openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

MDB_BAD_RSLOT while executing slapacl
by Igor Zinovik 24 Dec '13

24 Dec '13

Hello. Today I run slapacl to test access rights and saw this: ldap3# sudo slapacl -F /etc/openldap/slapd.d/ ... ... 52a8ae51 mdb_opinfo_get: err MDB_BAD_RSLOT: Invalid reuse of reader locktable slot(-30783) read access to o: ALLOWED At http://symas.com/mdb/doc/group__errors.html#ga1b6cbb28da30e28c48c9df66dd398… I read explanation that this error means: Txn has too many dirty pages. slapd 2.4.36 with Linux kernel 3.7.10 x86_64. In my slapd I have single database with mdb backend: dn: olcDatabase={1}mdb,config ... olcDbNoSync: FALSE olcDbMaxSize: 1073741824 olcDbMode: 0600 olcDbSearchStack: 16 Two questions: 0. What might cause this error? 1. Should I worry about this?

2 8

How to configure LDAP for sync passwd and group between ubuntu machines?
by Peng Yu 24 Dec '13

24 Dec '13

Hi, I'm trying to find a succinct description on how to use LDAP for sync passwd and group between ubuntu machines. I only find some general information on LDAP but not specific for sync passwd and group. Could anybody point me some simple instructions on how to do so? Thanks. -- Regards, Peng

1 0

Question about search performance
by Ferne Quinlan 24 Dec '13

24 Dec '13

Hi, Is there someone use openldap on windows? I found the query performance on windows is too bad, Any solution or relevant official documents?

3 4

Fw: Fw: host Attribute --- Low Sensitivity/Aerospace Internal Use Only
by Warron S French 23 Dec '13

23 Dec '13

Low Sensitivity/Aerospace Internal Use Only NetWarrior, are you attempting to apply a TCP_Wrappers like behavior but implement it through LDAP? Warron French, MBA, SCSA ----- Forwarded by Warron S French/Emp/Aerospace/US on 12/23/2013 07:42 AM ----- From: Net Warrior <netwarrior863(a)gmail.com> To: openldap-technical <openldap-technical(a)openldap.org>, Date: 12/23/2013 07:36 AM Subject: host Attribute Sent by: openldap-technical-bounces(a)OpenLDAP.org Hi guys. I'm trying to restric some user to login to some server, googling around I found that some things can be donde with the host attribute, this is what I got. A user with host attribute and and a FQDN server on it server.comap.com , the pam_check_host_attr set to yes in the client configuration ( pam_ldap.conf / ldap.conf ), If I understand well the user can now login to that server, in my tests I can confirm that, what I notice is that the user can loging to all the other servers in the farm whaterver I set to the host attribute I read this article as a reference: thornelabs dot net /documentation/2013/02/01/linux-restrict-server-login-via-ldap-hostobject-objectclass-and-host-attribute.html Please, can someone shed some light on this or clarify what I'm trying to to is correct or wrong? Thanks for your time and support Regards Low Sensitivity/Aerospace Internal Use Only

3 3

host Attribute
by Net Warrior 23 Dec '13

23 Dec '13

Hi guys. I'm trying to restric some user to login to some server, googling around I found that some things can be donde with the host attribute, this is what I got. A user with host attribute and and a FQDN server on it server.comap.com , the pam_check_host_attr set to yes in the client configuration ( pam_ldap.conf / ldap.conf ), If I understand well the user can now login to that server, in my tests I can confirm that, what I notice is that the user can loging to all the other servers in the farm whaterver I set to the host attribute I read this article as a reference: thornelabs dot net /documentation/2013/02/01/linux-restrict-server-login-via-ldap-hostobject-objectclass-and-host-attribute.html Please, can someone shed some light on this or clarify what I'm trying to to is correct or wrong? Thanks for your time and support Regards

1 0

Fw: Fw: ADDING OBJECT CLASS --- Low Sensitivity/Aerospace Internal Use Only
by Warron S French 23 Dec '13

23 Dec '13

Low Sensitivity/Aerospace Internal Use Only John, I agree with Dieter, in fact I haven't finished reading this full thread yet, but my instinct was to suggest inetOrgPerson as the appropriate schema as well. Also, Terje, that is a great website I agree, but here's another one I discovered that was also very useful: http://ldap.akbkhome.com/index.php Warron French, MBA, SCSA The Aerospace Corporation Sr. UNIX SA & Storage Admin Mailstop: CH1-230 Desk: 571-307-5311 Cell: 703-967-8936 ----- Forwarded by Warron S French/Emp/Aerospace/US on 12/23/2013 07:06 AM ----- From: Terje Trane <terjet(a)funcom.com> To: openldap-technical(a)openldap.org, Date: 12/20/2013 04:10 AM Subject: Re: ADDING OBJECT CLASS Sent by: openldap-technical-bounces(a)OpenLDAP.org On 19.12.2013 22:39, Borresen, John - 0442 - MITLL wrote: > > I would like to add and objectClass(es) so that I can add, > emailAddress, employee number. Can someone refresh my memory on what > I need (objectClasses)? > > The objectClass inetOrgPerson that you can find in the file inetorgperson.schema has employeeNumber and mail and several other useful attributes. That is what we use. PS: I have found this useful: http://www.zytrax.com/books/ldap/ape/ --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com Low Sensitivity/Aerospace Internal Use Only

1 0

ADDING OBJECT CLASS
by Borresen, John - 0442 - MITLL 23 Dec '13

23 Dec '13

For my Users, currently utilizing the following: ObjectClass: account (structural) objectClass: posixAccount (auxiliary) objectClass: pwdPolicy (auxiliary) objectClass: shadowAccount (auxiliary) objectClass: top (abstract) cn: gidNumber: homeDirectory: pwdAttribute: uid: uidNumber: gecos: loginShell: pwdAllowUserChange: pwdMinLength: pwdMustChange: shadowLastChange: userPassword: I would like to add and objectClass(es) so that I can add, emailAddress, employee number. Can someone refresh my memory on what I need (objectClasses)? Thanks, John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420

6 7

Replicate cn=config between masters and slaves?
by Karsten Heymann 23 Dec '13

23 Dec '13

Hi, when setting up a cluster with 1+x masters and 1+x slaves, is it possible to use a single cn=config replicated between all of these? Or do masters and slaves need to have different settings anyhow. I'd like not to have to manage schema information and acls in two places. Best, Karsten

4 7

BIND ERROR
by Borresen, John - 0442 - MITLL 21 Dec '13

21 Dec '13

Built a test 2.4.38 server, port 389 (for now), trying to set up a NetApp filer. When attempting to run: Wcc -u jdoe No passwd entry for jdoe I can see on the server the following: 52b4adfe => bdb_search 52b4adfe bdb_dn2entry("ou=users,dc=example,dc=ldap") 52b4adfe search_candidates: base="ou=users,dc=example,dc=ldap" (0x000002d6) scope=2 52b4adfe => bdb_dn2idl("ou=users,dc=example,dc=ldap") 52b4adfe <= bdb_dn2idl: id=2 first=726 last=727 52b4adfe => bdb_equality_candidates (objectClass) 52b4adfe => key_read 52b4adfe <= bdb_index_read: failed (-30989) 52b4adfe <= bdb_equality_candidates: id=0, first=0, last=0 52b4adfe bdb_search_candidates: id=0 first=726 last=0 52b4adfe bdb_search: no candidates 52b4adfe send_ldap_result: conn=1007 op=5 p=3 52b4adfe send_ldap_response: msgid=12 tag=101 err=0 ber_flush2: 14 bytes to sd 20 Thanks in advance John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

2 1

Authentication problem
by Jean-Charles 20 Dec '13

20 Dec '13

Hello I have a problem authenticating from a client RedHat 6.3 to a server RedHat 6.3 Connection is ok I can change user when I am root with *su paula* with no problem When I change from non root to paula *su paula* : I am requested a password, but I get an incorrect password message despite the password bieng correct Here are the details : _*SERVER Configuration (obtained with slapcat) *_ The first database does not allow slapcat; using the first available one (2) bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (2). Expect poor performance for suffix "dc=jcs-PC,dc=home". dn: dc=jcs-PC,dc=home dc: jcs-PC objectClass: dcObject objectClass: organization o: NETEXPANSION structuralObjectClass: organization entryUUID: b9dcdb1e-f628-1032-8eef-4f234421cd34 creatorsName: cn=ldapadmin,dc=jcs-PC,dc=home createTimestamp: 20131210205228Z entryCSN: 20131210205228.791640Z#000000#000#000000 modifiersName: cn=ldapadmin,dc=jcs-PC,dc=home modifyTimestamp: 20131210205228Z dn: ou=employes,dc=jcs-PC,dc=home objectClass: organizationalUnit ou: employes structuralObjectClass: organizationalUnit entryUUID: 2008d924-f629-1032-8ef0-4f234421cd34 creatorsName: cn=ldapadmin,dc=jcs-PC,dc=home createTimestamp: 20131210205520Z entryCSN: 20131210205520.207551Z#000000#000#000000 modifiersName: cn=ldapadmin,dc=jcs-PC,dc=home modifyTimestamp: 20131210205520Z dn: cn=Paula Bionda,ou=employes,dc=jcs-PC,dc=home cn: Paula Bionda sn: Bionda uid: paula uidNumber: 503 gidNumber: 1100 gecos: Paula Bionda homeDirectory: /home/paula shadowLastChange: 10877 shadowMin: 0 shadowMax: 999999 shadowWarning: 7 shadowInactive: -1 shadowExpire: -1 shadowFlag: 0 structuralObjectClass: person entryUUID: e4f37848-f930-1032-985a-91cf669ea788 creatorsName: cn=ldapadmin,dc=jcs-PC,dc=home createTimestamp: 20131214172830Z loginShell: /bin/bash objectClass: top objectClass: person objectClass: posixAccount objectClass: shadowAccount userPassword:: e1NTSEF9aEFzWFZFejlIa2xQSUpFSFF2SnpoZmo1cTYzdzRLUlg= entryCSN: 20131219155524.533147Z#000000#000#000000 modifiersName: cn=Paula Bionda,ou=employes,dc=jcs-PC,dc=home modifyTimestamp: 20131219155524Z dn: ou=groups,dc=jcs-PC,dc=home objectClass: organizationalUnit ou: groups structuralObjectClass: organizationalUnit entryUUID: e1a8545a-fa85-1032-84b7-a9514c4c1551 creatorsName: cn=ldapadmin,dc=jcs-PC,dc=home createTimestamp: 20131216100923Z entryCSN: 20131216100923.403228Z#000000#000#000000 modifiersName: cn=ldapadmin,dc=jcs-PC,dc=home modifyTimestamp: 20131216100923Z dn: cn=mygroup,ou=groups,dc=jcs-PC,dc=home objectClass: top objectClass: posixGroup cn: mygroup gidNumber: 1100 memberUid: paula memberUid: giuseppe structuralObjectClass: posixGroup entryUUID: c26713a0-fa9f-1032-8b7d-155dd966052d creatorsName: cn=ldapadmin,dc=jcs-PC,dc=home createTimestamp: 20131216131437Z entryCSN: 20131216131437.881194Z#000000#000#000000 modifiersName: cn=ldapadmin,dc=jcs-PC,dc=home modifyTimestamp: 20131216131437Z _*CLIENT C*__*onfiguration *_ authconfig-tui gives [] Cache Infomation [*] Use LDAP [] Use NIS [] Use IPAV2 [] Use WinBind [*] Use MD5 Passwords [*] Use Shadow Passwords [*] Use LDAP Authentication [] Use Kerboros [*] Use Fingerprint Reader [] Use Windbind Authentication [*] Local Authorization is sufficient [] Use TLS ldap://192.168.1.12/ Base DN: dc=jcs-PC,dc=home _*Result su paula *_ a) when I am logged in as root, *su paula* logs me into paula : no problem b) when I am not logged in as root and I do *su paula* I am requested a password (as expected), but then I get incorrect password despite the password being correct Here is the log Dec 19 18:49:50 jcs-PC slapd[6441]: => slap_access_allowed: backend default read access granted to "(anonymous)" Dec 19 18:49:50 jcs-PC slapd[6441]: => access_allowed: read access granted by read(=rscxd) Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1005 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1006 fd=21 ACCEPT from IP=192.168.1.17:56000 (IP=0.0.0.0:389) Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1006 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1006 op=0 STARTTLS Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1006 op=0 RESULT oid= err=0 text= Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1006 fd=21 closed (TLS negotiation failure) Dec 19 19:04:43 jcs-PC slapd[6441]: conn=1005 op=4 UNBIND Dec 19 19:04:43 jcs-PC slapd[6441]: conn=1005 fd=14 closed And these are the last 2 lines of wireshark _Source_ _Destination_ _Protocol_ _Info_ 192.168.1.17(Client) 192.168.1.12 (Server) LDAP ExtendedReq LDAP_START_TLS_OID 192.168.1.12 192.168.1.17 LDAP ExtendedResp LDAP_START_TLS_OID responseName missing I am surprised about STARTLS because there seems to be nothing in my configuration files about TLS Thank you Axel --

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical