openldap-technical

openldap-technical@openldap.org

9 participants
9867 discussions

slave dbd files and timestamps
by Ken McLauchlin 05 Feb '09

05 Feb '09

Hi there, We're running openldap 4.1.25 on 4 servers. 2 servers on a site running in master/slave configuration and 2 more on a remote site running as slaves receiving updates from the slurpd running on the master. The question I have isn't really anything to do with the configuration but with what files should be updated on the remote slave servers on update? The slave running at the same site as the master has all the files (dc.bdb, db2id.bdb, id2entry.bdb and objectClass.bdb) all updated with the same timestamp. However on the remote slaves the objectClass.bdb is NOT updated at the same time as the others. Is this a problem? As an aside, we are getting a log.00000xxxx file created every couple of days on the remote slave servers which isn't happening on the primary site slave server. Is this a configuration issue? Hope you can help. Cheers, Ken

1 0

Forgotten password recovery
by Vincent Panel 04 Feb '09

04 Feb '09

On 2/4/09, Michael Ströder <michael(a)stroeder.com> wrote: > Yes, but these "temporary security objects" have to be generated. If you > do this automagically you have a privileged service account which resets > the user's password in combination with a e-mail based > challenge-response check. I agree, but until I get your replies, I did not find any satisfying solution integrating this "e-mail based challenge-response check". I wanted the ldap server to validate the challenge which is going to be possible if I make drupal create those security objects with the challenge answer as the password. Once a user comes back with its response to the challenge, drupal will try to bind to the LDAP server as this temporary security object with the password being the "challenge" url. If the bind is successful, then drupal will automatically be granted the right to reset the corresponding user's password (thanks to regex ACLs). Once this is done, the user will be able to log in (or actually, drupal will log the user in) This is probably a bit complex to implement, but I'm gonna try.

1 0

Re: Forgotten password recovery
by Vincent Panel 04 Feb '09

04 Feb '09

Thanks, but as discussed, even creating a user able to reset all the userPassword attributes of all other users is not security risk free. This is what I call a privileged user and I would like to avoid it. Drupal already supports such a solution, but I don't find it secure enough. I had an interesting suggestion on the list : to create a database of temporary security objects where drupal is the only one who knows the passwords. Each temporary security object is able to reset one password in the main database (by the use of regex ACLs) and only once. On 2/4/09, Brett Maxfield <brett.maxfield(a)gmail.com> wrote: > If we are talking about openldap, not drupal, there are probably many ways > of doing so.. My thoughts.. > > You cannot bind as the user in this case, as presumably the reason they want > to reset password is that they dont know it. > > You should probably give the website it's own standard read-only user, which > has been (only) allowed to update userPassword. > > Giving the website manager/root access just to change a password would be > extremely unwise and inasvisable. > > Drupal should let you specify any ldap user for password resers.. > > -----Original Message----- > From: Vincent Panel <yohonet(a)gmail.com> > Sent: Wednesday, 4 February 2009 2:16 AM > To: openldap-technical(a)openldap.org > Subject: Forgotten password recovery > > Hello, > > Many websites now provide a feature which allow users to reset their > password on their own, without being helped by an administrator or > another privileged person. > > A website I'm working on is using drupal which is able to handle such > a situation by sending a mail to the user. The body of this mail > contains a specific url crafted by drupal so that when the user clicks > on the link, drupal can automatically authenticate the user. This URL > is only valid once. > > If you try to integrate drupal with openldap, you'll find that > openldap does not support such an authentication scheme. So you are > either forced to create a privileged user in LDAP which is able to > reset all users' passwords or live with it and give up this feature. > > So I'm writing to this list to know if anyone already had a similar > issue and which solution was found ? Would it be possible for openldap > or an openldap overlay to implement such an authentication mechanism ? > Is there any IETF draft about it (one can dream) ? > > Vincent > >

2 1

user home directory perms
by Geoffrey 04 Feb '09

04 Feb '09

We are using a combination of ldap and samba, therefore are adding users via the smbldap-useradd script. How do we set the permissions for the home directory when the user logs in for the first time. The directories are being created, but not with the permissions we want. Thanks. -- Until later, Geoffrey Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. - Benjamin Franklin

1 0

Forgotten password recovery
by Vincent Panel 04 Feb '09

04 Feb '09

Hello, Many websites now provide a feature which allow users to reset their password on their own, without being helped by an administrator or another privileged person. A website I'm working on is using drupal which is able to handle such a situation by sending a mail to the user. The body of this mail contains a specific url crafted by drupal so that when the user clicks on the link, drupal can automatically authenticate the user. This URL is only valid once. If you try to integrate drupal with openldap, you'll find that openldap does not support such an authentication scheme. So you are either forced to create a privileged user in LDAP which is able to reset all users' passwords or live with it and give up this feature. So I'm writing to this list to know if anyone already had a similar issue and which solution was found ? Would it be possible for openldap or an openldap overlay to implement such an authentication mechanism ? Is there any IETF draft about it (one can dream) ? Vincent

3 4

best practices - dn:
by Brian Krusic 04 Feb '09

04 Feb '09

Hi all, I've read and config'd my ldifs as follows; option 1; dn: uid=fbar,ou=People,dc=company,dc=com uid: foo sn: Bar mail: foo(a)company.com cn: Foo Bar objectClass: inetOrgPerson objectClass: apple-user objectClass: shadowAccount objectClass: posixAccount objectClass: top uidNumber: 1000 gidNumber: 20 loginShell: /bin/tcsh homeDirectory: /homes/fbar apple-user-homeDirectory: /homes/fbar userPassword:: agbeirrklflhfihverrrknv= option 2; dn: cn=Foo Bar,ou=People,dc=company,dc=com uid: foo sn: Bar mail: foo(a)company.com cn: Foo Bar objectClass: inetOrgPerson objectClass: apple-user objectClass: shadowAccount objectClass: posixAccount objectClass: top uidNumber: 1000 gidNumber: 20 loginShell: /bin/tcsh homeDirectory: /homes/fbar apple-user-homeDirectory: /homes/fbar userPassword:: agbeirrklflhfihverrrknv= My OpenLDAP server is used for company white pages and authentication for Linux, OSX clients. What do you think the most reliable dn value should be; with uid or with cn? - Brian

2 2

multiple groups not showing up in "groups" cmd
by Justin Lintz 03 Feb '09

03 Feb '09

Hi, I've configured a user to be a member of another posixGroup as so... dn: cn=dev2,ou=groups,dc=test,dc=net cn: dev2 gidNumber: 1003 objectClass: posixGroup objectClass: top memberUid: dave The users info: dn: cn=David FooBar,ou=people,dc=test,dc=net givenName: David sn: FooBar cn: David FooBar uid: dave userPassword:: uidNumber: 1009 gidNumber: 1004 homeDirectory: /home/dave loginShell: /bin/bash objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: top If I log into a server with the users account, it shows him properly a member of gid 1004, but does not list his seconday group of dev2. My /etc/ldap.conf file is base dc=test,dc=net binddn cn=Manager,dc=test,dc=net bindpw timelimit 15 bind_timelimit 15 idle_timelimit 3600 nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman pam_filter objectclass=posixaccount pam_member_attribute memberuid nss_base_passwd ou=People,dc=test,dc=net?one nss_base_shadow ou=People,dc=test,dc=net?one nss_base_group ou=Groups,dc=test,dc=net?one uri ldaps://prodldap01/ ldaps://prodldap02/ ssl on tls_cacertdir /etc/openldap/cacerts tls_checkpeer no pam_password md5 I also tried changing the value of memberUid to the DN of the user, but that did not work as well. Any suggestions are appreciated. Thanks - Justin Lintz

2 2

Active Directory & Open LDAP Synchronization
by Paul bob 03 Feb '09

03 Feb '09

Hi - I have installed Active directory authentication for windows servers and users and LDAP for Linux servers, now I am planning to use single sign on system windows and Linux. How can I sync with these two directory? I would appreciate your advice! Thanks, PB

3 2

supportedSASLMechanisms not Work in Debian Lenny
by Jarbas Peixoto Júnior 03 Feb '09

03 Feb '09

I have two servers: * Server A: Debian Etch - Works Fine * Server B: Debian Lenny - Do not Works supportedSASLMechanisms EXTERNAL In Server A I have: # ldapsearch -v -H ldap://server-Etch -b "" -LLL -s base supportedSASLMechanisms -ZZ ldap_initialize( ldap://server-Etch ) SASL/EXTERNAL authentication started SASL username: emailAddress=jarbas.peixoto(a)previdencia.gov.br,CN=jarbas.peixoto,OU=DATAPREV,O=Previdencia Social,L=Campo Grande,ST=Mato Grosso do Sul,C=BR SASL SSF: 0 filter: (objectclass=*) requesting: supportedSASLMechanisms dn: supportedSASLMechanisms: PLAIN supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: LOGIN supportedSASLMechanisms: NTLM supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: EXTERNAL In Server B I have: # ldapsearch -v -H ldap://server-Lenny -b "" -LLL -s base supportedSASLMechanisms -ZZ ldap_initialize( ldap://server-Lenny:389/??base ) ldap_start_tls: Connect error (-11 # ldapsearch -v -H ldap://server-Lenny -b "" -LLL -s base supportedSASLMechanisms -ZZ -d 1 ldap_url_parse_ext(ldap://server-Lenny) ldap_create ldap_url_parse_ext(ldap://server-Lenny:389/??base) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP server-Lenny:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.82.0.234:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 31 bytes to sd 3 ldap_result ld 0x9d73280 msgid 1 wait4msg ld 0x9d73280 msgid 1 (infinite timeout) wait4msg continue ld 0x9d73280 msgid 1 all 1 ** ld 0x9d73280 Connections: * host: www-mmldap port: 389 (default) refcnt: 2 status: Connected last used: Thu Jan 29 18:17:22 2009 ** ld 0x9d73280 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x9d73280 request count 1 (abandoned 0) ** ld 0x9d73280 Response Queue: Empty ld 0x9d73280 response count 0 ldap_chkResponseList ld 0x9d73280 msgid 1 all 1 ldap_chkResponseList returns ld 0x9d73280 NULL ldap_int_select read1msg: ld 0x9d73280 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 0x9d73280 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: read1msg: ld 0x9d73280 0 new referrals read1msg: mark request completed, ld 0x9d73280 msgid 1 request done: ld 0x9d73280 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_err2string ldap_start_tls: Connect error (-11) In the /var/log/syslog I have: Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 fd=21 ACCEPT from IP=10.82.0.234:50441 (IP=0.0.0.0:389) Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 op=0 STARTTLS Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 op=0 RESULT oid= err=0 text= Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 fd=21 closed (TLS negotiation failure) This is very important for use openldap with user certificates. Anybody have a help for me? Tanks!

3 3

RE: ldap_bind fails in vpn tunnel
by Christopher Barry 30 Jan '09

30 Jan '09

> -----Original Message----- > From: Shankhadeep Sen [mailto:shanks.iit@gmail.com] > Sent: Friday, January 30, 2009 1:25 PM > To: Christopher Barry > Subject: Re: ldap_bind fails in vpn tunnel > > Hi Christopher, > > Thanks for your email.It seems that > without TLS , the search works first but next when I initiate > a TLS session, the ldap api says "SERVER DOWN".I must mention > that the bandwidth is very low in that VPN tunnel and there > is only one route. > > Now I used tcpdump to check the packets on port 389 , it > seems that there are a lot of packets being exchanged.My > guess is that because of the low b/w even if one packet gets > dropped because of router overflow, the SSL handshake will be > terminated. > > What do you think? > > Thanks, > > Sankhadip > > > On Fri, Jan 30, 2009 at 9:05 AM, Christopher Barry > <christopher.barry(a)qlogic.com> wrote: > > > > -----Original Message----- > > From: > > openldap-technical-bounces+christopher.barry=qlogic.com@openld > > ap.org > > [mailto:openldap-technical-bounces+christopher.barry > <mailto:openldap-technical-bounces%2Bchristopher.barry> =qlogic.co > > m(a)openldap.org] On Behalf Of Sankhadip Sengupta > > Sent: Friday, January 30, 2009 9:34 AM > > To: openldap-technical(a)openldap.org > > Subject: ldap_bind fails in vpn tunnel > > > > Hi, > > > > In a VPN tunnel, using TLS, ldap_search works but the > > ldap_bind fails with error :Can't contact LDAP server(-1). > > > > Can any one help me? I am using the openldap sdk. > > > > Thanks, > > > > Sankhadip > > > > > You might try putting the LDAP server's name and IP > address in the hosts file of the client. > > -C > > > > > Is this link helpful to you? http://www.openldap.org/lists/openldap-software/200201/msg00625.html

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical