openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Pre-requisites to enable SSL/TLS in OpenLDAP 2.4
by Arun Srinivasan 24 Mar '10

24 Mar '10

Hi All, I am using OpenLDAP 2.4.21 on RHEL 5.3. I have configured the openldap with "./configure --with-tls" option to enable ssl in the server. I used the built-in openssl that comes with RHEL 5.3. Berkley GB is 4.8.26. But after creating the certificates and configuring the slapd.conf with the below lines: TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /usr/local/etc/openldap/cacert.pem TLSCertificateFile /usr/local/etc/openldap/servercrt.pem TLSCertificateKeyFile /usr/local/etc/openldap/serverkey.pem However, when I try to run the slapd with the -h option as "/usr/local/libexec/slapd -h "ldap:// ldaps://" -d 255" then I get the following output: >>>>>>>> daemon_init: ldap:// ldaps:// daemon_init: listen on ldap:// daemon_init: listen on ldaps:// daemon_init: 2 listeners to open... ldap_url_parse_ext(ldap://) daemon: listener initialized ldap:// ldap_url_parse_ext(ldaps://) daemon: TLS not supported (ldaps://) slapd stopped. connections_destroy: nothing to destroy. >>>>>>>>> I am guessing something is wrong at the openldap configuration level itself. Can somebody let me know what are the pre-requisites to be followed while configuring openldap (configure options)so that SSL can be enabled successfully. Thanks

2 1

Quick help on ldap modify with different domain name
by Meena Ram 24 Mar '10

24 Mar '10

Dear folks: Wanted some quick help in deleting the entries and adding more users with a different set of DN Our DN earlier was like this cn = manager, dc = ind, dc=ban, dc =com. now it is changed to three levels like cn = manager, dc = gubbi, dc = ind, dc=ban, dc =com. when i try to modify using ldap modify i can not modify instead i get the following error: One more level is added. I get the following error if i try to modify using ldapmodify modifying entry "dc=gubbi,dc=ind,dc=ban,dc=com" ldap_modify: Constraint violation (19) additional info: structuralObjectClass: no user modification allowed Cheers!!!!!!! RAM ________________________________ From: Meena Ram <meenaram21(a)yahoo.com> To: openldap-technical(a)openldap.org Sent: Thu, March 11, 2010 6:07:03 PM Subject: brief tips and tricks for running ldaps on slackware Dear folks: If any one has a brief tips, tricks or cheatsheet for running slapd with SSL/TLS can you please post it. plain ldap works perfect but ldaps search and related stuff seams to have some issues Cheers!!!!!!!!

2 1

Re: Problem with getent passwd
by Tyler Gates 24 Mar '10

24 Mar '10

And don't forget nsswitch. ldap should be first for group and passwd. On Mar 23, 2010, at 8:25 PM, Tyler Gates <tgates81(a)gmail.com> wrote: > Sounds like it's a problem with your client side pam_ldap > authentication. There's a whole buch of steps to get that working, > just google it. If you have a redhat variant authconfig or setup > will step you through it. It would help if you could post your > system_auth file. > > On Mar 23, 2010, at 11:40 AM, Lynn York <lynn.york(a)mavenwire.com> > wrote: > >> Hello, >> >> >> >> When I issue “getent passwd” I can see it query >> the ldap server for all the information and the server is returnin >> g the correct information. However, “getent passwd” doesn’t >> actually show the users that are in ldap. I am not sure where my >> problem might be. Can anyone offer any suggestions on where to look? >> >> >> >> Lynn York II >> >> MavenWire Hosting Admin >> >> www.mavenwire.com >> >> (866) 343-4870 x717 >> >> >> >> MavenWire - We DELIVER >> >> http://www.mavenwire.com >> >> >> >> This e-mail and any attached files may contain confidential and/or >> privileged material for the sole use of the intended recipient. >> Any review, use, distribution or disclosure by others is strictly >> prohibited. If you are not the intended recipient (or authorized to >> receive this e-mail for the recipient), you may not review, copy or >> distribute this message. Please contact the sender by reply e-mail >> and delete all copies of this message. >> >> >> >> MavenWire - We DELIVER >> http://www.mavenwire.com >> >> This e-mail and any attached files may contain confidential and/or >> privileged material for the sole use of the intended recipient. >> Any review, use, distribution or disclosure by others is strictly >> prohibited. If you are not the intended recipient (or authorized to >> receive this e-mail for the recipient), you may not review, copy or >> distribute this message. Please contact the sender by reply e-mail >> and delete all copies of this message. >>

2 1

Re: Tips when implementing password policies
by Chris Jacobs 24 Mar '10

24 Mar '10

Okay, it says: "If pwdChangedTime does not exist, the user's password will not expire." How have you guys dealt with this? I suspect that just asking people to please change their passwords so we can make sure they expire will result in a low turn-out rate. :p I also don't want people to just end-up locked out either, if at all possible. Thoughts? Thanks! - chris Chris Jacobs, Jr. Unix System Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ----- Original Message ----- From: Howard Chu <hyc(a)symas.com> To: Chris Jacobs Cc: 'tgates81(a)gmail.com' <tgates81(a)gmail.com>; 'openldap-technical(a)openldap.org' <openldap-technical(a)openldap.org> Sent: Tue Mar 23 19:27:53 2010 Subject: Re: Tips when implementing password policies Chris Jacobs wrote: > I've a few accounts that I was testing with - after I set the password /after/ ppolicy was in place, things work as expected. Password history, # grace auths, etc. > > However, for those accounts existing before the ppolicy was in place, no enforcement - there's no password change date set, nor any other policy items added - other than the pwdpolicysubentry. Please read the slapo-ppolicy(5) manpage. In particular, read the description of the pwdChangedTime attribute. > One note: early on in the old ldap installations use, inetorgperson wasn't > a class on accounts. Is that necessary for pwdpolicy? Would that make everything else work for the legacy accounts? > > I'll send an example LDIF of a test account and a legacy account later. > - chris -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

3 3

Re: Tips when implementing password policies
by Chris Jacobs 24 Mar '10

24 Mar '10

I've a few accounts that I was testing with - after I set the password /after/ ppolicy was in place, things work as expected. Password history, # grace auths, etc. However, for those accounts existing before the ppolicy was in place, no enforcement - there's no password change date set, nor any other policy items added - other than the pwdpolicysubentry. One note: early on in the old ldap installations use, inetorgperson wasn't a class on accounts. Is that necessary for pwdpolicy? Would that make everything else work for the legacy accounts? I'll send an example LDIF of a test account and a legacy account later. - chris Chris Jacobs, Jr. Unix System Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ----- Original Message ----- From: Tyler Gates <tgates81(a)gmail.com> To: Chris Jacobs Cc: openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> Sent: Tue Mar 23 18:55:21 2010 Subject: Re: Tips when implementing password policies pwdPolicySubentry should work -it's honored in place of the default password policy which is set in your config. If it doesn't work than likely your config lacks the necessary directives to use ppolicy. As far as enforcement pwdMustchange can be set in your policy which looks at the entrys pwdReset value. If both are true then ldap will allow a limited set of rights on the dn enough to bind as tls or ssl and change his or her password. On Mar 23, 2010, at 5:19 PM, Chris Jacobs <Chris.Jacobs(a)apollogrp.edu> wrote: > Hello, > > I'm upgrading our LDAP infrastructure (it'll be a cut-over) and I've > noticed that after adding pwdPolicySubentry to a user's account, it > doesn't seem to have any affect. > > This user hasn't /ever/ reset their password, and the user's account > doesn't show any password policy grace period usage after the test. > > The pwdPolicySubentry is still the only password policy related > entry on his account. > > This suggests that I'll need to force people to change their > password's at some point. > > 1) Is what I'm seeing normal/expected? > 2) What method(s) have you used to force people to change their > password - beyond asking them? > > Thanks! > - chris > > Chris Jacobs, Jr. Linux Administrator, Information Technology & > Operations > Apollo Group | Apollo Marketing | Aptimus, Inc. > 2001 6th Ave | Ste 3200 | Seattle, WA 98121 > phone: 206.441-9100 x1245 | cell: 206.601.3256 | Fax: 208.441.9661 > email: chris.jacobs(a)apollogrp.edu > > This message is private and confidential. If you have received it in > error, please notify the sender and remove it from your system. > > This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 1

Tips when implementing password policies
by Chris Jacobs 24 Mar '10

24 Mar '10

Hello, I'm upgrading our LDAP infrastructure (it'll be a cut-over) and I've noticed that after adding pwdPolicySubentry to a user's account, it doesn't seem to have any affect. This user hasn't /ever/ reset their password, and the user's account doesn't show any password policy grace period usage after the test. The pwdPolicySubentry is still the only password policy related entry on his account. This suggests that I'll need to force people to change their password's at some point. 1) Is what I'm seeing normal/expected? 2) What method(s) have you used to force people to change their password - beyond asking them? Thanks! - chris Chris Jacobs, Jr. Linux Administrator, Information Technology & Operations Apollo Group | Apollo Marketing | Aptimus, Inc. 2001 6th Ave | Ste 3200 | Seattle, WA 98121 phone: 206.441-9100 x1245 | cell: 206.601.3256 | Fax: 208.441.9661 email: chris.jacobs(a)apollogrp.edu This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 1

Re: brief tips and tricks for running ldaps on slackware
by Meena Ram 23 Mar '10

23 Mar '10

1 0

Problem with getent passwd
by Lynn York 23 Mar '10

23 Mar '10

Hello, When I issue “getent passwd” I can see it query the ldap server for all the information and the server is returning the correct information. However, “getent passwd” doesn’t actually show the users that are in ldap. I am not sure where my problem might be. Can anyone offer any suggestions on where to look? Lynn York II MavenWire Hosting Admin www.mavenwire.com (866) 343-4870 x717 MavenWire - We DELIVER http://www.mavenwire.com This e-mail and any attached files may contain confidential and/or privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive this e-mail for the recipient), you may not review, copy or distribute this message. Please contact the sender by reply e-mail and delete all copies of this message. MavenWire - We DELIVER http://www.mavenwire.com This e-mail and any attached files may contain confidential and/or privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive this e-mail for the recipient), you may not review, copy or distribute this message. Please contact the sender by reply e-mail and delete all copies of this message.

1 0

RE: attribute 'pwdPolicySubentry' cannot have multiple values
by Chris Jacobs 23 Mar '10

23 Mar '10

Howard, Tyler, Michael, My apologies: I take that back. The entry is indeed on the account - and it is, in fact, a system attribute. I will endeavor to not reply to messages at 4am in the future - a bit too quick on the /assume/ thing. BTW: How do you identify whether an attribute will be a system attribute or not? I've plenty to learn on ldap, but even I knew to look at the schema file - and I'm not certain how one could know whether an attribute would be a system attribute. Anyway - assuming the policy functions as expected - I'm nearly done with this beast of a one-man project. Thanks! - chris PS: I'd failed to reply-to-all on my previous emails. Please pardon my mailing list etiquette and use failure. :) ________________________________________ From: Chris Jacobs Sent: Monday, March 22, 2010 4:12 AM To: Howard Chu Subject: RE: attribute 'pwdPolicySubentry' cannot have multiple values No - there's no pwdPolicySubEntry entry. The contents of the LDAP db were built via a slapcat dump from an OpenLDAP 2.2 installation, with no ppolicy. As you can see from the LDIF of the chrisjtest 'account' - there's no pwdPolicySubEntry currently. Apache's directory studio and slapcat agree. - chris ________________________________________ From: Howard Chu [hyc(a)symas.com] Sent: Saturday, March 20, 2010 2:49 AM To: Tyler Gates Cc: Chris Jacobs; openldap-technical(a)openldap.org Subject: Re: attribute 'pwdPolicySubentry' cannot have multiple values Tyler Gates wrote: > I'm pretty sure pwdPolicySubEntry requires the pwdPolicy objectClass > in the target dn No. The pwdPolicy class is for the entry that contains the policy attributes, not the entry being controlled by the policy. > although that wouldn't explain the error message... The error message is quite clear - the pwdPolicySubentry attribute is single-valued, you can't set multiple values for it. > Are you sure the attribute doesn't already exist? It is a system > attribute so depending on the browser you are using at may not appear. That's most likely what's going on here. > On Mar 19, 2010, at 6:59 PM, Chris Jacobs<Chris.Jacobs(a)apollogrp.edu> > wrote: > >> Hello, >> >> I've got my ldap infrastructure (mirrormode masters, 2 slaves per >> datacenter) working fantastic (I can clear a db on a remote slave >> and in less than 30 seconds after startup, it'll reacquire the >> entire db!). >> >> I'm now having an issue with one of the very last things: getting a >> password policy into effect. >> >> When I attempt to add the 'pwdPolicySubentry' attribute to a user >> account, I get the error: >> >> Mar 19 22:51:24 ldapmaster1 slapd[8731]: Entry >> (uid=chrisjtest,ou=people,dc=unix,dc=aptimus,dc=net), attribute >> 'pwdPolicySubentry' cannot have multiple values >> Mar 19 22:51:24 ldapmaster1 slapd[8731]: entry failed schema check: >> attribute 'pwdPolicySubentry' cannot have multiple values >> >> I get that error in the logs whether I try to add it by hand via >> Apache Directory Studio, or an ldif import/modify: >> >> dn: uid=chrisjtest,ou=people,dc=unix,dc=aptimus,dc=net >> changetype: modify >> add: pwdPolicySubentry >> pwdPolicySubentry: cn=default,ou=policies,dc=unix,dc=aptimus,dc=net >> >> Here are the related slapd.conf overlay directives: >> >> overlay ppolicy >> ppolicy_hash_cleartext >> ppolicy_use_lockout >> >> (Notice there's no ppolicy_default set - I'm still testing this >> feature out before I roll it out.) >> >> And for completeness, here's the entry that I'm attempting to add >> this attribute to: >> >> dn: uid=chrisjtest,ou=people,dc=unix,dc=aptimus,dc=net >> objectClass: top >> objectClass: inetOrgPerson >> objectClass: posixAccount >> objectClass: shadowAccount >> cn: ChrisJ Test >> gidNumber: 200 >> homeDirectory: /home/chrisjtest >> sn: chrisjtest >> uid: chrisjtest >> uidNumber: 583 >> description: ChrisJ Test >> gecos: ChrisJ Test >> loginShell: /bin/bash >> shadowLastChange: 14657 >> userPassword::<<snipped>> >> >> And here's the password policy ldif: >> >> dn: ou=policies,dc=unix,dc=aptimus,dc=net >> objectClass: organizationalUnit >> objectClass: top >> ou: policies >> >> dn: cn=default,ou=policies,dc=unix,dc=aptimus,dc=net >> objectClass: top >> objectClass: device >> objectClass: pwdPolicy >> cn: default >> pwdAttribute: userPassword >> pwdAllowUserChange: TRUE >> pwdExpireWarning: 172800 >> pwdFailureCountInterval: 0 >> pwdGraceAuthNLimit: 0 >> pwdInHistory: 10 >> pwdLockout: TRUE >> pwdLockoutDuration: 1200 >> pwdMaxAge: 15897600 >> pwdMaxFailure: 3 >> pwdMinLength: 8 >> pwdMustChange: FALSE >> pwdSafeModify: TRUE >> >> When I built openldap, I enabled all overlays (I know, not the most >> efficient), and when I attempt to add moduleload ppolicy.la or >> ppolicy.so I get in the logs: >> >> line 18 (moduleload ppolicy.la) >> module_load: (ppolicy.la) already present (static) >> >> Which I'm pretty sure means it's already loaded... >> >> Any idea as to what I'm doing wrong? >> >> Thanks, >> - chris >> >> Chris Jacobs, Jr. Linux Administrator, Information Technology& >> Operations >> Apollo Group | Apollo Marketing | Aptimus, Inc. >> 2001 6th Ave | Ste 3200 | Seattle, WA 98121 >> phone: 206.441-9100 x1245 | cell: 206.601.3256 | Fax: 208.441.9661 >> email: chris.jacobs(a)apollogrp.edu >> >> >> This message is private and confidential. If you have received it in >> error, please notify the sender and remove it from your system. >> >> > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 1

Difficulty configuring a shared addressbook
by Jonathan 22 Mar '10

22 Mar '10

Despite following 2 tutorials, seems we're not able to get openldap configured correctly. Since this had to be done yesterday, is there anyone on this list who is available for an hour or 2 of consulting to get this running? Ideally tonight (Pacific time). Server is running fine, and no problem logged in as manager, but can't add the schema or a new user (dies with "Server is unwilling to perform (53) -- additional info: no global superior knowledge" or "ldapadd: No such object (32)"). Also TLS dies with "TLS: peer cert untrusted or revoked (0x42)" even though we are using a good, working SSL certificate. Also concerned about any unexpected issues trying to get a shared addressbook working across Thunderbird, Outlook, and others. Many thanks.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical