openldap-technical

openldap-technical@openldap.org

11 participants
9876 discussions

how to analysis openldap log
by owen nirvana 14 Dec '10

14 Dec '10

I could not find apis for analysising log. Thanks for help! gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com>

2 1

Openldap occasional hunging
by Nick Milas 14 Dec '10

14 Dec '10

Hi, I am experiencing the following problem: Occasionally but consistently (about once a month), one of my ldap servers will hung - usually after some entry update. I find out the hung due to problems with the services which are dependent on ldap (mail, dns, see below). The question is: Why does this happen, and how can I avoid it? All servers are production systems, and need maximum reliability. When the problem occurs, I need to stop ldap service. If I try to start it again, I get: Checking configuration files for slapd: bdb_db_open: unclean shutdown detected; attempting recovery. bdb_db_open: Recovery skipped in read-only mode. Run manual recovery if errors are encountered. Then (as I have found from researching the problem), I must issue (as root): # service ldap stop # slapd_db_recover -v -h /var/lib/ldap ... # slapindex # chown ldap:ldap /var/lib/ldap/* # service ldap start Then, everything works fine again. My setup is: one master (provider) openldap server (where all modifications take place) with 3 slaves (consumers), one of which is used with postfix/dovecot, and the other two with powerdns (ldap backend). Sync is being done with syncrepl, type=refreshAndPersist. Modifications are carried out using phpLDAPadmin (1.0.7), JXplorer, and other custom php scripts. The DIT is small (less than 2000 entries in total) and DIT changes are relatively few (max ~50 modifications per day, sometimes no modifications are made for several days). The hung can occur to anyone of the ldap servers (either master or slave), with the same frequency (about once per month)! One of the servers is affected each time. All servers run CentOS 5.5 with the latest openldap packages available: 2.3.43-12.el5_5.3. BDB: # slapd_db_upgrade -V Sleepycat Software: Berkeley DB 4.4.20: (January 10, 2006) I wonder: Could such a database corruption problem occur in case: 1. An entry is being modified at the same time as it is being read by another process? 2. An entry is being modified "concurrently" by two different connected clients? Could the problem be resolved with upgrading to a more recent openldap/bdb version? Can anyone suggest RPM (RHEL5 or Centos 5) packages to use safely (with TLS, cyrus-sasl, slapi, overlays=mod, plugins, modules) ? Thanks in advance, Nick

1 0

How to rename the BASE DN?
by Anton Chu 14 Dec '10

14 Dec '10

How do I rename my base dn due to my domain name change? I'm using the latest openldap run time configuraiton.

4 4

Duplicate DN records, sometimes..
by Jorgen Lundman 13 Dec '10

13 Dec '10

openldap-2.4.23 db-4.8.30.NC Solaris 10u8 x86 We use LDAP for many things, including DNS. We've had an intermittent issue where doing a ldap subtree (recursive) delete would fail. I dug deeper, and found that it would die with NO SUCH OBJECT. Curiously, it was not lying. Or rather, the LDAP Search to determine the objects to delete would return duplicate for the "@" entry. - Found 9 service entries in subtree DNSZoneName=reger.jorgen.jp,ou=dns: 1 DNSHostName=(a),DNSZoneName=reger.jorgen.jp,ou=dns 2 DNSHostName=(a),DNSZoneName=reger.jorgen.jp,ou=dns etc. What would then happen, is that the #1 deletion would succeed (and delete both entries). After which it would try to delete #2 and receive NO SUCH OBJECT. I created a new (many many new) domains, and did a command-line ldapsearch: /usr/local/bin/ldapsearch -h 172.20.12.113 -b DNSZoneName=fun.jorgen.jp,ou=dns # fun.jorgen.jp, dns, dn: DNSZoneName=fun.jorgen.jp,ou=dns objectClass: DNSZone DNSZoneName: fun.jorgen.jp # @, fun.jorgen.jp, dns dn: DNSHostName=(a),DNSZoneName=fun.jorgen.jp,ou=dns objectClass: DNSHost DNSHostName: @ # @, fun.jorgen.jp, dns dn: DNSHostName=(a),DNSZoneName=fun.jorgen.jp,ou=dns objectClass: DNSHost DNSHostName: @ How curious. I peppered the perl code with the same ldapsearch to try to determine where the duplicate DN was (accidentally?) created. I found that if I had this: ldapdb::CreateSOA($domain,$serial,28800, 7200, 604800, $ttl, "hostmaster.$domain.", "dns01.company.com."); system("/usr/local/bin/ldapsearch -h $ldap_host_dns DNSZoneName=$domain,ou=dns"); ldapdb::AddRecord($domain, "NS", "@", "dns01.company.com."); The duplicate records were no longer created. By simply having an LDAP search between the creation of the tree, the error went away. Does anyone know what is actually going on here? I have also found that I can create a LDAP tree, which has duplicate "@" entries. Then wait ~30mins, and the duplicate entry also, sometimes(?), goes away. But not always. The code for CreateSOA and AddRecord is relatively simple, here I have stripped out the error checking code for simplicity. ---------------------------------------------------------------------- CreateSOA(): $ldap = Net::LDAP->new($ldap_host_dns); $mesg = $ldap->bind($ldap_bind, password=>$ldap_pass); $mesg = $ldap->add("DNSZoneName=$adddomain,$ldap_base_dns", attr => [ 'objectClass' => [ 'DNSZone' ], 'DNSZoneName' => "$adddomain" ] ); $mesg = $ldap->add("DNSHostName=\@,DNSZoneName=$adddomain,$ldap_base_dns", attr => [ 'objectClass' => [ 'DNSHost' ], 'DNSHostName' => "\@" ] ); $mesg = $ldap->add("DNSRecord=SOA,DNSHostName=\@,DNSZoneName=$adddomain,$lda p_base_dns", attr => [ 'objectClass' => [ 'DNSSOARecord' ], 'DNSHostName' => "\@", 'DNSRecord' => "SOA", 'DNSType' => "soa", 'DNSSerial' => "$serial", 'DNSRefresh' => "$refresh", 'DNSRetry' => "$retry", 'DNSExpire' => "$expire", 'DNSMinimum' => "$minttl", 'DNSAdminEmail' => "$hostmaster", 'DNSPrimaryns' => "$nameserver", 'DNSTTL' => "$minttl" ] ); $ldap->unbind; ---------------------------------------------------------------------- And AddRecord: $ldap = Net::LDAP->new($ldap_host_dns); $mesg = $ldap->bind($ldap_bind, password=>$ldap_pass); $mesg = $ldap->add("DNSHostName=$name,DNSZoneName=$domain,$ldap_base_dns", attr => [ 'objectClass' => [ 'DNSHost' ], 'DNSHostName' => "$name" ] ); $ldap->unbind; ---------------------------------------------------------------------- For now, we will have the simple/pointless ldapsearch between CreateSOA and AddRecord to avoid the duplicate "@" DN entry, and in ldap delete-subtree we will ignore NO SUCH OBJECT error so that it keeps going and cleans up the domain properly. Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

1 0

Re: backend issue
by Quanah Gibson-Mount 13 Dec '10

13 Dec '10

--On Monday, December 13, 2010 7:51 PM -0200 Friedrich Locke <friedrich.locke(a)gmail.com> wrote: > Excuse me Mr. Quanah, > > but where do you download BDB 4.4.x from ? If you want help, keep your replies to the list. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Mac OS X OpenLDAP allows anonymous access to all fields
by RAT 13 Dec '10

13 Dec '10

I am experimenting with authenticating users off of OpenLDAP. The default deployment from Apple seems to be (at least in my case) completely wide open. I have been trying to find a ACI to block access to the password value. Does anyone have any good resources on this or, better yet, an ACI I can apply? Robert Threet http://yesistilluseperl.blogspot.com/ ____________________________________________________________ Obama Urges Homeowners to Refinance If you owe under $729k you probably qualify for Obama's Refi Program http://thirdpartyoffers.netzero.net/TGL3231/4d0648688b054664b76st03duc

2 1

Re: Mac OS X OpenLDAP allows anonymous access to all fields
by RAT 13 Dec '10

13 Dec '10

I have SSHA1 working, but still not comfortable with this being visible via LDAP query. http://www.openldap.org/doc/admin24/security.html What are others doing to harden the default install? Robert Threet http://yesistilluseperl.blogspot.com/ ---------- Original Message ---------- From: "RAT" <robert3t(a)netzero.net> To: openldap-technical(a)openldap.org Subject: Mac OS X OpenLDAP allows anonymous access to all fields Date: Mon, 13 Dec 2010 16:22:44 GMT I am experimenting with authenticating users off of OpenLDAP. The default deployment from Apple seems to be (at least in my case) completely wide open. I have been trying to find a ACI to block access to the password value. Does anyone have any good resources on this or, better yet, an ACI I can apply? Robert Threet http://yesistilluseperl.blogspot.com/ ____________________________________________________________ How to Fall Asleep? Cambridge Researchers have developed an all natural sleep aid just for you. http://thirdpartyoffers.netzero.net/TGL3231/4d065f00159b66954dest06duc

1 0

push replication with proxy and rwm overlay
by Gwenn Gueguen 13 Dec '10

13 Dec '10

Hi all, I'm trying to set up push replication from master to slave through a proxy with rwm overlay. Master, proxy and slave are OpenLDAP 2.4.11 from debian lenny. On the slave, I don't want samba related attributes so I used the attrs param on syncrepl to only get attributes I want but entries still have sambaSamAccount or sambaGroupMapping as objectClass. I tried using the rwm overlay to remove these references to samba in objectclass but it did not work and I still get the following error when proxy tries to add the entries on the slave: error code 0x15: objectClass: value #3 invalid per syntax Here is the proxy configuration: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/authldap.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel -1 modulepath /usr/lib/ldap moduleload back_ldap moduleload syncprov moduleload rwm database ldap suffix "..." rootdn "cn=admin,..." uri ldap://ldap-dmz # Save the time that the entry gets modified, for database #1 lastmod on #We don't need any access to this DSA restrict all overlay rwm rwm-map objectclass inetOrgPerson * rwm-map objectclass posixAccount * rwm-map objectclass shadowAccount * rwm-map objectclass organizationalPerson * rwm-map objectclass person * rwm-map objectclass posixGroup * # rwm-map objectclass sambaSamAccount # rwm-map objectclass sambaGroupMapping rwm-map objectclass * acl-bind bindmethod=simple idassert-bind bindmethod=simple binddn="cn=admin,..." credentials="secret" syncrepl rid=001 provider=ldap://ldap attrs="@inetOrgPerson,@posixAccount,@shadowAccount,@organizationalPerson,@person" bindmethod=simple searchbase="ou=people,..." type=refreshAndPersist retry="60 +" interval=00:00:01:00 schemachecking=off syncrepl rid=002 provider=ldap://ldap attrs="@posixGroup" bindmethod=simple searchbase="ou=groups,..." type=refreshAndPersist retry="60 +" interval=00:00:01:00 schemachecking=off overlay syncprov I tried upgrading OpenLdap on the proxy to 2.4.17 from backports and also upgraded to squeeze with OpenLdap 2.4.23 but I still get the error. Am I doing something wrong or is rwm buggy ? Thanks, -- Gwenn

1 1

Ordering of shadowExpire values
by Antonio Batovanja 13 Dec '10

13 Dec '10

From nis.schema: attributetype ( 1.3.6.1.1.1.1.10 NAME 'shadowExpire' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) If I add ORDERING integerOrderingMatch to shadowExpire, I can use a range filter like (&(objectclass=shadowaccount)(shadowexpire>=1000)) What else can I do to be able to use a range filter? I don't like changing standard schemas... Cheers, Toni

1 0

debugging memberOf overlay
by c0re 13 Dec '10

13 Dec '10

Hello all! Trying to get memberOf overlay working. Added to slapd.conf "overlay memberof" Restarted slapd. Checked that overlay loaded # slaptest -d 1 ............. config_build_entry: "olcOverlay={1}memberof" ............. Then added 1 user and 2 groups via ldif: dn: cn=test,ou=users,dc=domain,dc=local sn: test cn: test uid: test objectClass: inetOrgPerson objectClass: top objectClass: person objectClass: posixAccount objectClass: shadowAccount objectClass: radiusprofile uidNumber: 5555 gidNumber: 5555 homeDirectory: /home/test givenName: test loginShell: /bin/sh shadowMin: 0 shadowMax: 999 shadowWarning: 7 shadowInactive: -1 shadowExpire: 0 shadowFlag: 0 dialupAccess: yes dn: cn=testgroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: testgroup member: cn=test,ou=users,dc=domain,dc=local dn: cn=maingroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: maingroup member: cn=testgroup,ou=servers,dc=domain,dc=local And made # ldapsearch -x -D "cn=admin,dc=domain,dc=local" -b "dc=domain,dc=local" -W "(cn=test)" memberOf # extended LDIF # # LDAPv3 # base <dc=domain,dc=local> with scope subtree # filter: (cn=test) # requesting: memberOf # # test, users, domain.local dn: cn=test,ou=users,dc=domain,dc=local # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 As you see - no memberOf in users attrs. I got no ideas why... By that I wanted to test output of ldapsearch to check will there be two or one memberOf attrs. Thanks!

1 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical