openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

Strange ACL evaluation depending on AttributeSelection?
by Michael Ströder 17 Jan '13

17 Jan '13

HI! Today I made a strange observation tested with release 2.4.32 and git-build RE24 6f33e2c both with same results. The following commands (lines wrapped herein) were all typed as user root which gets mapped by authz-regexp to the rootdn of the database o=example (LDAPI with SASL/EXTERNAL). Let's check that: # ldapwhoami SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn:uid=admin,o=example I wanted to check ACLs applied to attribute 'sambaNTPassword' and to test Samba logon of course. Samba logon did work when putting the Samba demon user in a special group which has read access everywhere but it didn't when the special Samba ACLs were to be applied. So I tried to examine a possible bug in my ACLs but noticed unexpected results during that. Everything looks fine with a normal search as rootdn and we see that the entry indeed contains 'sambaNTPassword': # ldapsearch -LLL "(&(objectclass=sambaSamAccount)(uid=wtester))" sambaNTPassword SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: employeeNumber=42424242,ou=users,o=example sambaNTPassword: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx But when requesting to use the authz-DN with which the Samba demon binds the attribute is not shown which one might consider an ACL issue. Note that sambaNTPassword is explicitly requested just like Samba correctly does it: # ldapsearch -LLL -X "dn:uid=samba_dc_1,ou=samba,o=example" "(&(objectclass=sambaSamAccount)(uid=wtester))" sambaNTPassword SASL/EXTERNAL authentication started SASL username: dn:uid=samba_dc_1,ou=samba,o=example SASL SSF: 0 dn: employeeNumber=42424242,ou=users,o=example But then I would expect this search also *not* to return attribute 'sambaNTPassword' but it does! # ldapsearch -LLL -X "dn:uid=samba_dc_1,ou=samba,o=example" "(&(objectclass=sambaSamAccount)(uid=wtester))" "*" |grep -i sambaNTPassword SASL/EXTERNAL authentication started SASL username: dn:uid=samba_dc_1,ou=samba,o=example SASL SSF: 0 sambaNTPassword: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Maybe I'm doing something wrong on the command-line but I simply don't get it... :-/ Or is there some difference in ACL handling based on SearchRequest.attributes (AttributeSelection)? I have an ACL which blocks access to password attributes of disabled users by using a filter-based ACL. Hmm, I did not try what happens when explicitly requesting the attribute used in the filter. I have to do that tomorrow... Ciao, Michael.

2 3

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

Ok Thanks a lot , looks like i will be able to swim through Final question, before going for this config. What would be impact of lastmode on/off with and without replication with big db size. On Thu, Jan 17, 2013 at 4:45 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 17, 2013 4:37 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> I am using rpm from symas, latest update on 29th dec,2013. i think that >> will work. >> >> Is my acceslog db configuration in slapd.conf right ? >> > > If that is your actual config file, no. You stuck the definition of the > accesslog DB in the middle of your existing DB configuration, which is > going to cause you all sorts of problems. I prefer to list the accesslog > db prior to the main db. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

1 0

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

I am using rpm from symas, latest update on 29th dec,2013. i think that will work. Is my acceslog db configuration in slapd.conf right ? On Thu, Jan 17, 2013 at 4:27 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 17, 2013 2:49 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> My Bad >> >> Going forward, what would be my strategy, to enable delta sync repl with >> one master is already running with 200G mdb db. >> >> What i understand is >> 1.enable accesslog overlay on master server configure accesslog start >> the master >> 2. Take backup with mdb_copyand restore it on other master servers. >> 3. Enable accesslog configure to new consumers(work as providers as >> well) >> > > That sounds about right. I assume you are using current RE24 OpenLDAP, > and not 2.4.33. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

2 1

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

My Bad Going forward, what would be my strategy, to enable delta sync repl with one master is already running with 200G mdb db. What i understand is 1.enable accesslog overlay on master server configure accesslog start the master 2. Take backup with mdb_copyand restore it on other master servers. 3. Enable accesslog configure to new consumers(work as providers as well) Can you have a look, if i am wrong some where or any suggestion. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema2/channelIdentifier.schema include /etc/openldap/schema2/platform.schema include /etc/openldap/schema2/extendedProfileKey.schema include /etc/openldap/schema2/extendedProfileValue.schema include /etc/openldap/schema2/behaviorKey.schema include /etc/openldap/schema2/behaviorValue.schema include /etc/openldap/schema2/questionAnswer.schema include /etc/openldap/schema2/extendedTop.schema include /etc/openldap/schema2/counter.schema serverid 1 TLSCipherSuite HIGH:MEDIUM:+SSLv3 TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/cacerts/mmam01.crt TLSCertificateKeyFile /etc/openldap/cacerts/mmam01.key TLSVerifyClient never pidfile /var/run/slapd.pid argsfile /var/run/slapd.args loglevel sync stats idletimeout 30 writetimeout 30 modulepath /etc/openldap/lib64/openldap moduleload back_mdb.la moduleload ppolicy.la moduleload unique.la moduleload syncprov.la database mdb suffix "dc=example,dc=com" directory /openldap/var/data access to attrs=userPassword by self write by anonymous auth by * break access to * by group/groupOfUniqueNames/uniqueMember.exact="cn=PWrite,ou=bGroup,dc=example,dc=com" manage by group/groupOfUniqueNames/uniqueMember.exact="cn=PRead,ou=bGroup,dc=example,dc=com" read by * break access to * by self write by anonymous auth by * read rootdn "cn=Manager,dc=example,dc=com" rootpw {SSHA}dXDESQeFjSoa/A1HfJ2TAzYf4DrSYWY index mail,uid,postalCode,smail,channelType,channelValue,answer,behavName,objectclass,type eq index givenName,sn,city,cn,extName sub index displayName approx index entryCSN,entryUUID eq checkpoint 128 15 maxsize 274877906944 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 #accesslog db configuration database mdb suffix cn=log rootdn "cn=Manager,cn=log" rootpw xxxxxx directory /apps/accesslog index reqStart,objectclass,entryCSN,reqResult eq overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE overlay accesslog logdb cn=log logops writes logpurge 7+00:00 2+00:00 logsuccess TRUE syncrepl rid=111 provider=ldap://sjam01.com binddn="cn=Manager,dc=example,dc=com" bindmethod=simple credentials=0m2013 tls_cacert=/etc/openldap/cacerts/cacert.pem searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 5 60 +" network-timeout=10 timeout=10 syncdata=accesslog logbase="cn=log" logfilter="(&(objectclass=auditWriteObject)(reqResult=0))" syncrepl rid=222 provider=ldap://mmam04.com binddn="cn=Manager,dc=example,dc=com" bindmethod=simple credentials=0m2013 tls_cacert=/etc/openldap/cacerts/cacert.pem searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 5 60 +" network-timeout=10 timeout=10 syncdata=accesslog logbase="cn=log" logfilter="(&(objectclass=auditWriteObject)(reqResult=0))" mirrormode true overlay unique unique_attributes mail overlay ppolicy ppolicy_default "cn=default,ou=pwdPolicy,dc=example,dc=com" ppolicy_use_lockout On Thu, Jan 17, 2013 at 1:51 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 17, 2013 1:48 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> If i can't use multi master with refreshandpersist then why its given at >> all. >> i was able to get replication working with same configuration in other >> testing environment, but with very less users 1m only. >> > > I don't understand your statement/question. Delta-Syncrepl MMR uses > refresh and persist, and it is the best option to use for replication in > OpenLDAP. Particularly with multi-master replication. > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

2 1

Access questions
by Ori Bani 16 Jan '13

16 Jan '13

Hello, I think I understand that default access for everything that does not have any access rule is to allow read permission to everyone. All other entries (that have some form of access rules) will have a default of "access to * by * none" applied. I'd like instead to have all defaults be no access. I have a directory that will be used for internal email processes and also have a certain amount of public/anonymous access (but only to chosen attributes). Due to the public/anonymous component, I'd like to have default access rules be as restrictive as possible. Does it make sense to (do people commonly) set a global access of "access to * by * none" and then open access up for individual databases as desired? I'm thinking a global rule: access to * by dn.base="cn=Manager,dc=example,dc=com" write by * none Then each database will have to explicitly open access only as much as needed. The following would be in the database that uses the suffix for dc=example,dc=com Passwords for auth only, only admin can change passwords: access to attrs=userPassword by dn.base="cn=Manager,dc=example,dc=com" write by anonymous auth by * none Attributes needed by email delivery software only visible to the entry itself: access to attrs=mailMessageStore,homeDirectory,uidNumber,gidNumber by dn.base="cn=Manager,dc=example,dc=com" write by self read by * none Publicly available attributes defined explicitly: access to attrs=mail,jpegPhoto by dn.base="cn=Manager,dc=example,dc=com" write by * read Nothing else can be seen by anyone except the admin: access to * by dn.base="cn=Manager,dc=example,dc=com" write by * none In this scenario, cn is used to identify entries when searching but as you see, that attribute is forbidden to anonymous. Is that a problem or is it OK to allow query against cn while still disallowing cn in the results? I guess I'd also add this within this database's context, but I have to do it above the other rules I just listed? access to dn.base="cn=Manager,dc=example,dc=com" by peername.ip=127.0.0.1 auth by peername.ip=192.168.0.0%255.255.255.0 auth by * none Any tips much appreciated.

2 6

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

If i can't use multi master with refreshandpersist then why its given at all. i was able to get replication working with same configuration in other testing environment, but with very less users 1m only. I am having all this running in production, but replication is not working. What should be my strategy to add new consumer, where my provider is running with mdb db size of 200G in production. i don't want to mess with configuration changes on master or with minimum changes. Any other suggestions are all welcome. On Wed, Jan 16, 2013 at 12:46 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, January 15, 2013 6:53 PM +0000 Chris Card < > ctcard(a)hotmail.com> wrote: > > This second problem doesn't happen consistently, but because I don't >> understand why it happens or how to fix it consistently, I can't go ahead >> with the production upgrade to delta-syncrepl, which is very frustrating. >> We are currently running openldap 2.4.31, but I do plan to see if 2.4.33 >> or RE24 behaves better. However, looking at the openldap sources I >> haven't spotted any fixes which look likely to help. >> Any ideas? >> > > I take it you are replicating cn=config then? I never do that, so hard > for me to comment on issues that may arise by doing that. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

2 1

Using policy overlay
by rodrigo tavares 16 Jan '13

16 Jan '13

Hello ! I´m with troubles, in trying to load policy overlay,it is /usr/lib/ldap/ppolicy.so. Then I put overlay ppolicy in slapd.conf. So, restart openldap. But is com error: Jan 16 16:08:12 defensoria slapd[14010]: @(#) $OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) $#012#011buildd@murphy:/build/buildd-openldap_2.4.23-7.2-i386-Y1mwvF/openldap-2.4.23/debian/build/servers/slapd Jan 16 16:08:12 defensoria slapd[14010]: overlay "ppolicy" not found Jan 16 16:08:12 defensoria slapd[14010]: slapd stopped. Jan 16 16:08:12 defensoria slapd[14010]: connections_destroy: nothing to destroy. Anybody Can to help me ? Thanks ! Rodrigo Faria

2 3

Re: uninstall?
by Ori Bani 15 Jan '13

15 Jan '13

>> Is there a make rule for uninstallation? "make uninstall" doesn't do >> the trick... >> >> If there's not, is there any recommended way to handle removing >> OpenLDAP that was installed from source? > > > Use --prefix so you install everything into the path you want? Otherwise, > no, no particularly easy way to uninstall. Hmmm, OK thank you.

1 0

uninstall?
by Ori Bani 15 Jan '13

15 Jan '13

Hi, Is there a make rule for uninstallation? "make uninstall" doesn't do the trick... If there's not, is there any recommended way to handle removing OpenLDAP that was installed from source? Thank you!

2 1

Permissions, users, startup when install from source
by Ori Bani 15 Jan '13

15 Jan '13

Hi, If compiling and installing from source, I don't see any information in the manual about how to auto-start the software and about process/file/directory permissions and ownership. I'm still searching the Faq-O-Matic (which is a little frustrating). Taking a step back, I'd love to install from yum on RHEL/CentOS and let it be taken care of in a trusted manner. But we require better password hashing than SHA1, so we are required to compile by hand using the passwd/sha2 contributed module (little surprised this isn't accepted into the core project, but I'm sure there are reasons). Maybe I can find this in a third-party repo somewhere? After installation, what is commonly done in this regard? Create user/group "ldap" with no login shell and chown ldap:ldap on /usr/local/var/openldap-data? Is that all? Then what do people use for auto-starting the software (presumably with -u ldap -g ldap) in a RedHat environment? Thanks for the work that you do, thanks for the great software.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical