openldap-technical

openldap-technical@openldap.org

9897 discussions

Re-investigating ppolicy + chain issues on a consumer: chain configuration
by Siddhartha Jain 23 Jun '10

23 Jun '10

I am still stuck at the same place where a chained consumer allows a client to auth with a bad password. Remove chaining and bad passwords are no longer accepted. To troubleshoot from scratch, I am curious about how chaining should be configured in the new ldif-based configuration scheme? Initially, I created a slapd.conf with the appropriate chaining statements and converted that file to "slapd.d". The conversion places all the chaining config under the "frontend" database. : [0115] root@ldaps01:olcDatabase={-1}frontend # ; ls -lR .: total 8 drwxr-x--- 2 ldap ldap 4096 Jun 24 00:30 olcOverlay={0}chain -rw------- 1 ldap ldap 433 Jun 22 23:00 olcOverlay={0}chain.ldif ./olcOverlay={0}chain: total 8 -rw------- 1 ldap ldap 591 Jun 23 23:53 olcDatabase={0}ldap.ldif -rw------- 1 ldap ldap 893 Jun 24 00:30 olcDatabase={1}ldap.ldif Interestingly, it creates two "ldap" databases for a single "chain" overlay. Can someone please explain why/how is this so? Why does chaining go to "frontend" db instead of being under the database that is chained? I tried to create the "ldap" databases under a "bdb" database but OpenLDAP won't allow that. Thanks, Siddhartha

2 1

data for search_base and bind_dn in postfix config.
by sam 23 Jun '10

23 Jun '10

Hi, With Openldap 24, postfix 2.8, I want to add the following entries in mydestination.cf file into my openldap database, Content of file mydestination.cf: server_host = 127.0.0.1 server_port = 389 search_base = lookupName=mydestination,cn=postfix,cn=mailstore,ou=server,ou=edv,dc=example,dc=net scope = sub timeout = 30 bind = yes bind_dn = cn=postfix,ou=system,ou=accounts,dc=example,dc=net bind_pw = XXXXXXXXXX version = 3 start_tls = no query_filter = (lookupKey=%s) result_attribute = lookupValue My current openldap entry is shown below: # cat initial.ldif dn: dc=ip6,dc=com,dc=au objectClass: top objectClass: dcObject objectClass: organization o: IP6 Networks dc: ip6 # super user node dn: cn=root,dc=ip6,dc=com,dc=au objectclass: organizationalRole objectclass: simpleSecurityObject cn: root description: LDAP administrator userPassword: {MD5}cW2LX0AjZxSBzv/mflD3xQ== According to my current initial openldap database entries, can I change the entires in the mydesitination.cf file into the following data? search_base = lookupName=mydestination,cn=postfix,ou=hometest,dc=ip6,dc=com,dc=au scope = sub timeout = 30 bind = yes bind_dn = cn=postfix,ou=accounts,dc=ip6,dc=com,dc=au bind_pw = {MD5}cW2LX0AjZxSBzv/mflD3xQ== Very appreciate for any suggestion and help. Thanks Sam

1 0

openldap pwdReset
by Allgood, John 23 Jun '10

23 Jun '10

Hey All I have a question for you all. I am using openldap 2.4.31 on Centos 5.5 and using the ppolicy overlay. I have also compiled the smbk5 module to update the samba attr when the user password is updated. My problem is to change the password and have the samba password update I have to use ldappasswrd which works great. If I force a pwdReset and login via gdm the password program take over and sets the posix password but this does not change the samba side nor does it adhere to the ppolicy. I am thinking this may something related to /etc/pamd/system-auth file but not sure. Any feedback would be appreciated. John Allgood Senior Systems Administrator OHL Transportation Services 2251 Jesse Jewell Pky. NE Gainesville, GA 30507 tel: (678) 989-3051 fax: (770) 531-7878 jallgood(a)ohl.com<mailto:jallgood@ohl.com> www.ohl.com<http://www.ohl.com> ______________________________________________________ This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you are not the intended recipient or their designee, please notify the sender immediately by return e-mail and delete all copies.

4 5

Copying trees from one consumer to another
by Nick Urbanik 23 Jun '10

23 Jun '10

Dear Folks, With slurpd, copying a tree from one slave to another was like this: 1. stop slapd on both slaves. 2. netcat the directory across from one slave to the other. 3. stop slurpd on master 4. edit slurpd.status to make the time and replication number match by copying that for the source to that for the destination slave. 5. start everything back up. My question with syncrepl is: How do I copy the database for a tree from one consumer to another consumer (of the same producer) so that the newly copied replica knows where its replication should continue from? Is the state for replication of the database stored in the contextCSN of the suffix entry? If so, does that mean that with syncrepl, the above operation is reduced to the following three steps? 1. Stop slapd on both consumers. 2. Netcat the database from one to the other. 3. start both consumers. -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

5 12

Re: smbk5pwd: ldappassword hangs
by Frank Van Damme 23 Jun '10

23 Jun '10

2010/6/10 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, June 10, 2010 1:36 PM +0200 Frank Van Damme > <frank.vandamme(a)gmail.com> wrote: > >> 2010/6/7 Quanah Gibson-Mount <quanah(a)zimbra.com>: >>> >>> --On Monday, June 07, 2010 11:56 AM +0200 Frank Van Damme >>> What version of OpenLDAP are you using? You've failed to mention that >>> anywhere. >> >> 2.4.11 (Debian 5.0). > > There have been multiple fixes to smbk5pwd since that release. Plus > hundreds of fixes elsewhere in the software. I would highly advise you to > upgrade to a current release, and most specifically to build OpenLDAP with > OpenSSL rather than GnuTLS. Once you've done that, then see if you continue > to have issues. > > --Quanah I did so. I had some rough times trying to get through the compilation process (of version 2.4.21), because test 44 kept failing - then I disabled the dynlist overlay which tests the dynlist and compilation succeeded fine. The server works, too. But the original problem has not gone away. As soon as I try ldappasswd-ing with the smb5kpwd overlay enabled, the process hangs (at least, if authentication of the user I test this with, succeeds). The module is off course compiled from the contrib tree of 2.4.21. -- Frank Van Damme A: Because it destroys the flow of the conversation. Q: Why is it bad? A: No, it's bad. Q: Should I top post in replies to mailing lists or on Usenet?

2 2

How to change OpenLDAP database directory
by Mail Admin 23 Jun '10

23 Jun '10

Hello, I am very new to Linux and Openldap. We have setup a mail server on CentOS, Postfix, Dovecot, etc witth OpenLDAP as backend. 1) We want to change the daabase directory of Openldap from /var/lib/ldap to /var/vmail/ldap. Could someone please let me know the settings I need to make to achieve this? 2) I tried to creae /var/lib/ldap as a linked folder (actual database located under /var/vmail/ldap). Permissions to the files and folders under this were set exactly the same. when I start ldap service, i get the following error: backend_startup_one: bi_db_open failed! (-1) slap_startup failed (test would succeed using the -u switch) [FAILED] stale lock files may be present in /var/lib/ldap/dbname [WARNING] If I remove the linked folder and copy the contents to /var/lib/ldap, everything works perfectly fine. Is linked folder not going to work for ldap? or am I missing something here? (Please note that the folder /var/vmail is a separate LUN in the SAN). I would like to achieve any one of the scinario mentioned above. Any help on this would be highly appreciated. Best Regards PineMail Admin

1 0

Configuring slapd.conf-less OpenLDAP
by Braden McDaniel 22 Jun '10

22 Jun '10

I'm trying to get OpenLDAP up and running on Fedora (12) using the cn=config-based configuration. I've changed /etc/openldap/slapd.d/cn=config/oldCatabase={1}bdb.ldif to point to my domain: olcSuffix: dc=endoframe,dc=net olcRootDN: cn=Manager,dc=endoframe,dc=net And I've added: olcRootPW: [slappasswd output] However, I haven't had any luck using this password: # ldapadd -x -D "cn=Manager,dc=endoframe,dc=net" -W -f Manager.ldif Enter LDAP Password: ldap_bind: Invalid credentials (49) Is there some other way I should be specifying the password? -- Braden McDaniel <braden(a)endoframe.com>

2 2

Unigueness of RID; changing RID
by Nick Urbanik 22 Jun '10

22 Jun '10

Dear Folks, I am trying to improve my understanding of the RID before making many large deployments of syncrepl. My understanding is that the replica ID (RID) is unique within one level of [provider] --> [consumer], [consumer],... relationship. Here, an arrow --> represents replication of one directory tree from provider to consumers, and commas represent consumers at the same level, all replicating from the same provider, and the square brackets [...] represent one machine. 1. If there is a relationship like this, where at least one machine acts simultaneously as consumer and provider [provider] --> [consumer+provider] --> [consumer], [consumer],... does the RID need to be unique within all these consumers at all levels in the propagation of replication? 2. What are the consequences of changing the RID on a consumer? Would this inevitably require a dump and restore? Is the RID stored in the data? Where is it stored, besides in the consumer's syncrepl configuration? -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

3 4

Regression failure on openldap-2.4.21 stable (test058-syncrepl-asymmetric)
by Mark Cave-Ayland 22 Jun '10

22 Jun '10

Hi folks, I've just been testing a build of openldap-2.4.21 here in preparation for deployment, and have found that test058-syncrepl-asymmetric seems to fail randomly on our test box (on both i386 and amd64). A sample output is given below: >>>>> Starting test058-syncrepl-asymmetric for bdb... running defines.sh Initializing master configurations... Initializing search configurations... Starting central master slapd on TCP/IP port 9011... Using ldapsearch to check that central master slapd is running... Starting site1 master slapd on TCP/IP port 9012... Using ldapsearch to check that site1 master is running... Starting site2 master slapd on TCP/IP port 9013... Using ldapsearch to check that site2 master is running... Starting central search slapd on TCP/IP port 9014... Using ldapsearch to check that central search slapd is running... Starting site1 search slapd on TCP/IP port 9015... Using ldapsearch to check that site1 search slapd is running... Waiting 1 seconds for slapd to start... Starting site2 search slapd on TCP/IP port 9016... Using ldapsearch to check that site2 search slapd is running... Adding schema on ldap://localhost:9011/... Adding backend module on ldap://localhost:9011/... Adding schema on ldap://localhost:9012/... Adding backend module on ldap://localhost:9012/... Adding schema on ldap://localhost:9013/... Adding backend module on ldap://localhost:9013/... Adding schema on ldap://localhost:9014/... Adding backend module on ldap://localhost:9014/... Adding schema on ldap://localhost:9015/... Adding backend module on ldap://localhost:9015/... Adding schema on ldap://localhost:9016/... Adding backend module on ldap://localhost:9016/... Adding database config on central master... Adding database config on site1 master... Adding database config on site2 master... Adding access rules on central master... Adding access rules on site1 master... Adding access rules on site2 master... Adding database config on central search... Adding database config on site1 search... Adding database config on site2 search... Populating central master... Adding syncrepl on site1 master... Adding syncrepl on site2 master... Using ldapsearch to check that site1 master received changes... Using ldapsearch to check that site2 master received changes... Populating site1 master... Populating site2 master... Stopping site1 master... Adding syncrepl on central master... Using ldapsearch to check that central master received site2 entries... Restarting site1 master slapd on TCP/IP port 9012... Using ldapsearch to check that site1 master is running... Using ldapsearch to check that central master received site1 entries... Adding syncrepl consumer on central search... Adding syncrepl consumer on site1 search... Adding syncrepl consumer on site2 search... Using ldapsearch to check that central search received changes... Using ldapsearch to check that site1 search received changes... Using ldapsearch to check that site2 search received changes... Checking contextCSN after initial replication... Using ldapmodify to modify first backend on central master... Using ldapsearch to check replication to central search... Using ldapsearch to check replication to site1 search... Using ldapsearch to check replication to site2 search... Checking contextCSN after modify of first backend on central master... Using ldapmodify to modify second backend on central master... Using ldapsearch to check replication to site2 search... Using ldapsearch to check no replication to site1 master... Using ldapsearch to check no replication to central search... Checking contextCSN after modify of second backend on central master... Using ldapmodify to modify first backend on site1 master... Using ldapsearch to check replication to site1 search... Using ldapsearch to check replication to site2 master... Using ldapsearch to check no replication to site2 search... Using ldapsearch to check no replication to central search... Checking contextCSN after modify of first backend on site1 master... Using ldapmodify to modify second backend on site1 master... Using ldapsearch to check replication to site1 search... Using ldapsearch to check no replication to central master... Checking contextCSN after modify of second backend on site1 master... Using ldapmodify to modify first backend on site2 master... Using ldapsearch to check replication to central master... Using ldapsearch to check replication to site2 search... Using ldapsearch to check no replication to site1 master... Using ldapsearch to check no replication to central search... Checking contextCSN after modify of first backend on site2 master... Using ldapmodify to modify second backend on site2 master... Using ldapsearch to check replication to site2 search... Using ldapsearch to check no replication to central master... Checking contextCSN after modify of second backend on site2 master... Stopping central master and site2 servers to test start with emtpy db... Starting site2 master slapd on TCP/IP port 9013... Using ldapsearch to check that site2 master slapd is running... Starting site2 search slapd on TCP/IP port 9016... Using ldapsearch to check that site2 search slapd is running... Waiting 1 seconds for slapd to start... Waiting 2 seconds for slapd to start... Waiting 3 seconds for slapd to start... Starting central master slapd on TCP/IP port 9011... Using ldapsearch to check that central master slapd is running... Using ldapsearch to check that site2 master received base... Using ldapsearch to check that site2 search received base... Waiting 1 seconds for syncrepl to receive changes... Waiting 2 seconds for syncrepl to receive changes... Checking contextCSN after site2 servers repopulated... Adding syncrepl of second site1 master backend on central master... Using ldapsearch to check that central master received second site1 backend... Waiting 1 seconds for syncrepl to receive changes... Waiting 2 seconds for syncrepl to receive changes... Waiting 3 seconds for syncrepl to receive changes... Waiting 4 seconds for syncrepl to receive changes... Waiting 5 seconds for syncrepl to receive changes... ERROR: Second site1 backend not replicated to central master Restarting central master slapd on TCP/IP port 9011... Using ldapsearch to check that central master slapd is running... Waiting 1 seconds for slapd to start... Using ldapsearch to check that central master received second site1 backend... Using ldapsearch to check that central search received second site1 backend... Waiting 1 seconds for syncrepl to receive changes... Waiting 2 seconds for syncrepl to receive changes... Waiting 3 seconds for syncrepl to receive changes... Waiting 4 seconds for syncrepl to receive changes... Waiting 5 seconds for syncrepl to receive changes... ERROR: Second site1 backend not replicated to central search Restarting central search slapd on TCP/IP port 9014... Using ldapsearch to check that central search slapd is running... Waiting 1 seconds for slapd to start... Using ldapsearch to check that central search received second site1 backend... Running 1 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... ERROR: Entry not removed on central search! Race error found after 1 of 10 iterations Found 3 errors >>>>>> Exiting with a false success status for now >>>>> /home/build/deb/openldap/2.4.21/openldap_2.4.21.orig/tests/scripts/test058-syncrepl-asymmetric completed OK for bdb. Is this something I should be worried about? One thing to note is that the underlying disk array is being rebuilt with extra disks and so I/O performance is quite poor on this machine at the moment - so I'm wondering whether it's a timing issue with the test script rather than within openldap itself? ATB, Mark. -- Mark Cave-Ayland - Senior Technical Architect PostgreSQL - PostGIS Sirius Corporation plc - control through freedom http://www.siriusit.co.uk t: +44 870 608 0063 Sirius Labs: http://www.siriusit.co.uk/labs

2 3

Re: failed to start slapd & can't create password - please help.
by sam 22 Jun '10

22 Jun '10

Harry Jede wrote: > Am Sonntag, 20. Juni 2010 schrieb sam: > >> Hi, >> >> With the following setup: >> >> hometest:openldap # uname -a >> FreeBSD hometest.ip6.com.au <http://hometest.ip6.com.au> 8.1-RC1 >> FreeBSD 8.1-RC1 #0: Fri Jun 18 >> 15:26:58 EST 2010 >> root@hometest.ip6.com.au:/usr/ >> obj/usr/src/sys/mail.db.java.portal >> i386 >> hometest:openldap # pkg_info | grep -i ldap >> openldap-sasl-client-2.4.22 Open source LDAP client implementation >> with SASL2 support >> openldap-sasl-server-2.4.22 Open source LDAP server implementation >> hometest:openldap # pkg_info | grep -i db >> db46-4.6.21.4 The Berkeley DB package, revision 4.6 >> hometest:openldap # pkg_info | grep -i sasl >> cyrus-sasl-2.1.23 RFC 2222 SASL (Simple Authentication and Security >> Layer) >> cyrus-sasl-saslauthd-2.1.23 SASL authentication server for >> cyrus-sasl2 openldap-sasl-client-2.4.22 Open source LDAP client >> implementation with SASL2 support >> openldap-sasl-server-2.4.22 Open source LDAP server implementation >> >> I can't create password for ldap: >> hometest:openldap # slappasswd -h {MD5} -s password >> Password generation failed for scheme MD5: scheme not recognized >> >> and: >> >> hometest:rc.d # ./slapd start >> Starting slapd. >> ./slapd: WARNING: failed to start slapd >> >> slapd.conf file is shown below: >> >> # >> # See slapd.conf(5) for details on configuration options. >> # This file should NOT be world readable. >> # >> include /usr/local/etc/openldap/schema/core.schema >> >> #X.500 RFC1274 COSINE Pilot Schema >> include /usr/local/etc/openldap/schema/cosine.schema >> #For Addressbooks >> include /usr/local/etc/openldap/schema/inetorgperson.schema >> #For Authentication >> include /usr/local/etc/openldap/schema/nis.schema >> >> TLSCACertificateFile /usr/local/etc/ssl/cacert.pem >> TLSCertificateFile /usr/local/etc/openldap/ssl/portal.ip6.com.au.pem >> TLSCertificateKeyFile /usr/local/etc/openldap/ssl/private/cakey.pem >> TLSCipherSuite HIGH >> >> >> # Define global ACLs to disable default read access. >> >> # Do not enable referrals until AFTER you have a working directory >> # service AND an understanding of referrals. >> #referral ldap://root.openldap.org <http://root.openldap.org> >> >> pidfile /var/run/openldap/slapd.pid >> argsfile /var/run/openldap/slapd.args >> >> # Load dynamic backend modules: >> modulepath /usr/local/libexec/openldap >> moduleload back_bdb >> ##################################################################### >> ## # BDB database definitions >> ##################################################################### >> ## >> >> database bdb >> suffix "dc=ip6,dc=com,dc=au" >> rootdn "cn=Manager,dc=ip6,dc=com,dc=au" >> # Cleartext passwords, especially for the rootdn, should >> # be avoid. See slappasswd(8) and slapd.conf(5) for details. >> # Use of strong authentication encouraged. >> rootpw secret >> # The database directory MUST exist prior to running slapd AND >> # should only be accessible by the slapd and slap tools. >> # Mode 700 recommended. >> directory /var/db/openldap-data >> # Indices to maintain >> index objectClass eq >> >> Can anyone tell me how to start openldap and how to assign password >> to it? >> > I do not know why your slapd is not starting. > Have you added some data to your database? > Who is the owner of /var/db/openldap-data? > > Hi, thanks for the reply regarding to the problem of ldap is not starting. I haven't added any data to the ldap database yet, because I had problem of creating ldap password before. Should I add data to the ldap database before I can start ldap? Thanks agian for your help Sam > Most people do not want the md5-scheme, they need the md5 algo from > crypt. Try this: > > slappasswd -c '$1$%.8s' -s secret > {CRYPT}$1$HlW67YUS$DNY2T6859V9xh8frUpbXJ/ > > Read the man pages of slappasswd and slapd.conf. > > But pay attention, that slappasswd is NOT reading the config file > slpad.conf. This is at least true for my quite old version of slapd in > Debian Lenny (slapd 2.4.11) :-( . > > strace -e trace=file /usr/sbin/slappasswd -s secret 2>&1 | grep > slapd.conf > > returns nothing > > > > >> Your help is very much appreciated. >> >> Thanks >> Sam >> >> - >> > > > >

6 13

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical