openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

[PATCH] Fix OpenLDAP build when using LibreSSL
by Xin Li 12 Nov '14

12 Nov '14

Hi, A FreeBSD user have proposed the patch below to solve OpenLDAP compile issue when using LibreSSL, which I think would be good to share with upstream. The patch can be found at: https://svnweb.freebsd.org/ports/head/net/openldap24-server/files/patch-des… The patch was created by "Spil Oss <spil.oss(a)gmail.com>" so credit should go to the submitter: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=194841 Cheers, --- libraries/liblutil/passwd.c.orig 2014-09-19 03:48:49.000000000 +0200 +++ libraries/liblutil/passwd.c 2014-11-05 19:57:10.807555025 +0100 @@ -38,11 +38,11 @@ # include <openssl/des.h> -typedef des_cblock des_key; -typedef des_cblock des_data_block; -typedef des_key_schedule des_context; -#define des_failed(encrypted) 0 -#define des_finish(key, schedule) +typedef DES_cblock DES_key; +typedef DES_cblock DES_data_block; +typedef DES_key_schedule DES_context; +#define DES_failed(encrypted) 0 +#define DES_finish(key, schedule) #elif defined(HAVE_MOZNSS) /* @@ -53,9 +53,9 @@ */ #define PROTYPES_H 1 # include <nss/pk11pub.h> -typedef PK11SymKey *des_key; -typedef unsigned char des_data_block[8]; -typedef PK11Context *des_context[1]; +typedef PK11SymKey *DES_key; +typedef unsigned char DES_data_block[8]; +typedef PK11Context *DES_context[1]; #define DES_ENCRYPT CKA_ENCRYPT #endif @@ -664,10 +664,10 @@ * abstract away setting the parity. */ static void -des_set_key_and_parity( des_key *key, unsigned char *keyData) +DES_set_key_and_parity( DES_key *key, unsigned char *keyData) { memcpy(key, keyData, 8); - des_set_odd_parity( key ); + DES_set_odd_parity( key ); } @@ -677,7 +677,7 @@ * implement MozNSS wrappers for the openSSL calls */ static void -des_set_key_and_parity( des_key *key, unsigned char *keyData) +DES_set_key_and_parity( DES_key *key, unsigned char *keyData) { SECItem keyDataItem; PK11SlotInfo *slot; @@ -699,7 +699,7 @@ } static void -des_set_key_unchecked( des_key *key, des_context ctxt ) +DES_set_key_unchecked( DES_key *key, DES_context ctxt ) { ctxt[0] = NULL; @@ -712,37 +712,37 @@ } static void -des_ecb_encrypt( des_data_block *plain, des_data_block *encrypted, - des_context ctxt, int op) +DES_ecb_encrypt( DES_data_block *plain, DES_data_block *encrypted, + DES_context ctxt, int op) { SECStatus rv; int size; if (ctxt[0] == NULL) { /* need to fail here... */ - memset(encrypted, 0, sizeof(des_data_block)); + memset(encrypted, 0, sizeof(DES_data_block)); return; } rv = PK11_CipherOp(ctxt[0], (unsigned char *)&encrypted[0], - &size, sizeof(des_data_block), - (unsigned char *)&plain[0], sizeof(des_data_block)); + &size, sizeof(DES_data_block), + (unsigned char *)&plain[0], sizeof(DES_data_block)); if (rv != SECSuccess) { /* signal failure */ - memset(encrypted, 0, sizeof(des_data_block)); + memset(encrypted, 0, sizeof(DES_data_block)); return; } return; } static int -des_failed(des_data_block *encrypted) +DES_failed(DES_data_block *encrypted) { - static const des_data_block zero = { 0 }; + static const DES_data_block zero = { 0 }; return memcmp(encrypted, zero, sizeof(zero)) == 0; } static void -des_finish(des_key *key, des_context ctxt) +DES_finish(DES_key *key, DES_context ctxt) { if (*key) { PK11_FreeSymKey(*key); @@ -817,7 +817,7 @@ static void lmPasswd_to_key( const char *lmPasswd, - des_key *key) + DES_key *key) { const unsigned char *lpw = (const unsigned char *) lmPasswd; unsigned char k[8]; @@ -832,7 +832,7 @@ k[6] = ((lpw[5] & 0x3F) << 2) | (lpw[6] >> 6); k[7] = ((lpw[6] & 0x7F) << 1); - des_set_key_and_parity( key, k ); + DES_set_key_and_parity( key, k ); } static int chk_lanman( @@ -843,10 +843,10 @@ { ber_len_t i; char UcasePassword[15]; - des_key key; - des_context schedule; - des_data_block StdText = "KGS!@#$%"; - des_data_block PasswordHash1, PasswordHash2; + DES_key key; + DES_context schedule; + DES_data_block StdText = "KGS!@#$%"; + DES_data_block PasswordHash1, PasswordHash2; char PasswordHash[33], storedPasswordHash[33]; for( i=0; i<cred->bv_len; i++) { @@ -864,21 +864,21 @@ ldap_pvt_str2upper( UcasePassword ); lmPasswd_to_key( UcasePassword, &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT ); + DES_set_key_unchecked( &key, &schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash1, &schedule , DES_ENCRYPT ); - if (des_failed(&PasswordHash1)) { + if (DES_failed(&PasswordHash1)) { return LUTIL_PASSWD_ERR; } lmPasswd_to_key( &UcasePassword[7], &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash2, schedule , DES_ENCRYPT ); - if (des_failed(&PasswordHash2)) { + DES_set_key_unchecked( &key, &schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash2, &schedule , DES_ENCRYPT ); + if (DES_failed(&PasswordHash2)) { return LUTIL_PASSWD_ERR; } - des_finish( &key, schedule ); + DES_finish( &key, schedule ); sprintf( PasswordHash, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", PasswordHash1[0],PasswordHash1[1],PasswordHash1[2],PasswordHash1[3], @@ -1139,10 +1139,10 @@ ber_len_t i; char UcasePassword[15]; - des_key key; - des_context schedule; - des_data_block StdText = "KGS!@#$%"; - des_data_block PasswordHash1, PasswordHash2; + DES_key key; + DES_context schedule; + DES_data_block StdText = "KGS!@#$%"; + DES_data_block PasswordHash1, PasswordHash2; char PasswordHash[33]; for( i=0; i<passwd->bv_len; i++) { @@ -1160,12 +1160,12 @@ ldap_pvt_str2upper( UcasePassword ); lmPasswd_to_key( UcasePassword, &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT ); + DES_set_key_unchecked( &key, &schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash1, &schedule , DES_ENCRYPT ); lmPasswd_to_key( &UcasePassword[7], &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash2, schedule , DES_ENCRYPT ); + DES_set_key_unchecked( &key, &schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash2, &schedule , DES_ENCRYPT ); sprintf( PasswordHash, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", PasswordHash1[0],PasswordHash1[1],PasswordHash1[2],PasswordHash1[3], -- Xin LI <delphij(a)delphij.net> https://www.delphij.net/ FreeBSD - The Power to Serve! Live free or die

2 1

LDAP auth is failing when I disconnect and re-connect AD server
by Adarsha S 12 Nov '14

12 Nov '14

Hi All, I've a setup where I've installed openldap-2.4.25 on debian machine to access windows 2003 AD server. my radius server use the libraire of openldap-2.4.25. Along with this i'm using samba to join the AD domain and bring up winbindd. The senario is this way. After I've started my radius server, winbindd process autherthication works fine. Now I disconnect my AD server for a while.Try to authenticate. It fails. This is a valid senario. But after I re-connect my AD server still the authentication says invalid users. I would like to know how to debug this issue as i'm not able to get logs also. Thanks in Advance, Adarsha

1 0

adding VLV support to OpenLDAP 2.4.31
by Igor Shmukler 12 Nov '14

12 Nov '14

Hello, I apologize if I am posting to the wrong mailing list. I have a simple problem, which I am sure any OpenLDAP administrator can easily solve... I am not an administrator, however. Hence being unable to answer this trivial question presents a real problem. I am stuck. Any assistance would be greatly appreciated. I am trying to add Virtual List View support to an OpenLDAP server on hosted Ubuntu. The distro version is Ubuntu 14.04.1 LTS. The OpenLDAP server is already running. I receive responses to basic commands, but VLV is not working. When I run the version command, I get: vq@vq-HVM-domU:~$ slapd -VV @(#) $OpenLDAP: slapd (Ubuntu) (Mar 17 2014 21:20:08) $ buildd@aatxe:/build/buildd/openldap-2.4.31/debian/build/servers/slapd I added the following lines to the slapd.conf file (located for some reason in a funky place /usr/share/slapd/slapd.conf ) moduleload sssvlv.so overlay sssvlv My path seems to be OK: modulepath /usr/lib/ldap The dynamic library appears to be in the right place as well: vq@vq-HVM-domU:~$ ls -l /usr/lib/ldap/sssvlv.so lrwxrwxrwx 1 root root 19 Mar 17 2014 /usr/lib/ldap/sssvlv.so -> sssvlv-2.4.so.2.8.3 vq@vq-HVM-domU:~$ ls -l /usr/lib/ldap/sssvlv-2.4.so.2.8.3 -rw-r--r-- 1 root root 26872 Mar 17 2014 /usr/lib/ldap/sssvlv-2.4.so.2.8.3 I cut out a piece of dmesg, just in case: [ 0.000000] Linux version 3.13.0-32-generic (buildd@kissel) (gcc version 4.8. 2 (Ubuntu 4.8.2-19ubuntu1) ) #57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014 (Ubuntu 3.13.0-32.57-generic 3.13.11.4) I tried to figure out how to see what OpenLDAP modules are loaded, but did not find the appropriate documentation, at least quickly. Sorry again. I am sure the list subscribers where where to look. I unfortunately do not. There is no slapd-config executable on this system. Hence, I am assuming that slapd.conf is being used. Please advise what I am missing and/or doing wrong. Any suggestions are welcome If this is a totally wrong place to ask, please direct me to an appropriate resource. The server fault forums did not produce immediate results. Thank you, Igor Shmukler

5 16

Fwd: interaction of LastBind and Accesslog modules
by David Tello 11 Nov '14

11 Nov '14

i have a problem with the modules lastbind and access log. Without lastbind modulo i can to audit the login of users finding the bind entries in the accesslog database. My problem is that when i active the lastbind module, this bind entries not appear in access log database. Instead appear modify entries that modify the AUTHTIMESTAMP attribute in the users that did the login, and the reqAuthnz of the modify is the rootDN of the directory. I can change the mode to audit the login finding this new entries, but i want to know if this is the normal funcionality or this a problem in the interaction of both. Thanks to all.

3 4

export directory in LDIF format
by Jerry 11 Nov '14

11 Nov '14

I have a strange problem exporting my directory into LDIF format. I am using the "mdb" format with openldap. /usr/local/sbin/slapcat -l MyDomain.net.ldif -b "dc=MyDomain,dc=net" If I run this command after starting "slapd", it works fine. However, I have this configured to run from a CRON job at midnight. It fails with this message: 5460a615 mdb_db_open: database "dc=MyDomain,dc=net" cannot be opened: No such file or directory (2). Restore from backup! 5460a615 backend_startup_one (type=mdb, suffix="dc=MyDomain,dc=net"): bi_db_open failed! (2) slap_startup failed This also occurs from the command line if the database has not been accessed for several hours, usually on a weekend. Restarting "slapd" immediately corrects the problem. I have checked and "slapd" is running when the failure occurs. I tried accessing the database and then using the backup command; however, the failure still continues. That is assuming that it failed to begin with obviously. Is there some sort of a "sleep" mode or something like that, that I am not aware of, or some really hard to debug "bug" somewhere? -- Jerry

4 4

How do I say to LDAP to use my configuration instead of the default one?
by Abel Guzmán Sánchez 11 Nov '14

11 Nov '14

Hi, I am writing because some time ago I have done some things with LDAP. But I am unable to make the new versions work (2.4.x). Basically I create the config file but I am unable to say to LDAP to use it instead of the default one. Is that clear somewhere in the documentation? can anyone help me? I have followed the official documentation and I managed to compile and create the config files (Config manual <http://www.openldap.org/doc/admin24/slapdconf2.html>), after this I have an ldif file like this: root@helpDesk10000:~# cat base.ldif # example config file - global configuration entry dn: cn=config objectClass: olcGlobal cn: config # olcReferral: ldap://root.openldap.org # internal schema dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema # include the core schema include: file:///usr/local/etc/openldap/schema/core.ldif <http:///usr/local/etc/openldap/schema/core.ldif%3C/p%3E%3Cp%3E#> <http:///usr/local/etc/openldap/schema/core.ldif%3C/p%3E%3Cp%3E#> # <http:///usr/local/etc/openldap/schema/core.ldif%3C/p%3E%3Cp%3E#> global database parameters dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: frontend olcAccess: to * by * read # set a rootpw for the config database so we can bind. # deny access to everyone else. dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootPW: {SSHA}EQpw7T2x2Num+krwRjq/ZYczmRgaX1Km olcAccess: to * by * none # HDB definition for example.com dn: olcDatabase=bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcSuffix: dc=helpdesk,dc=co,dc=bw olcDbDirectory: /var/lib/ldap-database olcRootDN: cn=Manager,dc=helpdesk,dc=co,dc=bw olcRootPW: {SSHA}teY3/6WO7uoGrCmaDu9NKmvgn87WlCCw olcDbIndex: uid pres,eq olcDbIndex: cn,sn pres,eq,approx,sub olcDbIndex: objectClass eq olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=helpdesk,dc=co,dc=bw" write by * none olcAccess: to * by self write by dn.base="cn=Admin,dc=helpdesk,dc=co,dc=bw" write by * read root@helpDesk10000:~# Then the LDAP add apparently works: root@helpDesk10000:~# ldapadd -Y EXTERNAL -H ldapi:/// -vn -f base.ldif add objectClass: olcGlobal add cn: config !adding new entry "cn=config" add objectClass: olcSchemaConfig add cn: schema !adding new entry "cn=schema,cn=config" add objectClass: olcSchemaConfig add cn: core add olcAttributeTypes: ( 2.5.4.2 NAME 'knowledgeInformation' DESC 'RFC2256: knowledge information' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) ( 2.5.4.4 NAME (...) add olcDbDirectory: /var/lib/ldap-database add olcRootDN: cn=Manager,dc=helpdesk,dc=co,dc=bw add olcRootPW: {SSHA}teY3/6WO7uoGrCmaDu9NKmvgn87WlCCw add olcDbIndex: uid pres,eq cn,sn pres,eq,approx,sub objectClass eq add olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=helpdesk,dc=co,dc=bw" write by * none to * by self write by dn.base="cn=Admin,dc=helpdesk,dc=co,dc=bw" write by * read !adding new entry "olcDatabase=bdb,cn=config" root@helpDesk10000:~# after that I start slapcat and it says this: root@helpDesk10000:~# slapcat 545b828d bdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/var/openldap-data: (2). Expect poor performance for suffix "dc=my-domain,dc=com". 545b828d bdb_monitor_db_open: monitoring disabled; configure monitor database to enable root@helpDesk10000:~# *How do I say to LDAP to use my configuration instead of the default one?* Thank you!

2 1

PFS: ITS#7506 in master but not in release
by Christopher Odenbach 10 Nov '14

10 Nov '14

Hi, while I was trying to find out why slapd does not use Perfect Forward Secrecy I found bug #7506 from september 2013. The patch has already been applied to the master branch but still cannot be found in any released version since. Why is this so? I would like to see good encryption in OpenLDAP for Debian. Regards, Christopher -- ====================================================== Dipl.-Ing. Christopher Odenbach Zentrum fuer Informations- und Medientechnologien Universitaet Paderborn Raum N5.311 odenbach(a)uni-paderborn.de Tel.: +49 5251 60 5315 ======================================================

4 6

Ppolicy not working on openldap on ubuntu 12.04 server
by Guruprasad Kulkarni 10 Nov '14

10 Nov '14

Hi, I am using Ubuntu 12.04 LTS server and have installed openldap on it. The commands used were: apt-get install slapd ldap-utils dpkg-reconfigure slapd I selected the default options for the questions asked. I am having a hard time trying to make ppolicy work on it. I loaded the ppolicy.schema by making the following change to /etc/ldap.conf: include /etc/ldap/schema/ppolicy.schema I even tried the command "moduleload ppolicy.la" None have worked. If anyone knows of a way to make it work, please let me know. -Guruprasad

2 1

Backing up openldap
by Jerry 10 Nov '14

10 Nov '14

Before changing over to "mdb" from "bdb", I ran a script that used slapcat to generate an LDIF file every night. Since updating to "mdb", that script fails if "slapd" is running. That is expected behavior from what I have been reading. <http://www.openldap.org/faq/data/cache/288.html> My question is how do I export the directory into an LDIF file if "slapd" is running, or is that not supported? I could easily modify the script to shut down the program, backup the directory in an LDIF format and restart the program; however, that seems overly ambitious. I understand that "replication" is an option, but I don't know if I really want to go that route at this time. -- Jerry

3 2

Re: Replication restores deleted user
by kevin sullivan 10 Nov '14

10 Nov '14

Thank you very much for the advice and the example config! I generally convert my slapd.conf to cn=config, I just find it easier to use the slapd.conf when debugging. But this gives me hope that my problem could be an issue with the conversion of slapd.conf to cn=config or something that I can find in your configuration. Thank you again, and I will let you know what I find! On Fri, Oct 31, 2014 at 3:40 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, October 31, 2014 4:13 PM -0400 kevin sullivan < > kevin4sullivan(a)gmail.com> wrote: > > >> >> >> >> >> Quanah, >> >> Thank you for the suggestion to move to delta-syncrepl MMR. >> Unfortunately, I am having problems setting this up properly. After >> reading through some documentation, I thought it would be simple but when >> I bring up slapd on my two servers, they both start using around 100% CPU >> and in the debug output the two servers are constantly looping through >> all of the objects in my DIT and saying that the objects have not changed: >> >> 5453d6b5 @(#) $OpenLDAP: slapd 2.4.39 (Jun 18 2014 05:19:18) $ >> >> mockbuild@x86-028.build.eng.bos.redhat.com:/builddir/build/BUILD/openldap >> -2.4.39/openldap-2.4.39/build-servers/servers/slapd >> 5453d6b5 hdb_monitor_db_open: monitoring disabled; configure monitor >> database to enable >> 5453d6b5 slapd starting >> ... >> 5453d6b5 syncrepl_message_to_entry: rid=001 DN: dc=example,dc=com, UUID: >> 1cfcd560-f564-1033-9f47-b521eabdb6ad >> 5453d6b5 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) >> 5453d6b5 syncrepl_entry: rid=001 inserted UUID >> 1cfcd560-f564-1033-9f47-b521eabdb6ad >> 5453d6b5 dn_callback : entries have identical CSN dc=example,dc=com >> 20141031161001.910968Z#000000#000#000000 >> 5453d6b5 syncrepl_entry: rid=001 be_search (0) >> 5453d6b5 syncrepl_entry: rid=001 dc=example,dc=com >> 5453d6b5 syncrepl_entry: rid=001 entry unchanged, ignored >> (dc=example,dc=com) >> 5453d6b5 syncrepl_message_to_entry: rid=001 DN: >> ou=users,dc=example,dc=com, UUID: 1cfe8cf2-f564-1033-9f48-b521eabdb6ad >> 5453d6b5 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) >> 5453d6b5 syncrepl_entry: rid=001 inserted UUID >> 1cfe8cf2-f564-1033-9f48-b521eabdb6ad >> 5453d6b5 dn_callback : entries have identical CSN >> ou=users,dc=example,dc=com 20141031161001.922234Z#000000#000#000000 >> 5453d6b5 syncrepl_entry: rid=001 be_search (0) >> 5453d6b5 syncrepl_entry: rid=001 ou=users,dc=example,dc=com >> 5453d6b5 syncrepl_entry: rid=001 entry unchanged, ignored >> (ou=users,dc=example,dc=com) >> ..... >> 5453d6b5 do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT >> 5453d6b5 do_syncrep2: rid=001 cookie= >> ... Repeated forever ... >> >> Am I configuring something incorrectly? >> >> To refresh your memory, I am running 2.4.39-8. I have two servers >> (server1 and server2) that I want to setup in delta-syncrepl MMR >> MirrorMode. >> > > Hi Kevin, > > I stopped using the deprecated slapd.conf format years ago, as it's prone > to misuse and incorrect setup. Your supplied config is an example of why > it's a bad idea to use slapd.conf (For example, you have serverID under the > database section, when it's a global option, etc). I'd strongly advise you > to switch to using cn=config so that you can have an actual validated > configuration. It also makes troubleshooting a lot easier to do. > > Aside from that, your log simply shows the server comparing each entry > between the two servers... Sounds like they didn't start out believing they > were in sync and are trying to get there. > > Here's an example of my config, using cn=config (slapcat export) minus the > schema: > > <http://pastebin.com/nv1WNX2y> > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 10

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical