openldap-technical

openldap-technical@openldap.org

11 participants
9876 discussions

slapd 2.2.24 will not start as non root user
by Iain M Conochie 02 Mar '11

02 Mar '11

Good Afternoon, I am attempting to upgrade my openldap 2.4.x installation to the latest release 2.4.24. I am compiling from source. I can start slapd as the root user but I am unable to start as a non-root user (e.g. ldap). I am receiving the following error message: /opt/openldap/libexec/slapd -u ldap -g ldap -h ldap://XXXXX.XXXXXXXX.XXX slapd: sbind.c:76: ldap_simple_bind: Assertion `( (ld)->ld_options.ldo_valid == 0x2 )' failed. Aborted Is the server attempting to bind to another ldap server? This is the "secondary" server on the network an I have the main LDAP server in /etc/ldap.conf. Running an strace I do see slapd referencing this file: open("/etc/ldap.conf", O_RDONLY) = 8 fstat64(8, {st_mode=S_IFREG|0644, st_size=919, ...}) = 0 fstat64(8, {st_mode=S_IFREG|0644, st_size=919, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fa1000 read(8, "#\n# LDAP Defaults\n#\n\n# See ldap."..., 4096) = 919 read(8, "", 4096) = 0 close(8) = 0 munmap(0xb7fa1000, 4096) = 0 stat64("/etc/ldap.conf", {st_mode=S_IFREG|0644, st_size=919, ...}) = 0 geteuid32() = 0 brk(0x82b2000) = 0x82b2000 stat64("/etc/ldap.conf", {st_mode=S_IFREG|0644, st_size=919, ...}) = 0 geteuid32() = 0 write(2, "slapd: sbind.c:76: ldap_simple_b"..., 95slapd: sbind.c:76: ldap_simple_bind: Assertion `( (ld)->ld_options.ldo_valid == 0x2 )' failed. ) = 95 rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 tgkill(9691, 9691, SIGABRT) = 0 --- SIGABRT (Aborted) @ 0 (0) --- +++ killed by SIGABRT +++ Process 9691 detached Does anyone have any ideas here? Regards Iain M Conochie

4 10

openldap does not want to write log files?
by Mauricio Tavares 01 Mar '11

01 Mar '11

I am feeling rather confused here. I installed openldap in a solaris10/sparc box but I do not seem to persuade it to write to a log file. FYI, right now I am running slapd as root so permissions AFAIk should not be the issue. FYI, syslog here is the old, non-rsyslog/syslog-ng variety. So, in the /etc/syslog.conf file I have: local4.info /var/log/ldap.log local4.err /var/log/ldap.log local4.notice /var/log/ldap.log which makes me think I should be covering every possible message sent by slapd. Now /var/log/ldap.log is created as -rw------- 1 root sys 0 Feb 28 16:21 ldap.log and in the slapd.conf file I have loglevel 11560 logfile /var/log/slapd.log which not only should mean slapd is blabbing a lot to the log file. Also note I am telling it to write to /var/log/slapd.log, -rw------- 1 root sys 0 Mar 1 07:39 slapd.log When I start slapd (after restarting syslog just in case), nothing is written to those two log files. In fact, the only clue that something happened is the data in slapd.log changed: -rw------- 1 root sys 0 Feb 28 16:21 ldap.log -rw------- 1 root sys 0 Mar 1 07:40 slapd.log Anything I am missing here?

5 8

multiple certificates on one LDAP server
by Yann CUEFF 01 Mar '11

01 Mar '11

Hello, Is someone know how to use multiple certificates on one LDAP Server ? I need to use Thawte/Verisign SSL certificate and self signed SSL certificate on one LDAP server. I don't find any information about that. Regards, Yann Ce message et toutes les pièces jointes (ci-après le 'Message') sont établis à l'intention exclusive des destinataires et les informations qui y figurent sont strictement confidentielles. Toute utilisation de ce Message non conforme à sa destination, toute diffusion ou toute publication totale ou partielle, est interdite sauf autorisation expresse. Si vous n'êtes pas le destinataire de ce Message, il vous est interdit de le copier, de le faire suivre, de le divulguer ou d'en utiliser tout ou partie. Si vous avez reçu ce Message par erreur, merci de le supprimer de votre système, ainsi que toutes ses copies, et de n'en garder aucune trace sur quelque support que ce soit. Nous vous remercions également d'en avertir immédiatement l'expéditeur par retour du message. Il est impossible de garantir que les communications par messagerie électronique arrivent en temps utile, sont sécurisées ou dénuées de toute erreur ou virus. ____________________________________________________ This message and any attachments (the 'Message') are intended solely for the addressees. The information contained in this Message is confidential. Any use of information contained in this Message not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. If you are not the addressee, you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return message. E-mail communication cannot be guaranteed to be timely secure, error or virus-free.

1 0

Poor performance on Solaris
by Juergen.Sprenger＠swisscom.com 01 Mar '11

01 Mar '11

Hi, we had some performance issues on our ldap servers running Solaris 10 sparc. I did some tests using slamd http://www.slamd.com/ and got disturbing results: ldap-service: OpenLDAP 2.4.23, setup identical on both boxes, threads=64, identical content. box1: hardware: Sun Microsystems sun4v SPARC Enterprise T5120 memory:32 GB RAM os: Solaris 10 s10s_u9wos_14a searches (avg/second): 1521 box2: hardware: AMD 64 phenom 9850 memory: 8 GB RAM os: Linux dsv00000 2.6.36.2 #1 SMP Mon Dec 27 10:09:29 CET 2010 x86_64 AMD Phenom(tm) 9850 Quad-Core Processor AuthenticAMD GNU/Linux searches (avg/second): 22968 I am looking for some hints to improve performance on box1 to a similar level as on box2 or an explanation why on box1 performance is so bad. As slapd.conf, ldap.conf and DB_CONFIG are identical there should not be such a big gap in performance. Juergen Sprenger

7 10

Password policy: possible DoS scenario
by Konstantin Boyandin 01 Mar '11

01 Mar '11

Hello, Thanks to everyone having answered me earlier, I've managed to set up password policy on the OpenLDAP provided in CentOS 5.5 repositories (current version 2.3.43). The setup: we have password policy enabled for users accounts in our intranet. After 5 unsuccessful attempts the account is blocked for short duration (30 seconds). Does that mean that anyone now can keep all the accounts blocked most of the time? Am I right that if anyone enters someone else' incorrect password 5 times (in the given case), they will block the target account (regardless of what IP address the attacker was connecting from)? Narrower question: do password policy module developers plan to take into account what IPs are used to connect (thus, blocking only access from specific IPs)? Thanks. All the best, Konstantin

2 3

Re: Problem unexpected failing slapd
by jekvb＠gmx.co.uk 27 Feb '11

27 Feb '11

"...now and then slapd just stops and always without any traces in the logfiles. Sometime three times a day, sometime a week without a failure. I can't find a pattern or any relation to any other service on the linux server." Is your LDAP environment installed on a VM or on plain metal box? Regards, Kuba ----- Original Message ----- From: Ruud Baart Sent: 27/02/11 12:57 PM To: openldap-technical(a)openldap.org Subject: Problem unexpected failing slapd Problem: For a customer we use LDAP for many years. Last year suddenly the slapd service just stopped without any traces in the logfiles. After a restart of slapd everything works fine again. But the problem was there: it was not an incident, now and then slapd just stops and always without any traces in the logfiles. Sometime three times a day, sometime a week without a failure. I can't find a pattern or any relation to any other service on the linux server. Environment: - Several (debian squeeze) servers , several windows servers. We use bdb database backend. - There is one master LDAP server which provides syncprov and two replica's LDAP servers (syncrepl). The master server is most intens used (mainly samba as primary domain controller: a few hundred useraccounts, lot of groupaccounts, workstations, acl's, etc.), one of the replica's is not very busy but handles the mail for all users (lookup: amavis, postfix, courier-imap, mailaccount settings etc). The third replica is not busy at all, it is a remote location. - Total LDAP is 3700 dn's, slapcat produces a file of 7,3 Mb. - It is only the master LDAP with stops suddenly. I have never seen a failure of a replica LDAP. Because I have no clear idea about the problem I have no idea which technical details are relevant: DB_CONFIG =========== set_cachesize 0 10485760 1 set_lk_max_objects 10000 set_lk_max_locks 10000 set_lk_max_lockers 10000 set_lg_dir /home/ldap-dbd The database is stored on a ext3 filesystem, kernel 2.6.32. The server has no problems, plenty of memory and a fast diskarray (SAS->SATA). Never technical problems with this server. And it worked without problems for a long period. Nothing has changed to the environment or the LDAP setup (except of course with the upgrade to debian squeeze but the problem was already there). What we have tried: - upgrade from openldap 2..4.17 (debian lenny+backports) to openldap 2.4.23 (debian squeeze). I saw in the release notes that problems related to syncrepl were solved. Therefor we waited for version 2.4.23 te become available in debian. This upgrade made no difference. - reindex, rebuilt the directory. When I rebuilt the LDAP with a clean LDIF file on the master LDAP or an other machine with ldapadd there is not one error or warning. The workaround for the moment: I have written a process monitor (perl daemon) which monitors the slapd daemon and if it suddenly stops, slapd is restarted. It is of course not a solution but the 300 user can work. If slapd stops without a restart within 1 minute a few hundred people can't work because samba stops working. I would like to receive suggestions what we can do to find the problem. Because there is no pattern, nothing in the logfiles I don't know where to start. -- Regards, Ruud Baart

1 0

Help needed with opeLDAP configuration
by sim123 25 Feb '11

25 Feb '11

Dear All, I am new to LDAP and openLDAP, just installed and configured openLDAP 2.4.23 with Berkeley DB 4.8 on CentOS 5.4 using http://www.openldap.org/doc/admin24/quickstart.html make test gave an error on replication similar to this http://www.openldap.org/lists/openldap-technical/201006/msg00256.html So I think installation is correct but when I try to do a search as described in the article, result is : # ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: namingContexts # # dn: namingContexts: dc=example,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Can someone please help me identifying the problem. Thanks for the help and support.

3 3

Re: Help needed with opeLDAP configuration
by sim123 25 Feb '11

25 Feb '11

Thanks for your response, I did ignore the error. However, the search result is empty, not sure what could go wrong. my sladp.conf file is same as described in quick start guide. Thanks. On Fri, Feb 25, 2011 at 12:36 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, February 25, 2011 11:36 AM -0800 sim123 <Sim3159(a)gmail.com> > wrote: > > Dear All, >> >> >> I am new to LDAP and openLDAP, just installed and configured openLDAP >> 2.4.23 with Berkeley DB 4.8 on CentOS 5.4 >> using http://www.openldap.org/doc/admin24/quickstart.html >> >> make test gave an error on replication similar to >> this http://www.openldap.org/lists/openldap-technical/201006/msg00256.ht >> ml >> >> So I think installation is correct but when I try to do a search as >> described in the article, result is : >> > > As noted repeatedly, even by the test itself, you should ignore any errors > from test058. That's why it exists with success. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

sortvals oddities - with more information and hopefully to the right list
by Andrew Elble 25 Feb '11

25 Feb '11

We are using sortvals on both member and memberUid. We have been seeing duplicate member/memberUid attributes on some objects that have been modified (as well as a lack of sorting on those attributes). It seemed that there was a correlation between modifies to objects that experienced deadlocks and the objects that had duplicate member/memberUid attributes on them. We put the seqmod overlay in place - and this reduced the number of occurrences of the issue but did not eliminate them. Upon further investigation, I discovered that it was possible to bypass the sorting behavior if the object was not created with an instance of the attribute with sorting enabled as a part of it. It would seem that attr_merge() (in attr.c) should have something like this: if ( *a == NULL ) { *a = attr_alloc( desc ); if (desc->ad_type->sat_flags & SLAP_AT_SORTED_VAL) { (*a)->a_flags |= SLAP_ATTR_SORTED_VALS; } } else { Further pursuing the issue, I started to focus on the index deletion code that was changed as a part of ITS#5183. Specifically, the portion of code within bdb_modify_internal() (in back-bdb/modify.c) that is commented: /* Move deleted values to end of array */ This code modifies save_attrs, which is actually apparently a pointer to memory that resides within the cache. If a deadlock occurs, these changes are not reverted, thereby corrupting the entry in the cache. I replaced this code with the pre-ITS#5183 code and I am no longer able to 'break' the object and insert duplicate member/memberUids. I also found it surprising that the call to bdb_idl_cache_del() in bdb_idl_delete_key() in back-bdb/idl.c occurred prior to any calls to the database? I can answer any questions about the specifics of the environment in which where we are seeing this - it is a somewhat difficult problem to reproduce outside of our production environment. I'm not terribly familiar with the code - I'm looking to see if I have collected enough data here to open an ITS to have this fixed. (or if I'm just way off base) Thanks, Andy -- Andrew W. Elble aweits(a)discipline.rit.edu Infrastructure Engineer, Communications Technical Lead Rochester Institute of Technology PGP: BFAD 8461 4CCF DC95 DA2C B0EB 965B 082E 863E C912 CONFIDENTIALITY NOTE: The information transmitted, including attachments, is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and destroy any copies of this information.

2 1

Migrating from Sun DSEE & Boolean values question
by Simon Fraser 25 Feb '11

25 Feb '11

Hi, We're planning to migrate to OpenLDAP from Sun Directory Server. So far the test setup works fine, with one potential problem. Sun's directory server treats boolean values as case-insensitive, while the RFC (and OpenLDAP) require upper-case TRUE and FALSE values. Is there a way of forcing case insensitivity on boolean values with OpenLDAP, so that any clients who are applying filters like "(foo=true)" will continue to work? Or is the only way to maintain stats logging and try to locate particular scripts on the machines that connect, and fix each one in turn? I realise the former option is not RFC compliant, but for me, it'll be very convenient to be permissive. Thanks, Simon. -- The Wellcome Trust Sanger Institute is operated by Genome Research Limited, a charity registered in England with number 1021457 and a company registered in England with number 2742969, whose registered office is 215 Euston Road, London, NW1 2BE.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical