openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

slapo-accesslog
by Michael 13 Feb '14

13 Feb '14

I'm trying to configure a means to be able to get the lastlogin time for users in my environment. However, since I'm stuck using the RHEL version of OpenLDAP I can't take advantage of the "lastbind overlay" Here's my config. overlay accesslog logdb cn=accesslog logops bind logsuccess TRUE # scan the accesslog DB every day, and purge entries older than 90 days logpurge 90+00:00 01+00:00 The accesslog DB is populated and I can query for BIND operations, however the only BIND operations that get recorded are BINDS to the LDAP server itself. BINDS to clients do not get recorded in the accesslog. Is this the advertised behavior of the accesslog? -Mike

4 5

Syncrepl and mmr
by Borresen, John - 0442 - MITLL 12 Feb '14

12 Feb '14

All, Hope I am not persona non grata (that is supposed to be funny) based on the responses I received from my last post earlier today. Tomorrow I am starting from scratch...I have one week to get this working -- afraid to find out what will happen after that. Anyway, I've increased the syslog verbosity on both servers. mm-server1: 52fbefc2 <= send_search_entry: conn 1013 exit. 52fbefc2 => test_filter 52fbefc2 PRESENT 52fbefc2 => access_allowed: search access to "reqStart=20140211203819.000000Z,cn=accesslog" "objectClass" requested 52fbefc2 => acl_get: [1] attr objectClass 52fbefc2 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "objectClass" requested 52fbefc2 => acl_mask: to all values by "cn=ldapadmin,dc=group42,dc=ldap", (=0) 52fbefc2 <= check a_dn_pat: uid=replicator,ou=admins,dc=group42,dc=ldap 52fbefc2 <= check a_dn_pat: cn=ldapadmin,dc=group42,dc=ldap 52fbefc2 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fbefc2 <= acl_mask: [2] mask: write(=wrscxd) 52fbefc2 => slap_access_allowed: search access granted by write(=wrscxd) 52fbefc2 => access_allowed: search access granted by write(=wrscxd) 52fbefc2 <= test_filter 6 52fbefc2 => send_search_entry: conn 1013 dn="reqStart=20140211203819.000000Z,cn=accesslog" 52fbefc2 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "entry" requested 52fbefc2 => acl_get: [1] attr entry 52fbefc2 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "entry" requested 52fbefc2 => acl_mask: to all values by "cn=ldapadmin,dc=group42,dc=ldap", (=0) 52fbefc2 <= check a_dn_pat: uid=replicator,ou=admins,dc=group42,dc=ldap 52fbefc2 <= check a_dn_pat: cn=ldapadmin,dc=group42,dc=ldap 52fbefc2 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fbefc2 <= acl_mask: [2] mask: write(=wrscxd) 52fbefc2 => slap_access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: result not in cache (reqType) 52fbefc2 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "reqType" requested 52fbefc2 => acl_get: [1] attr reqType 52fbefc2 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "reqType" requested 52fbefc2 => acl_mask: to value by "cn=ldapadmin,dc=group42,dc=ldap", (=0) 52fbefc2 <= check a_dn_pat: uid=replicator,ou=admins,dc=group42,dc=ldap 52fbefc2 <= check a_dn_pat: cn=ldapadmin,dc=group42,dc=ldap 52fbefc2 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fbefc2 <= acl_mask: [2] mask: write(=wrscxd) 52fbefc2 => slap_access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: result not in cache (reqDN) 52fbefc2 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "reqDN" requested 52fbefc2 => acl_get: [1] attr reqDN 52fbefc2 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "reqDN" requested 52fbefc2 => acl_mask: to value by "cn=ldapadmin,dc=group42,dc=ldap", (=0) 52fbefc2 <= check a_dn_pat: uid=replicator,ou=admins,dc=group42,dc=ldap 52fbefc2 <= check a_dn_pat: cn=ldapadmin,dc=group42,dc=ldap 52fbefc2 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fbefc2 <= acl_mask: [2] mask: write(=wrscxd) 52fbefc2 => slap_access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: result not in cache (reqMod) 52fbefc2 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "reqMod" requested 52fbefc2 => acl_get: [1] attr reqMod 52fbefc2 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "reqMod" requested 52fbefc2 => acl_mask: to value by "cn=ldapadmin,dc=group42,dc=ldap", (=0) 52fbefc2 <= check a_dn_pat: uid=replicator,ou=admins,dc=group42,dc=ldap 52fbefc2 <= check a_dn_pat: cn=ldapadmin,dc=group42,dc=ldap 52fbefc2 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fbefc2 <= acl_mask: [2] mask: write(=wrscxd) 52fbefc2 => slap_access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: result was in cache (reqMod) 52fbefc2 => access_allowed: result was in cache (reqMod) 52fbefc2 => access_allowed: result was in cache (reqMod) 52fbefc2 => access_allowed: result not in cache (entryCSN) 52fbefc2 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "entryCSN" requested 52fbefc2 => acl_get: [1] attr entryCSN 52fbefc2 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "entryCSN" requested 52fbefc2 => acl_mask: to value by "cn=ldapadmin,dc=group42,dc=ldap", (=0) 52fbefc2 <= check a_dn_pat: uid=replicator,ou=admins,dc=group42,dc=ldap 52fbefc2 <= check a_dn_pat: cn=ldapadmin,dc=group42,dc=ldap 52fbefc2 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fbefc2 <= acl_mask: [2] mask: write(=wrscxd) 52fbefc2 => slap_access_allowed: read access granted by write(=wrscxd) 52fbefc2 => access_allowed: read access granted by write(=wrscxd) 52fbefc2 conn=1013 op=1 ENTRY dn="reqStart=20140211203819Z,cn=accesslog" 52fbefc2 daemon: activity on 1 descriptor 52fbefc2 daemon: activity on:52fbefc2 18r52fbefc2 52fbefc2 daemon: read active on 18 52fbefc2 daemon: epoll: listen=7 active_threads=0 tvp=zero 52fbefc2 daemon: activity on 1 descriptor 52fbefc2 daemon: activity on:52fbefc2 52fbefc2 daemon: epoll: listen=7 active_threads=0 tvp=zero 52fbefc2 daemon: activity on 1 descriptor 52fbefc2 daemon: activity on:52fbefc2 52fbefc2 daemon: epoll: listen=7 active_threads=0 tvp=zero 52fbefc2 connection_get(18) 52fbefc2 connection_get(18): got connid=1013 52fbefc2 connection_read(18): checking for input on id=1013 ber_get_next ldap_read: want=8, got=7 0000: 30 05 02 01 03 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x76a43d0 ptr=0x76a43d0 end=0x76a43d5 len=5 0000: 02 01 03 42 00 ...B. 52fbefc2 op tag 0x42, time 1392242626 ber_get_next ldap_read: want=8, got=0 mm-server2: 52fbf12a =>do_syncrep2 rid=001 ldap_result ld 0x9715890 msgid 2 wait4msg ld 0x9715890 msgid 2 (infinite timeout) wait4msg continue ld 0x9715890 msgid 2 all 0 ** ld 0x9715890 Connections: * host: mm-server1.example.ldap port: 389 (default) refcnt: 2 status: Connected last used: Wed Feb 12 17:09:46 2014 ** ld 0x9715890 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x9715890 request count 1 (abandoned 0) ** ld 0x9715890 Response Queue: Empty ld 0x9715890 response count 0 ldap_chkResponseList ld 0x9715890 msgid 2 all 0 ldap_chkResponseList returns ld 0x9715890 NULL ldap_int_select read1msg: ld 0x9715890 msgid 2 all 0 ber_get_next ldap_read: want=8, got=8 0000: 30 81 b2 02 01 02 64 48 0.....dH ldap_read: want=173, got=173 0000: 04 0c 63 6e 3d 61 63 63 65 73 73 6c 6f 67 30 38 ..cn=accesslog08 0010: 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 04 28 06..entryCSN1*.( 0020: 32 30 31 34 30 32 30 33 31 38 33 38 33 31 2e 37 20140203183831.7 0030: 35 31 38 33 38 5a 23 30 30 30 30 30 30 23 30 30 51838Z#000000#00 0040: 31 23 30 30 30 30 30 30 a0 63 30 61 04 18 31 2e 1#000000.c0a..1. 0050: 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 2e 31 3.6.1.4.1.4203.1 0060: 2e 39 2e 31 2e 32 04 45 30 43 0a 01 01 04 00 04 .9.1.2.E0C...... 0070: 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 30 31 <rid=001,sid=001 0080: 2c 63 73 6e 3d 32 30 31 34 30 32 30 33 31 38 33 ,csn=20140203183 0090: 38 33 31 2e 37 35 31 38 33 38 5a 23 30 30 30 30 831.751838Z#0000 00a0: 30 30 23 30 30 31 23 30 30 30 30 30 30 00#001#000000 ber_get_next: tag 0x30 len 178 contents: ber_dump: buf=0x9762840 ptr=0x9762840 end=0x97628f2 len=178 0000: 02 01 02 64 48 04 0c 63 6e 3d 61 63 63 65 73 73 ...dH..cn=access 0010: 6c 6f 67 30 38 30 36 04 08 65 6e 74 72 79 43 53 log0806..entryCS 0020: 4e 31 2a 04 28 32 30 31 34 30 32 30 33 31 38 33 N1*.(20140203183 0030: 38 33 31 2e 37 35 31 38 33 38 5a 23 30 30 30 30 831.751838Z#0000 0040: 30 30 23 30 30 31 23 30 30 30 30 30 30 a0 63 30 00#001#000000.c0 0050: 61 04 18 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 34 a..1.3.6.1.4.1.4 0060: 32 30 33 2e 31 2e 39 2e 31 2e 32 04 45 30 43 0a 203.1.9.1.2.E0C. 0070: 01 01 04 00 04 3c 72 69 64 3d 30 30 31 2c 73 69 .....<rid=001,si 0080: 64 3d 30 30 31 2c 63 73 6e 3d 32 30 31 34 30 32 d=001,csn=201402 0090: 30 33 31 38 33 38 33 31 2e 37 35 31 38 33 38 5a 03183831.751838Z 00a0: 23 30 30 30 30 30 30 23 30 30 31 23 30 30 30 30 #000000#001#0000 00b0: 30 30 00 read1msg: ld 0x9715890 msgid 2 message type search-entry ber_scanf fmt ({xx) ber: ber_dump: buf=0x9762840 ptr=0x9762843 end=0x97628f2 len=175 0000: 64 48 04 0c 63 6e 3d 61 63 63 65 73 73 6c 6f 67 dH..cn=accesslog 0010: 30 38 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 0806..entryCSN1* 0020: 04 28 32 30 31 34 30 32 30 33 31 38 33 38 33 31 .(20140203183831 0030: 2e 37 35 31 38 33 38 5a 23 30 30 30 30 30 30 23 .751838Z#000000# 0040: 30 30 31 23 30 30 30 30 30 30 a0 63 30 61 04 18 001#000000.c0a.. 0050: 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 1.3.6.1.4.1.4203 0060: 2e 31 2e 39 2e 31 2e 32 04 45 30 43 0a 01 01 04 .1.9.1.2.E0C.... 0070: 00 04 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 ..<rid=001,sid=0 0080: 30 31 2c 63 73 6e 3d 32 30 31 34 30 32 30 33 31 01,csn=201402031 0090: 38 33 38 33 31 2e 37 35 31 38 33 38 5a 23 30 30 83831.751838Z#00 00a0: 30 30 30 30 23 30 30 31 23 30 30 30 30 30 30 0000#001#000000 ber_scanf fmt ({a) ber: ber_dump: buf=0x9762840 ptr=0x976288f end=0x97628f2 len=99 0000: 30 61 04 18 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 0a..1.3.6.1.4.1. 0010: 34 32 30 33 2e 31 2e 39 2e 31 2e 32 04 45 30 43 4203.1.9.1.2.E0C 0020: 0a 01 01 04 00 04 3c 72 69 64 3d 30 30 31 2c 73 ......<rid=001,s 0030: 69 64 3d 30 30 31 2c 63 73 6e 3d 32 30 31 34 30 id=001,csn=20140 0040: 32 30 33 31 38 33 38 33 31 2e 37 35 31 38 33 38 203183831.751838 0050: 5a 23 30 30 30 30 30 30 23 30 30 31 23 30 30 30 Z#000000#001#000 0060: 30 30 30 000 ber_scanf fmt (o) ber: ber_dump: buf=0x9762840 ptr=0x97628ab end=0x97628f2 len=71 0000: 04 45 30 43 0a 01 01 04 00 04 3c 72 69 64 3d 30 .E0C......<rid=0 0010: 30 31 2c 73 69 64 3d 30 30 31 2c 63 73 6e 3d 32 01,sid=001,csn=2 0020: 30 31 34 30 32 30 33 31 38 33 38 33 31 2e 37 35 0140203183831.75 0030: 31 38 33 38 5a 23 30 30 30 30 30 30 23 30 30 31 1838Z#000000#001 0040: 23 30 30 30 30 30 30 #000000 ldap_get_dn_ber ber_scanf fmt ({ml{) ber: ber_dump: buf=0x9762840 ptr=0x9762843 end=0x97628f2 len=175 0000: 64 48 04 0c 63 6e 3d 61 63 63 65 73 73 6c 6f 67 dH..cn=accesslog 0010: 30 38 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 0806..entryCSN1* 0020: 04 28 32 30 31 34 30 32 30 33 31 38 33 38 33 31 .(20140203183831 0030: 2e 37 35 31 38 33 38 5a 23 30 30 30 30 30 30 23 .751838Z#000000# 0040: 30 30 31 23 30 30 30 30 30 30 a0 63 30 61 04 18 001#000000.c0a.. 0050: 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 1.3.6.1.4.1.4203 0060: 2e 31 2e 39 2e 31 2e 32 04 45 30 43 0a 01 01 04 .1.9.1.2.E0C.... 0070: 00 04 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 ..<rid=001,sid=0 0080: 30 31 2c 63 73 6e 3d 32 30 31 34 30 32 30 33 31 01,csn=201402031 0090: 38 33 38 33 31 2e 37 35 31 38 33 38 5a 23 30 30 83831.751838Z#00 00a0: 30 30 30 30 23 30 30 31 23 30 30 30 30 30 30 0000#001#000000 ber_scanf fmt ({em) ber: ber_dump: buf=0x9762970 ptr=0x9762970 end=0x97629b5 len=69 0000: 30 43 0a 01 01 04 00 04 3c 72 69 64 3d 30 30 31 0C......<rid=001 0010: 2c 73 69 64 3d 30 30 31 2c 63 73 6e 3d 32 30 31 ,sid=001,csn=201 0020: 34 30 32 30 33 31 38 33 38 33 31 2e 37 35 31 38 40203183831.7518 0030: 33 38 5a 23 30 30 30 30 30 30 23 30 30 31 23 30 38Z#000000#001#0 0040: 30 30 30 30 30 00000 52fbf12a do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) ldap_msgfree ldap_free_request (origid 2, msgid 2) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 17 0000: 30 05 02 01 03 42 00 0....B. ldap_write: want=7, written=7 0000: 30 05 02 01 03 42 00 0....B. ldap_free_connection: actually freed 52fbf12a do_syncrepl: rid=001 rc -1 retrying 52fbf12a daemon: activity on 1 descriptor 52fbf12a daemon: activity on:52fbf12a 52fbf12a daemon: epoll: listen=7 active_threads=0 tvp=zero 52fbf166 daemon: epoll: listen=7 active_threads=0 tvp=zero 52fbf166 =>do_syncrepl rid=001 ldap_create ldap_url_parse_ext(ldap://mm-server1.example.ldap) ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP mm-server1.example.ldap:389 ldap_new_socket: 17 ldap_prepare_socket: 17 ldap_connect_to_host: Trying <mm-server1_IP>:389 ldap_pvt_connect: fd: 17 tm: -1 async: 0 attempting to connect: connect success ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x9761740 ptr=0x9761740 end=0x9761778 len=56 0000: 30 36 02 01 01 60 31 02 01 03 04 1f 63 6e 3d 6c 06...`1.....cn=l 0010: 64 61 70 61 64 6d 69 6e 2c 64 63 3d 67 72 6f 75 dapadmin,dc=exam 0020: 70 34 32 2c 64 63 3d 6c 64 61 70 80 0b 47 72 70 ple,dc=ldap..<pas 0030: 34 32 2d 41 64 6d 21 6e sword> ber_scanf fmt ({i) ber: ber_dump: buf=0x9761740 ptr=0x9761745 end=0x9761778 len=51 0000: 60 31 02 01 03 04 1f 63 6e 3d 6c 64 61 70 61 64 `1.....cn=ldapad 0010: 6d 69 6e 2c 64 63 3d 67 72 6f 75 70 34 32 2c 64 min,dc=example,d 0020: 63 3d 6c 64 61 70 80 0b 47 72 70 34 32 2d 41 64 c=ldap..<passwo 0030: 6d 21 6e rd> ber_flush2: 56 bytes to sd 17 0000: 30 36 02 01 01 60 31 02 01 03 04 1f 63 6e 3d 6c 06...`1.....cn=l 0010: 64 61 70 61 64 6d 69 6e 2c 64 63 3d 67 72 6f 75 dapadmin,dc=grou 0020: 70 34 32 2c 64 63 3d 6c 64 61 70 80 0b 47 72 70 p42,dc=ldap..<pass 0030: 34 32 2d 41 64 6d 21 6e word> ldap_write: want=56, written=56 0000: 30 36 02 01 01 60 31 02 01 03 04 1f 63 6e 3d 6c 06...`1.....cn=l 0010: 64 61 70 61 64 6d 69 6e 2c 64 63 3d 67 72 6f 75 dapadmin,dc=grou 0020: 70 34 32 2c 64 63 3d 6c 64 61 70 80 0b 47 72 70 p42,dc=ldap..<pas 0030: 34 32 2d 41 64 6d 21 6e sword> ldap_result ld 0x950ac90 msgid 1 Thanks in advance... John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

2 1

rwm overlay causes slapd segfault
by Jarbas Peixoto Júnior 12 Feb '14

12 Feb '14

Needed to enable authentication on ldap server via the mail attribute. I used the overlay rwm as documentation: * Http://www.openldap.org/doc/admin24/overlays.html # Rewrite / Remap * http://www.openldap.org/lists/openldap-software/200707/msg00487.html * http://www.openldap.org/software/man.cgi?query=slapo-rwm&sektion=5&apropos=… I run the current version of OpenLDAP : dpkg -l | grep openldap ii openldap-ltb 2.4.39-1 amd64 OpenLDAP server with addons from the LDAP Tool Box project ii openldap-ltb-check-password 2.4.39-1 amd64 check_password module for password policy ii openldap-ltb-contrib-overlays 2.4.39-1 amd64 Overlays contributed to OpenLDAP My configuration snippet is shown below : ... backend hdb moduleload rwm overlay rwm rwm-rewriteEngine on rwm-rewriteMap ldap attr2dn "ldaps:///dc=gov,dc=br?dn?sub?" rwm-rewriteContext bindDN rwm-rewriteRule "^mail=[^,]+@[^,]+$" "${attr2dn($0)}" ":@I" database hdb ... Everything worked fine , but sometimes occurred a ' slapd segfault " there was no apparent cause . A log analysis allowed us to identify the query that caused the "crash " was the folder containing " ** " as follows : "(mail=*name**surname*)(mailAlternateAddress=*name**surname*)" Redid several searches and this is really "crash " in some situations : Normal ======= ldapsearch -xLLL -H ldaps://www-linuxprev -b dc=gov,dc=br "(uid=jarbas*peixoto)" mail dn: uid=jarbas.peixoto,ou=URMS,ou=SUAT,ou=DRD,ou=DATAPREV,dc=gov,dc=br mail: jarbas.peixoto(a)dataprev.gov.br Normal ======= ldapsearch -xLLL -H ldaps://www-linuxprev -b dc=gov,dc=br "(uid=jarbas**peixoto)" mail ldap_search_ext: Bad search filter (-7) Normal ======= ldapsearch -xLLL -H ldaps://www-linuxprev -b dc=gov,dc=br "(mail=jarbas*peixoto(a)dataprev.gov.br)" mail dn: uid=jarbas.peixoto,ou=URMS,ou=SUAT,ou=DRD,ou=DATAPREV,dc=gov,dc=br mail: jarbas.peixoto(a)dataprev.gov.br Normal ======= ldapsearch -xLLL -H ldaps://www-linuxprev -b dc=gov,dc=br "(mail=jarbas**peixoto(a)dataprev.gov.br)" mail ldap_search_ext: Bad search filter (-7) Segfault - Note that there is a space between the two asterisks ( "* *" ) ================================================================ ldapsearch -xLLL -H ldaps://www-linuxprev -b dc=gov,dc=br "(mail=jarbas* *peixoto(a)dataprev.gov.br)" mail Additional information: massaged filter parse error The excerpts from server logs are: Feb 12 09:49:18 linuxprev slapd[27108]: conn=1004 fd=19 ACCEPT from IP=10.82.0.22:46996 (IP=0.0.0.0:636) Feb 12 09:49:18 linuxprev slapd[27108]: conn=1004 fd=19 TLS established tls_ssf=128 ssf=128 Feb 12 09:49:18 linuxprev slapd[27108]: conn=1004 op=0 BIND dn="" method=128 Feb 12 09:49:18 linuxprev slapd[27108]: conn=1004 op=0 RESULT tag=97 err=0 text= Feb 12 09:49:18 linuxprev slapd[27108]: conn=1004 op=1 SRCH base="dc=gov,dc=br" scope=2 deref=0 filter="(mail=jarbas**peixoto(a)dataprev.gov.br)" Feb 12 09:49:18 linuxprev slapd[27108]: conn=1004 op=1 SRCH attr=mail Feb 12 09:49:18 linuxprev slapd[27108]: conn=1004 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text=massaged filter parse error Feb 12 09:49:18 linuxprev kernel: [19683068.279488] slapd[27112] general protection ip:7f9c3520cac9 sp:7f9bc9eb2960 error:0 in libc-2.13.so[7f9c35191000+182000] To work around this error I added the lines: # Remove os '**" da pesquisa 'mail=**' evitando o segfault rwm-rewriteContext searchFilter rwm-rewriteRule "(.*)(\\* ?\\*)(.*)" "$1*$3" "@I" This problem also occurs in other versions of slapd native Debian and Ubuntu. Without the overlay rwm not occur this BUG . Can anyone confirm if it is really a bug in the " rwm overlay" ? Regards, Jarbas

3 4

subtree-exclude (was Re: slapd-meta exclude syntax; larger problem with rwm, collective attributes.)
by Dan Pritts 12 Feb '14

12 Feb '14

Hi - Anyone have any thoughts about my question about "subtree-exclude" with slapd-meta? > Dan Pritts <mailto:danno@umich.edu> > February 7, 2014 at 10:51 AM > Hi folks - > > first, a simple, direct question. I'm trying to use the meta backend, > and exclude part of the > back-end directory (which is AD, if that matters). > > I tried the following config: > > -------------------------- > include /usr/local/pkg/openldap-2.4.39/etc/openldap/schema/core.schema > include > /usr/local/pkg/openldap-2.4.39/etc/openldap/schema/cosine.schema > include > /usr/local/pkg/openldap-2.4.39/etc/openldap/schema/inetorgperson.schema > include /usr/local/pkg/openldap-2.4.39/etc/openldap/schema/nis.schema > > pidfile /var/run/openldap/slapd-filter.pid > argsfile /var/run/openldap/slapd-filter.args > > loglevel any > > access to * > by * read > > database meta > suffix "dc=adsroot,dc=itd,dc=umich,dc=edu" > uri > "ldap://adsroot.itd.umich.edu/dc=adsroot,dc=itd,dc=umich,dc=edu" > rootdn "cn=Manager,dc=adsroot,dc=itd,dc=umich,dc=edu" > > #subtree-exclude > "ou=ICPSR,ou=Organizations,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu" > #subtree-exclude > "ou=ICPSR,ou=Accounts,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu" > subtree-exclude > "dn.subtree:ou=ICPSR,ou=Organizations,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu" > subtree-exclude > "dn.subtree:ou=ICPSR,ou=Accounts,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu" > -------------------------- > > As you can see i tried two syntaxes for subtree-exclude. with either > one, a search for "cn=danno" returns > dn: > cn=danno,ou=ICPSR,ou=Accounts,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu > > What am I doing wrong? Or do I misunderstand what subtree-exclude is > supposed to be doing? > > openldap 2.4.39 on centos 6, x64. > -- Dan Pritts ICPSR Computing & Network Services University of Michigan +1 (734)615-7362

1 0

Simple way to check that MMR is in sync?
by Philip Colmer 12 Feb '14

12 Feb '14

Hi I've got a 2-node setup for master-master replication. Other than creating or modifying a record on one node and then checking/waiting for that change to appear on the other node, is there a recommended way to check that the nodes are in sync and not encountering any problems? Thanks. Philip

12 28

Syncrepl and MMR
by Borresen, John - 0442 - MITLL 12 Feb '14

12 Feb '14

All, Ok, grasping at straws here. This is the cn=config for mm-server1 as of yesterday. mm-server1: dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /usr/local/openldap/etc/openldap/slapd.conf olcConfigDir: /usr/local/openldap/etc/openldap/slapd.d olcArgsFile: /var/lib/openldap/run/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcListenerThreads: 1 olcLocalSSF: 71 olcPidFile: /var/lib/openldap/run/slapd.pid olcReadOnly: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcTLSProtocolMin: 0.0 olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal entryUUID: 1b256f1e-2f15-4538-8a6f-5b021d015e35 creatorsName: cn=config createTimestamp: 20140122200748Z olcLogLevel: stats olcSecurity: tls=0 olcServerID: 1 ldap://mm-server1.example.ldap olcServerID: 2 ldap://mm-server2.example.ldap entryCSN: 20140131211613.134974Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140131211613Z dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}syncprov olcModuleLoad: {1}accesslog structuralObjectClass: olcModuleList entryUUID: 1191cf8f-8d46-4f2e-8aba-e65537210029 creatorsName: cn=admin,cn=config createTimestamp: 20140129175231Z entryCSN: 20140129175429.232704Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129175429Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by self write by users read by anonymous auth olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 77451682-9629-4753-9a80-5cc0e69a7482 creatorsName: cn=config createTimestamp: 20140122200748Z entryCSN: 20140122200748.381523Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140122200748Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: d7f25d3b-7ad1-4625-a577-a23a22b5494d creatorsName: cn=config createTimestamp: 20140122200748Z entryCSN: 20140122200748.381523Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140122200748Z dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=example,dc=ldap olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=ldapadmin,dc=example,dc=ldap olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/openldap/openldap-data olcDbCacheSize: 1000 olcDbConfig: {0}# $OpenLDAP$ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databas es. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-d b/db/ref/env/db_config.html> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig:: ezh9Iwk8aHR0cDovL3d3dy5vcGVubGRhcC5vcmcvZmFxL2luZGV4LmNnaT9maWxl PTI+ olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon re building olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 0.25 GB cache olcDbConfig: {16}set_cachesize 0 268435456 1 olcDbConfig: {17} olcDbConfig: {18}# Data Directory olcDbConfig: {19}#set_data_dir db olcDbConfig: {20} olcDbConfig: {21}# Transaction Log settings olcDbConfig: {22}set_lg_regionmax 262144 olcDbConfig: {23}set_lg_bsize 2097152 olcDbConfig: {24}#set_lg_dir logs olcDbConfig: {25} olcDbConfig: {26}# Note: special DB_CONFIG flags are no longer needed for "qui ck" olcDbConfig:: ezI3fSMgc2xhcGFkZCg4KSBvciBzbGFwaW5kZXgoOCkgYWNjZXNzIChzZWUgdGhl aXIgLXEgb3B0aW9uKS4g olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn eq,sub olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: sn eq,sub olcDbIndex: mail eq,sub olcDbIndex: departmentNumber eq olcDbIndex: automountKey eq olcDbIndex: memberUid eq olcDbIndex: printerURI eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 5a87b5f1-c445-4e0e-ba97-6d2d63093704 creatorsName: cn=config createTimestamp: 20140122200748Z olcMirrorMode: TRUE olcLimits: {0}dn.exact="cn=ldapadmin,dc=example,dc=ldap" size=unlimited time=u nlimited olcSyncrepl: {0}rid=002 provider=ldap://mm-server2.example.ldap bindmethod=simple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcSyncrepl: {1}rid=001 provider=ldap://mm-server1.example.ldap bindmethod=simple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn.exact="cn=ldapadmin,dc=example,dc=ldap" write by dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" read by * none olcAccess: {1}to * by * read entryCSN: 20140203200931.503493Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140203200931Z dn: olcOverlay={0}syncprov,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 04afe1bf-40c7-425a-8b25-74f8687323fc creatorsName: cn=admin,cn=config createTimestamp: 20140129180447Z entryCSN: 20140129180447.701059Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180447Z dn: olcOverlay={1}accesslog,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig entryUUID: 54b5fa00-8244-41d3-923d-0743a10bf192 creatorsName: cn=admin,cn=config createTimestamp: 20140129180903Z entryCSN: 20140129180903.479192Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180903Z dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/openldap/accesslog olcSuffix: cn=accesslog olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart structuralObjectClass: olcBdbConfig entryUUID: ff63820b-fbe4-4a65-8c00-99e2cc28fca5 creatorsName: cn=admin,cn=config createTimestamp: 20140129175923Z olcAccess: {0}to * by dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" w rite by * none olcLimits: {0}dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" time.soft =unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcRootDN: uid=replicator,ou=Admins,dc=example,dc=ldap entryCSN: 20140203190415.581904Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140203190415Z dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 9246709d-7a9b-41f3-bca8-f665add4e4f2 creatorsName: cn=admin,cn=config createTimestamp: 20140129180331Z entryCSN: 20140129180331.702641Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180331Z mm-server2: dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /usr/local/openldap/etc/openldap/slapd.conf olcConfigDir: /usr/local/openldap/etc/openldap/slapd.d olcArgsFile: /var/lib/openldap/run/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcListenerThreads: 1 olcLocalSSF: 71 olcPidFile: /var/lib/openldap/run/slapd.pid olcReadOnly: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcTLSProtocolMin: 0.0 olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal entryUUID: 84a58742-a1ce-4714-a743-14daf3f40c75 creatorsName: cn=config createTimestamp: 20131218155313Z olcLogLevel: stats olcSecurity: tls=0 olcServerID: 1 ldap://mm-server1.example.ldap olcServerID: 2 ldap://mm-server2.example.ldap entryCSN: 20140131211906.564734Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140131211906Z contextCSN: 20140206183618.370299Z#000000#002#000000 contextCSN: 20140121211615.993780Z#000000#004#000000 dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}syncprov olcModuleLoad: {1}accesslog structuralObjectClass: olcModuleList entryUUID: ab2c7f52-e10f-4233-aa17-ac8b051defcf creatorsName: cn=admin,cn=config createTimestamp: 20140129182320Z entryCSN: 20140129182642.147840Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129182642Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by self write by users read by anonymous auth olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 46ec808c-285f-442f-8c70-d5bb8c2d39de creatorsName: cn=config createTimestamp: 20131218155313Z entryCSN: 20131218155313.477459Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20131218155313Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 4354a8b6-8a36-4804-81f8-14a8550aef74 creatorsName: cn=config createTimestamp: 20131218155313Z entryCSN: 20131218155313.477459Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20131218155313Z dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 644d3984-d125-446e-aae2-1ddc541f4661 creatorsName: cn=admin,cn=config createTimestamp: 20140121191314Z entryCSN: 20140121191314.076259Z#000000#004#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140121191314Z dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=example,dc=ldap olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=ldapadmin,dc=example,dc=ldap olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/openldap/openldap-data olcDbCacheSize: 1000 olcDbConfig: {0}# $OpenLDAP$ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databas es. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-d b/db/ref/env/db_config.html> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig:: ezh9Iwk8aHR0cDovL3d3dy5vcGVubGRhcC5vcmcvZmFxL2luZGV4LmNnaT9maWxl PTI+ olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon re building olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 0.25 GB cache olcDbConfig: {16}#set_cachesize 0 268435456 1 olcDbConfig: {17}set_cachesize 0 2147483648 1 olcDbConfig: {18} olcDbConfig: {19}# Data Directory olcDbConfig: {20}#set_data_dir db olcDbConfig: {21} olcDbConfig: {22}# Archive/deletion olcDbConfig: {23}set_flags DB_LOG_AUTOREMOVE olcDbConfig: {24} olcDbConfig: {25}# Transaction Log settings olcDbConfig: {26}set_lg_regionmax 262144 olcDbConfig: {27}set_lg_bsize 2097152 olcDbConfig: {28}#set_lg_dir logs olcDbConfig: {29} olcDbConfig: {30}# Note: special DB_CONFIG flags are no longer needed for "qui ck" olcDbConfig:: ezMxfSMgc2xhcGFkZCg4KSBvciBzbGFwaW5kZXgoOCkgYWNjZXNzIChzZWUgdGhl aXIgLXEgb3B0aW9uKS4g olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn eq,sub olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: sn eq,sub olcDbIndex: departmentNumber eq olcDbIndex: mail eq,sub olcDbIndex: automountKey eq olcDbIndex: memberUid eq olcDbIndex: printerURI eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 94ff450b-aa70-4507-9ca6-51cdd740ea3e creatorsName: cn=config createTimestamp: 20131218155313Z olcMirrorMode: TRUE olcLimits: {0}dn.exact="cn=ldapadmin,dc=example,dc=ldap" size=unlimited time=u nlimited olcSyncrepl: {0}rid=001 provider=ldap://mm-server1.example.ldap bindmethod=si mple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcSyncrepl: {1}rid=002 provider=ldap://mm-server2.example.ldap bindmethod=si mple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn.exact="cn=ldapadmin,dc=example,dc=ldap" write by dn.exact="uid=r eplicator,ou=Admins,dc=example,dc=ldap" read olcAccess: {1}to * by * read entryCSN: 20140206183618.370299Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140206183618Z dn: olcOverlay={0}accesslog,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {0}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig entryUUID: 6e4e1508-5eb9-4372-bbd1-813f859b0acc creatorsName: cn=admin,cn=config createTimestamp: 20140129182321Z entryCSN: 20140129182321.004272Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129182321Z dn: olcOverlay={1}syncprov,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 9108e0db-ba9e-4b40-b743-4016c61582bc creatorsName: cn=admin,cn=config createTimestamp: 20140129183014Z entryCSN: 20140129183014.073365Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129183014Z dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/openldap/accesslog olcSuffix: cn=accesslog olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart structuralObjectClass: olcBdbConfig entryUUID: 9b42a346-de9b-42d5-8a3b-3167f80d4b01 creatorsName: cn=admin,cn=config createTimestamp: 20140129182320Z olcAccess: {0}to * by dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" w rite by * none olcLimits: {0}dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" time.soft =unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcRootDN: uid=replicator,ou=Admins,dc=example,dc=ldap entryCSN: 20140203190210.968231Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140203190210Z dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 0366206b-4295-4463-952c-0b233646c24d creatorsName: cn=admin,cn=config createTimestamp: 20140129182831Z entryCSN: 20140129182831.866738Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129182831Z dn: olcDatabase={3}monitor,cn=config objectClass: olcDatabaseConfig olcAccess: {0}to dn.children="cn=monitor" by dn.children="cn=admin,cn=config" read olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcMonitoring: TRUE structuralObjectClass: olcDatabaseConfig entryUUID: 691d6dfc-82af-4e12-8f03-be93d5d5436b creatorsName: cn=admin,cn=config createTimestamp: 20140114170424Z entryCSN: 20140114170424.436842Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140114170424Z olcDatabase: {3}monitor An attempt IS being made between mm-server1 and mm-server2: Log output from mm-server1: <= ldap_dn2bv(cn=accesslog)=0 52fb7a31 SRCH "cn=accesslog" 2 052fb7a31 0 0 0 52fb7a31 filter: (objectClass=*) 52fb7a31 attrs:52fb7a31 reqDN52fb7a31 reqType52fb7a31 reqMod52fb7a31 reqNewRDN52fb7a31 reqDeleteOldRDN52fb7a31 reqNewSuperior52fb7a31 entryCSN52fb7a31 52fb7a31 base_candidates: base: "cn=accesslog" (0x00000001) 52fb7a31 send_ldap_result: err=0 matched="" text="" 52fb7a31 send_ldap_result: err=0 matched="" text="" 52fb7a31 connection_get(36) 52fb7a6d connection_get(36) => ldap_bv2dn(cn=ldapadmin,dc=example,dc=ldap,0) <= ldap_bv2dn(cn=ldapadmin,dc=example,dc=ldap)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=ldapadmin,dc=example,dc=ldap)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=ldapadmin,dc=example,dc=ldap)=0 Log output from mm-server2: 52fb7a0f attrs:52fb7a0f *52fb7a0f 52fb7a0f base_candidates: base: "cn=role2,ou=sudoers,dc=example,dc=ldap" (0x00000271) 52fb7a0f send_ldap_result: err=0 matched="" text="" ldap_build_search_req ATTRS: reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN 52fb7a31 do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) 52fb7a31 do_syncrepl: rid=001 rc -1 retrying ldap_build_search_req ATTRS: reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN 52fb7a6d do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) 52fb7a6d do_syncrepl: rid=001 rc -1 retrying ldap_build_search_req ATTRS: reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN 52fb7aa9 do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) 52fb7aa9 do_syncrepl: rid=001 rc -1 retrying ldap_build_search_req ATTRS: reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN 52fb7ae5 do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) 52fb7ae5 do_syncrepl: rid=001 rc -1 retrying Thanks in advance... John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

1 0

how to manage groups in different machines using LDAP
by Daniel Szortyka 11 Feb '14

11 Feb '14

Hey guys, I'm new in the forum and new in the LDAP world. I have my environment set up and working fine so far. I have a LDAP server and few other stations which autenticate in my server, OK so far. However, I have applications running exclusively with a special group, let's say "SAS" and that's my problem. Group SAS in MachineA is GID = 501 (/etc/groups) Group SAS in MachineB is GID = 502 (/etc/groups) (this was defined some time ago.. every computer has a different GID for Group SAS) UserA was created with GID = 501 in LDAP. The problem is that when UserA authenticates in MachineB, he doesn't have a group assigned. I would like to know which direction I should go to make sure no matter what computer the user authenticates, he'll get the right group assigned. Tks in advance. -Daniel Szortyka Porto Alegre / RS / Brasil SysAdm at IBOPE -- Esta mensagem é destinada exclusivamente para a(s) pessoa(s) a quem é dirigida, podendo conter informação confidencial. Se você não for destinatário desta mensagem, desde já fica notificado de abster-se a divulgar, copiar, distribuir, examinar ou, de qualquer forma, utilizar a informação contida nesta mensagem, por ser ilegal. Caso você tenha recebido esta mensagem por engano, pedimos que nos retorne este E-Mail, promovendo, desde logo, a eliminação do seu conteúdo em sua base de dados, registros ou sistema de controle. This message is exclusively destined for the people to whom it is directed, and it can bear private and/or legally exceptional information. If you are not addressee of this message, since now you are advised to not release, copy, distribute, check or, otherwise, use the information contained in this message, because it is illegal. If you received this message by mistake, we ask you to return this email, making possible, as soon as possible, the elimination of its contents of your database, registrations or controls system. Este mensaje ha sido enviado exclusivamente para la(s) persona(s) destinataria(s) y puede contener información confidencial. Si Usted no es el destinatario, esta desde ya compelido a no divulgar, copiar, distribuir, examinar o, de cualquier manera, utilizar la información contenida en este mensaje, por razones legales. Caso Usted haya recibido este mensaje equivocadamente, favor contestar al remitente en forma inmediata, borrándolo de su base de datos, registros o sistema de control.

2 3

Accelog overlay do not register unbind idletimeout
by David Tello 11 Feb '14

11 Feb '14

Hi all, I have a doubt. I have a idletimeout and it's working correctly. The session die after this time and new binds are required. The problem es that this automatic unbind isn't appears in the accesslog. No problem with the binds but there isn't any automatic unbind. I think that the configuration of overlay accesslog is correct, because the manual unbind appears correctly. Someone know if is this the normal behavior? Thanks for your time.

1 0

Problem with ppolicy
by Mikael Nehlsen 11 Feb '14

11 Feb '14

Hello! I have a problem with the ppolicy module. I have 2 ldaptrees dc=example,dc=com and o=external and I want to have password policies (lockout after 5 failed login attempts) and I can see that it works on dc=example,dc=com but it does not work on o=external. Both trees save failed login attempts but only the first tree locks people out o=external just saves more and more failed attempts but never lockout the user. I have tried a lot of things and I can not figure out what the problem is. I hope someone here can help me. It is 2 replicated ubuntu 10.04 servers with openldap 2.4.21-0ubuntu5.7 and the ppolicy configuration looks like this: ppolmodule.ldif : dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModuleLoad: ppolicy.la ldapadd -x -D "cn=admin,cn=config" -w password -f ~/ppolmodule.ldif -h ldap1 ppol.ldif: dn: ou=policies,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: policies dn: cn=default,ou=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxFailure: 5 pwdMinLength: 6 ldapadd -x -D "cn=admin,dc=example,dc=com" -w password -f ~/ppol.ldif -h ldap1 ppol_external.ldif: dn: ou=policies,o=external objectClass: organizationalUnit objectClass: top ou: policies dn: cn=default,ou=policies,o=external objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxFailure: 5 pwdMinLength: 6 ldapadd -x -D "cn=admin,dc=example,dc=com" -w password -f ~/ppol_external.ldif -h ldap1 ppoloverlay.ldif: dn: olcOverlay=ppolicy,olcDatabase={1}bdb,cn=config olcOverlay: ppolicy objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: FALSE olcPPolicyDefault: cn=default,ou=policies,dc=example,dc=com ppoloverlay_external.ldif: dn: olcOverlay=ppolicy,olcDatabase={2}bdb,cn=config olcOverlay: ppolicy objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: FALSE olcPPolicyDefault: cn=default,ou=policies,o=external ldapadd -x -D "cn=admin,cn=config" -w password -f ~/ppoloverlay.ldif -h ldap1 ldapadd -x -D "cn=admin,cn=config" -w password -f ~/ppoloverlay_external.ldif -h ldap1 I tried with only one default policy for both trees as well, it made no difference. /Mikael

1 1

Recommended version of BDB package
by Mark Cairney 11 Feb '14

11 Feb '14

Hi, Having recently experienced some issues with our Live server (2.4.38, Scientific Linux 6.4 64-bit) I was looking into possible causes and found the following Debian bug report which suggests that BDB 5.X is problematic with OpenLDAP. What's the "best" version of BDB to go with- I see 4.7.25 "with patches" mentioned in the posting and I noticed that this is the version shipped with LTB. If I were to downgrade my BDB database would this be the best one to go for? I would like to migrate to MDB but there's an issue with alias de-referencing that's a bit of a deal-breaker for us at the moment as a number of our departments use them to provide subsets of their own users(ITS#7657). Kind regards, Mark -- /**************************** Mark Cairney ITI UNIX Section Information Services University of Edinburgh Tel: 0131 650 6565 Email: Mark.Cairney(a)ed.ac.uk *******************************/ The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

5 9

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical