openldap-technical

openldap-technical@openldap.org

1 participants
9989 discussions

Forcing TLS encryption
by Wiebe Cazemier 28 Dec '12

28 Dec '12

Hi, I'm trying to get slapd to reject non-encrypted connections, but nowhere can I find how you configure it to *only* accept TLS traffic. I just confirmed that our server accepts unencrypted traffic (with ldapsearch and tcpdump). Normally, I would just close the non-SSL port with IP tables, but using the SSL port is deprecated, apparently, so I don't have that option. So, with the cn=config SSL configuration commands, like this: dn: cn=config changetype:modify replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/bla.key - replace: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/bla.crt - replace: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/ca.pem Is there a param for forcing TLS? I tried: dn: cn=config changetype: modify replace: olcTLSCipherSuite olcTLSCipherSuite: TLSv1+RSA:!NULL but it doesn't work; the server doesn't start. Debug output: TLS: could not set cipher list TLSv1+RSA:!NULL. main: TLS init def ctx failed: -1 slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. Nor does "olcTLSCipherSuite: HIGH" work. I looked in the openldap source code, but even there, I can't find how to do it. Slapd: 2.4.21-0ubuntu5.7 Ubuntu: Ubuntu 10.04.4 LTS Thanks, Wiebe Cazemier

5 8

add posixAccount to back-sql definition
by DavidHornung 28 Dec '12

28 Dec '12

Hello, up to now i used inetOrgPerson from the docs to auth my users via LDAP/back-sql. but in inetOrgPerson isnt a uid defined so the Object Class posixAccount would fit better. I created a table which represents the posixAccount - minimal I need uid and password. the entity integer refers to id's of table persons with mobliePhone, mail, etc. CREATE TABLE net_accounts ( id serial NOT NULL, entity integer NOT NULL, password character varying NOT NULL, uid character varying NOT NULL, CONSTRAINT "net_accounts_pkey" PRIMARY KEY (id , uid ) ) I plan to use this posixAccount to auth with Mailserver, Intranet and all other services ... How to modify the example in the docs to do this ? Thank you! David

1 0

Multi-Master OpenLDAP Replication for 3 nodes -- slapadd command failing
by fal patel 28 Dec '12

28 Dec '12

Oops -- forgot to enter subject-line! On Thu, Dec 27, 2012 at 2:11 AM, fal patel <fal0patel(a)gmail.com> wrote: > Hello, > > I'm trying to accomplish Multi-Master OpenLDAP Replication for 3 nodes, > but it's not working. > > Specifically, per The OpenLDAP 2.4 Administrator's Guide, Section 18.3.3 > "N-Way Multi=Master", I have created the following LDIF file and slapd.conf > file, but when I run slapadd to create my config database it fails. > > Could you please advise? > > Thank you very much. > > Fal > > (1) The slapadd command, I execute, and the error message I get: > ================================================ > sudo slapadd -l /home/ubuntu11/openldap-2.4.33/mmr_servers.ldif -f > /usr/local/etc/openldap/slapd.conf -F /usr/local/etc/openldap/slapd.d > [sudo] password for ubuntu11: > 50dc0b31 bdb_monitor_db_open: monitoring disabled; configure monitor > database to enable > slapadd: line 1: database #1 (dc=ldapservice,dc=hq,dc=mycompany,dc=com) > not configured to hold "cn=config"; did you mean to use database #0 > (cn=config)? > _ 2.58% eta none elapsed none spd 1.1 > M/s > Closing DB... > > > > (2) My LDIF File, mmr-servers.ldif > ========================= > # This sets up the config database: > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 1 > > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcRootPW: secret > > # second and third servers will have a different olcServerID obviously: > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 2 > > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcRootPW: secret > > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 3 > > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcRootPW: secret > > # This sets up syncrepl as a provider (since these are all masters): > dn: cn=module,cn=config > objectClass: olcModuleList > cn: module > olcModulePath: /usr/local/libexec/openldap > olcModuleLoad: syncprov.la > > # Now we setup the first Master Node > # (replace $URI1, $URI2 and $URI3 etc. with your actual ldap urls): > dn: cn=config > changetype: modify > replace: olcServerID > ## olcServerID: 1 $URI1 > > olcServerID: 1 ldap://ldap.awshost.ldapservice.hq.mycompany.com > ## olcServerID: 2 $URI2 > olcServerID: 2 ldap://ldap.schost.ldapservice.hq.mycompany.com > ## olcServerID: 3 $URI3 > olcServerID: 3 ldap://ldap.sachost.ldapservice.hq.mycompany.com > > dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config > changetype: add > objectClass: olcOverlayConfig > objectClass: olcSyncProvConfig > olcOverlay: syncprov > > dn: olcDatabase={0}config,cn=config > changetype: modify > add: olcSyncRepl > olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple > credentials=secret searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple > credentials=secret searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=003 provider=$URI3 binddn="cn=config" bindmethod=simple > credentials=secret searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=1 > > add: olcMirrorMode > olcMirrorMode: TRUE > > # Now start up the Master and a consumer/s; > # also add the above LDIF to the first consumer, second consumer etc. > # It will then replicate cn=config. > # You now have N-Way Multimaster on the config database. > > # We still have to replicate the actual data, not just the config; > # so add to the master > # (all active and configured consumers/masters will pull down this config, > # as they are all syncing). > # Also, replace all ${} variables with whatever is applicable to your > setup: > dn: olcDatabase={1}$BACKEND,cn=config > objectClass: olcDatabaseConfig > objectClass: olc${BACKEND}Config > olcDatabase: {1}$BACKEND > olcSuffix: $BASEDN > olcDbDirectory: ./db > olcRootDN: $MANAGERDN > olcRootPW: $PASSWD > olcLimits: dn.exact="$MANAGERDN" time.soft=unlimited time.hard=unlimited > size.soft=unlimited olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" > bindmethod=simple > credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly > interval=00:00:00:10 retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple > credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly > interval=00:00:00:10 retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=006 provider=$URI3 binddn="$MANAGERDN" bindmethod=simple > credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly > interval=00:00:00:10 retry="5 5 300 5" timeout=1 > olcMirrorMode: TRUE > > dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config > changetype: add > objectClass: olcOverlayConfig > objectClass: olcSyncProvConfig > olcOverlay: syncprov > > # Note: All of your servers' clocks must be tightly synchronized using > e.g. NTP. > # Note: URLs specified in olcSyncRepl directives are the servers URLs to > replicate from. > # These must exactly match the URLs slapd listens on (-h in Command-Line > Options). > # Otherwise slapd may attempt to replicate from itself, causing a loop. > > > > (3) My slapd.conf file: > ================ > # > # See slapd.conf(5) for details on configuration options. > # This file should NOT be world readable. > # > include /usr/local/etc/openldap/schema/core.schema > > # Define global ACLs to disable default read access. > > # Do not enable referrals until AFTER you have a working directory > # service AND an understanding of referrals. > #referral ldap://root.openldap.org > > pidfile /usr/local/var/run/slapd.pid > argsfile /usr/local/var/run/slapd.args > > # Load dynamic backend modules: > # modulepath /usr/local/libexec/openldap > # moduleload back_bdb.la > # moduleload back_hdb.la > # moduleload back_ldap.la > > # Sample security restrictions > # Require integrity protection (prevent hijacking) > # Require 112-bit (3DES or better) encryption for updates > # Require 63-bit encryption for simple bind > # security ssf=1 update_ssf=112 simple_bind=64 > > # Sample access control policy: > # Root DSE: allow anyone to read it > # Subschema (sub)entry DSE: allow anyone to read it > # Other DSEs: > # Allow self write access > # Allow authenticated users read access > # Allow anonymous users to authenticate > # Directives needed to implement policy: > # access to dn.base="" by * read > # access to dn.base="cn=Subschema" by * read > # access to * > # by self write > # by users read > # by anonymous auth > # > # if no access controls are present, the default policy > # allows anyone and everyone to read anything but restricts > # updates to rootdn. (e.g., "access to * by * read") > # > # rootdn can always read and write EVERYTHING! > > ####################################################################### > # BDB database definitions > ####################################################################### > ## database bdb > ## suffix "dc=my-domain,dc=com" > ## rootdn "cn=Manager,dc=my-domain,dc=com" > # Cleartext passwords, especially for the rootdn, should > # be avoid. See slappasswd(8) and slapd.conf(5) for details. > # Use of strong authentication encouraged. > ## rootpw secret > # The database directory MUST exist prior to running slapd AND > # should only be accessible by the slapd and slap tools. > # Mode 700 recommended. > ## directory /usr/local/var/openldap-data > # Indices to maintain > ## index objectClass eq > > ## added for multimaster replication (prior to running slapadd to create > db): > database bdb > # suffix <DN of root of subtree you are trying to create> > suffix "dc=ldapservice,dc=hq,dc=mycompany,dc=com" > rootdn "cn=admin,dc=ldapservice,dc=hq,dc=mycompany,dc=com" > rootpw secret > # directory for index files > directory /usr/local/var/openldap-data > # specify which indices you want to build > index objectClass eq > # loglevel 64 > > > > I have these additional questions also, please: > * It's "refreshAndPersist" Provider Push replication I want to implement, > not "refreshOnly" Consumer Poll Pull. > So in my mmr-servers.ldif file, can/should I change all the "refreshOnly" > clauses in the Data Replication part to "refreshAndPersist"? > > * In the above LDIF file, in both the Config Replication section and the > Data Replication section, why does it add MirrorMode and set it to True? > It's N-Way Multi-Master replication I want to implement, not Mirror-Mode > replication, so can/should I get rid of all those "Mirror Mode" clause > statements? > > Thank you once again. > >

3 4

db_recover gives program version mismatch
by anil beniwal 27 Dec '12

27 Dec '12

Hi I am getting belwo errors when i run db_recover on rhel 6.3 64 bit. [root@mmprodam01 data-ldap]# /apps/db4/bin/db_recover -h /apps/openldap/var/openldap-data/ db_recover: Program version 4.7 doesn't match environment version 4.8 db_recover: Unacceptable log file /apps/openldap/var/openldap-data/log.0000000001: unsupported log version 16 db_recover: Invalid log file: log.0000000001: Invalid argument db_recover: PANIC: Invalid argument db_recover: process-private: unable to find environment db_recover: DB_ENV->open: DB_RUNRECOVERY: Fatal error, run database recovery I have installed berkely db in /apps/db4 with simple prefix=/apps/db4 i am getting this error everytime i run any db_xxx command. [root@mmprodam01 data-ldap]# rpm -qa | grep db4 db4-4.7.25-17.el6.x86_64 db4-utils-4.7.25-17.el6.x86_64 Its still taking db4.7 . Any help would be great. Let me know in case further details are required. -- Thanks&Regards Anil Beniwal

3 6

Re: How to force password change upon account creation
by Dan White 27 Dec '12

27 Dec '12

On 12/27/12 14:24 -0600, Kyle(a)TheHarrisHome.com wrote: >Hi Dan, > >Thank you for your response. I am using CentOS 6.3, OpenLDAP 2.4 and sssd >1.8 as the pam module. Hope that helps as I still can't quite figure it >out, and thank you again. You should see if sssd contains the logic to make use of the ppolicy related attributes. If not, you should configure the appropriate shadowAccount attributes instead. >-----Original Message----- >From: Dan White [mailto:dwhite@olp.net] >Sent: Sunday, December 23, 2012 6:43 PM >To: Kyle Harris >Cc: openldap-technical(a)openldap.org >Subject: Re: How to force password change upon account creation > >On 12/23/12 17:33 -0600, Kyle Harris wrote: >>Hello All, >> >>I have a perl script that allows for the creation of new accounts in >>OpenLDAP. I am attempting to find a way to force the newly created >>user to change his or her password upon first login. I tried setting >>the attribute pwdMustChange to TRUE but that attribute must not be >>definable upon user creation. So, how can this be accomplished so that >>a new user is forced to change passwords after they first log on? > >By 'log in' I assume you're asking about shell access to your system, which >makes use of an ldap pam module to authenticate users. If so, the function >of prompting users to change their password will be handled by that piece of >software, and you should consult the documentation distributed with it. > >If that's not the case, please clarify your authentication scenario. -- Dan White

1 0

Multi-Master OpenLDAP Replication for 3 nodes -- slapadd command failing
by fal patel 27 Dec '12

27 Dec '12

Oops -- forgot to add subject-line! ---------- Forwarded message ---------- From: fal patel <fal0patel(a)gmail.com> Date: Thu, Dec 27, 2012 at 2:11 AM Subject: To: openldap-technical(a)openldap.org Cc: fal patel <fal0patel(a)gmail.com>

1 0

(no subject)
by fal patel 27 Dec '12

27 Dec '12

Hello, I'm trying to accomplish Multi-Master OpenLDAP Replication for 3 nodes, but it's not working. Specifically, per The OpenLDAP 2.4 Administrator's Guide, Section 18.3.3 "N-Way Multi=Master", I have created the following LDIF file and slapd.conf file, but when I run slapadd to create my config database it fails. Could you please advise? Thank you very much. Fal (1) The slapadd command, I execute, and the error message I get: ================================================ sudo slapadd -l /home/ubuntu11/openldap-2.4.33/mmr_servers.ldif -f /usr/local/etc/openldap/slapd.conf -F /usr/local/etc/openldap/slapd.d [sudo] password for ubuntu11: 50dc0b31 bdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapadd: line 1: database #1 (dc=ldapservice,dc=hq,dc=mycompany,dc=com) not configured to hold "cn=config"; did you mean to use database #0 (cn=config)? _ 2.58% eta none elapsed none spd 1.1 M/s Closing DB... (2) My LDIF File, mmr-servers.ldif ========================= # This sets up the config database: dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: secret # second and third servers will have a different olcServerID obviously: dn: cn=config objectClass: olcGlobal cn: config olcServerID: 2 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: secret dn: cn=config objectClass: olcGlobal cn: config olcServerID: 3 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: secret # This sets up syncrepl as a provider (since these are all masters): dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/local/libexec/openldap olcModuleLoad: syncprov.la # Now we setup the first Master Node # (replace $URI1, $URI2 and $URI3 etc. with your actual ldap urls): dn: cn=config changetype: modify replace: olcServerID ## olcServerID: 1 $URI1 olcServerID: 1 ldap://ldap.awshost.ldapservice.hq.mycompany.com ## olcServerID: 2 $URI2 olcServerID: 2 ldap://ldap.schost.ldapservice.hq.mycompany.com ## olcServerID: 3 $URI3 olcServerID: 3 ldap://ldap.sachost.ldapservice.hq.mycompany.com dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=003 provider=$URI3 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 add: olcMirrorMode olcMirrorMode: TRUE # Now start up the Master and a consumer/s; # also add the above LDIF to the first consumer, second consumer etc. # It will then replicate cn=config. # You now have N-Way Multimaster on the config database. # We still have to replicate the actual data, not just the config; # so add to the master # (all active and configured consumers/masters will pull down this config, # as they are all syncing). # Also, replace all ${} variables with whatever is applicable to your setup: dn: olcDatabase={1}$BACKEND,cn=config objectClass: olcDatabaseConfig objectClass: olc${BACKEND}Config olcDatabase: {1}$BACKEND olcSuffix: $BASEDN olcDbDirectory: ./db olcRootDN: $MANAGERDN olcRootPW: $PASSWD olcLimits: dn.exact="$MANAGERDN" time.soft=unlimited time.hard=unlimited size.soft=unlimited olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=006 provider=$URI3 binddn="$MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov # Note: All of your servers' clocks must be tightly synchronized using e.g. NTP. # Note: URLs specified in olcSyncRepl directives are the servers URLs to replicate from. # These must exactly match the URLs slapd listens on (-h in Command-Line Options). # Otherwise slapd may attempt to replicate from itself, causing a loop. (3) My slapd.conf file: ================ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### ## database bdb ## suffix "dc=my-domain,dc=com" ## rootdn "cn=Manager,dc=my-domain,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. ## rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. ## directory /usr/local/var/openldap-data # Indices to maintain ## index objectClass eq ## added for multimaster replication (prior to running slapadd to create db): database bdb # suffix <DN of root of subtree you are trying to create> suffix "dc=ldapservice,dc=hq,dc=mycompany,dc=com" rootdn "cn=admin,dc=ldapservice,dc=hq,dc=mycompany,dc=com" rootpw secret # directory for index files directory /usr/local/var/openldap-data # specify which indices you want to build index objectClass eq # loglevel 64 I have these additional questions also, please: * It's "refreshAndPersist" Provider Push replication I want to implement, not "refreshOnly" Consumer Poll Pull. So in my mmr-servers.ldif file, can/should I change all the "refreshOnly" clauses in the Data Replication part to "refreshAndPersist"? * In the above LDIF file, in both the Config Replication section and the Data Replication section, why does it add MirrorMode and set it to True? It's N-Way Multi-Master replication I want to implement, not Mirror-Mode replication, so can/should I get rid of all those "Mirror Mode" clause statements? Thank you once again.

1 0

data import very slow for data migration
by anil beniwal 25 Dec '12

25 Dec '12

Hi We are having 4 million users to migrate, all data exported from oracle to multiple ldif files. Imported 1 million till now, took almost 28 hours. and openldap-data dir of about 28G. openldap version 2.4.33 bdb version 5.1.29 RHEL 6.3 RAM 8G 4 cpu , system is a VM. Currently running slapadd output + /apps/openldap/sbin/slapadd -q -c -w -f /apps/openldap/etc/openldap/slapd.conf -l /root/User9.ldif bdb_monitor_db_open: monitoring disabled; configure monitor database to enable . 2.27% eta 21h31m elapsed 29m57s spd 1.6 k/s str2entry: invalid value for attributeType postalAddress #0 (syntax 1.3.6.1.4.1.1466.115.121.1.41) slapadd: could not parse entry (line=394416) * 2.81% eta 19h59m elapsed 34m40s spd 10.1 k/s Its seems to be taking weeks go import whole data. is there any tool or any other approach which we can use to make it fast,Or we are going with wrong configuration. Or we have to switch to ODS or RHDS Top output top - 10:26:04 up 21 days, 6:51, 3 users, load average: 2.13, 2.06, 1.79 Tasks: 153 total, 2 running, 151 sleeping, 0 stopped, 0 zombie Cpu0 :100.0%us, 0.0%sy, 0.0%ni, 0.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st Cpu1 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st Cpu2 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st Cpu3 : 3.0%us, 0.3%sy, 0.0%ni, 0.0%id, 96.6%wa, 0.0%hi, 0.0%si, 0.0%st Mem: 9095980k total, 8956852k used, 139128k free, 31452k buffers Swap: 6291448k total, 21300k used, 6270148k free, 7431012k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 27877 ldap 20 0 4855m 539m 284m S 99.8 6.1 1807:28 slapd 21130 root 20 0 5267m 3.8g 3.0g R 4.3 43.6 0:59.27 slapadd DB_CONFIG set_cachesize 0 4294967295 0 set_lg_regionmax 2048576 set_lg_max 20485760 set_lg_bsize 2097152 set_lk_max_locks 10000 set_lk_max_objects 5000 set_lk_max_lockers 5000 slapd.conf include /apps/openldap/etc/openldap/schema/core.schema include /apps/openldap/etc/openldap/schema/cosine.schema include /apps/openldap/etc/openldap/schema/nis.schema include /apps/openldap/etc/openldap/schema/inetorgperson.schema include /apps/openldap/etc/openldap/schema/openldap.schema include /apps/openldap/etc/openldap/schema/dyngroup.schema include /apps/openldap/etc/openldap/schema/ppolicy.schema include /apps/openldap/etc/openldap/schema/channelIdentifier.schema include /apps/openldap/etc/openldap/schema/platform.schema include /apps/openldap/etc/openldap/schema/extendedProfileKey.schema include /apps/openldap/etc/openldap/schema/extendedProfileValue.schema include /apps/openldap/etc/openldap/schema/behaviorKey.schema include /apps/openldap/etc/openldap/schema/behaviorValue.schema include /apps/openldap/etc/openldap/schema/questionAnswer.schema include /apps/openldap/etc/openldap/schema/extendedTop.schema include /apps/openldap/etc/openldap/schema/counter.schema pidfile /apps/openldap/var/run/slapd.pid argsfile /apps/openldap/var/run/slapd.args logfile /apps/logs/ldap loglevel 16640 database bdb suffix "dc=example,dc=com" access to attrs=userPassword by self write by anonymous auth by * break access to * by group/groupOfUniqueNames/uniqueMember.exact="cn=VWrite,ou=businessUsersGroup,dc=example,dc=com" manage by group/groupOfUniqueNames/uniqueMember.exact="cn=VRead,ou=businessUsersGroup,dc=example,dc=com" read by * break access to * by self write by anonymous auth by * read rootdn "cn=Manager,dc=example,dc=com" rootpw {SSHA}dXDFSQeFjSofJ3TAzYf8DrDSYWY ################## SSL ########################################## # TLSCipherSuite HIGH:MEDIUM:+SSLv3 TLSCACertificateFile /apps/openldap/etc/openldap/cacerts/cacert.pem TLSCertificateFile /apps/openldap/etc/openldap/cacerts/dam01.crt TLSCertificateKeyFile /apps/openldap/etc/openldap/cacerts/dam01.key # #################################################################### ####ache Entries ##### cachesize 900000 #idlcachesize 900000 lastmod on checkpoint 128 15 concurrency 100 index entryCSN eq index entryUUID eq index mail,uid,postalCode,smail,channelType,channelValue,answer,behavName,objectclass,tokenID,type eq index givenName,sn,city,question,behavValue,cn,extName sub index displayName approx # Replication Configuration overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 serverid 1 syncrepl rid=111 provider=ldap://s01.com binddn="cn=Manager,dc=example,dc=com" bindmethod=simple starttls=yes tls_reqcert=allow schemachecking=off credentials=G00gle# searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 5 300 +" interval=00:00:00:10 syncrepl rid=222 provider=ldap://m04.com binddn="cn=Manager,dc=example,dc=com" bindmethod=simple starttls=yes tls_reqcert=allow schemachecking=off credentials=G00gle# searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 5 300 +" interval=00:00:00:10 ###### mirrormode TRUE directory /apps/openldap/var/openldap-data overlay unique unique_attributes mail overlay ppolicy ppolicy_default "cn=default,ou=pwdPolicy,dc=example,dc=com" ppolicy_use_lockout -- Please let me know in case you need further details. Thanks&Regards Anil Beniwal +919891695048

2 3

How to force password change upon account creation
by Kyle Harris 24 Dec '12

24 Dec '12

Hello All, I have a perl script that allows for the creation of new accounts in OpenLDAP. I am attempting to find a way to force the newly created user to change his or her password upon first login. I tried setting the attribute pwdMustChange to TRUE but that attribute must not be definable upon user creation. So, how can this be accomplished so that a new user is forced to change passwords after they first log on? Thank you.

6 5

Migration from openldap 2.4.20 to 2.4.33
by anil beniwal 24 Dec '12

24 Dec '12

Hi We are planing migration from openldap 2.4.20 (with bdb 4.8) to openldap 2.4.33 (bdb 5.1.29) No of users are 4 million and about to go live within next 10 days. We are using flat file for configuration in use. Below is my slapd.conf and DB_CONFIG files include /apps/openldap/etc/openldap/schema/core.schema include /apps/openldap/etc/openldap/schema/cosine.schema include /apps/openldap/etc/openldap/schema/nis.schema include /apps/openldap/etc/openldap/schema/inetorgperson.schema include /apps/openldap/etc/openldap/schema/openldap.schema include /apps/openldap/etc/openldap/schema/dyngroup.schema include /apps/openldap/etc/openldap/schema/ppolicy.schema include /apps/openldap/etc/openldap/schema/channelIdentifier.schema include /apps/openldap/etc/openldap/schema/platform.schema include /apps/openldap/etc/openldap/schema/extendedProfileKey.schema include /apps/openldap/etc/openldap/schema/extendedProfileValue.schema include /apps/openldap/etc/openldap/schema/behaviorKey.schema include /apps/openldap/etc/openldap/schema/behaviorValue.schema include /apps/openldap/etc/openldap/schema/questionAnswer.schema include /apps/openldap/etc/openldap/schema/extendedTop.schema include /apps/openldap/etc/openldap/schema/counter.schema pidfile /apps/openldap/var/run/slapd.pid argsfile /apps/openldap/var/run/slapd.args logfile /apps/logs/ldap loglevel 16640 database bdb suffix "dc=ibm,dc=com" access to attrs=userPassword by self write by anonymous auth by * break access to * by group/groupOfUniqueNames/uniqueMember.exact="cn=VWrite,ou=businessUsersGroup,dc=ibm,dc=com" manage by group/groupOfUniqueNames/uniqueMember.exact="cn=VRead,ou=businessUsersGroup,dc=ibm,dc=com" read by * break access to * by self write by anonymous auth by * read rootdn "cn=Manager,dc=ibm,dc=com" rootpw {SSHA}dXDFSQeFjSoa/A1HfJ3TAzYf8 ################## SSL ########################################## # #TLSVerifyClient allow TLSCipherSuite HIGH:MEDIUM:+SSLv3 TLSCACertificateFile /apps/openldap/etc/openldap/cacerts/nascarcacert.pem TLSCertificateFile /apps/openldap/etc/openldap/cacerts/sj.crt TLSCertificateKeyFile /apps/openldap/etc/openldap/cacerts/sj.key # index entryCSN eq index entryUUID eq index mail,uid,postalCode,smail,channelType,channelValue,answer,behavName,objectclass,tokenID,type eq index givenName,sn,city,question,behavValue,cn,extName sub index displayName approx overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 serverid 3 syncrepl rid=111 provider=ldap://mmprod04 binddn="cn=Manager,dc=ibm,dc=com" bindmethod=simple starttls=yes tls_reqcert=allow credentials=G00gle# searchbase="dc=ibm,dc=com" type=refreshAndPersist retry="5 5 300 +" interval=00:00:00:10 syncrepl rid=222 provider=ldap://mmprod05 binddn="cn=Manager,dc=ibm,dc=com" bindmethod=simple starttls=yes tls_reqcert=allow credentials=G00gle# searchbase="dc=idm,dc=com" type=refreshAndPersist retry="5 5 300 +" interval=00:00:00:10 mirrormode TRUE cachesize 100000 idlcachesize 300000 lastmod on checkpoint 128 15 concurrency 100 directory /apps/openldap/var/openldap-data overlay unique unique_attributes mail overlay ppolicy ppolicy_default "cn=default,ou=pwdPolicy,dc=idm,dc=com" ppolicy_use_lockout DB_CONFIG set_cachesize 0 4294967295 0 set_lg_regionmax 2048576 set_lg_max 20485760 set_lg_bsize 2097152 set_lk_max_locks 10000 set_lk_max_objects 5000 set_lk_max_lockers 5000 My querries are:- 1. What should be taken care(Best Practices). 2. Data migration can be db_hotbackup will work? 3. Can same flat file method be used, if not what could be the way should work out. 4. any thing else i should be aware and is critical. -- Thanks&Regards Anil Beniwal

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical