openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

TLS negation failure
by espeake＠oreillyauto.com 19 Sep '13

19 Sep '13

We have a client server that is failing on the ssl handshake using TLS. The following is from the server log when the client is trying to connect. Sep 19 09:12:49 tntest-ldap-3 slapd[18796]: conn=3534 fd=28 ACCEPT from IP=172.17.1.10:55469 (IP=0.0.0.0:389) Sep 19 09:12:49 tntest-ldap-3 slapd[18796]: conn=3534 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Sep 19 09:12:49 tntest-ldap-3 slapd[18796]: conn=3534 op=0 STARTTLS Sep 19 09:12:49 tntest-ldap-3 slapd[18796]: conn=3534 op=0 RESULT oid= err=0 text= Sep 19 09:12:50 tntest-ldap-3 slapd[18796]: conn=3534 fd=28 closed (TLS negotiation failure) On the client when I run the following: openssl s_client -showcerts -connect tntest-ldap.oreillyauto.com:389 I get this on the client CONNECTED(00000003) 139669033973408:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 226 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE If I do the same command on port 636 I can see the certificate. All of our applications that use ldap are all set for TLS. Even if I force them to port 636 they fail. Any ideas to look at are appreciated. Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 2

auditing failed login attempts
by Paul B. Henson 18 Sep '13

18 Sep '13

Our security group is hassling us because we don't currently provide them an audit log of failed login attempts on our LDAP servers. For most of our other systems, we simply provide them a syslog feed with this information. However, openldap doesn't appear to have a logging level that provides detail about login attempts on a single line, but rather across many lines that would need to be correlated. It seems more like connection debugging logging as opposed to authentication logging. It looks like we might need to set up an accesslog overlay to log all of the attempted binds and then have a separate process that runs through that and generates the syslog feed to our ISO group's central logging server? That's a bit more overhead than I would like. Are there any other simpler ways of generating failed login logs? Thanks much.

5 8

Re: Multi-master setup in debian
by Listas de Correo 17 Sep '13

17 Sep '13

On Tue, Sep 17, 2013 at 9:49 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, September 17, 2013 9:06 PM -0300 Listas de Correo < > toshiro.listas(a)gmail.com> wrote: > > Would you mind to provide me more details about the bugs and potential >> problems of using Debian packages? I'm not putting your statements in >> doubt, I just need to have solid and documented arguments to convince my >> boss that this extra work is really needed. >> > > Read the release notes for OpenLDAP: > > <http://www.openldap.org/**software/release/changes.html<http://www.openldap.org/software/release/changes.html> > > > > The FAQ from the Debian OpenLDAP package maintainers: > > <http://www.openldap.org/faq/**data/cache/1456.html<http://www.openldap.org/faq/data/cache/1456.html> > > > > The use of GnuTLS (What Debian links to instead of OpenSSL) is harmful: > > <http://www.openldap.org/lists/openldap-devel/200802/msg00072.html> > Ok, thanks for the info, I will look into it right away. I have an additional question about compiling from source: how do you handle upgrades? In Debian, I've just use apt-get upgrade, in the case of compiliing yourself, you just compile and then 'make install'? Is that enough or do you need to do any previous housekeeping? (I'm asking because I haven't found any mention of upgrade in the Administrator's Guide)

2 1

Re: Multi-master setup in debian
by Listas de Correo 17 Sep '13

17 Sep '13

Hi Quanah, On Tue, Sep 17, 2013 at 12:21 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > It is always interesting to me when someone emails the technical list, > asking for guidance from people who know the most about the software, and > then ignore it. I know what you mean, I've suffered that myself :) but there's a valid reason for trying to ignore your suggestion (that I explained in a previous message). > The Debian build of OpenLDAP is old, links to a potentially insecure SSL > implementation, and has a variety of known bugs present in it that are > known to affect replication, particularly multi-master. Understand that by > continuing to use the Debian package, you are essentially setting yourself > up for failure when looking at using Multi-Master Replication. > Would you mind to provide me more details about the bugs and potential problems of using Debian packages? I'm not putting your statements in doubt, I just need to have solid and documented arguments to convince my boss that this extra work is really needed. Thanks in advance for your help!

3 2

seeding memberOf attribute
by Paul B. Henson 17 Sep '13

17 Sep '13

We are looking at adding the memberOf overlay to an existing deployment. >From what I can tell, after the configuration on all of the servers has been updated, all of the members need to be removed and then re-added for all existing groups in order to get this new attribute populated? We have a lot of groups, with a lot of members; that's going to be quite a bit of churn. I just want to double check there wasn't a simpler/more efficient mechanism before I started down that path. Thanks much.

1 0

invalid syntax (21) error while importing password password policy
by Philip Bubel 17 Sep '13

17 Sep '13

Running OpenLdap 2.4.23 on Centos 6.4 and we are having truoble enabling password polices. I've read a number of FAQ's online, plus spent hours searching for a solution to this problem, although a lot of folks seem to have the same issue I haven't been able to find a solution that works for us. I run into trouble running ldapadd to import the new policy. I end up with the invalid syntax error I've included below, along with a copy of the .ldif file and my slapd.conf file. I was able to create the policies OU without issue, I also tried using the OID for pwdAttribute instead of userPassword. [root@asu10d schema]# ldapadd -D "cn=Manager,dc=XXXX,dc=test" -W -x -f /tmp/ppolicy.ldif Enter LDAP Password: adding new entry "cn=policy,ou=policies,dc=XXXX,dc=test" ldap_add: Invalid syntax (21) additional info: pwdAttribute: value #0 invalid per syntax Contents of policy.ldif n: cn=policy,ou=policies,dc=XXXX,dc=test cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 0 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value Contents of my slapd.conf include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/pmi.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib64/openldap moduleload ppolicy.la TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt TLSCertificateFile /etc/pki/tls/certs/slapd.pem TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem database config access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.exact="cn=Manager,dc=XXXX,dc=test" read by * none database bdb suffix "dc=XXXXX,dc=test" checkpoint 1024 15 rootdn "cn=Manager,dc=XXXX,dc=test" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw hello (Temp password used for testing) overlay ppolicy policy_default "cn=default,ou=policies,dc=XXXX,dc=test" policy_use_lockout directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub

6 21

RE: invalid syntax (21) error while importing password password policy
by Quanah Gibson-Mount 17 Sep '13

17 Sep '13

--On Tuesday, September 17, 2013 8:28 PM +0000 Sebastian Bianchi <Sebastian.Bianchi(a)zaisgroup.com> wrote: > Can anyone tell me how to get off this list? I can tell you a second time to stop hijacking threads. Read the email I sent you earlier about how to get removed. --Quanah -- Quanah Gibson-Mount Lead Engineer Zimbra Software, LLC -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Multi-master setup in debian
by Listas de Correo 17 Sep '13

17 Sep '13

Hi, I've "inherited" from a former sysadmin (among many other things) an LDAP server to administer :) ... it's installed on Debian 6.0; it's currently working ok but the company has another remote site now and wants to have a secondary LDAP server on the new location (in order to support the new remote users). Looking into the documentation I think the best configuration option is a N-way multi-master replication setup; unfortunately, I don't have experience with LDAP so I found difficult to implement this; I've found some good tutorials on the web but they're written for other versions of LDAP (for example, they use slapd.conf but on Debian, the configuration is in several directories under /etc/ldap/slapd.d). My big question is: ¿do you know of any resource (url link, book, whatever) that I can use as a reference to make this configuration? (in particular, I'd be more than happy if provides some examples in Debian). Of course, I'm willing to do my own work (study, research, etc) but I need some guidance regarding where to start (assume I have little LDAP knowledge). Thanks in advance for any help, tip, etc you may have!

7 9

Fwd: [GENERAL] Using LDAP for PostgreSQL permissions/authentication
by Stephan Fabel 17 Sep '13

17 Sep '13

Found on the Postgres mailing list... seems like some folks like to do user provisioning with config management tools rather than LDAP. I don't agree with the guy, but he does point out one issue that I find interesting, which is the absense of a "history" of sorts. Are you guys thinking of some sort of "snapshotting" / COW feature? Would something like that even make sense? -Stephan ---------- Forwarded message ---------- From: Stephen Frost Date: Fri, Sep 13, 2013 at 10:29 AM Subject: Re: [GENERAL] Using LDAP for PostgreSQL permissions/authentication Cc: pgsql-general(a)postgresql.org * Bill Moran wrote: > As documented, LDAP solves a few of the problems we have -- since everyone > will be in LDAP, we can use LDAP's password complexity rules and password > expiration to handle those security requirements, and (of course) when > someone changes their password, they don't have to remember to change it > on every server ... these are big wins. Better is to use Kerberos, imv. It's what AD does. > But it doesn't help with the headache of creating the accounts on all the > servers, or dropping them as part of employee termination procedures, or > doing security audits, or changing permissions on multiple servers when > an employee gets a promotion, etc. Nope; I'd use puppet or chef or something along those lines to deal with this aspect, much as I'd do with Unix accounts. Using nsswitch and tying every user name look up to LDAP has certain.. drawbacks. > Thus, when I go to log in as wmoran, LDAP checks my password, then informs > PostgreSQL to allow me in with specified roles, and I can do operations > granted to those roles. That's a little over-simplistic, isn't it? What about objects which are created by the 'wmoran' account? > Obviously, that's not how it works now ... my question is why not? Is it just > a matter of nobody's gotten to it yet, or are there issues that make such > an implementation difficult/troublesome/impossible? If it's possible, does > anyone have any concept of how hard it would be to implement? My gut feeling on this is 'pretty darn hard' and 'not sure there are many who really want it'. That last particularly because tools like puppet and chef exist and solve this problem in a better way, imv anyway, than LDAP. Back in the day, I was a big proponent of LDAPv3 and all of the nice things it did, but the complexities involved in "what happens when the network goes away" grew tiring and managing accounts through a config management system which also tracks history of changes, both to the master repo and to the individual systems, wins hands down. Thanks, Stephen ----------------------------------------

3 2

RE: unsubscribe
by Quanah Gibson-Mount 17 Sep '13

17 Sep '13

--On Tuesday, September 17, 2013 4:04 PM +0000 Sebastian Bianchi <Sebastian.Bianchi(a)zaisgroup.com> wrote: > How can I unsubscribe from this list? It is going to > Ryan.Palamara(a)zaisgroup.com and he is no longer with the company. This first thing you should never do is hijack a thread. You can read over <http://www.openldap.org/lists/> for information about the lists. Which, for example, can take you to <http://www.openldap.org/lists/mm/listinfo/openldap-technical> and then you can get the information on how to contact the moderator if you can't force unsubscribe your old employee. --Quanah -- Quanah Gibson-Mount Lead Engineer Zimbra Software, LLC -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical