openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Re: Global modifications
by Nick Milas 07 Feb '12

07 Feb '12

On 31/1/2012 9:52 μμ, Charles T. Brooks wrote: > T > Hi Charles, (Note that your last message was strangely encoded and I had some trouble reading it.) Thanks for all this info. I noticed that most (if not all) of the sendmail.schema definitions are actually included in the misc.schema bundled in openldap package. I guess I could use: inetLocalMailRecipient objectClass (attribute: mailLocalAddress); the only thing that disturbs me is that mailLocalAddress does not have a substring match rule (contrary to mail attribute) and I am afraid this might cause issues under particular scenarios... Best regards, Nick.

1 0

Help on ACL
by Hanns Mattes 06 Feb '12

06 Feb '12

Dear list-members, I want to grant write access to users to a kind of personal addressbook. User-DNs are for example: uid=user(a)example.com,ou=example.com,ou=virtualmail,dc=my,dc=company The personal Addressbook is stored under ou=user(a)example.com,ou=addressbook,dc=my,dc=company and an entry in the addressbook looks: uid=someuniqeid@mail.my.company,ou=user@example.com,dc=addressbook,dc=my,dc=company so far I didn't have success with constructing an ACL, which grants write access. I've tried modifying the example found in http://www.horde.org/apps/turba/docs/LDAP (in fact that's the application, which the addressbook is for), but no success so far (but a lot of "no such object"-entries in the log). Any help appreciated Regards Hanns

2 2

LDAP authentication fails
by Abhinav Jauhri 06 Feb '12

06 Feb '12

Hi, I have two client machines(CLIENT1 & CLIENT2) on which users are authenticated using a LDAP_SERVER. They also have autofs to mount the home directory at login. The issue is that on CLIENT1 authentication and mount works fine, but not on CLIENT2. Although, both have the same configuration files. Errors on CLIENT2: *Case 1:* When PasswordAuthentication is set to No in sshd_config ssh user(a)client2.isl.com <user(a)client1.isl.com> Permission denied (publickey). *Case 2*: When PasswordAuthentication is commented in sshd_config ssh user(a)client2.com <user(a)client1.com> user(a)clent2.isl.com <user(a)clent1.isl.com>'s password: Linux client2.isl.com <http://client1.isl.com> 2.6.31-14-generic #48-Ubuntu SMP Fri Oct 16 14:05:01 UTC 2009 x86_64 Creating directory '/home/user'. Unable to create and initialize directory '/home/user'. Configurations files on CLIENT2: 1) /etc/pam.d/sshd auth required pam_env.so # [1] auth required pam_env.so envfile=/etc/default/locale @include common-auth account required pam_nologin.so @include common-account @include common-session session optional pam_motd.so # [1] session optional pam_mail.so standard noenv # [1] session required pam_limits.so session required pam_mkhomedir.so skel=/etc/skel/ umask=0022 @include common-password 2) /etc/ldap.conf base dc=auth,dc=ldap_server,dc=isl,dc=com uri ldaps://192.169.214.54 ldap_version 3 rootbinddn cn=admin,dc=ldap_server,dc=isl,dc=com pam_password md5 ssl start_tls ssl on tls_checkpeer yes tls_cacertfile /etc/ssl/certs/ldap_server.isl.com.pem 3) /etc/nsswitch.conf passwd: compat ldap group: compat ldap shadow: compat ldap hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis 4) /etc/ssh/sshd_config Port 22 Protocol 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key UsePrivilegeSeparation yes KeyRegenerationInterval 3600 ServerKeyBits 768 SyslogFacility AUTH LogLevel INFO LoginGraceTime 120 PermitRootLogin yes StrictModes yes RSAAuthentication yes PubkeyAuthentication yes #AuthorizedKeysFile %h/.ssh/authorized_keys IgnoreRhosts yes RhostsRSAAuthentication no HostbasedAuthentication no PermitEmptyPasswords no ChallengeResponseAuthentication no #PasswordAuthentication no X11Forwarding yes X11DisplayOffset 10 PrintMotd no PrintLastLog yes TCPKeepAlive yes AcceptEnv LANG LC_* Subsystem sftp /usr/lib/openssh/sftp-server UsePAM yes 5) /etc/auto.home * 192.169.214.54:/home/& 6) /etc/auto.master +auto.master /home /etc/auto.home Also, there exist no local user by the same name in any of the client machines. The public keys are correctly inserted in the //LDAP_SERVER/home/user/.ssh/authorized_keys or else login wouldn't have been possible on CLIENT1. `getent passwd` on CLIENT2 shows all LDAP users. Any suggestions would be of great help. Thanks! -- Abhinav

1 0

Search on whole tree gives result, search on subtree not
by Karsten Heymann 06 Feb '12

06 Feb '12

Hi, I've started playing around with slapd (2.4.23-7.2 from debian squeeze) again and stumbled across a very strange phenomenon: When searching the whole tree for an entry it is found immediately: 0|kheymann@ds1-01:~$ ldapsearch -x -h localhost -b o=mycompany uid=aaa uid # extended LDIF # # LDAPv3 # base <o=mycompany> with scope subtree # filter: uid=aaa # requesting: uid # # aaa, 2, customers, marketing, mycompany dn: uid=aaa,contractID=2,ou=customers,ou=marketing,o=mycompany uid: aaa # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 But when searching any of the intermediate subtrees, no result is returned after a short delay: 0|kheymann@ds1-01:~$ ldapsearch -x -h localhost -b ou=marketing,o=mycompany uid=aaa uid # extended LDIF # # LDAPv3 # base <ou=tc,o=mycompany> with scope subtree # filter: uid=aaa # requesting: uid # # search result search: 2 result: 0 Success # numResponses: 1 The uid attribute is indexed with 0|root@ds1-01:/etc/ldap/slapd.d/cn=config# grep -e ' uid ' *ldif olcDatabase={1}hdb.ldif:olcDbIndex: uid eq and slapindex generated the index without any error messages. This also seems to happen only with entries created while the slapd is running while the entries from the initial import do not whoe this. This seems very weird to me. Any hints what could cause this behaviour and what could possibly fix it? Thanks in advance, Karsten

3 4

Does openldap support multicore CPU.
by arun.sasi1＠wipro.com 06 Feb '12

06 Feb '12

Hello Team, I have a small question... does OpenLDAP support multi core CPU... Thanks & Regards, Arun Sasi V ------------------------------------------------------------------------ ------------------------------------------------------------- Sr. Engineer - Server Management (UNIX), Wipro Infotech (GSMC) |Direct +918213029356 Mob: +919731031500 | E: arun.sasi1(a)wipro.com <mailto:koresh.dash@wipro.com> Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

3 4

Using NSS
by Braden McDaniel 05 Feb '12

05 Feb '12

I am trying to get OpenLDAP (2.4.24) working with NSS on Fedora 15. In cn=config.ldif I have: olcTLSCACertificatePath: /etc/pki/nssdb olcTLSCertificateFile: endoframe I have used certutil to create a self-signed certificate: # certutil -d /etc/pki/nssdb -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI endoframe Cu,Cu,Cu But this doesn't appear to be working: $ ldapsearch -H ldaps://rail -b dc=endoframe,dc=net -x -d1 ldap_url_parse_ext(ldaps://rail) ldap_create ldap_url_parse_ext(ldaps://rail:636/??base) ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP rail:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying ::1 636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_close_socket: 3 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_close_socket: 3 ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) slapd is running: # systemctl status slapd.service slapd.service - LSB: starts and stopd OpenLDAP server daemon Loaded: loaded (/etc/rc.d/init.d/slapd) Active: active (running) since Wed, 05 Oct 2011 02:24:11 -0400; 3 weeks and 0 days ago Main PID: 1429 (slapd) CGroup: name=systemd:/system/slapd.service └ 1429 /usr/sbin/slapd -h ldap:/// -u ldap Any ideas of what I might be doing wrong, or where I should be looking to debug this? -- Braden McDaniel <braden(a)endoframe.com>

8 19

How do I reset rootdn password?
by Daniel Savard 05 Feb '12

05 Feb '12

I would like to know how to reset the rootpw in OpenLDAP 2.4? Do I need to recreate over the entire configuration database and the database itself or there is a trick? -- Daniel Savard

7 11

Accursed LDAP+SSL Breakage When Using libgcrypt
by Ken Stailey 05 Feb '12

05 Feb '12

Hi, I abandoned any efforts to get anyone to hack the broken libgcrypt11 so that it would stop dropping setuid permissions. This was motivated largely by the fact that upstream GnuTLS started releasing versions that were intended to stop using libcrypt as the crypto back-end along with support for multiple crypto back-ends. The preferred crypto library for GnuTLS is nettle now. This change requires a minimum of GnuTLS 2.11.x and Ubuntu 12.04 is using GnuTLS 2.12.x. There were miscellaneous announcements made about this change: Andreas Metzler http://lists.debian.org/debian-legal/2011/02/msg00006.html {{ GnuTLS upstream has added support for different crypto backends in 2.11.x and has chosen nettle as prefered [sic] backend (2.10.x is using libgcrypt). }} It works for me, when I configure GnuTLS on Ubuntu 12.04 to use nettle the painful regression goes away and I can use setuid binaries from an LDAP account configured to access an LDAP server via SSL. To test on Ubuntu 12.04 or Debian Testing or Unstable simply: apt-get build-dep libgnutls26 apt-get source gnutls26 to fetch the source for gnutls26-2.12.14 (or 2.12.16-1 on Debian) then chop out --with-libgcrypt from the debian/rules file and rebuild gnutls26 debuild -i -uc -us -b and install the resulting .deb files. Much to my chagrin, upstream Debian still configures GnuTLS to use the horribly defective and rejected-by-upstream libgcrypt11 instead of the preferred-by-upstream nettle despite both Debian Testing and Debian Unstable having GnuTLS 2.12.16-1 $ grep with-libgcrypt sid/gnutls26-2.12.16/debian/rules --cache-file=$(CURDIR)/config.cache --with-libgcrypt \ So I opened two bug reports: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=658739 https://bugs.launchpad.net/bugs/926350 Hope that helps.

1 0

2.4.28 cn=config replication trouble
by Aaron Bennett 03 Feb '12

03 Feb '12

Hello, I've got two 2.4.28 boxes and I'm trying to get two-way multimaster replication set up - first for cn=config, and then for the entire tree. I can attach more of config.ldif if needed, but here are what I think are the relevant snippets: First thing that leaps out is, of course, the certificate is for ds.clarku.edu and the hosts are called animal.clarku.edu and zoot.clarku.edu; that's needed because I intend to round-robin those two hosts. I have TLS_REQCERT never in ldap.conf on each machine and I can do a successful "ldapsearch -H ldaps://animal.clarku.edu -x -D "cn=config" -W -b cn=config" from each machine to the other. dn: cn=config objectClass: olcGlobal cn: config olcAllows: bind_v2 olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 25 olcConfigDir: /etc/openldap/ldap/slapd.d olcConfigFile: /etc/openldap/slapd.conf olcConnMaxPending: 400 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexIntLen: 4 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcLocalSSF: 71 olcLogLevel: stats sync olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcServerID: 1 ldaps://animal.clarku.edu olcServerID: 2 ldaps://zoot.clarku.edu olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 25 olcTLSCACertificatePath: /etc/openldap/nssdb olcTLSCertificateFile: ds.clarku.edu olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcMirrorMode: TRUE olcMonitoring: FALSE olcReadOnly: FALSE olcRootDN: cn=config olcRootPW: {SSHA}<PASSWORD> olcSyncrepl: {0}rid=001 provider=ldaps://animal.clarku.edu binddn="cn=config " bindmethod="simple" credentials="<PASSWORD>" searchbase="cn=config" type= refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldaps://zoot.clarku.edu binddn="cn=config" bindmethod="simple" credentials="<PASSWORD>" searchbase="cn=config" type=r efreshAndPersist retry="5 5 300 5" timeout=1 Here's the -d1 output: 4f2ae081 do_syncrepl: rid=001 rc -1 retrying (4 retries left) 4f2ae081 slap_listener_activate(9): 4f2ae081 >>> slap_listener(ldaps:///) 4f2ae081 connection_get(15): got connid=1000 4f2ae081 connection_read(15): checking for input on id=1000 TLS: using moznss security dir /etc/openldap/nssdb prefix . TLS: certificate [CN=ds.clarku.edu,OU=ITS,O=Clark University,L=Worcester,ST=Massachusetts,C=US,serialNumber=HUpyuTQIxJ8ShXHOBGZo7j-BC9l4ykNA] is valid 4f2ae081 connection_get(15): got connid=1000 4f2ae081 connection_read(15): checking for input on id=1000 TLS certificate verification: subject: no certificate, issuer: no certificate, cipher: AES-256, security level: high, secret key bits: 256, total key bits: 256, cache hits: 0, cache misses: 1, cache not reusable: 0 4f2ae081 connection_read(15): unable to get TLS client DN, error=49 id=1000 4f2ae081 connection_get(15): got connid=1000 4f2ae081 connection_read(15): checking for input on id=1000 ber_get_next 4f2ae081 ber_get_next on fd 15 failed errno=0 (Success) 4f2ae081 connection_close: conn=1000 sd=15 4f2ae086 =>do_syncrepl rid=001 ldap_create ldap_url_parse_ext(ldaps://animal.clarku.edu) ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP animal.clarku.edu:636 4f2ae086 slap_listener_activate(9): 4f2ae086 >>> slap_listener(ldaps:///) 4f2ae086 connection_get(18): got connid=1001 4f2ae086 connection_read(18): checking for input on id=1001 ldap_new_socket: 15 ldap_prepare_socket: 15 ldap_connect_to_host: Trying 140.232.1.12:636 ldap_pvt_connect: fd: 15 tm: -1 async: 0 4f2ae086 connection_get(18): got connid=1001 4f2ae086 connection_read(18): checking for input on id=1001 TLS certificate verification: subject: no certificate, issuer: no certificate, cipher: AES-256, security level: high, secret key bits: 256, total key bits: 256, cache hits: 0, cache misses: 2, cache not reusable: 0 4f2ae086 connection_read(18): unable to get TLS client DN, error=49 id=1001 4f2ae086 connection_get(18): got connid=1001 4f2ae086 connection_read(18): checking for input on id=1001 ber_get_next ber_get_next: tag 0x30 len 31 contents: 4f2ae086 op tag 0x60, time 1328210054 ber_get_next 4f2ae086 conn=1001 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: 4f2ae086 >>> dnPrettyNormal: <cn=config> 4f2ae086 <<< dnPrettyNormal: <cn=config>, <cn=config> 4f2ae086 do_bind: version=3 dn="cn=config" method=128 4f2ae086 do_bind: v3 bind: "cn=config" to "cn=config" 4f2ae086 send_ldap_result: conn=1001 op=0 p=3 4f2ae086 send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 18 4f2ae086 connection_get(18): got connid=1001 4f2ae086 connection_read(18): checking for input on id=1001 ber_get_next ber_get_next: tag 0x30 len 185 contents: 4f2ae086 op tag 0x63, time 1328210054 ber_get_next 4f2ae086 conn=1001 op=1 do_search ber_scanf fmt ({miiiib) ber: 4f2ae086 >>> dnPrettyNormal: <cn=config> 4f2ae086 <<< dnPrettyNormal: <cn=config>, <cn=config> ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: 4f2ae086 => get_ctrls ber_scanf fmt ({m) ber: ber_scanf fmt (m) ber: 4f2ae086 => get_ctrls: oid="1.3.6.1.4.1.4203.1.9.1.1" (noncritical) ber_scanf fmt ({i) ber: ber_scanf fmt (m) ber: ber_scanf fmt (b) ber: ber_scanf fmt (}) ber: ber_scanf fmt ({m) ber: ber_scanf fmt (b) ber: 4f2ae086 => get_ctrls: oid="2.16.840.1.113730.3.4.2" (critical) 4f2ae086 <= get_ctrls: n=2 rc=0 err="" 4f2ae086 send_ldap_result: conn=1001 op=1 p=3 4f2ae086 send_ldap_result: conn=1001 op=1 p=3 4f2ae086 send_ldap_intermediate: err=0 oid=1.3.6.1.4.1.4203.1.9.1.4 len=2 4f2ae086 send_ldap_response: msgid=2 tag=121 err=0 ber_flush2: 37 bytes to sd 18 TLS: certificate [CN=ds.clarku.edu,OU=ITS,O=Clark University,L=Worcester,ST=Massachusetts,C=US,serialNumber=HUpyuTQIxJ8ShXHOBGZo7j-BC9l4ykNA] is valid TLS certificate verification: subject: CN=ds.clarku.edu,OU=ITS,O=Clark University,L=Worcester,ST=Massachusetts,C=US,serialNumber=HUpyuTQIxJ8ShXHOBGZo7j-BC9l4ykNA, issuer: CN=GeoTrust SSL CA,O="GeoTrust, Inc.",C=US, cipher: AES-256, security level: high, secret key bits: 256, total key bits: 256, cache hits: 0, cache misses: 2, cache not reusable: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({i) ber: ber_flush2: 33 bytes to sd 15 ldap_result ld 0x7f59cc100910 msgid 1 wait4msg ld 0x7f59cc100910 msgid 1 (timeout 1000000 usec) wait4msg continue ld 0x7f59cc100910 msgid 1 all 1 ** ld 0x7f59cc100910 Connections: * host: animal.clarku.edu port: 636 (default) refcnt: 2 status: Connected last used: Thu Feb 2 14:14:14 2012 ** ld 0x7f59cc100910 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x7f59cc100910 request count 1 (abandoned 0) ** ld 0x7f59cc100910 Response Queue: Empty ld 0x7f59cc100910 response count 0 ldap_chkResponseList ld 0x7f59cc100910 msgid 1 all 1 ldap_chkResponseList returns ld 0x7f59cc100910 NULL ldap_int_select read1msg: ld 0x7f59cc100910 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 0x7f59cc100910 msgid 1 message type bind ber_scanf fmt ({eAA) ber: read1msg: ld 0x7f59cc100910 0 new referrals read1msg: mark request completed, ld 0x7f59cc100910 msgid 1 request done: ld 0x7f59cc100910 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_search_ext put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 188 bytes to sd 15 4f2ae086 =>do_syncrep2 rid=001 ldap_result ld 0x7f59cc100910 msgid 2 wait4msg ld 0x7f59cc100910 msgid 2 (timeout 1000000 usec) wait4msg continue ld 0x7f59cc100910 msgid 2 all 0 ** ld 0x7f59cc100910 Connections: * host: animal.clarku.edu port: 636 (default) refcnt: 2 status: Connected last used: Thu Feb 2 14:14:14 2012 ** ld 0x7f59cc100910 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x7f59cc100910 request count 1 (abandoned 0) ** ld 0x7f59cc100910 Response Queue: Empty ld 0x7f59cc100910 response count 0 ldap_chkResponseList ld 0x7f59cc100910 msgid 2 all 0 ldap_chkResponseList returns ld 0x7f59cc100910 NULL ldap_int_select read1msg: ld 0x7f59cc100910 msgid 2 all 0 ber_get_next ber_get_next: tag 0x30 len 35 contents: read1msg: ld 0x7f59cc100910 msgid 2 message type intermediate ldap_parse_intermediate ber_scanf fmt ({) ber: ber_scanf fmt (a) ber: ber_scanf fmt (O) ber: ber_scanf fmt (t{) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_result ld 0x7f59cc100910 msgid 2 wait4msg ld 0x7f59cc100910 msgid 2 (timeout 0 usec) wait4msg continue ld 0x7f59cc100910 msgid 2 all 0 ** ld 0x7f59cc100910 Connections: * host: animal.clarku.edu port: 636 (default) refcnt: 2 status: Connected last used: Thu Feb 2 14:14:14 2012 ** ld 0x7f59cc100910 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x7f59cc100910 request count 1 (abandoned 0) ** ld 0x7f59cc100910 Response Queue: Empty ld 0x7f59cc100910 response count 0 ldap_chkResponseList ld 0x7f59cc100910 msgid 2 all 0 ldap_chkResponseList returns ld 0x7f59cc100910 NULL ldap_int_select 4f2ae08a connection_get(15): got connid=0 4f2ae08a =>do_syncrepl rid=001 4f2ae08a =>do_syncrep2 rid=001 ldap_result ld 0x7f59cc100910 msgid 2 wait4msg ld 0x7f59cc100910 msgid 2 (timeout 0 usec) wait4msg continue ld 0x7f59cc100910 msgid 2 all 0 ** ld 0x7f59cc100910 Connections: * host: animal.clarku.edu port: 636 (default) refcnt: 2 status: Connected last used: Thu Feb 2 14:14:14 2012 ** ld 0x7f59cc100910 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x7f59cc100910 request count 1 (abandoned 0) ** ld 0x7f59cc100910 Response Queue: Empty ld 0x7f59cc100910 response count 0 ldap_chkResponseList ld 0x7f59cc100910 msgid 2 all 0 ldap_chkResponseList returns ld 0x7f59cc100910 NULL ldap_int_select read1msg: ld 0x7f59cc100910 msgid 2 all 0 ber_get_next ldap_err2string 4f2ae08a do_syncrep2: rid=001 (-1) Can't contact LDAP server ldap_err2string 4f2ae08a connection_get(15): got connid=0 ldap_free_request (origid 2, msgid 2) ldap_free_connection 1 1 ldap_free_connection: actually freed Thanks for your time - any help is appreciated. - Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS

3 8

RE: Best Practices for configuration management with cn=config?
by Quanah Gibson-Mount 03 Feb '12

03 Feb '12

--On Friday, February 03, 2012 1:57 PM -0500 "Charles T. Brooks" <brooksct(a)hbcs.org> wrote: > Quanah, could you elaborate at little on this comment? > >> The cn=config method IS a database, not a set of flat text files. >> Modifications to the configuration are immediate with the exception of >> changes to olcSecurity. > > I'm just starting to convert a heavily replicated environment to > cn=config, and I (apparently stupidly) thought that slapd.d was a live > database. Is the cn=config database held by sleepycat then, mixed up > with my user and system data in /var/lib/ldap? Or is it in memory only? cn=config is indeed a live database, so thinking that is in no way stupid ;). My point was, that you cannot just go and edit the cn=config database with something like 'vi'. The correct method is to use something like ldapmodify, etc. > Also, the olcSecurity exception - why aren't changes to security also > immediate? Because it requires restarting slapd to take effect, due to the way in which it affects the connection handler. AFAIK, this is the only exception. Security changes to acls (such as SSF lines) are immediate. > I'll appreciate any insights you can share - I prefer slapd.conf > personally, but I want to proceed in the direction the code authors > favor, since they almost certainly have a clearer vision of what's > optimal for the future of the software than I do. > > Currently I make changes by shutting down slapd, deleting slapd.d, > rebuilding slapd.d from my slapd.conf with slaptest, and restarting > slapd. Works for me right now, but I hope to progress past it. That definitely is not the correct approach. You should just be using ldapmodify or similar to update the cn=config db. ;) --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical