openldap-technical

openldap-technical@openldap.org

13 participants
9795 discussions

Re: ssh automatic logins using OpenLDAP
by Norberto Bensa 24 Mar '09

24 Mar '09

On Tue, Mar 24, 2009 at 12:51 PM, Jordi Espasa Clofent <jespasac(a)minibofh.org> wrote: > Another related question żis possible to _NOT_ use LDAP auth in some users? > It means, use LDAP+ssh in general sense, with only a few exeptions which > will stills login in local. Just configure pam/nss to use both sources (files and ldap). Then add users to /etc/passwd and ldap as needed

1 0

ssh automatic logins using OpenLDAP
by Jordi Espasa Clofent 24 Mar '09

24 Mar '09

Hi all, ¿Is possible to configure ssh automatic logins [1] using/through OpenLDAP? ¿How? Currently the ssh+ldap works perfectly in my OpenLDAP config, so a lot of works has been already done. [1] http://linuxproblem.org/art_9.html -- Thanks, Jordi Espasa Clofent

2 1

mirror mode works just one way
by Hegedus Gabor 24 Mar '09

24 Mar '09

Hi, all! I have a problem, I could include the schema to the 2.4 openldap, and I set the mirror mode like the manual said on the first server. I installed the same version openldap to the another server, and set it like the first server. the full database came to the second ldap. If i modify the first database, it push the changes to the second, and I can see the changes on it. BUT when I modify the second database, there is no changes on the first... Why? I can see trafic with tcp dump on first server 389 port,but nothing changes on it. /etc/ldap/* /etc/default/slapd files are the same on both server, and the databases are too. the only differences are the serverID and the provider in the slapd.conf file my mirror mode configuration: serverID 1 moduleload syncprov overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://192.168.1.2 type=refreshAndPersist interval=00:00:00:10 searchbase="dc=test,dc=hu" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=admin,dc=test,dc=hu" credentials="test" mirrormode on I have tried the mirror mode on a basic database and it worked, what is the problem now? please help, it is very important! thank you, best regards, Gabor

3 5

OpenLDAP Syncrepl issue
by Luis Castillo 23 Mar '09

23 Mar '09

Hello, I am having an issue getting the OpenLDAP to replicate using syncrepl. Basically, after configuring the consumer I can start the slapd process but I see no replication happening. Do you have a sample configuration file that can provide more info? Is there anything required on the master? Thanks, Luis

5 8

Re: acls for mirrormode user and its clear text passwords
by Tyler Gates 22 Mar '09

22 Mar '09

I figured this out. The problem was I didn't have the entry 'anonymous auth' in the clause. >I have a multimaster system running behind a back_ldap proxy and all >is? >running fine except for the fact that the mirrormode user specified in >syncrepl section can only specify its password as cleartext or use sasl >authentication. I'm not so worried about the clear text password being >seen because all connections are via tls. But, if anyone binds, >including anonymous users, that password is visible to them which >scares me because the mirrormode user has write access to the entire >tree. My first course of action was to set acls as write to mirrormode >user and none to everyone else but no matter what I do, replication >between the two servers breaks because it seems as soon as an acl is >defined, mirrormode user no longer has permissions. Am I fundamentally >missing something here with the visible clear text password? Or am I >just not doing the acls right? Below is an example of what I surely >thought would work at a (very minimal level). > >access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword > by anonymous none > >doesn't work. Even: > >access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword > by self write > >gives me no love either. If you need the entire acl I can provide it >but I'm guessing I missing something much more obvious. > >Thanks, > Tyler

1 0

acls for mirrormode user and its clear text passwords
by Tyler Gates 21 Mar '09

21 Mar '09

I have a multimaster system running behind a back_ldap proxy and all is running fine except for the fact that the mirrormode user specified in syncrepl section can only specify its password as cleartext or use sasl authentication. I'm not so worried about the clear text password being seen because all connections are via tls. But, if anyone binds, including anonymous users, that password is visible to them which scares me because the mirrormode user has write access to the entire tree. My first course of action was to set acls as write to mirrormode user and none to everyone else but no matter what I do, replication between the two servers breaks because it seems as soon as an acl is defined, mirrormode user no longer has permissions. Am I fundamentally missing something here with the visible clear text password? Or am I just not doing the acls right? Below is an example of what I surely thought would work at a (very minimal level). access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword by anonymous none doesn't work. Even: access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword by self write gives me no love either. If you need the entire acl I can provide it but I'm guessing I missing something much more obvious. Thanks, Tyler

1 0

acls for mirrormode user and its clear text passwords
by Tyler Gates 21 Mar '09

21 Mar '09

1 0

Starting OpenLDAP: slapd - failed
by Eldon Phukuile 21 Mar '09

21 Mar '09

I am following the tutorial at https://help.ubuntu.com/8.10/serverguide/C/openldap-server.html. Everything worked until... Command: sudo /etc/init.d/slapd restart Output: Stopping OpenLDAP: slapd. Starting OpenLDAP: slapd - failed. The operation failed but no output was produced. For hints on what went wrong please refer to the system's logfiles (e.g. /var/log/syslog) or try running the daemon in Debug mode like via "slapd -d 16383" (warning: this will create copious output). Below, you can find the command line options used by this script to run slapd. Do not forget to specify those options if you want to look to debugging output: slapd -h 'ldap://127.0.0.1:389/ ldaps:/// ldapi:///' -g openldap -u openldap -F /etc/ldap/slapd.d/ Command: slapd -d 16383 Output: @(#) $OpenLDAP: slapd 2.4.11 (Nov 8 2008 09:42:18) $ buildd@palmer:/build/buildd/openldap-2.4.11/debian/build/servers/slapd ldap_pvt_gethostbyname_a: host=MORPHEUS.matrix.corp, r=0 daemon_init: <null> daemon_init: listen on ldap:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) daemon: bind(7) failed errno=13 (Permission denied) daemon: bind(7) failed errno=13 (Permission denied) slap_open_listener: failed on ldap:/// slapd stopped. connections_destroy: nothing to destroy.

3 2

trigger a program when ldap db modifies
by Hegedus Gabor 19 Mar '09

19 Mar '09

Hi all! Can you suggest me a program or solution what is do the following: after i modify a record in a db, an external bash script runs off, like a daemon what is check the modifications, and start a script. I hope you are understanding what i want. Gabor

3 2

main: TLS init def ctx failed: -1
by mario ramirez cervera 19 Mar '09

19 Mar '09

main: TLS init def ctx failed: -1 ani ideas? thank

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical