openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

bindpw in SSHA/MD5/CRYPT/...
by Frederic Hornain 27 Oct '10

27 Oct '10

Dear all, For already few weeks, I search for a mean to have an encypted bindpw password in /etc/ldap.conf on my Fedora Linux Ldap client. OK, I have perfectly understood a simple bind requires that the client has the *cleartext* password. Nonetheless, it seems it exists a SASL method which could permit without using Kerberos to have this functionality. - http://www.openldap.org/lists/openldap-technical/200809/msg00145.html - If someone could give me a hand on that, I would appreciate; Thanks a lot in advance for your time and your help. Best Regards Frederic ;) ----------------------------------------------------- Fedora-ambassadors-list mailing list Fedora-ambassadors-list(a)redhat.com

2 1

LDAP Backup and Restore
by Anton Chu 26 Oct '10

26 Oct '10

Hi All, I'm in need of figuring out how I can effectively backup my ldap server then restore it in case of crisis. I have a master and consumer ldap server running in replication mode with latest ldap 2.4 version on ubuntu 10. I have an idea on backup and restore procedures but I need verification. Backup procedures: 1. /etc/init.d/slapd stop 2. tar the following directories /etc/ldap /var/lib/ldap # tar -pczf compressed.tar.gz /etc/ldap/ /var/lib/ldap/ 3. convert the configs and dit to ldif sudo slapcat -n 0 > backup/config.ldif sudo slapcat -n 1 > backup/users.ldif 4./etc/init.d/slapd start Restore procedures: 1. Reinstall a fresh vanilla ubuntu ldap server 2. untar the compessed.tar.gz to original location 3. /etc/init.d/slapd stop sudo slapadd -n 0 -l backup/config.ldif sudo slapadd -n 0 -l backup/users.ldif sudo cp backup/ldap.secret /etc/ldap.secret /etc/init.d/slapd start Just a brainstorm and I'm sure it needs revising. TIA, Anton

2 1

ldapsearch problem
by Darouichi, Aziz 26 Oct '10

26 Oct '10

Hi All, I inherited openldap-2.2.13-12.el4. that was built by a vendor few years ago, This is running in a production. I built a new openldap-2.3.43-12.el5_5.2. I run a backup of production LDIF file. Imported to the new openldap-2.3.43-12.el5_5.2. deleted all files from /var/lib/ldap except alock and DB_CONFIG file after I stopped services. I run slapadd -v -c -l backup_filename.ldif -f /etc/openldap/slapd.conf > import.log After the import is done I changed owner to be ldap. I started services. Now when I run a search for users passwords ldapsearch -x -D "cn=company,dc=company dc=edu" -w "Password" userPassword > file.txt This is the output in file.txt : # extended LDIF # # LDAPv3 # base <> with scope subtree # filter: (objectclass=*) # requesting: userPassword # # search result search: 2 result: 32 No such object # numResponses: 1 If I run same in production server I get user's passwords. Thanks

3 4

Syncrepl not replicating userPassword
by Robert Klopotoski, Jr. 26 Oct '10

26 Oct '10

Hello, I'm running into a problem with syncrepl that I hope someone can help with. I'm hoping it's a simple config problem. There was another thread similar to this one, and I have tried the solutions and still failed. Running slapd 2.4.11 on both the consumer and the provider. The provider has thousands of records with numerous attributes including 'userPassword'. The consumer got it's start from a direct copy of the database files from the provider. All existing accounts have the userPassword attribute on both the consumer and provider. Any time a new record is added to the provider, it synchronizes all attributes other than the userPassword field. The provider has an account on it "dc=replica,dc=domain,dc=edu" for the syncrepl to use from the consumer. An ldap search to the provider using this account shows that it can see userPassword: ldapsearch -x -LLL -b dc=endicott,dc=edu -W -D cn=replica,dc=endicott,dc=edu returns the dn of dn: uid=112232584,ou=Students,ou=People,dc=endicott,dc=edu including the attribute of: userPassword:: e0NSWVBUfSQxJFZ5TXdTJHJJdS85L0EvWjl6UlZnZ3lKYjNtMjE= The consumer for whatever reason is not adding this attribute to any records it syncs. All other attributes come over fine. If I do a complete cleanout of the consumer and have it start it's database directly from the provider, it does the same thing and pulls over everything but userPassword. The config of the consumer is listed below. Where could the problem lie? Thanks, Rob The config files on the consumer look like this: **** Start slapd.conf ***** include /etc/ldap/schema/core.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/endicott.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 256 modulepath /usr/lib/ldap moduleload back_bdb sizelimit 15000 tool-threads 1 backend bdb database bdb suffix "dc=endicott,dc=edu" checkpoint 512 30 rootdn "cn=admin,dc=endicott,dc=edu" rootpw password directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=endicott,dc=edu" write by dn="cn=replica,dc=endicott,dc=edu" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=endicott,dc=edu" write by dn="cn=replica,dc=endicott,dc=edu" write by * read index entryUUID eq index userPassword eq syncrepl rid=123 provider=ldap://10.1.55.196:389 type=refreshAndPersist interval=00:00:02:00 searchbase="dc=endicott,dc=edu" scope=sub attrs="*" schemachecking=off bindmethod=simple binddn="cn=replica, dc=endicott, dc=edu" credentials="password" retry="60 +" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog updateref ldap://10.1.55.196 **** end slapd.conf ****

4 5

Introducing the slapd kinit module
by Ralf Haferkamp 26 Oct '10

26 Oct '10

Hi, a few days ago I committed the new kinit plugin to the CVS tree. It's sole purpose is to have slapd request a Kerberos TGT and keep it renewed as long as slapd is running. Especially useful e.g. if your syncrepl consumer uses SASL/GSSAPI for authentication (basically all setups where slapd also acts as an LDAP client can benefit from it). So there is no need any longer to use any external tools (cron jobs, whatever) to keep the TGT refreshed. You can find the code in current CVS HEAD inside the contrib/slapd-modules/kinit directory. For details on building the plugin see the README file in the same directory. It should be possible to build the plugin against recent OpenLDAP releases. Currently it only works with the MIT variant of libkrb5, it shouldn't be too hard to add Heimdal support though. I just didn't find time yet to look into that. Feedback is appreciated. For bug reports please use the ITS. -- regards, Ralf SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)

1 0

syncrepl missing deletion records?
by Jorgen Lundman 25 Oct '10

25 Oct '10

Hello list; db-4.8.30.NC openldap-2.4.23 We have on a few occasions come across a syncrepl problem where some deletion records do not happen everywhere. Today I was looking at two such problems; Usually the procedure is to delete the old record, then add a new record. #1: deletion of A records in ou=dns ldapmaster has it deleted. ldapslave03 has it deleted. (syncrepl with ldapmaster) dns02, dns04 has it deleted. (syncrepl with ldapslave03) dns01, dns03 still has the record. (syncrepl with ldapslave03) In detail, from dns03.unix, which now has two records: dn: DNSRecord=A1,DNSHostName=(a),DNSZoneName=customer.com,ou=dns,dc=work objectClass: DNSARecord DNSRecord: A1 DNSHostName: @ DNSType: A DNSIPAddr: zz.yy.xx.ww (new IP in reverse) DNSTTL: 600 structuralObjectClass: DNSARecord entryCSN: 20101021232823.000000Z#000002#000#000000 entryUUID: a43076ee-71b6-102f-95dd-c33ccbc720c3 creatorsName: cn=admin,dc=work createTimestamp: 20101021232823Z modifiersName: cn=admin,dc=work modifyTimestamp: 20101021232823Z dn: DNSRecord=A,DNSHostName=(a),DNSZoneName=customer.com,ou=dns,dc=work objectClass: DNSARecord DNSRecord: A DNSHostName: @ DNSType: A DNSIPAddr: dd.cc.bb.aa (old IP in reverse, should have been deleted) DNSTTL: 600 structuralObjectClass: DNSARecord entryCSN: 20091225133051.000000Z#00000b#000#000000 entryUUID: 77344376-85a5-102e-9deb-dbfa8f00ebbd creatorsName: cn=admin,dc=work createTimestamp: 20091225133051Z modifiersName: cn=admin,dc=work modifyTimestamp: 20091225133051Z #2 was pretty much same situation, except this time only dns03.unix missed the deletion. There is nothing much in the logs on either dns03.unix, nor ldapslave03. But LogLevel is only set to "sync". Is this related to: http://www.openldap.org/its/index.cgi/Software Bugs?id=6059 it is peculiar that it is only occurring on delete records. -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

1 0

Jndi VLV usage (maybe a BER encoding issue)
by Sebastien Bahloul 25 Oct '10

25 Oct '10

Hi, Does anyone already succeed to use VLV search requests through JNDI API ? It is functional with ldapsearch, but I get the following error on JDK 1.5 : javax.naming.NamingException [Root exception is com.sun.jndi.ldap.Ber$DecodeException: Encountered ASN.1 tag 2 (expected tag 10)] After doing some network captures between different directories implementation, it seems that there is a BER encoding error on the VLV response error code : Global VLV control response ASN1 dump (through openssl asn1parse) : 0:d=0 hl=2 l= 50 cons: SEQUENCE 2:d=1 hl=2 l= 24 prim: OCTET STRING :2.16.840.1.113730.3.4.10 28:d=1 hl=2 l= 22 prim: OCTET STRING 0000 - 30 14 02 01 00 02 02 00-aa 02 01 00 04 08 10 0a 0............... 0010 - 82 15 .. 0016 - <SPACES/NULS> Included octet string VLV control response ASN1 dump : 0:d=0 hl=2 l= 20 cons: SEQUENCE 2:d=1 hl=2 l= 1 prim: INTEGER :00 5:d=1 hl=2 l= 2 prim: INTEGER :AA 9:d=1 hl=2 l= 1 prim: INTEGER :00 12:d=1 hl=2 l= 8 prim: OCTET STRING 0000 - 10 0a 82 15 .... 0008 - <SPACES/NULS> According to latest VLV draft (seems to be version 4) in section 5.2, return type for error code (last 00 in this dump) must be an enumerated type (tag type 10). In OpenLDAP response, error code is encoded as an integer (tag type 2). I suggest to fix this by changing ber_printf(..."{iii ... to ber_printf(..."{iie ... in sssvlv.c:198. Please find a sssvlv patch attached. Regards -- Sebastien Bahloul @: sebastien.bahloul(a)gmail.com

2 1

slapd mysteriously quit/crash/die without last words
by Zhang Weiwu 25 Oct '10

25 Oct '10

Hello. slapd keep dying more and more frequently recently, from dying once a week in last month to current dying 3 to 5 times a day. "/etc/init.d/slapd start" instantly recover it, for next a few hours. Exactly the same web application that uses the ldap database had been running as-is for about one year without this problem. Server machine never changed/replaced/touched. What we tried are (in that order): 1. Run a server monitor to make sure the server load is not high (below 0.5) when slapd dies. 2. Upgrade to 2.4.11-1+lenny2 (on Debian) 3. slapcat the mostly used database (hdb) and slapadd them back in. 4. do the same for the other database (bdb); 5. track the log message at log level 256 (connection) and finding no clue. For example, one time, the last word is: Oct 25 16:06:59 www slapd[11969]: conn=26289 fd=29 ACCEPT from IP=**.**.**.**:56539 (IP=0.0.0.0:389) Oct 25 16:06:59 www slapd[11969]: conn=26289 op=0 BIND dn="cn=admin,dc=*******" method=128 Oct 25 16:06:59 www slapd[11969]: conn=26289 op=0 BIND dn="cn=admin,dc=*******" mech=SIMPLE ssf=0 Oct 25 16:06:59 www slapd[11969]: conn=26289 op=0 RESULT tag=97 err=0 text= Oct 25 16:06:59 www slapd[11969]: conn=26288 op=8 UNBIND Oct 25 16:06:59 www slapd[11969]: conn=26288 fd=41 closed Oct 25 16:06:59 www slapd[11969]: conn=26289 op=1 UNBIND Oct 25 16:06:59 www slapd[11969]: conn=26289 fd=29 closed Another time it is: Oct 25 16:27:09 www slapd[25691]: conn=2750 fd=51 ACCEPT from IP=**.**.**.**:54846 (IP=0.0.0.0:389) Oct 25 16:27:09 www slapd[25691]: conn=2750 op=1 SRCH base="ou=contacts,ou=china,dc=*******" scope=2 deref=0 filter="(uidNumber=7762)" Oct 25 16:27:10 www slapd[25691]: conn=2750 op=1 SRCH attr=o mail telephonenumber contactperson c st l street postalcode postofficebox facsimiletelephonenumber labeleduri businesscategory description pnglogo changetime lastrecapdate objectclass category 6. Track the log message at log level 4 (heavy trace debugging) and finding no clue. For example, one time, the last word is: Oct 25 22:23:48 www slapd[723]: connection_get(50) Oct 25 22:23:48 www slapd[723]: SRCH "ou=contacts,ou=china,dc=*******" 2 0 Oct 25 22:23:48 www slapd[723]: 0 0 0 Oct 25 22:23:48 www slapd[723]: filter: (uidNumber=2) Oct 25 22:23:48 www slapd[723]: attrs: Oct 25 22:23:49 www slapd[723]: Oct 25 22:23:49 www slapd[723]: connection_get(56) Oct 25 22:23:49 www slapd[723]: SRCH "ou=contacts,ou=china,dc=*******" 2 0 Oct 25 22:23:49 www slapd[723]: 0 0 0 Oct 25 22:23:49 www slapd[723]: filter: (uidNumber=2) Help, hints and suggestion of specific RTFM highly appreciated. Offering *paid* help to remote login to solve this problem is highly appreciated as well (please send me and my colleague on the 'cc' an email about the quotes). The problem exhausted us all. Thanks in advance! Zhang Weiwu

2 1

LDAP and Automount
by Holger Schier 25 Oct '10

25 Oct '10

Hey guys, I have a problem to get automount working correctly with my LDAP. I am using a Suse Linux Enterprise Edition 11. LDAP works fine, NFS too. The Client Desktops have an OpenSUSE 11.2 or 11.3. In the YaST LDAP Client I have activated the "Start Automounter" Option. On the Server I am working with the rfc2307bis.schema: ----- attributetype ( 1.3.6.1.1.1.1.31 NAME 'automountMapName' DESC 'automount Map Name' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.1.1.1.32 NAME 'automountKey' DESC 'Automount Key value' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.1.1.1.33 NAME 'automountInformation' DESC 'Automount information' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) objectclass ( 1.3.6.1.1.1.2.16 NAME 'automountMap' SUP top STRUCTURAL MUST ( automountMapName ) MAY description ) objectclass ( 1.3.6.1.1.1.2.17 NAME 'automount' SUP top STRUCTURAL DESC 'Automount information' MUST ( automountKey $ automountInformation ) MAY description ) ----- I added these next lines to my LDAP tree: ----- dn: ou=autofs,dc=MY,dc=DC objectclass: top objectclass: organizationalUnit ou: autofs dn: ou=home,ou=autofs,dc=MY,dc=DC objectclass: top objectclass: organizationalUnit ou: home dn: automountKey=/,ou=home,ou=autofs,dc=MY,dc=DC objectclass: top objectclass: automount automountInformation: SERVER:/home/& automountKey: / ------ and on the client maschine auto.master file: ----- /home ldap SERVER:ou=home,ou=autofs,dc=MY,dc=DC ----- and I added these lines in the /etc/sysconfig/autofs file (the old one are comments now) ----- DEFAULT_MAP_OBJECT_CLASS="automountMap" DEFAULT_ENTRY_OBJECT_CLASS="automount" DEFAULT_MAP_ATTRIBUTE="automountMapName" DEFAULT_ENTRY_ATTRIBUTE="automountKey" DEFAULT_VALUE_ATTRIBUTE="automountInformation" ----- But anyway, it doesn't want to work. What is missing? I tried to work with some guides in the net, but every guide isn't exact my case, so i tried it on my own. I am happy for every hint. Thanks. Holger

2 1

ldapsearch does not work properly
by Martin Jungowski 25 Oct '10

25 Oct '10

I'm facing a weird problem with ldapsearch on our companies CentOS OpenLDAP Server (CentOS 5.5, OpenLDAP 2.3.43-12.el5). Our DIT is as follows: o=company_name,c=country,ou=branch,ou=pool Within that pool are all users of that particular branch office. With some of those ldapsearch does not return a result when the search base is o=company_name but does return one starting with c=country,o=company_name: martin/linux2$ ldapsearch -x -h icld -b c=de,o=company_name uid | grep dn | grep s_sarwar dn: uid=s_sarwar,ou=pool,ou=branch,c=de,o=company_name martin/linux2$ ldapsearch -x -h icld -b o=company_name uid | grep dn | grep s_sarwar martin/linux2$ With other users within that same branch it works as expected: martin/linux2$ ldapsearch -x -h icld -b c=de,o=company_name uid | grep dn | grep t_ceylan dn: uid=t_ceylan,ou=pool,ou=branch,c=de,o=company_name martin/linux2$ ldapsearch -x -h icld -b o=company_name uid | grep dn | grep t_ceylan dn: uid=t_ceylan,ou=pool,ou=branch,c=de,o=company_name martin/linux2$ It does work for s_sarwar when I use the admin account to bind to in ldapsearch but my understanding is that it should work without it as well. We have no roles, no ACLs, no encryption, no nothing in that server. Simple authentication, nothing complicated. Any ideas? Martin -- Rieke Computersysteme GmbH Hellerholz 5 D-82061 Neuried Email: martin[at]rhm[dot]de

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical