openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

OpenLDAP Issues
by Allgood, John 29 Jun '10

29 Jun '10

Hey All Does anyone know why when I change pam_password exop in /etc/ldap.conf my password history and check_password module that I built into ppolicy stop working. This is openldap 2.4.21 built from source running on Centos 5.5. It worked fine when I had pam_password md5. Thanks John Allgood Senior Systems Administrator OHL Transportation Services 2251 Jesse Jewell Pky. NE Gainesville, GA 30507 tel: (678) 989-3051 fax: (770) 531-7878 jallgood(a)ohl.com<mailto:jallgood@ohl.com> www.ohl.com<http://www.ohl.com> ______________________________________________________ This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you are not the intended recipient or their designee, please notify the sender immediately by return e-mail and delete all copies.

2 2

ldapsearch not returning namingContexts
by ben thielsen 29 Jun '10

29 Jun '10

i just happened to notice that the following search(es) don't return the expected results: >ldapsearch -xs base -b '' + # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: + # # search result search: 2 result: 0 Success # numResponses: 1 >ldapsearch -xs base -b '' namingContexts # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: namingContexts # # search result search: 2 result: 0 Success # numResponses: 1 below is the debug output from slapd for the first search - what am i doing wrong? i'm using 2.4.21, courtesy of ubuntu. thanks -ben daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(7): daemon: epoll: listen=7 busy >>> slap_listener(ldap:///) daemon: listen=7, new connection on 14 daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: added 14r (active) listener=(nil) daemon: activity on 1 descriptor daemon: activity on: 14r conn=1000 fd=14 ACCEPT from IP=192.168.1.1:51467 (IP=0.0.0.0:389) daemon: read active on 14 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_get(14) connection_get(14): got connid=1000 connection_read(14): checking for input on id=1000 ber_get_next ldap_read: want=8, got=8 0000: 30 0c 02 01 01 60 07 02 0....`.. ldap_read: want=6, got=6 0000: 01 03 04 00 80 00 ...... ber_get_next: tag 0x30 len 12 contents: ber_dump: buf=0x20cf3b90 ptr=0x20cf3b90 end=0x20cf3b9c len=12 0000: 02 01 01 60 07 02 01 03 04 00 80 00 ...`........ op tag 0x60, time 1277686599 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL conn=1000 op=0 do_bind ber_scanf fmt ({imt) ber: ber_dump: buf=0x20cf3b90 ptr=0x20cf3b93 end=0x20cf3b9c len=9 0000: 60 07 02 01 03 04 00 80 00 `........ ber_scanf fmt (m}) ber: ber_dump: buf=0x20cf3b90 ptr=0x20cf3b9a end=0x20cf3b9c len=2 0000: 00 00 .. >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> conn=1000 op=0 BIND dn="" method=128 do_bind: version=3 dn="" method=128 send_ldap_result: conn=1000 op=0 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 14 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ ldap_write: want=14, written=14 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ conn=1000 op=0 RESULT tag=97 err=0 text= daemon: activity on 1 descriptor daemon: activity on: 14r daemon: read active on 14 daemon: epoll: listen=7 active_threads=0 tvp=NULL connection_get(14) daemon: epoll: listen=8 active_threads=0 tvp=NULL do_bind: v3 anonymous bind connection_get(14): got connid=1000 connection_read(14): checking for input on id=1000 ber_get_next ldap_read: want=8, got=8 0000: 30 28 02 01 02 63 23 04 0(...c#. ldap_read: want=34, got=34 0000: 00 0a 01 00 0a 01 00 02 01 00 02 01 3c 01 01 00 ............<... 0010: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 03 04 ..objectclass0.. 0020: 01 2b .+ ber_get_next: tag 0x30 len 40 contents: ber_dump: buf=0x20cf43a8 ptr=0x20cf43a8 end=0x20cf43d0 len=40 0000: 02 01 02 63 23 04 00 0a 01 00 0a 01 00 02 01 00 ...c#........... 0010: 02 01 3c 01 01 00 87 0b 6f 62 6a 65 63 74 63 6c ..<.....objectcl 0020: 61 73 73 30 03 04 01 2b ass0...+ op tag 0x63, time 1277686599 connection_input: conn=1000 deferring operation: binding ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL conn=1000 op=1 do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x20cf43a8 ptr=0x20cf43ab end=0x20cf43d0 len=37 0000: 63 23 04 00 0a 01 00 0a 01 00 02 01 00 02 01 3c c#.............< 0010: 01 01 00 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 .....objectclass 0020: 30 03 04 01 2b 0...+ >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> SRCH "" 0 0 0 60 0 begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x20cf43a8 ptr=0x20cf43be end=0x20cf43d0 len=18 0000: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 03 04 ..objectclass0.. 0010: 01 2b .+ end get_filter 0 filter: (objectClass=*) ber_scanf fmt ({M}}) ber: ber_dump: buf=0x20cf43a8 ptr=0x20cf43cb end=0x20cf43d0 len=5 0000: 00 03 04 01 2b ....+ attrs: + conn=1000 op=1 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" conn=1000 op=1 SRCH attr=+ => test_filter PRESENT => access_allowed: search access to "" "objectClass" requested => acl_get: [1] attr objectClass => acl_mask: access to entry "", attr "objectClass" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth <= check a_dn_pat: * <= acl_mask: [2] applying +0 (break) <= acl_mask: [2] mask: =0 <= acl_get: done. => slap_access_allowed: no more rules => access_allowed: no more rules <= test_filter 50 send_ldap_result: conn=1000 op=1 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=2 tag=101 err=0 ber_flush2: 14 bytes to sd 14 0000: 30 0c 02 01 02 65 07 0a 01 00 04 00 04 00 0....e........ ldap_write: want=14, written=14 0000: 30 0c 02 01 02 65 07 0a 01 00 04 00 04 00 0....e........ conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= daemon: activity on 1 descriptor daemon: activity on: 14r daemon: read active on 14 daemon: epoll: listen=7 active_threads=0 tvp=NULL connection_get(14) daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_get(14): got connid=1000 connection_read(14): checking for input on id=1000 ber_get_next ldap_read: want=8, got=7 0000: 30 05 02 01 03 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x20cf3b90 ptr=0x20cf3b90 end=0x20cf3b95 len=5 0000: 02 01 03 42 00 ...B. op tag 0x42, time 1277686599 ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 14 failed errno=0 (Success) connection_read(14): input error=-2 id=1000, closing. connection_closing: readying conn=1000 sd=14 for close daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_close: deferring conn=1000 sd=14 conn=1000 op=2 do_unbind conn=1000 op=2 UNBIND connection_resched: attempting closing conn=1000 sd=14 connection_close: deferring conn=1000 sd=14 connection_resched: attempting closing conn=1000 sd=14 connection_close: conn=1000 sd=14 daemon: removing 14 conn=1000 fd=14 closed

4 6

Problem with 2.4.22 with FreeBSD
by Frank Bonnet 29 Jun '10

29 Jun '10

Hello I upgraded from 2.4.21 to 2.4.22 from the FreeBSD ports and the slapd daemon does not start anymore ... error message follows /libexec/ld-elf.so.1: /usr/local/libexec/slapd: Undefined symbol "ldap_pvt_csnstr" The configuration is the same and there is no compilation error. Thanks for any infos. F

4 3

Can password-hash be database specific? also, storing and verifying cleartext passwords
by Tom Leach 29 Jun '10

29 Jun '10

Is the 'password-hash' configuration function a server-wide setting only or can it be set to different values for separate databases? I'm trying to add MAC-auth RADIUS functionality to my LDAP server (openldap-2.4.21) and I need to store the password for the MAC addresses in cleartext. I also use the LDAP server for user login which I don't want to keep in cleartext. So, my thought was to have 'password-hash {SSHA}' for the users database, and 'password-hash {CLEARTEXT}' for the RADIUS database, but it appears that it's a global so I'm pretty sure this won't work. Also, how do I verify that the passwords are stored in cleartext? On a test server, I've created just the radius database with a global 'password-hash {CLEARTEXT}', I have the following ldif file that I add with: ldapadd -x -W -v -D 'cn=Manager,o=radius' -f mac.ldif -h ldap_server Contents of mac.ldif: dn:uid=001e68d08ff9,o=radius uid: 001e68d08ff9 cn: 001e68d08ff9 userPassword: {cleartext}001e68d08ff9 objectClass: top objectClass: radiusProfile objectClass: radiusObjectProfile but when I use ldapsearch or slapcat to dump the database, the userPassword line looks to be hashed. ldap_server# slapcat dn: o=radius o: radius objectClass: top objectClass: organization structuralObjectClass: organization entryUUID: 97ab4273-42ae-4b41-9100-a8106bf766bf creatorsName: cn=Manager,o=radius createTimestamp: 20100618220235Z entryCSN: 20100618220235.020635Z#000000#000#000000 modifiersName: cn=Manager,o=radius modifyTimestamp: 20100618220235Z dn: uid=001e68d08ff9,o=radius uid: 001e68d08ff9 cn: 001e68d08ff9 userPassword:: e2NsZWFydGV4dH0wMDFlNjhkMDhmZjk= objectClass: top objectClass: radiusprofile objectClass: radiusObjectProfile structuralObjectClass: radiusObjectProfile entryUUID: 591d40f2-a155-4b49-a827-5bfd92ee8c32 creatorsName: cn=Manager,o=radius createTimestamp: 20100619000726Z entryCSN: 20100619000726.747404Z#000000#000#000000 modifiersName: cn=Manager,o=radius modifyTimestamp: 20100619000726Z Here are the relevant lines from the slapd.conf file: include /usr/local/etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/radius.schema password-hash {CLEARTEXT} database bdb suffix "o=radius" rootdn "cn=Manager,o=radius" rootpw "secret" directory /var/lib/ldap/radius index objectClass eq index ou,cn,uid,memberUid eq,pres,sub index uniqueMember eq,pres index entryCSN,entryUUID eq

5 6

Openldap passwords synchronization
by Jean-Luc CHANDEZON 28 Jun '10

28 Jun '10

Hello, My demand is very simple : When I export user/password, there is 2 attributes (lmpassword,newpassword) How can I decrypt theses passwords, for importing in one other directory? Can I export some other keys for decrypting? Thanks, Jean-Luc

2 1

how can i add 2 Structural in the same record ?
by shyuejyh.tw 28 Jun '10

28 Jun '10

HI All : I have Big problem in replica account , when i add new account in old 2.0.2x to new 2.4.11 i find error log in 123.223.111.222:389.rej (at old server) ERROR: Object class violation replica: 123.223.111.222:389 time: 1233452016.0 dn: uid=poorman,ou=33-22,dc=somewhere,dc=com changetype: add objectClass: account // This is Structural 1 objectClass: pilotPerson // This is Structural 2 objectClass: posixAccount objectClass: top objectClass: shadowAccount than i check , account and pilotPerson are both Structural, if i remove any one of than , add is done. but, i really need to add 2 structural in a record, how can i config ? i have try edit cosine.schema , but doesn't work .. objectclass ( 0.9.2342.19200300.100.4.5 NAME 'account' SUP top STRUCTURAL //Change to SUP top AUXILIARY MUST userid MAY ( description $ seeAlso $ localityName $ organizationName $ organizationalUnitName $ host ) ) plz,help ... 3q ~

2 1

ldaprc with ldaps:// and ldap:// fallback
by manu＠netbsd.org 27 Jun '10

27 Jun '10

Hello I would like to setup a ldaprc so that an application uses: - a localhost-base slapd without authentification (just relying on filesystem permission on the slapd socket) - if it is not available, a remote slapd, authenticating using client certificate Here is the desired ldaprc: BASE dc=example,dc=net URI ldapi:/// ldaps://ldap.example.net TLS_CACERT /etc/openssl/ca.crt TLS_CERT /etc/openssl/host.crt TLS_KEY /etc/openssl/host.key SASL_MECH EXTERNAL TLS_REQCERT demand Of course it will not work, as the ldapi:/// connection will present a certificate. I have the feeling the setup I am looking for cannot be configured. Is that right? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

5 14

openldap mysqlcluster and FreeRadius Schema
by Levent ILDENIZ 27 Jun '10

27 Jun '10

Hi, i have a problem about openldap with mysqlcluster and with free radius schema i inserted freeradius schema statement in my slapd.conf when i create any user with radiusprofile, i see below failure messages * /"ndb_oc_create: CREATE TABLE radiusprofile failed, Row size too large. The maximum row size for the used table type, not counting BLOBs, is 8052. You have to change some columns to TEXT or BLOBs (1118) ndb_back_add: ndb_entry_put_data failed (80) Tuple did not exist(626)/"* how can i fix this? -- Levent ILDENIZ Bu mesaj ve onunla iletilen tum ekler gonderildigi kisi ya da kuruma ozel, gizlilik yukumlulugu tasiyor olabilir. Bu mesaj, hicbir sekilde, herhangi bir amac icin cogaltilamaz, yayinlanamaz ve para karsiligi satilamaz; mesajin yetkili alicisi veya alicisina iletmekten sorumlu kisi degilseniz, mesaj icerigini ya da eklerini kopyalamayiniz, yayinlamayiniz, baska kisilere yonlendirmeyiniz ve mesaji gonderen kisiyi derhal uyararak bu mesaji siliniz. Bu mesajin bilinen viruslere karsi kontrolleri yapilmistir. ISTANBUL UNIVERSITESI http://www.istanbul.edu.tr This message (including any attachments) is intended only for the use of the individual or entity to which it is addressed and may contain information that is non-public, proprietary,privileged, confidential, and exempt from disclosure under applicable law or may constitute as attorney work product.If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, notify us immediately by telephone and (i) destroy this message if a facsimile or (ii) delete this message immediately if this is an electronic communication. ISTANBUL UNIVERSITY http://www.istanbul.edu.tr

2 1

Re: How to change openldap database directory
by Mail Admin 26 Jun '10

26 Jun '10

Thanks Quanah/Mauricio/Chris for the reply. In fact, that is the first thing I did, I get the following error when I start ldap service. Checking configuration files for slapd: bdb_db_open: Cannot access database directory /var/vamail/ldap/mydomain.com (13) Backend_startup_one: bi_db_open failed! (-1) Slap_startup failed (test would succeed using the –u switch) [FAILED] Stale lock files may be present in /var/vmail/ldap/mydomain.com [WARNING] Permission looks exactly the same. Any idea why this error?

2 1

RE: Can password-hash be database specific? also, storing and verifying cleartext passwords
by masarati＠aero.polimi.it 26 Jun '10

26 Jun '10

>> -----Original Message----- >> Is the 'password-hash' configuration function a server-wide setting >> only >> or can it be set to different values for separate databases? >> I'm trying to add MAC-auth RADIUS functionality to my LDAP server >> (openldap-2.4.21) and I need to store the password for the MAC >> addresses >> in cleartext. I also use the LDAP server for user login which I don't >> want to keep in cleartext. So, my thought was to have 'password-hash >> {SSHA}' for the users database, and 'password-hash {CLEARTEXT}' for the >> RADIUS database, but it appears that it's a global so I'm pretty sure >> this won't work. > > Yes, each database can have a different hashing mechanism set. > http://www.openldap.org/software/man.cgi?query=slapd-config&apropos=0&sekti… I'm afraid that man page is incorrect. As far as I know, that directive is global, not database specific. That's what I get from the code (and what I remembered). You can check yourself by adding the directive and inspecting the content of cn=config. We need at least to fix the manpage. p.

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical