openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

TLS Configuration
by Hydro Tium 26 Nov '14

26 Nov '14

Hi guys, I'm struggling to configure my OpenLDAP with TLS (openssl) without success. I'm receiving the following error: $ sudo slapd -d 3 ... TLS: gcry_control GCRYCTL_SET_RNDEGD_SOCKET failed 5475ca9c main: TLS init failed: -1 My configuration is the following: dn: cn=config objectClass: olcGlobal cn: config olcPidFile: /var/run/slapd/slapd.pid olcArgsFile: /var/run/slapd/slapd.args olcIdleTimeout: 7 olcLogLevel: conns filter stats none olcReferral: ldap://root.openldap.org olcTLSCACertificateFile: /etc/ssl/certs/My_Root_CA.pem olcTLSCertificateFile: /etc/ssl/certs/My_Root_CA.pem olcTLSCertificateKeyFile: /etc/ldap/server.key.pem olcTLSVerifyClient: demand olcTLSRandFile: /dev/urandom Any clues on how to solve this one?

4 4

Cannot add to mdb
by Da Rock 26 Nov '14

26 Nov '14

I'm trying to get openldap to play nice with mdb given that it is the "recommended" database backend for it now- although the conf wasn't an issue excepting I'm playing with the new cn=config setup we're expected to use now as well (even though it is mainly broken). My issue is that it seems to not respond like the older bdb/hdb databases. And when I say respond, I mean it hangs the ldapadd and makes slapd go into conniptions. I see slapd go to 100% WCPU and not come down as well as going into a uwait state. I've left it going for 10 minutes or more with no change, and I'm only adding 1 small entry of less the 10 lines. Strangely, I can still view other entries in the specific db as well access the rest of the server, which I won't complain about (aren't threads a wonderful invention? ). So coming to the experts - got a fix at all? Or should I just go back to ye olde db backends? At this point I have a db I can't add anything to. And before anyone asks, there is practically nothing in the logs that I can see; and I set the logging to everything (-1). I see recognition of the user in the acl and then nothing. The only possible curious entry is some blank lines and a number (that changes each time), so nothing informative. I set it up using the cn=config (and I'm still not entirely convinced that I will keep cn=config, but apparently it could be gone next version according to the grapevine, so the consensus is to suck it up and get used to it or your panties will get in a bunch and around your ankles when the upgrade comes along), and I've got only olcDBMaxSize. olcSizeLimit (not sure exactly which of these 2 can go just yet), olcDBMode, olcDBDirectory, and olcDatabase and the obviously root attrs. My max size I've set larger than 50M (so 7 digits) which is larger than what I have in another db so far, and I figure I can add more if needed - currently it is sitting at 64k. I'm using FreeBSD 9.1, ports Openldap version is 2.4.40_1 with bdb/hdb and mdb set in config. But I notice lmdb is not installed as a dependency - is this right? I've been on this for near a week now with no further advancement so any help would be very welcome at this point. No googling seems to find anything remotely similar either. TIA

2 4

Unexpected growth in mdb database file
by Rene B. Elgaard 26 Nov '14

26 Nov '14

I have gone through an upgrade proces from OpenLDAP 2.4.21 to 2.4.40 and took the opportunity to switch from the bdb backend to mdb. I am expiriencing an (in my eyes) unexpected growth of the mdb database file. Two types of setup: Setup 1: One master, one slave Setup 2: Two masters MMR (read,write,syncrepl goes to one master, three slaves) I see the growth in both setups on the master, who services read,write and syncrepl. In setup 2 the master, who is "idle" and only syncrepl's with the other master, does not grow more than expected. Example from setup 2: Servicing master: -rw------- 1 openldap openldap 4294963200 Nov 26 10:18 data.mdb Non-servicing master: -rw------- 1 openldap openldap 271347712 Nov 26 10:18 data.mdb Quite a difference ! A slapcat on the servicing master shows that I have no where near 4 Gb of data, here from my nightly backup: -rw------- 1 openldap openldap 73389431 Nov 25 23:46 20141125234504_slapd-dump.ldif I have the same backend configuration on all masters: database mdb maxsize 8589934592 suffix "c=<country>" rootdn "cn=Manager,o=<some-org>,c=<country>" rootpw <some-pw> directory <some-path> index objectClass,entryCSN,entryUUID eq No overlays involved. Operating system is Solaris 10. OpenLDAP compiled with Oracles compiler, compiler flags are: export CC="cc" export CFLAGS="-m64 -fast -D_AVL_H" Unsure how to proceed. Should I file an ITS (looks somewhat like 7974 though) ? I may also have missed something entirely... Happy to provide further info. /Rene

1 0

OpenLDAP incroyable!
by Onno van der Straaten 26 Nov '14

26 Nov '14

What was created with OpenLDAP is incredible. Truly. Experienced with open source but never seen before a system that is so archaic. Amazing. The way that configuration works is something that has to be seen and experienced to be believed. There must be strong commercial interest served here to create a system that works in this manner. It allows for configuration changes that corrupt the installation but will now allow manual correction of the configuration. Chicken and egg. To correct the configuration you have start OpenLDAP and ldapmodify the config files. But.... OpenLDAP will not start because the configuration is not correct. Really funny. And if you try to manually undo your changes, OpenLDAP will completely refuse to put itself into something that resembles a working configuration. It is fairly easy to make configuration changes that corrupt the database. Documentation is often incorrect or non-existing. For example try to add sha2 support. Accidentally add non existing hash method will create a corrupt configuration. If you slapd restart it will fail to start. To correct the configuration you need to start slapd. To start slapd you need correct configuration. It is the end of your efforts. I'm not doing this on a production system of course, I am trying to create a production system where OpenLDAP is on of the many components. So far most of the effort is OpenLDAP effort. It is consuming most of the project budget. A project of a couple of days turns into a project for a couple of weeks. We just need a LDAP user directory. OpenLDAP is not it.

8 14

ldaps replication question
by wailok tam 26 Nov '14

26 Nov '14

Hi, all, I cannot get replication to work even I get no error message. I change a record on the Master but when I check it on the slave, it remains unchanged. (Is it immediate?) The following command on slave: ldapsearch -x -h [MASTER HOST NAME] -W -D 'cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp' '(uid=tam)' returns no error message and gives the expected record. I am suspecting I may have screwed up the ssl/tls setting for the slave as I dont know what to put there. The master is set to use ssl/tls and it communicates fine with the client thru the ldaps protocol. Your help is much needed. First come the slapd.conf of the slave (I dont have the lines for ssl certs. I just use the ldaps address in the replication directive. Is that enough?): ### configuration for IER### writeen by T.Tanaka include /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default.allow bind_v2 # Do not enable referrals until AFTER you have a working directory# service AND an understanding of referrals.#referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pidargsfile /var/run/openldap/slapd.args ######################################################################## ldbm and/or bdb database definitions####################################################################### database bdbsuffix "dc=ier,dc=hit-u,dc=ac,dc=jp"rootdn "cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp"rootpw SLAVEPWdirectory /var/lib/ldap # Replicas of this database # Indices to maintain for this databaseindex objectClass eq,presindex ou,cn,mail,surname,givenname eq,pres,subindex uidNumber,gidNumber,loginShell eq,presindex uid,memberUid eq,pres,subindex nisMapName,nisMapEntry eq,pres,subindex entryCSN,entryUUID eq idlcachesize 1000 access to attrs=userPassword by dn="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" write by self write by anonymous auth by * none access to * by dn="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" write by self write by * read #loglevel stats sync syncrepl rid=001 provider=ldaps://mail.ier.hit-u.ac.jp type=refreshAndPersist interval=00:00:05:00 searchbase="dc=ier,dc=hit-u,dc=ac,dc=jp" binddn="uid=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" credentials=SLAVEPW Next come the slapd.conf of the master: ### configuration for IER### writeen by T.Tanaka### edited by WL.Tam include /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default.allow bind_v2 pidfile /var/run/openldap/slapd.pidargsfile /var/run/openldap/slapd.args ######################################################################## ldbm and/or bdb database definitions####################################################################### database bdbsuffix "dc=ier,dc=hit-u,dc=ac,dc=jp"rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp"rootpw MASTERPWdirectory /var/lib/ldap TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crtTLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crtTLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key overlay syncprovsyncprov-checkpoint 50 10syncprov-sessionlog 100 # Indices to maintain for this databaseindex objectClass eq,presindex ou,cn,mail,surname,givenname eq,pres,subindex uidNumber,gidNumber,loginShell eq,presindex uid,memberUid eq,pres,subindex nisMapName,nisMapEntry eq,pres,subindex entryCSN,entryUUID eq idlcachesize 1000 access to attrs=userPassword by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by anonymous auth by * none access to attrs=SambaLMPassword,SambaNTPassword by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by self read by anonymous auth by * none access to * by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by * read

3 2

Re: Antw: getting warning:var/lib/ldap/__db.004 is not owned by "ldap" and ldap wont start
by wailok tam 26 Nov '14

26 Nov '14

Hi, thanks. it is fixed now. I get another trouble with doing replication over SSL on redhat. I dont know how to config the slave.If you can help with my other post, that would be greatly appreciated. From: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> To: openldap-technical(a)openldap.org; wailoktam(a)yahoo.com Sent: Wednesday, November 26, 2014 5:26 PM Subject: Antw: getting warning:var/lib/ldap/__db.004 is not owned by "ldap" and ldap wont start >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 26.11.2014 um 04:36 in Nachricht <1434320209.699036.1416973016975.JavaMail.yahoo(a)jws100111.mail.ne1.yahoo.com>: > Hi, all, I get the warning given in the title and ldap stops even after > reporting to start successfully. > The error is fixed by doing a chown for the affected files. It was > mysteriously changed to root. I change it back to ldap and it works again. > However, I want to know what has caused this to happen. Anyone can help? Most likely: You started slapadd as root? > I am in the course of changing a slurpd-based replication to a > syncrepl-based replication. I suspect that is relevant. > In the old and working master config: > rootdn: root binddn for replication(slurpd) directive: replicator > In the old and working slave config: rootdn: replicator > > In the new master config: rootdn: root > > In the new slave config: rootdn: replicator > binddn for replication(syncrepl) directive: replicator > What has caused the db.00X file to be owned by root? > The new configs once start without error. But I find the replication is not > doing its job when I check on the slave the data of a user account I changed > on the master side. So I go back to the old config. And then the > var/lib/ldap/__db.004 is not owned by "ldap" comes up and ldap wont start on > the slave. > Maybe the syncrepl has been working partially, just in a different name and > causes the problem?Maybe it is not working at all as I dont know what to put > about ssl/tls in the slave config file. In the master, I have commented out > the tls cert/key lines and access to the server by the client are done with > the ldaps:// port. But I dont know what to do with the slapd.conf of the > slave file. Does it have to get the ssl lines commented out in order to get > allowed to access the master. > Any help would be greatly appreciated.

1 0

getting warning:var/lib/ldap/__db.004 is not owned by "ldap" and ldap wont start
by wailok tam 25 Nov '14

25 Nov '14

Hi, all, I get the warning given in the title and ldap stops even after reporting to start successfully. The error is fixed by doing a chown for the affected files. It was mysteriously changed to root. I change it back to ldap and it works again. However, I want to know what has caused this to happen. Anyone can help? I am in the course of changing a slurpd-based replication to a syncrepl-based replication. I suspect that is relevant. In the old and working master config: rootdn: root binddn for replication(slurpd) directive: replicator In the old and working slave config: rootdn: replicator In the new master config: rootdn: root In the new slave config: rootdn: replicator binddn for replication(syncrepl) directive: replicator What has caused the db.00X file to be owned by root? The new configs once start without error. But I find the replication is not doing its job when I check on the slave the data of a user account I changed on the master side. So I go back to the old config. And then the var/lib/ldap/__db.004 is not owned by "ldap" comes up and ldap wont start on the slave. Maybe the syncrepl has been working partially, just in a different name and causes the problem?Maybe it is not working at all as I dont know what to put about ssl/tls in the slave config file. In the master, I have commented out the tls cert/key lines and access to the server by the client are done with the ldaps:// port. But I dont know what to do with the slapd.conf of the slave file. Does it have to get the ssl lines commented out in order to get allowed to access the master. Any help would be greatly appreciated.

2 2

Re: Antw: Re: multi master replication
by Guruprasad Kulkarni 25 Nov '14

25 Nov '14

I think I can have two "rid=000" because I do not see any complaints on the logs (both masters) and the replication works. I'll have to read more about this. Thanks, Guruprasad On Nov 25, 2014 2:46 AM, "Ulrich Windl" <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: > Hi! > > First I think you cannot have two "rid=000", second (unless you use > certificates or more sophisticated mechs) your password will be visible in > the > config. That's why the config should be protected (and better not be sent > to > this list unmodified). > > Regards, > Ulrich > > >>> Guruprasad Kulkarni <gkulkarni(a)gridcosystems.com> schrieb am > 24.11.2014 > um > 20:01 in Nachricht > <CAB6=W2stWBseeehyE7vPn-v1BG6Wro+WPZtqdMb8ZY0yFqrXSQ(a)mail.gmail.com>: > > So I found an example for setting up multi master replication using > > slapd.conf > > > > *slapd.conf for MASTER 1* > > > > *# slapd master ldap1.example.com <http://ldap1.example.com>* > > *# global section* > > *serverID 001* > > > > *database bdb* > > *...* > > > > *access to ** > > * by dn.base="cn=admin,ou=people,dc=example,dc=com" read* > > * by * read* > > > > *syncrepl rid=000 * > > * provider=ldap://ldap2.example.com <http://ldap2.example.com>* > > * type=refreshAndPersist* > > * retry="5 5 300 +" * > > * searchbase="dc=example,dc=com"* > > * attrs="*,+"* > > * bindmethod=simple* > > * binddn="cn=admin,ou=people,dc=example,dc=com"* > > * credentials=secret* > > > > *index objectClass eq* > > > > *mirrormode TRUE* > > > > *overlay syncprov* > > *syncprov-checkpoint 100 10* > > > > > > > > *slapd.conf for MASTER 2* > > > > *# slapd master ldap2.example.com <http://ldap2.example.com>* > > *# global section* > > *serverID 002* > > > > *database bdb* > > *...* > > > > *access to ** > > * by dn.base="cn=admin,ou=people,dc=example,dc=com" read* > > * by * read * > > > > *syncrepl rid=000 * > > * provider=ldap://ldap1.example.com <http://ldap1.example.com>* > > * type=refreshAndPersist* > > * retry="5 5 300 +" * > > * searchbase="dc=example,dc=com"* > > * attrs="*,+"* > > * bindmethod=simple* > > * binddn="cn=admin,ou=people,dc=example,dc=com"* > > * credentials=secret* > > > > *index objectClass eq* > > > > *mirrormode TRUE* > > > > *overlay syncprov* > > *syncprov-checkpoint 100 10* > > > > > > > > My question is - Do the credentials have to be clear text passwords? If > > not, how do I mention encrypted passwords? (I tried within quotes ' ' > and " > > ", but each time got invalid credentials error) > > > > > > > > On Mon, Nov 24, 2014 at 1:28 PM, Howard Chu <hyc(a)symas.com> wrote: > > > >> Guruprasad Kulkarni wrote: > >> > >>> Hi, > >>> > >>> I did have a look at the options and only "--enable-modules" option > >>> talks about dynamic module support > >>> > >>> I tried "--enable-dynamic" option as well (the description for it is > >>> enable linking built binaries with dynamic libs) > >>> > >>> What I do observe is that even though I have "moduleload syncprov.la > >>> <http://syncprov.la>" directive in slapd.conf, slapd does not complain > >>> about it. So I guess I do not have to specify the module path > >>> (syncreplication tests were successful as well) > >>> > >> > >> Correct, moduleload silently succeeds if you specify a module that was > >> built statically. > >> > >>> > >>> I also realized I was looking at the OLC configuration examples for > >>> multi master. What I need to do is find slapd.conf example for multi > >>> master. > >>> > >>> > >>> On Mon, Nov 24, 2014 at 11:29 AM, Dieter Klünter <dieter(a)dkluenter.de > >>> <mailto:dieter@dkluenter.de>> wrote: > >>> > >>> Am Mon, 24 Nov 2014 09:52:34 -0500 > >>> schrieb Guruprasad Kulkarni <gkulkarni(a)gridcosystems.com > >>> <mailto:gkulkarni@gridcosystems.com>>: > >>> > >>> > I have 2 questions regarding multi master replication: > >>> > > >>> > 1. I built openldap 2.4.40 from source and according to the > >>> makefile, > >>> > the module directory should be at /usr/local/libexec/openldap. > >>> > > >>> > However I do not see such a folder. Am I missing something? > The > >>> > options I used with configure were "--enable-debug > --enable-modules > >>> > --enable-hdb --enable-monitor --enable-ppolicy --enable-syncprov > >>> > --with-tls --with-cyrus-sasl" > >>> > > >>> > I am asking because the multi master replication example ( > >>> >http://www.openldap.org/doc/admin24/replication.html > >>> > <http://www.openldap.org/doc/admin24/replication.html#N-Way>) > >>> needs > >>> > me to load thesyncprov.la <http://syncprov.la> module, but I am > >>> not sure if the > >>> > modulepath given there is correct or not. > >>> > >>> You have probably not build dynamic loadable modules, but built-in > >>> modules. > >>> you should run ./configure --help | less, which will show proper > build > >>> choices. > >>> > >> > >> -- > >> -- Howard Chu > >> CTO, Symas Corp. http://www.symas.com > >> Director, Highland Sun http://highlandsun.com/hyc/ > >> Chief Architect, OpenLDAP http://www.openldap.org/project/ > >> > > > > > > > > -- > > -Guruprasad > > > >

2 1

Re: Antw: Passwords, Hashing, and Binds
by Quanah Gibson-Mount 25 Nov '14

25 Nov '14

--On Monday, November 24, 2014 12:22 PM +0100 Onno van der Straaten <onno.van.der.straaten(a)gmail.com> wrote: > sudo make install I'd generally advise you really read over the options to configure, and build a better set of binaries. For example, leave out back-bdb/hdb, and enable building things modularly. My options are: --with-cyrus-sasl \ --with-tls=openssl \ --enable-dynamic \ --enable-slapd \ --enable-modules \ --enable-backends=mod \ --disable-shell \ --disable-sql \ --disable-bdb \ --disable-hdb \ --disable-ndb \ --enable-overlays=mod \ --enable-debug \ --enable-spasswd \ --enable-crypt; \ > Make the sha2 module > cd ~/openldap/contrib/slapd-modules/passwd/sha2 > sed -i.bak s/-Wall -g/-Wall -g fPIC/g Makefile > make I do: (cd openldap-$(LDAP_VERSION)/contrib/slapd-modules/passwd/sha2; \ $(MAKE) prefix=/usr/local LIBS="-L$(LDAP_LIB_DIR) -lldap_r -llber" install STRIP=""; \ ) And then it installs it for me in the same location. Just make sure you use the same prefix here. > This results in a number of files pw-sha2.la sha2.lo sha2.o slapd-sha2.lo slapd-sha2.o > > The question now is how to install this on my target OpenLDAP server. I > put the files in /usr/lib64/openldap en dan tried to add the following > dn: cn=module{0},cn=config > changetype: modify > replace: olcModuleLoad > olcModuleLoad: slapd-sha2.la I'm not sure that replacing olcModuleLoad is correct. If you already have values in there, you probably want to keep them. I generally *add* an additional values. In any case, your value for the attribute is incorrect. The .la file is named, as in your email, pw-sha2.la, not slapd-sha2.la . If you want to add it as an additional module to load, then you would do changetype: modify add: olcModuleLoad olcModuleLoad: pw-sha2.la My loaded modules are: dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: /opt/zimbra/openldap/sbin/openldap olcModuleLoad: {0}back_mdb.la olcModuleLoad: {1}back_monitor.la olcModuleLoad: {2}syncprov.la olcModuleLoad: {3}accesslog.la olcModuleLoad: {4}dynlist.la olcModuleLoad: {5}unique.la olcModuleLoad: {6}noopsrch.la olcModuleLoad: {7}pw-sha2.la for example. now, if you want to make something like say, SHA512 the default, then you need to modify the frontend config db: dn: olcDatabase={-1},cn=config changetype: modify replace: olcPasswordHash olcPasswordHash: {SSHA512} --Quanah -- Quanah Gibson-Mount Server Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Returned mail: Data format error
by cloos＠jhcloos.com 25 Nov '14

25 Nov '14

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical