openldap-technical

openldap-technical@openldap.org

13 participants
9906 discussions

TLS problem
by Chris 29 Jan '13

29 Jan '13

Hi I am running Openldap 2.4.23 on RHEL6. I can telnet to the server on both 389 636 ports. I can do a ldapsearch and ldapadd without any errors. I get this error when I start the slapd daemon. /ldap_start_tls_s() failed: Can't contact LDAP server: Transport endpoint is not connected (uri="ldap://ldapserver")// //failed to bind to LDAP server ldap://ldapserver: Can't contact LDAP server: Transport endpoint is not connected/ When I do a ldapsearch -x -d1 -Z -b 'dc=flamengro,dc=co,dc=za' I get the following error /TLS: certificate [//CA certificate details omitted here...] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user..// //TLS: error: connect - force handshake failure: errno 0 - moznss error -8172// //TLS: can't connect: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user..// //ldap_err2string// //ldap_start_tls: Connect error (-11)// // additional info: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user/ Any help will be appreciated. This is my slapd.conf file include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args TLSCipherSuite HIGH TLSCertificateFile /etc/pki/tls/certs/slapdcert.pem TLSCertificateKeyFile /etc/pki/tls/certs/slapdkey.pem TLSVerifyClient never database bdb suffix "dc=flamengro,dc=co,dc=za" checkpoint 1024 15 rootdn "cn=Manager,dc=flamengro,dc=co,dc=za" rootpw secret directory /var/lib/ldap/flamengro index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub database monitor # allow only rootdn to read the monitor access to * by dn.exact="cn=Manager,dc=flamengro,dc=co,dc=za" read by * none access to attrs=userPassword,shadowLastChange by anonymous auth by self write by * none I

4 3

Atribute Samba
by rodrigo tavares 29 Jan '13

29 Jan '13

Hi, I have a master ldap master, then make replication. The replication is ok, but when i see the samba atributes are empty. sambaAcctFlags: [U] sambaLogonScript: netlogon.vbs sambaPasswordHistory: 00000000000000000000000000000000000000000000000000000000 00000000 sambaPwdCanChange: 1359464617 sambaPwdLastSet: 1359464617 sambaPwdMustChange: 2147483647 sambaLMPassword: sambaNTPassword: sambaSID: S-1-5-21-4183517729-3427035622-36389750-6040 sambaPrimaryGroupSID: S-1-5-21-4183517729-3427035622-36389750-3003 Any suggestion ? Rodrigo Faria Tavares

1 0

Replication LDAP Users Samba
by rodrigo tavares 29 Jan '13

29 Jan '13

Hello, Today, I have one host vmware, it a master, it replicate all datas about LDAP from filesever01 (Samba). Using LDAP, I using the inteface, and when i create a ldap user, it create a samba account. So, i not need create user samba. ldap admin dn = cn=admin,dc=def,dc=mg,dc=gov,dc=us ldap group suffix = ou=Groups ldap machine suffix = ou=Computers ldap passwd sync = yes pam password change = yes encrypt passwords = True ldap suffix = ou=def,dc=def,dc=mg,dc=gov,dc=us ldap ssl = no ldap user suffix = ou=Users Well, When I remove slapd config replicate, i got change users samba passwords. But is replication LDAP is active, my ldap users can to email, but sambausers is not login in domain. root@fileserver02:~# smbclient -L localhost -U house.green Enter house.green's password: session setup failed: NT_STATUS_LOGON_FAILURE Any suggestion ? Rodrigo Faria Tavares

1 0

389 port is closed from the client point of view
by Asmaa Ahmed 29 Jan '13

29 Jan '13

Hello, I am trying to get my ldap binding running, but some how it doen't work!When I checked the port using nmap, I can see clearly that it is closed while the server listens to it! client# nmap -p 389 ldap.domain.com Starting Nmap 5.00 ( http://nmap.org ) at 2013-01-29 23:09 ESTInteresting ports on ldap.domain.com (203.28.247.83):PORT STATE SERVICE389/tcp closed ldap Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds root@server:/etc/ldap# nmap -p 389 localhost Starting Nmap 5.00 ( http://nmap.org ) at 2013-01-29 23:09 ESTInteresting ports on localhost (127.0.0.1):PORT STATE SERVICE389/tcp open ldap Nmap done: 1 IP address (1 host up) scanned in 0.04 secondsroot@server:/etc/ldap#root@server:/etc/ldap# nmap localhost Starting Nmap 5.00 ( http://nmap.org ) at 2013-01-29 23:10 ESTInteresting ports on localhost (127.0.0.1):Not shown: 994 closed portsPORT STATE SERVICE22/tcp open ssh80/tcp open http389/tcp open ldap464/tcp open kpasswd5636/tcp open ldapssl749/tcp open kerberos-adm Nmap done: 1 IP address (1 host up) scanned in 0.05 secondsroot@server:/etc/ldap# cat /etc/hosts127.0.0.1 localhost#127.0.1.1 ldap.domain.com ldap203.28.247.83 ldap.domain.com ldap How can I fix this? Thanks.

2 3

Re: replication between a back-sql master and back-hdb slave
by Benin Technologies 28 Jan '13

28 Jan '13

ok thanks I found that in the mailing list archive, dating back from 2007 (http://www.openldap.org/lists/openldap-software/200708/msg00015.html) Indeed back-sql was intended to loosely support acting as a syncrepl provider (limited to refreshOnly), but it's currently broken, and it's never been fixed (mostly due to lack of interest). Patches (or sponsorships) are welcome. Ing. Pierangelo Masarati OpenLDAP Core Team So I was wondering if it has been fix since... > your question is, can I use back-sql as syncperov. A sql backend is not > a fully featered database to use with slapd. > > -Dieter >

3 4

Usage of groups in an access control
by Marco de Booij 28 Jan '13

28 Jan '13

I use openLDAP already for years to store my users so I have to define them only once. The users can logon to both Linux and Windows (samba). Now I want to add address-books and manage the access rights. I have a problem with the usage of groups in an access control. I want to gave addressbooks in my LDAP but they should not be accessible by everybody. I used http://www.openldap.org/faq/data/cache/52.html to configure openLDAP but it does not seem to work. I have created a group like this: dn: cn=abk-admin,ou=Roles,dc=example,dc=com objectClass: groupOfNames member: cn=My ENTRY,ou=People,dc=example,dc=com cn: abk-admin and an address-book like this: dn: ou=abk1,ou=Addressbooks,dc=example,dc=com ou: abk1 objectClass: organizationalUnit objectClass: top (Both entries are output of slapcat. I did not put in the attributes like creatorsName and entryUUID) In the slapd:conf I have the following access rules: access to attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdMustChange,sambaPwdLastSet by dn="cn=admin,dc=example,dc=com" write by dn="cn=proxyuser,dc=example,dc=com" read by anonymous auth by self write by * none access to attrs=shadowLastChange,shadowMax by self write by * read access to dn.base="" by * read access to * by dn="cn=admin,dc=example,dc=com" write by * read access to dn.children="ou=abk1,ou=Addressbooks,dc=example,dc=com" by dn="cn=admin,dc=example,dc=com" write by groupOfNames="cn=abk-admin,ou=Roles,dc=example,dc=com" write by groupOfNames="cn=abk-user,ou=Roles,dc=example,dc=com" read by * none I searched around and changed dn.children by dn.subtree and dn.one but the result is the same. I can read the entries but I cannot insert or delete an entry. I can only do this with admin but only if the line for admin is defined. What did I do wrong or understood wrong? I tried to find the answer on the internet but was not able :( OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) Debian 6.0.6 Regards, Marco

4 6

Re: Permissions, users, startup when install from source
by Ori Bani 28 Jan '13

28 Jan '13

Thanks for your reply, >> If compiling and installing from source, I don't see any information >> in the manual about how to auto-start the software and about >> process/file/directory permissions and ownership. I'm still searching >> the Faq-O-Matic (which is a little frustrating). >> >> Taking a step back, I'd love to install from yum on RHEL/CentOS and >> let it be taken care of in a trusted manner. But we require better >> password hashing than SHA1, so we are required to compile by hand >> using the passwd/sha2 contributed module (little surprised this isn't >> accepted into the core project, but I'm sure there are reasons). >> Maybe I can find this in a third-party repo somewhere? > > Not sure what you mean. the SHA2 contrib module is shipped with every > OpenLDAP release. Thus, as best I can tell, it is indeed included. My "surprised" comment is in reference to the fact that the default build of OpenLDAP only supports SHA1, which is widely regarded as deprecated. Why hasn't the sha2 module been migrated out of the contrib directory is what I am getting at (which commonly requires situations like this -- forcing people who wouldn't otherwise do so to install from source just to obtain this feature). One could argue that situations like this contribute to the lack of adoption of stronger password schemes in general. Something of an off-topic tangent. > If you are using RHEL or CentOS, you may be interested in > <http://ltb-project.org/wiki/download#openldap> Great. I will investigate. Does anyone else know of any yum-compatible repos that have a sha2-enabled OpenLDAP build in them? Anyone know anything about the OpenLDAP packages in RepoForge? I actually only assumed without testing that the OpenLDAP package in the CentOS base repo doesn't have the sha2 module compiled in. I should go back and check that assumption. Also, reflecting on the installation of the sha2 module, it occurs to me that short of the CentOS repo package already having sha2 compiled in, the best course of action is probably to compile only the sha2 module and use it with the CentOS package --- including the module in the slapd configuration seems to be the extent of integration, so that should work, no? If so, I think this would be the best option. >> After installation, what is commonly done in this regard? Create >> user/group "ldap" with no login shell and chown ldap:ldap on >> /usr/local/var/openldap-data? Is that all? > > It depends on your needs. I have done anything from running slapd as root, > to running it as a specific user. I'd welcome pointers to somewhere this is discussed (don't see it in the docs, maybe in the FAQ?). I don't have needs that are much different than anyone else. I naively assume slapd should generally not be run as root. In that case, is creating a ldap user/group and chowning the openldap-data directory the only things to do? >> Then what do people use for auto-starting the software (presumably >> with -u ldap -g ldap) in a RedHat environment? > > I wrote my own startup script that works with chkconfig. > <http://linuxcommand.org/man_pages/chkconfig8.html> I'm looking for anyone who wants to share such scripts. Thanks kindly for your time, much appreciated.

5 9

Re: syncrepl issue
by Meike Stone 28 Jan '13

28 Jan '13

> > a) Use a current release. That would be 2.4.33. > b) Delta-syncrepl supports MMR in current releases > c) The reason I suggest delta-syncrepl is because syncrepl is known to be > problematic, particularly with MMR. If you want reliable replication, use > delta-syncrepl. Is it recommended in MMR setups to use delta-syncrepl before syncrepl in general? Are there any disadvantages, like using more RAM, or other things to care..? Thanks, Meike

2 1

replication between a back-sql master and back-hdb slave
by Benin Technologies 28 Jan '13

28 Jan '13

Hi, I set up a back-sql server to access some existing data in a postgresql database. I was wondering if it's possible to replicate that server to some (read-only) back-hdb servers. Thanks BT

2 2

Is any way to make proxy cache working for acl requests?
by Tio Teath 28 Jan '13

28 Jan '13

I'm thick and tired of configuring this dame thing! I mean slapo-pcache. It just won't work. Is any way to force this to cache JUST EVERYTHING, including ACL requests to remote server? I don't care of disk or memory usage, I just want dame thing working!

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical