openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

ldap not finding internal CA?
by Kurt Yoder 18 Jun '09

18 Jun '09

Hello all, On Ubuntu, I have set up an LDAP server and am authenticating to it over SSL for my LDAP queries. I had it working on previous Ubuntu releases, but something seems to have changed in the newest release (maybe this: http://www.debian-administration.org/users/dkg/weblog/ 42). I am having trouble figuring out exactly what is breaking. Some background: I have set up my own CA and generated a certificate for it, which the LDAP server is using. Without specifying this CA, I get "self-signed certificate" errors when connecting: root@host:# openssl s_client -connect my.ldap.server:636 -showcerts CONNECTED(00000003) <... trimmed certificate information ...> verify error:num=19:self signed certificate in certificate chain verify return:0 <... trimmed more certificate information ...> If I specify the path to my internal CA file, I receive no errors: root@host:# openssl s_client -connect my.ldap.server:636 -showcerts - CAfile /path/to/my/ca/file CONNECTED(00000003) <... trimmed certificate and internal CA information ...> verify return:1 <... trimmed more certificate information ...> That being said, I manually specified the path to my internal CA file in /etc/ldap/ldap.conf: BASE dc=my, dc=search, dc=base URI ldaps://my.ldap.server TLS_CACERT /path/to/my/ca/file TLS_REQCERT demand TIMEOUT 4 NETWORK_TIMEOUT 2 This still allows no secure ldap queries: root@host:# ldapsearch -x -d1 ldap_create ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP my.ldap.server:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying my.ldap.server.ip:636 ldap_pvt_connect: fd: 3 tm: 2 async: 0 ldap_ndelay_on: 3 ldap_int_poll: fd: 3 tm: 2 ldap_is_sock_ready: 3 ldap_ndelay_off: 3 ldap_pvt_connect: 0 TLS: peer cert untrusted or revoked (0x102) TLS: can't connect: (unknown error code). ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Just to prove that the above configuration is the one being used, if I switch the above configuration to "TLS_REQCERT allow", the ldap queries bypass this issue: root@myhost:# ldapsearch -x -d1 > /dev/null ldap_create ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP auth01.rdc.internal:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.1.41:636 ldap_pvt_connect: fd: 3 tm: 2 async: 0 ldap_ndelay_on: 3 ldap_int_poll: fd: 3 tm: 2 ldap_is_sock_ready: 3 ldap_ndelay_off: 3 ldap_pvt_connect: 0 TLS: peer cert untrusted or revoked (0x102) ldap_open_defconn: successful <... trimmed rest of results ...> My openldap is version 2.4.15 on Ubuntu Jaunty. Interestingly, I had the same message about self-signed certificates on previous Ubuntu versions, but querying ldap with "TLS_REQCERT demand" works fine. So what is the solution to this problem? Do I switch to "TLS_REQCERT allow"? Or perhaps there's some way to debug why openldap is not seeing the internal CA file even though I've told it where to look? Thanks for any pointers... -Kurt

3 2

N-way Master synchronization
by Bad Guy 17 Jun '09

17 Jun '09

Dear all, I am using a 4-way LDAP servers version 2.4.11. (type=refreshOnly, interval="00:00:00:30",attrs="*,+") Everyday, there will be some records updated in any of the servers. >From time to time, I will dump the records in all 4 servers and checked the modifyTimestamp attribute. I find that there is some records where the modifyTimestamp attribute value are different from other 3 servers. But the other content seems synced. Only differ by the modifyTimestamp attribute. Any idea of how come such situation occur ? Thanks _________________________________________________________________ 5 GB 超大容量、創新便捷、安全防護垃圾郵件和病毒 — 立即升級 Windows Live Hotmail http://mail.live.com

3 2

Check ppolicy
by Jordi Espasa Clofent 17 Jun '09

17 Jun '09

Hi folks, I use a OpenLDAP as a central accounting servers through the sshd service and I use sudo also. All works like a charm. However I wanto to use SLAPO_PPOLICY(5). Well, I think I've implemented it correctly: xen-ldap01:~# ldapsearch -x -b 'cn=DefaultPassword,ou=Policies,dc=company,dc=com' # extended LDIF # # LDAPv3 # base <cn=DefaultPassword,ou=Policies,dc=company,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # DefaultPassword, Policies, company.com dn: cn=DefaultPassword,ou=Policies,dc=company,dc=com cn: DefaultPassword objectClass: top objectClass: device objectClass: pwdPolicy objectClass: pwdPolicyChecker pwdAttribute: userPassword pwdMinAge: 0 pwdMaxAge: 15552000 pwdExpireWarning: 604800 pwdGraceAuthNLimit: 3 pwdMinLength: 8 pwdMaxFailure: 5 pwdLockout: TRUE pwdInHistory: 5 pwdAllowUserChange: TRUE pwdSafeModify: TRUE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The main problem is I don't know how to ckeck it. I mean, when a user connects to a machine (a box which is OpenLDAP client) using sshd, sshd goes to OpenLDAP and query about the user and his password. But I don't see anymore that the classical "Password:" prompt. So ¿how can I check if ppolicy is really working? I want to test it, changing the password for example or blocking a user who type wrong their password for more tant 5 times. I suspect a PAM issue (after all, the sshd service goes to LDAP using PAM modules), but I'm not sure. ¿Any clue? -- Thanks, Jordi Espasa Clofent

2 3

ldap_bind: Invalid credentials (49)
by J. Bakshi 17 Jun '09

17 Jun '09

Hello list, Here is a very typical problem. I have already done some googling but I am more confused now. I like to query a user information with his own id and password. When I do this as cn=Manager the there is no problem ```````````````````````````````````````` ldapsearch -h 127.0.0.1 -b "ou=people,dc=example,dc=com" -x "(&(objectclass=inetOrgPerson)(cn=test2))" uid -D "cn=Manager,dc=example,dc=com" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: (&(objectclass=inetOrgPerson)(cn=test2)) # requesting: uid # # test2, people, example.com dn: cn=test2,ou=people,dc=example,dc=com uid: rbilly # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ``````````````````````````````````````````````````````````````````` Now if I search with the user credential the problem starts `````````````````````````````````````````````````````` ldapsearch -h 127.0.0.1 -b "ou=people,dc=example,dc=com" -x "(&(objectclass=inetOrgPerson)(cn=test2))" uid -D "uid=rbilly,ou=people,dc=example,dc=com" -W Enter LDAP Password: ldap_bind: Invalid credentials (49) ```````````````````````````````````````````````` I have typed the correct password and repeated the above command a no. of times. But the same error. why Invalid credentials ? Any clue please ? Thanks

3 3

Re: password change and ppolicy
by Gustavo Mendes de Carvalho 17 Jun '09

17 Jun '09

Hi Tizo, Suposed that your users has to login in some linux/Unix machine using their LDAP accounts, I sugest you to create some binary or script to allow your users to change their passwords invoking ldappasswd command. I mean, you can create a C program or shell script or even a PHP page, to validate some weaks in their passwords, like min length, capital letters, numbers, and so on. After that, you can call ldappasswd command with all parameters (using system() call in a C source code) to change it. I know that this is not an elegant option, but it works. Let me know if it works for you that I can post my C source code here to help you there. See you Gustavo Date: Wed, 10 Jun 2009 18:54:14 -0300 From: tizo <tizone(a)gmail.com> Subject: Re: password change and ppolicy To: openldap-technical(a)openldap.org Message-ID: <e55f48520906101454i3e5b4b59v2b755278cd34437(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" On Tue, Jun 9, 2009 at 12:12 PM, tizo <tizone(a)gmail.com> wrote: > > Before starting this, I have been testing password changing with > phpLDAPAdmin. The fact is that I could only change a user password with > clear text. I guess that this behaviour happens because we have > pwdCheckQulity setting in 2 in our default password policy. So, when the > client (phpLDAPAdmin) tries to modify the password enconding it, the server > (OpenLDAP) cannot check the min length of the password, as it is encoded, > and then fails. I am guessing too, that phpLDAPAdmin is performing a simple > modify operation to change the password, as it is stored in clear text. On > the other hand, I could change passwords with ldappasswd withouth problem, > and they are stored with SSHA. I know that this command uses RFC 3062. > > tizo > >

3 2

slapd-config(5) Disaster Recovery - Best Practices?
by gruntler-ldap＠yahoo.com 16 Jun '09

16 Jun '09

Hi, I am considering migrating from a monolithic slapd.conf file to the newer DIT slapd-config(5). My primary concern is how to recover if a dynamic change brings down slapd so it becomes difficult to recover since the configuration is in a database and slapd will not start. Is it as simple as making a slapcat backup of the configuration database (or some other backup of the configuration database that resides in the slapd.d directory) prior to making changes so that a roll-back would consist of replacing the contents of the slapd.d directory? Or is there some other recovery method that is preferred? Thanks, Ken

2 1

pwdFailureTime not being deleted
by Adam Leach 16 Jun '09

16 Jun '09

I'm having a problem with the pwdFailureTime entries not being deleted after a successful login. What steps could I take to see if there is an error occurring? I'm running openldap 2.4.11 RHEL5, rpms came from http://staff.telkomsa.net/packages/rhel5/openldap/i386/ Thanks -- Adam Leach BS Computer/Electrical Engineering West Virginia University Systems Administrator - Raytheon (304)677-4455

2 1

LDAP search question
by Tihomir Culjaga 16 Jun '09

16 Jun '09

Hello, maybe it is a dummy question but i'd like to know why i have so big discrepancy in execution between two apparently identical ldapsearch ? The 1st search takes 94 ms while the 2nd one only 7 ms. It doesn't matter how many times i execute the 1st search (meaning everytihng should be already cached) .. it is always the same. Does anyone know why? ~$ time ldapsearch -h localhost -x -b ou=redirecting,ou=Dir,dc=ot,dc=hr -D cn=admin,dc=ot,dc=hr -w **** uniqueID=38512303736 # extended LDIF # # LDAPv3 # base <ou=redirecting,ou=Dir,dc=ot,dc=hr> with scope subtree # filter: uniqueID=38512303736 # requesting: ALL # # 38512303736, redirecting, Dir, ot.hr dn: uniqueID=38512303736,ou=redirecting,ou=Dir,dc=ot,dc=hr objectClass: top objectClass: uniqueID Prefix: 68A10 uniqueID: 38512303736 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 *real 0m0.094s* user 0m0.004s sys 0m0.000s ~$ time ldapsearch -h localhost -x -b ou=redirecting,ou=Dir,dc=ot,dc=hr -D cn=admin,dc=ot,dc=hr -w **** uniqueID=38515000400 # extended LDIF # # LDAPv3 # base <ou=redirecting,ou=Direktor,dc=ot,dc=hr> with scope subtree # filter: uniqueID=38515000400 # requesting: ALL # # 38515000400, redirecting, Dir, ot.hr dn: uniqueID=38515000400,ou=redirecting,ou=Dir,dc=ot,dc=hr objectClass: top objectClass: uniqueID Prefix: 68B99 uniqueID: 38515000400 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 *real 0m0.007s* user 0m0.000s sys 0m0.004s tculjaga@l01sipindir2:~$

3 5

How to temporarily downgrade to LDAPv2 ?
by J. Bakshi 16 Jun '09

16 Jun '09

Dear all, I like to downgrade the ldap communication protocol to do some experiments. An api which has been designed in 2005 can not work with my ldap server ( suse 11.1) as the log reports ````````````````````````` historical protocol version requested, use LDAPv3 instead ````````````````````````````````````` so i need to temporarily allow the old v2 protocol so that the api can communicate with the ldap server. How can i do this ? Thanks

3 6

RE: openLDAP with Berkeley DB - "Permission denied" problems after setting different data and log directories in DB_CONFIG
by Brett Maxfield 15 Jun '09

15 Jun '09

I checked ownership and permissions on /var/lib/ldap: francesco@bob:/var/lib$ ls -l | grep ldap drwxr-xr-x 5 openldap openldap 4096 2009-06-15 17:03 ldap --=-- Have you run the process under strace(linux) or truss (solaris) as that will give you the exact file/path failing.. Perhaps it is writing files outside the directories you have prepared?

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical