openldap-technical

openldap-technical@openldap.org

24 participants
9804 discussions

ACL for nssov-overlay
by Uwe Werler 24 May '12

24 May '12

Hello list, does someone know how I can define an ACL for the socket used by the nssov-overlay? I tried by socket.url="/var/run/nslcd/socket" read but it won't work. Any suggestions? Thanks in advance! Regards Uwe

2 1

slapd hangs upon performing modification of cn=config
by Patrick Hemmer 24 May '12

24 May '12

I have a database which was working fine, but now whenever I go to perform any sort of modification on the database, the modification just hangs. No error, no timeout, just sits there. However while that first modification is hung, I can perform modifications of another database (other than cn=config) and they work just fine. I can even do further searches against cn=config while the modification is still hung. Also when I run slapd in the foreground, and then send it a SIGINT, it says "slapd shutdown: waiting for X operations/tasks to finish" and never ends. I end up having to SIGKILL it. The database is part of a MMR group of servers I was building, but I shut down all the other servers to troubleshoot the issue (it makes no difference whether the other servers are up or down, and they all exhibit the same problem). Where should I start looking to figure out whats going on (the specific operation/task thats hanging)? I can run slapd in debug mode with '-1', but theres a ton of info, and I dont know whats relevant, or which debug mode I should use other than '-1'. Thanks -Patrick

3 7

Anonymous bind allowed when configured not to.
by Kyle Smith 24 May '12

24 May '12

Good Morning, I was recently made aware of a problem with my OpenLDAP 2.4.26 and 2.4.28 servers. I have configured each server to disallow anony using the below directive. ### Disable anony disallow bind_anon This works great for Softerra Ldap Administrator, and the ldapsearch command (linux). $ ldapsearch -x -H ldaps://openldap.example.com -b "ou=peoples,dc=example,dc=com" "(uid=someuser)" ldap_bind: Inappropriate authentication (48) additional info: anonymous bind disallowed However, when I use Jxplorer (http://jxplorer.org/) it not only allows the bind, but allows the search. Right now the ACL is set for "by anonymous read", but shouldn't the disallow directive even prevent the connection? I'm working on getting some debug logs, but if any one has experienced this, please let me know. Thanks. Kyle Smith

2 2

Re: size of bdb database, master vs replica
by Quanah Gibson-Mount 24 May '12

24 May '12

--On Tuesday, May 22, 2012 10:06 AM +0200 Jehan Procaccia <jehan.procaccia(a)tem-tsp.eu> wrote: > Le 21/05/2012 18:33, Quanah Gibson-Mount a écrit : > > --On Monday, May 21, 2012 3:15 PM +0200 jehan procaccia > <jehan.procaccia(a)it-sudparis.eu> wrote: > > > ok __dd.xxx files are memory mapped files, > then which is the file(s) that contains the database ? I suspect > id2entry.bdb, but why on the master the size in KB is: > 195412 id2entry.bdb > and on the slave > 32 id2entry.bdb > > > It doesn't look to me like your replica is replicating at all. Have you > done a slapcat of the two and verified they are identical? > > --Quanah > > > > Ok, then I did a slapcat on a replica and to my big surprise, before I > did the slapcat, bdb files on the replica were very small, then as soon > as I did the slapcat (while slapd is off), now they are similar in size > to the master !? > Do we need to run regularly slapcat on replicas in order to "really" > replicate ? > No. It sounds like you don't have a checkpoint directive set for your database. You should fix that. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

dn.exact vs dn.base
by Nick Milas 24 May '12

24 May '12

I was wondering whether there is any difference between dn.exact and dn.base constructs. For example, theoretically (according to the documentation) we can use either: access to dn.base="ou=system,dc=example,dc=com" by dn.exact="uid=userx,ou=people,dc=example,dc=com" write or: access to dn.exact="ou=system,dc=example,dc=com" by dn.base="uid=userx,ou=people,dc=example,dc=com" write It seems to me that the two forms are interchangeable (as used, e.g. here: http://www.openldap.org/faq/data/cache/1140.html) Can you please clarify? Thanks, Nick

3 2

Problem with localhost unauthenticated bind
by Tim Watts 24 May '12

24 May '12

Hi, I'm having a problem with a new LDAP server (slapd 2.4.23-7.2) I'd like to have root@localhost be able to perform "manage" operations on the slapd on the localhost *only* - all other ACLs would be pretty standard. The machine itself is considered secure. Ideally, I'd like to do this with a mode(600) Unix Domain Socket owned by root. How do you enable an "manage" ACL for the entire DN if and only if the access comes via the unix socket? ================ On an aside - I've tried unauthenticated localhost access - but cannot get that to work. This would be less desirable as anyone with ssh access to the server would be abloe to bypass security - but I'm still curious to know what I did wrong. My slapd.d entries are: cat /etc/ldap/slapd.d/cn\=config.ldif ======================================================================= dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: none olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: 62952116-3777-1031-8e1b-bfeeb6e70114 creatorsName: cn=config createTimestamp: 20120521095922Z entryCSN: 20120521095922.839791Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20120521095922Z olcAllows: bind_anon_cred bind_anon_dn update_anon ### <<< Added this ======================================================================= cat /etc/ldap/slapd.d/cn\=config/olcDatabase\=\{1\}hdb.ldif ======================================================================= dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=cch,dc=kcl,dc=ac,dc=uk olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=cch,dc=kcl,dc=ac,dc=uk" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by peername.regex=127\.0\.0\.1 manage ###<<< Added olcAccess: {3}to * by self write by dn="cn=admin,dc=cch,dc=kcl,dc=ac,dc=uk" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=cch,dc=kcl,dc=ac,dc=uk olcRootPW:: e1NTSEF9TVFtdlA4Q2FJUjZqOEdpMytlcWd5Zk1BUWFjVmpGM1c= olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq structuralObjectClass: olcHdbConfig entryUUID: 62964ee2-3777-1031-8e25-bfeeb6e70114 creatorsName: cn=admin,cn=config createTimestamp: 20120521095922Z entryCSN: 20120521095922.847576Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20120521095922Z ======================================================================= Sorry this is a bit of a numpty question - I'm learning slapd - in a hurry(!) Many thanks in advance :) Tim -- Tim Watts Personal Email Personal website and blog: http://www.dionic.net/tim/

2 3

Issue upgrading openldap-clients from 2.4.19-15 to 2.4.23-20
by Esther Garcia 24 May '12

24 May '12

Hi all, We have an OpenLDAP server (RHEL6) running version 2.4.23-15, and we have clients in RHEL5 and RHEL6. With clients in RHEL5 works properly but I found some problems with RHEL6 clients in versions newer than 2.4.19-15. In the clients, if I try to upgrade to new versions than 2.4.19-15 then the client stops working: [root@XX ~]# rpm -qa | grep openldap openldap-2.4.19-15.el6.x86_64 openldap-clients-2.4.19-15.el6.x86_64 [root@XX ~]# ldapsearch -x -D 'cn=authenticate, ou=System,dc=test, dc=es' '(objectclass=*)' -W -ZZ Enter LDAP Password: # extended LDIF # # LDAPv3 ...... [root@XX ~]# id esther uid=63004(esther) gid=50041(test) groups=50041(test) [root@XX ~]# yum upgrade openldap* ..... Updating : openldap-2.4.23-20.el6.x86_64 1/4 warning: /etc/openldap/ldap.conf created as /etc/openldap/ldap.conf.rpmnew Updating : openldap-clients-2.4.23-20.el6.x86_64 2/4 Cleanup : openldap-clients-2.4.19-15.el6.x86_64 3/4 Cleanup : openldap-2.4.19-15.el6.x86_64 4/4 Updated: openldap.x86_64 0:2.4.23-20.el6 openldap-clients.x86_64 0:2.4.23-20.el6 Complete! [root@XX ~]# service nslcd restart Stopping nslcd: [ OK ] Starting nslcd: [ OK ] [root@XX ~]# id esther id: esther: No such user [root@XX ~]# ldapsearch -x -D 'cn=authenticate, ou=System,dc=test, dc=es' '(objectclass=*)' -W -ZZ ldap_start_tls: Connect error (-11) I have the same configuration files that used with the older version. I use these configuration files: */etc/pam_ldap.conf:* base dc=test,dc=es binddn cn=authenticate,ou=System,dc=test,dc=es bindpw XXXX timelimit 120 bind_timelimit 120 idle_timelimit 3600 pam_lookup_policy yes pam_password exop nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm ssl start_tls uri ldap://ldap1-test ldap://ldap2-test tls_cacertdir /etc/openldap/cacerts pam_password md5 */etc/nslcd.conf* uid nslcd gid ldap uri ldap://ldap1-test ldap://ldap2-test base dc=test,dc=es binddn cn=authenticate,ou=System,dc=test,dc=es bindpw XXXX ssl start_tls tls_cacertdir /etc/openldap/cacerts timelimit 120 bind_timelimit 120 idle_timelimit 3600 */etc/openldap/ldap.conf:* URI ldap://ldap1-test/ ldap://ldap2-test/ BASE dc=test,dc=es TLS_CACERT /etc/openldap/cacerts/catest.crt *CAcert file:* [root@XX ~]# ls -l /etc/openldap/cacerts/catest.crt -rw-r--r--. 1 root root 1655 May 23 15:23 /etc/openldap/cacerts/catest.crt Any idea on what the issue is? Am I missing anything? Thanks in advance, Esther

2 3

Re: dn.exact vs dn.base
by Turbo Fredriksson 24 May '12

24 May '12

[sorry, should have gone to the list] On Thu, 24 May 2012 14:02:28 +0300, Nick Milas wrote: > access to dn.base="ou=system,dc=example,dc=com" > by dn.exact="uid=userx,ou=people,dc=example,dc=com" write This gives 'uid=userx,...' access to 'ou=system,...' _and everything below it_. > access to dn.exact="ou=system,dc=example,dc=com" > by dn.base="uid=userx,ou=people,dc=example,dc=com" write While this is the opposite - it gives 'uid=userx,...' and any objects below this (not much point in this exact example :) to ONLY the base object 'ou=system,...'. For example: ----- s n i p ----- access to dn.exact="" attrs=supportedSASLMechanisms,namingContexts,subschemaSubentry,objectClass,monitorContext,configContext,entry by domain.subtree="bayour.com" read by peername.ip="127\.0\.0\.1" read by peername.ip="192\.168\.69\.8" read by peername.path="/var/run/slapd/ldapi" read ----- s n i p ----- This gives almost anonymous access to certain attributes to the base DN...

2 1

Re: Migrating from slapd 2.3 to 2.4
by Bobby Krupczak 23 May '12

23 May '12

Hi! > This is an old can of worms, Bobby. > Basically, Quanah & the OpenLDAP developers are not interested in > supporting old versions, because it takes away from the time they have > to work on the current version. We as users should support this, > because the software will stop growing if the devs spend too much time > on older versions. I understand completely. I write software myself and only admin my network enough to support my software development. I have a small number of users but a large number of machines hence why I use ldaps. I dont want to support years old releases of my own software. However, I dont radically change my config file formats either :) > I've followed this policy for the decade or so that I've been using > OpenLDAP and been very successful. I am running a large infrastructure > of Red Hat OL builds right now - dozens of replicas, with no problems > whatsoever. Thanks!! I'm going to tackle the conversion after I get this new system in place. Bobby

5 11

Re: checking replica dbs for consistency
by Nick Milas 23 May '12

23 May '12

On 23/5/2012 5:51 μμ, Charles T. Brooks wrote: > > <Mail content is a bit scrambled (text with spaces between chars), but I managed to read !!> > Charles, Thank you for your thoughts. I agree with you. There can/should be a number of consumers fully replicating the DIT so that they can be promoted to masters whenever needed. However, we do have and want some consumers with limited data replication. For example, our mail server runs a consumer replicating only the user accounts needed and only the ldap-hosted aliases. I don't want to replicate more ldap data there, there is no need to expose more data there and to load the server with unneeded replication operations. We are replicating on the mail server so that we can do *local* ldap lookups and achieve better mail server performance. Additionally, our DNS masters, replicate only the DNS resource records (also ldap-hosted). They don't need any info about users and aliases. We are also replicating there so that we can do local ldap lookups and achieve better DNS server performance. But I want to be able to check whether all partially replicated data are replicating as they should! One solution would be to define some non-root DN which *will be able to* replicate the whole DIT and use it in consumer configuration, then limit replication *using filters*. But this limits options and affects DIT architecture in the first place (not necessarily bad, but we would need to re-evaluate some things and it's not easy when in production). Thank you again for your time and thoughts, Nick

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical