openldap-technical

openldap-technical@openldap.org

18 participants
9801 discussions

Sunone 5.2 to openldap migration
by Arya, Manish Kumar 07 Sep '10

07 Sep '10

Hi, I have a sunone 5.2 with custom schema and acis. can you please point me to some migration guide for schema,aci, data migration from sunone to openldap ? -- Manish www.mka.in +91-(0)-9871184321 xmpp manish(a)linuxlabs.biz Public Key http://www.mka.in/keys/public.asc

2 1

search with (uidNumber>=1900) got "text: inappropriate matching request"
by Zhang Weiwu 07 Sep '10

07 Sep '10

Hello. I am not quiet sure why a search with (uidNumber>=1900) got "text: inappropriate matching request". I've checked that uidNumber is mentioned and commented in nis.schema on my openldap-2.4.10 on Debian. Thus it should be a built-in attribute. It is of integerMatch Can you give some hint how to search for all users with uid greater than 1900? Thanks! Test case: $ ldapsearch -xD uid=supertuxadmin,ou=contacts,ou=china,dc=ahk,dc=de -b ou=contacts,ou=china,dc=ahk,dc=de '(uidNumber>=1900)' o uidNumber # extended LDIF # # LDAPv3 # base <ou=contacts,ou=china,dc=ahk,dc=de> with scope subtree # filter: (uidNumber>=1900) # requesting: o uidNumber # # search result search: 2 result: 0 Success text: inappropriate matching request # numResponses: 1

2 1

Back-ldap configuration and id-assertion.
by Mustafa A. Hashmi 07 Sep '10

07 Sep '10

Hi all, I am wondering if I am going about my setup the right way and am hoping someone can give me a bit of input. Using openldap-2.4.23 on Debian Linux, I have nssov configured to retrieve host, user and group information on my primary server, with back-ldap and nssov configured on a secondary machine doing the same. The back-ldap configuration is as follows: database ldap suffix dc=zivios,dc=net uri "ldap://dev03.zivios.net" acl-bind bindmethod=simple binddn="" credentials="" idassert-bind bindmethod=simple mode=self binddn="uid=zproxyauth,ou=zusers,ou=core control,ou=zivios,dc=zivios,dc=net" credentials="foo" idassert-authzFrom "dn.regex:.*" overlay nssov nssov-map group uniqueMember member nssov-ssd passwd ldap:///dc=zivios,dc=net??sub nssov-ssd group ldap:///dc=zivios,dc=net??sub nssov-ssd hosts ldap:///dc=zivios,dc=net??sub nssov-pam hostservice nssov-pam-session sshd nssov-pam-session login On the primary server, I have the authz policy set to "to", with an authzto rule as follows for the zproxyauth user: {0}ldap:///dc=zivios,dc=net??sub?(objectClass=posixAccount) I have setup appropriate ACLs that allow access to the authorizedService attribute for certain groups and, testing ssh & logins is working as required (on the primary server). However, when connections come in from the back-ldap server, the proxy auth works initially, with every "other" request failing. The back-ldap server log reports: send_ldap_result: err=123 matched="" text="anonymous proxied authorization not allowed" This is quite easily reproducible via simple getent passwd/group calls. Every second request fails with the aforementioned error. SSH access to the secondary server (with a successful regex, id-assertion and compare operation) works if I restart the back-ldap server, however, all subsequent requests fail. Below is the complete log of a failed request from the back-ldap server on a getent passwd command: dev02:/opt/zivios/openldap/etc/openldap# getent passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/bin/sh man:x:6:12:man:/var/cache/man:/bin/sh lp:x:7:7:lp:/var/spool/lpd:/bin/sh mail:x:8:8:mail:/var/mail:/bin/sh news:x:9:9:news:/var/spool/news:/bin/sh uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh proxy:x:13:13:proxy:/bin:/bin/sh www-data:x:33:33:www-data:/var/www:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh list:x:38:38:Mailing List Manager:/var/list:/bin/sh irc:x:39:39:ircd:/var/run/ircd:/bin/sh gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh libuuid:x:100:101::/var/lib/libuuid:/bin/sh sshd:x:101:65534::/var/run/sshd:/usr/sbin/nologin zopenldap:x:945:945::/home/zopenldap:/bin/false daemon: activity on 1 descriptor daemon: activity on: 10r daemon: read active on 10 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL connection_get(10) connection_get(10): got connid=0 nssov: connection from uid=0 gid=0 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL nssov_passwd_all() str2filter "(objectClass=posixAccount)" put_filter: "(objectClass=posixAccount)" put_filter: simple put_simple_filter: "objectClass=posixAccount" begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0xf6e8f010 ptr=0xf6e8f010 end=0xf6e8f02d len=29 0000: a3 1b 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 04 ....objectClass. 0010: 0c 70 6f 73 69 78 41 63 63 6f 75 6e 74 .posixAccount end get_filter 0 =>ldap_back_getconn: conn 0x9398940 fetched refcnt=1. ldap_search_ext put_filter: "(objectClass=posixAccount)" put_filter: simple put_simple_filter: "objectClass=posixAccount" ldap_build_search_req ATTRS: uid userPassword uidNumber gidNumber gecos cn homeDirectory loginShell objectClass ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x9397070 ptr=0x9397070 end=0x939716f len=255 0000: 30 81 fc 02 01 13 63 81 9c 04 10 64 63 3d 7a 69 0.....c....dc=zi 0010: 76 69 6f 73 2c 64 63 3d 6e 65 74 0a 01 02 0a 01 vios,dc=net..... 0020: 00 02 01 00 02 01 00 01 01 00 a3 1b 04 0b 6f 62 ..............ob 0030: 6a 65 63 74 43 6c 61 73 73 04 0c 70 6f 73 69 78 jectClass..posix 0040: 41 63 63 6f 75 6e 74 30 5c 04 03 75 69 64 04 0c Account0\..uid.. 0050: 75 73 65 72 50 61 73 73 77 6f 72 64 04 09 75 69 userPassword..ui 0060: 64 4e 75 6d 62 65 72 04 09 67 69 64 4e 75 6d 62 dNumber..gidNumb 0070: 65 72 04 05 67 65 63 6f 73 04 02 63 6e 04 0d 68 er..gecos..cn..h 0080: 6f 6d 65 44 69 72 65 63 74 6f 72 79 04 0a 6c 6f omeDirectory..lo 0090: 67 69 6e 53 68 65 6c 6c 04 0b 6f 62 6a 65 63 74 ginShell..object 00a0: 43 6c 61 73 73 a0 58 30 56 04 18 32 2e 31 36 2e Class.X0V..2.16. 00b0: 38 34 30 2e 31 2e 31 31 33 37 33 30 2e 33 2e 34 840.1.113730.3.4 00c0: 2e 31 38 04 3a 64 6e 3a 67 69 64 4e 75 6d 62 65 .18.:dn:gidNumbe 00d0: 72 3d 30 2b 75 69 64 4e 75 6d 62 65 72 3d 30 2c r=0+uidNumber=0, 00e0: 63 6e 3d 70 65 65 72 63 72 65 64 2c 63 6e 3d 65 cn=peercred,cn=e 00f0: 78 74 65 72 6e 61 6c 2c 63 6e 3d 61 75 74 68 xternal,cn=auth ber_scanf fmt ({) ber: ber_dump: buf=0x9397070 ptr=0x9397076 end=0x939716f len=249 0000: 63 81 9c 04 10 64 63 3d 7a 69 76 69 6f 73 2c 64 c....dc=zivios,d 0010: 63 3d 6e 65 74 0a 01 02 0a 01 00 02 01 00 02 01 c=net........... 0020: 00 01 01 00 a3 1b 04 0b 6f 62 6a 65 63 74 43 6c ........objectCl 0030: 61 73 73 04 0c 70 6f 73 69 78 41 63 63 6f 75 6e ass..posixAccoun 0040: 74 30 5c 04 03 75 69 64 04 0c 75 73 65 72 50 61 t0\..uid..userPa 0050: 73 73 77 6f 72 64 04 09 75 69 64 4e 75 6d 62 65 ssword..uidNumbe 0060: 72 04 09 67 69 64 4e 75 6d 62 65 72 04 05 67 65 r..gidNumber..ge 0070: 63 6f 73 04 02 63 6e 04 0d 68 6f 6d 65 44 69 72 cos..cn..homeDir 0080: 65 63 74 6f 72 79 04 0a 6c 6f 67 69 6e 53 68 65 ectory..loginShe 0090: 6c 6c 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 a0 ll..objectClass. 00a0: 58 30 56 04 18 32 2e 31 36 2e 38 34 30 2e 31 2e X0V..2.16.840.1. 00b0: 31 31 33 37 33 30 2e 33 2e 34 2e 31 38 04 3a 64 113730.3.4.18.:d 00c0: 6e 3a 67 69 64 4e 75 6d 62 65 72 3d 30 2b 75 69 n:gidNumber=0+ui 00d0: 64 4e 75 6d 62 65 72 3d 30 2c 63 6e 3d 70 65 65 dNumber=0,cn=pee 00e0: 72 63 72 65 64 2c 63 6e 3d 65 78 74 65 72 6e 61 rcred,cn=externa 00f0: 6c 2c 63 6e 3d 61 75 74 68 l,cn=auth ber_flush2: 255 bytes to sd 13 0000: 30 81 fc 02 01 13 63 81 9c 04 10 64 63 3d 7a 69 0.....c....dc=zi 0010: 76 69 6f 73 2c 64 63 3d 6e 65 74 0a 01 02 0a 01 vios,dc=net..... 0020: 00 02 01 00 02 01 00 01 01 00 a3 1b 04 0b 6f 62 ..............ob 0030: 6a 65 63 74 43 6c 61 73 73 04 0c 70 6f 73 69 78 jectClass..posix 0040: 41 63 63 6f 75 6e 74 30 5c 04 03 75 69 64 04 0c Account0\..uid.. 0050: 75 73 65 72 50 61 73 73 77 6f 72 64 04 09 75 69 userPassword..ui 0060: 64 4e 75 6d 62 65 72 04 09 67 69 64 4e 75 6d 62 dNumber..gidNumb 0070: 65 72 04 05 67 65 63 6f 73 04 02 63 6e 04 0d 68 er..gecos..cn..h 0080: 6f 6d 65 44 69 72 65 63 74 6f 72 79 04 0a 6c 6f omeDirectory..lo 0090: 67 69 6e 53 68 65 6c 6c 04 0b 6f 62 6a 65 63 74 ginShell..object 00a0: 43 6c 61 73 73 a0 58 30 56 04 18 32 2e 31 36 2e Class.X0V..2.16. 00b0: 38 34 30 2e 31 2e 31 31 33 37 33 30 2e 33 2e 34 840.1.113730.3.4 00c0: 2e 31 38 04 3a 64 6e 3a 67 69 64 4e 75 6d 62 65 .18.:dn:gidNumbe 00d0: 72 3d 30 2b 75 69 64 4e 75 6d 62 65 72 3d 30 2c r=0+uidNumber=0, 00e0: 63 6e 3d 70 65 65 72 63 72 65 64 2c 63 6e 3d 65 cn=peercred,cn=e 00f0: 78 74 65 72 6e 61 6c 2c 63 6e 3d 61 75 74 68 xternal,cn=auth ldap_write: want=255, written=255 0000: 30 81 fc 02 01 13 63 81 9c 04 10 64 63 3d 7a 69 0.....c....dc=zi 0010: 76 69 6f 73 2c 64 63 3d 6e 65 74 0a 01 02 0a 01 vios,dc=net..... 0020: 00 02 01 00 02 01 00 01 01 00 a3 1b 04 0b 6f 62 ..............ob 0030: 6a 65 63 74 43 6c 61 73 73 04 0c 70 6f 73 69 78 jectClass..posix 0040: 41 63 63 6f 75 6e 74 30 5c 04 03 75 69 64 04 0c Account0\..uid.. 0050: 75 73 65 72 50 61 73 73 77 6f 72 64 04 09 75 69 userPassword..ui 0060: 64 4e 75 6d 62 65 72 04 09 67 69 64 4e 75 6d 62 dNumber..gidNumb 0070: 65 72 04 05 67 65 63 6f 73 04 02 63 6e 04 0d 68 er..gecos..cn..h 0080: 6f 6d 65 44 69 72 65 63 74 6f 72 79 04 0a 6c 6f omeDirectory..lo 0090: 67 69 6e 53 68 65 6c 6c 04 0b 6f 62 6a 65 63 74 ginShell..object 00a0: 43 6c 61 73 73 a0 58 30 56 04 18 32 2e 31 36 2e Class.X0V..2.16. 00b0: 38 34 30 2e 31 2e 31 31 33 37 33 30 2e 33 2e 34 840.1.113730.3.4 00c0: 2e 31 38 04 3a 64 6e 3a 67 69 64 4e 75 6d 62 65 .18.:dn:gidNumbe 00d0: 72 3d 30 2b 75 69 64 4e 75 6d 62 65 72 3d 30 2c r=0+uidNumber=0, 00e0: 63 6e 3d 70 65 65 72 63 72 65 64 2c 63 6e 3d 65 cn=peercred,cn=e 00f0: 78 74 65 72 6e 61 6c 2c 63 6e 3d 61 75 74 68 xternal,cn=auth ldap_result ld 0x9398980 msgid 19 wait4msg ld 0x9398980 msgid 19 (timeout 100000 usec) wait4msg continue ld 0x9398980 msgid 19 all 0 ** ld 0x9398980 Connections: * host: dev03.zivios.net port: 389 (default) refcnt: 2 status: Connected last used: Tue Aug 31 20:07:02 2010 ** ld 0x9398980 Outstanding Requests: * msgid 19, origid 19, status InProgress outstanding referrals 0, parent count 0 ld 0x9398980 request count 1 (abandoned 0) ** ld 0x9398980 Response Queue: Empty ld 0x9398980 response count 0 ldap_chkResponseList ld 0x9398980 msgid 19 all 0 ldap_chkResponseList returns ld 0x9398980 NULL ldap_int_select read1msg: ld 0x9398980 msgid 19 all 0 ber_get_next ldap_read: want=8, got=8 0000: 30 37 02 01 13 65 32 0a 07...e2. ldap_read: want=49, got=49 0000: 01 7b 04 00 04 2b 61 6e 6f 6e 79 6d 6f 75 73 20 .{...+anonymous 0010: 70 72 6f 78 69 65 64 20 61 75 74 68 6f 72 69 7a proxied authoriz 0020: 61 74 69 6f 6e 20 6e 6f 74 20 61 6c 6c 6f 77 65 ation not allowe 0030: 64 d ber_get_next: tag 0x30 len 55 contents: ber_dump: buf=0x93988f0 ptr=0x93988f0 end=0x9398927 len=55 0000: 02 01 13 65 32 0a 01 7b 04 00 04 2b 61 6e 6f 6e ...e2..{...+anon 0010: 79 6d 6f 75 73 20 70 72 6f 78 69 65 64 20 61 75 ymous proxied au 0020: 74 68 6f 72 69 7a 61 74 69 6f 6e 20 6e 6f 74 20 thorization not 0030: 61 6c 6c 6f 77 65 64 allowed read1msg: ld 0x9398980 msgid 19 message type search-result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x93988f0 ptr=0x93988f3 end=0x9398927 len=52 0000: 65 32 0a 01 7b 04 00 04 2b 61 6e 6f 6e 79 6d 6f e2..{...+anonymo 0010: 75 73 20 70 72 6f 78 69 65 64 20 61 75 74 68 6f us proxied autho 0020: 72 69 7a 61 74 69 6f 6e 20 6e 6f 74 20 61 6c 6c rization not all 0030: 6f 77 65 64 owed ldap_chase_referrals read1msg: V2 referral chased, mark request completed, id = 19 read1msg: ld 0x9398980 0 new referrals read1msg: mark request completed, ld 0x9398980 msgid 19 request done: ld 0x9398980 msgid 19 res_errno: 123, res_error: <anonymous proxied authorization not allowed>, res_matched: <> ldap_free_request (origid 19, msgid 19) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x93988f0 ptr=0x93988f3 end=0x9398927 len=52 0000: 65 32 0a 01 7b 04 00 04 2b 61 6e 6f 6e 79 6d 6f e2..{...+anonymo 0010: 75 73 20 70 72 6f 78 69 65 64 20 61 75 74 68 6f us proxied autho 0020: 72 69 7a 61 74 69 6f 6e 20 6e 6f 74 20 61 6c 6c rization not all 0030: 6f 77 65 64 owed ber_scanf fmt (}) ber: ber_dump: buf=0x93988f0 ptr=0x9398927 end=0x9398927 len=0 ldap_msgfree send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=123 matched="" text="anonymous proxied authorization not allowed" ---- The primary server log shows only one line: Aug 31 20:13:53 dev03 slapd[32705]: conn=1604 op=19 do_search: get_ctrls failed ---- I am not sure why an anonymous request is made by back-ldap -- probably my lack of understanding on how it should be configured. If anyone can point out where I am going wrong, it would be greatly appreciated. Mustafa.

2 8

Defining a password attributetype
by Rob Tanner 06 Sep '10

06 Sep '10

Hi, I need to define a secondary password attribute and I¹m not sure what to enter in the schema. Is the syntax oid exclusively for searching and therefore, can I omit it (I¹m not going to be searching on the password)? Or is the synoid also used for defining how the attribute is stored? So far, what I have is: attributetype ( 1.3.6.1.4.1.6459.10.2.213 NAME 'tempPassword' DESC 'Temporary password used for resets only' EQUALITY ?? SYNTAX ?? SINGLE-VALUE ) The attribute will be SHA encrypted digest encoded as Base64 (same as the standard userPassword attribute). Any guidance on the schema definition would be most appreciated. Thanks, Rob Rob Tanner UNIX Services Manager Linfield College, McMinnville Oregon

4 7

Invitation to connect on LinkedIn
by Vinay Jain 06 Sep '10

06 Sep '10

LinkedIn ------------Vinay Jain requested to add you as a connection on LinkedIn: ------------------------------------------ Edward, I'd like to add you to my professional network on LinkedIn. - Vinay Accept invitation from Vinay Jain http://www.linkedin.com/e/-48cabe-gdr321y2-1a/IxIpDd2wsdsod7c6kW2TzgvFvx58f… View invitation from Vinay Jain http://www.linkedin.com/e/-48cabe-gdr321y2-1a/IxIpDd2wsdsod7c6kW2TzgvFvx58f… ------------------------------------------ Why might connecting with Vinay Jain be a good idea? People Vinay Jain knows can discover your profile: Connecting to Vinay Jain will attract the attention of LinkedIn users. See who's been viewing your profile: http://www.linkedin.com/e/-48cabe-gdr321y2-1a/wvp/inv18_wvmp/ ------ (c) 2010, LinkedIn Corporation

1 0

Can't start replication
by Alister Forbes 06 Sep '10

06 Sep '10

All, My situation is that I'm trying to get replication working between two instances of openldap 2.4.23, both running on RHEL5, both built with the same options, and db built under them with the same options, and both OS instances are the same (cloned VMs) I can see the two slapd's trying to communicate, but athough the passwords supplied in 'credentials' are definitely correct, I keep seeing the err=49 in the logs below I've been struggling with this for days now.. can anyone give me a hint what I've messed up? Also, I'm not sure if it's related, but I now can't change anything in the servers configs directly, I keep getting - ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral I think this is the behaviour you would expect when the server was a syncrepl slave, but these are supposed to be multi-mastered. Any help, greatfully received Alister output of ldapsearch: # {0}config, config dn: olcDatabase={0}config,cn=config olcSyncrepl: {0}rid=001 provider=ldap://10.211.55.8 binddn="cn=config" bindmet hod=simple credentials=cisco123 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://10.211.55.11 binddn="cn=config" bindme thod=simple credentials=cisco123 searchbase="cn=config" type=refreshAndPersis t retry="5 5 300 5" timeout=1 Sep 3 14:08:59 rhel-lnx1 slapd[12715]: slap_client_connect: URI=ldap://10.211.55.11 DN="cn=config" ldap_sasl_bind_s failed (49) Sep 3 14:08:59 rhel-lnx1 slapd[12715]: do_syncrepl: rid=002 rc 49 retrying (1 retries left) Sep 3 14:09:00 rhel-lnx1 slapd[12715]: conn=1007 fd=9 ACCEPT from IP=10.211.55.11:33025 (IP=0.0.0.0:389) Sep 3 14:09:00 rhel-lnx1 slapd[12715]: conn=1007 op=0 BIND dn="cn=config" method=128 Sep 3 14:09:00 rhel-lnx1 slapd[12715]: conn=1007 op=0 RESULT tag=97 err=49 text= Sep 3 14:09:00 rhel-lnx1 slapd[12715]: conn=1007 op=1 UNBIND Sep 3 14:09:00 rhel-lnx1 slapd[12715]: conn=1007 fd=9 closed Sep 3 14:09:04 rhel-lnx1 slapd[12715]: conn=1008 fd=11 ACCEPT from IP=10.211.55.8:33001 (IP=0.0.0.0:389) Sep 3 14:09:04 rhel-lnx1 slapd[12715]: conn=1008 op=0 BIND dn="cn=config" method=128 Sep 3 14:09:04 rhel-lnx1 slapd[12715]: conn=1008 op=0 RESULT tag=97 err=49 text= Sep 3 14:09:04 rhel-lnx1 slapd[12715]: slap_client_connect: URI=ldap://10.211.55.8 DN="cn=config" ldap_sasl_bind_s failed (49) Sep 3 14:09:04 rhel-lnx1 slapd[12715]: do_syncrepl: rid=001 rc 49 retrying Sep 3 14:09:04 rhel-lnx1 slapd[12715]: conn=1008 op=1 UNBIND Sep 3 14:09:04 rhel-lnx1 slapd[12715]: conn=1008 fd=11 closed Sep 3 14:09:04 rhel-lnx1 slapd[12715]: slap_client_connect: URI=ldap://10.211.55.11 DN="cn=config" ldap_sasl_bind_s failed (49) Sep 3 14:09:04 rhel-lnx1 slapd[12715]: do_syncrepl: rid=002 rc 49 retrying Sep 3 14:09:05 rhel-lnx1 slapd[12715]: conn=1009 fd=9 ACCEPT from IP=10.211.55.11:33027 (IP=0.0.0.0:389) Sep 3 14:09:05 rhel-lnx1 slapd[12715]: conn=1009 op=0 BIND dn="cn=config" method=128 Sep 3 14:09:05 rhel-lnx1 slapd[12715]: conn=1009 op=0 RESULT tag=97 err=49 text= Sep 3 14:09:05 rhel-lnx1 slapd[12715]: conn=1009 op=1 UNBIND Sep 3 14:09:05 rhel-lnx1 slapd[12715]: conn=1009 fd=9 closed -- Alister Forbes TACSUNS _.|._.|._ Cisco Systems Please avoid sending me Word or PowerPoint attachments. See - http://www.gnu.org/philosophy/no-word-attachments.html

3 6

[Fwd: PAM not warning for password expiration]
by Dannie Obbink 06 Sep '10

06 Sep '10

-------- Forwarded Message -------- > From: Obbink, D. (Dannie) <dannie.obbink(a)vtspn.nl> > To: openldap-technical(a)openldap.org > Subject: PAM not warning for password expiration > Date: Thu, 22 Jul 2010 19:29:36 +0200 > > When users with an expired account try to log on to an application > making a bind using the user's own credentials, everything works as > expected; users cannot login, access gets denied. In the slapd > logging, the following message is displayed: > > Jul 21 14:06:25 slapd2.4[27182]: ppolicy_bind: Entry uid=<user> has an > expired password: 0 grace logins > > But when trying to log into PAM (ssh, su etc.), there is no warning > displayed the account is expired. The user is also allowed to login > normally. > > I've been Googling for a couple of days now, and can't really find the > culprit. > > I was especially interested in this thread: > http://www.openldap.org/lists/openldap-technical/201003/msg00197.html > > So, I've set pwdExpireWarning to 1 second less then pwdMaxAge. > > When I try to bind directly, such as with an ldapsearch, the logging > shows > > Jul 22 15:31:56 slapd2.4[27182]: ppolicy_bind: Setting warning for > password expiry for uid=<user> = 4318121 seconds > > So, that seems to be correct. > But, when logging in via PAM, the log does not display the "setting > warning". > > <SNIP> > Thanks you for any responses, > Dannie Obbink Hello list, Well, I finally found a workaround which "works for me"; use SSSD (found in the EPEL repos for Redhat / Centos / Fedora and standard for RHEL6). SSSD, unlike pam_ldap, IS nice enough to warn me for impending password expiry. I found multiple bugs about this (really helps if you know what to search) such as https://bugzilla.redhat.com/show_bug.cgi?id=190256 and http://bugs.centos.org/view.php?id=4468&nbn=5 I just wanted to share with you all that this definitely looks like a pam_ldap bug. Sincerely, Dannie Obbink -------------------------Disclaimer------------------------------- De informatie verzonden met dit e-mailbericht (en bijlagen) is uitsluitend bestemd voor de geadresseerde(n) en zij die van de geadresseerde(n) toestemming kregen dit bericht te lezen. Gebruik door anderen dan geadresseerde(n) is verboden. De informatie in dit e-mailbericht (en bijlagen) kan vertrouwelijk van aard zijn en kan binnen het bereik vallen van een geheimhoudingsplicht en een verschoningsrecht. -------------------------------------------------------------------

2 1

Password history configuration for ldap users.
by Meghanand Acharekar 06 Sep '10

06 Sep '10

Hello, I have configured openldap server on RHEL 5.4 I also want to enforce strong password policies for my ldap users. for which i configured pam module on each ldap client in following way. (/etc/pam.d/system-auth) #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_tally.so onerr=fail deny=5 unlock_time=300 auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0 minlen=8 \ reject_username password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=5 password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so session optional pam_mkhomedir.so skel=/etc/skel umask=0066 I am having following problems with my configuration. 1. Although configured password history (pam_unix.so remember =5) is not working for ldap users, while other password policies (pam_cracklib,pam_tally) are working fine. 2. I also observed that I can't change/set any users password as root user (using passwd username). Following is my ldap client configuration file (ldap.conf). base dc=mycomp,dc=com bind_timelimit 120 idle_timelimit 3600 nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm pam_check_host_attr pam_password md5 ssl no timelimit 120 tls_cacertdir /etc/openldap/cacerts uri ldap://10.0.119.36 For further troubleshooting I observer my /var/log/secure file while changing ldap user's passwod. passwd: pam_unix(passwd:chauthtok): user "username" does not exist in /etc/passwd but #getent passwd show me the username. Thanks in advance. -- Regards, Meghanand N. Acharekar " A proud GNU\Linux User " Reg Linux User #397975 ------------------------------------------ I was born free! No Gates and Windows can restrict my Freedom !!!

2 2

solaris 10 as client to openldap
by Isaac Hailperin 03 Sep '10

03 Sep '10

Hi, I am trying to set up an solaris 10 ldap client to work with an openldap server. The server serves the following profile: dn: cn=solarisbox,ou=profile,dc=acme,dc=de bindTimeLimit: 10 credentialLevel: anonymous cn: solarisbox profileTTL: 43200 searchTimeLimit: 30 defaultSearchScope: sub followReferrals: TRUE authenticationMethod: simple defaultSearchBase: dc=acme,dc=de objectClass: top objectClass: DUAConfigProfile defaultServerList: 192.168.0.5 On the solaris box, I issue: ldapclient -v init -a profileName=solarisbox 192.168.0.5 Parsing profileName=solarisbox Arguments parsed: profileName: solarisbox defaultServerList: 192.168.0.5 Handling init option About to configure machine by downloading a profile findBaseDN: begins findBaseDN: ldap not running findBaseDN: calling __ns_ldap_default_config() found 1 namingcontexts findBaseDN: __ns_ldap_list(NULL, "(&(objectclass=nisDomainObject)(nisdomain=acme.de))" rootDN[0] dc=acme,dc=de found baseDN dc=acme,dc=de for domain acme.de Proxy DN: NULL Proxy password: NULL Credential level: 0 Authentication method: 1 No proxyDN/proxyPassword required Shadow Update is not enabled, no adminDN/adminPassword is required. About to modify this machines configuration by writing the files Stopping network services Stopping sendmail [...] restart: milestone/name-services:default... success Error resetting system. Recovering old system settings. Stopping network services Stopping sendmail stop: sleep 100000 microseconds [...] top: network/ldap/client:default... restoring from maintenance state stop: network/ldap/client:default... failed: required constraint not met Stopping ldap failed with (1) Error (1) while stopping services during reset recover: stat(/var/ldap/restore/defaultdomain)=0 [...] I am not very familiar with solaris, so I just drop a few other things that I found that seemed related: cat /var/ldap/cachemgr.log [...] Thu Sep 2 17:02:19.4557 Error: Unable to read '/var/ldap/ldap_client_file': Configuration Error: No entry for 'NS_LDAP_BINDDN' found Thu Sep 2 17:02:19.4601 detachfromtty(): child failed (rc = 255). Thu Sep 2 17:32:56.9181 Starting ldap_cachemgr, logfile /var/ldap/cachemgr.log [...] I can confirm that /var/ldap/ldap_client_file does not exist. grep ldap /var/svc/log/* /var/svc/log/network-ldap-client:default.log:[ Sep 2 17:02:19 Executing start m ethod ("/lib/svc/method/ldap-client start") ] /var/svc/log/network-ldap-client:default.log:/usr/lib/ldap/ldap_cachemgr: failed . Please see syslog for details. /var/svc/log/svc.startd.log:Sep 2 17:32:57/458 ERROR: svc:/network/ldap/client: default: Method "/lib/svc/method/ldap-client start" failed with exit status 1. /var/svc/log/svc.startd.log:Sep 2 17:32:57/458: network/ldap/client:default fai led: transitioned to maintenance (see 'svcs -xv' for details) cat /var/adm/messages [...] Sep 2 17:32:56 unknown ldap_cachemgr[1134]: [ID 293258 daemon.error] libsldap: Status: 0 Mesg: Configuration Error: No entry for 'NS_LDAP_BINDDN' found Sep 2 17:32:56 unknown ldap_cachemgr[1133]: [ID 703877 daemon.error] ldap_cachemgr: failed (rc = 255). Sep 2 17:32:57 unknown svc.startd[7]: [ID 652011 daemon.warning] svc:/network/ldap/client:default: Method "/lib/svc/method/ldap-client start" failed with exit status 1. [...] I had a look at another solaris 10 machine (which I did not set up). The file /var/ldap/ldap_client_file exists, but has no entry 'NS_LDAP_BINDDN'. Also, I can't find some sort of bindDN option to ldapclient, nor can I find an attribute of that kind for the profile. Any hints on how to get this working? Isaac

1 1

OID für caseExactIA5SubstringsMatch?
by Keutel, Jochen 02 Sep '10

02 Sep '10

Hello, there are 6 matching rules for IA5 strings: - caseExactIA5Match - caseIgnoreIA5Match - caseExactIA5SubstringsMatch - caseIgnoreIA5SubstringsMatch - caseExactIA5OrderingMatch - caseIgnoreIA5OrderingMatch Only three of them are defined in RFC4517: - caseExactIA5Match (1.3.6.1.4.1.1466.109.114.1) - caseIgnoreIA5Match (1.3.6.1.4.1.1466.109.114.2) - caseIgnoreIA5SubstringsMatch (1.3.6.1.4.1.1466.109.114.3) What are the OIDs for the other three matching rules? - in OpenLDAP - is there a standard? Regards, Jochen Keutel.

4 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical