openldap-technical

openldap-technical@openldap.org

3 participants
9990 discussions

Can't contact LDAP server (-1) additional info: error:14077410:SSL routines :SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
by wailok tam 22 Nov '14

22 Nov '14

Hi, can anyone help me with the error given in the title when entering the following command: ldapmodify -x -W -D 'cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp' Enter LDAP Password: ldap_bind: Can't contact LDAP server (-1) additional info: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure Access by the dovecot user is also blocked and all mails stop...Thanks in advace. Below is the slapd conf file: ### configuration for IER ### writeen by T.Tanaka ### edited by WL.Tam include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=ier,dc=hit-u,dc=ac,dc=jp" rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" rootpw ier2009 directory /var/lib/ldap overlay syncprov syncprov-checkpoint 50 10 syncprov-sessionlog 100 # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq idlcachesize 1000 access to attrs=userPassword by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by anonymous auth by * none access to attrs=SambaLMPassword,SambaNTPassword by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by self read by anonymous auth by * none access to * by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by * read

3 2

slapd read_config / interface bind errors
by Jason Swank 20 Nov '14

20 Nov '14

Hi, We updated from 2.4.23 to 2.4.39 and ran into the following issues around specifying listen interfaces for slapd. We run an n-way multi-master configuration. It appears as if a specific interface needs to be specified in order to start slapd, and using a specific interface is prevented by a binding to all interfaces. Is this expected behavior, or a bug? Running slapd as below results in an error: $ /usr/sbin/slapd -d 1 -h "ldap:// ldapi://" -u ldap ... 546cfa04 read_config: no serverID / URL match found. Check slapd -h arguments. 546cfa04 slapd destroy: freeing system resources. 546cfa04 syncinfo_free: rid=001 546cfa04 syncinfo_free: rid=001 546cfa04 slapd stopped. 546cfa04 connections_destroy: nothing to destroy. Specifying the hostname of this ldap server (ldap02) addresses the error, but introduces another- the listener can't be started since it conflicts with the INADDR_ANY interface definition "ldap://": $ /usr/sbin/slapd -d 1 -h "ldap:// ldapi:// ldap://ldap02" -u ldap ... 546cfb52 slapd starting 546cfb53 daemon: listen(ldap://ldap02, 5) failed errno=98 (Address already in use) 546cfb53 slapd shutdown: initiated 546cfb53 ====> bdb_cache_release_all 546cfb53 slapd destroy: freeing system resources. 546cfb53 syncinfo_free: rid=001 546cfb53 syncinfo_free: rid=001 546cfb53 slapd stopped. Removing the binding to INADDR_ANY (ldap://) allows slapd to be started: $ /usr/sbin/slapd -d 1 -h "ldapi:// ldap://ldap02" -u ldap Thanks, Jason

4 5

any help on "ldap_sasl_bind_s failed (53)"
by wailok tam 20 Nov '14

20 Nov '14

Hi, I am new to ldap. I am following the book "Mastering Openldap" to set up replication but I am getting the error given in the title when I start the slave with "splad -d sync" . Replication does not work. ****************************************************************************************************** slapd.conf of the Master: include /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/samba.schema #modulepath /usr/lib/openldap#moduleload syncprov.la # Allow LDAPv2 client connections. This is NOT the default.allow bind_v2 # Do not enable referrals until AFTER you have a working directory# service AND an understanding of referrals.#referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pidargsfile /var/run/openldap/slapd.args #sasl-realm ier.hit-u.ac.jp#sasl-host localhost#authz-regexp uid=([^,]*),cn=ier.hit-u.ac.jp,cn=DIGEST-MD5,cn=auth cn=$1,dc=ier,dc=hit-u,dc=ac,dc=jp ######################################################################## ldbm and/or bdb database definitions####################################################################### database bdbsuffix "dc=ier,dc=hit-u,dc=ac,dc=jp"rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp"#rootpw {MD5}x1Ktlhm0p7RPnl/G01rhTQ==rootpw secret#password-hash {MD5}directory /var/lib/ldap TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crtTLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crtTLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key overlay syncprovsyncprov-checkpoint 50 10syncprov-sessionlog 100 # Indices to maintain for this databaseindex objectClass eq,presindex ou,cn,mail,surname,givenname eq,pres,subindex uidNumber,gidNumber,loginShell eq,presindex uid,memberUid eq,pres,subindex nisMapName,nisMapEntry eq,pres,subindex entryCSN,entryUUID eq idlcachesize 1000 access to attrs=userPassword by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by anonymous auth by * none access to attrs=SambaLMPassword,SambaNTPassword by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by self read by anonymous auth by * none access to * by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by * read ***************************************************************************************************** sladp.conf of the slave: include /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default.allow bind_v2 # Do not enable referrals until AFTER you have a working directory# service AND an understanding of referrals.#referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pidargsfile /var/run/openldap/slapd.args ######################################################################## ldbm and/or bdb database definitions####################################################################### database bdbsuffix "dc=ier,dc=hit-u,dc=ac,dc=jp"#rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp"rootdn "cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp"#rootpw {MD5}x1Ktlhm0p7RPnl/G01rhTQ==rootpw secretofreplicator #password-hash {MD5}directory /var/lib/ldap#TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crt#TLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt#TLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key # Replicas of this database#updatedn cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp#updateref uri=ldap://192.168.84.22 # Indices to maintain for this databaseindex objectClass eq,presindex ou,cn,mail,surname,givenname eq,pres,subindex uidNumber,gidNumber,loginShell eq,presindex uid,memberUid eq,pres,subindex nisMapName,nisMapEntry eq,pres,subindex entryCSN,entryUUID eq idlcachesize 1000 #access to attrs=userPassword# by dn="cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" write# by self write# by anonymous auth# by * none #access to * # by dn="cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" write# by self write# by * read #loglevel stats sync syncrepl rid=001 provider=ldap://mail.ier.hit-u.ac.jp type=refreshAndPersist interval=00:00:05:00 searchbase="dc=ier,dc=hit-u,dc=ac,dc=jp" binddn="uid=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" bindmethod=simple# bindmethod=sasl saslmech=DIGEST-MD5# authcid=replicator credentials=secretofreplicator updateref ldap://mail.ier.hit-u.ac.jp/ *****************************************************************************************what puzzles me is that: I try on the slave to access the master withldapsearch -x -H ldap://mail.ier.hit-u.ac.jp -W -D 'cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp' '(uid=someone)' and it works. What is wrong? I really need your help.

5 7

debugging OpenLDAP client
by Igor Shmukler 19 Nov '14

19 Nov '14

Hello, I wrote a client to make RFC 2696 (paged results) requests. My client gets results fine, yet size and cookie values are always 0, "" - this should not be the case. I tried with ldapsearch(1) and it does paging fine. Hence, it makes sense to assume that the server is OK and opaque/cookie must not be empty. At the same time, format of my ASN object is fine. I need to understand where exactly, I messed up. In order to debug this, I added a logging LDIF and set debug to -1 any. It shows quite a lot of information, but I did not notice size and cookie values being dumped into syslog(3). Is there a way to have separate values that go into the packets printed out? I see that there is an option for BER 0x10 and parse 0x800 as well as others. Thank you, Igor Shmukler

4 8

make test failure due to libsasl2.so.3 not found
by Guruprasad Kulkarni 19 Nov '14

19 Nov '14

I am using ubuntu 12.04.5 LTS I installed cyrus-sasl-2.1.26 (created symlink from /usr/lib/sasl2 to /usr/local/lib/sasl2) I used the following options for configuration: --enable-debug --enable-hdb --enable-ppolicy --enable-syncprov --with-cyrus-sasl Configuration, make depend and make were successful. I then proceeded to "make test" and I got the error: ../clients/tools/ldapsearch: error while loading shared libraries: libsasl2.so.3: cannot open shared object file: No such file or directory The file libsasl2.so.3 is present in /usr/local/lib I set LDFLAGS="-L/usr/local/lib -L/usr/local/lib/sasl2" Do I need to set some other flags to make the tests work? -Guruprasad

3 3

Re: any help on "ldap_sasl_bind_s failed (53)"
by wailok tam 19 Nov '14

19 Nov '14

thx for your reply. do i put in the slave conf file the same thing as the following command? > ldapsearch -x -H ldap://mail.ier.hit-u.ac.jp -W -D > 'cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp' '(uid=someone)' ------------------------------ On Wed, Nov 19, 2014 9:25 AM GMT Jephte Clain wrote: >hello, > >I would say, try to understand the meaning of what you do. The >openldap admin guide is a good place to start. > >- for instance, on the slave, you bind to the master with dn >uid=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp and password >secretofreplicator >does this objet exist *on the master*? with the right password? does >this account have the right acl to read everything on the master >(i.e., on the master, the acl is defined for cn=replicator,... which >is not the same as uid=replicator,...) >- also, why would you use the replicator dn as the rootdn for the slave? > >one last thing: I advise you change the password of both the master >and slave. posting the file with the hash password of the root dn on >the internet is not a good idea :-) > >good luck > > >2014-11-19 11:38 GMT+04:00 wailok tam <wailoktam(a)yahoo.com>: >> Hi, I am new to ldap. I am following the book "Mastering Openldap" to set up >> replication >> but I am getting the error given in the title when I start the slave with >> "splad -d sync" . Replication does >> not work. >> >> ****************************************************************************************************** >> >> slapd.conf of the Master: >> >> include /etc/openldap/schema/core.schema >> include /etc/openldap/schema/cosine.schema >> include /etc/openldap/schema/inetorgperson.schema >> include /etc/openldap/schema/nis.schema >> include /etc/openldap/schema/samba.schema >> >> >> #modulepath /usr/lib/openldap >> #moduleload syncprov.la >> >> # Allow LDAPv2 client connections. This is NOT the default. >> allow bind_v2 >> >> # Do not enable referrals until AFTER you have a working directory >> # service AND an understanding of referrals. >> #referral ldap://root.openldap.org >> >> pidfile /var/run/openldap/slapd.pid >> argsfile /var/run/openldap/slapd.args >> >> #sasl-realm ier.hit-u.ac.jp >> #sasl-host localhost >> #authz-regexp uid=([^,]*),cn=ier.hit-u.ac.jp,cn=DIGEST-MD5,cn=auth >> cn=$1,dc=ier,dc=hit-u,dc=ac,dc=jp >> >> ####################################################################### >> # ldbm and/or bdb database definitions >> ####################################################################### >> >> database bdb >> suffix "dc=ier,dc=hit-u,dc=ac,dc=jp" >> rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" >> #rootpw {MD5}x1Ktlhm0p7RPnl/G01rhTQ== >> rootpw secret >> #password-hash {MD5} >> directory /var/lib/ldap >> >> TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crt >> TLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt >> TLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key >> >> overlay syncprov >> syncprov-checkpoint 50 10 >> syncprov-sessionlog 100 >> >> # Indices to maintain for this database >> index objectClass eq,pres >> index ou,cn,mail,surname,givenname eq,pres,sub >> index uidNumber,gidNumber,loginShell eq,pres >> index uid,memberUid eq,pres,sub >> index nisMapName,nisMapEntry eq,pres,sub >> index entryCSN,entryUUID eq >> idlcachesize 1000 >> >> >> access to attrs=userPassword >> by self write >> by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by anonymous auth >> by * none >> >> >> >> access to attrs=SambaLMPassword,SambaNTPassword >> by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by self read >> by anonymous auth >> by * none >> >> access to * >> by self write >> by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by * read >> >> ***************************************************************************************************** >> >> sladp.conf of the slave: >> >> include /etc/openldap/schema/core.schema >> include /etc/openldap/schema/cosine.schema >> include /etc/openldap/schema/inetorgperson.schema >> include /etc/openldap/schema/nis.schema >> include /etc/openldap/schema/samba.schema >> >> # Allow LDAPv2 client connections. This is NOT the default. >> allow bind_v2 >> >> # Do not enable referrals until AFTER you have a working directory >> # service AND an understanding of referrals. >> #referral ldap://root.openldap.org >> >> pidfile /var/run/openldap/slapd.pid >> argsfile /var/run/openldap/slapd.args >> >> ####################################################################### >> # ldbm and/or bdb database definitions >> ####################################################################### >> >> database bdb >> suffix "dc=ier,dc=hit-u,dc=ac,dc=jp" >> #rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" >> rootdn "cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" >> #rootpw {MD5}x1Ktlhm0p7RPnl/G01rhTQ== >> rootpw secretofreplicator >> #password-hash {MD5} >> directory /var/lib/ldap >> #TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crt >> #TLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt >> #TLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key >> >> >> # Replicas of this database >> #updatedn cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp >> #updateref uri=ldap://192.168.84.22 >> >> # Indices to maintain for this database >> index objectClass eq,pres >> index ou,cn,mail,surname,givenname eq,pres,sub >> index uidNumber,gidNumber,loginShell eq,pres >> index uid,memberUid eq,pres,sub >> index nisMapName,nisMapEntry eq,pres,sub >> index entryCSN,entryUUID eq >> idlcachesize 1000 >> >> >> #access to attrs=userPassword >> # by dn="cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> # by self write >> # by anonymous auth >> # by * none >> >> >> #access to * >> # by dn="cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> # by self write >> # by * read >> >> >> >> >> #loglevel stats sync >> >> syncrepl rid=001 >> provider=ldap://mail.ier.hit-u.ac.jp >> type=refreshAndPersist >> interval=00:00:05:00 >> searchbase="dc=ier,dc=hit-u,dc=ac,dc=jp" >> binddn="uid=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" >> bindmethod=simple >> # bindmethod=sasl saslmech=DIGEST-MD5 >> # authcid=replicator >> credentials=secretofreplicator >> >> updateref ldap://mail.ier.hit-u.ac.jp/ >> >> >> ***************************************************************************************** >> what puzzles me is that: >> >> I try on the slave to access the master with >> ldapsearch -x -H ldap://mail.ier.hit-u.ac.jp -W -D >> 'cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp' '(uid=someone)' >> >> and it works. >> >> What is wrong? I really need your help. >> >> > > > >-- >cordialement, >Jephté Clain >Direction des Systèmes d'Information >et des Usages Numériques - 2IG >Tél. 0262 93 86 31 >Fax. 0262 93 81 06 >

2 1

openldap 2.4.40 with cyrus sasl 2.1.26 on ubuntu 12.04lts
by Guruprasad Kulkarni 15 Nov '14

15 Nov '14

Hi, I am using ubuntu 12.04lts I installed cyrus sasl version 2.1.26 using the following steps: ./configure --disable-digest --without-saslauthd make make install I had to use the option without-saslauthd, otherwise it would fail. Now I tried to install openldap 2.4.40 with the following options ./configure --enable-hdb --enable-ppolicy --enable-syncprov --with-cyrus-sasl During make test, I get the error: ../clients/tools/ldapsearch: error while loading shared libraries: libsasl2.so.3: cannot open shared object file: No such file or directory Do I need to use the option --with-saslauthd while installing cyrus sasl to be able to use --with-cyrus-sasl option while installing openldap? -Guruprasad

4 5

ldapsearch and ldappasswd, one can't find user account.
by Grant Schoep 14 Nov '14

14 Nov '14

So I am trying to setup a command line script to simply changing users passwords. I know there are Perl modules and the like, but right now I just want to try to use ldapsearch and ldappasswd. >From my workstation(just a client of the LDAP server). ldapsearch is working fine. When I run ldapsearch -x -H ldaps://blah.blah:#### -W -D uid=mradmin,ou=service-accounts,ou=taco,dc=bell,dc=com -b ou=taco,dc=bell,dc=com "(&(cn=*)(uid=testuser))" This returns info. Looking at those results, it returned what I think I was looking for ... dc: uid=testuser,ou=people,ou=taco,dc=bell,dc=com ... So I then ran. ldappasswd -x -H ldaps://blah.blah:#### -D "uid=mradmin,ou=service-accounts,ou=taco,dc=bell,dc=com" -W "uid=testuser,ou=people,ou=taco,dc=bell,dc=com" And I get the following error Result: No such object (32) Additional info: Error in search for entry "oid=1.3.6.1.4.1.4203.1.11.1,cn=features,cn=config". I very new to dealing with LDAP, so I could be missing something simple from the command line. Thanks for any pointers.

2 1

pwdCheckModule not allowed on openldap 2.4.40 (ubuntu server 12.04)
by Guruprasad Kulkarni 14 Nov '14

14 Nov '14

Hi, I installed openldap 2.4.40 on ubuntu 12.04LTS I enabled ppolicy while configuring the installation. ./configure --enable-hdb --enable-ppolicy --enable-syncprov --with-tls I want to specify a password check module (to check for minimum upper cases, lower cases, digits, etc). I got the module from http://ltb-project.org/wiki/documentation/openldap-ppolicy-check-password I created a password policy very similar to the one given in the documentation: dn: cn=default,ou=policies,dc=example,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 1 pwdCheckModule: check_password.so pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 0 pwdInHistory: 5 3 pwdLockout: TRUE pwdLockoutDuration: 60 0 pwdMaxAge: 1200 pwdMaxFailure: 3 pwdMinAge: 0 pwdMinLength: 8 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value slapd.conf: modulepath /usr/local/lib moduleload check_password.so While adding this password policy to ldap, I get the error: ldap_add: Object class violation (65) attribute info: attribute 'pwdCheckModule' not allowed The log level is 256 and doesn't say much besides giving the same error. Let me know where I have gone wrong. -Guruprasad

2 1

Re: adding VLV support to OpenLDAP 2.4.31
by Igor Shmukler 13 Nov '14

13 Nov '14

Hello, I want to thank everyone who reads this mailing list and especially those who provided advice, which helped me to finally configure my server. You are amazing. Thank you

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical