openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

multi master replication
by Guruprasad Kulkarni 25 Nov '14

25 Nov '14

I have 2 questions regarding multi master replication: 1. I built openldap 2.4.40 from source and according to the makefile, the module directory should be at /usr/local/libexec/openldap. However I do not see such a folder. Am I missing something? The options I used with configure were "--enable-debug --enable-modules --enable-hdb --enable-monitor --enable-ppolicy --enable-syncprov --with-tls --with-cyrus-sasl" I am asking because the multi master replication example ( http://www.openldap.org/doc/admin24/replication.html <http://www.openldap.org/doc/admin24/replication.html#N-Way>) needs me to load the syncprov.la module, but I am not sure if the modulepath given there is correct or not. 2. Are the ldifs mentioned in the example enough with the following slapd.conf file I have? include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/misc.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/ppolicy.schema #custom password quality checker module location modulepath /usr/local/lib moduleload back_hdb.la moduleload ppolicy.la moduleload syncprov.la database hdb suffix "dc=example,dc=com" rootdn "cn=manager,dc=example,dc=com" rootpw *rootpw* access to * by dn="cn=manager,dc=example,dc=com" write by self write by * read directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq overlay ppolicy ppolicy_default "cn=default,ou=Policies,dc=example,dc=com" overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 loglevel 256 TLSCACertificateFile path_to_ca_certificate TLSCertificateFile path_to_certificate_file TLSCertificateKeyFile path_to_certificate_key_file I am new to openLDAP and not sure how to set up muti master replication properly. -- -Guruprasad

4 6

can our redhat os be migrate into 64bit?
by Wang, Hui 24 Nov '14

24 Nov '14

Hi, Our openLDAP is in version 2.3.4, it currently installed on a redhat 32bit. Can this server be migrate into 64bits? I can't find the os requirement for different version of openldap at this moment thanks Hui Wang (Holly) CSUN IT Department Identity and Directory Service 818-677-2031 holly.wang(a)csun.edu

3 2

Add attribute to already defined objectclass organizationalUnit in core.schema
by Shashi Ranjan 24 Nov '14

24 Nov '14

Hello, I need to add two elements to organizationalUnit Object Class. How can I do it without modifying the core.schema file? Is there a way to define two new attributes in my private schema file (local.schema) and then extend the object class organizationalUnit defined in core.schema? I do not want to modify the file core.schema. I wish to deliver only my local schema file (local.schema) with other changes also. P.S.: I m new OpenLDAP. Thanks & Regards, Shashi Ranjan "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

4 3

Re: Antw: Passwords, Hashing, and Binds
by Onno van der Straaten 24 Nov '14

24 Nov '14

Hi, I need some help getting this SSHA512 support. I found the module in the contrib directory passwd/sha2 but the README is still the old readme. It is doesn't explain how to install the module after compliation. This is what I was able to do so far On a clean CentOS VM make OpenLDAP 2-4-40 sudo yum -y install git mkdir openldap && cd openldap git clone git://git.openldap.org/openldap.git . git tag -l git checkout tags/OPENLDAP_REL_ENG_2_4_40 sudo yum -y install gcc export CXXFLAGS="$CXXFLAGS -fPIC" sudo yum -y install db4 db4-devel ./configure make depend sudo make sudo make install Make the sha2 module cd ~/openldap/contrib/slapd-modules/passwd/sha2 sed -i.bak s/-Wall -g/-Wall -g fPIC/g Makefile make This results in a number of files pw-sha2.la sha2.lo sha2.o slapd-sha2.lo slapd-sha2.o The question now is how to install this on my target OpenLDAP server. I put the files in /usr/lib64/openldap en dan tried to add the following dn: cn=module{0},cn=config changetype: modify replace: olcModuleLoad olcModuleLoad: slapd-sha2.la This give me an error message + sudo ldapadd -Y EXTERNAL -H ldapi:/// -f sha2.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 ldap_add: Other (e.g., implementation specific) error (80) additional info: <olcModuleLoad> handler exited with 1 adding new entry "cn=module{0},cn=config" The readme only describes how this used to work. I followed the readme for older version of OpenLDAP 2.4.23. This produces one file slapd-sha2.o exactly as described in the readme. I was able to install this module using this readme. Problem is that I need SSHA-512 which the older module does not support. Any tips or suggestions will be much appriacted Thanks and Regards, Onno On Fri, Aug 29, 2014 at 9:15 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, August 29, 2014 9:55 AM +0200 Ulrich Windl < > Ulrich.Windl(a)rz.uni-regensburg.de> wrote: > > Bram Cymet <bcymet(a)cbnco.com> schrieb am 28.08.2014 um 22:26 in >>>>> Nachricht >>>>> >>>> <53FF9080.1050209(a)cbnco.com>: >> >>> Hi, >>> >>> I am storing users passwords in a userPassword attribute. When the >>> passwords are hashed with MD5 I can bind as the user just fine. If I >>> hash the password with sha-256 I get invalid credentials. >>> >> >> I wonder: My slappasswd only knows about {SHA} and {SSHA}, {MD5} and >> {SMD5}, {CRYPT}, and {CLEARTEXT}. Section 14.4 of the manual indicates >> that hashed passwords are non-standard anyway. So implement the >> non-standard on your clients. >> > > It takes 5 seconds to look in the contrib directory shipped with the > source and find: > > SHA-2 OpenLDAP support > ---------------------- > > slapd-sha2.c provides support for SSHA-512, SSHA-384, SSHA-256, > SHA-512, SHA-384 and SHA-256 hashed passwords in OpenLDAP. For > instance, one could have the LDAP attribute: > > userPassword: {SHA512}vSsar3708Jvp9Szi2NWZZ02Bqp1qRC > FpbcTZPdBhnWgs5WtNZKnvCXdhztmeD2cmW192CF5bDufKRpayrW/isg== > > or: > > userPassword: {SHA384}WKd1ukESvjAFrkQHznV9iP2nHUBJe7 > gCbsrFTU4//HIyzo3jq1rLMK45dg/ufFPt > > or: > > userPassword: {SHA256}K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols= > > all of which encode the password 'secret'. > > (etc). As I already stated, there's a module for this. I use it on my > systems to add SSHA512 suport. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

1 0

LDAP wire protocol analysis with Wireshark
by Igor Shmukler 24 Nov '14

24 Nov '14

Hello, As per a suggestion by Andrew Findlay, I have been using Wireshark to debug my LDAP client. Specifically, at this time, I am working on simple paging results. One "issue" which I have noticed, is that searchResultsControl returned by both OpenLDAP and/or MS AD servers always has a size of 0. The cookie is returned according to the RFC 2696 specification, but size is not. Please advise what I am missing. Thank you, Igor Shmukler

1 0

main: TLS init def ctx failed: -1
by Hydro Tium 24 Nov '14

24 Nov '14

Hello, I'm trying to configure TLS but slapd won't even start: Here's my config: ################################################################################ # dynamic config file - global configuration entry ################################################################################ dn: cn=config objectClass: olcGlobal cn: config olcPidFile: /var/run/slapd/slapd.pid olcArgsFile: /var/run/slapd/slapd.args olcIdleTimeout: 7 olcLogLevel: conns filter stats none olcReferral: ldap://root.openldap.org olcTLSCACertificateFile: /etc/ldap/tls/cacert.pem olcTLSCertificateFile: /etc/ldap/tls/servercrt.pem olcTLSCertificateKeyFile: /etc/ldap/tls/serverkey.pem olcTLSVerifyClient: demand olcTLSRandFile: /dev/urandom ################################################################################ # modules loading ################################################################################ #dn: cn=module{0},cn=config #objectClass: olcModuleList #cn: module{0} #olcModulePath: /usr/lib/ldap #olcModuleLoad: back_hdb.la ################################################################################ # schema definitions ################################################################################ dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema ################################################################################ # include the schemas ################################################################################ include: file:///etc/ldap/schema/core.ldif include: file:///etc/ldap/schema/cosine.ldif include: file:///etc/ldap/schema/inetorgperson.ldif ################################################################################ # backend directives ################################################################################ dn: olcBackend=hdb,cn=config objectClass: olcBackendConfig olcBackend: hdb ################################################################################ # frontend database parameters ################################################################################ dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: frontend olcAccess: to * by * read olcReadOnly: FALSE ################################################################################ # config database parameters ################################################################################ dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: {SSHA}nHfi6O5OcjA0LG6gj2Gb7EDzBoGFPQtB olcAccess: to * by * none When I check the /var/log/debug messages the error in this email subject appears. I'm trying to start the service via the invoke-rc.d slapd start command, but all it returns is a failed status. Any clues with this? Thanks!

4 3

slapcat ldif backup
by Jerry 23 Nov '14

23 Nov '14

FreeBSD 10.1-RELEASE I reported this problem before. I am experiencing periodic backup failure with slapcat. I run it from CRON if that makes any difference. This is the exact failure message: 5471c421 mdb_db_open: database "dc=seibercom,dc=net" cannot be opened: No such file or directory (2). Restore from backup! 5471c421 backend_startup_one (type=mdb, suffix="dc=seibercom,dc=net"): bi_db_open failed! (2) slap_startup failed LDIF Backup Failed Exit Code: 0 I ran the slapcat command under "truss" and this is the output: mmap(0x0,32768,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34367242240 (0x800728000) issetugid(0x800928a20,0x7fffffffefc8,0x40,0x0,0xffff800800929a58,0x0) = 0 (0x0) lstat("/etc",{ mode=drwxr-xr-x ,inode=29614464,size=2560,blksize=32768 }) = 0 (0x0) lstat("/etc/libmap.conf",{ mode=-rw-r--r-- ,inode=29614965,size=109,blksize=32768 }) = 0 (0x0) open("/etc/libmap.conf",O_CLOEXEC,01760) = 3 (0x3) fstat(3,{ mode=-rw-r--r-- ,inode=29614965,size=109,blksize=32768 }) = 0 (0x0) mmap(0x0,109,PROT_READ,MAP_PRIVATE,3,0x0) = 34367275008 (0x800730000) close(3) = 0 (0x0) lstat("/usr",{ mode=drwxr-xr-x ,inode=37238784,size=512,blksize=32768 }) = 0 (0x0) lstat("/usr/local",{ mode=drwxr-xr-x ,inode=37238785,size=512,blksize=32768 }) = 0 (0x0) lstat("/usr/local/etc",{ mode=drwxr-xr-x ,inode=37569402,size=2560,blksize=32768 }) = 0 (0x0) lstat("/usr/local/etc/libmap.d",{ mode=drwxr-xr-x ,inode=803208,size=512,blksize=32768 }) = 0 (0x0) open("/usr/local/etc/libmap.d",O_NONBLOCK|O_DIRECTORY|O_CLOEXEC,0165) = 3 (0x3) __sysctl(0x7fffffffc948,0x2,0x80092964c,0x7fffffffc940,0x0,0x0) = 0 (0x0) fstatfs(0x3,0x7fffffffc968,0x80092964c,0x7fffffffc940,0x0,0x0) = 0 (0x0) getdirentries(0x3,0x80072e000,0x1000,0x80072d028,0x0,0x0) = 24 (0x18) getdirentries(0x3,0x80072e000,0x1000,0x80072d028,0x18,0x0) = 0 (0x0) close(3) = 0 (0x0) munmap(0x800730000,109) = 0 (0x0) mmap(0x0,36864,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34367275008 (0x800730000) access("/usr/local/lib/libldap_r-2.4.so.2",0) = 0 (0x0) open("/usr/local/lib/libldap_r-2.4.so.2",O_CLOEXEC,034607770) = 3 (0x3) fstat(3,{ mode=-rw-r--r-- ,inode=37570468,size=311864,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34367311872 (0x800739000) mmap(0x0,2416640,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34369347584 (0x80092a000) mmap(0x80092a000,303104,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34369347584 (0x80092a000) mmap(0x800b73000,12288,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x49000) = 34371743744 (0x800b73000) mmap(0x800b76000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34371756032 (0x800b76000) munmap(0x800739000,4096) = 0 (0x0) close(3) = 0 (0x0) access("/usr/local/lib/liblber-2.4.so.2",0) = 0 (0x0) open("/usr/local/lib/liblber-2.4.so.2",O_CLOEXEC,034607770) = 3 (0x3) fstat(3,{ mode=-rw-r--r-- ,inode=37567810,size=58320,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34367311872 (0x800739000) mmap(0x0,2154496,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34371764224 (0x800b78000) mmap(0x800b78000,57344,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34371764224 (0x800b78000) mmap(0x800d85000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0xd000) = 34373914624 (0x800d85000) munmap(0x800739000,4096) = 0 (0x0) close(3) = 0 (0x0) access("/usr/local/lib/libltdl.so.7",0) = 0 (0x0) open("/usr/local/lib/libltdl.so.7",O_CLOEXEC,034607770) = 3 (0x3) fstat(3,{ mode=-rwxr-xr-x ,inode=37570220,size=37304,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34367311872 (0x800739000) mmap(0x0,2134016,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34373918720 (0x800d86000) mmap(0x800d86000,36864,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34373918720 (0x800d86000) mmap(0x800f8e000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x8000) = 34376048640 (0x800f8e000) munmap(0x800739000,4096) = 0 (0x0) close(3) = 0 (0x0) access("/usr/local/lib/libcrypt.so.5",0) ERR#2 'No such file or directory' open("/var/run/ld-elf.so.hints",O_CLOEXEC,034607770) = 3 (0x3) read(3,"Ehnt\^A\0\0\0\M^@\0\0\0M\^A\0\0"...,128) = 128 (0x80) lseek(3,0x80,SEEK_SET) = 128 (0x80) read(3,"/lib:/usr/lib:/usr/lib/compat:/u"...,333) = 333 (0x14d) close(3) = 0 (0x0) access("/lib/libcrypt.so.5",0) = 0 (0x0) open("/lib/libcrypt.so.5",O_CLOEXEC,034607770) = 3 (0x3) fstat(3,{ mode=-r--r--r-- ,inode=9871558,size=62040,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34367311872 (0x800739000) mmap(0x0,2228224,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34376052736 (0x800f8f000) mmap(0x800f8f000,57344,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34376052736 (0x800f8f000) mmap(0x80119d000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0xe000) = 34378207232 (0x80119d000) mmap(0x80119e000,69632,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34378211328 (0x80119e000) munmap(0x800739000,4096) = 0 (0x0) close(3) = 0 (0x0) access("/usr/local/lib/libssl.so.8",0) = 0 (0x0) open("/usr/local/lib/libssl.so.8",O_CLOEXEC,034607770) = 3 (0x3) fstat(3,{ mode=-rw-r--r-- ,inode=37562291,size=479367,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34367311872 (0x800739000) mmap(0x0,2527232,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34378280960 (0x8011af000) mmap(0x8011af000,393216,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34378280960 (0x8011af000) mmap(0x80140e000,40960,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x5f000) = 34380767232 (0x80140e000) munmap(0x800739000,4096) = 0 (0x0) close(3) = 0 (0x0) access("/usr/local/lib/libcrypto.so.8",0) = 0 (0x0) open("/usr/local/lib/libcrypto.so.8",O_CLOEXEC,034607770) = 3 (0x3) fstat(3,{ mode=-rw-r--r-- ,inode=37560373,size=2390484,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34367311872 (0x800739000) mmap(0x0,4222976,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34380808192 (0x801418000) mmap(0x801418000,1966080,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34380808192 (0x801418000) mmap(0x8017f8000,147456,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x1e0000) = 34384871424 (0x8017f8000) mmap(0x80181c000,12288,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34385018880 (0x80181c000) munmap(0x800739000,4096) = 0 (0x0) close(3) = 0 (0x0) access("/usr/local/lib/libthr.so.3",0) ERR#2 'No such file or directory' access("/lib/libthr.so.3",0) = 0 (0x0) open("/lib/libthr.so.3",O_CLOEXEC,034607770) = 3 (0x3) fstat(3,{ mode=-r--r--r-- ,inode=9871581,size=105248,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34367311872 (0x800739000) mmap(0x0,2248704,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34385031168 (0x80181f000) mmap(0x80181f000,102400,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34385031168 (0x80181f000) mmap(0x801a37000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x18000) = 34387226624 (0x801a37000) mmap(0x801a39000,45056,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34387234816 (0x801a39000) munmap(0x800739000,4096) = 0 (0x0) close(3) = 0 (0x0) access("/usr/local/lib/libc.so.7",0) ERR#2 'No such file or directory' access("/lib/libc.so.7",0) = 0 (0x0) open("/lib/libc.so.7",O_CLOEXEC,034607770) = 3 (0x3) fstat(3,{ mode=-r--r--r-- ,inode=9871556,size=1631216,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34367311872 (0x800739000) mmap(0x0,3837952,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34387279872 (0x801a44000) mmap(0x801a44000,1523712,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34387279872 (0x801a44000) mmap(0x801db7000,53248,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x173000) = 34390896640 (0x801db7000) mmap(0x801dc4000,167936,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34390949888 (0x801dc4000) munmap(0x800739000,4096) = 0 (0x0) close(3) = 0 (0x0) munmap(0x800736000,12288) = 0 (0x0) mmap(0x0,53248,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34367299584 (0x800736000) munmap(0x80073f000,16384) = 0 (0x0) mmap(0x0,102400,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34367336448 (0x80073f000) sysarch(0x81,0x7fffffffd8c8,0x4,0x0,0xfffffffffe97b5c0,0x8080808080808080) = 0 (0x0) __sysctl(0x7fffffffd8a8,0x2,0x7fffffffd890,0x7fffffffd888,0x0,0x0) = 0 (0x0) getrlimit(RLIMIT_STACK,{ cur=536870912,max=536870912 }) = 0 (0x0) mprotect(0x7fffdffff000,536870912,PROT_READ|PROT_WRITE|PROT_EXEC) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) readlink("/etc/malloc.conf",0x7fffffffcff0,1024) ERR#2 'No such file or directory' issetugid(0x801b8f53e,0x7fffffffcff0,0xffffffffffffffff,0x2,0x40,0x0) = 0 (0x0) mmap(0x0,4194304,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34391117824 (0x801ded000) munmap(0x801ded000,4194304) = 0 (0x0) mmap(0x0,8384512,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34391117824 (0x801ded000) munmap(0x801ded000,2174976) = 0 (0x0) munmap(0x802400000,2015232) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) getpid() = 28705 (0x7021) __sysctl(0x7fffffffd400,0x2,0x801a438a0,0x7fffffffd408,0x0,0x0) = 0 (0x0) __sysctl(0x7fffffffd320,0x2,0x7fffffffd360,0x7fffffffd358,0x801833f6d,0xd) = 0 (0x0) __sysctl(0x7fffffffd360,0x3,0x801a4232c,0x7fffffffd408,0x0,0x0) = 0 (0x0) mmap(0x0,4194304,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34397487104 (0x802400000) thr_self(0x802406400,0x1,0x0,0x800733530,0x40,0x802416010) = 0 (0x0) mmap(0x7fffffbfe000,4096,PROT_NONE,MAP_ANON,-1,0x0) = 140737484152832 (0x7fffffbfe000) rtprio_thread(0x0,0x18b01,0x7fffffffd3d8,0x400000,0xffffffff,0x0) = 0 (0x0) sysarch(0x81,0x7fffffffd3e8,0x801a41f00,0x0,0xffffffff,0x0) = 0 (0x0) sigaction(32,{ 0x80182cae0 SA_SIGINFO ss_t },0x0) = 0 (0x0) sigprocmask(SIG_UNBLOCK,0x0,0x0) = 0 (0x0) _umtx_op(0x7fffffffd398,0x3,0x1,0x0,0x0,0x0) = 0 (0x0) mprotect(0x0,0,PROT_NONE) = 0 (0x0) getpid() = 28705 (0x7021) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGILL|SIGTRAP|SIGABRT|SIGEMT|SIGFPE|SIGKILL|SIGBUS|SIGSEGV|SIGSYS|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) open("/usr/home/gerard/LDAP_Backup/seibercom.net.ldif",O_WRONLY|O_CREAT|O_TRUNC,0666) = 3 (0x3) madvise(0x802446000,0x4000,0x5,0xaaaaaaaaaaaaaaab,0x7fffffffc6d0,0x801debbe0) = 0 (0x0) madvise(0x80244d000,0x2000,0x5,0xaaaaaaaaaaaaaaab,0x7fffffffc6d0,0x801debbe0) = 0 (0x0) madvise(0x802453000,0x2000,0x5,0xaaaaaaaaaaaaaaab,0x7fffffffc6d0,0x801debbe0) = 0 (0x0) madvise(0x80245a000,0x2000,0x5,0xaaaaaaaaaaaaaaab,0x7fffffffc6d0,0x801debbe0) = 0 (0x0) madvise(0x80246a000,0x1000,0x5,0xaaaaaaaaaaaaaaab,0x7fffffffc6d0,0x801debbe0) = 0 (0x0) stat("/usr/local/etc/openldap/slapd.conf",{ mode=-rw------- ,inode=37883465,size=2382,blksize=32768 }) = 0 (0x0) open("/usr/local/etc/openldap/slapd.conf",O_RDONLY,0666) = 4 (0x4) fstat(4,{ mode=-rw------- ,inode=37883465,size=2382,blksize=32768 }) = 0 (0x0) read(4,"#\n# See slapd.conf(5) for detai"...,32768) = 2382 (0x94e) stat("/usr/local/etc/openldap/schema/core.schema",{ mode=-rw-r--r-- ,inode=34109613,size=20499,blksize=32768 }) = 0 (0x0) open("/usr/local/etc/openldap/schema/core.schema",O_RDONLY,0666) = 5 (0x5) fstat(5,{ mode=-rw-r--r-- ,inode=34109613,size=20499,blksize=32768 }) = 0 (0x0) read(5,"# OpenLDAP Core schema\n# $OpenL"...,32768) = 20499 (0x5013) read(5,0x802497000,32768) = 0 (0x0) close(5) = 0 (0x0) stat("/usr/local/etc/openldap/schema/cosine.schema",{ mode=-rw-r--r-- ,inode=34109614,size=73994,blksize=32768 }) = 0 (0x0) open("/usr/local/etc/openldap/schema/cosine.schema",O_RDONLY,0666) = 5 (0x5) fstat(5,{ mode=-rw-r--r-- ,inode=34109614,size=73994,blksize=32768 }) = 0 (0x0) read(5,"# RFC1274: Cosine and Internet X"...,32768) = 32768 (0x8000) read(5,"#\n# This section attempts to f"...,32768) = 32768 (0x8000) read(5,"uteType 7}\n#\n#\n# userClass"...,32768) = 8458 (0x210a) read(5,0x802495000,32768) = 0 (0x0) close(5) = 0 (0x0) stat("/usr/local/etc/openldap/schema/inetorgperson.schema",{ mode=-rw-r--r-- ,inode=34109617,size=6267,blksize=32768 }) = 0 (0x0) open("/usr/local/etc/openldap/schema/inetorgperson.schema",O_RDONLY,0666) = 5 (0x5) fstat(5,{ mode=-rw-r--r-- ,inode=34109617,size=6267,blksize=32768 }) = 0 (0x0) read(5,"# inetorgperson.schema -- InetOr"...,32768) = 6267 (0x187b) read(5,0x802495000,32768) = 0 (0x0) close(5) = 0 (0x0) stat("/usr/local/etc/openldap/schema/nis.schema",{ mode=-rw-r--r-- ,inode=34109620,size=7640,blksize=32768 }) = 0 (0x0) open("/usr/local/etc/openldap/schema/nis.schema",O_RDONLY,0666) = 5 (0x5) fstat(5,{ mode=-rw-r--r-- ,inode=34109620,size=7640,blksize=32768 }) = 0 (0x0) read(5,"# $OpenLDAP$\n## This work is pa"...,32768) = 7640 (0x1dd8) read(5,0x802495000,32768) = 0 (0x0) close(5) = 0 (0x0) open("/usr/local/libexec/openldap/back_mdb.la",O_RDONLY,0666) = 5 (0x5) fstat(5,{ mode=-rwxr-xr-x ,inode=34109609,size=827,blksize=32768 }) = 0 (0x0) read(5,"# back_mdb.la - a libtool librar"...,32768) = 827 (0x33b) read(5,0x802495000,32768) = 0 (0x0) close(5) = 0 (0x0) open("/usr/local/libexec/openldap/back_mdb-2.4.so.2",O_CLOEXEC,056) = 5 (0x5) fstat(5,{ mode=-rwxr-xr-x ,inode=34109608,size=232288,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,5,0x0) = 34367438848 (0x800758000) mmap(0x0,2428928,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34401681408 (0x802800000) mmap(0x802800000,225280,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,5,0x0) = 34401681408 (0x802800000) mmap(0x802a37000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,5,0x37000) = 34404003840 (0x802a37000) mmap(0x802a39000,98304,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34404012032 (0x802a39000) munmap(0x800758000,4096) = 0 (0x0) close(5) = 0 (0x0) open("/var/db/openldap-data/DUMMY",O_WRONLY|O_CREAT|O_TRUNC,0666) = 5 (0x5) close(5) = 0 (0x0) unlink("/var/db/openldap-data/DUMMY") = 0 (0x0) read(4,0x80248d000,32768) = 0 (0x0) close(4) = 0 (0x0) stat("/var/db/openldap-data",{ mode=drwx------ ,inode=22311219,size=512,blksize=32768 }) = 0 (0x0) getpid() = 28705 (0x7021) __sysctl(0x7fffffffdc38,0x2,0x7fffffffdc34,0x7fffffffdc40,0x0,0x0) = 0 (0x0) open("/var/db/openldap-data/data.mdb",O_RDONLY,00) = 4 (0x4) open("/var/db/openldap-data/lock.mdb",O_RDWR|O_CREAT|O_CLOEXEC,0600) = 5 (0x5) fcntl(5,F_SETLK,0x7fffffffd9d0) ERR#35 'Resource temporarily unavailable' fcntl(5,F_SETLKW,0x7fffffffd9d0) = 0 (0x0) lseek(5,0x0,SEEK_END) = 8192 (0x2000) mmap(0x0,8192,PROT_READ|PROT_WRITE,MAP_SHARED,5,0x0) = 34367438848 (0x800758000) open("/tmp/SEMDMDBr?Nu;oi>KeQ",O_RDWR|O_EXLOCK|O_CLOEXEC,027) ERR#2 'No such file or directory' close(4) = 0 (0x0) munmap(0x800758000,8192) = 0 (0x0) close(5) = 0 (0x0) stat("/usr/share/nls/C/libc.cat",0x7fffffffd758) ERR#2 'No such file or directory' stat("/usr/share/nls/libc/C",0x7fffffffd758) ERR#2 'No such file or directory' stat("/usr/local/share/nls/C/libc.cat",0x7fffffffd758) ERR#2 'No such file or directory' stat("/usr/local/share/nls/libc/C",0x7fffffffd758) ERR#2 'No such file or directory' clock_gettime(13,{1416741752.000000000 }) = 0 (0x0) write(2,"5471c378 mdb_db_open: database ""...,123) = 123 (0x7b) clock_gettime(13,{1416741752.000000000 }) = 0 (0x0) write(2,"5471c378 backend_startup_one (ty"...,94) = 94 (0x5e) write(2,"slap_startup failed\n",20) = 20 (0x14) process exit, rval = 1 Now, if I restart slapd, and I did check and it was running, everything will work fine, at least for awhile. I can supply the "truss" output of a successful run if desired. -- Jerry

2 1

Can't contact LDAP server (-1) additional info: error:14077410:SSL routines :SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
by wailok tam 22 Nov '14

22 Nov '14

Hi, can anyone help me with the error given in the title when entering the following command: ldapmodify -x -W -D 'cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp' Enter LDAP Password: ldap_bind: Can't contact LDAP server (-1) additional info: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure Access by the dovecot user is also blocked and all mails stop...Thanks in advace. Below is the slapd conf file: ### configuration for IER ### writeen by T.Tanaka ### edited by WL.Tam include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=ier,dc=hit-u,dc=ac,dc=jp" rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" rootpw ier2009 directory /var/lib/ldap overlay syncprov syncprov-checkpoint 50 10 syncprov-sessionlog 100 # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq idlcachesize 1000 access to attrs=userPassword by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by anonymous auth by * none access to attrs=SambaLMPassword,SambaNTPassword by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by self read by anonymous auth by * none access to * by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by * read

3 2

slapd read_config / interface bind errors
by Jason Swank 20 Nov '14

20 Nov '14

Hi, We updated from 2.4.23 to 2.4.39 and ran into the following issues around specifying listen interfaces for slapd. We run an n-way multi-master configuration. It appears as if a specific interface needs to be specified in order to start slapd, and using a specific interface is prevented by a binding to all interfaces. Is this expected behavior, or a bug? Running slapd as below results in an error: $ /usr/sbin/slapd -d 1 -h "ldap:// ldapi://" -u ldap ... 546cfa04 read_config: no serverID / URL match found. Check slapd -h arguments. 546cfa04 slapd destroy: freeing system resources. 546cfa04 syncinfo_free: rid=001 546cfa04 syncinfo_free: rid=001 546cfa04 slapd stopped. 546cfa04 connections_destroy: nothing to destroy. Specifying the hostname of this ldap server (ldap02) addresses the error, but introduces another- the listener can't be started since it conflicts with the INADDR_ANY interface definition "ldap://": $ /usr/sbin/slapd -d 1 -h "ldap:// ldapi:// ldap://ldap02" -u ldap ... 546cfb52 slapd starting 546cfb53 daemon: listen(ldap://ldap02, 5) failed errno=98 (Address already in use) 546cfb53 slapd shutdown: initiated 546cfb53 ====> bdb_cache_release_all 546cfb53 slapd destroy: freeing system resources. 546cfb53 syncinfo_free: rid=001 546cfb53 syncinfo_free: rid=001 546cfb53 slapd stopped. Removing the binding to INADDR_ANY (ldap://) allows slapd to be started: $ /usr/sbin/slapd -d 1 -h "ldapi:// ldap://ldap02" -u ldap Thanks, Jason

4 5

any help on "ldap_sasl_bind_s failed (53)"
by wailok tam 20 Nov '14

20 Nov '14

Hi, I am new to ldap. I am following the book "Mastering Openldap" to set up replication but I am getting the error given in the title when I start the slave with "splad -d sync" . Replication does not work. ****************************************************************************************************** slapd.conf of the Master: include /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/samba.schema #modulepath /usr/lib/openldap#moduleload syncprov.la # Allow LDAPv2 client connections. This is NOT the default.allow bind_v2 # Do not enable referrals until AFTER you have a working directory# service AND an understanding of referrals.#referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pidargsfile /var/run/openldap/slapd.args #sasl-realm ier.hit-u.ac.jp#sasl-host localhost#authz-regexp uid=([^,]*),cn=ier.hit-u.ac.jp,cn=DIGEST-MD5,cn=auth cn=$1,dc=ier,dc=hit-u,dc=ac,dc=jp ######################################################################## ldbm and/or bdb database definitions####################################################################### database bdbsuffix "dc=ier,dc=hit-u,dc=ac,dc=jp"rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp"#rootpw {MD5}x1Ktlhm0p7RPnl/G01rhTQ==rootpw secret#password-hash {MD5}directory /var/lib/ldap TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crtTLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crtTLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key overlay syncprovsyncprov-checkpoint 50 10syncprov-sessionlog 100 # Indices to maintain for this databaseindex objectClass eq,presindex ou,cn,mail,surname,givenname eq,pres,subindex uidNumber,gidNumber,loginShell eq,presindex uid,memberUid eq,pres,subindex nisMapName,nisMapEntry eq,pres,subindex entryCSN,entryUUID eq idlcachesize 1000 access to attrs=userPassword by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by anonymous auth by * none access to attrs=SambaLMPassword,SambaNTPassword by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by self read by anonymous auth by * none access to * by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by * read ***************************************************************************************************** sladp.conf of the slave: include /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default.allow bind_v2 # Do not enable referrals until AFTER you have a working directory# service AND an understanding of referrals.#referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pidargsfile /var/run/openldap/slapd.args ######################################################################## ldbm and/or bdb database definitions####################################################################### database bdbsuffix "dc=ier,dc=hit-u,dc=ac,dc=jp"#rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp"rootdn "cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp"#rootpw {MD5}x1Ktlhm0p7RPnl/G01rhTQ==rootpw secretofreplicator #password-hash {MD5}directory /var/lib/ldap#TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crt#TLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt#TLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key # Replicas of this database#updatedn cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp#updateref uri=ldap://192.168.84.22 # Indices to maintain for this databaseindex objectClass eq,presindex ou,cn,mail,surname,givenname eq,pres,subindex uidNumber,gidNumber,loginShell eq,presindex uid,memberUid eq,pres,subindex nisMapName,nisMapEntry eq,pres,subindex entryCSN,entryUUID eq idlcachesize 1000 #access to attrs=userPassword# by dn="cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" write# by self write# by anonymous auth# by * none #access to * # by dn="cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" write# by self write# by * read #loglevel stats sync syncrepl rid=001 provider=ldap://mail.ier.hit-u.ac.jp type=refreshAndPersist interval=00:00:05:00 searchbase="dc=ier,dc=hit-u,dc=ac,dc=jp" binddn="uid=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" bindmethod=simple# bindmethod=sasl saslmech=DIGEST-MD5# authcid=replicator credentials=secretofreplicator updateref ldap://mail.ier.hit-u.ac.jp/ *****************************************************************************************what puzzles me is that: I try on the slave to access the master withldapsearch -x -H ldap://mail.ier.hit-u.ac.jp -W -D 'cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp' '(uid=someone)' and it works. What is wrong? I really need your help.

5 7

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical