openldap-technical

openldap-technical@openldap.org

9 participants
9866 discussions

How get more detailed error information than the provided by ldap_err2string?
by Werner - Google 09 Mar '14

09 Mar '14

Hi, I've the sample code bellow, and when i intentionally put the wrong credentials, i get from "ldap_err2string( rc ) the error message: "Invalid credentials". But monitoring network traffic with wireshark, i can see that on the bindResponse packet that returns from the server, i also get a more detailed message. In my/this test case, "errorMessage: 80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 525, v1772" attached is also an image of the wireshark showing what i mean. Question is, is there a way i could retrieve this more detailed message? Thanks in advance for any help Regards. --- sample code: if ( (ld = (LDAP *)ldap_init( pHostName, iPortNum )) == NULL ) { perror( "ldap_init failed. Reason?:" ); exit ( 1 ); } if ( (rc=ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version)) != LDAP_SUCCESS ){ fprintf( stderr, "ldap_set_option(LDAP_OPT_PROTOCOL_VERSION): %s\n", ldap_err2string( rc ) ); exit( 1 ); } if ( (rc=ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF)) != LDAP_SUCCESS){ fprintf( stderr, "ldap_set_option(LDAP_OPT_REFERRALS): %s\n", ldap_err2string( rc )); exit( 1 ); } rc = ldap_simple_bind_s( ld, "auth_dn", "auth_pw" ); if ( rc != LDAP_SUCCESS ) { fprintf( stderr, "ldap_simple_bind_s() Failed: %s [%d]\n", ldap_err2string(rc), rc); ldap_unbind_s(ld); /* try unbind the failed connection anyway */ exit ( 1 ); }

4 6

Context around DNS resolution
by Joshua Schaeffer 09 Mar '14

09 Mar '14

I setup LDAPS (yes, will be switching to ldap + StartTLS) and ran intosomething odd and I'm really just looking for a bit of context. Everything is working correctlyand I'm able to authenticate clients to the ldap server, however when I runthe following ldapsearch I get an error: jschaeffer@zipmaster07:~$ ldapsearch -LLL -v -D cn=admin,dc=harmonywave,dc=com -W -H ldaps://baneling -b uid=jschaeffer,ou=People,dc=harmonywave,dc=com ldap_initialize( ldaps://baneling:636/??base ) Enter LDAP Password: ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) And from the debug output: 531c7c0a ber_get_next on fd 12 failed errno=0 (Success) 531c7c0a conn=1000 op=1 do_unbind 531c7c0a connection_close: conn=1000 sd=12 531c7c18 slap_listener_activate(6): 531c7c18 >>> slap_listener(ldaps:///) 531c7c18 connection_get(12): got connid=1001 531c7c18 connection_read(12): checking for input on id=1001 531c7c18 connection_get(12): got connid=1001 531c7c18 connection_read(12): checking for input on id=1001 531c7c18 connection_read(12): unable to get TLS client DN, error=49 id=1001 531c7c18 connection_get(12): got connid=1001 531c7c18 connection_read(12): checking for input on id=1001 ber_get_next 531c7c18 ber_get_next on fd 12 failed errno=0 (Success) 531c7c18 connection_close: conn=1001 sd=12 If I use the FQDN for the URI then everything works fine and I get results. I know DNS is working correctly, I can ping the server name and it returns the FQDN and reverse DNS resolution also works. The hostname and hostname -f commands work correctly on both client and server. Was it never intended for ldap commands to resolve server names to their FQDN? I'm also assuming that ldap + StartTLS would show the same behavior.

2 1

ldapdelete failing
by Tim Dunphy 08 Mar '14

08 Mar '14

Hello, I'm trying to delete an entry in my ldap database. But when issuing this command I am getting an error: [root@ldap01:~/ldap] #ldapdelete -v -x 'dn: uid=spencer,ou=People,dc=example,dc=com' -D cn=admin,dc=example,dc=com -W ldap_initialize( <DEFAULT> ) Enter LDAP Password: deleting entry "dn: uid=spencer,ou=People,dc=example,dc=com" ldap_delete: Invalid DN syntax (34) additional info: invalid DN I find it strange to be getting an 'invalid dn' error as the dn I'm using in the delete command was pulled straight form an ldapsearch: root@ldap01:~/ldap] #ldapsearch -x -LLL -b dc=example,dc=com 'uid=spencer' dn dn: uid=spencer,ou=People,dc=example,dc=com It was a straight copy paste, so I am unsure of why I might be getting this error. Could I please get some help on the syntax I'll need to get the command to work properly? Thank you, Tim -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

2 2

Client doesn't send certificate for LDAPS
by Joshua Schaeffer 08 Mar '14

08 Mar '14

I'm in the process of setting up my slapd server to operate over LDAPS and having trouble when using a CA certificate (being my own certificate authority). I've been able to setup LDAPS when using a self-signed server certificate: root@baneling:~# slapcat -H ldap:///cn=config??base dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: none olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: 0e827846-3926-1033-9f74-632898b715c9 creatorsName: cn=config createTimestamp: 20140306025210Z olcTLSCertificateFile: /etc/ssl/certs/ldap.harmonywave.com.crt olcTLSCertificateKeyFile: /etc/ssl/private/ldap.harmonywave.com.key olcTLSCipherSuite: SECURE256 olcTLSVerifyClient: never entryCSN: 20140308131751.026022Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20140308131751Z This works fine and I'm able to authenticate clients. However if I use a CA certificate (again, being my own CA) to sign my server certificate and then change olcTLSVerifyClient to demand and add olcTLSCACertificateFile then I can no longer authenticate. I've installed my CA certificate on the client machine and pointed both ldap.conf and nslcd.conf to the CA certificate. However I get the following when debugging: root@baneling:~# slapd -d conns -h ldaps:/// 531b1cef @(#) $OpenLDAP: slapd (Apr 23 2013 12:16:04) $ root@lupin:/tmp/buildd/openldap-2.4.31/debian/build/servers/slapd 531b1cf0 slapd starting 531b1cf0 daemon: added 3r listener=(nil) 531b1cf0 daemon: added 6r listener=0x7fe2d98326e0 531b1cf0 daemon: added 7r listener=0x7fe2d98327c0 531b1cf0 daemon: epoll: listen=6 active_threads=0 tvp=zero 531b1cf0 daemon: epoll: listen=7 active_threads=0 tvp=zero 531b1cf0 daemon: activity on 1 descriptor 531b1cf0 daemon: activity on:531b1cf0 531b1cf0 daemon: epoll: listen=6 active_threads=0 tvp=zero 531b1cf0 daemon: epoll: listen=7 active_threads=0 tvp=zero 531b1cf4 daemon: activity on 1 descriptor 531b1cf4 daemon: activity on:531b1cf4 531b1cf4 daemon: epoll: listen=6 busy 531b1cf4 daemon: epoll: listen=7 active_threads=0 tvp=zero 531b1cf4 daemon: activity on 1 descriptor 531b1cf4 daemon: activity on:531b1cf4 531b1cf4 daemon: epoll: listen=6 active_threads=0 tvp=zero 531b1cf4 daemon: epoll: listen=7 active_threads=0 tvp=zero 531b1cf4 daemon: listen=6, new connection on 12 531b1cf4 daemon: added 12r (active) listener=(nil) 531b1cf4 daemon: activity on 1 descriptor 531b1cf4 daemon: activity on:531b1cf4 12r531b1cf4 531b1cf4 daemon: read active on 12 531b1cf4 daemon: epoll: listen=6 active_threads=0 tvp=zero 531b1cf4 daemon: epoll: listen=7 active_threads=0 tvp=zero 531b1cf4 daemon: activity on 1 descriptor 531b1cf4 daemon: activity on:531b1cf4 531b1cf4 daemon: epoll: listen=6 active_threads=0 tvp=zero 531b1cf4 daemon: epoll: listen=7 active_threads=0 tvp=zero 531b1cf4 daemon: activity on 1 descriptor 531b1cf4 daemon: activity on:531b1cf4 531b1cf4 daemon: epoll: listen=6 active_threads=0 tvp=zero 531b1cf4 daemon: epoll: listen=7 active_threads=0 tvp=zero 531b1cf4 daemon: activity on 1 descriptor 531b1cf4 daemon: activity on:531b1cf4 12r531b1cf4 531b1cf4 daemon: read active on 12 531b1cf4 daemon: epoll: listen=6 active_threads=0 tvp=zero 531b1cf4 daemon: epoll: listen=7 active_threads=0 tvp=zero TLS: can't accept: The peer did not send any certificate.. 531b1cf4 connection_closing: readying conn=1000 sd=12 for close 531b1cf4 daemon: removing 12 531b1cf4 daemon: activity on 1 descriptor 531b1cf4 daemon: activity on:531b1cf4 Why would the client not send the certificate if I've pointed TLS_CACERT in ldap.confand tls_cacertfile to that cert? Maybe I'm misunderstanding the basic concepts here, I am pretty new to a lot of this. I'm using OpenLDAP 2.4.31, Debian 7, and GnuTLS. Yes, I'm aware of its recent critical security bug and the warnings against it from this group (http://www.openldap.org/lists/openldap-devel/200802/msg00072.html). Thanks, Joshua

3 3

User-Managed Groups
by Tim Gustafson 08 Mar '14

08 Mar '14

Hi, I've had OpenLDAP set up for a while now such that users can create groups and manage the groups that they've created. I've achieved this by creating a new objectClass (called "managedGroup") which adds the "manager" attribute, and then I've set up ACLs like this: olcAccess: {14}to dn.base="ou=Groups,dc=whatever" attrs=children by users add by * break olcAccess: {15}to dn.subtree="ou=Groups,dc=whatever" filter="(&(objectClass=posixGroup)(objectClass=managedGroup)(gidNumber>=1000))" attrs=entry by users add by * break olcAccess: {16}to dn.subtree="ou=Groups,dc=whatever" attrs=cn,manager,memberUid,description by set.exact="this/manager & user" write by * break I also have the "unique" overlay installed to prevent multiple groups from having the same "cn" or "gidNumber". I've got a request from users to be able to re-name their groups now too. I tried changing "by users add" to "by users write" in clause 14, and added the "entry" attribute to "attrs=" in clause 16, but the server is still not letting users re-name their groups. The output of the log file looks like this: slapd[44745]: => acl_get: [16] attr entry slapd[44745]: => acl_mask: access to entry "cn=test-1234,ou=Groups,dc=whatever", attr "entry" requested slapd[44745]: => acl_mask: to all values by "uid=g-guest,ou=people,dc=whatever", (=0) slapd[44745]: <= check a_dn_pat: users slapd[44745]: <= acl_mask: [1] applying add(=arscxd) (stop) slapd[44745]: <= acl_mask: [1] mask: add(=arscxd) slapd[44745]: => slap_access_allowed: write access denied by add(=arscxd) slapd[44745]: => access_allowed: no more rules What am I missing? -- Tim Gustafson tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A

3 2

Help with trying to setup RE: Issues with setting up multiple master
by Alex Samad - Yieldbroker 07 Mar '14

07 Mar '14

Hi Any one got any hints at what I can look at to fix this ? Alex > -----Original Message----- > From: Alex Samad - Yieldbroker > Sent: Wednesday, 5 March 2014 4:11 PM > To: 'openldap-technical(a)openldap.org' > Subject: Issues with setting up multiple master > > Hi > > So I am setting up multi master following the steps here > http://www.openldap.org/doc/admin24/replication.html 18.3.3 > > I have 2 nodes and not 3. > > I did this on the master > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 1 > > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcRootPW: secret > > and on the 2nd > > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 2 > > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcRootPW: secret > > > > I used a different password on each site . changed it to the same password > no > > > I did this > > dn: cn=config > changetype: modify > replace: olcServerID > olcServerID: 1 $URI1 > olcServerID: 2 $URI2 > > dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config > changetype: add > objectClass: olcOverlayConfig > objectClass: olcSyncProvConfig > olcOverlay: syncprov > > dn: olcDatabase={0}config,cn=config > changetype: modify > add: olcSyncRepl > olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" > bindmethod=simple > credentials=secret searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" > bindmethod=simple > credentials=secret searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=1 > - > add: olcMirrorMode > olcMirrorMode: TRUE > > > I am wondering why I did > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 2 > > if I am just going to do this > > dn: cn=config > changetype: modify > replace: olcServerID > olcServerID: 1 $URI1 > olcServerID: 2 $URI2 > > This is what I get on the second node > Mar 5 16:08:09 alcldap1 slapd[21296]: do_syncrep2: rid=001 got empty > syncUUID with LDAP_SYNC_ADD > Mar 5 16:08:09 alcldap1 slapd[21296]: do_syncrepl: rid=001 rc -1 retrying (4 > retries left) > Mar 5 16:08:14 alcldap1 slapd[21296]: do_syncrep2: rid=001 got empty > syncUUID with LDAP_SYNC_ADD > Mar 5 16:08:14 alcldap1 slapd[21296]: do_syncrepl: rid=001 rc -1 retrying (4 > retries left) > Mar 5 16:08:19 alcldap1 slapd[21296]: do_syncrep2: rid=001 got empty > syncUUID with LDAP_SYNC_ADD > > > And on the first node > Mar 5 16:09:27 gsldap1 slapd[11028]: do_syncrep2: rid=002 got empty > syncUUID with LDAP_SYNC_ADD > x > Mar 5 16:09:27 gsldap1 slapd[11028]: do_syncrepl: rid=002 rc -1 retrying (4 > retries left) x > > I have done manual ldapsearch from both boxes to the other boxes with the > credentials and it works > > > So now I am stuff. Had a quick google, but could find anything relevant. > > Help :) > > Oh I started with info in the db's already. Just a rsync ... > > Alex > > >

1 1

Slapd TLS issue
by Eric Falbe 07 Mar '14

07 Mar '14

Hi, When I try to start slapd I get this error message: Checking configuration files for slapd: [WARNING] PROXIED attributeDescription "DC" inserted. config file testing succeeded Starting slapd: @(#) $OpenLDAP: slapd 2.4.23 (Feb 3 2014 19:11:35) $ mockbuild(a)c6b10.bsys.dev.centos.org: /builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd PROXIED attributeDescription "DC" inserted. bdb_db_open: database "dc=cassens,dc=com": unclean shutdown detected; attempting recovery. bdb_db_open: database "cn=accesslog": unclean shutdown detected; attempting recovery. slapd starting TLS: error: the certificate '/etc/pki/tls/certs/ldap.cassens.com.pem' could not be found in the database - error -12285:Unable to find the certificate or key necessary for authentication.. TLS: certificate '/etc/pki/tls/certs/ldap.cassens.com.pem' successfully loaded from PEM file. TLS: no unlocked certificate for certificate 'CN=ldap.cassens.com,OU=Ldap Server,O=Cassens Transport Company,C=US'. ppolicy_bind: Setting warning for password expiry for cn=replication,dc=cassens,dc=com = 0 seconds ^Cdaemon: shutdown requested and initiated. slapd shutdown: waiting for 0 operations/tasks to finish slapd stopped. This server was working last night, I had to promote our secondary ldap server this morning. I have attempted to rebuild the database backend (with slapcat and slapadd), but am still getting this same error. I have my ssl (self-signed) certificates located in /etc/pki/tls/certs/ldap.cassens.com.pem /etc/pki/tls/tls/certa/ca.pem /etc/pki/tls/private/ldap.cassens.comKey.pem These certificates worked fine up untill today, does anyone have any insight on where to look to being troubleshooting this issue? Thanks, Eric Falbe

5 6

Documentation required on openldap 2.4.39
by saurabh ohri 07 Mar '14

07 Mar '14

Hi, Does anyone installed openldap 2.4.39 or later. Please help me with self created document as i am getting stuck at various point. I have installed and configured but not able to : 1) Change the ldap to work for ldap(389) to ldaps(636) with openssl certs. 2) Not able to convert the slapd.conf to config. 3) Implementing password policies. 4) 2 node Replication Master-Master Please help as it is been 2 weeks and am dead stuck. Project completion data is near so quick help will be highly appreciated. Thanks again Regards Sam

2 1

LDAP Passwordless SSH Problem
by Kamran Khan 06 Mar '14

06 Mar '14

Hi all, I have a cluster, running RHEL6.5, which I have installed and configured LDAP w/ TLS support. The systems are all authenticating using LDAP properly, and I have added a test user to make sure this works. I can 'su' into the new user, and SSH across all systems. However, it requires a password upon every SSH. Please see verbose SSH below: =================================================== [root@usdtwclus01 ~]# su - jramey [jramey@usdtwclus01 ~]$ ssh -vvvvv n001 OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug2: ssh_connect: needpriv 0 debug1: Connecting to n001 [172.16.36.1] port 22. debug1: Connection established. debug3: Not a RSA1 key file /home/jramey/.ssh/id_rsa. debug2: key_type_from_name: unknown key type '-----BEGIN' debug3: key_read: missing keytype debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug2: key_type_from_name: unknown key type '-----END' debug3: key_read: missing keytype debug1: identity file /home/jramey/.ssh/id_rsa type 1 debug1: identity file /home/jramey/.ssh/id_rsa-cert type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3 debug1: match: OpenSSH_5.3 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.3 debug2: fd 5 setting O_NONBLOCK debug1: SSH2_MSG_KEXINIT sent debug3: Wrote 960 bytes for a total of 981 debug1: SSH2_MSG_KEXINIT received debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc(a)lysator.liu.se debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc(a)lysator.liu.se debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,zlib(a)openssh.com,zlib debug2: kex_parse_kexinit: none,zlib(a)openssh.com,zlib debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc(a)lysator.liu.se debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc(a)lysator.liu.se debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,zlib(a)openssh.com debug2: kex_parse_kexinit: none,zlib(a)openssh.com debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: mac_setup: found hmac-md5 debug1: kex: server->client aes128-ctr hmac-md5 none debug2: mac_setup: found hmac-md5 debug1: kex: client->server aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug3: Wrote 24 bytes for a total of 1005 debug2: dh_gen_key: priv key bits set: 120/256 debug2: bits set: 522/1024 debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug3: Wrote 144 bytes for a total of 1149 debug3: check_host_in_hostfile: host n001 filename /home/jramey/.ssh/known_hosts debug3: check_host_in_hostfile: host n001 filename /home/jramey/.ssh/known_hosts debug3: check_host_in_hostfile: match line 1 debug3: check_host_in_hostfile: host 172.16.36.1 filename /home/jramey/.ssh/known_hosts debug3: check_host_in_hostfile: host 172.16.36.1 filename /home/jramey/.ssh/known_hosts debug3: check_host_in_hostfile: match line 1 debug1: Host 'n001' is known and matches the RSA host key. debug1: Found key in /home/jramey/.ssh/known_hosts:1 debug2: bits set: 504/1024 debug1: ssh_rsa_verify: signature correct debug2: kex_derive_keys debug2: set_newkeys: mode 1 debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug3: Wrote 16 bytes for a total of 1165 debug2: set_newkeys: mode 0 debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug3: Wrote 48 bytes for a total of 1213 debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug2: key: /home/jramey/.ssh/id_rsa (0x7f0a9fb7a6a0) debug3: Wrote 64 bytes for a total of 1277 debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password debug3: authmethod_lookup gssapi-keyex debug3: remaining preferred: gssapi-with-mic,publickey,keyboard-interactive,password debug3: authmethod_is_enabled gssapi-keyex debug1: Next authentication method: gssapi-keyex debug1: No valid Key exchange context debug2: we did not send a packet, disable method debug3: authmethod_lookup gssapi-with-mic debug3: remaining preferred: publickey,keyboard-interactive,password debug3: authmethod_is_enabled gssapi-with-mic debug1: Next authentication method: gssapi-with-mic debug3: Trying to reverse map address 172.16.36.1. debug1: Unspecified GSS failure. Minor code may provide more information Credentials cache file '/tmp/krb5cc_15000' not found debug1: Unspecified GSS failure. Minor code may provide more information Credentials cache file '/tmp/krb5cc_15000' not found debug1: Unspecified GSS failure. Minor code may provide more information debug1: Unspecified GSS failure. Minor code may provide more information Credentials cache file '/tmp/krb5cc_15000' not found debug2: we did not send a packet, disable method debug3: authmethod_lookup publickey debug3: remaining preferred: keyboard-interactive,password debug3: authmethod_is_enabled publickey debug1: Next authentication method: publickey debug1: Offering public key: /home/jramey/.ssh/id_rsa debug3: send_pubkey_test debug2: we sent a publickey packet, wait for reply debug3: Wrote 368 bytes for a total of 1645 debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug2: we did not send a packet, disable method debug3: authmethod_lookup password debug3: remaining preferred: ,password debug3: authmethod_is_enabled password debug1: Next authentication method: password jramey@n001's password: =================================================== Any ideas on how to accomplish passwordless SSH with LDAP users? Please let me know. Thanks. -- Kamran Khan PSSC Labs HPC Software Technical Engineer

3 3

openldap search filter attribut equal to another
by Lanfeust troy 05 Mar '14

05 Mar '14

hi list, is it possible to write a filter like: (&(objectClass=inetOrgPerson)(mail=cn)) to retrieve all entry that attribute mail equal to attribute cn. thanks

4 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical