openldap-technical

openldap-technical@openldap.org

11 participants
9876 discussions

ldap root disable su
by Arif Ali 30 Jun '11

30 Jun '11

Hi list, I have used ldap for a while now, and we are currently looking at some security options for users to not to be able to hack the ldap system what we want is that for anyone who is root not to be able to su to any ldap user. Is there anything in the slapd.conf that can be configured to do that Arif Ali catch me on freenode IRC, username: arif-ali

1 0

OpenLDAP mirror replication ldif format
by Simon Massart 30 Jun '11

30 Jun '11

Hi there, I recently installed a new Debian 6 and OpenLDAP to test the new ldif format configuration. The problem is that I do not have any base configuration to use slaptest to migrate my config to ldif format. My main concern is now to find a manual/tutorial, to be able to setup a mirror replication with ldif format, because all I can find is using the old slapd.conf. Can anyone point me somewhere, where I could find some help or give my a quick example ? Thanks in advance for any return, Sismon

2 1

bad credential
by Friedrich Locke 30 Jun '11

30 Jun '11

I upload the ldif file below into my openldap server: dn: dc=ufv,dc=br dc: ufv objectclass: dcobject objectclass: organization o: Universidade Federal de Vicosa dn: ou=group,dc=ufv,dc=br ou: group objectclass: top objectclass: organizationalunit dn: cn=its,ou=group,dc=ufv,dc=br cn: its objectclass: posixgroup gidnumber: 1000 dn: cn=asd,ou=group,dc=ufv,dc=br cn: asd objectclass: posixgroup gidnumber: 1001 memberuid: sioux dn: cn=dba,ou=group,dc=ufv,dc=br cn: dba objectclass: posixgroup gidnumber: 1002 memberuid: sioux dn: cn=wbx,ou=group,dc=ufv,dc=br cn: wbx objectclass: posixgroup gidnumber: 1003 dn: cn=alg,ou=group,dc=ufv,dc=br cn: alg objectclass: posixgroup gidnumber: 1004 memberuid: sioux dn: cn=djb,ou=group,dc=ufv,dc=br cn: djb objectclass: posixgroup gidnumber: 1005 dn: cn=nofiles,ou=group,dc=ufv,dc=br cn: nofiles objectclass: posixgroup gidnumber: 1006 dn: cn=qmail,ou=group,dc=ufv,dc=br cn: qmail objectclass: posixgroup gidnumber: 1007 dn: cn=ftp,ou=group,dc=ufv,dc=br cn: ftp objectclass: posixgroup gidnumber: 1008 dn: cn=src,ou=group,dc=ufv,dc=br cn: src objectclass: posixgroup gidnumber: 1009 dn: cn=ord,ou=group,dc=ufv,dc=br cn: ord objectclass: posixgroup gidnumber: 2000 dn: cn=adc,ou=group,dc=ufv,dc=br cn: adc objectclass: posixgroup gidnumber: 2001 dn: cn=bod,ou=group,dc=ufv,dc=br cn: bod objectclass: posixgroup gidnumber: 2002 dn: cn=frn,ou=group,dc=ufv,dc=br cn: frn objectclass: posixgroup gidnumber: 2003 dn: ou=people,dc=ufv,dc=br ou: people objectclass: top objectclass: organizationalunit dn: uid=sioux,ou=people,dc=ufv,dc=br uid: sioux objectclass: organizationalrole objectclass: posixaccount cn: Gustavo Rios uidnumber: 1000 gidnumber: 1000 homedirectory: /home/sioux userpassword: {SASL}sioux(a)UFV.BR loginshell: /bin/sh Gecos: Gustavo V G Coelho Rios,,, But when i try the command below, i get invalid credential sioux@gustav$ ldapsearch -x -W -D 'uid=sioux,ou=people,dc=ufv,dc=br' -b dc=ufv,dc=br Enter LDAP Password: ldap_bind: Invalid credentials (49) sioux@gustav$ And when i try: $ ldapsearch -Y GSSAPI -b dc=ufv,dc=br it works perfectly. Any ideia about why it does not work ?

1 0

autofs wild cards
by Collins, Cris 30 Jun '11

30 Jun '11

My auto.home has "* host:/export/&" for user directories. When I use the automount migration tool the * is changed to / and I get the error: adding new entry "cn=/,ou=auto.home,dc=domain,dc=com" ldapadd: Naming violation (64) additional info: value of naming attribute 'cn' is not present in entry Is there a way to get the wild card to work or do I need to enter each user instead of using a wild card? Thank you for your time.

2 1

pcache + back-sql
by Chris Card 30 Jun '11

30 Jun '11

[Let's try that again. Hotmail/Chrome managed to screw up the formatting before] Does anyone have an example of using the pcache overlay with back-sql? Here's the relevant section of my slapd.config: database sql suffix "......" rootdn "......." rootpw ........ dbname MySQL dbuser ......... subtree_cond "ldap_entries.dn like CONCAT('%',?)" insentry_stmt "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no baseobjectupper_func UPPER autocommit yes pcache bdb 10000 1 50 100 pcacheAttrset 0 * + pcacheTemplate (objectClass=) 0 60 ... pcache-directory /var/tmp/cache pcache-cachesize 100 What I'm unclear about is how to configure the private bdb database used for the cache. When use this config, slapd starts up ok, but crashes with a SEGV when (I assume) it tries to cache a result: (I am running slapd built from the latest code in HEAD from git) slap_queue_csn: queing 0xb7a52efa 20110629132038.554471Z#000000#000#000000 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb7a55b90 (LWP 26226)] 0x080f3844 in slap_queue_csn (op=0xb7a53378, csn=0xb7a52f60) at ctxcsn.c:199 199 LDAP_TAILQ_INSERT_TAIL( be->be_pending_csn_list, (gdb) where #0 0x080f3844 in slap_queue_csn (op=0xb7a53378, csn=0xb7a52f60) at ctxcsn.c:199 #1 0x080f38e0 in slap_get_csn (op=0xb7a53378, csn=0xb7a52f60, manage_ctxcsn=1) at ctxcsn.c:214 #2 0x08079f33 in slap_add_opattrs (op=0xb7a53378, text=0xb7a53214, textbuf=0xb7a53074 "", textlen=256, manage_ctxcsn=1) at add.c:609 #3 0x0814187b in bdb_add (op=0xb7a53378, rs=0xb7a53200) at add.c:107 #4 0x081a144e in merge_entry (op=0xb7a53378, e=0x9f56e4c, dup=0, query_uuid=0xa040848) at pcache.c:865 #5 0x081a4d1c in cache_entries (op=0x9fdbfc8, query_uuid=0xa040848) at pcache.c:2325 #6 0x081a5244 in pcache_op_cleanup (op=0x9fdbfc8, rs=0xb7a550e4) at pcache.c:2430 #7 0x08084697 in slap_cleanup_play (op=0x9fdbfc8, rs=0xb7a550e4) at result.c:539 #8 0x08084dd3 in send_ldap_response (op=0x9fdbfc8, rs=0xb7a550e4) at result.c:724 #9 0x0808554e in slap_send_ldap_result (op=0x9fdbfc8, rs=0xb7a550e4) at result.c:851 #10 0x0813e4a3 in backsql_search (op=0x9fdbfc8, rs=0xb7a550e4) at search.c:2493 #11 0x0807402e in fe_op_search (op=0x9fdbfc8, rs=0xb7a550e4) at search.c:402 #12 0x080f1aaa in overlay_op_walk (op=0x9fdbfc8, rs=0xb7a550e4, which=op_search, oi=0x9f3dc80, on=0x0) at backover.c:671 #13 0x080f1c5f in over_op_func (op=0x9fdbfc8, rs=0xb7a550e4, which=op_search) at backover.c:723 #14 0x080f1d0e in over_op_search (op=0x9fdbfc8, rs=0xb7a550e4) at backover.c:750 #15 0x0807397d in do_search (op=0x9fdbfc8, rs=0xb7a550e4) at search.c:247 #16 0x08070704 in connection_operation (ctx=0xb7a551d0, arg_v=0x9fdbfc8) at connection.c:1138 #17 0x08070c44 in connection_read_thread (ctx=0xb7a551d0, argv=0xd) at connection.c:1274 #18 0x081e04a5 in ldap_int_thread_pool_wrapper (xpool=0x9f11f78) at tpool.c:685 #19 0x004be5ab in start_thread () from /lib/libpthread.so.0 #20 0x003b2cfe in clone () from /lib/libc.so.6 It crashes because be->be_pending_csn_list is zero, presumably because backend_startup_one() has not been called for this backend. This leads me to believe that I need something in slapd.conf to get the private bdb database initialised, but what? Chris

2 7

fetching information
by Friedrich Locke 29 Jun '11

29 Jun '11

I am planing using openldap to fetch user/group information. Below my main tree there will be ou=people and ou=group, and below those the regular user or group information. It happens that a program (ypserv) will fetch information from tree binding as cn=ypserv just below my main tree. This binding should be authenticated, so what should cn=ypserv attributes be? What about access rules for it ? Thanks a lot for your time and cooperation. Best regards! Fried.

3 3

Connections
by Friedrich Locke 29 Jun '11

29 Jun '11

I would like to see how many connections openldap is serving on a given momment. I am trying this: sioux@gustav$ ldapsearch -LLL -W -D cn=oldap,dc=ufv,dc=br -b cn=current,cn=connections,cn=monitor -H ldap://gustav.cpd.ufv.br/ objectclass=* Enter LDAP Password: dn: cn=Current,cn=Connections,cn=Monitor objectClass: monitorCounterObject cn: Current sioux@gustav$ I cannot see the number of connections. Where is my mistake ? Thanks a lot.

3 2

protected entry
by Friedrich Locke 29 Jun '11

29 Jun '11

Dear list users, i would like to have an entry in my openldap server thats needs to have a password so that it would be able to permit clients to bind as it providing its password. For instance: cn=x,ou=y,dc=a,dc=b So anyone knowing "cn=x,ou=y,dc=a,dc=b" 's password could bind as it. Any ideia? Thanks.

2 1

chaining through proxy and slave
by Hugo Monteiro 29 Jun '11

29 Jun '11

Hello list, With the following scenario Client (A) <-----> back_ldap Proxy (B) <-----> syncrepl Slave (C) <-----> Master (D) and B and C use a binddn that only has full read permissions on the database, except for a couple of attributes, on which it has full write permissions. Also, Each of the represented nodes can only "talk" to the nodes to which there is a represented connection, so (A) and (B) cannot chase a configured referral to (D). What would be the proper way to setup (B) and (C) so that (A) could push updates for the couple of attributes into the master (D) node? At the Slave level, i've already setup chaining and making it use (D) as updateref, but then any push on (B) would not propagate. I also noticed that in although i used mode=self, in the chaining, i had to configure a binddn which had full write permissions. Wouldn't it be sufficient to have a full read enabled binddn or even no binddn at all since the bind would then be made using the clients credentials? Thanks in advance, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

2 1

kerberos ldap/host.my.domain
by Friedrich Locke 29 Jun '11

29 Jun '11

Hi folks, i have just installed openldap and i am facing a situation i would like to share with you. In OpenBSD (the OS i am using) i have the keytab file inside /etc/kerberosV. Its access mode is 600, its ownership is root:wheel. But OpenBSD specifies a user and group the slapd daemon should run as; the user is "u" and group "g". In order to get SASL/GSSAPI working i need to add to the keytab the principal ldap/host.my.domain. I did it; now the keytab has the principals host/x.y.z and ldap/x.y.z But since slapd runs as another user it is prevented from accessing the keytab file. So i thought the following possible solutions: 0) Run slapd as root 1) change the permission of the keytab Any of those options above makes security less secure. I known there should be some more approaches, but i cannot think it right now. How did you handle that? Thanks a lot for your time and cooperation. Best regards.

4 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical