openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

updating from 2.4.20 to 2.4.22 breaks syncrepl/TLS
by Thierry Lacoste 20 Oct '10

20 Oct '10

Hello, I have 2 CentOS 5.4 servers running OpenLDAP 2.4.20 installed from Buchan Milne's repository (openldap2.4- servers-2.4.20-1.el5). The first server is a Sync Provider. The second is a consumer with 'starttls=critical'. I have no problem after 'yum update' of the master (openldap2.4-servers-2.4.22-1.el5 is installed and replication is OK). But after 'yum update' of the slave, syncrepl won't work anymore because of TLS failures. Here are the logs on the master : Oct 20 16:51:15 vcos-castor slapd2.4[20097]: @(#) $OpenLDAP: slapd 2.4.22 (Apr 27 2010 12:04:27) $ bgmilne@centos5-32.ranger.dnsalias.com:/home/bgmilne/rpm/BUILD/ openldap-2.4.22/servers/slapd Oct 20 16:51:15 vcos-castor slapd2.4[20098]: slapd starting Oct 20 16:51:46 vcos-castor slapd2.4[20098]: conn=1000 fd=16 ACCEPT from IP=IP.OF.THE.SLAVE:46212 (IP=0.0.0.0:389) Oct 20 16:51:46 vcos-castor slapd2.4[20098]: conn=1000 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 20 16:51:46 vcos-castor slapd2.4[20098]: conn=1000 op=0 STARTTLS Oct 20 16:51:46 vcos-castor slapd2.4[20098]: conn=1000 op=0 RESULT oid= err=0 text= Oct 20 16:51:46 vcos-castor slapd2.4[20098]: conn=1000 fd=16 closed (TLS negotiation failure) Here are the logs on the slave : Oct 20 16:51:45 vcos-pollux slapd2.4[1808]: @(#) $OpenLDAP: slapd 2.4.22 (Apr 27 2010 12:04:27) $ bgmilne@centos5-32.ranger.dnsalias.com:/home/bgmilne/rpm/BUILD/ openldap-2.4.22/servers/slapd Oct 20 16:51:45 vcos-pollux slapd2.4[1809]: slapd starting Oct 20 16:51:45 vcos-pollux slapd2.4[1809]: slap_client_connect: URI=ldap://NAME_OF_THE_MASTER Error, ldap_start_tls failed (-11) Oct 20 16:51:45 vcos-pollux slapd2.4[1809]: do_syncrepl: rid=000 rc -11 retrying (4 retries left) ldapsearch from the slave can do TLS : $ ldapsearch -ZZ -x -h NAME_OF_THE_MASTER This is ldapsearch from openldap-clients-2.3.43-12.el5_5.2 as packaged by CentOS Any ideas on how to troubleshoot the problem? Regards, Thierry PS : as a side note both servers are Xen VMs running on CentOS hosts.

3 3

Compiling slapd with debug symbols
by Lucas Brasilino 20 Oct '10

20 Oct '10

Hi I'm writing an overlay which manipulates some attributes of objects and It is, somehow, leading to a segfault within slapd code. In order to debug what's going on, I'm trying to compile a non-stripped slapd but I can't figure out how. I've read configure.in and Makefile.in to find out a fancy way to do it, but I have no idea. I've also removed the STRIP option at the top level Makefile: no success. I've removed $(STRIP) at install-slapd target at Makefile on slapd's dir and did: make install-slapd No success. I've googled around too! How can I do that ? regards Lucas Brasilino

2 3

Sometimes getent missing users
by Jocke M 20 Oct '10

20 Oct '10

Hello, We are running an OpenLDAP server on RHEL4 and I just found out that running getent on the RHEL clients sometimes missed users against the OpenLDAP server. Example: getent passwd | wc -l 1038 getent passwd | wc -l 1624 Does anyone know what can be faulty, either on the clients or the server? -- Thx Jocke

6 11

PPolicy error.
by Meghanand Acharekar 19 Oct '10

19 Oct '10

Hi, I am using ppolicy overlay to enforce password policies. Following is my ppolicy configuration/ldif. dn: cn=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: policies pwdAttribute: userPassword pwdMaxAge: 7516800 pwdExpireWarning: 432000 pwdInHistory: 6 pwdCheckQuality: 1 pwdMinLength: 8 pwdMaxFailure: 4 pwdLockout: TRUE pwdLockoutDuration: 1920 pwdGraceAuthNLimit: 0 pwdFailureCountInterval: 0 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: FALSE while changing password on first login I got following error. WARNING: Your password has expired. You must change your password now and login again! Changing password for user prasad. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Constraint violation Password is too young to change passwd: Permission denied Connection to myhost closed. Thanks in advance Meghanand N Acharekar.

3 7

Logging when an account is locked by ppolicy
by Mikalsen Remi 19 Oct '10

19 Oct '10

I have successfully configured ppolicy on a test server and everything works as it should; except one small detail that isn't strictly necessary, but very useful to monitor the "state of affairs". The slapd log doesn't seem to include any information to indicate that an account has just been locked due to password policies. This information would be very useful for automatic log monitoring, because a high number of accounts being locked in a short period of time could indicate some kind of problem or attack against our systems via some supposedly secure client. The only thing I use password policies for is locking down accounts temporarily after repeated authentication failures. The LDAP catalogue isn't the place where passwords are actually set or changed. I've tried configuring the auditlog overlay, imagining it would log the locking of an account somehow, but I haven't actually been able to make it work. There are no errors in the slapd log when loading the module, but the auditlog log file is always empty, even after running ldapmodify on a "cn" attribute for a random person. Snippets from the slapd.conf (for testing purposes I've enabled and disabled ppolicy_use_lockout to see if it also had an effect in the logs, but nothing): [...] loglevel stats config cons [...] database bdb [...] overlay auditlog auditlog /var/log/slapd_audit.log overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=uit,dc=no" ppolicy_use_lockout [...] This server is a test server, the production servers are slaves in a master-slave configuration using syncrepl. The server version is 2.4.23. Getting auditlog to work is not a priority, what I really want is to be able to monitor locking of accounts. Does anybody have ideas around these issues? Maybe a new approach? Regards, Remi Mikalsen

1 0

db stick in RAM ?
by Frank Bonnet 19 Oct '10

19 Oct '10

Hello I'm thinking to put db files in RAM instead of hard disk for performance reasons. FreeBSD ( and Linux thought ) provide some utility to build RAMDISK ( md ) I did some tests in rebuilding db files with the slapcat/slapadd commands with RAMDISK ldap3# time slapadd -l test.ldif /usr/local/etc/openldap/slapd.conf: line 110: rootdn is always granted unlimited privileges. #################### 100.00% eta none elapsed 20s spd 633.9 k/s WITH HARDDISK ldap3# time slapadd -l test.ldif /usr/local/etc/openldap/slapd.conf: line 110: rootdn is always granted unlimited privileges. #################### 100.00% eta none elapsed 04m22s spd 48.4 k/s Does anyone runs production servers with ramdisk ? I know it is risky but running rsyncd between ramdisk and a hardisk depot would be safe huh ? Thanks for any advices

4 8

Configuring OpenLDAP 2.2 with gdbm
by KALINOWSKI, Piotr (Piotr) 19 Oct '10

19 Oct '10

Hello, I am trying to build OpenLDAP version 2.2.17 with the gdbm back end. The platform is Solaris 10 on SPARC. However, the configure script fails with the following error: ./configure --enable-ldbm --with-ldbm-api=gdbm --enable-shell --enable-crypt --disable-bdb ... checking for GDBM library... checking for gdbm_open... no checking for gdbm_open in -lgdbm... no no checking for gdbm.h... yes checking for db... no configure: warning: could not find suitable LDBM backend configure: error: select appropriate LDBM options or disable Does anyone know how to fix it? Thanks in advance. Piotr

6 11

Possible bug in ldap_get_values_len?
by Edward Z. Yang 18 Oct '10

18 Oct '10

Hello all, I was mucking around with OpenLDAP and noticed that ldap_get_values_len was returning NULL without setting a corresponding error code. Intruiged by this behavior, I did some debugging, and found that it was doing so on nsslapd-referral as generated by a Fedora 1.2.5 or 1.2.6 directory server for the cn=config entry (I haven't checked anywhere else yet). Here is a fragment of the byte sequence in ber_buf that was causing this: 000<14><04><10>nsslapd-referral1<00>0<19><04><12>password I checked some other code, ldapvi works around this by checking if the return value of ldap_get_values_len is NULL before using it, but it doesn't seem to do so consistently, and an old version of the code had this to say: struct berval **values = ldap_get_values_len(ld, entry, ad); struct berval **ptr; if (!values) continue; /* weird server */ I've also posted to 389-users [1], in Fedora Directory Server spitting out malformed data. But in that case, OpenLDAP should give me an error code, or work around it, or something. Cheers, Edward [1] http://lists.fedoraproject.org/pipermail/389-users/2010-October/012320.html

3 6

How to apply default ppolicy with cn=config
by sophie ailin 18 Oct '10

18 Oct '10

Hello, I was new to openldap, I try to use the default ppolicy with openldap 2.4.21 on suse linux, I didn't find much info in detail about how to config it when using cn=config. Could you take a look what I am missing here. I created and include the ldif file I think equivalent to slapd.conf , (convert the default ppolicy.shcema to ppolicy.ldif) : : include: file:///etc/openldap/schema/ppolicy.ldif : : dn: olcOverlay={1}ppolicy,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {1}ppolicy olcPPolicyDefault: cn=default,ou=policies,dc=example,dc=com Also I added the container and the policies : : dn: ou=policies,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: policies dn: cn=default,ou=policies,dc=example,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: 2.5.4.35 #pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 0 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 8 pwdMustChange: FALSE pwdSafeModify: TRUE sn: dummy value the ppolicy.ldif look like this dn: cn=ppolicy,cn=schema,cn=config objectClass: olcSchemaConfig cn: ppolicy olcAttributeTypes: {0}( 1.3.6.1.4.1.42.2.27.8.1.1 NAME 'pwdAttribute' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) olcAttributeTypes: {1}( 1.3.6.1.4.1.42.2.27.8.1.2 NAME 'pwdMinAge' EQUALITY in tegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.4.1.42.2.27.8.1.3 NAME 'pwdMaxAge' EQUALITY in tegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.4.1.42.2.27.8.1.4 NAME 'pwdInHistory' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {16}( 1.3.6.1.4.1.42.2.27.8.1.5 NAME 'pwdCheckQuality' EQUAL ITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.4.1.42.2.27.8.1.6 NAME 'pwdMinLength' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.4.1.42.2.27.8.1.7 NAME 'pwdExpireWarning' EQUA LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.4.1.42.2.27.8.1.8 NAME 'pwdGraceAuthNLimit' EQ UALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.4.1.42.2.27.8.1.9 NAME 'pwdLockout' EQUALITY b ooleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {9}( 1.3.6.1.4.1.42.2.27.8.1.10 NAME 'pwdLockoutDuration' E QUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.4.1.42.2.27.8.1.11 NAME 'pwdMaxFailure' EQUAL ITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {11}( 1.3.6.1.4.1.42.2.27.8.1.12 NAME 'pwdFailureCountInter val' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {12}( 1.3.6.1.4.1.42.2.27.8.1.13 NAME 'pwdMustChange' EQUAL ITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {13}( 1.3.6.1.4.1.42.2.27.8.1.14 NAME 'pwdAllowUserChange' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.4.1.42.2.27.8.1.15 NAME 'pwdSafeModify' EQUAL ITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {15}( 1.3.6.1.4.1.4754.1.99.1 NAME 'pwdCheckModule' DESC 'L oadable module that instantiates "check_password() function' EQUALITY caseExa ctIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.4.1.4754.2.99.1 NAME 'pwdPolicyChecker' SUP top AUXILIARY MAY pwdCheckModule ) olcObjectClasses: {1}( 1.3.6.1.4.1.42.2.27.8.2.1 NAME 'pwdPolicy' SUP top AUXI LIARY MUST pwdAttribute MAY ( pwdMinAge $ pwdMaxAge $ pwdInHistory $ pwdCheck Quality $ pwdMinLength $ pwdExpireWarning $ pwdGraceAuthNLimit $ pwdLockout $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMustChange $ pwdAllowUserChange $ pwdSafeModify ) ) Somehow the policy didn't seems apply to my user entries, like the pwdMinLength or pwdExpireWarning not take effect at all. I tried with pwdCheckQuality 1 or 2 , both not working. I guess I am missing some config, the old way has a step to load the module, is there something similar I need to do the new way? Really appreciate your time and help! Sophie

3 2

SYntax for Proxy addresses and attribute to be defined for proxy addresess in LDIF file
by Meena Ram 17 Oct '10

17 Oct '10

Dear folks: If any one has the syntax for adding proxy addresses in the LDIF file along with the normal mail attribute that will be really appreciated if you can share the Syntax or the link and also the modifications to schema files with the details. Cheers!!!!!! Ram Req: Sample LDIF file with proxy addresses along with mail attribute Cheers!!!!!!!!!! RAM

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical