openldap-technical

openldap-technical@openldap.org

9868 discussions

Replicating the Access Log
by Tim Gustafson 26 Jul '13

26 Jul '13

Hi, I'm using the accesslog overlay on all three of my LDAP servers to record BIND and WRITE operations. Is there any reason I can't replicate the data from cn=log on all three of my servers in MirrorMode so that all three of my servers contain a complete audit log of all bind and write operations? I tried to Google this, but all I'm findind is how-tos and questions about using accesslog and delta replication, which is not what I want. I want to actually replicate the contents of the accesslog itself between all of my servers. -- Tim Gustafson tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A

1 0

delta sync error message in log
by Ludovic Brochard 25 Jul '13

25 Jul '13

Hello, I use the 2.4.35 version of openldap. I have three master ldap mulit-delta-sync: ldap01, ldap02 and ldap03. We import data ldap03 on two others by a copy of the FileSystem. Upon restart, the three seem OK but we have in the logs files 3GB of message like this: Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Someone had an idea of the problem? Or significatuion of this message ? Thank you. -- If the automobile had followed the same development cycle as the computer, a Rolls-Royce would today cost $100, get a million miles per gallon, and explode once a year, killing everyone inside. Robert X. Cringely, InfoWorld magazine

6 5

cn=monitor issues.
by Mónico Briseño 25 Jul '13

25 Jul '13

Hi, there. I have installed ldap in Ubuntu 12.04. I decided to use cn=monitor. I added that line in the slap.conf script. I stopped and started the slpad deamon. After that I typed the following command: ldapsearch -x -D 'cn=admin,dc=example,dc=com' -W \ -b 'cn=monitor' -s base '(objectClass=*)' '*' '+' The results of this command is: extended LDIF # # LDAPv3 # base <> (default) with scope baseObject # filter: (objectclass=*) # requesting: -b cn=monitor (objectClass=*) * + # # dn: objectClass: top objectClass: OpenLDAProotDSE structuralObjectClass: OpenLDAProotDSE configContext: cn=config namingContexts: dc=example,dc=com supportedControl: 2.16.840.1.113730.3.4.18 supportedControl: 2.16.840.1.113730.3.4.2 supportedControl: 1.3.6.1.4.1.4203.1.10.1 supportedControl: 1.2.840.113556.1.4.319 supportedControl: 1.2.826.0.1.3344810.2.3 supportedControl: 1.3.6.1.1.13.2 supportedControl: 1.3.6.1.1.13.1 supportedControl: 1.3.6.1.1.12 supportedExtension: 1.3.6.1.4.1.4203.1.11.1 supportedExtension: 1.3.6.1.4.1.4203.1.11.3 supportedExtension: 1.3.6.1.1.8 supportedFeatures: 1.3.6.1.1.14 supportedFeatures: 1.3.6.1.4.1.4203.1.5.1 supportedFeatures: 1.3.6.1.4.1.4203.1.5.2 supportedFeatures: 1.3.6.1.4.1.4203.1.5.3 supportedFeatures: 1.3.6.1.4.1.4203.1.5.4 supportedFeatures: 1.3.6.1.4.1.4203.1.5.5 supportedLDAPVersion: 3 supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: NTLM entryDN: subschemaSubentry: cn=Subschema # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 However, I don't see nothing related with cn=monitor. What did I do wrong? Thanks in Advance -- M.S. José M. Briseño Cortés Universidad de Guadalajara Instructional Technologist Univ. Houston Moodle Teacher Certificate NTCM, IACEP, iNACOL, ACM member

4 3

Ldap features installed.
by Mónico Briseño 25 Jul '13

25 Jul '13

Hi, there. I installed Ldap in Ubuntu 12.04 Question: How can I know the ldap features are installed? -- M.S. José M. Briseño Cortés Universidad de Guadalajara Instructional Technologist Univ. Houston Moodle Teacher Certificate NTCM, IACEP, iNACOL, ACM member

2 1

str2entry: invalid value for attributeType objectClass #2 URGENT
by 25Dollar Tech 25 Jul '13

25 Jul '13

Hello Team, I have a problem with OpenLDAP exporting and importing in to a different machine. When I use slapadd -l /backupfilname.ldif I used to get below error message _ 0.16% eta 05m31s elapsed none spd 6.7 k/s 51f0c75b str2entry: invalid value for attributeType objectClass #2 (syntax 1.3.6.1.4.1.1466.115.121.1.38) slapadd: could not parse entry (line=168) . 0.28% eta 04m29s elapsed none spd 12.1 k/s Closing DB... Below is the line 168 168 dn: ou=Idmap,dc=example,dc=test,dc=com 169 objectClass: top 170 objectClass: organizationalUnit 171 objectClass: sambaUnixIdPool 172 ou: Idmap 173 structuralObjectClass: organizationalUnit 174 entryUUID: 22da7a76-16e0-102f-87b0-799f55e47d38 175 creatorsName: cn=admin,dc=example,dc=test,dc=com 176 createTimestamp: 20100628090609Z 177 uidNumber: 1000 178 gidNumber: 20001 179 entryCSN: 20100814084304.552975Z#000000#002#000000 180 modifiersName: cn=admin,dc=example,dc=test,dc=com 181 modifyTimestamp: 20100814084304Z I already installed samba.schema. what could be the reason then. -- *Thanks & Regards, 25dollarTech Team https://sites.google.com/site/25dollartech/* *Email: 25dollartechhelp(a)gmail.com*

2 1

lmdb - atomic actions
by Tomer Doron 24 Jul '13

24 Jul '13

wondering what the best strategy to achieve atomic updates with LMDB. what i am trying to achieve is a read then update atomic action given a highly concurrent use case, for example, if a key/value pair represents a counter, how does one increment or decrement the counter atomically. i am pretty sure mdb_get -> mdv_set sequence is not atomic, wondering if mdb_cursor_get -> mdv_cursor_put sequence is? perhaps a certain flag is required on the get action to achieve a lock? in my bdb implementation i used lockers to achieve this. thanks, tomer

2 3

TLS, integrity and root DSE
by Ulrich Windl 24 Jul '13

24 Jul '13

Hi! When trying to require integrity for LDAP connections by specifying "ssf=1" in Security, I have a problem with Perl where the cat bites its tail: It's recommended to query the root DSE for TLS extension before trying to use TLS like this: my $dse = $ldap->root_dse(); if ($dse->supported_extension(LDAP_EXTENSION_START_TLS)) { my $msg = $ldap->start_tls('verify' => 'require', 'capath' => '/etc/ssl/certs'); ... Unfortunately the root_dse() fails with the security restriction: "confidentiality required" Note: The manual says: "0 (zero) implies no protection, 1 implies integrity protection only" So is "confidentiality" actually "integrity" here, and are here any solutions to this problem? Regards, Ulrich Windl

3 2

root cannot change user password with command "passwd", sssd, pam, openldap
by Augustin Wolf 23 Jul '13

23 Jul '13

Hi list, I'm using CentOs 6.4, and moved user management to OpenLDAP. As far as it works fine for user - user can login, do `passwd` to change his password, etc. - it fails for root to change users passwords. Root have to use ldapmodify. Is it normal behavior, or do I have some configuration errors? For now, LDAP ACL was "turned off" - every user has manage permission. I know it's a security issue, but I wanted to remove potential interference. I will change this as soon as root can change users password. SELlinux was also turned off to eliminate it's potential interference. Iptables was "turned off", as well, though I thing it doesn't matter as long as port 389 is open. My configs, logs, etc are in here: http://fpaste.org/26708/ Thanks in advance, Augustyn

3 4

undocumented TLSProtocolMin
by Manuel Gaupp 23 Jul '13

23 Jul '13

Hi, OpenLDAP seems to support an undocumented configuration parameter "TLSProtocolMin" when linked against OpenSSL. It allows to set the minimum SSL/TLS protocol version: * TLSProtocolMin 768 # (3 << 8) disables SSLv2 * TLSProtocolMin 769 # ((3 << 8)+1) disables SSLv2 and SSLv3 As there's no documentation for TLSProtocolMin: Is this feature ready for production or is it experimental? Best regards, Manuel

3 2

need help interpreting "Error: ldap_back_is_proxy_authz returned 0, misconfigured URI?"
by Steve Eckmann 23 Jul '13

23 Jul '13

The answer would be obvious if we had a misconfigured URI, but I don't think we do. In fact, we are getting this error from the ldap/translucent proxy on a first attempt to retrieve a DN from a remote Active Directory, then a second identical ldapsearch always succeeds. That makes us think there might be a timing issue getting from our openldap server, through a forwarding proxy out of a DMZ, and finally to the target AD server. But since all the openldap log messages appear with the same timestamp, there would have to be a sub-second timeout somewhere in the path. Does openldap have any default sub-second timeouts? I haven't configured any of the slapd or slapd-ldap timeout options. Here is a typical log from a failed search: Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 fd=10 ACCEPT from IP=172.20.11.85:54864 (IP=0.0.0.0:636) Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 fd=10 TLS established tls_ssf=256 ssf=256 Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 op=0 BIND dn="cn=localuser,ou=users,ou=Native,dc=example,dc=com" method=128 Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 op=0 BIND dn="cn=localuser,ou=users,ou=Native,dc=example,dc=com" mech=SIMPLE ssf=0 Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 op=0 RESULT tag=97 err=0 text= Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 op=1 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(sAMAccountName=steve.eckmann)" Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 op=1 SRCH attr=cn Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 op=1 ldap_back_retry: retrying URI="ldap://172.30.11.20" DN="cn=remoteuser,ou=users,ou=system accounts,dc=example,dc=com" Jul 15 09:46:09 eck1 slapd[9198]: Error: ldap_back_is_proxy_authz returned 0, misconfigured URI? Jul 15 09:46:09 eck1 slapd[9198]: <= mdb_equality_candidates: (sAMAccountName) not indexed Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 op=2 UNBIND Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 fd=10 closed Thanks. Steve

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical