openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Many TCP connections
by Peter Mogensen 14 Dec '09

14 Dec '09

Hi, I tried to increase the number of simultaneous TCP connection to my slapd (to around 800) and was a little surprised to see the result. While slapd still answers very fast in ldapi:/// , TCP connections now takes a while to connect() and after that even longer to answer the query. I can see ldapsearch hanging waiting for response. Eventually it answers - after more than a minute. So it doesn't seem to be a load problem for the backend, but what could make TCP-connections that slow compared to ldapi:/// ? I have no FD limits. /Peter

1 0

proxied attributedescription inserted
by Alexander 'Leo' Bergolth 13 Dec '09

13 Dec '09

Hi! When running slaptest, slapcat or other related utilities, I keep getting 'PROXIED attributeDescription "OU" inserted.' warnings. Initially I thought that some schema definitions could be missing but as far as I can see, the core-schema should be OK. Maybe the problem is that the modifiersName (uid=leoadm,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at) of cn=config is outside of cn=config? Here is the snippet of slaptest output (debuglevel -1) where the errors occur: -------------------- 8< -------------------- backend_startup_one: starting "cn=config" ldif_read_file: read entry file: "/etc/openldap2.4/slapd.d/cn=config.ldif" => str2entry: "dn: cn=config [...] modifiersName: uid=leoadm,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at modifyTimestamp: 20091208164511Z " >>> dnPrettyNormal: <cn=config> <<< dnPrettyNormal: <cn=config>, <cn=config> >>> dnPretty: <cn=config> <<< dnPretty: <cn=config> >>> dnNormalize: <cn=config> <<< dnNormalize: <cn=config> >>> dnPretty: <uid=leoadm,ou=LDAPusers,dc=wu-wien,dc=ac,dc=at> PROXIED attributeDescription "OU" inserted. PROXIED attributeDescription "DC" inserted. <<< dnPretty: <uid=leoadm,OU=LDAPusers,DC=wu-wien,DC=ac,DC=at> >>> dnNormalize: <uid=leoadm,OU=LDAPusers,DC=wu-wien,DC=ac,DC=at> <<< dnNormalize: <uid=leoadm,OU=LDAPusers,DC=wu-wien,DC=ac,DC=at> <= str2entry(cn=config) -> 0x93a7ee4 -------------------- 8< -------------------- Any hints? Thanks, --leo -- e-mail ::: Leo.Bergolth (at) wu.ac.at fax ::: +43-1-31336-906050 location ::: IT-Services | Vienna University of Economics | Austria

2 1

TLS + SSL and openldap
by Bruno Steven 12 Dec '09

12 Dec '09

Hi, I am trying configure openldap work with tls , but I have two question about this, first when I use tls openldap use port 389 and ssl port 639 , is this correct ? Second How I can test connection between client and server, cryptography is working ? Thnaks. -- Bruno Steven - Administrador de sistemas. LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4 https://www.lpi.org/caf/Xamman/certification MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100 https://mcp.microsoft.com/authenticate/validatemcp.aspx P Antes de imprimir pense em sua responsabilidade e comprometimento com o Meio Ambiente. Before printing this message, think about your ecologic responsability and environment commitment.

7 10

Re: restrict host login based on group
by Adam Hough 12 Dec '09

12 Dec '09

There are other ways to populate the pam_groupdn that you have associated with each machine but those all correspond to some attribute in the user's profile. I have pam_groupdn setup like this /etc/ldap.conf: pam_groupdn cn=<GROUP_NAME>,ou=Systems,dc=domain,dc=com pam_member_attribute member cn=<GROUP_NAME>,ou=Systems,dc=domain,dc=com cn: <GROUP_NAME> objectClass: top objectClass: groupOfNames objectClass: labeledURIObject member: uid=nobody,ou=People, dc=domain,dc=com labeledURI: ldap:///ou=People,dc=domain,dc=com??one?(host=<type of system>) labeledURI: ldap:///ou=People,dc=domain,dc=com??one?(gidNumber=XXXX) So as you can see you can have as many labeledURI attributes as you want or need. I tend to use the host name function of what the host does. This is how my account profile would look: uid=<MYUSERID>,ou=People,dc=domain,dc=com host: "cluster" host: sysadmin So "cluster" is a compute cluster that we have and thus for all those machines the pam_groupdn cn="cluster",ou=Systems,dc=domain,dc=com, and for machines where only the sysadmins login to then pam_groupdn cn=sysadmin,ou=Systems,dc=domain,dc=com. As long as you can for a labeledURI: ldap:///ou=People,dc=domain,dc=com??one?<attribute>=<value>) type search you can use it to auto populate the group. Summary: * Do to not think of the host attribute as host = hostname but as host = type of machine and that you can have more then one labeledURI per group to help populate the group. * Use good gidNumbers for groups to help auto populate groupOfName style groups. - Adam On Wed, Dec 9, 2009 at 4:01 AM, Shamika Joshi <shamika.joshi(a)gmail.com>wrote: > Hi Adam, > I'm able to get host auth working by using host attribute.But the drawback > of that is everytime there a new machine, I have to add that host to all the > users I want to grant access to. If I decide to do it based on group > membership, I can use pam_groupdn but then it does not allow multiple group > entries there, plus it has to be managed on client side,which is even more > undesirable by any administrator. > > I went through this article but I'm not sure if it will work if I have some > members already associated with some groups. Like ldap1 & ldap2 members of > qagroup & ldap3 & ldap4 members of sysadmin, would this method allow me to > limit access based on their group membership?? if yes...could you briefly > explain with an example? > > Thank for your time in advance > Shamika > > > > On Wed, Dec 9, 2009 at 9:04 AM, Adam Hough <adam(a)gradientzero.com> wrote: > >> Here is is the write up that I read to figure out how to do setup to >> auto-restrict users to certain hosts. >> >> >> http://www.hurricanelabs.com/september2009_login_security_using_openldap_an… >> >> >> >> On Tue, Dec 8, 2009 at 4:40 PM, Howard Chu <hyc(a)symas.com> wrote: >> >>> Shamika Joshi wrote: >>> >>>> Thanks Howard, >>>> Could you point me to some good documentation or HowTos on that? >>>> >>> >>> Search the archives. I posted an example in here a few months ago. >>> http://www.openldap.org/lists/openldap-technical/200905/msg00108.html >>> >>> >>> -- >>> -- Howard Chu >>> CTO, Symas Corp. http://www.symas.com >>> Director, Highland Sun http://highlandsun.com/hyc/ >>> Chief Architect, OpenLDAP http://www.openldap.org/project/ >>> >> >> >

2 2

MUA that could address LDAP Groups ?
by Frank Bonnet 11 Dec '09

11 Dec '09

Hello I'm searching for a Mail User Agent that could send emails to all users living in a LDAP group. Anyone knows such program ? Thanks

1 0

syncrepl broke, connection loss
by Peter Mogensen 10 Dec '09

10 Dec '09

Hi, I've loaded my mirror mode setup with data and let it run for a few day, Both cn=config and the application database is mirrored. Only server1 is receiving writes from the application. OpenLDAP 2.4.20, BDB 4.8 After about 6 hours the mirror partly broke and I experience 3 symptoms: 1) The syncrepl connection from server1->server2 for the application database is missing and data only flows from server1 to server2 - not the other way. The cn=config connections exists. $ netstat -tna # shows tcp 0 0 192.168.0.102:636 0.0.0.0:* LISTEN tcp 8125 0 192.168.0.102:45535 192.168.0.101:636 ESTABLISHED tcp 0 0 192.168.0.102:636 192.168.0.101:34954 ESTABLISHED tcp 0 0 192.168.0.102:45537 192.168.0.101:636 ESTABLISHED Where it should show, something like: tcp 0 0 192.168.0.101:636 0.0.0.0:* LISTEN tcp 0 0 192.168.0.101:34954 192.168.0.102:636 ESTABLISHED tcp 261 0 192.168.0.101:33409 192.168.0.102:636 ESTABLISHED tcp 0 0 192.168.0.101:636 192.168.0.102:45537 ESTABLISHED tcp 0 0 192.168.0.101:636 192.168.0.102:33226 ESTABLISHED 2) Meanwhile the log on server1 says: Dec 8 02:04:03 server1 slapd[6863]: do_syncrepl: rid=004 rc -1 retrying Dec 8 02:05:03 server1 slapd[6863]: do_syncrepl: rid=004 rc -2 retrying Dec 8 02:06:03 server1 slapd[6863]: do_syncrepl: rid=004 rc -2 retrying etc... The first such entry appear around 6 hours after start of the mirror. 3) If I try to change cn=config with ldapmodify on either server, server1 will hang, not answering queries until I restart it. For instance, if I do: ---------- dn: cn=config changetype: modify replace: olcLogLevel olcLogLevel: None sync ----------- ... it'l hang. I was able to connect and search the database on both server, to both servers like (on server1), using client certs: ldapsearch -H ldaps://server2/ -YEXTERNAL -b cn=data,dc=example,dc=com -s sub -D cn=config '(cn=*)' + \* So it's not that the TCP connection can't be established. Which make me suspect that this is related to this thread: http://www.mail-archive.com/openldap-software@openldap.org/msg16028.html Now after 27 hours the connection finally came back by it self, and replication works both ways. The "rc -2 retrying" in the log on server1 stopped and was replaced by: Dec 8 15:39:34 server1 slapd[11177]: do_syncrepl: rid=004 rc -2 retrying Dec 8 15:40:34 server1 slapd[11177]: do_syncrepl: rid=004 rc -2 retrying Dec 8 15:42:15 server1 slapd[11177]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Dec 8 15:47:05 server1 slapd[11177]: => bdb_idl_delete_key: c_del id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Dec 8 15:47:05 server1 slapd[11177]: conn=15694 op=16: attribute "entryCSN" index delete failure Dec 8 15:47:06 server1 slapd[11177]: => bdb_idl_delete_key: c_del id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Dec 8 15:47:06 server1 slapd[11177]: conn=15569 op=36: attribute "entryCSN" index delete failure ... and a bit more of the same. Trying to modify cn=config with ldapmodify still makes server1 (and ldapmodify) hang though. /Peter

3 7

OpenLDAP as a proxy/rewrite/remap to AD for nss_ldap
by Mikolaj Kucharski 09 Dec '09

09 Dec '09

Hi, I have Active Directory server, OpenLDAP server and a client machine. AD is based on Windows Server 2003, OpenLDAP is 2.3.43-3.el5 running on CentOS 5 i386, client machine is as well CentOS 5. Does OpenLDAP server in any version, allows me to rewrite/remap/merge results from: - Active Directory - internal LDAP database (or any database) to make them suitable to nss_ldap? AD doesn't have all attributes which are needed by nss_ldap, so I thought to keep internal LDAP database with missing information (uidNumber, loginShell, etc) and merge, rewrite, remap or meta this information, and then give that result to the nss_ldap. I understand that it is possible to merge with slapd-meta different DIT from different databased as a single DIT, but what I need here is to merge attributes from one db, with second db (Active Directory), then rewrite that, and finaly return result to the querying client. What I mean is, is it possible to rewrite/remap results from AD which look like that: # (sAMAccountName=kucharskim) dn: CN=kucharskim,CN=Users,DC=euops,DC=lan objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: kucharskim distinguishedName: CN=kucharskim,CN=Users,DC=euops,DC=lan instanceType: 4 whenCreated: 20091117183353.0Z whenChanged: 20091117183353.0Z uSNCreated: 15484 uSNChanged: 15488 name: Mikolaj Kucharski objectGUID:: PLah511UiUKib3pt8HCJ+g== userAccountControl: 66048 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 129041574477164624 lastLogoff: 0 lastLogon: 129046275442578437 pwdLastSet: 129029564332783194 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAA1MNb9pJhAvyslWmgfAcAAA== accountExpires: 9223372036854775807 logonCount: 9 sAMAccountName: kucharskim sAMAccountType: 805306368 objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=euops,DC=lan memberOf: CN=testgroup,CN=ActiveDirectoryGroups,DC=euops,DC=lan with pieces missing from another ldap db, to something like that: # (uid=kucharskim) dn: uid=kucharskim,ou=People,dc=ldapdomain,dc=lan uid: kucharskim cn: Mikolaj Kucharski objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowLastChange: 12561 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 10207 gidNumber: 10207 homeDirectory: /home/kucharskim gecos: Mikolaj Kucharski # (memberUid=kucharskim) dn: cn=testgroup,ou=Groups,dc=ldapdomain,dc=lan objectClass: posixGroup objectClass: top cn: testgroup gidNumber: 50201 memberUid: kucharskim memberUid: ldapuser1 memberUid: ldapuser2 I see that this is something overly complicated, but I wanted to know is that possible. If it is, could someone give me which version of OpenLDAP supports it and where I can read how to implement that. Thank you. -- best regards q#

3 2

Query performance degrades over time.
by Laurence Field 09 Dec '09

09 Dec '09

Hi, We are experiencing a decay in query performance over time using OpenLDAP 2.3.43 on CentOS 5. After populating the database with about 70 000 entries, the query response time for one entry is about 0.4s. After about two hours the same query takes over 1s. The slapd.conf file and DB_CONFIG files that we use can be found at the following URLs. http://svnweb.cern.ch/trac/gridinfo/browser/bdii/trunk/etc/bdii-slapd.conf http://svnweb.cern.ch/trac/gridinfo/browser/bdii/trunk/etc/DB_CONFIG Does anyone have an idea about what is happening. Thanks Laurence

8 13

100% CPU loading
by Bad Guy 09 Dec '09

09 Dec '09

Dear all, We have been setup a 4 ways multi-master replication openldap version 2.4.11. It has been running for a year. However, recently, we find that one of the server has 100% high CPU and all the replication can't be replicated to that server. After restart the slapd process, it can be resumed normal. But afraid that high CPU will occur again. What changes recently is that we just added 1 field in the schema file in all the 4 servers, there is no other things changed. Any idea of the high CPU ? What data should be collected in case high CPU occurs again ? Thanks _________________________________________________________________ 嶄新的 Windows 7：找出適合您的電腦。深入了解。 http://windows.microsoft.com/shop

3 4

ldapsearch filter and
by Jeff Huang 09 Dec '09

09 Dec '09

Hi all. How to set a filter to connect tow entrys like SQL of database? For example. entry 1: dn:ou=p,o=test ou=p status=active entry 2: dn:cn=1,ou=p,o=test uid=1 status=active result=test1 entry 3: dn:cn=2,ou=p,o=test uid=2 status=inactive result=test2 I need to do a search and the result is: if the entry1's status=active,then research other entry using the query attribute=uid. if the entry1's status=inactive,the the research returen null result. How can I do this search? And if it can do,how to set the ldap.conf located /etc/ldap.conf?

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical