openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Re: Help with Cyrus configuration - testsaslauthd not working
by Gabriella Turek 07 Nov '11

07 Nov '11

Hi Dan, Awesome I got it to work, but I have a couple of comments to add for future reference: 1) I was using quotes around the ldap_bind_dn, because it has blanks in it, but by looking at wireshark I realized that the string is also being quoted by saslauthd so I was ending up with double quotes and therefore an invalid DN 2) The ldap_filter has to read (distinguishedName=%u), there is no "dn" attribute in Active Directory. If that's not correct then authentication also fails, because - as it was pointed out in some other list I was reading - authentication is a two pass affair. First it binds the ldap_bind_dn user with which it does a search for the authenticating user. Then, the result of that search is used to bind the authenticating user. Since the DN is required for binding, the filter must return the distinguishedName in case of AD. On 8/11/11 12:11 PM, "Dan White" <dwhite(a)olp.net> wrote: >On 07/11/11 21:49 +0000, Gabriella Turek wrote: >>Hello, I am trying to set up Cyrus sasl so I can use it for pass-through >>authentication with OpenLDAP. The OS is SUSE sles11 and I thought I'd >>start with what is already there preinstalled (v.2.1.22) I am trying to >>authenticate against Active Directory 2008. >>My configuration file looks like: >> >>ldap_servers: ldap://hamwdc01.niwa.local/ >>ldap_search_base: DC=niwa=,DC=local > >You have a typo here, with an extra equals sign. > >>ldap_scope: sub >>ldap_sasl_mech: plain > >Since you're not using ldap_use_sasl: yes, you should remove >ldap_sasl_mech from your config. > >>ldap_auth_method: bind >>ldap_bind_dn: "CN=SDT Tester,OU=NIWA Staff Accounts,OU=User >>Accounts,DC=niwa,DC=local" >>ldap_password: mypassword >>ldap_filter: (dn=%u) >> >>When I try authenticate using testsaslauthd I get: >>>Authentication failed for some-user: Bind to ldap server failed (invalid >>>user/password or insufficient access) (-7) >> >>If I try a ldap_bind_dn of the form >>sdttester(a)niwa.local<mailto:sdttester@niwa.local> in the config file I >>get: >>Authentication failed for some-user: Retry condition (ldap server >>connection reset or broken) (-3) > >You should be using the DN, when using 'ldap_auth_method: bind'. > >>This is all very puzzling, as I can ldapsearch perfectly fine with any >>valid user I chose in either form (DN or userPrincipalName) >> >>Is it possible that this installation of cyrus has not been compiled with >>ldap support? I would expect a bit more feedback. > >You can verify saslauthd was compiled with LDAP support with 'saslauthd >-v'. You use it by specifying '-a ldap' as a command line option. > >Your saslauthd.conf file should typically go in /etc, but you can specify >an >alternate location with '-O <path/file>'. > >See saslauthd/LDAP_SASLAUTHD in the source for documentation. > >You can simulate the function of saslauthd (in bind mode) with: > >ldapsearch -x -H ldap://hamwdc01.niwa.local/ -D "CN=SDT Tester,OU=NIWA >Staff Accounts,OU=User Accounts,DC=niwa,DC=local" -w mypassword -b >"DC=niwa,DC=local" "(dn=testusername)" dn > >and then with the returned dn: > >ldapwhoami -x -H ldap://hamwdc01.niwa.local/ -D "$DN" -w <user_password> > >and if successful, ldapwhoami should return the DN again. If so, then your >saslauthd.conf config is probably correct. > >For further trouble shooting, you can add 'ldap_debug: -1' to your >saslauthd.conf, and start saslauthd in debug mode. > >After verifying testsaslauthd is working, make sure that your OpenLDAP >user >(-u option) has filesystem permissions to access the saslauthd mux. > >For OpenLDAP pass-through documentation, see "14.5. Pass-Through >authentication" of the OpenLDAP Administrator's Guide. > >-- >Dan White

1 0

LD_LIBRARY_PATH exported but libdb-4.6.so not found
by Pablo Chamorro C. 07 Nov '11

07 Nov '11

I updated from 2.4.21 to 2.4.23 in some old Fedoras and also in a CentOS 5.4. Before compiling, I run: export LD_LIBRARY_PATH=/usr/local/BerkeleyDB.4.6/lib export CPPFLAGS="-I/usr/local//BerkeleyDB.4.6/include" export LDFLAGS="-L/usr/local/BerkeleyDB.4.6/lib" and it compiles ok. But after installed, in 3 out 4 of the used servers, slapd doesn't start unless I execute first: export LD_LIBRARY_PATH=/usr/local/BerkeleyDB.4.6/lib Attached, the output of ldd /usr/local/libexec/slapd, before and after running export LD_LIBRARY_PATH=/usr/local/BerkeleyDB.4.6/lib. In short: without LD_LIBRARY_PATH defined: libdb-4.6.so => not found with LD_LIBRARY_PATH as above: libdb-4.6.so => /usr/local/BerkeleyDB.4.6/lib/libdb-4.6.so (0x00002b4eb2c16000) Could you please explain me why this might be happening? Is this a bug? This issue ocurred to me in at least 3 server, but I have another CentOS 5.4, where the compilation and the install process run just fine, and I didn't need that workaround. Thank you, Pablo Chamorro La informaci�n contenida en este mensaje y cualquiera de sus adjuntos es confidencial, para el uso exclusivo de la persona o entidad destinataria. Si usted ha recibido este mensaje por equivocaci�n, se le notifica que no est� autorizado para revisarlo, reenviarlo, imprimirlo, copiarlo o distribuirlo de forma parcial o total; por favor comunique el error a la persona que lo env�a y elim�nelo. Las opiniones y puntos de vista presentados en este mensaje son responsabilidad de quien firma el mensaje y no representan necesariamente la posici�n y puntos de vista de INGEOMINAS. Este mensaje de correo electr�nico ha sido analizado por el antivirus Mcafee. Confidentiality Notice The information in this message and any attachments is confidential, it is for exclusive use of the person or entity to which it is addressed. If you have received this message in error, you are notified that you are not authorized to review, re-transmit, print out, disseminate, copy or distribute it in partial or total way; please communicate the mistake to the person who sent this message and delete it. The opinions and points of view stated in this message with responsibility by who signed the message, do not necessarily represent the opinion or point of view of INGEOMINAS. This electronic mail message was scanned by the Mcafee anti-virus.

2 2

Error when creating realm in openldap from kerberos
by Ethan Koh 07 Nov '11

07 Nov '11

Hello I have been at this for a week now, and i would really appreciate any help. I'm setting up both kerberos and openldap on the same ubuntu VM for testing purposes. I was following the configuration for kerberos-ldap ( https://help.ubuntu.com/11.04/serverguide/C/kerberos-ldap.html) when I got this error: sudo kdb5_ldap_util -D cn=admin,dc=example,dc=com create -subtrees dc=example,dc=com -r EXAMPLE.COM -s -H ldap://ldap.example.com <......entered password for cn=admin and new KDC database.....> kdb5_ldap_util: Hostname cannot be canonicalized krb5_sname_to_principal, while adding entries to the database I think its something to do with the /etc/hosts file, but I'm not sure. Here are my configurations: ---------------------- kdc.conf ---------------------- [kdcdefaults] kdc_ports = 88 acl_file = /usr/local/var/krb5kdc/kadm5.acl admin_keytab = /usr/local/var/krb5kdc/kadm5.keytab dict_file = /usr/local/var/krb5kdc/kadm5.dict [realms] EXAMPLE.COM = { database_name = /usr/local/var/krb5kdc/principal admin_keytab = /usr/local/var/krb5kdc/kadm5.keytab acl_file = /usr/local/var/krb5kdc/kadm5.acl dict_file = /usr/local/var/krb5kdc/kadm5.dict key_stash_file = /usr/local/var/krb5kdc/.k5.EXAMPLE.COM kadmind_port = 749 max_life = 10h 0m 0s max_renewable_life = 7d 0h 0m 0s master_key_type = des3-hmac-sha1 supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal } ---------------------- kdc.conf ---------------------- [libdefaults] ticket_lifetime = 2400 default_realm = EXAMPLE.COM default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc [realms] EXAMPLE.COM = { kdc = kerberos.example.com:88 admin_server = kerberos.example.com:749 default_domain = example.com database_module = openldap_ldapconf } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM [dbdefaults] ldap_kerberos_container_dn = dc=example,dc=com [dbmodules] openldap_ldapconf = { db_library = kldap ldap_kdc_dn = "cn=admin,dc=example,dc=com" # this object needs to have read rights on # the realm container, principal container and realm sub-trees ldap_kadmind_dn = "cn=admin,dc=example,dc=com" # this object needs to have read and write rights on # the realm container, principal container and realm sub-trees ldap_service_password_file = /etc/krb5kdc/service.keyfile ldap_servers = ldaps://ldap.example.com ldap_conns_per_server = 5 } [logging] kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmin.log default = FILE:/var/log/krb5lib.log ---------------------- backend.example.com.ldif ---------------------- # Load dynamic backend modules dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib/ldap olcModuleload: back_hdb.la # Database settings dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcSuffix: dc=example,dc=com olcDbDirectory: /var/lib/ldap olcRootDN: cn=admin,dc=example,dc=com olcRootPW: {SSHA}0tWXk3nWCfFXeyv3cGF39KmW3Wukbgj8 olcDbConfig: set_cachesize 0 2097152 0 olcDbConfig: set_lk_max_objects 1500 olcDbConfig: set_lk_max_locks 1500 olcDbConfig: set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcLastMod: TRUE olcDbCheckpoint: 512 30 olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey by dn="cn=admin,dc=example,dc=com" write by anonymous auth by self write by * none olcAccess: to dn.base="" by * read olcAccess: to * by dn="cn=admin,dc=example,dc=com" write by * read ---------------------- frontend.example.com.ldif ---------------------- # Create top-level object in domain dn: dc=example,dc=com objectClass: top objectClass: dcObject objectclass: organization o: Example Organization dc: Example description: LDAP Example # Admin user. dn: cn=admin,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin1 description: LDAP administrator #userPassword: aa userPassword: {SSHA}0tWXk3nWCfFXeyv3cGF39KmW3Wukbgj8 dn: ou=people,dc=example,dc=com objectClass: organizationalUnit ou: people dn: ou=groups,dc=example,dc=com objectClass: organizationalUnit ou: groups dn: uid=john,ou=people,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: john sn: Doe givenName: John cn: John Doe displayName: John Doe uidNumber: 1000 gidNumber: 10000 userPassword: {SSHA}0tWXk3nWCfFXeyv3cGF39KmW3Wukbgj8 gecos: John Doe loginShell: /bin/bash homeDirectory: /home/john shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 8 shadowMax: 999999 shadowLastChange: 10877 mail: admin(a)example.com postalCode: 31000 l: Toulouse o: Example mobile: +33 (0)6 xx xx xx xx homePhone: +33 (0)5 xx xx xx xx title: System Administrator postalAddress: initials: JD dn: cn=example,ou=groups,dc=example,dc=com objectClass: posixGroup cn: example gidNumber: 10000 ---------------------- ldap.conf ---------------------- BASE dc=example,dc=com URI ldap://ldap.example.com ldapi://ldap.example.com ldaps:// ldap.example.com TLS_CACERT /etc/ssl/certs/cacert.pem SIZELIMIT 12 TIMELIMIT 15 DEREF never ---------------------- /etc/hosts ---------------------- 127.0.0.1 kerberos.example.com kerberos 127.0.0.1 ldap.example.com ldap 192.168.0.101 ubuntu # The following lines are desirable for IPv6 capable hosts ::1 localhost ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters ff02::3 ip6-allhosts

1 0

smbk5pwd not respecting olcSmbK5PwdEnable on 64-bit platforms
by David Adam 06 Nov '11

06 Nov '11

There are a few threads on the web [1][2] where people are running into problems with smbk5PwdEnable being set to 'samba' but the smbk5pwd module still insisting on loading all the Kerberos configuration regardless, which fails if you aren't actually using Kerberos at all. We have also been experiencing this but I have noticed (and confirmed by spinning up two brand-new Debian VMs) that it is only a problem on 64-bit machines; 32-bit architectures respect the attribute's value. I suspect this has something to do with the call to verbs_to_mask() in smbk5pwd_cf_func (under the case PC_SMB_ENABLE)[3] - my very basic printf() debugging shows that m is set correctly on 32-bit architectures but on 64-bit architectures returns a varying and strangely-numbered value (4511419, -1407332384, 353253328 in subsequent runs). The problem goes away if the m variable is initialised to 0 before the call to verbs_to_mask(). I wonder if verbs_to_mask() is possibly not 64-bit clean but my C foo is not strong enough to confirm or deny this. Any ideas? For the moment I'm simply using case PC_SMB_ENABLE: { - slap_mask_t mode = pi->mode, m; + slap_mask_t mode = pi->mode, m = 0; but I'm not sure if this could have unintended consequences. Thanks, David Adam zanchey(a)ucc.gu.uwa.edu.au [1]: http://www.openldap.org/lists/openldap-technical/201105/msg00136.html [2]: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631120 [3]: http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=contrib/sl…

2 1

Special characters in bindpw
by Alex Moen 05 Nov '11

05 Nov '11

Hi all, Say that my bindpw is d!ffs3r^ (it, of course, is not). What is the proper way to use this passwd in ldap.conf or nslcd.conf so that the special characters are not interpreted incorrectly? Thanks! Alex

2 2

ACL issue for unix authentication
by Olivier 04 Nov '11

04 Nov '11

I have a weired ACL issue using my ldap server for authentication. My plan was to use a "proxyuser" to forbid "anonymous" queries to the ldap directory, but it sounds like pam needs in all cases to perform anonymous retreivals before any other binding, even if the "rootbinddn" directive is correctly configured for pam in /etc/pam_ldap.conf. Where is my mistake ? (see below) I have configured this first olcAccess to allow password self changed : {0}to attrs=userPassword,shadowLastChange,loginShell by dn.base="cn=proxyuser,ou=system,dc=example,dc=fr" read by self write by anonymous auth by * none The issue comes with this second ACL. THIS DOESN'T WORK : If I configure this : {1}to * by dn.base="cn=proxyuser,ou=system,dc=example,dc=fr" read by users read by anonymous auth by * none I CAN'T log in ( ssh guillard@client ) weither or not I configure rootbinddn cn=proxyuser,ou=system,dc=example,dc=fr in /etc/pam_ldap.conf on the client side. I get a "Permission denied" and I see this in logs, on the client side : tail -f /var/log/secure Nov 4 16:33:21 ldap2 sshd[22730]: Invalid user guillard from 10.1.86.93 Nov 4 16:33:21 ldap2 sshd[22731]: input_userauth_request: invalid user guillard on the ldap server side I see this : tail -f /var/log/ldap.log | grep BIND returns NOTHING TO MAKE IT WORK : I must authorize anonymous to read everything to be able to log in, if I change the previous ACL for this one on the ldap server : {1}to * by dn.base="cn=proxyuser,ou=system,dc=example,dc=fr" read by users read by anonymous auth by * READ ^^^^^ Then I can log in properly weither or nor I add rootbinddn in /etc/pam_ldap.conf : rootbinddn cn=proxyuser,ou=system,dc=example,dc=fr If I configure rootbinddn cn=proxyuser,ou=system,dc=example,dc=fr in /etc/pam_ldap.conf, I have this on the client side tail -f /var/log/secure : Nov 4 16:43:15 ldap2 sshd[22813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=fouine.tech.prive.example.fr user=guillard Nov 4 16:43:15 ldap2 sshd[22813]: Accepted password for guillard from 10.1.x.x port 44953 ssh2 Nov 4 16:43:15 ldap2 sshd[22813]: pam_unix(sshd:session): session opened for user guillard by (uid=0) tail -f /var/log/ldap.log | grep BIND Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=1 BIND dn="cn=proxyuser,ou=system,dc=example,dc=fr" method=128 Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=1 BIND dn="cn=proxyuser,ou=system,dc=example,dc=fr" mech=SIMPLE ssf=0 Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=3 BIND anonymous mech=implicit ssf=0 Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=3 BIND dn="uid=guillard,ou=staff,ou=people,dc=example,dc=fr" method=128 Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=3 BIND dn="uid=guillard,ou=staff,ou=people,dc=example,dc=fr" mech=SIMPLE ssf=0 Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=4 BIND anonymous mech=implicit ssf=0 Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=4 BIND dn="cn=proxyuser,ou=system,dc=example,dc=fr" method=128 Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=4 BIND dn="cn=proxyuser,ou=system,dc=example,dc=fr" mech=SIMPLE ssf=0 Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=5 UNBIND If I don't configure rootbinddn I have the some logs on the client side tail -f /var/log/secure : Nov 4 16:49:47 ldap2 sshd[22863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=fouine.tech.prive.example.fr user=guillard Nov 4 16:49:47 ldap2 sshd[22863]: Accepted password for guillard from 10.1.x.x port 45639 ssh2 Nov 4 16:49:47 ldap2 sshd[22863]: pam_unix(sshd:session): session opened for user guillard by (uid=0) and this slighty different one on the server side : tail -f /var/log/ldap.log | grep BIND Nov 4 16:51:23 ldap1 slapd[11600]: conn=1622 op=1 BIND dn="" method=128 Nov 4 16:51:23 ldap1 slapd[11600]: conn=1622 op=3 BIND dn="uid=guillard,ou=staff,ou=people,dc=example,dc=fr" method=128 Nov 4 16:51:23 ldap1 slapd[11600]: conn=1622 op=3 BIND dn="uid=guillard,ou=staff,ou=people,dc=example,dc=fr" mech=SIMPLE ssf=0 Nov 4 16:51:23 ldap1 slapd[11600]: conn=1622 op=4 BIND anonymous mech=implicit ssf=0 Nov 4 16:51:23 ldap1 slapd[11600]: conn=1622 op=4 BIND dn="" method=128 Nov 4 16:51:23 ldap1 slapd[11600]: conn=1622 op=5 UNBIND >From what I see in my logs, I don't manage to do what I want, and BTW, I don't see neither any interest to use a proxyuser : Any idea ? --- Olivier

2 1

Per server cn=config parameter in multi-master mode
by Jens Thomas 03 Nov '11

03 Nov '11

Hi, i am playing around with a multi-master setup. The documentation suggests to start with replication of the cn=config database, so that all member server have the same configuration. To solve the problem of the unique server ID we list all member server with their ID and their URL, so that every server can determine his own server ID on the basis of his own URL. OK. But how i can handle all the individual parameter like olcThreads, olcTLS* and all the other parameter, that may differ from server to server? With kind regards Jens -- linux systeme thomas Jens Thomas Völklinger Straße 9 42285 Wuppertal Telefon: +49.202.3097507 Mobil: +49.177.9301386 eFax: +49.202.85064329 Web: http://linux-systeme-thomas.de USt-ID: DE250711901

1 0

delta-syncrepl based N-way MMR/Mirror mode replication
by Meike Stone 03 Nov '11

03 Nov '11

Hello, a second question I have. I read in the list, that OpenLDAP 2.4.27 will support delta-syncrepl based N-way MMR/Mirror mode replication setups. That would solve my problem with a small WAN line and the MM replication between my two LDAP-Servers. 1) Is it reliable enough, to configure this in a production setup? 2) Does it need more CPU and/or RAM than the full replication on the servers? Thanks Meike

2 1

Configuring shared memory / memory mapped files
by Meike Stone 03 Nov '11

03 Nov '11

Hello, time ago, we installed a Linux Guest with OpenLDAP (db size appox. 650MByte / ) server in a ESXi environment. Maybe because of a read/write ratio 100:1, the hard discs where heavy used by writing bdb backends memory mapped files. The CPU in that Linux system had iowait (top) between 80% and 100% and the other VMs on the ESXi went slow down. After changing to shared memory (shm_key), all problems with disc IO where gone. I read in the mailing list and on "OpenLDAP performance tuning" guide, that it does not matter if using memory mapped files or shared memory until the database is over 8GB. But why we had such problems? Please note, the OpenLDAP was operating very fast with the memory mapped files, because of using indexes and proper caching. Now, I want install more than one OpenLDAP server on one Linux system (now real Hardware). Every OpenLDAP server will be bind on a separate IP and DNS host name. So in this scenario it is hard to calculate the shared memory and assign each LDAP server to the right shared memory region (key). Therefore I want go back to memory mapped files. Are there any recommendation for sizing the Linux system like: - type of file system (ext3, ext4, xfs, ..) - parameters of file system (syncing -> commit=nrsec, data=*, ... ) - swap using (swappiness, dirty_background_ratio) - ??? Thanks for any help. Meike

5 10

OpenLDAP Replication configuration error!
by pradyumna dash 03 Nov '11

03 Nov '11

Hi, I am facing an issue with multi master replication in Redhat Enterprise linux 5.7 with Openldap 2.3.43-12.el5_6.7 When am trying to delete or create any user , in the log it says : "err=53 text=shadow context; no update referral." My Configuration file is attached, in the other node i have changed the ServerID and the refereal server IP. Please help me to fix this issue. Regards, Neo

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical