openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

RE: ssh with ldap authentication
by Rodney Simioni 06 Mar '13

06 Mar '13

Something new has just transpired. Before leaving work last night, I created 10 accounts and then tried to ssh in. All the logins failed prompting for the password. I came to work this morning, and now all the accounts are able to login successfully. Why is it taking so long for the accounts to work? From: Rodney Simioni Sent: Tuesday, March 05, 2013 2:17 PM To: 'openldap-technical(a)openldap.org' Subject: ssh with ldap authentication Hi, I'm new to LDAP. I just created a new user in LDAP and it cannot login through ssh. It keeps prompting for the password. Any help will be greatly appreciated. # dude12, people, wh.local dn: uid=dude12,ou=people,dc=wh,dc=local uid: dude12 cn: Johnny Appleseed objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e1NTSEF9K2E0YXVTWlYwckMwRUhsVWlNVzBrS2U3MzA1a1JrOVI= shadowLastChange: 15140 shadowMax: 99999 shadowWarning: 7 uidNumber: 1212 gidNumber: 1212 homeDirectory: /home/dude12 loginShell: /bin/bash # dude12, group, wh.local dn: cn=dude12,ou=group,dc=wh,dc=local objectClass: posixGroup objectClass: top cn: dude12 gidNumber: 1212 userPassword:: e0NSWVBUfXg= # search result search: 2 result: 0 Success # numResponses: 220 # numEntries: 219 ############################### When I created the user, the logs indicated. ############################### Mar 5 13:53:18 rodster slapd[2678]: => bdb_dn2id("uid=dude12,ou=people,dc=wh,dc=local") Mar 5 13:53:18 rodster slapd[2678]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) Mar 5 13:53:18 rodster slapd[2678]: => bdb_dn2id_add 0x628: "uid=dude12,ou=people,dc=wh,dc=local" Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 %ou=people,dc=wh,dc=local Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 @ou=people,dc=wh,dc=local Mar 5 13:53:18 rodster slapd[2678]: <= bdb_dn2id_add 0x628: 0 Mar 5 13:53:18 rodster slapd[2678]: => index_entry_add( 1576, "uid=dude12,ou=people,dc=wh,dc=local" ) Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [7c477315] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [1fd53424] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [02537054] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [53430dd1] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [5aef1f7f] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [acefc46f] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [caca4579] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [c37ad51a] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [9b3bdeb2] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [39ebd2f9] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [d7851707] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:54:51 rodster slapd[2678]: connection_get(24) Mar 5 13:54:51 rodster slapd[2678]: connection_get(24): got connid=1903 Mar 5 13:54:51 rodster slapd[2678]: connection_read(24): checking for input on id=1903 Mar 5 13:54:51 rodster slapd[2678]: ber_get_next on fd 24 failed errno=0 (Success) Mar 5 13:54:51 rodster slapd[2678]: connection_close: conn=1903 sd=24 ####################################### When I try to ssh as the user the logs indicates. ####################################### Mar 5 14:14:30 rodster slapd[2678]: slap_listener_activate(7): Mar 5 14:14:30 rodster slapd[2678]: >>> slap_listener(ldap:///) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17): got connid=1910 Mar 5 14:14:30 rodster slapd[2678]: connection_read(17): checking for input on id=1910 Mar 5 14:14:30 rodster slapd[2678]: op tag 0x60, time 1362510870 Mar 5 14:14:30 rodster slapd[2678]: conn=1910 op=0 do_bind Mar 5 14:14:30 rodster slapd[2678]: >>> dnPrettyNormal: <> Mar 5 14:14:30 rodster slapd[2678]: <<< dnPrettyNormal: <>, <> Mar 5 14:14:30 rodster slapd[2678]: do_bind: version=3 dn="" method=128 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: conn=1910 op=0 p=3 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: err=0 matched="" text="" Mar 5 14:14:30 rodster slapd[2678]: send_ldap_response: msgid=1 tag=97 err=0 Mar 5 14:14:30 rodster slapd[2678]: do_bind: v3 anonymous bind Mar 5 14:14:30 rodster slapd[2678]: connection_get(17) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17): got connid=1910 Mar 5 14:14:30 rodster slapd[2678]: connection_read(17): checking for input on id=1910 Mar 5 14:14:30 rodster slapd[2678]: op tag 0x63, time 1362510870 Mar 5 14:14:30 rodster slapd[2678]: conn=1910 op=1 do_search Mar 5 14:14:30 rodster slapd[2678]: >>> dnPrettyNormal: <dc=wh,dc=local> Mar 5 14:14:30 rodster slapd[2678]: <<< dnPrettyNormal: <dc=wh,dc=local>, <dc=wh,dc=local> Mar 5 14:14:30 rodster slapd[2678]: SRCH "dc=wh,dc=local" 2 0 Mar 5 14:14:30 rodster slapd[2678]: 1 0 0 Mar 5 14:14:30 rodster slapd[2678]: filter: (uid=dude12) Mar 5 14:14:30 rodster slapd[2678]: attrs: Mar 5 14:14:30 rodster slapd[2678]: host Mar 5 14:14:30 rodster slapd[2678]: authorizedService Mar 5 14:14:30 rodster slapd[2678]: shadowExpire Mar 5 14:14:30 rodster slapd[2678]: shadowFlag Mar 5 14:14:30 rodster slapd[2678]: shadowInactive Mar 5 14:14:30 rodster slapd[2678]: shadowLastChange Mar 5 14:14:30 rodster slapd[2678]: shadowMax Mar 5 14:14:30 rodster slapd[2678]: shadowMin Mar 5 14:14:30 rodster slapd[2678]: shadowWarning Mar 5 14:14:30 rodster slapd[2678]: uidNumber Mar 5 14:14:30 rodster slapd[2678]: Mar 5 14:14:30 rodster slapd[2678]: ==> limits_get: conn=1910 op=1 self="[anonymous]" this="dc=wh,dc=local" Mar 5 14:14:30 rodster slapd[2678]: => bdb_search Mar 5 14:14:30 rodster slapd[2678]: bdb_dn2entry("dc=wh,dc=local") Mar 5 14:14:30 rodster slapd[2678]: search_candidates: base="dc=wh,dc=local" (0x00000001) scope=2 Mar 5 14:14:30 rodster slapd[2678]: => bdb_dn2idl("dc=wh,dc=local") Mar 5 14:14:30 rodster slapd[2678]: => bdb_equality_candidates (objectClass) Mar 5 14:14:30 rodster slapd[2678]: => key_read Mar 5 14:14:30 rodster slapd[2678]: bdb_idl_fetch_key: [b49d1940] Mar 5 14:14:30 rodster slapd[2678]: <= bdb_index_read: failed (-30988) Mar 5 14:14:30 rodster slapd[2678]: <= bdb_equality_candidates: id=0, first=0, last=0 Mar 5 14:14:30 rodster slapd[2678]: => bdb_equality_candidates (uid) Mar 5 14:14:30 rodster slapd[2678]: => key_read Mar 5 14:14:30 rodster slapd[2678]: bdb_idl_fetch_key: [7c477315] Mar 5 14:14:30 rodster slapd[2678]: <= bdb_index_read 1 candidates Mar 5 14:14:30 rodster slapd[2678]: <= bdb_equality_candidates: id=1, first=1578, last=1578 Mar 5 14:14:30 rodster slapd[2678]: bdb_search_candidates: id=1 first=1578 last=1578 Mar 5 14:14:30 rodster slapd[2678]: => send_search_entry: conn 1910 dn="uid=dude12,ou=people,dc=wh,dc=local" Mar 5 14:14:30 rodster slapd[2678]: <= send_search_entry: conn 1910 exit. Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: conn=1910 op=1 p=3 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: err=0 matched="" text="" Mar 5 14:14:30 rodster slapd[2678]: send_ldap_response: msgid=2 tag=101 err=0 Mar 5 14:14:30 rodster slapd[2678]: connection_get(17) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17): got connid=1910 Mar 5 14:14:30 rodster slapd[2678]: connection_read(17): checking for input on id=1910 Mar 5 14:14:30 rodster slapd[2678]: op tag 0x60, time 1362510870 Mar 5 14:14:30 rodster slapd[2678]: conn=1910 op=2 do_bind Mar 5 14:14:30 rodster slapd[2678]: >>> dnPrettyNormal: <uid=dude12,ou=people,dc=wh,dc=local> Mar 5 14:14:30 rodster slapd[2678]: <<< dnPrettyNormal: <uid=dude12,ou=people,dc=wh,dc=local>, <uid=dude12,ou=people,dc=wh,dc=local> Mar 5 14:14:30 rodster slapd[2678]: do_bind: version=3 dn="uid=dude12,ou=people,dc=wh,dc=local" method=128 Mar 5 14:14:30 rodster slapd[2678]: ==> bdb_bind: dn: uid=dude12,ou=people,dc=wh,dc=local Mar 5 14:14:30 rodster slapd[2678]: bdb_dn2entry("uid=dude12,ou=people,dc=wh,dc=local") Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: conn=1910 op=2 p=3 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: err=49 matched="" text="" Mar 5 14:14:30 rodster slapd[2678]: send_ldap_response: msgid=3 tag=97 err=49 Mar 5 14:14:30 rodster slapd[2678]: connection_get(17) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17): got connid=1910 Mar 5 14:14:30 rodster slapd[2678]: connection_read(17): checking for input on id=1910 Mar 5 14:14:30 rodster slapd[2678]: op tag 0x60, time 1362510870 Mar 5 14:14:30 rodster slapd[2678]: conn=1910 op=3 do_bind Mar 5 14:14:30 rodster slapd[2678]: >>> dnPrettyNormal: <> Mar 5 14:14:30 rodster slapd[2678]: <<< dnPrettyNormal: <>, <> Mar 5 14:14:30 rodster slapd[2678]: do_bind: version=3 dn="" method=128 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: conn=1910 op=3 p=3 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: err=0 matched="" text="" Mar 5 14:14:30 rodster slapd[2678]: send_ldap_response: msgid=4 tag=97 err=0 Mar 5 14:14:30 rodster slapd[2678]: do_bind: v3 anonymous bind This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

4 13

configuring digital certificate on openldap
by Jignesh Patel 06 Mar '13

06 Mar '13

I am working on setting ldap certification discovery on openldap 2.4. version. Is it possible to configure it such that an CERT entry like "test.direct.icare.com" gets translated to the "certificate" attribute of a mapped inetOrgPerson

1 0

FW: Userpasswords stored in plain text
by arantza serrano 06 Mar '13

06 Mar '13

It works perfect with ppolicy_hash_cleartext!! Thanks!! > Date: Wed, 6 Mar 2013 10:13:09 +0000 > From: tw(a)dionic.net > To: openldap-technical(a)openldap.org > Subject: Re: Userpasswords stored in plain text > > On 06/03/13 09:58, arantza serrano wrote: > > Hello, > > > > I need that the userpasswords are stored hashed. I have configured the > > slapd.conf file with this option: > > > > password-hash {SSHA} > > Hi, > > That only takes effect if the password is set via an Extended Operation > password Modify command. > > using slapo-ppolicy and setting: > ppolicy_hash_cleartext > > Will catch your cases and hash them. > > Another solution is to pre-hash them before sending to ldapadd. You can > use slappasswd for this - or do it directly in perl for example. > > Cheers > > Tim > > -- > Tim Watts > Personal Blog: http://squiddy.blog.dionic.net/ > > http://www.sensorly.com/ Crowd mapping of 2G/3G/4G mobile signal coverage >

1 0

Userpasswords stored in plain text
by arantza serrano 06 Mar '13

06 Mar '13

Hello, I need that the userpasswords are stored hashed. I have configured the slapd.conf file with this option: password-hash {SSHA} But when I add users with ldapadd command, I pass the values of userpassword in plain text. Like this: /opt/openldap/bin/ldapadd -x -D "root_dn" -w pass_dn << _EOF dn: uid=usu3,ou=users,o=my_organization uid: usu2 objectClass: top objectClass: person objectClass: organizationalperson objectClass: inetorgperson cn: my_cn sn: my_sn mail: my_mail(a)mydomain.com userPassword: usuario _EOF I think that these values must be stored hashed, but they are only store in plain text in base64. /opt/openldap/bin/ldapsearch -D cn="root_dn" -w pass_dn -x -b o= my_organization uid=usu3 -LLL dn: uid=usu3,ou=users,o=my_organization uid: usu2 uid: usu3 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson cn: my_cn sn: my_sn mail: my_mail(a)mydomain.com userPassword:: dXN1YXJpbw== echo dXN1YXJpbw==|base64 -d usuario What I am doing wrong? Thanks!

3 2

ssh with ldap authentication
by Rodney Simioni 06 Mar '13

06 Mar '13

Hi, I'm new to LDAP. I just created a new user in LDAP and it cannot login through ssh. It keeps prompting for the password. Any help will be greatly appreciated. # dude12, people, wh.local dn: uid=dude12,ou=people,dc=wh,dc=local uid: dude12 cn: Johnny Appleseed objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e1NTSEF9K2E0YXVTWlYwckMwRUhsVWlNVzBrS2U3MzA1a1JrOVI= shadowLastChange: 15140 shadowMax: 99999 shadowWarning: 7 uidNumber: 1212 gidNumber: 1212 homeDirectory: /home/dude12 loginShell: /bin/bash # dude12, group, wh.local dn: cn=dude12,ou=group,dc=wh,dc=local objectClass: posixGroup objectClass: top cn: dude12 gidNumber: 1212 userPassword:: e0NSWVBUfXg= # search result search: 2 result: 0 Success # numResponses: 220 # numEntries: 219 ############################### When I created the user, the logs indicated. ############################### Mar 5 13:53:18 rodster slapd[2678]: => bdb_dn2id("uid=dude12,ou=people,dc=wh,dc=local") Mar 5 13:53:18 rodster slapd[2678]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) Mar 5 13:53:18 rodster slapd[2678]: => bdb_dn2id_add 0x628: "uid=dude12,ou=people,dc=wh,dc=local" Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 %ou=people,dc=wh,dc=local Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 @ou=people,dc=wh,dc=local Mar 5 13:53:18 rodster slapd[2678]: <= bdb_dn2id_add 0x628: 0 Mar 5 13:53:18 rodster slapd[2678]: => index_entry_add( 1576, "uid=dude12,ou=people,dc=wh,dc=local" ) Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [7c477315] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [1fd53424] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [02537054] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [53430dd1] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [5aef1f7f] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [acefc46f] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [caca4579] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [c37ad51a] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [9b3bdeb2] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [39ebd2f9] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [d7851707] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:54:51 rodster slapd[2678]: connection_get(24) Mar 5 13:54:51 rodster slapd[2678]: connection_get(24): got connid=1903 Mar 5 13:54:51 rodster slapd[2678]: connection_read(24): checking for input on id=1903 Mar 5 13:54:51 rodster slapd[2678]: ber_get_next on fd 24 failed errno=0 (Success) Mar 5 13:54:51 rodster slapd[2678]: connection_close: conn=1903 sd=24 ####################################### When I try to ssh as the user the logs indicates. ####################################### Mar 5 14:14:30 rodster slapd[2678]: slap_listener_activate(7): Mar 5 14:14:30 rodster slapd[2678]: >>> slap_listener(ldap:///) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17): got connid=1910 Mar 5 14:14:30 rodster slapd[2678]: connection_read(17): checking for input on id=1910 Mar 5 14:14:30 rodster slapd[2678]: op tag 0x60, time 1362510870 Mar 5 14:14:30 rodster slapd[2678]: conn=1910 op=0 do_bind Mar 5 14:14:30 rodster slapd[2678]: >>> dnPrettyNormal: <> Mar 5 14:14:30 rodster slapd[2678]: <<< dnPrettyNormal: <>, <> Mar 5 14:14:30 rodster slapd[2678]: do_bind: version=3 dn="" method=128 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: conn=1910 op=0 p=3 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: err=0 matched="" text="" Mar 5 14:14:30 rodster slapd[2678]: send_ldap_response: msgid=1 tag=97 err=0 Mar 5 14:14:30 rodster slapd[2678]: do_bind: v3 anonymous bind Mar 5 14:14:30 rodster slapd[2678]: connection_get(17) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17): got connid=1910 Mar 5 14:14:30 rodster slapd[2678]: connection_read(17): checking for input on id=1910 Mar 5 14:14:30 rodster slapd[2678]: op tag 0x63, time 1362510870 Mar 5 14:14:30 rodster slapd[2678]: conn=1910 op=1 do_search Mar 5 14:14:30 rodster slapd[2678]: >>> dnPrettyNormal: <dc=wh,dc=local> Mar 5 14:14:30 rodster slapd[2678]: <<< dnPrettyNormal: <dc=wh,dc=local>, <dc=wh,dc=local> Mar 5 14:14:30 rodster slapd[2678]: SRCH "dc=wh,dc=local" 2 0 Mar 5 14:14:30 rodster slapd[2678]: 1 0 0 Mar 5 14:14:30 rodster slapd[2678]: filter: (uid=dude12) Mar 5 14:14:30 rodster slapd[2678]: attrs: Mar 5 14:14:30 rodster slapd[2678]: host Mar 5 14:14:30 rodster slapd[2678]: authorizedService Mar 5 14:14:30 rodster slapd[2678]: shadowExpire Mar 5 14:14:30 rodster slapd[2678]: shadowFlag Mar 5 14:14:30 rodster slapd[2678]: shadowInactive Mar 5 14:14:30 rodster slapd[2678]: shadowLastChange Mar 5 14:14:30 rodster slapd[2678]: shadowMax Mar 5 14:14:30 rodster slapd[2678]: shadowMin Mar 5 14:14:30 rodster slapd[2678]: shadowWarning Mar 5 14:14:30 rodster slapd[2678]: uidNumber Mar 5 14:14:30 rodster slapd[2678]: Mar 5 14:14:30 rodster slapd[2678]: ==> limits_get: conn=1910 op=1 self="[anonymous]" this="dc=wh,dc=local" Mar 5 14:14:30 rodster slapd[2678]: => bdb_search Mar 5 14:14:30 rodster slapd[2678]: bdb_dn2entry("dc=wh,dc=local") Mar 5 14:14:30 rodster slapd[2678]: search_candidates: base="dc=wh,dc=local" (0x00000001) scope=2 Mar 5 14:14:30 rodster slapd[2678]: => bdb_dn2idl("dc=wh,dc=local") Mar 5 14:14:30 rodster slapd[2678]: => bdb_equality_candidates (objectClass) Mar 5 14:14:30 rodster slapd[2678]: => key_read Mar 5 14:14:30 rodster slapd[2678]: bdb_idl_fetch_key: [b49d1940] Mar 5 14:14:30 rodster slapd[2678]: <= bdb_index_read: failed (-30988) Mar 5 14:14:30 rodster slapd[2678]: <= bdb_equality_candidates: id=0, first=0, last=0 Mar 5 14:14:30 rodster slapd[2678]: => bdb_equality_candidates (uid) Mar 5 14:14:30 rodster slapd[2678]: => key_read Mar 5 14:14:30 rodster slapd[2678]: bdb_idl_fetch_key: [7c477315] Mar 5 14:14:30 rodster slapd[2678]: <= bdb_index_read 1 candidates Mar 5 14:14:30 rodster slapd[2678]: <= bdb_equality_candidates: id=1, first=1578, last=1578 Mar 5 14:14:30 rodster slapd[2678]: bdb_search_candidates: id=1 first=1578 last=1578 Mar 5 14:14:30 rodster slapd[2678]: => send_search_entry: conn 1910 dn="uid=dude12,ou=people,dc=wh,dc=local" Mar 5 14:14:30 rodster slapd[2678]: <= send_search_entry: conn 1910 exit. Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: conn=1910 op=1 p=3 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: err=0 matched="" text="" Mar 5 14:14:30 rodster slapd[2678]: send_ldap_response: msgid=2 tag=101 err=0 Mar 5 14:14:30 rodster slapd[2678]: connection_get(17) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17): got connid=1910 Mar 5 14:14:30 rodster slapd[2678]: connection_read(17): checking for input on id=1910 Mar 5 14:14:30 rodster slapd[2678]: op tag 0x60, time 1362510870 Mar 5 14:14:30 rodster slapd[2678]: conn=1910 op=2 do_bind Mar 5 14:14:30 rodster slapd[2678]: >>> dnPrettyNormal: <uid=dude12,ou=people,dc=wh,dc=local> Mar 5 14:14:30 rodster slapd[2678]: <<< dnPrettyNormal: <uid=dude12,ou=people,dc=wh,dc=local>, <uid=dude12,ou=people,dc=wh,dc=local> Mar 5 14:14:30 rodster slapd[2678]: do_bind: version=3 dn="uid=dude12,ou=people,dc=wh,dc=local" method=128 Mar 5 14:14:30 rodster slapd[2678]: ==> bdb_bind: dn: uid=dude12,ou=people,dc=wh,dc=local Mar 5 14:14:30 rodster slapd[2678]: bdb_dn2entry("uid=dude12,ou=people,dc=wh,dc=local") Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: conn=1910 op=2 p=3 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: err=49 matched="" text="" Mar 5 14:14:30 rodster slapd[2678]: send_ldap_response: msgid=3 tag=97 err=49 Mar 5 14:14:30 rodster slapd[2678]: connection_get(17) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17): got connid=1910 Mar 5 14:14:30 rodster slapd[2678]: connection_read(17): checking for input on id=1910 Mar 5 14:14:30 rodster slapd[2678]: op tag 0x60, time 1362510870 Mar 5 14:14:30 rodster slapd[2678]: conn=1910 op=3 do_bind Mar 5 14:14:30 rodster slapd[2678]: >>> dnPrettyNormal: <> Mar 5 14:14:30 rodster slapd[2678]: <<< dnPrettyNormal: <>, <> Mar 5 14:14:30 rodster slapd[2678]: do_bind: version=3 dn="" method=128 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: conn=1910 op=3 p=3 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: err=0 matched="" text="" Mar 5 14:14:30 rodster slapd[2678]: send_ldap_response: msgid=4 tag=97 err=0 Mar 5 14:14:30 rodster slapd[2678]: do_bind: v3 anonymous bind This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

3 3

Double escaping \ in regex in slapo-constraint directives in slapd.conf
by Tim Watts 05 Mar '13

05 Mar '13

Could someone make sure I'm not going mad before I call this a bug? In slapd.conf: constraint_attribute mail regex ^[^@]+@[a-z0-9\-]+(\.[a-z0-9\-]+)*$ stick this into ldapmodify and it is allowed: replace: mail mail: mrwibble-bble@example#com This looks like the last \. is being parsed to . before the regex engine sees it. With this regex: constraint_attribute mail regex ^[^@]+@[a-z0-9\-]+(\\.[a-z0-9\-]+)*$ the constraint acts on mrwibble-bble@example#com but allows mrwibble-bble(a)example.com which is correct. Is this a bug in the code, a bug in man -S5 slapo-constraint (which does not mention double escaping is necessary) or am I insane? Makes me wonder what is happening with the \- Hmm Both: constraint_attribute mail regex ^[^@]+@[a-z0-9\-]+(\\.[a-z0-9\-]+)*$ and constraint_attribute mail regex ^[^@]+@[a-z0-9\-]+(\\.[a-z0-9\\-]+)*$ accept mrwibble-bble(a)example.c-o-m I'll investigate further is someone would kindly rule out anything I may have overlooked. Cheers, Tim -- Tim Watts Personal Blog: http://squiddy.blog.dionic.net/ http://www.sensorly.com/ Crowd mapping of 2G/3G/4G mobile signal coverage

2 2

Re: Mirror mode and cn=config replication
by John Baker 04 Mar '13

04 Mar '13

Thanks for the reply, gnutls is a pain but we've been able to make it work and the boss hates it when we use source so I'm kind of stuck with it as it is unless I can make a better case than ssl. So mirror mode is really defined by the load balancer in front? I guess this is a bit confusing in the documentation because multi-master has a more complex configuration. As of right now then we are really using multi-master with two servers and the very simple example configuration that's laid out under mirror mode at http://www.openldap.org/doc/admin24/replication.html. But the plan is to upgrade and put load balancing in front. And then we want to use a couple of slaves with limited directories in front of those for constant lookups from services like mail. We are trying to get he benefits of load balancing for heavy writing without having one point of failure for critical services that need a lot of lookups but no writes. I'm testing a setup with the load balancer right now. Can schema changes in cn=config be sent to the the load balancer and slaves as well? On Mon, Mar 4, 2013 at 4:00 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, March 04, 2013 3:39 PM -0500 John Baker <johnnyb(a)marlboro.edu> > wrote: > > Hi, >> >> >> We have been using mirror mode for some time as a simple way for us to >> have an up to date copy in case of a crash and load balancing. We have >> been using the older slapd.conf configuration in Ubntu Hardy and are now >> moving up to 2.4.28 in Ubuntu Precise. >> > > a) Don't use builds provided by Debian/Ubuntu. Build something sane > linked to OpenSSL. > b) Use a current release (2.4.34) > c) There is no difference in configuration between "Mirror Mode" and MMR. > They are the exact same thing configuration wise. The *only* difference is > that with "mirror mode" you use some sort of balancer so that only a single > server is available for writes at a given time. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- John Baker Network Administrator Marlboro College Phone: 451-7551 Cell: 490-0066

2 2

Mirror mode and cn=config replication
by John Baker 04 Mar '13

04 Mar '13

Hi, We have been using mirror mode for some time as a simple way for us to have an up to date copy in case of a crash and load balancing. We have been using the older slapd.conf configuration in Ubntu Hardy and are now moving up to 2.4.28 in Ubuntu Precise. The documentation for N-way multi master mentions that cn=config can be replicated. Can this be done in mirror mode as well? The part I'm particularly trying to figure out is how schema and password policy changes can be sent to both mirrors as well as the proxy and slaves so that we don't have to add ldifs manually an each server. -- John Baker Network Administrator Marlboro College Phone: 451-7551 Cell: 490-0066

2 1

Combining AD and Local DB into single 'virtual' tree
by Mailing Lists 04 Mar '13

04 Mar '13

Hello, I posted a question along these lines a few months ago and received replies, but never understood enough to implement them. I've done more research in the meantime and hopefully have learned enough to ask this question intelligently. I'm working on a project proposal for integrating Linux machines into a Windows environment. The client is very concerned about their AD environment and wants to do as little modification to it as possible (preferably none). What I'd like to propose is that we set up an OpenLDAP server that chains to AD. If possible, I would like to use the OpenLDAP client's credentials to bind to AD instead of having a dedicated user for the OpenLDAP <--> AD connection. I believe this can be accomplished with the 'rebind-as-user' option of the ldap backend (slapd-ldap). Is this correct? Now here's where I think it gets tricky. We also need to be able to store information for the Linux boxes in LDAP (samba winbind mappings for example), but keep it separate from AD. I know that part of this would require a dedicated LDAP database backend (slapd-bdb) to be configured, but what confuses me is how to combine these two separate entities (the AD proxy and this bdb database) into one 'virtual' backend that clients can query against. Is this where slapd-translucent would come into play? Finally, if I want to create OUs in the Linux LDAP database that contain user DNs from AD, is that possible? Any guidance, example solutions, or suggested reading is greatly appreciated. -Dave

3 2

Openldap doesn't force password change and other related problems
by Francesco Belli 04 Mar '13

04 Mar '13

Hello All, I probably have something misconfigured on my openldap server, but it seems that this is not so easy to debug (for me). I use openldap 2.4.23 with ppolicy and accesslog overlays. I have the following behaviours: - when pwdMustChange and pwdReset are set to true, after login, user is not prompted to change the password, however if I run: [def_auditor@localhost fbelli]$ ldapwhoami -x -e ppolicy -D uid=def_auditor,ou=people,dc=pippo,dc=com -w ****** -ZZ -H ldap://mkernel ldap_bind: Success (0); Password must be changed (Password expires in 0 seconds) dn:uid=def_auditor,ou=people,dc=pippo,dc=com - When there are less of pwdExpireWarning seconds and user authenticates (bash shell or ldapsearch), it doesn't get any warning. - When password is expired and user uses one of his pwdGraceAuthNLimit, he doesn't get any warning (but it will get lockedout after). It looks like that for some reason the openldap server doesn't send warnings back to the user. However if user tryes to change the password to one that doesn't match the policy, it gets the correct warnings. Following there is my standard password policy: dn: ou=Policies,dc=aivp,dc=vtp ou: Policies description: Directory policies. objectClass: organizationalUnit dn: cn=Standard,ou=Policies,dc=aivp,dc=vtp cn: Standard description: Standard password policy. pwdAttribute: 2.5.4.35 pwdMinAge: 172800 pwdMaxAge: 5184000 pwdCheckQuality: 1 pwdCheckModule: check_password.so pwdMinLength: 8 pwdExpireWarning: 604800 pwdGraceAuthNLimit: 1 pwdInHistory: 20 pwdLockout: TRUE pwdLockoutDuration: 900 pwdMaxFailure: 3 pwdFailureCountInterval: 1200 pwdMustChange: TRUE objectClass: device objectClass: pwdPolicy objectClass: pwdPolicyChecker Overlay configuration: dn: olcOverlay={2}ppolicy objectClass: olcPPolicyConfig objectClass: olcOverlayConfig olcOverlay: ppolicy olcPPolicyDefault: cn=Standard,ou=Policies,dc=aivp,dc=vtp olcPPolicyUseLockout: TRUE olcPPolicyHashCleartext: TRUE And an example of an user when first inserted: dn: uid=def_auditor,ou=people,dc=aivp,dc=vtp cn: def_auditor gidnumber: 601 homedirectory: /home/def_auditor loginshell: /bin/bash objectclass: account objectclass: posixAccount objectclass: top uid: def_auditor uidnumber: 634 userPassword:: ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= pwdReset: TRUE Thanks in advance for any advice Best Regards, Francesco Belli

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical