openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

RE: database is not a shadow
by Chris Jacobs 13 Mar '10

13 Mar '10

Ok, this is embarrassing. Issue: I'd set the provider to itself (on ldapmaster2): syncrepl rid=1 provider=ldaps://ldapmaster2.corp.aptimus.net type=refreshAndPersist interval=00:00:10:00 searchbase="dc=unix,dc=aptimus,dc=net" bindmethod=simple binddn="uid=root,ou=people,dc=unix,dc=aptimus,dc=net" credentials="Ten%20two" retry="15 20 60 +" mirrormode on changed to what it should be (ldapmaster1) and it started up fine. Odd error though. PS: I'd love to reply to my original message, but I haven't received it (I had recently changed my options to receive an email for each, rather than a digest) -----Original Message----- From: Chris Jacobs Sent: Friday, March 12, 2010 2:54 PM To: 'openldap-technical(a)openldap.org' Subject: database is not a shadow I'm getting a really odd error when trying to start slapd: [root@ldapmaster2 ~]# /usr/local/libexec/slapd -u ldap -h 'ldap:/// ldaps:///' -d5 @(#) $OpenLDAP: slapd 2.4.21 (Mar 9 2010 10:37:55) $ root@localhost.localdomain:/cust/appbuilds/openldap-2.4.21/servers/slapd ldap_pvt_gethostbyname_a: host=ldapmaster2.corp.aptimus.net, r=0 daemon_init: ldap:/// ldaps:/// daemon_init: listen on ldap:/// daemon_init: listen on ldaps:/// daemon_init: 2 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// ldap_url_parse_ext(ldaps:///) daemon: listener initialized ldaps:/// daemon_init: 4 listeners opened ldap_create slapd init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Berkeley DB 4.6.21: (September 27, 2007) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Berkeley DB 4.6.21: (September 27, 2007) ==> translucent_initialize >>> dnNormalize: <> <<< dnNormalize: <> >>> dnNormalize: <cn=Subschema> => ldap_bv2dn(cn=Subschema,0) <= ldap_bv2dn(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnNormalize: <cn=subschema> >>> dnNormalize: <ou=assets,dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(ou=assets,dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(ou=assets,dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(ou=assets,dc=unix,dc=aptimus,dc=net)=0 <<< dnNormalize: <ou=assets,dc=unix,dc=aptimus,dc=net> bdb_db_init: Initializing BDB database >>> dnPrettyNormal: <dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unix,dc=aptimus,dc=net)=0 <<< dnPrettyNormal: <dc=unix,dc=aptimus,dc=net>, <dc=unix,dc=aptimus,dc=net> >>> dnPrettyNormal: <uid=root,ou=people,dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(uid=root,ou=people,dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 <<< dnPrettyNormal: <uid=root,ou=people,dc=unix,dc=aptimus,dc=net>, <uid=root,ou=people,dc=unix,dc=aptimus,dc=net> >>> dnNormalize: <dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unix,dc=aptimus,dc=net)=0 <<< dnNormalize: <dc=unix,dc=aptimus,dc=net> >>> dnNormalize: <uid=root,ou=people,dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(uid=root,ou=people,dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 <<< dnNormalize: <uid=root,ou=people,dc=unix,dc=aptimus,dc=net> put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ber_scanf fmt (m) ber: ldap_url_parse_ext(ldaps://ldapmaster2.corp.aptimus.net) ldap_url_parse_ext(ldap:///) ldap_url_parse_ext(ldap:///) ldap_url_parse_ext(ldaps:///) /etc/openldap/slapd.conf: line 75: <mirrormode> database is not a shadow slapd destroy: freeing system resources. syncinfo_free: rid=001 slapd stopped. connections_destroy: nothing to destroy. Needless to say, this server will be a mirror - and I'd had this config working previously. The other server, setup seemingly identically works fine. What the heck does this error mean? - chris Chris Jacobs, Jr. Linux Administrator, Information Technology & Operations Apollo Group | Apollo Marketing | Aptimus, Inc. 2001 6th Ave | Ste 3200 | Seattle, WA 98121 phone: 206.441-9100 x1245 | cell: 206.601.3256 | Fax: 208.441.9661 email: chris.jacobs(a)apollogrp.edu This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

database is not a shadow
by Chris Jacobs 12 Mar '10

12 Mar '10

I'm getting a really odd error when trying to start slapd: [root@ldapmaster2 ~]# /usr/local/libexec/slapd -u ldap -h 'ldap:/// ldaps:///' -d5 @(#) $OpenLDAP: slapd 2.4.21 (Mar 9 2010 10:37:55) $ root@localhost.localdomain:/cust/appbuilds/openldap-2.4.21/servers/slapd ldap_pvt_gethostbyname_a: host=ldapmaster2.corp.aptimus.net, r=0 daemon_init: ldap:/// ldaps:/// daemon_init: listen on ldap:/// daemon_init: listen on ldaps:/// daemon_init: 2 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// ldap_url_parse_ext(ldaps:///) daemon: listener initialized ldaps:/// daemon_init: 4 listeners opened ldap_create slapd init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Berkeley DB 4.6.21: (September 27, 2007) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Berkeley DB 4.6.21: (September 27, 2007) ==> translucent_initialize >>> dnNormalize: <> <<< dnNormalize: <> >>> dnNormalize: <cn=Subschema> => ldap_bv2dn(cn=Subschema,0) <= ldap_bv2dn(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnNormalize: <cn=subschema> >>> dnNormalize: <ou=assets,dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(ou=assets,dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(ou=assets,dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(ou=assets,dc=unix,dc=aptimus,dc=net)=0 <<< dnNormalize: <ou=assets,dc=unix,dc=aptimus,dc=net> bdb_db_init: Initializing BDB database >>> dnPrettyNormal: <dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unix,dc=aptimus,dc=net)=0 <<< dnPrettyNormal: <dc=unix,dc=aptimus,dc=net>, <dc=unix,dc=aptimus,dc=net> >>> dnPrettyNormal: <uid=root,ou=people,dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(uid=root,ou=people,dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 <<< dnPrettyNormal: <uid=root,ou=people,dc=unix,dc=aptimus,dc=net>, <uid=root,ou=people,dc=unix,dc=aptimus,dc=net> >>> dnNormalize: <dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unix,dc=aptimus,dc=net)=0 <<< dnNormalize: <dc=unix,dc=aptimus,dc=net> >>> dnNormalize: <uid=root,ou=people,dc=unix,dc=aptimus,dc=net> => ldap_bv2dn(uid=root,ou=people,dc=unix,dc=aptimus,dc=net,0) <= ldap_bv2dn(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=root,ou=people,dc=unix,dc=aptimus,dc=net)=0 <<< dnNormalize: <uid=root,ou=people,dc=unix,dc=aptimus,dc=net> put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ber_scanf fmt (m) ber: ldap_url_parse_ext(ldaps://ldapmaster2.corp.aptimus.net) ldap_url_parse_ext(ldap:///) ldap_url_parse_ext(ldap:///) ldap_url_parse_ext(ldaps:///) /etc/openldap/slapd.conf: line 75: <mirrormode> database is not a shadow slapd destroy: freeing system resources. syncinfo_free: rid=001 slapd stopped. connections_destroy: nothing to destroy. Needless to say, this server will be a mirror - and I'd had this config working previously. The other server, setup seemingly identically works fine. What the heck does this error mean? - chris Chris Jacobs, Jr. Linux Administrator, Information Technology & Operations Apollo Group | Apollo Marketing | Aptimus, Inc. 2001 6th Ave | Ste 3200 | Seattle, WA 98121 phone: 206.441-9100 x1245 | cell: 206.601.3256 | Fax: 208.441.9661 email: chris.jacobs(a)apollogrp.edu This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

Issues migrating from Linux passwd file to OpenLDAP
by Steve Cross 12 Mar '10

12 Mar '10

Hello all, Here is the issue that I am having. I have recently setup an OpenLDAP database for my local network. My goal is to use this for authentication for all clients on my network. I have been able to configure slapd.conf and the server will start up and run just fine. I have been using the migration tools to convert from the Linux style passwd file to .ldif files to import into my shiny new LDAP database. Everything goes smoothly, including the ldapadd command to import the ldif files. I am importing my users and my groups, as well as the base information for my site. Everything imports in, and i can find every user's DN using ldapsearch, but whenever I try to authenticate with any user imported from the passwd file, it fails authentication. However, if i go and change the user's password with ldappasswd then it will let me authenticate just fine for that user. I think this issue has to do with the fact that ldapadd automatically hashes the value stored in userPassword, but this seems to be causing issues with the SMD5 passwords that are stored in my shadow file. I've tried using {CLEARTEXT}, {CRYPT}, {MD5}, and {SMD5} before the value in the userPassword field, but no matter what i cannot login with the user's actual password. Is there any way to prevent ldapadd from hashing the userPassword value, since it already is encrypted? If not, what is the correct method for importing from passwd file that will not require me to change every user's password manually once imported into the LDAP directory. Below is my system setup. Slackware Linux 12.2 OpenLDAP 2.4.21 compiled from source passwd file encryption type: Salted MD5 If you need any more information please don't hesitate to ask. I am willing to provide any information necessary to get this going. Any help or pointers that I can get on this situation would be GREATLY appreciated. Thanks, Steve

2 1

OpenLDAP DB_CONFIG values for a big Server
by Echedey Lorenzo 12 Mar '10

12 Mar '10

Hi, Soon I'll have a x64 Suse machine with 16GB RAM and 4 Intel Cores. We need our OpenLDAP Server to be as fast as possible. I wonder which DB_CONFIG values are suitable for this. Maybe... set_cachesie 14 0 4 set_lg_regionmax 262144 set_lg_bsize 2097152 set_flags DB_LOG_AUTOREMOVE ...? Directory will have around 6~8 million entries. I'm not sure if they will be entirely uploaded to the RAM cache, but at least part of will improve speed, I think. Any help will be appreciated since my experiences with OpenLDAP performance against Sun Directory Server 5.2 has not been good, taking several seconds to answer any ldaprequest :( -- -------------------------------------------- | Echedey Lorenzo Arencibia | --------------------------------------------

4 8

syncrepl not working for pwdFailureTime attribute
by Alex Samad 12 Mar '10

12 Mar '10

Hi I have setup a multi master as per the online doco. When I was checking recently, the 2 DB were out of sync, some record hadn't been transferred over, I force this by setting -c rid=,csn= But whilst checking this, I noticed that some attributes haven't been moved across pwdFailureTime was on a record on the primary ldap server and not on the secondary master, try what I could I couldn't force it over is this a feature or a bug ? Alex

5 5

brief tips and tricks for running ldaps on slackware
by Meena Ram 12 Mar '10

12 Mar '10

Dear folks: If any one has a brief tips, tricks or cheatsheet for running slapd with SSL/TLS can you please post it. plain ldap works perfect but ldaps search and related stuff seams to have some issues Cheers!!!!!!!!

2 1

Error code -12 with ldap_sasl_bind
by Thilko Richter 12 Mar '10

12 Mar '10

Hello, In the following debug snippet I make an ldap_intit and an ldap_sasl_bind_s afterwards. In the end an unbind follows. My problem is, that I get an error code '-12' for the ldap_sasl_bind. Does anyone has a clue why the bin doesnt work? Mar 8 12:03:06 matrix slapd[3505]: conn=3 fd=15 ACCEPT from IP=[::1]:56601 (IP=[::]:389) Mar 8 12:03:06 matrix slapd[3505]: daemon: activity on 1 descriptor Mar 8 12:03:06 matrix slapd[3505]: daemon: activity on: Mar 8 12:03:06 matrix slapd[3505]: Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=9 active_threads=0 tvp=zero Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=10 active_threads=0 tvp=zero Mar 8 12:03:06 matrix slapd[3505]: daemon: activity on 1 descriptor Mar 8 12:03:06 matrix slapd[3505]: daemon: activity on: Mar 8 12:03:06 matrix slapd[3505]: 15r Mar 8 12:03:06 matrix slapd[3505]: Mar 8 12:03:06 matrix slapd[3505]: daemon: read active on 15 Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=9 active_threads=0 tvp=zero Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=10 active_threads=0 tvp=zero Mar 8 12:03:06 matrix slapd[3505]: connection_get(15) Mar 8 12:03:06 matrix slapd[3505]: connection_get(15): got connid=3 Mar 8 12:03:06 matrix slapd[3505]: connection_read(15): checking for input on id=3 Mar 8 12:03:06 matrix slapd[3505]: op tag 0x42, time 1268046186 ======== I think here is the problem Mar 8 12:03:06 matrix slapd[3505]: ber_get_next on fd 15 failed errno=0 (Success) Mar 8 12:03:06 matrix slapd[3505]: connection_read(15): input error=-2 id=3, closing. ======== Mar 8 12:03:06 matrix slapd[3505]: connection_closing: readying conn=3 sd=15 for close Mar 8 12:03:06 matrix slapd[3505]: connection_close: deferring conn=3 sd=15 Mar 8 12:03:06 matrix slapd[3505]: conn=3 op=0 do_unbind Mar 8 12:03:06 matrix slapd[3505]: conn=3 op=0 UNBIND Mar 8 12:03:06 matrix slapd[3505]: connection_resched: attempting closing conn=3 sd=15 Mar 8 12:03:06 matrix slapd[3505]: connection_close: conn=3 sd=15 Mar 8 12:03:06 matrix slapd[3505]: daemon: removing 15 Mar 8 12:03:06 matrix slapd[3505]: conn=3 fd=15 closed Mar 8 12:03:06 matrix slapd[3505]: daemon: activity on 1 descriptor Mar 8 12:03:06 matrix slapd[3505]: daemon: activity on: Mar 8 12:03:06 matrix slapd[3505]: Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=9 active_threads=0 tvp=zero Mar 8 12:03:06 matrix slapd[3505]: daemon: epoll: listen=10 active_threads=0 tvp=zero Since I try to build up a ruby Binding for OpenLdap with ffi I dont have c code here, but the ruby snippet is: handle = ldap_init "localhost", 389 res = ldap_sasl_bind_s handle, 'cn=admin,ou=users,dc=thilko,dc=net', '', 'x', nil, nil, nil p " the result: #{res}" and the result is '-12'. Note that I am using ffi, so the function 'ldap_sasl_bind_s' is a call to the native function defined in ldap.h. I try to use LDAP_SASL_SIMPLE. I also tried to use a ber_val struct as password and servercred - the same effect. I stepped through some source code in openLdap, but I dont know where the error code '-12' comes from and where to find some documentation. Thx a lot for help, Thilko

1 0

Is there an "authconfig" tool in ubuntu?
by Zengming Zhang 11 Mar '10

11 Mar '10

Hi everyone: In redhat system there is a tool named "authconfig" which is used to configure user authentication method on clients. What I want to know is that is there a similar tool in ubuntu system? I am going to set up a group system and all client computers are running ubuntu linux. I searched something use google, someone said that they are working on it. But the history of ubuntu is not short, someone must use some similar tools to change user authentication method on ubuntu. Anyone knows something about it? Please let me know! Thanks in advance. -- Zengming Zhang <nicegiving(a)gmail.com>

2 2

Problem getting monitor backend and syncrepl overlay to work
by DeMoNs＠web.de 10 Mar '10

10 Mar '10

Hi all, i have a problem getting openldap to run monitor backend AND syncrepl overlay. i'm running freebsd-7.2-release-p6 in combination with openldap-server-2.4.19 with sasl support compiled in. i use the following slapd config: include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/misc.schema include /usr/local/etc/openldap/schema/ldapns.schema include /usr/local/etc/openldap/schema/radius.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args logfile /var/log/slapd.log password-hash {SSHA} modulepath /usr/local/libexec/openldap moduleload back_bdb moduleload back_monitor access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to * by ssf=128 dn="cn=admin,dc=example,dc=de" write by dn="cn=admin,dc=example,dc=de" peername.ip=127.0.0.1 write by ssf=96 dn="cn=nssadmin,dc=example,dc=de" read by dn="cn=nssadmin,dc=example,dc=de" peername.ip=127.0.0.1 read by anonymous auth by * none access to attrs=userPassword by self write by anonymous auth by * none database bdb suffix "dc=example,dc=de" rootdn "dc=example,dc=de" directory /var/db/openldap-data index objectClass,entryCSN,entryUUID eq index uid pres,eq,sub index memberUID eq index uidNumber,gidNumber eq index host eq database monitor rootdn "cn=monitoring,cn=Monitor" rootpw monitoring access to dn.subtree="cn=Monitor" by dn="cn=nssadmin,dc=example,dc=de" by * none syncrepl rid=041 provider=ldap://ldap-master.example.de type=refreshOnly interval=00:00:35:00 searchbase="dc=example,dc=de" schemachecking=off bindmethod=simple starttls=yes binddn="cn=syncuser,dc=example,dc=de" credentials="strongsecretpassword" TLSCertificateFile /usr/local/etc/openldap/ssl/ldap-crt.pem TLSCertificateKeyFile /usr/local/etc/openldap/ssl/ldap-key.pem TLSCACertificateFile /usr/local/etc/openldap/ssl/cacert.pem loglevel 256 now, when i run slaptest i receive following error: /usr/local/etc/openldap/slapd.conf: line 59: database monitor does not support operations required for syncrepl slaptest: bad configuration file! Line 59 corresponds to the credentials option in the synrepl statement. i can't figure out whats wrong, so if anyone can point me in the right direction that would be really helpful. thanks in advance, david

5 4

Steps after Crash
by Jeff Burdon 10 Mar '10

10 Mar '10

Hello, I have two LDAP-Master with refresh and persist configured. Both are located in different countries and the bandwidth between them is only 10Mbit/s. Both masters are used for read and writing entires (writing from the local country), the Setup is running well. But now, somehow one Server is crashing. My application is detecting this and is now writing to the other remote Server in the different country. To recover the crashed server, I stop the slapd with the crashed database, and delete the whole database directory and start the slapd again. The slapd now is syncing with the other remote slapd (present and delete phase). The syncing will take about 1,5 hour. But what will happen during this time. My application is detection that the local slapd is running again and will read an write entires to the this server which is in the syncing state. In this same time, the other server in the remote site is trying to establish the replication to the crashed server who is not fully synchronized, but who may have some new entires. * Can it be, that the remote server now receive false information an gets delete entires during this state? * Do I have (manually) prevent for writing to the syncing server? Can someone help me for this Setup - Especially the recovery procedure? .. Thanx in advance Jeff

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical