openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

Rebuild openldap so all modules/overlays are separate
by Chris Jacobs 02 Dec '10

02 Dec '10

Main question: how to build openldap with all overlays as dynamically loaded modules (ie: optional). Why? These problems have been covered before, recently even. I'm trying to get Solaris 9/10 clients talking to openldap server. I can do getent passwd <user> but getent passwd or getent group or even ldaplist all fail. I haven't had any success with Benjamin's acl fix/work around, or configuring the overlay for sssvlv in slapd.conf. So, I thought I'd recompile openldap - without sssvlv support, but then I thought why have to do this again in the future if I find another incompatibility? I'd prefer to simply have all overlays/modules as separate loadable modules. When I compiled OpenLDAP, I configured it with: ./configure --with-tls=openssl \ --enable-crypt \ --enable-dynamic \ --enable-ldap \ --enable-lmpasswd \ --enable-modules \ --enable-overlays \ --enable-spasswd \ --sysconfdir=/etc The enable-overlays option builds in a number of overlays I use and am interested in using in the future - however, it also enables sss/vlv. I supposed I could try to build it again with that option followed by --disable-sssvlv but what I'd really prefer is a way to build openldap with the overlays as separate modules that I can load/unload when/as I need them. I've searched the documentation, but I can't figure out how. It's quite likely I haven't looked in the right spot. I'm currently trying to make my way through the configure script... Blech. Thanks for any pointers, - chris Chris Jacobs, Systems Administrator, Information Technology & Operations Apollo Group | Apollo Marketing | Aptimus, Inc. 2001 6th Ave | Ste 3200 | Seattle, WA 98121 phone: 206.839-8245 | cell: 206.601.3256 | Fax: 208.441.9661 email: chris.jacobs(a)apollogrp.edu This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

4 4

Re: Want interesting restrictions to ldap auth on different servers to different users
by c0re 01 Dec '10

01 Dec '10

2010/11/19 Phuong Marie VUONG <mangocphung(a)gmail.com>: > Hello, > > First, im sorry about my English. I share here my experience which worked > for limit acces host/group of host for user... > > In the configuration of ldap client /etc/ldap.conf , i have activate the > host attribute and a filter in nss_base_passwd > pam_check_host_attr yes > nss_base_passwd > ou=People,dc=xxxxx,dc=xxxx?one?|(host=hostname.domain)(host=PatternofHostGroup)(host=*) > > In the user entry, add the host attribute > And in the host set, you can put the pattern value correpond of the level > that you want to authorize to connect , for exe : > hostname.domain > or > PatternofHostGroup > or > * > > Hope that can help > > > 2010/11/19 c0re <nr1c0re(a)gmail.com> >> >> can you give an example of usage pam_check_host_attr? >> >> And how can I use group of hosts and assign user to this group to >> permit access user to this group avoiding enumerating hosts in users >> dn each time I add new user? >> >> What should I set in "host:"? Hostname of server? How host attr are >> sent to pam_ldap? >> >> 2010/11/18 Aaron Richton <richton(a)nbcs.rutgers.edu>: >> > On Thu, 18 Nov 2010, c0re wrote: >> > >> >> I mean user user1 can must login only on server1,server2 and server3. >> >> And user2 can login only on server5 and server2. >> > >> > You could probably overload almost anything (dyngroups, OpenLDAP ACLs, >> > search filters, who knows) to accomplish this, but the cleanest way to >> > do >> > this in pam_ldap would utilize pam_check_host_attr. I assume pam_ldap >> > because you mentioned "pam_groupdn" which is not an OpenLDAP >> > configuration >> > directive. >> > > > > > -- > Milan&Phuong > 06.17.34.09.77 > 09.53.57.04.94 > http://www.phuong.fr/photos/ > > > I moved a bit different way. I used pam_groupdn in ldap.conf and created a group for each server. Now if I add user to ldap, I need to add to groups "memberUid: `userdn`". And user will be able to login to those servers in which groups is user as a member. But if I got 100-200 servers and want to give access to new user to all this servers, I should add user to all groups. Of course it's a waste of time and it's possible to be done via some external shell/perl script, but may be there another way in openldap? pam_check_host_attr do almost same. If I add user - I need to add all hosts to user attr "host:". So it's same work I think.

2 2

ssf settings on server restart
by Christian Bösch 01 Dec '10

01 Dec '10

hi, i have an acl set to allow only some ips to connect unencrypted: {0}to dn.children="dc=abc,dc=net" by peername.ip=10.10.40.100 read break by peername.ip=10.10.8.49 read break by ssf=128 read break by * none olcSecurity: ssf=0 tls=0 simple_bind=0 update_ssf=0 this works in general, but if i restart slapd i get from the defined ips from above 'confidentially required'. then i have to set ssf=1 then back to ssf=0 to make it work again? anyone an idea why? /thx.chris

2 6

ACL based on superior entry
by Michael Ströder 01 Dec '10

01 Dec '10

HI! Is it possible to grant access in an ACL by a certain attribute value of the superior entry? I'd like to be able to disable bind for users based on a status flag in the container entry under which all user entries reside. Ciao, Michael.

2 2

RE: ldap crashing once under load
by Francis, Steve (IHG) 30 Nov '10

30 Nov '10

I see this in the config via : ldapsearch -Y external -H ldapi:/// -b cn=config olcRootDN: cn=Admin,o=SAH olcRootPW: {SSHA}VIYAj8/mu1iPhyrClvWqRUKJFrhZRFdKSQ== olcDbCacheSize: 10000 olcDbCheckpoint: 1024 5 olcDbConfig: {0}set_cachesize 0 15000000 1 olcDbConfig: {1}set_lg_regionmax 262144 olcDbConfig: {2}set_lg_bsize 2097152 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbIDLcacheSize: 30000 Do these need to be adjusted? Thanks, Steve Francis Technical Advisor - zSeries, zLinux, z/OS IHG Alpharetta Data Center Ph: 770-442-7157 Cell: 770-906-3122 IM: francisihg "Life's tough...It's even tougher if you're stupid!!" John Wayne ________________________________ From: Francis, Steve (IHG) Sent: Wednesday, December 01, 2010 12:57 AM To: openldap-technical(a)openldap.org Subject: ldap crashing once under load hello, I just recently migrated an exsiting app that uses an LDAP server on z/OS with no issues, to a SLES 11.1 server on a z10 processor using OpenLdap, and get the following error. Nov 30 23:15:50 adczlnxldapp1 slapd[15854]: slapd starting Nov 30 23:25:39 adczlnxldapp1 slapd[15854]: ch_malloc of 16777216 bytes failed I have at least 1gb memory assigned to the linux instance. Is there something I can do to correct this. I have temporarily pointed the app to use the z/OS LDAP server and all is fine....Our intent is to completely move this to zLinux and get off the z/OS LDAP server. Steve Francis Technical Advisor - zSeries, zLinux, z/OS IHG Alpharetta Data Center Ph: 770-442-7157 Cell: 770-906-3122 IM: francisihg "Life's tough...It's even tougher if you're stupid!!" John Wayne

1 0

ldap crashing once under load
by Francis, Steve (IHG) 30 Nov '10

30 Nov '10

hello, I just recently migrated an exsiting app that uses an LDAP server on z/OS with no issues, to a SLES 11.1 server on a z10 processor using OpenLdap, and get the following error. Nov 30 23:15:50 adczlnxldapp1 slapd[15854]: slapd starting Nov 30 23:25:39 adczlnxldapp1 slapd[15854]: ch_malloc of 16777216 bytes failed I have at least 1gb memory assigned to the linux instance. Is there something I can do to correct this. I have temporarily pointed the app to use the z/OS LDAP server and all is fine....Our intent is to completely move this to zLinux and get off the z/OS LDAP server. Steve Francis Technical Advisor - zSeries, zLinux, z/OS IHG Alpharetta Data Center Ph: 770-442-7157 Cell: 770-906-3122 IM: francisihg "Life's tough...It's even tougher if you're stupid!!" John Wayne

1 0

syncrepl with accesslog not replicating
by Dieter Klünter 30 Nov '10

30 Nov '10

Hi, I am facing a problem with OpenLDAP-2.4.23. That is I am trying to setup a delta replication based on accesslog. Although the accesslog database contains new entries and the log database is successfully read, no replication ever takes place, while a setup without accesslog replicates successfully. An excerpt from the systemlogs: slapd[19170]: conn=1050 fd=20 ACCEPT from IP=192.168.0.8:41487 (IP=0.0.0.0:389) slapd[19170]: conn=1050 op=0 EXT oid=1.3.6.1.4.1.1466.20037 slapd[19170]: conn=1050 op=0 STARTTLS slapd[19170]: conn=1050 op=0 RESULT oid= err=0 text= slapd[19170]: conn=1050 fd=20 TLS established tls_ssf=256 ssf=256 slapd[19170]: conn=1050 op=1 BIND dn="" method=163 slapd[19170]: conn=1050 op=1 BIND authcid="cn=replicator,o=avci,c=de" authzid="cn=replicator,o=avci,c=de" slapd[19170]: conn=1050 op=1 BIND dn="cn=replicator,o=avci,c=de" mech=EXTERNAL sasl_ssf=0 ssf=256 slapd[19170]: conn=1050 op=1 RESULT tag=97 err=0 text= slapd[19170]: conn=1050 op=2 SRCH base="cn=log" scope=2 deref=0 filter="(&(objectClass=auditWriteObject)(reqResult=0))" slapd[19170]: conn=1050 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN slapd[19170]: conn=1050 op=2 SEARCH RESULT tag=101 err=0 nentries=7 text= slapd[19170]: conn=1050 op=3 UNBIND slapd[19170]: conn=1050 fd=20 closed A ldapsearch -Y EXTERNAL -ZZ -H ldap://localhost -b cn=log -s one "(&(objectClass=auditWriteObject)(reqResult=0))" provides the expected results, an example # 20101129144212.000003Z, log dn: reqStart=20101129144212.000003Z,cn=log objectClass: auditModify reqStart: 20101129144212.000003Z reqEnd: 20101129144212.000004Z reqType: modify reqSession: 1007 reqAuthzID: cn=admanager,o=avci,c=de reqControls: {0}{2.16.840.1.113730.3.4.18 controlValue "646O3K636O3N61646N616O 616765722M6P3N617663692M633N6465"} reqDN:: Y249U2Now6RmZXIgV29sZmdhbmcsb3U9YWRyZXNzYnVjaCxvPWF2Y2ksYz1kZQ== reqResult: 0 reqMod: sn:- Wolfgang reqMod: sn:+ Schaefer reqMod: entryCSN:= 20101129144212.353910Z#000000#000#000000 reqMod: modifiersName:= cn=admanager,o=avci,c=de reqMod: modifyTimestamp:= 20101129144212Z The relevant config files can be found here: Provider slapd.conf: http://pastebin.de/12273 Consumer slapd.conf: http://pastebin.de/12275 -Dieter -- Dieter Kl�nter | Systemberatung sip: 7770535(a)sipgate.de http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

3 11

slapcat segfaults when ppolicy overlay added
by Ryan Steele 30 Nov '10

30 Nov '10

I've been trying, unsuccessfully, to set up ppolicy in my installation (2.4.21 on Ubuntu). As soon as I set up the overlay (before I even configure a user with a password policy or set up a default policy), slapcatting the database results in a segmentation fault. I tried it on 2.4.23 and 2.4.17 with the same results. Here is the configuration I'm using, and a backtrace from the 2.4.21 installation: dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb.la olcModuleLoad: {1}autogroup.la olcModuleLoad: {2}syncprov.la olcModuleLoad: {3}smbk5pwd.la olcModuleLoad: {4}ppolicy.la dn: olcOverlay={3}ppolicy objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {3}ppolicy olcPPolicyHashCleartext: FALSE olcPPolicyUseLockout: TRUE olcPPolicyForwardUpdates: FALSE structuralObjectClass: olcPPolicyConfig (gdb) run Starting program: /usr/sbin/slapcat -n1 [Thread debugging using libthread_db enabled] Program received signal SIGSEGV, Segmentation fault. 0x00007ffff242d840 in ppolicy_restrict (op=0x7fffffffd710, rs=0x7fffffffd670) at /usr/src/openldap/openldap-2.4.21/servers/slapd/overlays/ppolicy.c:1271 1271 /usr/src/openldap/openldap-2.4.21/servers/slapd/overlays/ppolicy.c: No such file or directory. in /usr/src/openldap/openldap-2.4.21/servers/slapd/overlays/ppolicy.c (gdb) backtrace #0 0x00007ffff242d840 in ppolicy_restrict (op=0x7fffffffd710, rs=0x7fffffffd670) at /usr/src/openldap/openldap-2.4.21/servers/slapd/overlays/ppolicy.c:1271 #1 0x00007ffff7f6ed3a in overlay_op_walk (op=0x7fffffffd710, rs=0x7fffffffd670, which=<value optimized out>, oi=0x7ffff8320fc0, on=0x7ffff8340d50) at /usr/src/openldap/openldap-2.4.21/servers/slapd/backover.c:659 #2 0x00007ffff7f6f8ab in over_op_func (op=0x7fffffffd710, rs=0xfffffffffffffff0, which=4294957776) at /usr/src/openldap/openldap-2.4.21/servers/slapd/backover.c:721 #3 0x00007ffff2a4b141 in autogroup_db_open (be=<value optimized out>, cr=<value optimized out>) at autogroup.c:1754 #4 0x00007ffff7f6e994 in over_db_open (be=<value optimized out>, cr=0x7fffffffdfc0) at /usr/src/openldap/openldap-2.4.21/servers/slapd/backover.c:155 #5 0x00007ffff7f1388c in backend_startup_one (be=0x7ffff8314e80, cr=0x7fffffffdfc0) at /usr/src/openldap/openldap-2.4.21/servers/slapd/backend.c:224 #6 0x00007ffff7f13a83 in backend_startup (be=0x7ffff8314e80) at /usr/src/openldap/openldap-2.4.21/servers/slapd/backend.c:278 #7 0x00007ffff7f742cc in slap_tool_init (progname=<value optimized out>, tool=2, argc=2, argv=0x7fffffffe5b8) at /usr/src/openldap/openldap-2.4.21/servers/slapd/slapcommon.c:780 #8 0x00007ffff7f7335a in slapcat (argc=-9520, argv=<value optimized out>) at /usr/src/openldap/openldap-2.4.21/servers/slapd/slapcat.c:51 #9 0x00007ffff7ee84f5 in main (argc=2, argv=0x7fffffffe5b8) at /usr/src/openldap/openldap-2.4.21/servers/slapd/main.c:657 As soon as I remove olcOverlay={3}ppolicy from the backend database, the problem disappears. The configuration isn't anything special so I don't think it's a misconfiguration issue, but I figured I'd get a second opinion from the list before submitting this issue as a bug to the ITS. As always, all advice and input is appreciated. -Ryan

2 3

cn=config and authz-regexp
by Julien Vehent 30 Nov '10

30 Nov '10

Hi list, I'm moving a LDAP directory on a freshly installed Debian Squeeze and I'm discovering cn=config. On my former installation, I have SASL configured using : --- authz-regexp "^uid=([^,]+).*,cn=[^,]*,cn=auth$" "ldap:///dc=domain,dc=net??sub?(uid=$1)" authz-policy to password-hash {CLEARTEXT} --- How do I translate this into cn=config directives ? I believe it should be stored into /etc/ldap/slapd.d/cn=config/olcDatabase\=\{1\}hdb.ldif is that correct ? Thanks, Julien

2 2

RE: Problems Enabling Authentication using Cyrus SASL
by Fernando Torrez 29 Nov '10

29 Nov '10

Hi all I got work sasl authentication to access ldap server by correcting two things: 1.- inserting the proxyuser's userpassword in clear text (userPassord=secret) 2.- fixing the proxyuser's authzTo atributte to authzTo: ldap:///ou=people,dc=plainjoe,dc=org??sub?(objectClass=account) (results at the end of this mail) As far as it can be seen, there's no need for cyrus-sasl for these matter but my final purpose is to enable Cyrus-sasl with openldap as backend to authenticate users for cyrus-imapd and postfix services. Any hints would be appreciated. Thanks to all for your support Fernando firewall:~ # ldapwhoami -U proxyuser -X u:test -Y digest-md5 SASL/DIGEST-MD5 authentication started Please enter your password: SASL username: u:test SASL SSF: 128 SASL data security layer installed. dn:uid=test,ou=people,dc=plainjoe,dc=org firewall:~ # ldapsearch -Y digest-md5 -U proxyuser -b 'dc=plainjoe,dc=org' '(objectclass=*)' SASL/DIGEST-MD5 authentication started Please enter your password: SASL username: proxyuser SASL SSF: 128 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <dc=plainjoe,dc=org> with scope subtree # filter: (objectclass=*)

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical