openldap-technical

openldap-technical@openldap.org

3 participants
9898 discussions

"bulk-reload" of database and replication
by Sebastian Benoit 28 Oct '08

28 Oct '08

Hi, we are developing a application using openldap and have the following problem: We plan a setup using one master-ldap server (with normally few write operations). The database will be replicated to (initially) two slave-servers using syncrepl replication. Now, at the beginning (until the complete system is set up to work with the ldap-server) we will need to re-initialize the complete database from scratch. This reload takes about 10 minutes using perl-ldap and a tcp-connection to the server. During this time the application accessing the slave servers should still see the old view of the database. The switch from old data to new data on the slave-servers should be as fast as possible to avoid clients seeing wrong (or not existing) data. I thought about writing data in LDIF format and the create a new database from that using slapadd. But then there still is the replication problem. What methods to others use to solve this? Thanks for you help, /Benno -- Sebastian Benoit <benoit-lists(a)fb12.de>

3 2

slurpd replication problem.
by Choi, Justin 28 Oct '08

28 Oct '08

I am seeing invalid credential error logs a lot. Could you guys let me know how to solve this issue? Thanks. Server Log(slurpd -d 2) Replicated Log (/usr/sbin/slapd -u ldap -d 2 -h ldap:///) Slapd.conf database bdb suffix "dc=ijji,dc=com" rootdn "cn=Manager,dc=ijji,dc=com" rootpw {SSHA}EpkPadkANDlpX7yfcsa2WbA+bSssh0S4 # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap/ijji.com # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub #updatedn cn=Replication Manager,dc=ijji,dc=com #updateref ldap://ca1xc115.ijji.com access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=ijji,dc=com" write by * none access to * by self write by dn.base="cn=Manager,dc=ijji,dc=com" write by * read access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Replication Manager,dc=ijji,dc=com" write by * none access to * by self write by dn.base="cn=Replication Manager,dc=ijji,dc=com" write by * read # Replicas of this database replogfile /var/lib/ldap/openldap-master-replog replica host=ca1xc115.ijji.com:389 binddn="cn=Replication Manager,dc=ijji,dc=com" bindmethod=simple credentials=skdltmwkq loglevel -1 database bdb suffix "dc=ijji,dc=com" rootdn "cn=Manager,dc=ijji,dc=com" rootpw {SSHA}EpkPadkANDlpX7yfcsa2WbA+bSssh0S4 # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap/ijji.com # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub updatedn "cn=Replication Manager,dc=ijji,dc=com" updateref ldap://ca1xc124.ijji.com access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=ijji,dc=com" write by * none access to * by self write by dn.base="cn=Manager,dc=ijji,dc=com" write by * read access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Replication Manager,dc=ijji,dc=com" write by * none access to * by self write by dn.base="cn=Replication Manager,dc=ijji,dc=com" write by * read # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM loglevel -1 Justin Choi Sr. Security Engineer NHN USA, Inc. 3353 Michelson Suite 250 Irvine, CA 92612 Mobile (408) 329-8554 MSN iD: counterhacker(a)live.com <mailto:amyoh79@hotmail.com> Office (949) 863-1292 ext 256 Fax (949) 863-9418

2 1

nss_initgroups_ignoreusers
by Lynn York 26 Oct '08

26 Oct '08

Hello, I seem to be having an issue with nss_initgroups_ignoreusers. I have the following line in my /etc/ldap.conf file but it still seems to search ldap for the users. Can anyone shed some light on this issue for me? Also, I am running nss_ldap version >= 2.53. I have supplied a snippet of the sldap log. [ /etc/ldap.conf ] nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,postm aster,anonymous,apache [end ] [ log snippet ] Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=140 fd=48 ACCEPT from IP=127.0.0.1:59736 (IP=0.0.0.0:389) Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=69 op=27 SRCH base="ou=Internal,dc=mgmt,dc=test,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=postmaster))" Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=69 op=27 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=139 op=0 STARTTLS Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=139 op=0 RESULT oid= err=0 text= Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=69 op=27 SEARCH RESULT tag=101 err=0 nentries=0 text= Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=69 op=28 SRCH base="ou=Internal,dc=mgmt, dc=test,dc=com " scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=postmaster))" Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=69 op=28 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Oct 24 12:15:33 ldap-proxy slapd[10000]: conn=139 fd=62 TLS established tls_ssf=256 ssf=256 [ end snippet ] Thanks

1 0

active option crypt
by Kermito le kermit 26 Oct '08

26 Oct '08

hello all, i am to know how to activate option crypt in install of open ldap when i make this commande i see in the log crypt ..... no ./configure --enable-crypt

2 1

Upgrade from openldap 2.4.9 to 2.4.12
by Paul Lee 24 Oct '08

24 Oct '08

Dear all, I am currently having 4 LDAP servers running in 4-way masters mode, the current version is 2.4.9 and there are around 100k records. The db version is 4.2. If I want to upgrade to version 2.4.12, I should upgrade the db to 4.4 or above, right ? but if the db version is upgraded, how to preserve my existing 100k records, any formal procedure to convert the data to the new format ? Is my following procedure correct ? - upgrade the db version to 4.4 - upgrade openldap in 1 machine to 2.4.12 - delete all the files in /usr/local/var/openldap-data - stop 2 more openldap servers, leaving only 1 running version 2.4.9 - start the new server running version 2.4.12, then, records will be created in 2.4.12. - repeat for others servers. Is this correct ? Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

3 5

Security issue : userPassword is shown
by Paul Lee 23 Oct '08

23 Oct '08

Hi all, I use a 3rd party LDAP browser to browse the users that I created. I can see the userPassword clearly (plain text). Is there any way to avoid this ? When I use slapcat command to export to LDIF file, the userPassword field is encrypted, but why using 3rd party browser will show the password in plain text ? Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

6 7

Re: Upgrade from openldap 2.4.9 to 2.4.12
by Oliver Liebel 23 Oct '08

23 Oct '08

yes. absolutely correct: 2.4.12 needs 4.4+ http://www.openldap.org/software/release/readme.html Rein Tollevik schrieb: > Oliver Liebel skrev: >> keep it simple. >> first, theres no need of upgrading your bdb. >> 4.2.52 has the longest history to be stable. >> for bdb versions, see: >> http://www.openldap.org/lists/openldap-technical/200807/msg00138.html > > As of version 2.4.12, the bdb backend only support db versions 4.4 and > higher. See the README file. So the upgrade from 4.2 *is* required. > > Rein Tollevik > Basefarm AS > > ____________ Virus checked by G DATA AntiVirusKit Version: AVK 19.1180 from 23.10.2008 Virus news: www.antiviruslab.com

1 0

LDAP + SAMBA PDC
by Arun NAIR 23 Oct '08

23 Oct '08

Hey Guys, I have made an LDAP + Samba PDC and am able to add users to it as well. But when I try to login using ssh to the user name I get the error message Permission denied (publickey,gssapi-with-mic,password). I'm really reaching the deadlines now and have tried all the resources I could get my hands on it would be greatly appreciated if you guys can help me out with this. Regards, Arun Nair

3 2

Case sensitive uid attribute
by Martin Benson 23 Oct '08

23 Oct '08

Hi I am currently using Buchan Milne's OpenLDAP 2.3.43 rpm's on a RHEL 4.4 installation. I use the core, cosine, inetorgperson and NIS schema's and everything works great. I mainly use OpenLDAP as an authentication server and I have a problem where the uid is not case sensitive. If I create a user called "Martin" then it will also allow me to log in as "martin" and then fails as it cannot find my home directory. I have had a look at the schema files and in the core.schema and the core.ldif the uid entry is commented out. It contains an entry "EQUALITY caseIgnoreMatch" and I tried to change it to "EQUALITY caseExactMatch". Now I realise that I shouldn't be touching the core.schema but I don't know how else to do this without invalidating all the entries in the current database. No surprise but changing the attribute and uncommenting the uid entry did not work so any help would be appreciated. Sorry for not including all the usual files like slapd.conf but they are on the server at work and I am at home. Martin Benson

2 1

How to confirm syncrepl is working properly
by Mike Simonton 23 Oct '08

23 Oct '08

Hello everyone, I'm trying to learn how to use OpenLDAP and syncrepl, and I have two issues. First, how do I get past the following error, and second, how do I confirm that syncrepl is actually working?? Here's the slaptest error: # slaptest -f /usr/local/etc/openldap/slapd.conf bdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/var/openldap-data: (2). Expect poor performance for suffix "dc=promptutech,dc=local". bdb_monitor_db_open: monitoring disabled; configure monitor database to enable config file testing succeeded ...and here's my slapd.conf. Any ideas?? cat /usr/local/etc/openldap/slapd.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/promptu.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /opt/promptu/openldap/libexec/openldap # moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! access to * by dn.base="cn=replica,dc=promptutech,dc=local" read by * break ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=promptutech,dc=local" rootdn "cn=Manager,dc=promptutech,dc=local" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=0 provider=ldap://ptsunray02 type=refreshOnly interval=00:00:05:00 searchbase="dc=promptutech,dc=local" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=replica,dc=promptutech,dc=local" credentials="secret" updateref ldap://localhost mirrormode TRUE overlay syncprov syncprov-checkpoint 100 10 Thanks for your help! Mike

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical