openldap-technical

openldap-technical@openldap.org

21 participants
9787 discussions

pcache makes slapd die after some seconds
by Norbert 25 Aug '22

25 Aug '22

Hi, when trying to use the pcache overlay for an MDB database instance, it seems to work, at least some first test search seem to be significantly improved but then the slapd process without anything in the logs (no segfault at least). Unfortunately it is not possible to restart the slapd process either, as it also soon dies after starting. The config used looks something like the following: dn: olcOverlay={0}pcache,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcPcacheConfig olcOverlay: {0}pcache olcPcache: mdb 1000 1 1000 100 olcPcacheAttrset: 0 bn attribute1 attribute2 objectClass olcPcacheTemplate: "(&(|(objectClass=)(objectClass=))(bn=))" 0 120 olcPcacheTemplate: "(bn=)" 0 120 dn: olcDatabase={0}mdb,olcOverlay={0}pcache,olcDatabase={1}mdb,cn=config objectClass: olcMdbConfig objectClass: olcPcacheDatabase olcDatabase: {0}mdb olcDbDirectory: /data/pcache olcDbIndex: objectClass eq olcDbIndex: bn pres,eq,sub Is pcache supposed to work as an overlay for mdb database? Or does it only work with an ldap backend db? Thanks, Norbert

2 2

ipService anyone?
by Ulrich Windl 24 Aug '22

24 Aug '22

Hi! Several years ago I added ipService to our LDAP Database, then I thought it's time to update it. Now I have a conceptual problem: Some services have multiple protocols and port numbers. For example "compressnet". While it's possible to assign unique names like cn=compressnet@2/tcp,... cn=compressnet@2/tcp,... cn=compressnet@3/tcp,... cn=compressnet@3/udp,... I wonder how a standard query for "compressnet" should look like. Basically I'd like to leave out the port (@n), but the IANA registry is not unique. I identified these: compressnet mit-ml-dev sql-net rap meter pip csdmbase csdm nmsp uma raid-cd ... optohost004 It seems ipService can have multiple values for ipServiceProtocol, cn, and ipServiceProtocol, but wouldn't that silently assume that all port numbers are valid for all listed protocols? For the example it would be any combination of (UDP,TCP) and (2,3). To me the only solution seems to force IANA to clean up the mess. RFC-6335/BCP-165 claims: "Service names are the unique key in the Service Name and Transport Protocol Port Number registry." (page 8) Opinions? Regards, Ulrich

1 0

Empty error when configuring OpenLDAP
by Cezary Drożak 23 Aug '22

23 Aug '22

Hello, I am trying to set up OpenLDAP on Arch Linux on my server, following instruction on Arch Wiki[1]. I prepared the config.ldif file, replacing every $BASEDN and $PASSWD in the example configuration: # The root config entry dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /run/openldap/slapd.args olcPidFile: /run/openldap/slapd.pid # Schemas dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema # TODO: Include further schemas as necessary include: file:///etc/openldap/schema/core.ldif # The config database dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootDN: cn=Manager,dc=example,dc=com # The database for our entries dn: olcDatabase=mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcSuffix: dc=example,dc=com olcRootDN: cn=Manager,dc=example,dc=com olcRootPW: {SSHA}xZqSQN4wG4+C5I57dB/Qm02vJ+kQcwd7 olcDbDirectory: /var/lib/openldap/openldap-data # TODO: Create further indexes olcDbIndex: objectClass eq Then I executed the following command: sudo -u ldap slapadd -n 0 -F /etc/openldap/slapd.d/ -l ./config.ldif This gave me the following error: invalid config directory /etc/openldap/slapd.d/, error 2 slapadd: bad configuration directory! I checked that the directory did not exist, so I created it and changed owner to `ldap`. The wiki page did not mention that the directory should be created earlier, so maybe it should have been created by a post installation script. If that's the case, I will report it to package maintainers. After I created the directory, I ran the command again, this time having a different error message: slapadd: could not add entry dn="cn=config" (line=1): Closing DB... I have no idea what is wrong now and I cannot find anything useful on the internet. Does anyone have an idea what I may be doing wrong here? [1]: https://wiki.archlinux.org/title/OpenLDAP

3 4

slapo-variant and searching virtual attrs
by Michael Ströder 23 Aug '22

23 Aug '22

HI! I have the need to search a whole sub-tree for something like collective attributes which AFAIK slapo-collect does not support. Now I'm wondering whether it's possible to search for the virtual attributes generated by slapo-variant. And probably I'd like to use the regex variant. I've read the section LIMITATIONS in slapo-variant(5) which says that regex variants only support reading the virtual attributes with scope base. It also implies that searching for these virtual attributes is not possible at all. Is that correct? Ciao, Michael.

2 1

using memberof to authenticate Linux with PAM
by Alceu Rodrigues de Freitas Junior 22 Aug '22

22 Aug '22

Greetings, For a matter of studying OpenLDAP, I decided to create a CLI in Golang that is based on the migrationtools (https://gitlab.com/future-ad-laboratory/migrationtools), which is written in Bash and (very old) Perl code. All the Golang module is available here: https://github.com/glasswalk3r/aprendendo-openldap/tree/main/migration. After learning about the memberof overlay, I've being wondering if it is possible to use it to maintain the UNIX groups at /etc/group instead of just replicating the same information over an over. I've tried to find references in the documentation of using PAM and NSCD in the Linux clients for authenticating from a OpenLDAP server, but found nothing regarding those requirements, neither a detailed explanation (without resorting looking into the source code) of how those requests from a Linux client would be sent to OpenLDAP in order to check that. If any has any pointers on the subject, I would be glad to receive them. Thanks in advance, Alceu

3 7

Proxying an insecure LDAP and authenticate using another
by Kevin Olbrich 22 Aug '22

22 Aug '22

Hi! I have a case where I got access to a read-only LDAP that has no authentication (everything is public). It is located in a secure and trusted environment. Now I want to expose the directory to another network and like to add authentication but can not add it to the source (proprietary software). I need to proxy this server and authenticate the users using active directory. I know how to proxy AD including passthrough authentication but can I proxy another directory and authenticate using another? If yes, how? Thank you very much. Kind regards Kevin Olbrich

1 0

Re: Pass-through
by Stéphane Veyret 20 Aug '22

20 Aug '22

Could it be that the SASL global configuration (also given in first message) is wrong? I only set those 2 options: olcSaslHost: localhost olcSaslSecProps: none

2 4

Re: Error: Could not locate TLS/SSL package
by Jeffrey Walton 17 Aug '22

17 Aug '22

On Wed, Aug 17, 2022 at 12:16 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > --On Wednesday, August 17, 2022 2:11 PM +0530 Vijay Maidarkar > <vmaidarkar(a)gmail.com> wrote: > > Hi, please keep replies on the list. > > Find below answers. > > > > Where is it installed? > > $ which openssl > > > > /usr/local/bin/openssl > > > > $ ldd /usr/local/bin/openssl > > linux-vdso.so.1 => (0x00007fff931e6000) > > libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007f7f7a570000) > > libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007f7f7a087000) > > libdl.so.2 => /lib64/libdl.so.2 (0x00007f7f79e83000) > > libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f7f79c67000) > > libc.so.6 => /lib64/libc.so.6 (0x00007f7f79899000) > > /lib64/ld-linux-x86-64.so.2 (0x00007f7f7a802000) > > > > How was it installed? > > I've downloaded the archive & done compilation from below cmds. > > > > $ ./config > > $ make > > $ make install There are other options you should be using for OpenSSL. At minimum, you probably want enable-ec_nistp_64_gcc_128 on x86_64. Also see https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_O… . > So, you built it yourself so there will be no development package. I'm not > sure why you built such an ancient version of OpenSSL (you listed OpenSSL > 1.1.1g when 1.1.1q is the most recent), since it's vulnerable to multiple > critical CVEs. > > I'd strongly advise using the packages from EPEL if you insist on staying > on CentOS7 (which is near end of life). > > If you are going to use your own OpenSSL build, I can't emphasize enough > the importance of using a current release. Since you're doing this in an > unpackaged way, maintenance is going to be a nightmare. > > Since you've built it yourself into its own location, you have to tell the > configure script where to find the development headers, like: > > CPPFLAGS="/usr/local/include" LDFLAGS="-L/usr/local/lib > -Wl,-rpath,/usr/local/lib" ./configure ... +1 for the RPATH. Linux (and other OSes) have a (mis)feature of building against one version of a library, and runtime linking against another version of the library. Be sure to specify the RPATH to avoid the bug. (If you want to see the effects of linking against the wrong library at runtime, see https://www.openwall.com/lists/oss-security/2020/07/20/1). Nowadays on Linux you should specify a RUNPATH, not a RPATH. The RUNPATH allows LD_LIBRARY overrides to search paths. It is recommended by the folks who write the runtime loaders. The options you need are: * -Wl,-rpath,<lib path> (enables RPATH) * -Wl,--enable-new-dtags (enables RUNPATH) Jeff

2 1

Re: Error: Could not locate TLS/SSL package
by Quanah Gibson-Mount 17 Aug '22

17 Aug '22

--On Wednesday, August 17, 2022 2:11 PM +0530 Vijay Maidarkar <vmaidarkar(a)gmail.com> wrote: > > > > > Hi Quanah, Hi, please keep replies on the list. > Find below answers. > > Where is it installed? > $ which openssl > > /usr/local/bin/openssl > > $ ldd /usr/local/bin/openssl > linux-vdso.so.1 => (0x00007fff931e6000) > libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007f7f7a570000) > libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007f7f7a087000) > libdl.so.2 => /lib64/libdl.so.2 (0x00007f7f79e83000) > libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f7f79c67000) > libc.so.6 => /lib64/libc.so.6 (0x00007f7f79899000) > /lib64/ld-linux-x86-64.so.2 (0x00007f7f7a802000) > > How was it installed? > I've downloaded the archive & done compilation from below cmds. > > $ ./config > $ make > $ make install So, you built it yourself so there will be no development package. I'm not sure why you built such an ancient version of OpenSSL (you listed OpenSSL 1.1.1g when 1.1.1q is the most recent), since it's vulnerable to multiple critical CVEs. I'd strongly advise using the packages from EPEL if you insist on staying on CentOS7 (which is near end of life). If you are going to use your own OpenSSL build, I can't emphasize enough the importance of using a current release. Since you're doing this in an unpackaged way, maintenance is going to be a nightmare. Since you've built it yourself into its own location, you have to tell the configure script where to find the development headers, like: CPPFLAGS="/usr/local/include" LDFLAGS="-L/usr/local/lib -Wl,-rpath,/usr/local/lib" ./configure ... However, I would again strongly advise you not go the route of building the software yourself unless you're going to do it in a packaged way (I.e. make RPMs) so that you can upgrade whenever there's a new vulnerability. Even more, I'd strongly advise just using the pre-built packages provided by either Symas (Which offers current builds of both OpenLDAP 2.5 and OpenLDAP 2.6 + supporting libraries) or the LTB project. <https://repo.symas.com/> <https://ltb-project.org/> Regards, Quanah

1 0

Error: Could not locate TLS/SSL package
by vmaidarkar＠gmail.com 16 Aug '22

16 Aug '22

Hi Team, I'm compiling OpenLDAP 2.5.13 on CentOS 7 & OpenSSL 1.1.1g is already installed & below is the command. ./configure --prefix=/opt/deployment/openldap_v13 --sysconfdir=/opt/deployment/openldap_v13/etc --localstatedir=/opt/deployment/openldap_v13/var --libexecdir=/opt/deployment/openldap_v13/libexec --enable-overlays=mod --enable-modules --enable-accesslog --enable-auditlog --enable-collect --enable-memberof --enable-syncprov --with-tls=openssl --enable-dynamic --enable-crypt --enable-slapd --enable-rlookups --disable-perl --enable-ppolicy --enable-backends=mod --disable-ndb --disable-sql --disable-shell --disable-bdb --disable-hdb I'm getting the below error of OpenSSL. checking for openssl/ssl.h... yes checking for SSL_export_keying_material_early in -lssl... no configure: error: Could not locate TLS/SSL package Could you please suggest how to fix this issue. Thanks, Vijay

4 6

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical