openldap-technical

openldap-technical@openldap.org

7 participants
9901 discussions

back-sql documentation (was: SELinux woes)
by Ori Bani 17 Jan '13

17 Jan '13

>> Trying to switch to slapd.conf instead of dynamic configuration in >> order to test the back-sql backend > > As of version 2.4.27, I believe back-sql supports dynamic configuration, so > there's no need to switch to slapd.conf > > see http://www.openldap.org/software/release/changes.html : > > OpenLDAP 2.4.27 Release (2011/11/24) > > Added slapd-sql dynamic config support Oh! Thanks for the pointer. Anyone know if there's any chance the documentation is going to be updated? It's over a year later and the docs (and everything I saw in the list archives) say I must use slapd.conf

3 2

Re: slapd crashes with ch_realloc of X bytes failed
by Meike Stone 17 Jan '13

17 Jan '13

Hello, I could update both systems during my vacation to 2.4.33. Both servers had 16GByte RAM. The system crashed again randomly (as expected). So we increased the memory on one server to 24 GByte RAM. No effect, this server crashes too, sometime till 5 times a day. I installed a test machine (VM), but only with 7GByte RAM and could reproduce the crashes with one/two parallel searches. So I tried tcmalloc, but with the same result. I digged a little deeper and the results are, that not the physical memory from the system is insufficient. First - slapd tries to allocate memory more then available, but not use it. It is enough physical memory available during slapd crashes. I ran the commands continuously with while and sleep 1: free -m, and pmap $PID_OF_LDAP and vmstat 1 The last memory information before the crash was: pmap: -------------------------- 21954: slapd START SIZE RSS PSS DIRTY SWAP PERM MAPPING 00007f63f4904000 4K 0K 0K 0K 0K rw-p [anon] 00007f63f4905000 4K 0K 0K 0K 0K ---p [anon] 00007f63f4906000 16384K 2080K 2080K 2080K 0K rw-p [anon] 00007f63f5906000 4K 0K 0K 0K 0K ---p [anon] 00007f63f5907000 16384K 4120K 4120K 4120K 0K rw-p [anon] 00007f63f6907000 4K 0K 0K 0K 0K ---p [anon] 00007f63f6908000 16384K 4120K 4120K 4120K 0K rw-p [anon] 00007f63f7908000 4K 0K 0K 0K 0K ---p [anon] 00007f63f7909000 16384K 4104K 4104K 4104K 16K rw-p [anon] 00007f63f8909000 4K 0K 0K 0K 0K ---p [anon] 00007f63f890a000 16384K 8K 8K 8K 4K rw-p [anon] 00007f63f990a000 24K 8K 8K 8K 0K rw-s /SYSV0000000c 00007f63f9910000 544K 44K 44K 44K 0K rw-s /SYSV0000000b 00007f63f9998000 2304K 12K 12K 12K 0K rw-s /SYSV0000000a 00007f63f9bd8000 2097152K 2097052K 2097052K 2097052K 0K rw-s /SYSV00000009 00007f6479bd8000 78008K 60508K 60508K 60508K 0K rw-s /SYSV00000008 00007f647e806000 16K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libplain.so.2.0.22 00007f647e80a000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libplain.so.2.0.22 00007f647ea09000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libplain.so.2.0.22 00007f647ea0a000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libplain.so.2.0.22 00007f647ea0b000 16K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libanonymous.so.2.0.22 00007f647ea0f000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libanonymous.so.2.0.22 00007f647ec0e000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libanonymous.so.2.0.22 00007f647ec0f000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libanonymous.so.2.0.22 00007f647ec10000 20K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libsasldb.so.2.0.22 00007f647ec15000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libsasldb.so.2.0.22 00007f647ee14000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libsasldb.so.2.0.22 00007f647ee15000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libsasldb.so.2.0.22 00007f647ee16000 16K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/liblogin.so.2.0.22 00007f647ee1a000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/liblogin.so.2.0.22 00007f647f019000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/liblogin.so.2.0.22 00007f647f01a000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/liblogin.so.2.0.22 00007f647f01b000 8K 0K 0K 0K 0K r-xp /lib64/libkeyutils-1.2.so 00007f647f01d000 2044K 0K 0K 0K 0K ---p /lib64/libkeyutils-1.2.so 00007f647f21c000 4K 0K 0K 0K 4K r--p /lib64/libkeyutils-1.2.so 00007f647f21d000 4K 0K 0K 0K 4K rw-p /lib64/libkeyutils-1.2.so 00007f647f21e000 28K 0K 0K 0K 0K r-xp /usr/lib64/libkrb5support.so.0.1 00007f647f225000 2048K 0K 0K 0K 0K ---p /usr/lib64/libkrb5support.so.0.1 00007f647f425000 4K 0K 0K 0K 4K r--p /usr/lib64/libkrb5support.so.0.1 00007f647f426000 4K 0K 0K 0K 4K rw-p /usr/lib64/libkrb5support.so.0.1 00007f647f427000 12K 0K 0K 0K 0K r-xp /lib64/libcom_err.so.2.1 00007f647f42a000 2044K 0K 0K 0K 0K ---p /lib64/libcom_err.so.2.1 00007f647f629000 4K 0K 0K 0K 4K r--p /lib64/libcom_err.so.2.1 00007f647f62a000 4K 0K 0K 0K 4K rw-p /lib64/libcom_err.so.2.1 00007f647f62b000 144K 0K 0K 0K 0K r-xp /usr/lib64/libk5crypto.so.3.1 00007f647f64f000 2044K 0K 0K 0K 0K ---p /usr/lib64/libk5crypto.so.3.1 00007f647f84e000 8K 0K 0K 0K 8K r--p /usr/lib64/libk5crypto.so.3.1 00007f647f850000 4K 0K 0K 0K 4K rw-p /usr/lib64/libk5crypto.so.3.1 00007f647f851000 632K 0K 0K 0K 0K r-xp /usr/lib64/libkrb5.so.3.3 00007f647f8ef000 2044K 0K 0K 0K 0K ---p /usr/lib64/libkrb5.so.3.3 00007f647faee000 12K 0K 0K 0K 12K r--p /usr/lib64/libkrb5.so.3.3 00007f647faf1000 8K 0K 0K 0K 8K rw-p /usr/lib64/libkrb5.so.3.3 00007f647faf3000 172K 0K 0K 0K 0K r-xp /usr/lib64/libgssapi_krb5.so.2.2 00007f647fb1e000 2048K 0K 0K 0K 0K ---p /usr/lib64/libgssapi_krb5.so.2.2 00007f647fd1e000 4K 0K 0K 0K 4K r--p /usr/lib64/libgssapi_krb5.so.2.2 00007f647fd1f000 4K 0K 0K 0K 4K rw-p /usr/lib64/libgssapi_krb5.so.2.2 00007f647fd20000 28K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libgssapiv2.so.2.0.22 00007f647fd27000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libgssapiv2.so.2.0.22 00007f647ff26000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libgssapiv2.so.2.0.22 00007f647ff27000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libgssapiv2.so.2.0.22 00007f647ff28000 48K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libdigestmd5.so.2.0.22 00007f647ff34000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libdigestmd5.so.2.0.22 00007f6480133000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libdigestmd5.so.2.0.22 00007f6480134000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libdigestmd5.so.2.0.22 00007f6480135000 84K 0K 0K 0K 0K r-xp /lib64/libz.so.1.2.3 00007f648014a000 2044K 0K 0K 0K 0K ---p /lib64/libz.so.1.2.3 00007f6480349000 4K 0K 0K 0K 4K r--p /lib64/libz.so.1.2.3 00007f648034a000 4K 0K 0K 0K 4K rw-p /lib64/libz.so.1.2.3 00007f648034b000 84K 0K 0K 0K 0K r-xp /lib64/libgcc_s.so.1 00007f6480360000 2044K 0K 0K 0K 0K ---p /lib64/libgcc_s.so.1 00007f648055f000 4K 0K 0K 0K 4K r--p /lib64/libgcc_s.so.1 00007f6480560000 4K 0K 0K 0K 4K rw-p /lib64/libgcc_s.so.1 00007f6480561000 940K 0K 0K 0K 0K r-xp /usr/lib64/libstdc++.so.6.0.16 00007f648064c000 2048K 0K 0K 0K 0K ---p /usr/lib64/libstdc++.so.6.0.16 00007f648084c000 32K 0K 0K 0K 32K r--p /usr/lib64/libstdc++.so.6.0.16 00007f6480854000 8K 0K 0K 0K 8K rw-p /usr/lib64/libstdc++.so.6.0.16 00007f6480856000 84K 0K 0K 0K 4K rw-p [anon] 00007f648086b000 36K 28K 28K 0K 0K r-xp /lib64/libunwind.so.7.0.0 00007f6480874000 2044K 0K 0K 0K 0K ---p /lib64/libunwind.so.7.0.0 00007f6480a73000 4K 4K 4K 4K 0K r--p /lib64/libunwind.so.7.0.0 00007f6480a74000 4K 4K 4K 4K 0K rw-p /lib64/libunwind.so.7.0.0 00007f6480a75000 16K 4K 4K 4K 0K rw-p [anon] 00007f6480a79000 1460K 444K 38K 0K 0K r-xp /lib64/libc-2.11.3.so 00007f6480be6000 2048K 0K 0K 0K 0K ---p /lib64/libc-2.11.3.so 00007f6480de6000 16K 16K 16K 8K 0K r--p /lib64/libc-2.11.3.so 00007f6480dea000 4K 4K 4K 4K 0K rw-p /lib64/libc-2.11.3.so 00007f6480deb000 20K 16K 16K 16K 4K rw-p [anon] 00007f6480df0000 36K 28K 10K 0K 0K r-xp /lib64/libwrap.so.0.7.6 00007f6480df9000 2044K 0K 0K 0K 0K ---p /lib64/libwrap.so.0.7.6 00007f6480ff8000 4K 4K 4K 0K 0K r--p /lib64/libwrap.so.0.7.6 00007f6480ff9000 4K 4K 4K 4K 0K rw-p /lib64/libwrap.so.0.7.6 00007f6480ffa000 4K 4K 4K 4K 0K rw-p [anon] 00007f6480ffb000 76K 4K 0K 0K 0K r-xp /lib64/libresolv-2.11.3.so 00007f648100e000 2048K 0K 0K 0K 0K ---p /lib64/libresolv-2.11.3.so 00007f648120e000 4K 0K 0K 0K 4K r--p /lib64/libresolv-2.11.3.so 00007f648120f000 4K 0K 0K 0K 4K rw-p /lib64/libresolv-2.11.3.so 00007f6481210000 8K 0K 0K 0K 0K rw-p [anon] 00007f6481212000 48K 4K 0K 0K 0K r-xp /lib64/libcrypt-2.11.3.so 00007f648121e000 2044K 0K 0K 0K 0K ---p /lib64/libcrypt-2.11.3.so 00007f648141d000 4K 0K 0K 0K 4K r--p /lib64/libcrypt-2.11.3.so 00007f648141e000 4K 0K 0K 0K 4K rw-p /lib64/libcrypt-2.11.3.so 00007f648141f000 184K 0K 0K 0K 0K rw-p [anon] 00007f648144d000 1484K 4K 4K 0K 0K r-xp /usr/lib64/libcrypto.so.0.9.8 00007f64815c0000 2044K 0K 0K 0K 0K ---p /usr/lib64/libcrypto.so.0.9.8 00007f64817bf000 64K 0K 0K 0K 64K r--p /usr/lib64/libcrypto.so.0.9.8 00007f64817cf000 100K 0K 0K 0K 100K rw-p /usr/lib64/libcrypto.so.0.9.8 00007f64817e8000 16K 0K 0K 0K 12K rw-p [anon] 00007f64817ec000 308K 4K 4K 0K 0K r-xp /usr/lib64/libssl.so.0.9.8 00007f6481839000 2044K 0K 0K 0K 0K ---p /usr/lib64/libssl.so.0.9.8 00007f6481a38000 8K 0K 0K 0K 8K r--p /usr/lib64/libssl.so.0.9.8 00007f6481a3a000 24K 0K 0K 0K 24K rw-p /usr/lib64/libssl.so.0.9.8 00007f6481a40000 8K 4K 0K 0K 0K r-xp /lib64/libdl-2.11.3.so 00007f6481a42000 2048K 0K 0K 0K 0K ---p /lib64/libdl-2.11.3.so 00007f6481c42000 4K 0K 0K 0K 4K r--p /lib64/libdl-2.11.3.so 00007f6481c43000 4K 0K 0K 0K 4K rw-p /lib64/libdl-2.11.3.so 00007f6481c44000 100K 44K 36K 0K 0K r-xp /usr/lib64/libsasl2.so.2.0.22 00007f6481c5d000 2048K 0K 0K 0K 0K ---p /usr/lib64/libsasl2.so.2.0.22 00007f6481e5d000 4K 4K 4K 4K 0K r--p /usr/lib64/libsasl2.so.2.0.22 00007f6481e5e000 4K 4K 4K 4K 0K rw-p /usr/lib64/libsasl2.so.2.0.22 00007f6481e5f000 84K 4K 0K 0K 0K r-xp /lib64/libnsl-2.11.3.so 00007f6481e74000 2044K 0K 0K 0K 0K ---p /lib64/libnsl-2.11.3.so 00007f6482073000 4K 0K 0K 0K 4K r--p /lib64/libnsl-2.11.3.so 00007f6482074000 4K 0K 0K 0K 4K rw-p /lib64/libnsl-2.11.3.so 00007f6482075000 8K 0K 0K 0K 0K rw-p [anon] 00007f6482077000 364K 4K 0K 0K 0K r-xp /lib64/libm-2.11.3.so 00007f64820d2000 2044K 0K 0K 0K 0K ---p /lib64/libm-2.11.3.so 00007f64822d1000 4K 0K 0K 0K 4K r--p /lib64/libm-2.11.3.so 00007f64822d2000 120K 0K 0K 0K 8K rw-p /lib64/libm-2.11.3.so 00007f64822f0000 96K 4K 4K 0K 0K r-xp /usr/lib64/libslp.so.1.0.0 00007f6482308000 2044K 0K 0K 0K 0K ---p /usr/lib64/libslp.so.1.0.0 00007f6482507000 4K 0K 0K 0K 4K r--p /usr/lib64/libslp.so.1.0.0 00007f6482508000 4K 0K 0K 0K 4K rw-p /usr/lib64/libslp.so.1.0.0 00007f6482509000 92K 76K 26K 0K 0K r-xp /lib64/libpthread-2.11.3.so 00007f6482520000 2048K 0K 0K 0K 0K ---p /lib64/libpthread-2.11.3.so 00007f6482720000 4K 4K 4K 4K 0K r--p /lib64/libpthread-2.11.3.so 00007f6482721000 4K 4K 4K 4K 0K rw-p /lib64/libpthread-2.11.3.so 00007f6482722000 16K 4K 4K 4K 0K rw-p [anon] 00007f6482726000 400K 4K 4K 0K 0K r-xp /usr/lib64/libodbc.so.1.0.0 00007f648278a000 2044K 0K 0K 0K 0K ---p /usr/lib64/libodbc.so.1.0.0 00007f6482989000 4K 0K 0K 0K 4K r--p /usr/lib64/libodbc.so.1.0.0 00007f648298a000 28K 0K 0K 0K 28K rw-p /usr/lib64/libodbc.so.1.0.0 00007f6482991000 4K 0K 0K 0K 0K rw-p [anon] 00007f6482992000 1224K 196K 187K 0K 0K r-xp /usr/lib64/libdb-4.5.so 00007f6482ac4000 2048K 0K 0K 0K 0K ---p /usr/lib64/libdb-4.5.so 00007f6482cc4000 12K 4K 4K 4K 8K r--p /usr/lib64/libdb-4.5.so 00007f6482cc7000 12K 12K 12K 12K 0K rw-p /usr/lib64/libdb-4.5.so 00007f6482cca000 36K 4K 0K 0K 0K r-xp /usr/lib64/libltdl.so.7.2.0 00007f6482cd3000 2044K 0K 0K 0K 0K ---p /usr/lib64/libltdl.so.7.2.0 00007f6482ed2000 4K 0K 0K 0K 4K r--p /usr/lib64/libltdl.so.7.2.0 00007f6482ed3000 4K 0K 0K 0K 4K rw-p /usr/lib64/libltdl.so.7.2.0 00007f6482ed4000 56K 44K 14K 0K 0K r-xp /usr/lib64/liblber-2.4.so.2.8.5 00007f6482ee2000 2044K 0K 0K 0K 0K ---p /usr/lib64/liblber-2.4.so.2.8.5 00007f64830e1000 4K 4K 4K 4K 0K r--p /usr/lib64/liblber-2.4.so.2.8.5 00007f64830e2000 4K 4K 4K 4K 0K rw-p /usr/lib64/liblber-2.4.so.2.8.5 00007f64830e3000 308K 64K 64K 0K 0K r-xp /usr/lib64/libldap_r-2.4.so.2.8.5 00007f6483130000 2048K 0K 0K 0K 0K ---p /usr/lib64/libldap_r-2.4.so.2.8.5 00007f6483330000 4K 4K 4K 4K 0K r--p /usr/lib64/libldap_r-2.4.so.2.8.5 00007f6483331000 8K 8K 8K 8K 0K rw-p /usr/lib64/libldap_r-2.4.so.2.8.5 00007f6483333000 12K 8K 8K 8K 4K rw-p [anon] 00007f6483336000 288K 96K 96K 0K 0K r-xp /usr/local/lib/libtcmalloc.so.4.1.0 00007f648337e000 2044K 0K 0K 0K 0K ---p /usr/local/lib/libtcmalloc.so.4.1.0 00007f648357d000 4K 4K 4K 4K 0K r--p /usr/local/lib/libtcmalloc.so.4.1.0 00007f648357e000 4K 4K 4K 4K 0K rw-p /usr/local/lib/libtcmalloc.so.4.1.0 00007f648357f000 156K 92K 92K 88K 36K rw-p [anon] 00007f64835a6000 124K 40K 0K 0K 0K r-xp /lib64/ld-2.11.3.so 00007f6483708000 212K 0K 0K 0K 0K r--s /var/run/nscd/group 00007f648373d000 212K 0K 0K 0K 0K r--s /var/run/nscd/passwd 00007f6483772000 212K 0K 0K 0K 0K r--s /var/run/nscd/dbvbS4oY 00007f64837a7000 48K 28K 28K 24K 20K rw-p [anon] 00007f64837bc000 24K 8K 8K 8K 0K rw-s /SYSV00000007 00007f64837c2000 8K 4K 4K 4K 4K rw-p [anon] 00007f64837c4000 4K 4K 4K 4K 0K r--p /lib64/ld-2.11.3.so 00007f64837c5000 4K 4K 4K 4K 0K rw-p /lib64/ld-2.11.3.so 00007f64837c6000 4K 4K 4K 4K 0K rw-p [anon] 00007f64837c7000 1944K 456K 456K 0K 0K r-xp /usr/lib/openldap/slapd 00007f6483bac000 20K 8K 8K 8K 12K r--p /usr/lib/openldap/slapd 00007f6483bb1000 48K 24K 24K 24K 24K rw-p /usr/lib/openldap/slapd 00007f6483bbd000 3812K 1052K 1052K 984K 1788K rw-p [heap] 00007f6483f76000 5004408K 4574484K 4574484K 4574392K 257508K rw-p [heap] 00007fff9f532000 132K 4K 4K 4K 32K rw-p [stack] 00007fff9f5b6000 4K 4K 0K 0K 0K r-xp [vdso] ffffffffff600000 4K 0K 0K 0K 0K r-xp [vsyscall] Total: 7350688K 6749464K 6748875K 6747724K 259932K 5091328K writable-private, 80668K readonly-private, 2178692K shared, and 4900700K referenced ================================================================================ last free -m before crash: ------------------------------- total used free shared buffers cached Mem: 6928 6813 115 0 0 2180 -/+ buffers/cache: 4632 2296 Swap: 2047 288 1759 last free after crash: ------------------------------- total used free shared buffers cached Mem: 6928 4978 1950 0 0 2166 -/+ buffers/cache: 2810 4117 Swap: 2047 42 2005 ================================================================================ and vmstat: ------------------------------- procs -----------memory---------- ---swap-- -----io---- -system-- -----cpu------ r b swpd free buff cache si so bi bo in cs us sy id wa st 1 4 295284 110148 540 2255804 108 0 13428 0 796 1373 3 5 27 65 0 0 3 295260 118140 608 2242804 36 0 9308 0 2227 1309 2 5 23 70 0 0 3 295224 116668 680 2237396 48 0 4008 0 1253 2002 3 6 52 39 0 1 0 295164 116296 736 2232588 128 0 6028 0 1083 954 3 14 45 39 0 0 0 42332 4742716 768 2219044 784 0 1104 0 1428 1178 3 23 63 11 0 0 0 42332 4743020 768 2219168 0 0 0 0 253 97 0 0 100 0 0 0 0 42332 4743408 768 2219160 0 0 0 0 201 98 0 0 100 0 0 0 1 42300 4743408 768 2219140 216 0 216 0 295 150 0 0 99 1 0 What I see, that slapd had reserved "Total: 7350688K" (overcommitted?), but only referenced 4900700K. Why does slapd reserve so much memory and use it not? Because of this, I changed the default values for memory overcomittment from: vm.overcommit_memory = 0 (guess, default) vm.overcommit_ratio = 50 to: vm.overcommit_memory=2 (strict overcommit) vm.overcommit_ratio=100 but it crashed again (ch_malloc of 34545 bytes failed): . . 00007f2bf8e1a000 5019920K 4597460K 4597460K 4597116K 333472K rw-p [heap] 00007fffe86c5000 132K 0K 0K 0K 36K rw-p [stack] 00007fffe87af000 4K 4K 0K 0K 0K r-xp [vdso] ffffffffff600000 4K 0K 0K 0K 0K r-xp [vsyscall] Total: 7333420K 6766996K 6766484K 6765536K 336192K 5074068K writable-private, 80660K readonly-private, 2178692K shared, and 4681876K referenced So in spite of increase the memory from 16GByte to 24 GByte (one of the production server - configuration described in the first mail) same results. Is there anywhere a memory leak - how can I find out this? Thanks Meike P.S., mdb is not the option now, we need time to evaluate this ...

2 3

[OT] SELinux woes
by Ori Bani 17 Jan '13

17 Jan '13

All, Trying to switch to slapd.conf instead of dynamic configuration in order to test the back-sql backend I ran into a problem with SELinux that I do not understand. The startup fails with the error: /etc/openldap/slapd.conf: line 27: invalid path: Permission denied Disabling SELinux fixes the problem, however I'm not sure what is going on. The line in question is naturally the "directory" that points in this case to /var/lib/ldap. That directory is a hand-made clone of the original one that was there which was moved (renamed) out of the way. Here is what I did: mv /etc/openldap/slapd.d /etc/openldap/slapd.d.BAK mv /var/lib/ldap /var/lib/ldap.BAK mkdir /var/lib/ldap chown ldap:ldap /var/lib/ldap chmod 700 /var/lib/ldap create a simple /etc/openldap/slapd.conf The ownership and permissions on ldap and ldap.BAK directories are identical. OpenLDAP works fine if I disable SELinux. What is SELinux doing here?

3 3

Issue with LDAP TLS for Unix Login
by Arvind Navale 17 Jan '13

17 Jan '13

Hi Folks, I have a openldap server version slapd 2.4.16 running on a Solaris-10 OS. I have generated the self signed CA certificate on the ldap server to use TLS and configured the slapd.conf with certificate information. I am looking to get LDAP authentication using TLS on the ldap client side. I was able to setup centos-6.3 linux as ldap client using openldap client to LDAP authentication using TLS but I am having issues to setup a Solaris-10 OS using native LDAP client software. Solaris-10 LDAP client is setup using 'ldapclient manaul' and certificate was added using certutil command. Here is error messages seeing when trying to authenticate when using LDAP-TLS in sladp.log file on the openldap server side, Jan 14 14:51:53 ldapsrv slapd[543]: [ID 848112 local4.debug] conn=1270 fd=25 ACCEPT from IP=10.90.180.236:41051 (IP=0.0.0.0:636) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 609413 local4.debug] daemon: waked Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 802679 local4.debug] daemon: activity on: Jan 14 14:51:53 ldapsrv slapd[543]: [ID 522297 local4.debug] 25r Jan 14 14:51:53 ldapsrv slapd[543]: [ID 100000 local4.debug] Jan 14 14:51:53 ldapsrv slapd[543]: [ID 694296 local4.debug] daemon: read activity on 25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 525477 local4.debug] connection_get(25) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 611214 local4.debug] connection_get(25): got connid=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 138202 local4.debug] connection_read(25): checking for input on id=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 609413 local4.debug] daemon: waked Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 802679 local4.debug] daemon: activity on: Jan 14 14:51:53 ldapsrv slapd[543]: [ID 522297 local4.debug] 25r Jan 14 14:51:53 ldapsrv slapd[543]: [ID 100000 local4.debug] Jan 14 14:51:53 ldapsrv slapd[543]: [ID 694296 local4.debug] daemon: read activity on 25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 525477 local4.debug] connection_get(25) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 611214 local4.debug] connection_get(25): got connid=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 138202 local4.debug] connection_read(25): checking for input on id=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 688457 local4.debug] connection_read(25): TLS accept failure error=-1 id=1270, closing Jan 14 14:51:53 ldapsrv slapd[543]: [ID 734893 local4.debug] connection_closing: readying conn=1270 sd=25 for close Jan 14 14:51:53 ldapsrv slapd[543]: [ID 330685 local4.debug] connection_close: conn=1270 sd=25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 609413 local4.debug] daemon: waked Jan 14 14:51:53 ldapsrv slapd[543]: [ID 423323 local4.debug] daemon: removing 25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 485650 local4.debug] conn=1270 fd=25 closed (TLS negotiation failure) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 802679 local4.debug] daemon: activity on: Jan 14 14:51:53 ldapsrv slapd[543]: [ID 522297 local4.debug] 23r Jan 14 14:51:53 ldapsrv slapd[543]: [ID 100000 local4.debug] On the ldap client side I have enabled pam debugging and I see the following error messages associated with it, Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 492885 auth.debug] PAM[6459]: pam_setcred(80c9bd8, 2) Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 931871 auth.debug] PAM[6459]: load_modules(80c9bd8, pam_sm_setcred)=/usr/lib/security/pam_authtok_get.s o.1 Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 962116 auth.debug] PAM[6459]: pam_setcred(80c9bd8, 2): error Permission denied Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 509612 auth.debug] PAM[6459]: pam_set_item(80c9bd8:authtok) Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 725776 auth.debug] PAM[6459]: pam_end(80c9bd8): status = Permission denied Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 826707 auth.debug] PAM[6820]: pam_set_item(80c9bd8:authtok) Jan 14 14:52:45 drac9ec2 last message repeated 1 time Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 887652 auth.debug] PAM[6820]: pam_authenticate(80c9bd8, 1): error Authentication failed Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 285619 auth.debug] ldap pam_sm_authenticate(sshd-kbdint ldapusr2), flags = 1 Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 293258 auth.warning] libsldap: Status: 81 Mesg: openConnection: simple bind failed - Can't contact LDA P server Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 887652 auth.debug] PAM[6820]: pam_authenticate(80c9bd8, 1): error Permission denied Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 826707 auth.debug] PAM[6820]: pam_set_item(80c9bd8:authtok) Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 800047 auth.info] Keyboard-interactive (PAM) userauth failed[9] while authenticating: Authentication fa iled Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 800047 auth.notice] Failed keyboard-interactive for ldapusr2 from 10.90.176.38 port 44078 ssh2 Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 826707 auth.debug] PAM[6820]: pam_set_item(80c9bd8:conv) Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 814791 auth.debug] PAM[6820]: pam_end(80c9bd8): status = Authentication failed Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 324150 auth.debug] PAM[6820]: pam_start(sshd-kbdint,ldapusr2,80a98a8:80c9bd8) - debug = 1 Here is the ldapclient I have ran to setup the ldapclient, ldapclient -v manual -a defaultServerList=10.90.177.2 -a credentialLevel=anonymous -a domainName=dvsg-ldap.com -a defaultSearchBase=dc=dvsg-ldap,dc=com -a authenticationMethod=tls:simple -a serviceAuthenticationMethod=pam_ldap:tls:simple -a proxyDN=cn=readonly,dc=dvsg-ldap,dc=com -a proxyPassword=secret -a certificatePath=/var/ldap Any guidance or help to resolve this issue would be most appreciated. thank you, Arvind.

1 0

Strange ACL evaluation depending on AttributeSelection?
by Michael Ströder 17 Jan '13

17 Jan '13

HI! Today I made a strange observation tested with release 2.4.32 and git-build RE24 6f33e2c both with same results. The following commands (lines wrapped herein) were all typed as user root which gets mapped by authz-regexp to the rootdn of the database o=example (LDAPI with SASL/EXTERNAL). Let's check that: # ldapwhoami SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn:uid=admin,o=example I wanted to check ACLs applied to attribute 'sambaNTPassword' and to test Samba logon of course. Samba logon did work when putting the Samba demon user in a special group which has read access everywhere but it didn't when the special Samba ACLs were to be applied. So I tried to examine a possible bug in my ACLs but noticed unexpected results during that. Everything looks fine with a normal search as rootdn and we see that the entry indeed contains 'sambaNTPassword': # ldapsearch -LLL "(&(objectclass=sambaSamAccount)(uid=wtester))" sambaNTPassword SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: employeeNumber=42424242,ou=users,o=example sambaNTPassword: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx But when requesting to use the authz-DN with which the Samba demon binds the attribute is not shown which one might consider an ACL issue. Note that sambaNTPassword is explicitly requested just like Samba correctly does it: # ldapsearch -LLL -X "dn:uid=samba_dc_1,ou=samba,o=example" "(&(objectclass=sambaSamAccount)(uid=wtester))" sambaNTPassword SASL/EXTERNAL authentication started SASL username: dn:uid=samba_dc_1,ou=samba,o=example SASL SSF: 0 dn: employeeNumber=42424242,ou=users,o=example But then I would expect this search also *not* to return attribute 'sambaNTPassword' but it does! # ldapsearch -LLL -X "dn:uid=samba_dc_1,ou=samba,o=example" "(&(objectclass=sambaSamAccount)(uid=wtester))" "*" |grep -i sambaNTPassword SASL/EXTERNAL authentication started SASL username: dn:uid=samba_dc_1,ou=samba,o=example SASL SSF: 0 sambaNTPassword: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Maybe I'm doing something wrong on the command-line but I simply don't get it... :-/ Or is there some difference in ACL handling based on SearchRequest.attributes (AttributeSelection)? I have an ACL which blocks access to password attributes of disabled users by using a filter-based ACL. Hmm, I did not try what happens when explicitly requesting the attribute used in the filter. I have to do that tomorrow... Ciao, Michael.

2 3

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

Ok Thanks a lot , looks like i will be able to swim through Final question, before going for this config. What would be impact of lastmode on/off with and without replication with big db size. On Thu, Jan 17, 2013 at 4:45 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 17, 2013 4:37 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> I am using rpm from symas, latest update on 29th dec,2013. i think that >> will work. >> >> Is my acceslog db configuration in slapd.conf right ? >> > > If that is your actual config file, no. You stuck the definition of the > accesslog DB in the middle of your existing DB configuration, which is > going to cause you all sorts of problems. I prefer to list the accesslog > db prior to the main db. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

1 0

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

I am using rpm from symas, latest update on 29th dec,2013. i think that will work. Is my acceslog db configuration in slapd.conf right ? On Thu, Jan 17, 2013 at 4:27 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 17, 2013 2:49 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> My Bad >> >> Going forward, what would be my strategy, to enable delta sync repl with >> one master is already running with 200G mdb db. >> >> What i understand is >> 1.enable accesslog overlay on master server configure accesslog start >> the master >> 2. Take backup with mdb_copyand restore it on other master servers. >> 3. Enable accesslog configure to new consumers(work as providers as >> well) >> > > That sounds about right. I assume you are using current RE24 OpenLDAP, > and not 2.4.33. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

2 1

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

My Bad Going forward, what would be my strategy, to enable delta sync repl with one master is already running with 200G mdb db. What i understand is 1.enable accesslog overlay on master server configure accesslog start the master 2. Take backup with mdb_copyand restore it on other master servers. 3. Enable accesslog configure to new consumers(work as providers as well) Can you have a look, if i am wrong some where or any suggestion. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema2/channelIdentifier.schema include /etc/openldap/schema2/platform.schema include /etc/openldap/schema2/extendedProfileKey.schema include /etc/openldap/schema2/extendedProfileValue.schema include /etc/openldap/schema2/behaviorKey.schema include /etc/openldap/schema2/behaviorValue.schema include /etc/openldap/schema2/questionAnswer.schema include /etc/openldap/schema2/extendedTop.schema include /etc/openldap/schema2/counter.schema serverid 1 TLSCipherSuite HIGH:MEDIUM:+SSLv3 TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/cacerts/mmam01.crt TLSCertificateKeyFile /etc/openldap/cacerts/mmam01.key TLSVerifyClient never pidfile /var/run/slapd.pid argsfile /var/run/slapd.args loglevel sync stats idletimeout 30 writetimeout 30 modulepath /etc/openldap/lib64/openldap moduleload back_mdb.la moduleload ppolicy.la moduleload unique.la moduleload syncprov.la database mdb suffix "dc=example,dc=com" directory /openldap/var/data access to attrs=userPassword by self write by anonymous auth by * break access to * by group/groupOfUniqueNames/uniqueMember.exact="cn=PWrite,ou=bGroup,dc=example,dc=com" manage by group/groupOfUniqueNames/uniqueMember.exact="cn=PRead,ou=bGroup,dc=example,dc=com" read by * break access to * by self write by anonymous auth by * read rootdn "cn=Manager,dc=example,dc=com" rootpw {SSHA}dXDESQeFjSoa/A1HfJ2TAzYf4DrSYWY index mail,uid,postalCode,smail,channelType,channelValue,answer,behavName,objectclass,type eq index givenName,sn,city,cn,extName sub index displayName approx index entryCSN,entryUUID eq checkpoint 128 15 maxsize 274877906944 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 #accesslog db configuration database mdb suffix cn=log rootdn "cn=Manager,cn=log" rootpw xxxxxx directory /apps/accesslog index reqStart,objectclass,entryCSN,reqResult eq overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE overlay accesslog logdb cn=log logops writes logpurge 7+00:00 2+00:00 logsuccess TRUE syncrepl rid=111 provider=ldap://sjam01.com binddn="cn=Manager,dc=example,dc=com" bindmethod=simple credentials=0m2013 tls_cacert=/etc/openldap/cacerts/cacert.pem searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 5 60 +" network-timeout=10 timeout=10 syncdata=accesslog logbase="cn=log" logfilter="(&(objectclass=auditWriteObject)(reqResult=0))" syncrepl rid=222 provider=ldap://mmam04.com binddn="cn=Manager,dc=example,dc=com" bindmethod=simple credentials=0m2013 tls_cacert=/etc/openldap/cacerts/cacert.pem searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 5 60 +" network-timeout=10 timeout=10 syncdata=accesslog logbase="cn=log" logfilter="(&(objectclass=auditWriteObject)(reqResult=0))" mirrormode true overlay unique unique_attributes mail overlay ppolicy ppolicy_default "cn=default,ou=pwdPolicy,dc=example,dc=com" ppolicy_use_lockout On Thu, Jan 17, 2013 at 1:51 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 17, 2013 1:48 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> If i can't use multi master with refreshandpersist then why its given at >> all. >> i was able to get replication working with same configuration in other >> testing environment, but with very less users 1m only. >> > > I don't understand your statement/question. Delta-Syncrepl MMR uses > refresh and persist, and it is the best option to use for replication in > OpenLDAP. Particularly with multi-master replication. > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

2 1

Access questions
by Ori Bani 16 Jan '13

16 Jan '13

Hello, I think I understand that default access for everything that does not have any access rule is to allow read permission to everyone. All other entries (that have some form of access rules) will have a default of "access to * by * none" applied. I'd like instead to have all defaults be no access. I have a directory that will be used for internal email processes and also have a certain amount of public/anonymous access (but only to chosen attributes). Due to the public/anonymous component, I'd like to have default access rules be as restrictive as possible. Does it make sense to (do people commonly) set a global access of "access to * by * none" and then open access up for individual databases as desired? I'm thinking a global rule: access to * by dn.base="cn=Manager,dc=example,dc=com" write by * none Then each database will have to explicitly open access only as much as needed. The following would be in the database that uses the suffix for dc=example,dc=com Passwords for auth only, only admin can change passwords: access to attrs=userPassword by dn.base="cn=Manager,dc=example,dc=com" write by anonymous auth by * none Attributes needed by email delivery software only visible to the entry itself: access to attrs=mailMessageStore,homeDirectory,uidNumber,gidNumber by dn.base="cn=Manager,dc=example,dc=com" write by self read by * none Publicly available attributes defined explicitly: access to attrs=mail,jpegPhoto by dn.base="cn=Manager,dc=example,dc=com" write by * read Nothing else can be seen by anyone except the admin: access to * by dn.base="cn=Manager,dc=example,dc=com" write by * none In this scenario, cn is used to identify entries when searching but as you see, that attribute is forbidden to anonymous. Is that a problem or is it OK to allow query against cn while still disallowing cn in the results? I guess I'd also add this within this database's context, but I have to do it above the other rules I just listed? access to dn.base="cn=Manager,dc=example,dc=com" by peername.ip=127.0.0.1 auth by peername.ip=192.168.0.0%255.255.255.0 auth by * none Any tips much appreciated.

2 6

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

If i can't use multi master with refreshandpersist then why its given at all. i was able to get replication working with same configuration in other testing environment, but with very less users 1m only. I am having all this running in production, but replication is not working. What should be my strategy to add new consumer, where my provider is running with mdb db size of 200G in production. i don't want to mess with configuration changes on master or with minimum changes. Any other suggestions are all welcome. On Wed, Jan 16, 2013 at 12:46 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, January 15, 2013 6:53 PM +0000 Chris Card < > ctcard(a)hotmail.com> wrote: > > This second problem doesn't happen consistently, but because I don't >> understand why it happens or how to fix it consistently, I can't go ahead >> with the production upgrade to delta-syncrepl, which is very frustrating. >> We are currently running openldap 2.4.31, but I do plan to see if 2.4.33 >> or RE24 behaves better. However, looking at the openldap sources I >> haven't spotted any fixes which look likely to help. >> Any ideas? >> > > I take it you are replicating cn=config then? I never do that, so hard > for me to comment on issues that may arise by doing that. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical