openldap-technical

openldap-technical@openldap.org

1 participants
9989 discussions

how to compile recent openldap on Centos 5.5
by Götz Reinicke - IT-Koordinator 06 Dec '10

06 Dec '10

Hello, I tried to compile the Release 2.4.23 of openldap on my centos 5.5 server. It fails with: checking db.h usability... yes checking db.h presence... yes checking for db.h... yes checking for Berkeley DB major version in db.h... 4 checking for Berkeley DB minor version in db.h... 3 checking if Berkeley DB version supported by BDB/HDB backends... no configure: error: BerkeleyDB version incompatible with BDB/HDB backends I do have db4 installed: db4-4.3.29-10.el5_5.2 db4-devel-4.3.29-10.el5_5.2 db4-utils-4.3.29-10.el5_5.2 What may I do wrong? Any sugesstions? Thanks and regards . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

8 12

Re: Want interesting restrictions to ldap auth on different servers to different users
by c0re 06 Dec '10

06 Dec '10

2010/12/6 Dan White <dwhite(a)olp.net>: > On 06/12/10 15:34 +0300, c0re wrote: >> >> 2010/12/1 Dan White <dwhite(a)olp.net>: >> Thanks for example! >> >> But it still requires to edit clients.conf when adding device. And not >> restricts by groups. > > That's true, unless you have some of your clients coming from behind > one NAT address. I'm not aware of any way around that. > >> As per http://wiki.freeradius.org/Rlm_ldap I can use >> >> groupmembership_filter = >> >> "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" >> >> If there any other variables that can be used? I mean not only >> Ldap-userDn, but something like Ldap-clientIP, or Ldap-clientHostname >> or anything else to unique identify remote device. So I can use >> dynamic groups in OpenLdap and restrict access to device by group >> membership. > > As for the client IP, or other identifying information of the > authenticating device, I've always tried to use huntgroups to identify the > device rather than trying to perform a match in the LDAP filter, but that > approach might work just fine. > > Keep in mind that different types of devices will send more or less > information in its RADIUS request. Running freeradius in '-X' mode, and > sending a sample request will show you the information that you might be > able to match on. > > -- > Dan White > Thanks for tip about -X mode, will do it if get troubles. Found very interesting message in mailists here: http://lists.freeradius.org/pipermail/freeradius-users/2010-October/msg0005… Even more interesting - storing NAS secret in ldap! And using variable Packet-Src-IP-Address to differ source devices. Will try to get it work at this week.

1 0

help for tuning slapd
by Stéphane PURNELLE 06 Dec '10

06 Dec '10

Hi all, Sometimes my sladd process take more than 100% CPU and I don't know why. Searching on google I foud nsome tips about tunning but I don't understand some part of the article (set_cachesize chapter) ( http://www.openldap.org/doc/admin23/tuning.html) openldap 2.3.43 with BDB db-4.2.52 on Redhat Enterprise Linux 5.3 Some output : db_stat -d dn2id.bdb 53162 Btree magic number. 9 Btree version number. Flags: duplicates, little-endian 2 Minimum keys per-page. 4096 Underlying database page size. 2 Number of levels in the tree. 1588 Number of unique keys in the tree. 3159 Number of data items in the tree. 5 Number of tree internal pages. 19000 Number of bytes free in tree internal pages (7% ff). 51 Number of tree leaf pages. 113150 Number of bytes free in tree leaf pages (46% ff). 10 Number of tree duplicate pages. 18790 Number of bytes free in tree duplicate pages (54% ff). 0 Number of tree overflow pages. 0 Number of bytes free in tree overflow pages (0% ff). 0 Number of pages on the free list. db_stat -d id2entry.bdb 53162 Btree magic number. 9 Btree version number. Flags: little-endian 2 Minimum keys per-page. 16384 Underlying database page size. 2 Number of levels in the tree. 792 Number of unique keys in the tree. 792 Number of data items in the tree. 1 Number of tree internal pages. 13792 Number of bytes free in tree internal pages (16% ff). 117 Number of tree leaf pages. 717074 Number of bytes free in tree leaf pages (63% ff). 0 Number of tree duplicate pages. 0 Number of bytes free in tree duplicate pages (0% ff). 25 Number of tree overflow pages. 276539 Number of bytes free in tree overflow pages (32% ff). 4 Number of pages on the free list. anyone can help me for tuning mu openldap DB ? thanks Stéphane Purnelle ----------------------------------- Stéphane PURNELLE Admin. Systèmes et Réseaux Service Informatique Corman S.A. Tel : 00 32 (0)87/342467

1 0

ldap_result returns LDAP_TIMEOUT even after getting search response
by Shankar Anand R 06 Dec '10

06 Dec '10

Hi, I am seeing very slow responses while using ldap_search_ext() and ldap_result(). I have explained my application below. Kindly let me know if you see any problems/clues. I have written a simple application which reads a file and does LDAP search for all entities in the file. I am doing a simple bind with the LDAP server. I have 2 threads and 2 queues namely, LDAP Search queue and LDAP result queue. - Thread 1 reads all the entities from LDAP Search queue, sends out LDAP search requests for those entities and puts them into LDAP result queue. - Thread 2 reads all the entities from LDAP Result queue and checks for search results for those entities. These 2 threads do these tasks every 1 second. Since I don't want to overload the LDAP server I have programmed a constraint of a maximum of 20 outstanding LDAP searches that haven't got a result yet. Successful ldap_result() seems to be taking a long time. I keep getting LDAP_TIMEOUT errors. But i do get the result eventually without any retransmissions. But after a long time. When I capture the LDAP packets, the results seems to coming in pretty quick. But still ldap_result returns a LDAP_TIMEOUT error. Why should ldap_result() return a timeout in this case? Note that I am using LDAP_MSG_ONE in ldap_result. And I am using a timeout of 0 - I want to poll for the result and not actually block. I have turned OFF LDAP_OPT_REFERRALS on client side. (But still not able to figure out how to prevent Active Directory 2008 from sending out referrals). My test file contains 25 entities and I want to query the LDAP server for these 25 entities. This is a simplified form of my log: At 0 seconds: LDAP Search thread: 25 more LDAP searches pending. 0 LDAP Search waiting for results Sent out 20 LDAP Search Requests. Trigger to start LDAP Result thread after 1 second. 5 more LDAP searches pending. Wait for 1 second before sending these out. At 1 seconds: LDAP Result thread: 20 LDAP Search results pending. Got 1 LDAP results. 19 LDAP Search results still pending. Try again after 1 second. LDAP Search Thread: 5 more LDAP Searches pending. 19 LDAP Search waiting for results. Sent out 1 LDAP Search Requests. 4 more LDAP searches pending. Wait for 1 second before sending these out. At 2 seconds: LDAP Result thread: 20 LDAP Search results pending. Got 5 LDAP results. 15 LDAP Search results still pending. Try again after 1 second. LDAP Search Thread: 4 more LDAP Searches pending. 15 LDAP Search waiting for results. Sent out 4 LDAP Search Requests. 0 LDAP Search pending. Stopping LDAP Search thread. At 3 seconds: LDAP Result thread: 19 LDAP Search results pending. Got 4 LDAP results. 15 LDAP Search results still pending. Try again after 1 second. At 4 seconds: LDAP Result thread: 15 LDAP Search results pending. Got 4 LDAP results. 11 LDAP Search results still pending. Try again after 1 second. At 5 seconds: LDAP Result thread: 11 LDAP Search results pending. Got 3 LDAP results. 8 LDAP Search results still pending. Try again after 1 second. At 6 seconds: LDAP Result thread: 8 LDAP Search results pending. Got 2 LDAP results. 6 LDAP Search results still pending. Try again after 1 second. At 7 seconds: LDAP Result thread: 6 LDAP Search results pending. Got 1 LDAP results. 5 LDAP Search results still pending. Try again after 1 second. At 8 seconds: LDAP Result thread: 5 LDAP Search results pending. Got 2 LDAP results. 3 LDAP Search results still pending. Try again after 1 second. At 8 seconds: LDAP Result thread: 3 LDAP Search results pending. Got 1 LDAP results. 2 LDAP Search results still pending. Try again after 1 second. At 9 seconds: LDAP Result thread: 2 LDAP Search results pending. Got 0 LDAP results. 2 LDAP Search results still pending. Try again after 1 second. At 10 seconds: LDAP Result thread: 2 LDAP Search results pending. Got 1 LDAP results. 1 LDAP Search results still pending. Try again after 1 second. At 11 seconds: LDAP Result thread: 1 LDAP Search results pending. Got 0 LDAP results. 1 LDAP Search results still pending. Try again after 1 second. At 12 seconds: LDAP Result thread: 1 LDAP Search results pending. Got 1 LDAP results. 0 LDAP Search Results pending. Stopping LDAP Result thread. Any help/clues is much appreciated. Regards, Shankar

1 0

Re: Want interesting restrictions to ldap auth on different servers to different users
by c0re 06 Dec '10

06 Dec '10

2010/12/1 Dan White <dwhite(a)olp.net>: > On 01/12/10 18:27 +0300, c0re wrote: >> >> Can't understand about how to use nssov overlay in my case, but >> understood about dynamic groups overlay and it should fit to my needs. >> >> Also I've got freeradius that authenticate users by looking in ldap. >> Works good. But can't understand about how to restrict users to login >> to some devices. At that moment all users has access to all devices >> via radius. Same requests - this must be controlled via openldap. >> >> May be someone uses freeradius and has already made such restritions >> and can give me some tips. > > Here's one approach: > > Given a huntgroups file of: > > device1 NAS-IP-Address == 192.168.1.1 > cisco1 NAS-IP-Address == 192.168.1.2 > > and corresponding entries in your clients.conf, you can add something like > this in your users file: > > DEFAULT Huntgroup-Name == "device1", ldap-customattr-Ldap-Group == "device1" > Fall-Through = no > > DEFAULT Huntgroup-Name == "device1", Auth-Type := Reject > > DEFAULT Huntgroup-Name == "cisco1", ldap-customattr-Ldap-Group == > "cisco1/admin", User-Profile := "cn=ciscoadmin,ou=radius,dc=example,dc=net" > Fall-Through = no > > DEFAULT Huntgroup-Name == "cisco1", Auth-Type := Reject > > then create /etc/freeradius/modules/ldap-customattr with: > > ldap ldap-customattr { > > server = "ldap://ldap.example.net" > ldap_debug = 0x0028 > identity = "$dn" > password = $pass > ldap_connections_number = 5 > basedn = "dc=example,dc=net" > filter = "(uid=%u)" > start_tls = no > tls_mode = no > password_attribute = "userPassword" > groupname_attribute = "customattr" > groupmembership_filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > groupmembership_attribute = "customattr" > > } > > Add 'ldap-customattr' inside the 'instantiate' section within > /etc/freeradius/radiusd.conf. > > Add this to your tree: > > dn: cn=ciscoadmin,ou=radius,dc=example,dc=net > objectClass: radiusObjectProfile > objectClass: radiusprofile > cn: ciscoadmin > radiusReplyItem: cisco-avpair = "shell:priv-lvl=15" > > > Then within your user entries, any user with: > > customattr: device1 > > will be authorized to authenticate to device1, and > > customattr: cisco1/admin > > will authenticate to cisco1, and will also drop directly into enable mode, > assuming the cisco device is configured to do so. > > -- > Dan White > Thanks for example! But it still requires to edit clients.conf when adding device. And not restricts by groups. As per http://wiki.freeradius.org/Rlm_ldap I can use groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" If there any other variables that can be used? I mean not only Ldap-userDn, but something like Ldap-clientIP, or Ldap-clientHostname or anything else to unique identify remote device. So I can use dynamic groups in OpenLdap and restrict access to device by group membership.

1 0

Multiple LDAP server IPs to ldap_init, server is busy and failover question.
by Jorgen Lundman 06 Dec '10

06 Dec '10

Solaris 10 x86 u8 openldap-2.4.23 db-4.8.30.NC dovecot-1.2.7 Can I have some clarification on how failover works when using OpenLDAP library as a client. If a piece of software is passing multiple space-separated hosts to ldap_init() (or initialize) calls, but receives "Server is busy" error during a search request, should the LDAP library not handle that for the caller automatically/transparently? Ie, switch to next working LDAP server, and perform the ldap_search. Or is it closer to that ldap_init will find the first working IP (the failover is early in the flow), but if an already started search later fails, it is up to the software to retry/reconnect? It only guarantees that the initial connection is valid. What is the general practise here? Thanks, Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

1 0

OpenLDAP 2.4 authentication methods
by Josh Spranger 04 Dec '10

04 Dec '10

I have OpenLDAP version 2.4 installed on an OpenSUSE box. I am using it as an LDAP Proxy to Windows AD domain. It works perfectly using standard LDAP logon credentials (cn=user,DC=domain,DC=com). But I have some applications that use user(a)domain.com<mailto:user@domain.com> logon credentials. Is there a way to configure OpenLDAP to authenticate in this way? Slapd config file available on request. Thanks! Josh Spranger Sr. Network Engineer

2 3

Cannot ID LDAP User On LDAP Client
by Anton Chu 03 Dec '10

03 Dec '10

I've setup an Ubuntu 10.10 LDAP Client to authenticate off my LDAP server. I've install the following: sudo apt-get install libpam-ldap libnss-ldap nss-updatedb libnss-db nscd ldap-utils pam_ccreds Here's my /etc/nsswitch.conf: passwd: files ldap [NOTFOUND=return] db > > group: files ldap [NOTFOUND=return] db > > shadow: files ldap > > hosts: files dns > networks: files > > protocols: db files > services: db files > ethers: db files > rpc: db files > I can nss_updatedb ldap succssfully: # nss_updatedb ldap passwd... done. group... done. I can getent passwd, getent passwd shadow, getent group just fine and they all show all my ldap users. However, I cannot do an id ldapuser ex: $ id tony id: tony: No such user Here's my auth.log: Dec 1 21:08:17 webdev120 sshd[14765]: pam_unix(sshd:auth): check pass; user > unknown > Here's my syslog: sshd[14648]: Libgcrypt warning: missing initialization - please fix the > application > Here's my /etc/pam.d/commoun-auth: auth [success=4 default=ignore] pam_unix.so nullok_secure > auth [success=3 default=ignore] pam_ldap.so use_first_pass > auth [success=2 default=ignore] pam_ccreds.so minimum_uid=1000 > action=validate use_first_pass > auth [default=ignore] pam_ccreds.so minimum_uid=1000 action=update > # here's the fallback if no module succeeds > #auth requisite pam_deny.so > # prime the stack with a positive return value if there isn't one already; > # this avoids us returning an error just because nothing sets a success > code > # since the modules above will each just jump around > #auth required pam_permit.so > # and here are more per-package modules (the "Additional" block) > auth optional pam_ccreds.so minimum_uid=1000 action=store > # end of pam-auth-update config > Here's my /etc/pam.d/common-account: # here are the per-package modules (the "Primary" block) > account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so > account [success=1 default=ignore] pam_ldap.so > # here's the fallback if no module succeeds > account requisite pam_deny.so > # prime the stack with a positive return value if there isn't one already; > # this avoids us returning an error just because nothing sets a success > code > # since the modules above will each just jump around > account required pam_permit.so > # and here are more per-package modules (the "Additional" block) > # end of pam-auth-update config > ID works just fine with my local users on my local machine so somehow it's not able to read the ldap users. Any insights appreciated.

3 7

last login time
by Nick Folino 03 Dec '10

03 Dec '10

I saw some old list traffic from 2005 about implementing last login time into the password policy. Was this idea scrapped? Nick

1 0

MemberOf out of sync on consumer[s]
by Yuri Bank 03 Dec '10

03 Dec '10

Hello, I've been putting this off for a while, but this is happening frequently enough that I think its time to ask for opinions on the bug I'm running into with OpenLDAP and the MemberOf overlay. Version: 2.4.23 Configuration: Single Provider, with 4 Consumers. It seems that when I add a new users on my provider, the MemberOf attribute disappears randomly for some users, on some ( not all ) consumer nodes. Everything in the DIT is in tact, and the changes made on my provider are replicated to the consumers correctly. The only issue here is with the memberof attribute. The only way for me to remedy this problem is to shutdown slapd on the affected consumer node, delete everything in /var/sun/slapd, and then start slapd again which then fully syncs with my provider with all memberof attributes in tact. My testing shows that this is triggered by making changes to to my LDAP groups/users on the provider node, but that is all I can find. Nothing in the logs gives me any clues as to what is happening. Has anyone experienced similar problems? Thanks, -Yuri

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical