openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

OpenLDAP 2.6.1 testing call #1 (OpenLDAP 2.6.1)
by Quanah Gibson-Mount 20 Jan '22

20 Jan '22

This is the first testing call for OpenLDAP 2.6.1. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. We are aware of two issues with the regression suite tests failing (its4448 and its8752), so no need to report failures for those. Thanks! OpenLDAP 2.6.1 Engineering Fixed libldap to init client socket port (ITS#9743) Added slapd config keyword for logfile format (ITS#9745) Fixed slapd to allow objectClass edits with no net change (ITS#9772) Fixed slapd configtable population (ITS#9576) Fixed slapd to only set loglevel in server mode (ITS#9715) Fixed slapd logfile-rotate use of uninitialized variable (ITS#9730) Fixed slapd passwd scheme handling with slapd.conf (ITS#9750) Fixed slapd postread support for modrdn (ITS#7080) Fixed slapd syncrepl recreation of deleted entries (ITS#9282) Fixed slapd syncrepl replication with ODSEE (ITS#9707) Fixed slapd syncrepl to properly replicate glue entries (ITS#9647) Fixed slapd syncrepl to reject REFRESH for precise resync (ITS#9742) Fixed slapd syncrepl to avoid busy loop during refresh (ITS#9584) Fixed slapd syncrepl when X-ORDERED is specified (ITS#9761) Fixed slapd syncrepl to better handle out of order delete ops (ITS#9751) Fixed slapd syncrepl to correctly close connections when config is deleted (ITS#9776) Fixed slapd-mdb to update indices correctly on replace ops (ITS#9753) Fixed slapd-wt to set correct flags (ITS#9760) Fixed slapo-accesslog to fix assertion due to deprecated code (ITS#9738) Fixed slapo-accesslog to fix inconsistently normalized minCSN (ITS#9752) Fixed slapo-accesslog delete handling of multi-valued config attrs (ITS#9493) Fixed slapo-autogroup to maintain values in insertion order (ITS#9766) Fixed slapo-constraint to maintain values in insertion order (ITS#9770) Fixed slapo-dyngroup to maintain values in insertion order (ITS#9762) Fixed slapo-dynlist compare operation for static groups (ITS#9747) Fixed slapo-dynlist static group filter with multiple members (ITS#9779) Fixed slapo-ppolicy when not built modularly (ITS#9733) Fixed slapo-refint to maintain values in insertion order (ITS#9763) Fixed slapo-retcode to honor requested insert position (ITS#9759) Fixed slapo-sock cn=config support (ITS#9758) Fixed slapo-syncprov memory leak (ITS#8039) Fixed slapo-syncprov to generate a more accurate accesslog query (ITS#9756) Fixed slapo-syncprov to allow empty DB to host persistent syncrepl connections (ITS#9691) Fixed slapo-syncprov to consider all deletes for sycnInfo messages (ITS#5972) Fixed slapo-translucent to warn on invalid config (ITS#9768) Fixed slapo-unique to warn on invalid config (ITS#9767) Fixed slapo-valsort to maintain values in insertion order (ITS#9764) Build Environment Fix test022 to preserve DELAY search output (ITS#9718) Fix slapd-watcher to allow startup when servers are down (ITS#9727) Contrib Fixed slapo-lastbind to work with 2.6 lastbind-precision configuration (ITS#9725) Documentation Fixed slapd.conf(5)/slapd-config(5) documentation on lastbind-precision (ITS#9728) Fixed slapo-accesslog(5) to clarify logoldattr usage (ITS#9749) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

4 3

CRL refresh in OpenLDAP
by Xabier Berasategui Cano 19 Jan '22

19 Jan '22

Hi, We have an application that uses a client certificate to authenticate to OpenLDAP server 2.4.46 at SSL/TLS level. Among other things, olcTLSCRLCheck directive is configured to "peer" value to verify if the client certificate has not been revoked and the CRL is updated every day via script and expires after 15 days. Everything works well until the 15 days are exceeded and the authentication of the application fails since the server has not been restarted to refresh the CRL. Is there a way to refresh the CRL without restarting the server? Thanks in advance Regards P Please consider the environment before printing this e-mail.

2 1

RE25 testing call #1 (OpenLDAP 2.5.10)
by Quanah Gibson-Mount 18 Jan '22

18 Jan '22

This is the first testing call for OpenLDAP 2.5.10. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! We are aware of two issues with the regression suite tests failing (its4448 and its8752), so no need to report failures for those. OpenLDAP 2.5.10 Engineering Fixed libldap to init client socket port (ITS#9743) Fixed slapd to allow objectClass edits with no net change (ITS#9772) Fixed slapd syncrepl recreation of deleted entries (ITS#9282) Fixed slapd syncrepl replication with ODSEE (ITS#9707) Fixed slapd syncrepl to reject REFRESH for precise resync (ITS#9742) Fixed slapd syncrepl when X-ORDERED is specified (ITS#9761) Fixed slapd syncrepl to better handle out of order delete ops (ITS#9751) Fixed slapd syncrepl to correctly close connections when config is deleted (ITS#9776) Fixed slapd-mdb to update indices correctly on replace ops (ITS#9753) Fixed slapd-wt to set correct flags (ITS#9760) Fixed slapo-accesslog to fix inconsistently normalized minCSN (ITS#9752) Fixed slapo-autogroup to maintain values in insertion order (ITS#9766) Fixed slapo-constraint to maintain values in insertion order (ITS#9770) Fixed slapo-dyngroup to maintain values in insertion order (ITS#9762) Fixed slapo-dynlist compare operation for static groups (ITS#9747) Fixed slapo-dynlist static group filter with multiple members (ITS#9779) slapo-refint to maintain values in insertion order (ITS#9763) Fixed slapo-retcode to honor requested insert position (ITS#9759) Fixed slapo-syncprov memory leak (ITS#8039) Fixed slapo-syncprov to generate a more accurate accesslog query (ITS#9756) Fixed slapo-translucent to warn on invalid config (ITS#9768) Fixed slapo-unique to warn on invalid config (ITS#9767) Fixed slapo-valsort to maintain values in insertion order (ITS#9764) Documentation Fixed slapo-accesslog(5) to clarify logoldattr usage (ITS#9749) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Members of groups should be able to change user passwords. Can't find the error im mi Ldif file
by cupcake＠domayn.ch 18 Jan '22

18 Jan '22

Hi there, I can't seem to find my error in my Ldif file. I have an openLDAP server and I'd like to change the config, that every member of the group sys_allow_pw_change is able to change the password of every user. It's been a while since I've last used openLDAP. I got the current ACLs using ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b \ > cn=config '(olcDatabase={1}mdb)' olcAccess dn: olcDatabase={1}mdb,cn=config olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * none olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to * by * read So I've created pwchange.ldif with the help of this serverfault post (https://serverfault.com/questions/1064914/q-what-is-the-correct-way-to-add-…): dn: olcDatabase={1}mdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=userPassword by self write by dn="cn=admin,dc=ldap,dc=example,dc=com" manage by dn="[cn=sys_allow_pw_change,ou=Groups,dc=ldap,dc=example,dc=com]/memberUid & user/uid" write by anonymous auth by * none - add: olcAccess olcAccess: {1}to attrs=shadowLastChange by self write by * read - add olcAccess olcAccess: {2}to * by * read So I'm adding the group in question to olcAccess{0} and re adding all the current config. However: ldapmodify -a -x -D "cn=admin,dc=ldap,dc=example,dc=com" -w Passw0rd! -H ldap:// -f pwchange.ldif results in ldapmodify: invalid format (line 9) entry: "olcDatabase={1}mdb,cn=config" (Line 9 is by * none) Thanks for any pointers!

2 7

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') (CWE ID 90)
by chinnac412＠gmail.com 17 Jan '22

17 Jan '22

I am Using SearchControls constraints = new SearchControls(); NamingEnumeration answer = ctx.search("DC=YourDomain,DC=com", "sAMAccountName=" + username, constraints); when i Run the Varacode Dynamic scan i am getting the Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') when i debug i can see { constraints } is printing Special Characters like example ( specila@345678) so any solution or else any other alternate way to use instead of SearchControls

2 1

OPENLDAP_2.200 is this equivalent to openldap 2.6 version?
by thrivikram.rage＠gmail.com 13 Jan '22

13 Jan '22

Hi There , After building openldap 2.6 , i have noticed "OPENLDAP_2.200" when i grep for openldap version. is this correct version ?, can you please confirm.

2 1

mmr of cn=config with OpenLDAP 2.6
by Stefan Kania 11 Jan '22

11 Jan '22

Hi to all, is it now save to use mmr of cn=config with OpenLDAP 2.6? I got it running with 4 server. I'm installing all 4 server with Ansible so I created a basic configuration: ------------------ dn: cn=config objectClass: olcGlobal cn: config olcLogLevel: sync olcLogLevel: stats olcPidFile: /var/symas/run/slapd.pid olcArgsFile: /var/symas/run/slapd.args olcToolThreads: 1 olcServerID: 4 dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema # Read all needed schema from variable in default/main.yml include: file:///opt/symas/etc/openldap/schema/core.ldif include: file:///opt/symas/etc/openldap/schema/cosine.ldif include: file:///opt/symas/etc/openldap/schema/nis.ldif include: file:///opt/symas/etc/openldap/schema/inetorgperson.ldif include: file:///opt/symas/etc/openldap/schema/dyngroup.ldif include: file:///opt/symas/etc/openldap/schema/kerberos.openldap.ldif # Read all modules from variable in default/main.yml dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /opt/symas/lib/openldap olcModuleLoad: back_mdb olcModuleLoad: back_monitor olcModuleLoad: autoca.la olcModuleLoad: otp.la olcModuleLoad: argon2.la olcModuleLoad: syncprov olcModuleLoad: back_monitor olcModuleLoad: accesslog.la dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcSizeLimit: 500 olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth manage by * break olcAccess: {1}to dn="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcPasswordHash: {ARGON2} dn: olcBackend={0}mdb,cn=config objectClass: olcBackendConfig olcBackend: {0}mdb dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4 olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth manage by dn.exact=uid=ldap-admin,ou=users,dc=example,dc=net write by * break dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to dn.subtree="cn=monitor" by dn.exact=cn=admin,cn=config read by dn.exact=cn=admin,dc=example,dc=net read dn: olcDatabase={2}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcmdbConfig olcDatabase: {2}mdb olcSuffix: dc=example,dc=net olcRootDN: cn=admin,dc=example,dc=net olcRootPW: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4 olcSizeLimit: unlimited olcTimeLimit: unlimited olcDbCheckpoint: 512 30 olcDbDirectory: /var/symas/openldap-data olcDbIndex: default eq olcDbIndex: objectClass olcDbIndex: entryUUID olcDbIndex: entryCSN olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: mail pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbIndex: description pres,eq,sub olcDbIndex: title pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbMaxSize: 85899345920 olcAccess: {0} to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth manage by dn.exact=uid=ldap-admin,ou=users,dc=example,dc=net write by dn.exact=uid=repl-user,ou=users,dc=example,dc=net read by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcAccess: {3} to attrs=userPassword by anonymous auth by self write by * none olcLimits: {0} dn.exact="uid=repl-user,ou=users,dc=example,dc=net" time=unlimited size=unlimited olcLimits: {1} dn.exact="uid=ldap-admin,ou=users,dc=example,dc=net" time=unlimited size=unlimited ------------------ The "ServerID" is different for every server, every thing else is identical. Then I created a file to change the serverID: ------------------ dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://ldap01.example.net olcServerID: 2 ldap://ldap02.example.net olcServerID: 3 ldap://ldap03.example.net olcServerID: 4 ldap://ldap04.example.net ------------------ and a file to configure the replication: ------------------ dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify replace: olcSyncRepl olcSyncRepl: rid=1 provider=ldap://ldap01.example.net binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 20" timeout=1 starttls=yes olcSyncRepl: rid=2 provider=ldap://ldap02.example.net binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 20" timeout=1 starttls=yes olcSyncRepl: rid=3 provider=ldap://ldap03.example.net binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 20" timeout=1 starttls=yes olcSyncRepl: rid=4 provider=ldap://ldap04.example.net binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 20" timeout=1 starttls=yes - add: olcMirrorMode olcMirrorMode: TRUE ------------------ When I configure the server via Ansible (everything in one playbook) the replication of cn=config is not working. When I only do the basic configuration via Ansible and then add the change of serverID and then the replication of cn=config step by step on every single server: ------------- ldapmodify -Y EXTERNAL -H ldapi:/// -f serverid.ldif ldapmodify -Y EXTERNAL -H ldapi:/// -f repl_config.ldif ------------- everything is fine. The two files "serverid.ldif" and "repl_config.ldif" are the files Ansible created, so the content of the file is the same. Can it be, that the problem is because Ansible first sets all the ServerIDs on all servers and then configure the replication of cn=config on all servers? For setting up the configuration I took: https://www.openldap.org/devel/admin/replication.html Starting at 18.3.3 What I don't understand: Do I realy have to put all Servers in the replication, even the server it self? So do I realy have to add on Server-01, the Server "server-01, server-02, server-03 ,server-04" to the replication? Dosn't it mean that server-01 is replicating to it self? If it's correct, can someone explain why? O did I understud something wrong on the webpage? Stefan

3 12

Help on building and configuring openLdap V2.6.0
by Stampfl, Burt 06 Jan '22

06 Jan '22

Hi, I'm new to OpenLDAP. Pulled down the current 2.6 release to a Debian target and am having trouble figuring out how to build the backend modules for dynamic use. What I did: 1. Downloaded openldap-2.6.0.tgz and extracted the source on my Debian target. 2. configured the 'build' via (output indicated it was successful) : ./configure --enable-sql=no --enable-wt=no --enable-spasswd=yes --enable-passwd=yes --enable-perl=yes --enable-crypt=yes --enable-ldap=yes --enable-slapd=yes --enable-ppolicy=yes --enable-otp=yes --enable-auditlog=yes --enable-modules=yes --with-cyrus-sasl=yes 3. ran 'make depend' (output indicated it was successful). 4. ran 'make' (output indicated it was successful). 5. ran the tests via 'env SLAPD_DEBUG=1 make test' (output indicated it was successful). 6. Installed it via 'su root -c 'make install' I was able to pretty easily get the slapd server running, create a database (mdb) add users, etc, and access via a remote client. Once I was able to do that I wanted to enable the ppolicy backend/overlay and have not been able to get this to work. Looking online it appears I need some 'backend' modules like back-mdb.la, ppolicy.la, etc and I cannot find them anywhere in my build tree. I had thought the --enable-xxx directives I used in the config step would have forced this to build them, but I guess not. How do I create these dynamic backend modules and is there any documentation on how to use them in the newer dynamic configuration schema ? I've attached a file with the output from the steps I performed above. Thank you Burt Burt Stampfl AMSC (NASDAQ: AMSC) W231 N2844 Roundy Circle Suite D, Pewaukee, WI 53072 USA Work: +1 262.901.6007 Mobile: +1 847.638.1792 burt.stampfl(a)amsc.com<mailto:burt.stampfl@amsc.com> amsc.com<http://www.amsc.com/> [Description: Description: cid:image001.jpg@01CC890F.E40B1CB0] "This e-mail message and any attachments are confidential and may be privileged. If you are not the intended recipient please notify AMSC immediately by replying to this message or by sending a message to postmaster(a)amsc.com and destroy all copies of this message and any attachments. Thank you."

2 1

Error with slapadd & syncrepl ldif file
by David White 06 Jan '22

06 Jan '22

At last, I'm trying to setup a consumer to replicate data off of a primary ldap server running the Symas-provided v2.6 packages on Ubuntu 20.04. The following links were very helpful to me: https://openldap-software.0penldap.narkive.com/VEt6vIEI/syncrepl-ldif-kicks… https://www.openldap.org/pub/hyc/LDAPcon2007s.pdf I have built an ldif file that I'm trying to slapadd. But when the binddn contains anything other than "cn" attributes, slapadd produces an error. My Question: Why can I not use a binddn that contains anything other than "cn" attributes, like "uid", "dc", or "ou"? Specific details with debug below: The following works perfectly fine: root@ldapconsumer:/opt/symas/etc/openldap# /opt/symas/sbin/slapadd -l /home/myself/ldap/consumer_sync.ldif -F /opt/symas/etc/openldap/slapd.d/ -w -n0 Closing DB.. root@ldapconsumer:/opt/symas/etc/openldap# cat /home/myself/ldap/consumer_sync.ldif dn: cn=config objectClass: olcGlobal cn: config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: secret olcSyncRepl: rid=001 provider=ldap://172.16.2.5 binddn="cn=admin,cn=example,cn=com" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" Alternatively, this works as the binddn: cn=ldap.sync,cn=example,cn=com But the following values in the binddn do NOT work: - binddn=cn=ldap.sync,dc=example,dc=com - binddn=uid=sync,ou=People,dc=example,dc=com In either of the examples above that do NOT work, I'm getting an "invalid bind config value" error message. See below for full stdout with 1 example: root@ldapconsumer:/opt/symas/etc/openldap# /opt/symas/sbin/slapadd -l /home/myself/ldap/consumer_sync.ldif -F /opt/symas/etc/openldap/slapd.d/ -w -n0 invalid bind config value binddn=uid=ldap.sync,ou=People,dc=example,dc=com olcSyncrepl: value #0: Error: parse_syncrepl_line: unable to parse "binddn=uid=ldap.sync,ou=People,dc=example,dc=com" . failed to add syncinfo slapadd: could not add entry dn="olcDatabase={0}config,cn=config" (line=5): Error: parse_syncrepl_line: unable to parse "binddn=uid=ldap.sync,ou=People,dc=example,dc=com" Closing DB... If I run this with debug enabled, below is what I see (not sure if this will be helpful or not, but am providing it just in case). Password has been redacted of course. root@ldapconsumer:/opt/symas/etc/openldap# /opt/symas/sbin/slapadd -l /home/myself/ldap/consumer_sync.ldif -F /opt/symas/etc/openldap/slapd.d/ -w -n0 -d -1 slapadd init: initiated tool. slap_sasl_init: initialized! backend_startup_one: starting "cn=config" ldif_read_file: no entry file "/opt/symas/etc/openldap/slapd.d//cn=config.ldif" send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=32 matched="" text="" >>> dnNormalize: <cn=Subschema> <<< dnNormalize: <cn=subschema> matching_rule_use_init {snip} slapadd startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open Backend ACL: access to * by * none config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context config_back_db_open: No explicit ACL for back-config configured. Using hardcoded default => str2entry: "dn: cn=config objectClass: olcGlobal cn: config " >>> dnPrettyNormal: <cn=config> <<< dnPrettyNormal: <cn=config>, <cn=config> <= str2entry(cn=config) -> 0x5574eedc21b8 oc_check_required entry (cn=config), objectClass "olcGlobal" oc_check_allowed type "objectClass" oc_check_allowed type "cn" oc_check_allowed type "structuralObjectClass" ldif_write_entry: wrote entry "cn=config" => str2entry: "dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: secret olcSyncRepl: rid=001 provider=ldap://172.16.2.5 binddn="uid=ldap.sync,ou=People,dc=example,dc=com" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5"" >>> dnPrettyNormal: <olcDatabase={0}config,cn=config> <<< dnPrettyNormal: <olcDatabase={0}config,cn=config>, <olcDatabase={0}config,cn=config> >>> dnNormalize: <cn=admin,cn=config> <<< dnNormalize: <cn=admin,cn=config> <= str2entry(olcDatabase={0}config,cn=config) -> 0x5574eedc2258 oc_check_required entry (olcDatabase={0}config,cn=config), objectClass "olcDatabaseConfig" oc_check_allowed type "objectClass" oc_check_allowed type "olcDatabase" oc_check_allowed type "olcRootDN" oc_check_allowed type "olcRootPW" oc_check_allowed type "olcSyncrepl" oc_check_allowed type "structuralObjectClass" config_build_entry: "olcDatabase={-1}frontend" slap_get_csn: conn=-1 op=0 generated new csn=20220106202401.439197Z#000000#000#000000 manage=0 ldif_read_file: read entry file: "/opt/symas/etc/openldap/slapd.d//cn=config.ldif" => str2entry: "# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 fd732ca0 dn: cn=config objectClass: olcGlobal cn: config structuralObjectClass: olcGlobalentryUUID: 54643148-037a-103c-8b74-e78e18fa89a5 creatorsName: cn=config createTimestamp: 20220106202401Z entryCSN: 20220106202401.438467Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20220106202401Z " >>> dnPrettyNormal: <cn=config> <<< dnPrettyNormal: <cn=config>, <cn=config> >>> dnNormalize: <cn=config> <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> <<< dnNormalize: <cn=config> <= str2entry(cn=config) -> 0x5574eedc22f8 ldif_write_entry: wrote entry "olcDatabase={-1}frontend,cn=config" >>> dnPrettyNormal: <cn=admin,cn=config> <<< dnPrettyNormal: <cn=admin,cn=config>, <cn=admin,cn=config> >>> dnPrettyNormal: <cn=admin,cn=config> <<< dnPrettyNormal: <cn=admin,cn=config>, <cn=admin,cn=config> >>> dnNormalize: <uid=ldap.sync,ou=People,dc=example,dc=com> invalid bind config value binddn=uid=ldap.sync,ou=People,dc=example,dc=com olcSyncrepl: value #0: Error: parse_syncrepl_line: unable to parse "binddn=uid=ldap.sync,ou=People,dc=example,dc=com" . failed to add syncinfo syncinfo_free: rid=001 slapadd: could not add entry dn="olcDatabase={0}config,cn=config" (line=5): Error: parse_syncrepl_line: unable to parse "binddn=uid=ldap.sync,ou=People,dc=example,dc=com" slapadd shutdown: initiatedslapadd destroy: freeing system resources. Sent with ProtonMail Secure Email.

1 0

OpenLDAP's UB minefield
by openldap-technical＠kolttonen.fi 06 Jan '22

06 Jan '22

Someone recently wrote on openldap-bugs: > The kernel recently got bitten using the same pattern of unaligned > short pointers through casts. GCC produced code which corrupted > initramfs during unpacking. > > See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D100363. > OpenLDAP should fix that code. Correct. That's what I said long time ago, too. I wonder if OpenLDAP projects' delusions about Undefined Behaviour "not being a bug" still persist, or are they perhaps going to fix their buggy code? What a minefield to walk on, it can blow up anytime. I am very happy to not have to administer this server code anymore, but I sure am scared for those who do. best regards, Unto Sten

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical