openldap-technical

openldap-technical@openldap.org

9897 discussions

ldif-diff / ldif->ldap sync utilities
by Hallvard Breien Furuseth 17 Jan '14

17 Jan '14

[There doesn't seem to be an active general LDAP list anymore, so I hope it's OK to post here instead.] I need an ldif-diff utility (take two LDIF dumps and produce an .LDIF to change one to the other) and maybe an LDIF->LDAP sync program like this: - Give me some control of the order in which entries are output. I need to ensure that when a "mail:" value moves from one entry to another, it should temporarily occur in both entries rather than in neither. Usually that means output the 2nd entry first. - Fairly fast, but a slower and smarter mode would be nice. Fast mode can be crude, e.g. it need not know that "foo:: eHk=" means "foo: xy" and DN cn=x+uid=y,... matches uid=y+cn=x,... - Not resource-hungry. (Don't slurp the entire LDIFs into memory. Scan them to build a mapping {dn: filepos} or something.) - Don't generate a huge "replace: member" change when it instead can generate a small "delete:" + "add:" for the attribute change. (So it must be configured to know which attrs have an EQUALITY matching rule, at least when there is no server to ask.) - Preferably LDAP-novice-friendly error messages. It does *not* need to: - Detect renamed entries. - Certainly not convert anything to/from Unicode. Sometimes I've had to battle tools to stop them from deciding I want Latin1->UTF-8. - Preserve entry/attribute order. (But preserved attr.value order is nice for some attributes, even if LDAP does not guarantee it.) -- Hallvard

1 0

lmdb memory usage when writing lots of data with memorymap option
by Luc Vlaming 16 Jan '14

16 Jan '14

Hi, Currently I am creating support for using LMDB as a new storage backend for one of our products. At the moment I am testing import bulk data into lmdb using transactions that span a single record of 10MB. The total db size afterwards is 5GB. I also tested with records of 1MB. I noticed a very odd thing: when using the MDB_WRITEMAP option, memory usage grows very quickly and linear with the amount of data stored into the database. (memory usage ends up a bit higher than 5GB). when not using MDB_WRITEMAP, however, memory usage stays very low. Does anyone have a suggestion what might be wrong and what causes such different behaviour with and without using the memorymap option? FYI: - there are no long lived reads so that should not be the problem. - I am using the newest git version: ec97f49a6552a8ed599472d665ec7c16463b808c Regards, Luc Vlaming

3 8

Failed bind registry
by David Tello 15 Jan '14

15 Jan '14

I need to have in a exploitable format the failed binds. Something similar to the correct binds in the accesslog. I have seen that some people talks about the use of loglevel 256, but i thing that is too hard. Any help would be welcome. Thanks!

4 11

SETTING UP MONITOR
by Borresen, John - 0442 - MITLL 15 Jan '14

15 Jan '14

First, my apologies for the adding you, Quanah, to the cc list. Over the last few weeks, my emails have not been getting through to the openldap-technical group (haven't seen anything getting posted). Anyway, Trying to set up Monitor. I've created a Monitor directory in my ldap directory: /var/lib/openldap /var/lib/openldap/Monitor /var/lib/openldap/openldap-data All owned by ldap. My ldif looks like this: dn: olcDatabase=Monitor,cn=config objectClass:olcDatabaseConfig olcDatabase:Monitor olcAccess:dn.exact="cn=ldapadmin,dc=<my_group>,dc=ldap" write olcAccess:by users read olcAccess:by * none Getting two different errors: 1) Ldap_add: Other (e.g., implementation specific) error (80); additional info: <olcAccess> handlier exited with 1 2) Then after restarting slapd, and seeing no changes in the /var/lib/openldap/Monitor directory and ldapsearch returns # extended LDIF # # LDAPv3 # base <cn=Monitor> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 10 Referral ref: ldap://<ldap_server>.<my_group>.ldap/cn=Monitor??sub # numResponses: 1 John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

4 3

SSHA hashed passwords && retrieving the salt
by Matthias Apitz 15 Jan '14

15 Jan '14

Hello, I want to understand how to retrieve the 'salt' which was used by the LDAP server to hash a user's password with seeded sha1, i.e. SSHA; when I do a ldapsearch from the UNIX cmd line I get the attribute as: $ ldapsearch -h 10.45.xx.xx -p 389 -x -D ... 'cn=jrXXXXX' ... dn: cn=jrXXXXX,ou=user,ou=.... userPassword:: e1NTSEF9TWd3ZmtxQ25HdTJYVXZtVzNzTm5yWjlwVjBUSmwvQ0Q= ... the above string I can decode with: $ echo -n 'e1NTSEF9TWd3ZmtxQ25HdTJYVXZtVzNzTm5yWjlwVjBUSmwvQ0Q=' | mmencode -u {SSHA}MgwfkqCnGu2XUvmW3sNnrZ9pV0TJl/CD but now I'm lost how to retrieve the 'salt' from it :-( I have google'd around and see examples for this like in http://www.pressinganswer.com/444023/how-can-i-retrieve-a-salt-from-ldap <CITED ON> With SSHA, normally the salt is appended to the SHA1 hash and then the whole thing is Base64 encoded (I've never seen an LDAP that didn't do SSHA this way). You should be able to tell this by looking at the userPassword attribute. If it's 28 character long with a = at the end, it's only the hash. If the Base64 value is 32 character long or greater, it contains both the hash and the salt. Base64 decode the value and strip off the first 20 bytes, this is the SHA1 hash. The remaining bytes are the salt. Example: Base64 encoded hash with salt userPassword: {SSHA}MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0 Base64 decoded value SHA1 Hash Salt --------------------++++ 123456789012345678901234 <CITED OFF> I can repeat the given example with: $ echo -n 'MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0' | mmencode -u 123456789012345678901234 but when I run the original string through decode, I get only binary nonsense from: echo -n 'MgwfkqCnGu2XUvmW3sNnrZ9pV0TJl/CD' | mmencode -u 2 §íRùÞÃgð What I do wrong or what I'm missing here? The used 'mmencode' is on FreeBSD 10-CURRENT from a pkg: $ pkg_info -W /usr/local/bin/mmencode /usr/local/bin/mmencode was installed by package metamail-2.7_9 if this does any matter. Thanks matthias -- Matthias Apitz | /"\ ASCII Ribbon Campaign: www.asciiribbon.org E-mail: guru(a)unixarea.de | \ / - No HTML/RTF in E-mail WWW: http://www.unixarea.de/ | X - No proprietary attachments phone: +49-170-4527211 | / \ - Respect for open standards

2 3

strange error with openldap 2.4 and sql backend
by Adrian 15 Jan '14

15 Jan '14

Hi, I have a very strange issue with OpenLDAP 2.4 and the SQL backend. at_query fails although the exactly same query works fine with 2.3. I posted some details on this question on SF: http://serverfault.com/questions/566902/openldap-sql-backend-failing There's also this Gist containing my config, the full error message, etc.: https://gist.github.com/ThiefMaster/b47613f79d6a3ed879df Regards, Adrian

1 0

N-Way-Multimaster Configuration
by Borresen, John - 0442 - MITLL 15 Jan '14

15 Jan '14

Thanks for your help with my last post. Now, the next task, will be setting up an N-way multimaster: Server1 Server2 Server3 Server4 Using TLS. To create the certificates, finding a lot of varying ideas via google, what is the "best practice" to create certificates to where I don't have to touch each client if a server goes down. Create a wildcard cert or use the subjectAltName in the openssl.cnf file? John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

4 5

BDB fine grained lock manager
by Chris Card 14 Jan '14

14 Jan '14

Hi All, We are running openldap 2.4.36 and Berkeley DB 4.6.21 (+ 4 patches) on centos 6.3 64 bit. Does anyone know if building Berkeley DB with --enable-fine_grained_lock_manager is likely to make any difference to slapd performance? Chris

2 1

Re: N-Way-Multimaster Configuration
by Quanah Gibson-Mount 14 Jan '14

14 Jan '14

--On Tuesday, January 14, 2014 2:22 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > > > Thanks for your help with my last post. > > > > Now, the next task, will be setting up an N-way multimaster: > > Server1 > > Server2 > > Server3 > > Server4 > > > > Using TLS. To create the certificates, finding a lot of varying ideas > via google, what is the "best practice" to create certificates to > where I don't have to touch each client if a server goes down. Create > a wildcard cert or use the subjectAltName in the openssl.cnf file? I prefer to use a wildcard cert. I would note that a technically correct wildcard cert has *.domain in subjectAltname. On the flip side, virtually no CA creates certs that are compliant with the RFC for wildcards. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

RE: SETTING UP MONITOR
by Quanah Gibson-Mount 14 Jan '14

14 Jan '14

--On Tuesday, January 14, 2014 11:51 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Did I miss something? That link just showed me an ldif that isn't > telling me anything...that I haven't already seen in numerous google > searches. It is an example of a correctly configured monitor backend. Given that your attempt to add the monitor backend to your database is failing, I thought it might help you actually get it configured. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical