openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

filesystem considerations
by Julien Huon 24 Oct '14

24 Oct '14

Hello, I read a long time ago theses very interesting benchmarks : http://symas.com/mdb/microbench/july/. It seams that ext2 is the fastest filesystem for asynchronous writes. Do you think an ext4 filesystem without journalisation but with extents could be faster ? A LMBD database is a big flat file isn't it ? Extents are very interesting with that kind of files, aren't they ? Did someone try it ? Regards

3 4

Redhat LDAP Client Issues when disabling SSLv3
by Peter Boguszewski 23 Oct '14

23 Oct '14

I am running into issues on RHEL 6.x servers (mix of 6.5 and now 6.6) when attempting to disable SSLv3. I have compiled the servers with the --with-tls=openssl option and communication appears to be working well between servers to matter what I have for SSL Protocol. My problems are with the clients. For client configuration I install the openldap-clients package via yum install. Everything works as expected with this setting on the server side: olcTLSCipherSuite: HIGH:+TLSv1.2:-TLSv1.1:-TLSv1.0:+SSLv3:-SSLv2 as soon as I modify the +SSLv3 to -SSLv3 to this: olcTLSCipherSuite: HIGH:+TLSv1.2:-TLSv1.1:-TLSv1.0:-SSLv3:-SSLv2 the client no longer works. I have tried just about everything I can think of. I /can /get ldapsearch to work properly when I compile the openldap source on the client but sssd / authentication on the Red Hat side still fails. Here is the error message I am getting: 54481b75 slap_listener_activate(8): 54481b75 >>> slap_listener(ldaps://blah) 54481b75 connection_get(38): got connid=1009 54481b75 connection_read(38): checking for input on id=1009 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL3 alert write:fatal:handshake failure TLS trace: SSL_accept:error in SSLv3 read client hello C TLS trace: SSL_accept:error in SSLv3 read client hello C TLS: can't accept: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher. 54481b75 connection_read(38): TLS accept failure error=-1 id=1009, closing 54481b75 connection_close: conn=1009 sd=38 I am assuming this has something to do with RHEL clients linking to MozNSS libraries instead of openssl but can not be sure of that. Again, to be clear - I do not change anything but the olcTLSCipherSuite entry so I do not believe it is a certificate issue. Is there a solution to LDAP auth for RHEL clients with only allowind TLSv1.2? I will gladly compile from source or use the LTB Project rpms. Thanks in advance, -- Peter Boguszewski Manager of Library Systems UW Madison - Library Technology Group pboguszewski(a)library.wisc.edu 608.262.4768

6 8

Synchronizing two mirror mode clusters
by Clément OUDOT 23 Oct '14

23 Oct '14

Hi, I need to set up a backup OpenLDAP cluster and I am looking for advices on the best solutions to achieve it. The situation is: * A mirror mode cluster on one geographical site * A mirror mode cluster on another geographical site (backup site) * I would prefer not to impact configuration of main cluster * I think that full multi-master on different geographical site is not the best solution (but maybe I am totally wrong on this point) The backup site must be in sync with the main site. Here are my two ideas: * Configure a syncrepl client to main cluster on each node of the backup cluster. Question is: will not be conflicts as each node of the backup cluster is already synced with the other backup node? * Configure a LDAP proxy (back-ldap) to backup cluster, with syncrepl client to main cluster. But would back-ldap be able to write operational attributes to backup cluster? I imagine that some of you already have such needs, could you share your experience? Thanks, Clément.

5 6

Multimaster OpenLDAP - LDAP failed to start
by Arantza Serrano 23 Oct '14

23 Oct '14

Hello, I've a multimaster openldap servers. One of them is not running and when I try to start I show this error: Starting ldap...Done. Failed. /opt/zimbra/bin/ldap: line 50: kill: (4375) - No such process /opt/zimbra/bin/ldap: line 50: kill: (6219) - No such process /opt/zimbra/bin/ldap: line 50: kill: (6231) - No such process /opt/zimbra/bin/ldap: line 50: kill: (6242) - No such process /opt/zimbra/bin/ldap: line 50: kill: (6253) - No such process /opt/zimbra/bin/ldap: line 50: kill: (6264) - No such process /opt/zimbra/bin/ldap: line 50: kill: (6275) - No such process Failed to start slapd. Attempting debug start to determine error. 5446fc53 <= mdb_index_read: failed (-30798) 5446fc53 <= mdb_index_read: failed (-30798) res_errno: 0, res_error: <>, res_matched: <> res_errno: 0, res_error: <>, res_matched: <> 5446fc53 <= mdb_index_read: failed (-30798) 5446fc53 <= mdb_dn2id: get failed: MDB_NOTFOUND: No matching key/data pair found (-30798) 5446fc53 <= mdb_dn2id: get failed: MDB_NOTFOUND: No matching key/data pair found (-30798) slapd: ./../../../libraries/liblmdb/mdb.c:2282: mdb_txn_commit: Assertion `oldpg_txnid <= env->me_pgstate.mf_pglast' failed. What can I do to solve the problem? Thanks

2 2

Re: Seems that syncprov holds up LMDB's reclaiming while handle a syncrepl requests.
by Леонид Юрьев 23 Oct '14

23 Oct '14

I will submit the ITS with a patch. Now it is being tested. Leonid. 2014-10-20 21:30 GMT+04:00 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Wednesday, October 15, 2014 10:47 PM +0400 Леонид Юрьев <leo(a)yuriev.ru> > wrote: > >> Under heavy load conditions with syncrepl a lot of FreeDB records is >> generated, without any other reading activity. Is really a lot, up to >> 90% of DB space, a sample is below. >> >> I assume that the bugfix of ITS#7904 does not affected for syncprov >> overlay and syncrepl. >> http://www.openldap.org/its/index.cgi/Software%20Bugs?id=7904 > > > Provide a test case that triggers the behavior. > > --Quanah > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 1

LDAP searches hang after returning results...
by Jeff Lebo 22 Oct '14

22 Oct '14

OpenLDAP server setup as pass-through to AD on the backend. When doing a traffic dump on the connection between OpenLDAP and the AD server, I see OpenLDAP make the search request, the AD server responds with the results, then it just hangs there for about 90 seconds before the OpenLDAP server sends an unbind request to AD. This is causing the external application to timeout. Any idea what is causing this?

3 7

Modifying schemas
by Côme BERNIGAUD 22 Oct '14

22 Oct '14

Hello, If I do sudo ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=schema,cn=config" "cn=*" cn I can see in the resulsting list: # {18}applications-fd, schema, config dn: cn={18}applications-fd,cn=schema,cn=config cn: {18}applications-fd But if I use an ldif trying to modify this I get: modifying entry "cn={18}applications-fd,cn=schema,cn=config" ldap_modify: No such object (32) I can see in /etc/ldap/slapd.d/cn=config/cn=schema that the file is named cn={19}applications-fd.ldif so I tried with 19 instead of 18 in the ldif and I get: modifying entry "cn={19}applications-fd,cn=schema,cn=config" ldap_modify: No such object (32) matched DN: cn=schema,cn=config Which seems worse. I'm wondering if there is not a numbering problem with schemas due to a previous dirty delete of a schema (stopping slapd, deleting the file and starting slapd), but it still is weird that slapd would list the schema but not find it for modification. Côme

2 3

username syntax for bind/auth
by Jeff Lebo 21 Oct '14

21 Oct '14

So I've got everything working with my OpenLDAP passthrough to AD... one last thing (I think). Is there a way to make OpenLDAP accept username(a)domain.com instead of the full DN?

2 2

LDAP Replica TLS problem
by Elmopi, Stefano 21 Oct '14

21 Oct '14

Hi, I'm having trouble to run the replica LDAP with TLS, without TLS, all works !! Provider and Consumer are identical CentOS release 6.5 rpm -qa | grep ldap openldap-clients-2.4.23-34.el6_5.1.x86_64 openldap-2.4.23-34.el6_5.1.x86_64 apr-util-ldap-1.3.9-3.el6_0.1.x86_64 nss-pam-ldapd-0.7.5-18.2.el6_4.x86_64 mod_authz_ldap-0.26-16.el6.x86_64 pam_ldap-185-11.el6.x86_64 openldap-servers-2.4.23-34.el6_5.1.x86_64 Provider config, file cn\=config.ldif olcTLSCACertificateFile: /etc/openldap/certs/ldapscert.pem olcTLSCertificateFile: /etc/openldap/certs/ldapscert.pem olcTLSCertificateKeyFile: /etc/openldap/certs/keys/ldapskey.pem olcTLSCipherSuite: TLSv1+RSA:!EXPORT:!NULL olcTLSVerifyClient: never Consumer config: olcSyncrepl: {0}rid=000 provider=ldap://ldpsoc01devpom.sociale.it starttls=yes type=refreshonly retry="5 5 300 +" searchbase="dc=example,dc=it" attrs="*,+" bindmethod=simple binddn="uid=xxxxxxxx,ou=admin_bind,ou=Utenze_Amministratori,dc=example,dc=it" credentials=xxxxxxx interval=60 and, in /etc/openldap/ldap.conf TLS_CACERT /etc/openldap/certs/ldapscert.pem TLS_REQCERT never the certificate is self-signed On the slave, if I try the following command: ldapsearch -ZZ -x -H ldap://ldpsoc01devpom -D 'uid=xxxxxxx,ou=admin_bind,ou=Utenze_Amministratori,dc=example,dc=it' -W 'objectclass=*' -v everything is ok but when I try to use TLS in replication, the process goes wrong. In the Provider log: connection_get(16) connection_get(16): got connid=1030 connection_read(16): checking for input on id=1030 connection_read(16): TLS accept failure error=-1 id=1030, closing connection_closing: readying conn=1030 sd=16 for close connection_close: conn=1030 sd=16 daemon: activity on 1 descriptor daemon: activity on: In the Consumer log: slapd[6508]: =>do_syncrepl rid=000 slap_client_connect: URI=ldap://ldpsoc01devpom.sociale.it Warning, ldap_start_tls failed (-11) slap_client_connect: URI=ldap://ldpsoc01devpom.sociale.it DN="uid=bind_replica,ou=admin_bind,ou=utenze_amministratori,dc=sociale,dc=it" ldap_sasl_bind_s failed (-1) do_syncrepl: rid=000 rc -1 retrying (3 retries left) daemon: activity on 1 descriptor daemon: activity on: Help, I do not know where to turn !!!! Thanks Ing. Stefano Elmopi Cooperativa Capodarco - Resp. Area ICT Gestione Esercizio Via Ostiense 131/L Corpo B, 00154 Roma cell. 3466147165 tel. 0657060500 email:stefano.elmopi@sociale.it -- "Ai sensi e per gli effetti della legge sulla tutela dei dati personali (D.lgs 196/2003), le informazioni contenute nella presente @mail sono di natura riservata e destinate ad un uso aziendale-lavorativo con esclusione di utilizzi ad uso personale; come tali, pertanto, sono riservate esclusivamente ai destinatari sopra indicati. E' proibito leggere, copiare, usare o diffondere il contenuto della presente @mail senza autorizzazione. Se avete ricevuto questa @mail per errore, siete pregati di rispedire la stessa al mittente. Grazie"

4 4

POODLE SSLv3 downgrade attack
by Howard Chu 21 Oct '14

21 Oct '14

You've probably all heard about this "new" attack several times by now. Just to confirm what's already been stated - this attack only affects HTTP browsers that deliberately break the TLS handshake protocol to allow using older SSL versions. It does not affect LDAP software at all. Also, since version 2.4.14 (released February 2009), OpenLDAP has supported TLSProtocolMin slapd config and LDAP_TLS_PROTOCOL_MIN client config directives for selecting the minimum version of SSL/TLS to allow. As this feature has been available for over 5 years there is no reason for any OpenLDAP deployments to be using SSLv3 today. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

6 8

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical