openldap-technical

openldap-technical@openldap.org

13 participants
9906 discussions

(no subject)
by Mark Beavis 09 Feb '10

09 Feb '10

I've setup an OpenLDAP server to use MySQL as a backend - and everything works wonderfully. When I add a new record to the table, I can see the new record in an LDAP browser immediately. However, when I insert a record into the database using JDBC (via a hello world-ish java app), the record does not appear in my LDAP browser. I can see the record in the DB so the data is there - it just doesn't appear in the LDAP browser. That is, until, I restart the LDAP server, then the new record (inserted via JDBC )appears OK in my LDAP browser... Would anyone have any idea as to why this is happening? Thanks - This email may contain privileged and confidential information intended only for the use of the intended recipient. If you are not the intended recipient of this message, any use, dissemination, distribution or reproduction of this message is prohibited. Any views expressed in this message are for those of the individual sender and may not necessarily reflect the views of RHE Group.

1 0

slapd dying, what next?
by Bryan J. Maupin 09 Feb '10

09 Feb '10

A few weeks ago, we upgraded to OpenLDAP 2.4.19. All seemed well, for about 4 weeks, and then within the last few days (starting Jan 14), slapd has been dying on our replica servers. It doesn't seem to follow any pattern, and the system seems fine when slapd dies; it isn't out of memory, and doesn't show any load spikes. In our logs we get messages like: Jan 14 22:18:34 slapd[7940]: ch_malloc of 14698087920909635104 bytes failed (from ldap.log) Jan 15 16:58:03 kernel: slapd[22663] general protection rip:2ac667af65cc rsp:4659d970 error:0 Jan 16 15:42:34 kernel: slapd[10272] general protection rip:2b71f6c6d9c4 rsp:45441980 error:0 Jan 16 17:20:01 kernel: slapd[7538] general protection rip:2aec51954ae0 rsp:449518d0 error:0 Jan 19 13:38:46 kernel: slapd[2821] general protection rip:2aeac3070ae0 rsp:4918f8d0 error:0 (from /var/log/messages) from another replica server: Jan 16 20:56:15 kernel: slapd[17948] general protection rip:2aedf150d9c4 rsp:4154f980 error:0 Jan 18 01:42:46 kernel: slapd[9446] general protection rip:2ae369401ae0 rsp:454c08d0 error:0 Jan 19 13:04:29 kernel: slapd[25339] general protection rip:2b9803877ae0 rsp:4b6bc8d0 error:0 We're running on RHEL 5.4, with Heimdal 1.2.1-3, OpenSSL 0.9.8k, Cyrus-SASL 2.1.23, BDB 4.7.25 (with patches), libunwind 0.99 (for Google tcmalloc), Google tcmalloc 1.3. 1. Is there any useful information that can be obtained from these log entries, or do we simply need to change to a more verbose log level and wait for slapd to die again? 2. If we need to change our log level, what is a suggested level? Right now we're using "loglevel sync stats". Would it be wise to change the log level to -1 (any)? These are production servers, and I imagine that'd be a huge performance hit. 3. Also, we're logging asynchronously at the moment. Should we disable this while debugging? Thanks!

3 13

accesslog overlay - filter by ip addresses (advise)
by Aravind Gottipati 09 Feb '10

09 Feb '10

Hi, I'd like to extract successful bind operations and filter them based on the connection's originating ip address. From the docs, it looks like enabling and querying the accesslog database is a good way to go. Unfortunately, it looks like the ip addresses for the operations aren't recorded in the accesslog db. Is this information recorded in the accesslog at all? I dumped the db with a slapcat and couldn't find it there. Are there some configuration options that I could enable to record this information. My worst case scenario would be to log this into the ldap log file and scrape that. Is there a better way to do this? Thanks in advance, Aravind.

1 0

LDAP and DNS-SRV: questions
by Keutel, Jochen 09 Feb '10

09 Feb '10

Hello, we are trying to use the DNS-SRV backend of OpenLDAP. This gets difficult when ldaps is used. I'm not sure whether we do this correctly - so I'd like to ask the following questions: 1. If I run an LDAP server (administrative point: dc=keutel,dc=de) with both ldap and ldaps enabled: Is it right that I should put *two* lines into DNS? Like: _ldaps._tcp.keutel.de IN SRV 10 0 636 ldap.keutel.de _ldap._tcp.keutel.de IN SRV 10 0 389 ldap.keutel.de Or, when using non-default ports: _ldaps._tcp.keutel.de IN SRV 10 0 1636 ldap.keutel.de _ldap._tcp.keutel.de IN SRV 10 0 1389 ldap.keutel.de 2. If there is another LDAP server, e.g. ldap.abcdefg.hi , configured using DNS-SRV backend: If I search this server like: ldapsearch -H ldaps://ldap.abcdefh.hi/ -b dc=keutel,dc=de sn=meier Then I would expect that this requested is chained (using back-meta) to ldaps://keutel.de:1636/ with search base dc=keutel,dc=de . Is this understanding correct? 3. If yes: I think that OpenLDAP code currently doesn't handle this correctly: a) independent on the original request (ldap or ldaps): Always the _ldap._tcp DNS record is used (never _ldaps._tcp) b) independent on the original request (ldap or ldaps): Always ldap URLs are returned (never ldaps://...) c) the search base is omitted in the chained request: So keutel.de is searched with empty search base See ITS 6462 and 6463 for details. I think fixing b) and c) is not that difficult: Just dnssrv_back_referrals() has to be changed. I'll try to send a patch. Fixing a) seems more difficult because ldap_domain2hostlist() isn't used only in the DNS SRV backend but also in the tools (ldapsearch etc.) and the NSS overlay. Best regards, Jochen.

1 0

LDAP w/mysql as backend
by Radosław Antoniuk 09 Feb '10

09 Feb '10

Hi, I need a pointer please. I need to configure an LDAP server that presents (only read!) data from a mysql database. I have found some nice article for ndb configuration but I think that's not what I need, because this scenario is bi-directional, i.e. It assumes a clean mysql database and r/w access via LDAP that uses mysql as backend per say. What I want to do is to treat LDAP just as an "interface" to mysql database (or even one table). Can anybody point me to a good direction of reading? Thanks. -- Best regards, Radek Antoniuk

4 3

nssov overlay and hostservice
by ben thielsen 08 Feb '10

08 Feb '10

hi i'm experimenting with the nssov overlay, and am trying to get the hostservice approach working as described in man 5 slapo-nssov. i'm using slapd 2.4.18 and the 0.6.11 nss-pam-ldapd stub libraries, both via ubuntu packages. the nss side of things appears to be working as desired, but in my testing with sshd and pam, authentication succeeds even when the user is in a group that's denied the compare operation for the authorizedservice attribute. testing a bit with ldapcompare seems to indicate my acls are working as expected, and i see compare references in slapd's log when running ldapcompare, but not during ssh authentication. i'm relatively confident the authentication is not occurring via another mechanism (like nss/shadow) - if i remove the auth line that references pam_ldap from the pam config for sshd, authentication fails. i've included a few snippits below that will hopefully help illustrate things. overlay config: >ldapsearch -xLLLWH 'ldaps://ldap.groundnoise.net' -D 'cn=admin,cn=config' -b 'olcOverlay={6}nssov,olcDatabase={2}bdb,cn=config' -s base Enter LDAP Password: dn: olcOverlay={6}nssov,olcDatabase={2}bdb,cn=config objectClass: olcNssOvConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {6}nssov olcNssMap: group uniquemember member olcNssPam: authz2dn hostservice olcNssPamSession: sshd olcNssPamSession: login acls: >ldapsearch -xLLLWH 'ldaps://ldap.groundnoise.net' -D 'cn=admin,cn=config' -b 'olcDatabase={2}bdb,cn=config' -s base olcaccess Enter LDAP Password: dn: olcDatabase={2}bdb,cn=config olcAccess: {0}to dn.base="" by * read olcAccess: {1}to attrs=userPassword by self =dxw by anonymous auth by * none olcAccess: {2}to dn.base=cn=under.groundnoise.net,ou=hosts,dc=groundnoise,dc=net attrs=authorizedservice by set="[cn=directory_administrators,ou=general,ou=users,ou=groups,dc=groundnoise,dc=net]/member* & user" manage by set="[cn=ssh,ou=all_servers,ou=servers,ou=users,ou=groups,dc=groundnoise,dc=net]/member* & user" compare by set="[cn=ssh,ou=under,ou=servers,ou=users,ou=groups,dc=groundnoise,dc=net]/member* & user" compare by * =dxrs olcAccess: {3}to * by self write by set="[cn=directory_administrators,ou=general,ou=users,ou=groups,dc=groundnoise,dc=net]/member* & user" manage by users read by * none related group membership: >ldapsearch -xLLLWH 'ldaps://ldap.groundnoise.net' -D 'cn=admin,dc=groundnoise,dc=net' -b 'dc=groundnoise,dc=net' '(cn=ssh)' member Enter LDAP Password: dn: cn=ssh,ou=under,ou=servers,ou=users,ou=groups,dc=groundnoise,dc=net member: uid=alien,ou=people,ou=users,ou=accounts,dc=groundnoise,dc=net member: uid=lisa,ou=people,ou=users,ou=accounts,dc=groundnoise,dc=net dn: cn=ssh,ou=all_servers,ou=servers,ou=users,ou=groups,dc=groundnoise,dc=net member: uid=rwetzel,ou=people,ou=users,ou=accounts,dc=groundnoise,dc=net entry for the host running sshd: >ldapsearch -xLLLWH 'ldaps://ldap.groundnoise.net' -D 'cn=admin,dc=groundnoise,dc=net' -b 'cn=under.groundnoise.net,ou=hosts,dc=groundnoise,dc=net' -s base Enter LDAP Password: dn: cn=under.groundnoise.net,ou=hosts,dc=groundnoise,dc=net objectClass: device objectClass: top objectClass: ipHost objectClass: authorizedServiceObject cn: under.groundnoise.net ipHostNumber: 192.168.1.1 authorizedService: sshd authorizedService: login getent for the host entry: >getent hosts under.groundnoise.net 192.168.1.1 under.groundnoise.net nsswitch config: >egrep -v '(^[[:space:]]*#|^[[:space:]]*$)' /etc/nsswitch.conf passwd: compat ldap group: compat ldap shadow: compat ldap hosts: files dns ldap networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis ldapcompare test: >ldapcompare -vxWH 'ldaps://ldap.groundnoise.net' -D 'uid=luna,ou=people,ou=users,ou=accounts,dc=groundnoise,dc=net' 'cn=under.groundnoise.net,ou=hosts,dc=groundnoise,dc=net' 'authorizedservice:login' ldap_initialize( ldaps://ldap.groundnoise.net:636/??base ) Enter LDAP Password: DN:cn=under.groundnoise.net,ou=hosts,dc=groundnoise,dc=net, attr:authorizedservice, value:login Compare Result: Insufficient access (50) UNDEFINED pam config for sshd: >egrep -v '(^[[:space:]]*#|^[[:space:]]*$)' /etc/pam.d/sshd auth required pam_env.so # [1] auth required pam_env.so envfile=/etc/default/locale auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] pam_ldap.so use_first_pass auth requisite pam_deny.so auth required pam_permit.so account required pam_nologin.so account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so account [success=1 default=ignore] pam_ldap.so account requisite pam_deny.so account required pam_permit.so session [default=1] pam_permit.so session requisite pam_deny.so session required pam_permit.so session required pam_unix.so session optional pam_ldap.so no_warn session optional pam_motd.so # [1] session optional pam_mail.so standard noenv # [1] session required pam_limits.so password required pam_passwdqc.so min=disabled,16,12,7,6 max=256 password [success=2 default=ignore] pam_unix.so obscure md5 password [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass password requisite pam_deny.so password required pam_permit.so ssh test: >ssh luna(a)under.groundnoise.net hostname --fqdn luna(a)under.groundnoise.net's password: under.groundnoise.net i'm hoping someone can point out what i'm missing or what i might be doing wrong. thanks, -ben

2 1

Re: nssov overlay and hostservice
by ben thielsen 06 Feb '10

06 Feb '10

On Feb 05, 2010, at 11.59, Kyle Robinson wrote: > On Thu, Feb 4, 2010 at 7:26 PM, ben thielsen <btb(a)bitrate.net> wrote: > >> hi >> >> i'm experimenting with the nssov overlay, and am trying to get the >> hostservice approach working as described in man 5 slapo-nssov. i'm using >> slapd 2.4.18 and the 0.6.11 nss-pam-ldapd stub libraries, both via ubuntu >> packages. >> ... >> >> ssh test: >>> ssh luna(a)under.groundnoise.net hostname --fqdn >> luna(a)under.groundnoise.net's password: >> under.groundnoise.net >> >> i'm hoping someone can point out what i'm missing or what i might be doing >> wrong. >> >> thanks, >> -ben > > > Turn on debug for pam_unix and pam_ldap in the auth section and check syslog > to make sure it isn't actually pam_unix doing the auth via nss passwd hash. i'm fairly confident that auth isn't happening via pam_unix / nss passwd hash. if i remove the auth line for pam_ldap from the pam config (leaving only pam_unix), authentication fails (other users in local passwd/shadow flat files still work). i also see, in the logs, a pam_unix failure "sshd[10978]: pam_unix(sshd:auth): authentication failure;" prior to success by the ldap module each time authentication occurs. the debug option for the pam_ldap stub library from nss-pam-ldapd is ignored, according to the man page, and adding either debug or audit to pam_unix didn't seem to generate any additional log data. there is plenty of activity in the slap log file, just not the compare operations that i was expecting to see, based on my interpretation of the man page for slapo-nssov.

1 0

memberOf configured via directory based model
by Todd Reed 05 Feb '10

05 Feb '10

I've been stumped for two weeks now trying to implement the memberOf Overlay via directory based model. I even tried it via a slapd.con file and still had trouble. Here is my installation steps on Ubuntu. Is anyone able to spot where I'm going wrong with my configurations? ################ # Setup OpenLDAP ################ sudo apt-get -y install slapd ldap-utils cd /etc/ldap sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif sudo vi db.ldif # Load dynamic backend modules dn: cn=module{0},cn=config objectClass: olcModuleList cn: module {0} olcModulepath: /usr/lib/ldap olcModuleload: {0}back_hdb olcModuleload: {1}memberof.la # Create the database dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=mydomain,dc=com olcRootDN: cn=admin,dc=mydomain,dc=com olcRootPW: password olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbIndex: uid pres,eq olcDbIndex: cn,sn,mail pres,eq,approx,sub olcDbIndex: objectClass eq sudo ldapadd -Y EXTERNAL -H ldapi:/// -f db.ldif sudo slappasswd -h {MD5} sudo vi base.ldif dn: dc=mydomain,dc=com objectClass: dcObject objectclass: organization o: mydomain.com dc: mydomain description: My LDAP Root dn: cn=admin,dc=mydomain,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin userPassword: {MD5}gdyb21LQTcIANtvYMT7QVQ== description: LDAP administrator sudo ldapadd -Y EXTERNAL -H ldapi:/// -f base.ldif sudo vi config.ldif dn: cn=config changetype: modify delete: olcAuthzRegexp dn: olcDatabase={-1}frontend,cn=config changetype: modify delete: olcAccess dn: olcDatabase={0}config,cn=config changetype: modify delete: olcRootDN dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootDN olcRootDN: cn=admin,cn=config dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {MD5}gdyb21LQTcIANtvYMT7QVQ== dn: olcDatabase={0}config,cn=config changetype: modify delete: olcAccess sudo ldapadd -Y EXTERNAL -H ldapi:/// -f config.ldif sudo vi acl.ldif dn: olcDatabase={1}hdb,cn=config add: olcAccess olcAccess: to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=mydomain,dc=com" write by anonymous auth by self write by * none olcAccess: to dn.base="" by * read olcAccess: to * by dn="cn=admin,dc=mydomain,dc=com" write by * read sudo ldapmodify -x -D cn=admin,cn=config -W -f acl.ldif

2 1

sizelimit doesn't seem to be reflected into "ldap" backends?
by Jason Haar 05 Feb '10

05 Feb '10

Hi there I'm wanting to use slapd as a "LAF" - LDAP Application Firewall - to filter and log calls to our backend Active Directory LDAP network. I've just slapd doing the job just fine - except that it can't return large LDAP data dumps... If I use "ldapsearch -E pr=900/noprompt" directly against an AD LDAP server, I can get it to dump everything. However, if I do the same command against a slapd proxy, I get the "size exceeded" error message. It appears slapd doesn't understand this extension, and isn't passing it on to the backend? Any ideas how I could get around this, besides saying we need to touch our AD to get rid of the size limit (I've already thought of that :-) Thanks Jason -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 1

Re: ppolicy : managing passwords by another user than root
by smainklh＠free.fr 05 Feb '10

05 Feb '10

Hi Buchan, I'm not trying to manage password policies through php. I just had a problem to give the rights of changing passwords to a user. i figured it out now by modifying the acl's. Here is a sample of my slapd.conf: >>>>>>>>CUT<<<<<<<<<<<<< # Default password policy overlay ppolicy ppolicy_default cn=default,ou=policies,o=others,dc=domain,dc=tld ppolicy_hash_cleartext overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # The base of your directory in database #1 suffix "dc=domain,dc=tld" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. # rootdn "cn=admin,dc=domain,dc=tld" rootdn "cn=admin,dc=domain,dc=tld" rootpw {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx >>>>>>>CUT<<<<<<<<<<<< # org1 administrators have all the rights on the subtree ou=Users,o=org1,dc=domain,dc=tld access to dn.subtree="ou=Users,o=org1,dc=domain,dc=tld" attrs=userPassword,shadowLastChange by dn="cn=admin.org1,o=others,dc=domain,dc=tld" write by dn="cn=admin,dc=domain,dc=tld" write by dn="cn=syncrepluser,o=others,dc=domain,dc=tld" read by anonymous auth by self write by * none access to dn.subtree="ou=Users,o=org1,dc=domain,dc=tld" by dn="cn=admin.org1,o=others,dc=domain,dc=tld" manage by dn="cn=admin,dc=domain,dc=tld" write by dn="cn=syncrepluser,o=others,dc=domain,dc=tld" read by anonymous read by * none # org2 administrators have all the rights on the subtree ou=Users,o=org2,dc=domain,dc=tld access to dn.subtree="ou=Users,o=org2,dc=domain,dc=tld" attrs=userPassword,shadowLastChange by dn="cn=admin.org2,o=others,dc=domain,dc=tld" write by dn="cn=admin,dc=domain,dc=tld" write by dn="cn=syncrepluser,o=others,dc=domain,dc=tld" read by anonymous auth by self write by * none access to dn.subtree="ou=Users,o=org2,dc=domain,dc=tld" by dn="cn=admin.org2,o=others,dc=domain,dc=tld" manage by dn="cn=admin,dc=domain,dc=tld" write by dn="cn=syncrepluser,o=others,dc=domain,dc=tld" read by anonymous read by * none #### access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=domain,dc=tld" write by dn="cn=auth,o=others,dc=domain,dc=tld" read by dn="cn=syncrepluser,o=others,dc=domain,dc=tld" read by anonymous auth by self write by * none And my password policy : ldapsearch -Wx -H ldaps://ldap.domain.tld -D cn=admin,dc=domain,dc=tld -b o=others,dc=domain,dc=tld cn=default Enter LDAP Password: # extended LDIF # # LDAPv3 # base <o=others,dc=domain,dc=tld> with scope subtree # filter: cn=default # requesting: ALL # # default, policies, others, domain.tld dn: cn=default,ou=policies,o=others,dc=domain,dc=tld pwdAttribute: userPassword pwdLockout: TRUE pwdLockoutDuration: 10800 pwdMaxFailure: 5 objectClass: pwdPolicy objectClass: organizationalRole cn: default pwdAllowUserChange: TRUE pwdMinLength: 8 pwdMaxAge: 15552000 pwdExpireWarning: 15120000 pwdCheckQuality: 2 pwdInHistory: 4 Now it works, sorry i should have provided you more information. I'll do it next time. Regards, Grifith ----- Mail Original ----- De: "Buchan Milne" <bgmilne(a)staff.telkomsa.net> À: openldap-technical(a)openldap.org Cc: "Smaïne Kahlouch" <smainklh(a)free.fr> Envoyé: Vendredi 5 Février 2010 11h02:22 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne Objet: Re: ppolicy : managing passwords by another user than root On Monday, 1 February 2010 21:37:11 Smaïne Kahlouch wrote: > Could somebody help me please ? With what? > I'm asking a last time then i would have to use my root account within > my php code :/ (no secure at all) Assuming your message is relevant to the subject of this thread, php is a dead end, as it has no password policy control. I have some perl scripts to manage password-policy changes. Regards, Buchan

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical