openldap-technical

openldap-technical@openldap.org

7 participants
9901 discussions

Re: 2.5.7 - adding memberof module Duplicate attributeType
by Dave Macias 27 Aug '21

27 Aug '21

Im attempting to move from rfc2307 to rfc2307bis Ive had no issue doing this. I scripted it :) Before, when i did not add the memberof module/overlay, i attempted to do an ldapsearch uid=bla memberof but would return nothing. So i thought i missed something… So i was going to add the module and then the overlay. But looks like im misunderstanding something altogether by your response… :) Maybe my ldapsearch was wrong to begin with… What could i be missing? On Aug 27, 2021, 5:47 PM -0400, Quanah Gibson-Mount <quanah(a)symas.com>, wrote: > > > --On Friday, August 27, 2021 6:09 PM -0400 Dave Macias <davama(a)gmail.com> > wrote: > > > > > Hello again... > > > > On a clean rocky linux install i cannot seem to be able to add the > > memberof.la module. Get below output: > > First question is, why are you installing memberOf module at all? :) > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com>

2 2

2.5.7 - adding memberof module Duplicate attributeType
by Dave Macias 27 Aug '21

27 Aug '21

Hello again... On a clean rocky linux install i cannot seem to be able to add the memberof.la module. Get below output: 61295355.3b7373e7 0x7ff631852940 @(#) $OpenLDAP: slapd 2.5.7 (Aug 19 2021 17:48:53) $ mockbuild@3b6af787015541c89363999d4338d587 :/builddir/build/BUILD/openldap-2.5.7/servers/slapd 61295356.01d90296 0x7ff631852940 config error processing cn={4}msuser,cn=schema,cn=config: olcAttributeTypes: Duplicate attributeType: "P�e�;V" 61295356.0203a145 0x7ff631852940 slapd stopped. 61295356.0204a690 0x7ff631852940 connections_destroy: nothing to destroy. Here are all my steps I do: wget -q https://repo.symas.com/configs/SOLDAP/rhel8/release25.repo -O /etc/yum.repos.d/soldap-release25.repo dnf install -y symas-openldap-clients symas-openldap-servers # enable default configs cd /opt/symas/etc/openldap/ cp ldap.conf.default ldap.conf cp slapd.conf.default slapd.conf cp slapd.ldif.default slapd.ldif # use secret as cn=config password sed -i 's/^# rootpw/rootpw/g' slapd.conf # make some dirs mkdir /opt/symas/etc/openldap/slapd.d mkdir /var/log/slapd/ # enable/start systemctl enable --now slapd source /etc/profile.d/50-soldap.sh # the slapd.d dir will be empty so create the slapd-conf structure slaptest -f /opt/symas/etc/openldap/slapd.conf -F /opt/symas/etc/openldap/slapd.d systemctl restart slapd cd # change the cn=config secret cat >config-secret.ldif <<EOF dn: olcDatabase={0}config,cn=config changetype: modify replace: olcRootPW olcRootPW: {SSHA}blablabalblabla/ EOF ldapadd -D cn=config -w secret -H ldapi:/// -f config-secret.ldif # add a few schemas # had to remove tha last 7 lines tac /opt/symas/etc/openldap/schema/rfc2307bis.ldif | sed '1,7 d' | tac > /opt/symas/etc/openldap/schema/rfc2307bis-new.ldif for def in cosine.ldif rfc2307bis-new.ldif inetorgperson.ldif msuser.ldif; do ldapadd -D cn=config -w $config_pass -H ldapi:/// -f /opt/symas/etc/openldap/schema/$def done # add memberof module cat >memberof-module.ldif <<EOF dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /opt/symas/lib/openldap/ olcModuleLoad: memberof.la EOF ldapadd -D cn=config -w $config_pass -H ldapi:/// -f memberof-module.ldif systemctl restart slapd at this point i get the error from above.... I've looked around to see where the "Duplicate attribute" is... but cannot find it.. Any input is much appreciated! Thank you very much for the awesome support!!!! -Dave

2 1

Symas OpenLDAP Handbook: Operator and Administrator Guide with Training Labs Book
by Dr. Ogg 27 Aug '21

27 Aug '21

Does anyone know when the Symas OpenLDAP Handbook: Operator and Administrator Guide with Training Labs Book be be realized on kindle? Or other ebook option? Thanks https://www.amazon.com/Symas-OpenLDAP-Handbook-Operator-Administrator/dp/B0… <https://www.amazon.com/Symas-OpenLDAP-Handbook-Operator-Administrator/dp/B0…>

1 0

Re: OpenLDAP 2.5.7 dies
by kevin martin 27 Aug '21

27 Aug '21

I'll try that. I have narrowed it down to the ppm.so from slapd-modules/ppm. I removed ppm.so from /usr/local/libexec/openldap, restarted slapd, ran the command that killed it prior and it didn't die, stopped slapd, recompiled ppm and installed the new ppm.so in libexec/openldap, restarted slapd and reran the password change and boom, down went Frazier! --- Regards, Kevin Martin On Fri, Aug 27, 2021 at 11:30 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Friday, August 27, 2021 11:44 AM -0500 kevin martin <ktmdms(a)gmail.com> > > wrote: > > > > > > > 41720 sendto(3, "<165>Aug 27 15:36:40 slapd[41718]: ppm: entry > > uid=kmart,ou=people,dc=lecpq,dc=com", 87, MSG_NOSIGNAL, NULL, 0) = 87 > > 41720 getpid() = 41718 > > 41720 sendto(3, "<165>Aug 27 15:36:40 slapd[41718]: ppm: Reading > > pwdCheckModuleArg attribute", 75, MSG_NOSIGNAL, NULL, 0) = 75 > > 41720 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x8} > --- > > 41718 <... futex resumed>) = ? > > 41720 +++ killed by SIGSEGV +++ > > 41719 <... epoll_wait resumed> <unfinished ...>) = ? > > 41719 +++ killed by SIGSEGV +++ > > 41718 +++ killed by SIGSEGV +++ > > > > > > > > > > still now coredump file. I'll try changing the kernel.core_pattern and > > see if we get something somewhere. > > > Coredumps are often useless because they lose key information. You want > to > get a trace under gdb while the process is executing. > > Start slapd > > gdb /path/to/slapd PID > (gdb) cont > > execute the command that crashes slapd > > at the gdb prompt: > > gdb thr apply all bt full > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

3 4

openSUSE/SLE users, migrate to back-mdb now!
by Michael Ströder 27 Aug '21

27 Aug '21

HI! This is an important note to those who run OpenLDAP slapd based on openSUSE or SLE packages, especially Tumbleweed: If you're still using OpenLDAP 2.4 or earlier with back-bdb or back-hdb then migrate to back-mdb now because OpenLDAP 2.5 packages won't support these backends anymore! Disclaimer: I'm writing as a package maintainer who only updates package "openldap2" in openSUSE Factory/Tumbleweed. I have no official role in openSUSE project nor SUSE. Background: As you might already know OpenLDAP 2.5 builds by default have no more support for backends back-hdb and back-bdb based on Berkeley-DB. Furthermore using Berkeley-DB in general is deprecated. I've received a request to update the openSUSE package "openldap2" and its sub-packages to OpenLDAP release 2.5.7 also removing back-bdb and back-hdb [1]. I'd love to accept this update request really soon because I also want to have the new features in libldap. So the update will hit openSUSE Tumbleweed really soon. While this change will *not* affect your deployments based on packages from SLE or openSUSE Leap 15.3 or earlier you should prepare your installation for possible future updates by migrating to back-mdb now. And always use slapcat to backup your database(s) and practice restoring your databases to be prepared for any desaster. Ciao, Michael. [1] https://build.opensuse.org/request/show/914040

3 5

How to determine olcDbMaxSize
by Dave Macias 27 Aug '21

27 Aug '21

Hello, Playing around with moving from 2.4.59 hdb to 2.5.7 mdb. According to the admin page, one of the changes is adding olcDbMaxSize. Noticed that the default on 2.5.7 is: (1GB) olcDbMaxSize: 1073741824 My db does not come close to that but was curious how one can determine what the db size is currently ? Do you ls -h the /var/symas/openldap-data/data.mdb file ? Thank you, Dave

3 2

OpenLDAP 2.5.7 dies
by kevin martin 27 Aug '21

27 Aug '21

Aug 27 14:25:38 newldap0.mgt.ch3.bmi slapd[38335]: ppm: Reading pwdCheckModuleArg attribute Aug 27 14:25:38 newldap0.mgt.ch3.bmi systemd[1]: slapd.service: Main process exited, code=killed, status=11/SEGV Aug 27 14:25:38 newldap0.mgt.ch3.bmi systemd[1]: slapd.service: Failed with result 'signal'. is this a known issue? Oracle Linux 8. what can I do to help determine what occurred? --- Regards, Kevin Martin

3 9

OT: Net:LDAPapi / LDAPS-Support?
by A. Schulze 26 Aug '21

26 Aug '21

Hello, I took over a service using the Perl NET::LDAPapi. Now I fail to establish an LDAPS connection. Does anybody know if that's even supported and if so, how I've to setup that? Andreas

3 4

Re: /usr/local/etc/openldap/slapd.conf: line 39: <password-hash> scheme not available ({SHA512})
by kevin martin 26 Aug '21

26 Aug '21

ah, yes, I see. I made a bad assumption that, when doing a "make" in the password module, that it would make everything there and under it, including subdirectories. going into sha2 under password and doing a make works fine. my bad. --- Regards, Kevin Martin On Thu, Aug 26, 2021 at 11:41 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, August 26, 2021 12:38 PM -0500 kevin martin > <ktmdms(a)gmail.com> wrote: > > > > > > > so I sb able to take the pw-sha2 module that I compiled for RHEL7 and > > simply move it over to RHEL8? Ugh, so ugly that we can't remake the > > module on RHEL8 (is it unsupported?) due to missing dependencies... > > The pw-sha2 module has no dependencies on any radius libraries. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: 2.5.7 for RHEL8 - Question
by Dave Macias 26 Aug '21

26 Aug '21

Thank you! On Wed, Aug 25, 2021 at 3:08 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, August 25, 2021 3:57 PM -0400 Dave Macias > <davama(a)gmail.com> wrote: > > > > > Awesome! > > > > So then, if it's already shipped, why dont I see the schema files for > > ppolicy? > > Would have thought to find it here: /opt/symas/etc/openldap/schema > > I strongly advise reading the OpenLDAP 2.5 admin guide section on > upgrading, specifically: > > < > https://www.openldap.org/doc/admin25/appendix-upgrading.html#ppolicy%20over… > > > > which directly answers your question. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

4 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical