openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Error on boot
by Ronni Feldt 20 Nov '08

20 Nov '08

Hi, I've installed and configured LDAP and Kerberos which works fine. The only problem is that when I start my computer, I get the following error: udevd[2282]: nss_ldap: failed to bind to LDAP Server ldap://ldap.one.com: Can't contact LDAP Server udevd[2282]: reconnecting to LDAP Server... udevd[2282]: could not connect to any LDAP Server as (null) - Can't contact LDAP Server udevd[2282]: could not search LDAP Server - Server is unavailable I then have restart and boot into another dist I have installed and edit the following files: nsswitch.conf pam.d/common-auth common-account common-password common-session And remove kerberos & ldap Restart and then I can login, but without Kerberos and LDAP. How do I solve this? Best Regards Ronni

3 2

Advise on tuning
by Maykel Moya 19 Nov '08

19 Nov '08

I have a box (Proliant DL560) with this features: - 4GB RAM - 3 x Xeon 2.8 GHz - 2 x HD SCSI 10k RPM (No RAID) I have the BDB in one of those HD and the logs in the other one. When I installed the server I wasn't enough sure about a correct value for cachesize so I decided to play safe. sldcu DB_CONFIG --------------- set_cachesize 0 1073741824 0 set_lk_max_objects 2500 set_lk_max_locks 2500 set_lk_max_lockers 2500 set_lg_dir /storage/bdb-log/sldcu set_flags DB_LOG_AUTOREMOVE accesslog DB_CONFIG ------------------- set_cachesize 0 715827883 0 set_lk_max_objects 2500 set_lk_max_locks 2500 set_lk_max_lockers 2500 set_lg_dir /storage/bdb-log/accesslog set_flags DB_LOG_AUTOREMOVE I was reading this[1] yesterday and found out that a I have a very large value. For my dc=sld,dc=cu DB I have a 6.2 MB dn2id.bdb and a 56 MB id2entry.bdb, the DIT contains about 60k entries. Normally I larger value is a Good Thing(TM) but I'm specially worried about slapd using around 40%-50% time of (one) CPU and eventually a message of 'deferring operation' gets logged. The server is attending 30 connections per second sustained during working hours. Read Waiters are about 100 sustained during this same period. Yesterday I sent a message to the list asking for opinions about that value for Read Waiters because it doesn't sound good to me, but well, I know that 'sounds good' is very subjective. I was running 2.3.38 yesterday morning and upgraded to 2.4.11. With the same setup (only the slapd changed) the mail service got deeply affected. Dovecot began to take several (+10) seconds to authenticate, in other cases, the POP3/IMAP connection was dropped due to timeout. While Dovecot was failing my slapd.log were solid filled by 'deferring operation' messages. I stopped Dovecot, the messages dissapears, I started Dovecot, the message began again to fill logs. So, I thank it could be some problem on Dovecot side (although it was playing nice with slapd 2.3.38). Thanks God I hit man slapd-hdb and learn about cache tuning values there. I then raised olcDbCacheSize / olcDbDNCacheSize / olcDbIDLCacheSize and things began to calm down. I wonder how slapd 2.3.38 were nicely serving Dovecot without the tuning I made. On the other hand I have the suspiction, based on benchmark data published on the list, that there is something wrong with that large cache plus 50% CPU for less than 30 connections per second. I very much appreciate any help/advise/hint someone could give me about this issue. Regards, maykel [1] http://www.openldap.org/faq/data/cache/1075.html

1 0

Re: Openldap and TLS issue
by Ivan Ordonez 19 Nov '08

19 Nov '08

Will do. I'm glad that there are community as such. This is a great place to learn and get help. -Ivan Gavin Henry wrote: > ----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > > >> Thanks very much Gavin for all your help. All is working as it should. >> > > No problem. Just make sure you pass on what you've learned :-) > >

1 0

Re: Openldap and TLS issue
by Ivan Ordonez 19 Nov '08

19 Nov '08

Thanks very much Gavin for all your help. All is working as it should. -Ivan Gavin Henry wrote: > ----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > > >> Few more questions Gavin. >> >> Our primary domain controller certificate is also expiring next month. >> What is the best way to handle this? Does the certificate and keys on >> the backup domain controller has any connection to the certs and keys >> of the primary domain controller and the other backup domain >> controller? >> > > Other than being signed by the Certificate Authority, none. As long as > you use the same FQDN for the certs as before and the CA doesn't change, > then all is good. > > >> I would be relieve to hear that I can make brand new certificate and >> keys for each machine and they have no connection with each other. >> >> Thanks for all your help. >> >> -Ivan >> >> >> ghenry(a)OpenLDAP.org wrote: >> >> ----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: >> >> Looking at the debug log, it is expired. It puzzle me because the >> certs on the other two machine are working correctly. Check their >> expiry dates with: >> >> openssl x509 -in /usr/local/etc/openldap/ldap-slave_cert.pem -text >> >> Since this is the case (certificate expires), is it safe to create a >> new one for this machine? Of course, then sign it with the cacert, >> something like: >> >> ./CA.sh -newreq >> ./CA.sh -sign >> > >

1 0

cont contact server since 3 days+please help
by Donny George 19 Nov '08

19 Nov '08

hello all i am a beginner with openldap and installed a server and a client with ldap(both machines ubuntu 8.04) but once i tried to populate the database at the server it gave the error that it couldnt contact the server. i cudnt connect to the server frmo the client either. i ran the command ldapsearch -d 255 to debug and heres the result ldap_create ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_build_search_req ATTRS: supportedSASLMechanisms ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 10.4.139.5:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.4.139.5:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_close_socket: 3 ldap_err2string ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) and if i run ldapsearch -x it gives the message ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) please someone help, i dont know where i cud start to solve this error. -- Donny George

2 1

Re: Openldap and TLS issue
by ghenry＠OpenLDAP.org 19 Nov '08

19 Nov '08

----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > Looking at the debug log, it is expired. It puzzle me because the > certs on the other two machine are working correctly. Check their expiry dates with: openssl x509 -in /usr/local/etc/openldap/ldap-slave_cert.pem -text > Since this is the case (certificate expires), is it safe to create a > new one for this machine? Of course, then sign it with the cacert, something like: ./CA.sh -newreq ./CA.sh -sign -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

Re: Openldap and TLS issue
by Ivan Ordonez 19 Nov '08

19 Nov '08

Looking at the debug log, it is expired. It puzzle me because the certs on the other two machine are working correctly. Since this is the case (certificate expires), is it safe to create a new one for this machine? Gavin Henry wrote: > ----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > > >> Hi, >> >> Our environment is consist of 3 domain controllers - 1 primary and 2 >> backup. All domain controller are running on Gentoo platform using >> Samba with Openldap for user login and authentication. One of the >> backup domain controller has been acting up lately and will not start >> >> samba properly. A quick look at the log showed: >> >> slapd[22380]: conn=94 op=0 RESULT oid= err=0 text= >> slapd[22380]: conn=94 fd=11 closed (TLS negotiation failure) >> slapd[22380]: conn=95 fd=11 ACCEPT from IP=127.0.0.1:54158 >> (IP=0.0.0.0:389) >> >> It seems obvious that the issue is with certificate. The certificate >> we >> are using was created using the primary domain controller and were >> then >> copied to both backup domain controller. If I create a brand new >> certificate using the backup domain controller having certificate >> issue, >> will that interfere with the certificate on the primary domain >> controller? Will that cause confusion on the domain? Creating a brand >> >> new certificate is the only solution I can think of to fix this issue. >> > > http://www.openldap.org/faq/data/cache/185.html > > Has one of your certs expired? By default OpenSSL scripts do 365 days. > >

1 0

Slow Data sync
by Bad Guy 19 Nov '08

19 Nov '08

Hi all, I am using openldap 2.4.11, and configure as 4-way Master, config files for server A,B,C,D are shown below : Server A : syncrepl rid=A provider=ldap://serverA:389/ retry="1 +" ...... syncrepl rid=B provider=ldap://serverB:389/ retry="1 +" ...... syncrepl rid=C provider=ldap://serverC:389/ retry="1 +" ...... syncrepl rid=D provider=ldap://serverD:389/ retry="1 +" ...... serverID 001 Server B : syncrepl rid=A provider=ldap://serverA:389/ retry="1 +" ...... syncrepl rid=B provider=ldap://serverB:389/ retry="1 +" ...... syncrepl rid=C provider=ldap://serverC:389/ retry="1 +" ...... syncrepl rid=D provider=ldap://serverD:389/ retry="1 +" ...... serverID 002 Server C : syncrepl rid=A provider=ldap://serverA:389/ retry="1 +" ...... syncrepl rid=B provider=ldap://serverB:389/ retry="1 +" ...... syncrepl rid=C provider=ldap://serverC:389/ retry="1 +" ...... syncrepl rid=D provider=ldap://serverD:389/ retry="1 +" ...... serverID 003 Server D : syncrepl rid=A provider=ldap://serverA:389/ retry="1 +" ...... syncrepl rid=B provider=ldap://serverB:389/ retry="1 +" ...... syncrepl rid=C provider=ldap://serverC:389/ retry="1 +" ...... syncrepl rid=D provider=ldap://serverD:389/ retry="1 +" ...... serverID 004 I find a strange behaviour, data can be synced within all 4 servers, however, after some time, I find that when I add/update data in server A, it can sync to server B immediately, server C and server D can't receive the updated data., I check the log in server C and server D, there is no data push to C and D. (I set the log level 16384 to log the sync) When I add record in server C, data can be sync to server D immediately, server A and server B can't receive the updated data. But after some time (may be 1-2 hours), the data between the 4 servers are synced finally. Another information is that server A and B are in same segment, server C and server D are in same segment, but server A and C/D are in different segment. The ping test between servers are fast. I also use telnet server A/B/C/D 389, the response is fast. Any idea ? Thanks _________________________________________________________________ 5 GB 超大容量、創新便捷、安全防護垃圾郵件和病毒 — 立即升級 Windows Live Hotmail http://mail.live.com

1 0

Must pwdReset always be set explicitly?
by Akke Bengtsson 19 Nov '08

19 Nov '08

The draft description of ppolicy (draft-behera-ldap-password-policy-09.txt) from July 17 2005 says among other things "If the value the pwdMustChange is TRUE and the modification is performed by a password administrator, then the pwdReset attribute is set to TRUE. My impression, using OpenLDAP up to v.2.4.10 is that it rather is implemented as "...and the pwdReset attribute is set to TRUE, the user has to change his password." (i.e. to set pwdReset signals the very fact that I am a password administrator.)? (On the other hand - the reset of the pwdReset attribute when the user actually chooses a new password is as expected automatically performed by the OpenLDAP software.) The Behera draft expired more than two years ago - in a more recent IETF draft by Zeilenga from march 2008, there is a suggestion to replace pwdReset by passwdChangeRequired. Also this draft is expired by now - did it make way into any OpenLDAP code? Best Regards Akke Bengtsson IT-Forum, IT-Arkitektur och systemutveckling Karolinska Universitetssjukhuset 141 86 STOCKHOLM

1 0

Openldap and TLS issue
by Ivan Ordonez 18 Nov '08

18 Nov '08

Hi, Our environment is consist of 3 domain controllers - 1 primary and 2 backup. All domain controller are running on Gentoo platform using Samba with Openldap for user login and authentication. One of the backup domain controller has been acting up lately and will not start samba properly. A quick look at the log showed: slapd[22380]: conn=94 op=0 RESULT oid= err=0 text= slapd[22380]: conn=94 fd=11 closed (TLS negotiation failure) slapd[22380]: conn=95 fd=11 ACCEPT from IP=127.0.0.1:54158 (IP=0.0.0.0:389) It seems obvious that the issue is with certificate. The certificate we are using was created using the primary domain controller and were then copied to both backup domain controller. If I create a brand new certificate using the backup domain controller having certificate issue, will that interfere with the certificate on the primary domain controller? Will that cause confusion on the domain? Creating a brand new certificate is the only solution I can think of to fix this issue. I've already re-install samba, openldap and smbldap-tools twice to no avail. samba 3.0.32 openldap 2.3.43 smbldap-tools 0.9.4-r1 Thanks in advance. -Ivan

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical