openldap-technical

openldap-technical@openldap.org

9 participants
9873 discussions

Re: open LDAP + TLS/SSL bind Failed.
by vijay s sheelavantar 19 Sep '11

19 Sep '11

Thank you very much Buchan. I have changed the certificate creation method. Now I created the certificates using CA.sh of openssl.I followed the instruction given in the below link to create the certificates. http://octaldream.com/~scottm/talks/ssl/opensslca.html 1. At the server side now i am able to do ldapsearch and ldapadd, as i have chenged the /usr/local/etc/openldap/ldap.conf on server to remove IP address. I have made necessary changes in /etc/hosts file also. BASE    dc=samsung,dc=comURI     ldaps://localhost.localdomain/TLS_CACERT      /etc/pki/CA/cacert.pemTLS_CACERTDIR   /etc/pki/CA/ 2.slapd.conf details for TLS are as follows TLSCipherSuite          HIGH:MEDIUM:+SSLv2:+SSLv3:RSATLSCACertificatePath    /etc/pki/CA/TLSCACertificateFile    /etc/pki/CA/cacert.pemTLSCertificateFile      /etc/pki/tls/misc/newcert.pemTLSCertificateKeyFile   /etc/pki/tls/misc/newkey.pemTLSVerifyClient         allow 3. I have copied the "cacert.pem" which is CA and "newcert.pem" which my server certificate to the client machine. I have copied these files to /etc/openldap/cacerts directory on client machine. and I have made the following configuration changes to "/etc/ldap.conf" file at the client side. base dc=samsung,dc=comuri ldaps://localhost.localdomain/tls_cacertfile  /etc/openldap/cacerts/cacert.pemtls_cert /etc/openldap/cacerts/newcert.pempam_password md5nss_map_attribute gecos description When the "TLSVerifyClient  allow" is specified in slapd.conf, I am able to login to the client machine properly, authentication is succesful. but when "TLSVerifyClient  demand" and when I try to login to the client machine the authentication is failing. I am getting the following error at the server side. TLS trace: SSL3 alert write:fatal:handshake failureTLS trace: SSL_accept:error in SSLv3 read client certificate BTLS: can't accept: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate.connection_read(12): TLS accept failure error=-1 id=1005, closingconnection_closing: readying conn=1005 sd=12 for closeconnection_close: conn=1005 sd=12daemon: activity on 1 descriptordaemon: activity on:daemon: removing 12conn=1005 fd=12 closed (TLS negotiation failure) please let me know where i am making mistake? how can i correct this and make it work properly? Thanks & Regards,Vijay S.

1 0

pcache crashes server
by turbo＠bayour.com 19 Sep '11

19 Sep '11

I'm trying to use pcache on my server, but it crashes every time it gets a 'QUERY CACHABLE'... See my config in my other thread... This is a localy compiled OpenLDAP v2.4.26 with localy compiled Berkeley DB v5.1.25 on a CentOS v5.6 (Final). ----- s n i p ----- [...] => access_allowed: read access granted by read(=rscxd) conn=1000 op=1 ENTRY dn="uid=kpxb140,ou=people,dc=seml,dc=company,dc=tld" ber_flush2: 80 bytes to sd 17 0000: 30 4e 02 01 02 64 49 04 33 75 69 64 3d 6b 70 78 0N...dI.3uid=kpx 0010: 62 31 34 30 2c 6f 75 3d 50 65 6f 70 6c 65 2c 64 b140,ou=People,d 0020: 63 3d 73 65 6d 6c 2c 64 63 3d 00 00 00 00 00 00 c=seml,dc=xxxxxx 0030: 65 6e 65 63 61 2c 64 63 3d 6e 65 74 30 12 30 10 xxxxx,dc=net0.0. 0040: 00 00 00 00 00 31 09 04 07 6b 70 78 62 31 34 30 ..uid1...kpxb140 ldap_write: want=80, written=80 0000: 30 4e 02 01 02 64 49 04 33 75 69 64 3d 6b 70 78 0N...dI.3uid=kpx 0010: 62 31 34 30 2c 6f 75 3d 50 65 6f 70 6c 65 2c 64 b140,ou=People,d 0020: 63 3d 73 65 6d 6c 2c 64 63 3d 00 00 00 00 00 00 c=seml,dc=xxxxxx 0030: 00 00 00 00 00 2c 64 63 3d 6e 65 74 30 12 30 10 xxxxx,dc=net0.0. 0040: 04 03 75 69 64 31 09 04 07 6b 70 78 62 31 34 30 ..uid1...kpxb140 <= send_search_entry: conn 1000 exit. Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x41001940 (LWP 16414)] 0x00002aaaad0919c9 in pcache_op_cleanup (op=0x89ad40, rs=0x41000c10) at pcache.c:2369 2369 Attribute *a = rs->sr_entry->e_attrs; (gdb) bt #0 0x00002aaaad0919c9 in pcache_op_cleanup (op=0x89ad40, rs=0x41000c10) at pcache.c:2369 #1 0x000000000043f797 in ?? () #2 0x0000000000441a7a in slap_send_search_entry () #3 0x00002aaaaca0d9fe in ldap_back_search (op=0x89ad40, rs=0x41000c10) at search.c:361 #4 0x0000000000494722 in overlay_op_walk () #5 0x0000000000494c87 in ?? () #6 0x0000000000432f09 in fe_op_search () #7 0x0000000000433715 in do_search () #8 0x0000000000430c65 in ?? () #9 0x000000000043123f in ?? () #10 0x00002aaaaaac1f38 in ldap_int_thread_pool_wrapper (xpool=0x79d1d0) at tpool.c:685 #11 0x000000397c80673d in start_thread () from /lib64/libpthread.so.0 #12 0x000000397bcd40cd in clone () from /lib64/libc.so.6 ----- s n i p ----- ----- s n i p ----- [kpxb140@semldx00135 LDAPv3]$ alias ldapsearch.local alias ldapsearch.local='/usr/local/turbo/bin/ldapsearch -LLL -x -h localhost -b dc=company,dc=tld' [kpxb140@semldx00135 LDAPv3]$ ldapsearch.local 'uid=kpxb140' uid dn: uid=kpxb140,ou=People,dc=org1,dc=company,dc=tld uid: kpxb140 ldap_result: Can't contact LDAP server (-1) ----- s n i p ----- So it gets the value from the AD, transmogrifying it using rwm and sends the reply to the client. But when getting to the pcache overlay, it crashes...

2 1

Rename DN ?
by Tim Watts 18 Sep '11

18 Sep '11

Hi folks, Quick question if I may: Is it possible to rename a DN, eg this LDIF file: dn: cn=Fred,ou=people,dc=example,dc=com changetype: modify replace: dn dn: cn=Fred,ou=people,ou=external,dc=example,dc=com I tried that, and ldapmodify does not seem to like it :( Many thanks, Tim -- Tim Watts Personal Blog: http://www.dionic.net/tim/

3 3

open LDAP + TLS/SSL bind Failed.
by vijay s sheelavantar 18 Sep '11

18 Sep '11

Hi, I am trying to configure LDAP Client/server on 2 Fedora-10 linux machines. I have installed and configured openldap-2.4.26 server on one machine and pam_ldap-186, nss_ldap-265 on the other machines. I have created the TLS certificates using following command on the server. openssl req -newkey rsa:1024 -x509 -nodes -out \ server.pem -keyout server.pem -days 3650 and I have created the client.pem by copying CERTIFICATE portion of the server.pem. When my client try to connect to the server I get following errors. TLS trace: SSL3 alert read:fatal:unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca. connection_read(12): TLS accept failure error=-1 id=1012, closing connection_closing: readying conn=1012 sd=12 for close connection_close: conn=1012 sd=12 daemon: removing 12 conn=1012 fd=12 closed (TLS negotiation failure) My Configurations are as follows. slapd.conf access to attrs=userPassword by self write by anonymous auth by * none access to * by * read #TLS Certificate section TLSCipherSuite HIGH:MEDIUM:+SSLv2:+SSLv3:RSA TLSCACertificateFile /etc/openldap/cacerts/server.pem TLSCertificateFile /etc/openldap/cacerts/server.pem TLSCertificateKeyFile /etc/openldap/cacerts/server.pem TLSVerifyClient allow and client side ldap.conf  base dc=samsung,dc=com uri ldaps://10.254.204.181/ TLS_CACERT /etc/openldap/cacerts/client.pem pam_password md5 nsswitch.conf passwd: files ldap shadow: files ldap group: files ldap netgroup: files ldap automount: files ldap I am not getting why it is saying Unknown ca. even though the certificate is created on server machine itself. Kindly help me to solve this problem.

4 3

Re: SASL and non-cleartext passwords storage
by Julien Vehent 18 Sep '11

18 Sep '11

On 18.09.2011 14:36, Jacobus brogly.decap wrote: > No, encrypting passwords over the wire is somthing TOTALLY different > and > seperate from how they are stored on disk (in case you want to > migrate or > export) > Dont solve 2 different problems at the same time,..I recommend you > read > chapter 2 of IBM redbook on LDAP. > My apologies for not being clear. Let me go back to the initial problem. I have postfix, cyrus-imapd and openldap installed on a debian. I do not care about protecting passwords over the wire because I already use ldaps for all communications with slapd. postfix and cyrus-imapd both use ldapdb plugins to verify users against slapd. ldapdb is configured to authenticate postfix and cyrus-imap with their own private users, and then a proxy authorization is performed to take the identify of the real users. ex: postfix uses the user "postfixldap" and once authenticated, takes the identity of user "julien" +--------+ +----------+ |postfix | | cyrus | +--------+ +--------+-+ | | proxy | |proxy ldapdb ldapdb | +-----------+ |user "cyrusldap" user | | slapd | | +------->user=julien<--------+ "postfixldap" | | +-----------+ This method is nice because it avoid having an additional software in between postfix and cyrus (pam-ldap or saslauthd). But the problem is that ldapdb requires to use DIGEST-MD5 and therefore to store the passwords in cleartext in the directory. I'm looking for a solution to avoid storing the messages in cleartext. Is it possible while still using ldapdb in postfix and cyrus-imap ? Julien

2 1

Re: SASL and non-cleartext passwords storage
by Julien Vehent 18 Sep '11

18 Sep '11

On 18.09.2011 12:30, Jacobus brogly.decap wrote: > Sure, just choose "a schema" there are many hashes to choose from > SHA1-SHA2, MD5 etc...you can look it up in the admin guide on the > openldap.org [2] website...setting it up is really trivial! How is this going to work with proxy authorization ? the ldapdb auxprop plugin in postfix doesn't work with hash passwords. Should I go back to using saslauthd ? > 2011/9/18 Julien Vehent > >> Hi List, >> >> I'm working on a setup where postfix and cyrus-imap do proxy >> authorization against openldap (my setup is here http://1nw.eu/!cD >> [1] >> ). I love this solution, it's a lot more elegant that using >> saslauthd. >> But I'm concerned about passwords stored in cleartext, as required >> by >> DIGEST-MD5. >> >> I know of the many ways to protect the data stored in openldap (file >> system encryption, etc...), but if somebody gets a root access, >> passwords will be disclosed, and I want to prevent that. >> >> My question is: Is there a way to use hashed passwords with sasl and >> proxy authorization ? >> >> Thanks, >> Julien Links: ------ [1] http://1nw.eu/!cD [2] http://openldap.org [3] mailto:julien@linuxwall.info

1 0

SASL and non-cleartext passwords storage
by Julien Vehent 18 Sep '11

18 Sep '11

Hi List, I'm working on a setup where postfix and cyrus-imap do proxy authorization against openldap (my setup is here http://1nw.eu/!cD ). I love this solution, it's a lot more elegant that using saslauthd. But I'm concerned about passwords stored in cleartext, as required by DIGEST-MD5. I know of the many ways to protect the data stored in openldap (file system encryption, etc...), but if somebody gets a root access, passwords will be disclosed, and I want to prevent that. My question is: Is there a way to use hashed passwords with sasl and proxy authorization ? Thanks, Julien

1 0

Re: How to disable cn=config module in OpenLDAP
by pradyumna dash 17 Sep '11

17 Sep '11

Hi, Please find the configuration files as attached. When i run the below command i get the output ldapsearch -x -h 192.168,0.1 -D "cn=Manager,dc=example,dc=com" -b "dc=example,dc=com" -W but when i try either ldapsearch -x or ldapsearch -x -h 192.168.0.1 -b "cn=Manager,dc=example,dc=com" it shows : base <cn=Manager,dc=example,dc=com> with scope subtree filter: (objectclass=*) requesting: ALL #search result search: 2 result: 32 No such object #numResponse: 1 OS : SLES 11 SP1 LDAP : 2.4.20-0.4.29 What i have changed is insted of dynamic backend i am trying to use slapd.conf file so i have changed in /etc/sysconfig/openldap file OPENLDAP_CONFIG_BACKEND="files". Please suggest how to solve this. Regards, Neo On Wed, Sep 14, 2011 at 8:47 PM, Bill MacAllister <whm(a)stanford.edu> wrote: > > > --On Wednesday, September 14, 2011 07:46:17 PM +0200 pradyumna dash < > neomatrixgem(a)gmail.com> wrote: > > Hi, >> >> Yes i tried below >> >> ldapsearch -x -h l <http://somehost.com/>dap1.**example.com<http://dap1.example.com/>-b >> >> cn=Manager,dc=example,dc=com >> > > If that is the command line that you used no wonder you didn't get > the results you expected. > > > It asked me to provide the password i have provided that then it shows the >> same error, nothing came up. >> > > Why don't you provide exactly what you typed and and what the response > was? Just cut and paste it into a _text_ message. Sending HTML just > muddies the waters already murky waters. > > The -x requests a simple bind and since you have not provided a bind DN > or bind password it will attempt an anonymous bind. It is hard to believe > that you are seeing what you report. The host where the ldap server is > running is actually named 'ldap1.example.com'? > > > I have checked my ldap.conf as well it looks okay. >> > > Unless you were going to include the ldap.conf file this statement was > a waste of bytes. > > > Bill > > Regards, >> Neo >> >> On Wed, Sep 14, 2011 at 6:41 PM, Bill MacAllister <whm(a)stanford.edu> >> wrote: >> >> >>> >>> --On Wednesday, September 14, 2011 06:35:09 PM +0200 pradyumna dash < >>> neomatrixgem(a)gmail.com> wrote: >>> >>> Hi, >>> >>>> >>>> ldapsearch -x shows the content of LDAP database as well wothout any >>>> additional options. I can see the same in one of my servers,I took a >>>> dump >>>> of >>>> the running server by slapcat and restored the same in this server. >>>> >>>> I can see the data by slapcat but ldapsearch is not working. >>>> >>>> The box where ldap running fine its using slapd.d backend, but this >>>> server >>>> i >>>> have configured to run from slapd.conf file, can it be a issue with the >>>> DB >>>> backup and restore as they are both using different backend? >>>> >>>> Regards, >>>> Neo >>>> >>>> >>> Did you even try my suggestion? The error message that you got back, >>> i.e. >>> "32 no such object" is telling you that you have not supplied a baseDN >>> for the search. >>> >>> Bill >>> >>> P.S. Top posting to replies sucks. >>> >>> >>> On Wed, Sep 14, 2011 at 6:29 PM, Bill MacAllister <whm(a)stanford.edu> >>> >>>> wrote: >>>> >>>> >>>> >>>>> --On Wednesday, September 14, 2011 06:20:03 PM +0200 pradyumna dash < >>>>> neomatrixgem(a)gmail.com> wrote: >>>>> >>>>> I have fixed this by deleting the slapd.d and also changed the script >>>>> to >>>>> >>>>> read slapd.conf file but now >>>>>> >>>>>> when am trying ldapserach -x its showing 32 no such object >>>>>> >>>>>> but the below command works >>>>>> >>>>>> ldapsearch -LLL -Wx -D "cn=Manager,dc=mail,dc=domain,******dc=com >>>>>> >>>>>> why is that ? >>>>>> >>>>>> >>>>>> Because you did it wrong. There is not enough information in your >>>>> message to tell much more than you contacted an LDAP server and >>>>> got an error message. You might want to try using a fully specified >>>>> search and work back from there. For example: >>>>> >>>>> ldapsearch -x -h somehost.com -b cn=sometree,dc=domain,dc=com >>>>> >>>>> Bill >>>>> >>>>> >>>>> Regards, >>>>> >>>>> Neo >>>>>> On Wed, Sep 14, 2011 at 5:34 PM, pradyumna dash < >>>>>> neomatrixgem(a)gmail.com >>>>>> > wrote: >>>>>> >>>>>> Hi , >>>>>> >>>>>> >>>>>>> Can i disable cn=config module, I just want to use plain old >>>>>>> slapd.conf >>>>>>> file. How to disable that. So that LDAP wont use the directory. >>>>>>> >>>>>>> Am using SLES 11 SP1 and i tried deleteting the directory but if i am >>>>>>> unable to restart the service. >>>>>>> >>>>>>> Regards, >>>>>>> Neo >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>> -- >>>>> >>>>> Bill MacAllister >>>>> Infrastructure Delivery Group, Stanford University >>>>> >>>>> >>>>> >>>>> >>> >>> -- >>> >>> Bill MacAllister >>> Infrastructure Delivery Group, Stanford University >>> >>> >>> > > > -- > > Bill MacAllister > Infrastructure Delivery Group, Stanford University > >

1 1

Re: slapd does not creating pid file
by sim123 16 Sep '11

16 Sep '11

On Fri, Sep 16, 2011 at 12:01 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, September 16, 2011 11:46 AM -0700 sim123 <Sim3159(a)gmail.com> > wrote: > > Hi, >> >> >> I am using openldap 2.4.25 and configured location of pidfile and >> argsfile in slapd.conf. However, when running slapd its not creating pid >> file or args file. On searching for this issue I found the bug reported >> earlier stating similar problem. Is that fixed or do I need to do some >> other configuration. >> > > It works for me. Perhaps slapd can't write to the location you specified. > I am running it as root. And found out that if I CD into libexec directory and run slapd from there it all works. However if I run it like /opt/openldap-2.4.25/libexec/slapd no .pid or .args get created. And I am giving absolute path for pidFile and argsFile in slapd.conf Thanks > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

slapd does not creating pid file
by sim123 16 Sep '11

16 Sep '11

Hi, I am using openldap 2.4.25 and configured location of pidfile and argsfile in slapd.conf. However, when running slapd its not creating pid file or args file. On searching for this issue I found the bug reported earlier stating similar problem. Is that fixed or do I need to do some other configuration. Thanks

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical