openldap-technical

openldap-technical@openldap.org

9897 discussions

User root from client can be all another users
by Marcelo Gomes 24 Mar '09

24 Mar '09

Hi! In my network, when some client do login as root (local) he can type "su -l" and be all another user from ldap. How can i block this ? thanks Marcelo Gomes

4 3

smbk5pwd - slapd stops responding - please help-me!
by Eduardo Sachs 24 Mar '09

24 Mar '09

Hi People, I use the overlay smbk5pwd for sync password of Samba with the of Heimdal Kerberos. In Debian Etch using Samba 3.0.24-6etch10, OpenLDAP 2.3.30-5+etch2 and Heimdal Kerberos 0.7.2.dfsg.1-10, I don't have problems. But, in Debian Lenny using Samba 2:3.2.5-4, OpenLDAP 2.4.11-1, and Heimdal Kerberos 1.2.dfsg.1-2.1, I have problems. When I invoke smbpasswd or ldappaswd and trying change the password, slapd stops responding. With kpasswd I do not have problems, change the password of Samba and Kerberos correctly, and userPassword fixed with {K5KEY}, slapd not stops responding (working correctly), but, I need change the password with smbpasswd for Windows clients. Below follows a more detailed debug, has something else that I can show? This is a bug? slapd.conf configuration: moduleload smbk5pwd overlay smbk5pwd smbk5pwd-enable krb5 smbk5pwd-enable samba smbk5pwd-must-change 2592000 password-hash {K5KEY} - OpenLDAP have permission to read/write the file /var/lib/heimdal-kdc/m-key. - I configure OpenLDAP to run with user root and group root, for tests. smb.conf configuration about password: ldap passwd sync = Only unix password sync = no Look this example: 1 - LDAP OK: root# ps aux|grep slapd root 3841 3.0 0.8 21920 4512 ? Ssl 14:47 0:00 /usr/sbin/slapd -h ldap://10.111.222.100:389/ ldaps://10.111.222.100:636/ ldapi:/// -g root -u root -f /etc/ldap/slapd.conf root 3844 0.0 0.1 3116 728 pts/0 S+ 14:47 0:00 grep slapd root# ldapwhoami -Y GSSAPI SASL/GSSAPI authentication started SASL username: sachs(a)LOCAL.INT.BR SASL SSF: 56 SASL data security layer installed. dn:uid=sachs,ou=samba,ou=usuarios,dc=local,dc=int,dc=br 2 - Change password witch LDAPPASSWD: root# ldappasswd -x -D "krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" "uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" -w secret -S New password: Re-enter new password: ldap_result: Can't contact LDAP server (-1) root# ps aux|grep slapd root 3832 0.0 0.1 3116 724 pts/0 S+ 14:47 0:00 grep slapd root# ldapwhoami -Y GSSAPI ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) Loglevel in 256, trying change password with LDAPPASWD, stop in PASSMOD: conn=0 fd=18 ACCEPT from IP=10.111.222.100:40181 (IP=10.111.222.100:389) conn=0 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" method=128 conn=0 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" mech=SIMPLE ssf=0 conn=0 op=0 RESULT tag=97 err=0 text= conn=0 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=0 op=1 PASSMOD id="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" new Debug of Overlay Audit, trying change password with LDAPPASWD: # modify 1236964911 dc=local,dc=int,dc=br krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br dn: uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br changetype: modify replace: userPassword userPassword:: e0s1S0VZfQ== - replace: entryCSN entryCSN: 20090313172151.459306Z#000000#000#000000 - replace: modifiersName modifiersName: krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrin cipals,ou=Usuarios,dc=local,dc=int,dc=br - replace: modifyTimestamp modifyTimestamp: 20090313172151Z - # end replace 1236964911 3 - Change Password with SMBPASSWD: LDAP running correctly. root# ldapwhoami -Y GSSAPI SASL/GSSAPI authentication started SASL username: sachs(a)LOCAL.INT.BR SASL SSF: 56 SASL data security layer installed. dn:uid=sachs,ou=samba,ou=usuarios,dc=local,dc=int,dc=br # smbpasswd sachs New SMB password: Retype new SMB password: failed to bind to server ldaps://debian.local.int.br/ with dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" Error: Can't contact LDAP server (unknown) Connection to LDAP server failed for the 2 try! Connection to LDAP server failed for the 3 try! Connection to LDAP server failed for the 4 try! Connection to LDAP server failed for the 5 try! Connection to LDAP server failed for the 6 try! Connection to LDAP server failed for the 7 try! Loglevel in 256, trying change password with SMBPASSWD, stop in PASSMOD: conn=2 fd=27 ACCEPT from IP=10.111.222.100:35715 (IP=10.111.222.100:636) conn=2 fd=27 TLS established tls_ssf=128 ssf=128 conn=2 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" method=128 conn=2 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" mech=SIMPLE ssf=0 conn=2 op=0 RESULT tag=97 err=0 text= conn=2 op=1 SRCH base="ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=sachs))" conn=2 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=5 SRCH base="ou=Grupos,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(gidNumber=513))" conn=1 op=5 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass conn=1 op=5 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=6 SRCH base="ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaSamAccount)(|(sambaSID=s-1-5-21-1831924168-3154312721-1575139623-513)))" conn=1 op=6 SRCH attr=uid sambaSid conn=1 op=6 SEARCH RESULT tag=101 err=0 nentries=0 text= conn=1 op=7 SRCH base="ou=Grupos,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(|(sambaSID=s-1-5-21-1831924168-3154312721-1575139623-513)))" conn=1 op=7 SRCH attr=cn displayName sambaSid sambaGroupType conn=1 op=7 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=8 MOD dn="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" conn=1 op=8 MOD attr=sambaAcctFlags sambaAcctFlags conn=1 op=9 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" conn=1 op=9 SRCH attr=supportedExtension conn=1 op=9 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=10 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=1 op=10 PASSMOD id="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" new conn=1 op=8 RESULT tag=103 err=0 text= Debug of Overlay Audit, trying change password with SMBPASSWD: # modify 1236968199 dc=local,dc=int,dc=br krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br dn: uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br changetype: modify delete: sambaAcctFlags sambaAcctFlags: [U] - add: sambaAcctFlags sambaAcctFlags: [U ] - replace: entryCSN entryCSN: 20090313181639.613866Z#000000#000#000000 - replace: modifiersName modifiersName: krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrin cipals,ou=Usuarios,dc=local,dc=int,dc=br - replace: modifyTimestamp modifyTimestamp: 20090313181639Z - # end replace 1236968199 Thanks!!!

1 0

Re: ssh automatic logins using OpenLDAP
by Norberto Bensa 24 Mar '09

24 Mar '09

On Tue, Mar 24, 2009 at 12:51 PM, Jordi Espasa Clofent <jespasac(a)minibofh.org> wrote: > Another related question żis possible to _NOT_ use LDAP auth in some users? > It means, use LDAP+ssh in general sense, with only a few exeptions which > will stills login in local. Just configure pam/nss to use both sources (files and ldap). Then add users to /etc/passwd and ldap as needed

1 0

ssh automatic logins using OpenLDAP
by Jordi Espasa Clofent 24 Mar '09

24 Mar '09

Hi all, ¿Is possible to configure ssh automatic logins [1] using/through OpenLDAP? ¿How? Currently the ssh+ldap works perfectly in my OpenLDAP config, so a lot of works has been already done. [1] http://linuxproblem.org/art_9.html -- Thanks, Jordi Espasa Clofent

2 1

mirror mode works just one way
by Hegedus Gabor 24 Mar '09

24 Mar '09

Hi, all! I have a problem, I could include the schema to the 2.4 openldap, and I set the mirror mode like the manual said on the first server. I installed the same version openldap to the another server, and set it like the first server. the full database came to the second ldap. If i modify the first database, it push the changes to the second, and I can see the changes on it. BUT when I modify the second database, there is no changes on the first... Why? I can see trafic with tcp dump on first server 389 port,but nothing changes on it. /etc/ldap/* /etc/default/slapd files are the same on both server, and the databases are too. the only differences are the serverID and the provider in the slapd.conf file my mirror mode configuration: serverID 1 moduleload syncprov overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://192.168.1.2 type=refreshAndPersist interval=00:00:00:10 searchbase="dc=test,dc=hu" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=admin,dc=test,dc=hu" credentials="test" mirrormode on I have tried the mirror mode on a basic database and it worked, what is the problem now? please help, it is very important! thank you, best regards, Gabor

3 5

OpenLDAP Syncrepl issue
by Luis Castillo 23 Mar '09

23 Mar '09

Hello, I am having an issue getting the OpenLDAP to replicate using syncrepl. Basically, after configuring the consumer I can start the slapd process but I see no replication happening. Do you have a sample configuration file that can provide more info? Is there anything required on the master? Thanks, Luis

5 8

Re: acls for mirrormode user and its clear text passwords
by Tyler Gates 22 Mar '09

22 Mar '09

I figured this out. The problem was I didn't have the entry 'anonymous auth' in the clause. >I have a multimaster system running behind a back_ldap proxy and all >is? >running fine except for the fact that the mirrormode user specified in >syncrepl section can only specify its password as cleartext or use sasl >authentication. I'm not so worried about the clear text password being >seen because all connections are via tls. But, if anyone binds, >including anonymous users, that password is visible to them which >scares me because the mirrormode user has write access to the entire >tree. My first course of action was to set acls as write to mirrormode >user and none to everyone else but no matter what I do, replication >between the two servers breaks because it seems as soon as an acl is >defined, mirrormode user no longer has permissions. Am I fundamentally >missing something here with the visible clear text password? Or am I >just not doing the acls right? Below is an example of what I surely >thought would work at a (very minimal level). > >access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword > by anonymous none > >doesn't work. Even: > >access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword > by self write > >gives me no love either. If you need the entire acl I can provide it >but I'm guessing I missing something much more obvious. > >Thanks, > Tyler

1 0

acls for mirrormode user and its clear text passwords
by Tyler Gates 20 Mar '09

20 Mar '09

I have a multimaster system running behind a back_ldap proxy and all is running fine except for the fact that the mirrormode user specified in syncrepl section can only specify its password as cleartext or use sasl authentication. I'm not so worried about the clear text password being seen because all connections are via tls. But, if anyone binds, including anonymous users, that password is visible to them which scares me because the mirrormode user has write access to the entire tree. My first course of action was to set acls as write to mirrormode user and none to everyone else but no matter what I do, replication between the two servers breaks because it seems as soon as an acl is defined, mirrormode user no longer has permissions. Am I fundamentally missing something here with the visible clear text password? Or am I just not doing the acls right? Below is an example of what I surely thought would work at a (very minimal level). access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword by anonymous none doesn't work. Even: access to dn.base="cn=Mirrormode,dc=example,dc=com" attrs=userPassword by self write gives me no love either. If you need the entire acl I can provide it but I'm guessing I missing something much more obvious. Thanks, Tyler

1 0

acls for mirrormode user and its clear text passwords
by Tyler Gates 20 Mar '09

20 Mar '09

1 0

Starting OpenLDAP: slapd - failed
by Eldon Phukuile 20 Mar '09

20 Mar '09

I am following the tutorial at https://help.ubuntu.com/8.10/serverguide/C/openldap-server.html. Everything worked until... Command: sudo /etc/init.d/slapd restart Output: Stopping OpenLDAP: slapd. Starting OpenLDAP: slapd - failed. The operation failed but no output was produced. For hints on what went wrong please refer to the system's logfiles (e.g. /var/log/syslog) or try running the daemon in Debug mode like via "slapd -d 16383" (warning: this will create copious output). Below, you can find the command line options used by this script to run slapd. Do not forget to specify those options if you want to look to debugging output: slapd -h 'ldap://127.0.0.1:389/ ldaps:/// ldapi:///' -g openldap -u openldap -F /etc/ldap/slapd.d/ Command: slapd -d 16383 Output: @(#) $OpenLDAP: slapd 2.4.11 (Nov 8 2008 09:42:18) $ buildd@palmer:/build/buildd/openldap-2.4.11/debian/build/servers/slapd ldap_pvt_gethostbyname_a: host=MORPHEUS.matrix.corp, r=0 daemon_init: <null> daemon_init: listen on ldap:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) daemon: bind(7) failed errno=13 (Permission denied) daemon: bind(7) failed errno=13 (Permission denied) slap_open_listener: failed on ldap:/// slapd stopped. connections_destroy: nothing to destroy.

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical