openldap-technical

openldap-technical@openldap.org

4 participants
9898 discussions

Every user queried when one user logs in
by Gerrard Geldenhuis 22 Oct '10

22 Oct '10

Hi My question probably straddles both PAM and LDAP so please scan it to the bottom before outrightly dismissing it as being mis-posted. I am not sure if this is by design but when I login as a user to a box with LDAP enabled I see a search request for every possible user in my dirctory. This breaks my test system if I have more than 10 000 users, while is unlikely that I would have so many users I would still like to optimize the LDAP query to be slightly less verbose. I have added nss_base directive which I did not have to optimize the search but it has not had the desired effect I had hoped for, it has in fact added an additional 70 odd packets to the average network capture when a user authenticates. my /etc/ldap.conf: binddn uid=SysAuth,ou=Service Accounts,dc=mycompany bindpw secret pam_password clear base dc=betfair nss_base_passwd ou=people,dc=mycompany?sub nss_base_group ou=Groups,dc=mycompany?sub nss_base_group ou=PrivateGroups,dc=mycompany?sub nss_base_group ou=SystemGroups,dc=mycompany?sub sizelimit 1000 idle_timelimit 5 timelimit 10 bind_timelimit 5 nss_reconnect_tries 1 nss_reconnect_maxconntries 1 nss_reconnect_sleeptime 1 nss_reconnect_maxsleeptime 1 nss_reconnect_maxconntries 1 I have also played around with various debug levels in /etc/ldap.conf but I have not really been succesfull in matching requests I see there to requests I see in wireshark. The man page in centos (man pam_ldap and nss_ldap ) also does not make any mention of available log levels or what they do. I have also scanned the source code for some more info on log levels but did not find anything usefull. If it is in the source code then please point me to it. I have gone through the pam list logs and the closest I could find was a the following thread: https://www.redhat.com/archives/pam-list/2009-September/thread.html and a similar thread in December 2010. This threads although similar is related to groups and my problem is with every user being queried. I am also I am 90% certain that is a config error on my part but I have not been able to find that error yet and would welcome any assistance in finding the problem. My system-auth in /etc/pam.d/ looks as follows: auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_access.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so debug account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 password sufficient pam_unix.so nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so Using CentOS release 5.4 Best Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

1 1

LDAP backend TODO: Determine the real behaviour of DN+String and DN+Binary
by Andrew Bartlett 22 Oct '10

22 Oct '10

Anatoliy, The next big task, as I mentioned on mumble yesterday, for us to do on the OpenLDAP backend is to correctly test and implement the DN+String and DN+Binary matching rules. Once we have positive tests for these rules, then we can ask the OpenLDAP team to implement them, but we want to make sure we ask once, for the right thing (I may have already muddied the waters here, so I want to try again once, with the right info). The things we need to find out are: If I search on a DN+String attribute, does it match against the DN, or the DN+String. Likewise for the DN+Binary. If I attempt to add a duplicate DN+String value to an attribute, does it conflict (only unique values allowed in LDAP) based on the DN, or the DN +String. Likewise for DN+Binary. Once we understand this (and have tests to prove it), we need to implement proper matching rules based on these, upgrading our comparison functions to proper comparisons (not just canonicalise and memcmp()). Finally, we need to write the results of that research into a mail to Howard Chu and OpenLDAP tecnical, and see if they can help us by implementing this in their server, or if we should somehow deal with this client side. A particular difficulty is that we must have these values implement DN rules, such backlinks, changing on target rename and deleting when the target deletes etc, and a functional dereference control (or a replacement with extended DNs). There may be additional funny rules like the fact that you will see duplicates in backlinks that have different source String parts of the DN+String values, but for the same DN. I've CC'ed Howard, Pierangelo and openldap-technical to give them a heads-up about the fact that we are hoping to pick the ball up on this again, now some other matters have settled down. Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Cisco Inc.

1 0

ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
by Helge Tore Høyland 21 Oct '10

21 Oct '10

Hi. I'm trying to get openldap up and running. I am following this howot: http://techpubs.spinlocksolutions.com/dklar/ldap.html I did a previous atempt yesterday, where i tried to do a tls setup. Today i have done a dpkg-reconfigure slapd so, everything should be back to start. /etc/hosts 127.0.0.1 localhost localhost.localdomain 192.168.1.5 server.htnett server krb1.htnett krb1 ldap1.htnett ldap1 # The following lines are desirable for IPv6 capable hosts ::1 localhost ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters ff02::3 ip6-allhosts /etc/ldap/ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. BASE dc=htnett URI ldap://192.168.1.5/ #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never /etc/ldap/slapd.conf er vedlagt. This is installed on a fully updated Debian 5.0.6 distro. slapcat gives a nice readout but: ldapsearch -x stats this: ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) This means no other computer will be able to connect through net. Portmap is running, but hosts.allow and hosts.deny is emty. hostname is server. Anyone got a clue to whats wrong?

1 1

quick-start guide out-of-date
by Anders Geffen 21 Oct '10

21 Oct '10

I'm just getting started with OpenLDAP and I've just hit my first roadblock - the quickstart guide (http://www.openldap.org/doc/admin24/quickstart.html) refers to a slapd.conf file which is nowhere to be found on my system. A bit of research revealed that slapd.conf has been deprecated. Is there a quick-start guide anywhere that is up-to-date with this change?

5 6

ldapadd - no such object 32
by eric 20 Oct '10

20 Oct '10

Hi I just compiled an openldap server and am working on the server as root to add a test ldif entry. I used MigrationTools (migration_passwd.pl) to export some users from my /etc/passwd file which created my test.ldif file Below is an error and below the error is the test.ldif file and slapd.conf that I have been working with. I receive the following error when I try to use ldapadd ***************my ERROR**************************** root@inside:/# ldapadd -H ldap://127.0.0.1 -x -D "cn=Manager,dc=inside,dc=domain,dc=org" -f /test.ldif -w 'rtpass' adding new entry "uid=fungi,ou=People,dc=inside,dc=domain,dc=org" ldap_add: No such object (32) matched DN: dc=inside,dc=domain,dc=org ***************test.ldif file********************** dn: uid=fungi,ou=People,dc=inside,dc=domain,dc=org uid: fungi cn: Fred Ungi objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}1234567891012 shadowLastChange: 14897 loginShell: /bin/false uidNumber: 1001 gidNumber: 1002 homeDirectory: /home/fungi gecos: Fred Ungi ******************slapd.conf********************** # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/misc.schema include /usr/local/etc/openldap/schema/nis.schema # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=inside,dc=domain,dc=org" rootdn "cn=Manager,dc=inside,dc=domain,dc=org" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}11111111111111111111111111 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq I'm a super newbie, so hopefully it is something I missed while reading the admin documentations Thank you in advance for any experience you can throw my way :) ~eric

9 10

slapd why sasl error message?
by pablo.web＠tiscali.it 20 Oct '10

20 Oct '10

To all LADAP GURU. I installed ldap (slapd 2.4.17) on a debian machine (ARM processor). The LDAP server allows you to centralize authentication of users and unix samba (samba is set with the PDC for windows machines, all with windows 7 OS). The communication is protected by TLS / SSL. Don't use SALS mechanism and, at the moment, I don't want to use it. Everything works perfectly but I don't understand why in the log file (syslog) I find the following error message: Oct 18 14:52:10 qnapserver slapd[11916]: daemon: read active on 26 Oct 18 14:52:10 qnapserver slapd[11916]: connection_get(26) Oct 18 14:52:10 qnapserver slapd[11916]: ==> sasl_bind: dn="" mech=DIGEST-MD5 datalen=0 Oct 18 14:52:10 qnapserver slapd[11916]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 18 14:52:10 qnapserver slapd[11916]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 18 14:52:10 qnapserver slapd[11916]: daemon: epoll: listen=10 active_threads=0 tvp=zero Oct 18 14:52:10 qnapserver slapd[11916]: daemon: epoll: listen=11 active_threads=0 tvp=zero Oct 18 14:52:10 qnapserver slapd[11916]: daemon: epoll: listen=12 active_threads=0 tvp=zero Oct 18 14:52:10 qnapserver slapd[11916]: daemon: activity on 1 descriptor Oct 18 14:52:10 qnapserver slapd[11916]: daemon: activity on: Oct 18 14:52:10 qnapserver slapd[11916]: Oct 18 14:52:10 qnapserver slapd[11916]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 18 14:52:10 qnapserver slapd[11916]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 18 14:52:10 qnapserver slapd[11916]: daemon: epoll: listen=10 active_threads=0 tvp=zero Oct 18 14:52:10 qnapserver slapd[11916]: daemon: epoll: listen=11 active_threads=0 tvp=zero Oct 18 14:52:10 qnapserver slapd[11916]: daemon: epoll: listen=12 active_threads=0 tvp=zero Oct 18 14:52:10 qnapserver slapd[11916]: daemon: activity on 1 descriptor Oct 18 14:52:10 qnapserver slapd[11916]: daemon: activity on: Oct 18 14:52:10 qnapserver slapd[11916]: 26r Oct 18 14:52:10 qnapserver slapd[11916]: Oct 18 14:52:10 qnapserver slapd[11916]: daemon: read active on 26 Oct 18 14:52:10 qnapserver slapd[11916]: connection_get(26) Oct 18 14:52:10 qnapserver slapd[11916]: ==> sasl_bind: dn="" mech=<continuing> datalen=265 Oct 18 14:52:10 qnapserver slapd[11916]: SASL [conn=542] Failure: realm changed: authentication aborted Oct 18 14:52:10 qnapserver slapd[11916]: send_ldap_result: err=49 matched="" text="SASL(-13): authentication failure: realm changed: authentication aborted" Oct 18 14:52:10 qnapserver slapd[11916]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 18 14:52:10 qnapserver slapd[11916]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 18 14:52:10 qnapserver slapd[11916]: daemon: epoll: listen=10 active_threads=0 tvp=zero Oct 18 14:52:10 qnapserver slapd[11916]: daemon: epoll: listen=11 active_threads=0 tvp=zero Oct 18 14:52:10 qnapserver slapd[11916]: daemon: epoll: listen=12 active_threads=0 tvp=zero Oct 18 14:52:10 qnapserver slapd[11916]: daemon: activity on 2 descriptors Oct 18 14:52:10 qnapserver slapd[11916]: daemon: activity on: Oct 18 14:52:10 qnapserver slapd[11916]: 26r This massage is displayed only after logged in from a Windows 7 client machine and is repeated approximately every 15 minutes. Please Help me, how can I fix this? Thanks Paolo

1 0

updating from 2.4.20 to 2.4.22 breaks syncrepl/TLS
by Thierry Lacoste 20 Oct '10

20 Oct '10

Hello, I have 2 CentOS 5.4 servers running OpenLDAP 2.4.20 installed from Buchan Milne's repository (openldap2.4- servers-2.4.20-1.el5). The first server is a Sync Provider. The second is a consumer with 'starttls=critical'. I have no problem after 'yum update' of the master (openldap2.4-servers-2.4.22-1.el5 is installed and replication is OK). But after 'yum update' of the slave, syncrepl won't work anymore because of TLS failures. Here are the logs on the master : Oct 20 16:51:15 vcos-castor slapd2.4[20097]: @(#) $OpenLDAP: slapd 2.4.22 (Apr 27 2010 12:04:27) $ bgmilne@centos5-32.ranger.dnsalias.com:/home/bgmilne/rpm/BUILD/ openldap-2.4.22/servers/slapd Oct 20 16:51:15 vcos-castor slapd2.4[20098]: slapd starting Oct 20 16:51:46 vcos-castor slapd2.4[20098]: conn=1000 fd=16 ACCEPT from IP=IP.OF.THE.SLAVE:46212 (IP=0.0.0.0:389) Oct 20 16:51:46 vcos-castor slapd2.4[20098]: conn=1000 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 20 16:51:46 vcos-castor slapd2.4[20098]: conn=1000 op=0 STARTTLS Oct 20 16:51:46 vcos-castor slapd2.4[20098]: conn=1000 op=0 RESULT oid= err=0 text= Oct 20 16:51:46 vcos-castor slapd2.4[20098]: conn=1000 fd=16 closed (TLS negotiation failure) Here are the logs on the slave : Oct 20 16:51:45 vcos-pollux slapd2.4[1808]: @(#) $OpenLDAP: slapd 2.4.22 (Apr 27 2010 12:04:27) $ bgmilne@centos5-32.ranger.dnsalias.com:/home/bgmilne/rpm/BUILD/ openldap-2.4.22/servers/slapd Oct 20 16:51:45 vcos-pollux slapd2.4[1809]: slapd starting Oct 20 16:51:45 vcos-pollux slapd2.4[1809]: slap_client_connect: URI=ldap://NAME_OF_THE_MASTER Error, ldap_start_tls failed (-11) Oct 20 16:51:45 vcos-pollux slapd2.4[1809]: do_syncrepl: rid=000 rc -11 retrying (4 retries left) ldapsearch from the slave can do TLS : $ ldapsearch -ZZ -x -h NAME_OF_THE_MASTER This is ldapsearch from openldap-clients-2.3.43-12.el5_5.2 as packaged by CentOS Any ideas on how to troubleshoot the problem? Regards, Thierry PS : as a side note both servers are Xen VMs running on CentOS hosts.

3 3

Compiling slapd with debug symbols
by Lucas Brasilino 20 Oct '10

20 Oct '10

Hi I'm writing an overlay which manipulates some attributes of objects and It is, somehow, leading to a segfault within slapd code. In order to debug what's going on, I'm trying to compile a non-stripped slapd but I can't figure out how. I've read configure.in and Makefile.in to find out a fancy way to do it, but I have no idea. I've also removed the STRIP option at the top level Makefile: no success. I've removed $(STRIP) at install-slapd target at Makefile on slapd's dir and did: make install-slapd No success. I've googled around too! How can I do that ? regards Lucas Brasilino

2 3

Sometimes getent missing users
by Jocke M 20 Oct '10

20 Oct '10

Hello, We are running an OpenLDAP server on RHEL4 and I just found out that running getent on the RHEL clients sometimes missed users against the OpenLDAP server. Example: getent passwd | wc -l 1038 getent passwd | wc -l 1624 Does anyone know what can be faulty, either on the clients or the server? -- Thx Jocke

6 11

PPolicy error.
by Meghanand Acharekar 19 Oct '10

19 Oct '10

Hi, I am using ppolicy overlay to enforce password policies. Following is my ppolicy configuration/ldif. dn: cn=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: policies pwdAttribute: userPassword pwdMaxAge: 7516800 pwdExpireWarning: 432000 pwdInHistory: 6 pwdCheckQuality: 1 pwdMinLength: 8 pwdMaxFailure: 4 pwdLockout: TRUE pwdLockoutDuration: 1920 pwdGraceAuthNLimit: 0 pwdFailureCountInterval: 0 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: FALSE while changing password on first login I got following error. WARNING: Your password has expired. You must change your password now and login again! Changing password for user prasad. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Constraint violation Password is too young to change passwd: Permission denied Connection to myhost closed. Thanks in advance Meghanand N Acharekar.

3 7

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical