openldap-technical

openldap-technical@openldap.org

9868 discussions

Implementing LDAP logging
by rahul.manchanda＠bt.com 21 Apr '10

21 Apr '10

Hi All, Even on specifying the loglevel and logfile directives in the slapd.conf ldap related logs are not being written to the file. However separate auditlog file is getting created successfully and all the update/delete/modify/insert operations are getting recorded successfully over there. I need to get the ldap related log file created as well but that is something not happening. Also tried specifying the LOCAL4 feature in the syslog.conf and restarted the system logging service but no luck with that as well. I don't want to put the logging options in the ldap start up command line argument but want the log file created from configuration itself. Can someone please suggest on this and also is there a way to implement log rotation for the ldap log file through configuration itself then that will be really helpful. Many Thanks in advance. Regards Rahul Manchanda ------------------------------------------------------------------------ ---------------------------------- Andes , Selfcare Platform Build Team tel: (+91) (20) 66018100 extn: 6178; e-mail: rahul.manchanda(a)bt.com Address: Tech Mahindra, Sharada Center, Erandwana Pune-4

1 0

how to constructure ldap entry when user status is changed
by owen nirvana 21 Apr '10

21 Apr '10

I have some user information ( with certificate ) ,like cn = bob, dc= one, dc = two ,dc = org sn: .. userCertificate;binary::... .. : ... someday , if he would be revoked, should i move it to another entry ( replace a new dn ), like cn = bob, dc = crl ,dc = two ,dc = org or maybe I use the same entry , like cn = bob, dc= one, dc = two ,dc = org sn: .. userCertificate;binary::... .. : ... revoked : true/false revokeTime : ... gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com>

1 0

Using Replication Slave For Authentication
by Ariel 20 Apr '10

20 Apr '10

I have inherited an openldap server (2.4.9) and have set about to making it a bit more fault tolerant. So I have added a syncrepl slave and everything seems to work fine. It pulls down the whole ldap tree and stays in sync in real time with type=refreshAndPersist. I can use command line tools to very that it has all the information from the original master server using a command like this: ldapsearch -xLL -H ldaps://ldap2.domain.com/ -b "dc=domain,dc=com" -D "cn=admin,dc=domain,dc=com" -W My problem however is that when I try to authenticate users against the slave server, it does not work. All attempts fail. Also when I use ApacheDS (graphical LDAP browser) to view its contents, it only shows the Root DSE and none of the child objects like cn=config or any of the users or any of that. I can use ApacheDS fine to view and modify everything on the master server though. The slapd.conf config files between the two are exactly the same (except one is declared as sync master and one as slave), the password hashes are successfully replicated to the slave as I can see with ldapsearch, but I have no idea how to debug why it won't authenticate users. For reference, here is my syncrepl config section (in slapd.conf) on the slave: syncrepl rid=123 provider=ldaps://ldap1.domain.com:636 type=refreshAndPersist searchbase="dc=domain,dc=com" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="uid=syncuser,ou=People,dc=domain,dc=com" credentials=syncpassword and on the master server: moduleload syncprov.la overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 As a failover/backup server seems extremely prudent especially on the ancient hardware we have running these things, I really want to get this to work properly. Perhaps even later doing a round-robin style load balancing between the two or what have you. I have no idea how to debug this, any help would be greatly appreciated! -a

2 1

openLDAP architecture - centralized repository and authentication
by Marot Laurent 20 Apr '10

20 Apr '10

Hi all, I'm far from being openLDAP and more generally Linux advanced user but I'd love to be if I could find some architecture guidance for the following use case. (I've only been playing from time to time with openLDAP on Windows boxes - shame on me :)) I'm currently using 30 Linux server in my business unit. Almost 10 different sysadmin have to administer those servers. I'd like to have a centralized directory gartering all those 30 x 10 accounts so that I could have one single place du manage my identities. All my servers could then authenticate agains this directory. Could openLDAP and some adding tools provide me the right architecture to reach this goal ? Any pointer on this issue will please me ( Google only lead me to basical information about configuring openLDAP on standalone linux boxes) Thanks a lot LM

2 1

Samba and ldap failover - RH / Centos problem?
by Götz Reinicke - IT Koordinator 20 Apr '10

20 Apr '10

Hi folks, I recently got my ldap master slave samba test environment up and runing. samba-3.0.33-3.15.el5_4.1 openldap-2.3.43-3.el5 The ldap systems sync fine, samba users are authenticated by each server seperatly if I set tham in the samba conf. E.g. passdb backend = ldapsam:"ldap://ldap2.filmakademie.de" and passdb backend = ldapsam:"ldap://ldap1.filmakademie.de" work. passdb backend = ldapsam:"ldap://ldap1.filmakademie.de ldap://ldap2.filmakademie.de" works as long, as ldap1 is up. If ldap1 is down, no authentication / switchover to ldap2 is done. I've googled, looked up the samba wiki and finaly I found a posting Fedora 4 related to probems with an ldap_initialize() function ... So my question, are ther any known problems or what may I check/debug? Thanks and best regards, Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

1 0

Re: openLDAP architecture - centralized repository and authentication
by Francis, Steve (IHG) 20 Apr '10

20 Apr '10

OpenLdap will definitly provide that, as I'm using it for all my new linux instances Steve Francis IHG - z/OS- zLinux Technical Advisor Sent from my BlackBerry ________________________________ From: openldap-technical-bounces+steve.francis=ihg.com(a)OpenLDAP.org <openldap-technical-bounces+steve.francis=ihg.com(a)OpenLDAP.org> To: openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> Sent: Mon Apr 19 09:10:17 2010 Subject: openLDAP architecture - centralized repository and authentication Hi all, I’m far from being openLDAP and more generally Linux advanced user but I’d love to be if I could find some architecture guidance for the following use case. (I’ve only been playing from time to time with openLDAP on Windows boxes – shame on me J) I’m currently using 30 Linux server in my business unit. Almost 10 different sysadmin have to administer those servers. I’d like to have a centralized directory gartering all those 30 x 10 accounts so that I could have one single place du manage my identities. All my servers could then authenticate agains this directory. Could openLDAP and some adding tools provide me the right architecture to reach this goal ? Any pointer on this issue will please me ( Google only lead me to basical information about configuring openLDAP on standalone linux boxes) Thanks a lot LM

1 0

Restricting acces using host attribute
by Francis, Steve (IHG) 19 Apr '10

19 Apr '10

Greetings, I have a Ldap server up and running, all is well. However, I would like to start restricing access to hosts using the host attribute, which if I'm correct is part of the account objectClass. This is a SLES 10.3 system. The id that I migrated from /etc/passwd had the host attribute, but all other id's created later via the YAST gui interface, do not. I believe this is because they are using inetOrgPerson, instead of account. Is there some way of adding the host attribute to newly added users? Steve Francis Technical Advisor - zSeries, zLinux, z/OS IHG Alpharetta Data Center Ph: 770-442-7157 Cell: 770-906-3122 IM: francisihg

1 2

Basic ACL question...I think.
by Ken Kleiner 18 Apr '10

18 Apr '10

Hi, I'm new to ACL creation. We have a fully functional ldap server implementation that is working quite well for user auth. What I'm trying to do is set up my ldap server so that when a specific host binds using a particular DN, that host only sees specific entries in the ou=People tree, so that getent, id, nss, pam, etc only recognizes those users. Is this possible? I'm stumped. Thanks. Ken Kleiner System Manager University of Massachusetts Lowell Computer Science Department 978 934 3645

2 3

Adding Objectclass account gives object class violation
by Shamika Joshi 16 Apr '10

16 Apr '10

I'm using samba-openldap on Ubuntu 9.10 Server. I have created following user:rick using smbldap-tools which use default samba.schema.eg shown below. Now I also want to use "Host based authentication" using pam_filter where I need to mention host entry which has to be present in that user record. pam_filter |(host=cms2)(host=cms3) However "host" attribute appears only if I add "objectclass:account". If I go ahead to add that here for user:rick it gives me objectclass violation. What could be the way out of it? Any inputs would be highly appreciated cn: rick objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSamAccount sn: rick givenName: rick uid: rick uidNumber: 30003 gidNumber: 513 homeDirectory: /home/rick loginShell: /bin/bash gecos: System User sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 sambaPwdMustChange: 2147483647 displayName: rick sambaAcctFlags: [UX] sambaSID: S-1-5-21-1045966857-3925637060-4258372004-61006 sambaPrimaryGroupSID: S-1-5-21-1045966857-3925637060-4258372004-513 sambaLogonScript: logon.bat sambaProfilePath: \\x6\profiles\rick sambaHomePath: \\x6\rick sambaHomeDrive: H: sambaLMPassword: 01FC5A6BE7BC6929AAD3B435B51404EE sambaNTPassword: 0CB6948805F797BF2A82807973B89537 sambaPwdLastSet: 1271227877 userPassword: test Thanks Shamika

6 17

Re: RPM spec file
by Chris Jacobs 16 Apr '10

16 Apr '10

Be careful - it didn't do what I wanted (like 64 bit). And on top of that, none of the tools were in the default paths. - chris PS: I only found that after tons of googling too. Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ----- Original Message ----- From: openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org <openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org> To: jonathan(a)openldap.org <jonathan(a)openldap.org> Cc: openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> Sent: Thu Apr 15 19:20:16 2010 Subject: RE: RPM spec file > On 15/04/2010 16:38, Joe Friedeggs wrote: >> >> I need to build a Red Hat rpm for the latest OpenLDAP release. I am looking for spec file, howto page, or anything else that might speed up this project. Any advice/suggestions would be greatly appreciated. > > The folks at LTB-project maintain RPMs for recent OpenLDAP releases. You > could either use their pre-built RPMs or grab their spec file from the > repository: > > http://ltb-project.org/wiki/documentation/openldap-rpm > > Jonathan I googled the HECK out of that rpm.......how did I miss the LBT :-( Thanks, Jonathan, that is just what I was looking for. And thanks to all others that provided input. Joe _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. http://clk.atdmt.com/GBL/go/196390706/direct/01/ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical