root@oldaptest01 bin]# ldapsearch -bash: ldapsearch: command not found [root@oldaptest01 bin]# cd /usr/local/sbin [root@oldaptest01 sbin]# slapadd -bash: slapadd: command not found Hui Wang

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical