openldap-technical

openldap-technical@openldap.org

22 participants
9789 discussions

Start a nNew thread

Create EntryDN
by LITLE TUX 29 Aug '08

29 Aug '08

Hi all ..... Would Like know as create entry DN in my ldap server???? Thanks

1 0

Problem allow bind_v3
by LITLE TUX 29 Aug '08

29 Aug '08

Hi list.... would like know to lieve version OpenLdap in can use option "allow bind_v3" ? Thanks!

1 0

OpenLDAP Client + IBM Directory Server + TLS
by Klaus Heinrich Kiwi 29 Aug '08

29 Aug '08

Hi, has anyone ever managed to set-up an TLS connection between an OpenLDAP client and an IBM LDAP Server (more specifically, ITDS 6.1, linux platform)? I can submit queries in the standard way, but using TLS seems to be a bit of a problem. I have the server certificate specified as TLS_CACERT in my client config since it's self-signed. The query result goes like this: ------ klausk@klausk:~/sandbox/Kerberos_work$ ldapsearch -D cn=root -W -H ldap://fqdn -s sub -x -ZZ -d 9 objectclass=* ldap_url_parse_ext(ldap://fqdn) ldap_create ldap_url_parse_ext(ldap://fqdn:389/??base) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP fqdn:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 2.2.2.222:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 31 bytes to sd 3 ldap_result ld 0x8059240 msgid 1 wait4msg ld 0x8059240 msgid 1 (infinite timeout) wait4msg continue ld 0x8059240 msgid 1 all 1 ** ld 0x8059240 Connections: * host: fqdn port: 389 (default) refcnt: 2 status: Connected last used: Thu Aug 28 13:43:57 2008 ** ld 0x8059240 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x8059240 request count 1 (abandoned 0) ** ld 0x8059240 Response Queue: Empty ld 0x8059240 response count 0 ldap_chkResponseList ld 0x8059240 msgid 1 all 1 ldap_chkResponseList returns ld 0x8059240 NULL ldap_int_select read1msg: ld 0x8059240 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 38 contents: read1msg: ld 0x8059240 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: read1msg: ld 0x8059240 0 new referrals read1msg: mark request completed, ld 0x8059240 msgid 1 request done: ld 0x8059240 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ber_scanf fmt (a) ber: ber_scanf fmt (O) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (x) ber: ber_scanf fmt (x) ber: ber_scanf fmt (}) ber: ldap_msgfree TLS: can't connect: Decryption has failed.. ldap_err2string ldap_start_tls: Connect error (-11) klausk@klausk:~/sandbox/Kerberos_work$ ------ Note: the server is configured to accept TLS in the standard port (389), after a START_TLS extended LDAP operation. It works fine using the IBM Client. After sniffing the packets I could see that the OpenLDAP Client sends a "Client Hello" message advertising TLS 1.1 support (0x0302), whereas the IBM Client asks for TLS 1.0 (0x0301). In both cases the server replies with a TLS 1.0 "Server Hello" message, with the certificate and TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite. The following client messages are TLS 1.0, indicating that the OpenLDAP correctly fell back the version. But with the OpenLDAP Client, after Change Cipher Spec and Encrypted Handshake, the server sends an "Encrypted Alert" message and the connection is dropped, with the output above. I'm using a certificate generated using GSKIT in the server box, and exported the .PEM key, which OpenSSL appears to recognize fine. Is there anything more I can do to debug this error? I'm particularly interested in further debugging the TLS connection. Maybe there is an environment variable that will enable debugging output from OpenSSL? Any pointers are helpful. Thanks, -Klaus K. -- Klaus Heinrich Kiwi <klausk(a)linux.vnet.ibm.com> Linux Security Development, IBM Linux Technology Center

1 0

OpenLdap + Postfix
by LITLE TUX 29 Aug '08

29 Aug '08

Hello list.... look to me another .... after resolve problem witch ldap and squid ... i have a new problem.... now with POSTFIX Scenaries: server 01: openLdap + SambaPDC server 02: postfix + squi I trying make integration between systems OPEN LDAP and POSTFIX but all time that configure the server 02 to authentication in server 01 receving bellow error: Aug 29 08:30:19 gheorghe slapd[7485]: => bdb_search Aug 29 08:30:19 gheorghe slapd[7485]: bdb_dn2entry("ou=dns,dc=meudominio,dc=com,dc=br") Aug 29 08:30:19 gheorghe slapd[7485]: => send_search_entry: conn 31 dn="ou=DNS,dc=meudominio,dc=com,dc=br" Aug 29 08:30:19 gheorghe slapd[7485]: <= send_search_entry: conn 31 exit. Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_result: conn=31 op=7 p=3 Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_response: msgid=8 tag=101 err=0 Aug 29 08:30:19 gheorghe slapd[7485]: connection_get(31): got connid=31 Aug 29 08:30:19 gheorghe slapd[7485]: connection_read(31): checking for input on id=31 Aug 29 08:30:19 gheorghe slapd[7485]: do_search Aug 29 08:30:19 gheorghe slapd[7485]: >>> dnPrettyNormal: <zoneName= meudominio.com.br,ou=DNS,dc=meudominio,dc=com,dc=br> Aug 29 08:30:19 gheorghe slapd[7485]: <<< dnPrettyNormal: <zoneName= meudominio.com.br,ou=DNS,dc=meudominio,dc=com,dc=br>, <zoneName= meudominio.com.br,ou=dns,dc=meudominio,dc=com,dc=br> Aug 29 08:30:19 gheorghe slapd[7485]: => bdb_search Aug 29 08:30:19 gheorghe slapd[7485]: bdb_dn2entry("zoneName= meudominio.com.br,ou=dns,dc=meudominio,dc=com,dc=br") Aug 29 08:30:19 gheorghe slapd[7485]: => bdb_dn2id("zoneName= meudominio.com.br.br,ou=dns,dc=meudominio,dc=com,dc=br") Aug 29 08:30:19 gheorghe slapd[7485]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_result: conn=31 op=8 p=3 Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_response: msgid=9 tag=101 err=32 Aug 29 08:30:19 gheorghe slapd[7485]: connection_get(31): got connid=31 Aug 29 08:30:19 gheorghe slapd[7485]: connection_read(31): checking for input on id=31 Aug 29 08:30:19 gheorghe slapd[7485]: do_add Aug 29 08:30:19 gheorghe slapd[7485]: >>> dnPrettyNormal: <zoneName= meudominio.com.br,ou=DNS,dc=meudominio,dc=com,dc=br> Aug 29 08:30:19 gheorghe slapd[7485]: <<< dnPrettyNormal: <zoneName= meudominio.com.br,ou=DNS,dc=meudominio,dc=com,dc=br>, <zoneName= meudominio.com.br,ou=dns,dc=meudominio,dc=com,dc=br> Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_result: conn=31 op=9 p=3 Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_response: msgid=10 tag=105 err=21 I tray all... our almost all ... rs ...but i don't resolver error..... Thanks for any help to me resolve this problem.

1 0

SSHD doesn't start
by Jordi Espasa Clofent 29 Aug '08

29 Aug '08

Hi all, I'm just learning about wonderful OpenLDAP. I want to build a AAAA server (with OpenLDAP, of course) that allows SSH. At present I've the next testing scenario: * OpenLDAP server (FreeBSD 7.0) * OpenLDAP client (FreeBSD 7.0 also) When server it's running, I can always perform ssh logins on client. Perfect. The problem is when I shutdown the server and after I reboot the client, the client systems completely hangs up when it tries to run up the sshd service. ?¿?¿?¿? If I restart the server, the client runs fine again. I'm not understand the real reason of that behavior, but one thing is clear: SSH deamon requires OpenLDAP server runs. So I thing the problem is focused probably in pam.d module conf. Useful info: ldapclient# more /etc/pam.d/sshd # # $FreeBSD: src/etc/pam.d/sshd,v 1.16 2007/06/10 18:57:20 yar Exp $ # # PAM configuration for the "sshd" service # # auth auth sufficient pam_opie.so no_warn no_fake_prompts #auth requisite pam_opieaccess.so no_warn allow_local #auth sufficient pam_krb5.so no_warn try_first_pass auth sufficient /usr/local/lib/pam_ldap.so no_warn try_first_pass auth sufficient pam_ssh.so no_warn try_first_pass auth required pam_unix.so no_warn try_first_pass # account account required pam_nologin.so #account required pam_krb5.so account required pam_login_access.so account sufficient /usr/local/lib/pam_ldap.so account required pam_unix.so # session #session optional pam_ssh.so session required /usr/local/lib/pam_mkhomedir.so debug #session required pam_permit.so # password #password sufficient pam_krb5.so no_warn try_first_pass password sufficient /usr/local/lib/pam_ldap.so use_authok password required pam_unix.so no_warn try_first_pass ldapclient# more /etc/nsswitch.conf # # nsswitch.conf(5) - name service switch configuration file # $FreeBSD: src/etc/nsswitch.conf,v 1.1 2006/05/03 15:14:47 ume Exp $ # group: ldap files passwd: ldap files #group: compat #group_compat: nis hosts: files dns #networks: files #passwd: compat #passwd_compat: nis shells: files #services: compat #services_compat: nis protocols: files rpc: files -- Thanks, Jordi Espasa Clofent

1 0

ldap query on imail
by Li Wen Bin 28 Aug '08

28 Aug '08

Hi all, We have a mail server known as imail which is a product of Ipswitch. It is using openldap database. We are now in the process of creating a web application for our office users which will authenticate using the openldap database in imail server. Below is the code that my programmer is trying to query to imail. However we got the error "The specified domain either does not exist or could not be contacted". Is the code below "LDAP://o=smtp2.mentormedia.com.sg" correct? Pls advise. Thks in advance. //****Connecting to LDAP active directory domainAndUsername = "LDAP://o=smtp2.mentormedia.com.sg"; userName = "USER1"; passWord = "testpass"; at= AuthenticationTypes.ReadonlyServer; //Create the object necessary to read the info from the LDAP directory DirectoryEntry entry = new DirectoryEntry(domainAndUsername,userName,passWord,at);

1 0

AW: Re: [SOLVED] Re: SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server - client certificate not read
by Hauke Coltzau 28 Aug '08

28 Aug '08

Hi again, man, I mixed up a lot of things ... Hope, I finally understand what I did wrong: Ubuntu 8.04 creates a huge /etc/ldap.conf as a substitute for libnss_ldap.conf and libpam_ldap.conf. I misunderstood this file to be the LDAP client configuration, which it is obviously not. Instead, it's the configuration for libnss-ldap and libpam-ldap. In some wiki article, I read that it would be o.k. to softlink /etc/ldap/ldap.conf to /etc/ldap.conf to have a fewer number of configuration files. I did that and forgot to mention in my first mail. That's why I used keywords like tls_cacertfile and others, because that's just the way those parameters are called in that file. I hope to be smarter next time ;-) So, what I did now: I created a new /etc/ldap/ldap.conf with only a few entries: ===== /etc/ldap/ldap.conf ===== BASE dc=... URI ldaps://<fqdn>/ TLS_REQCERT yes TLS_CACERT /usr/lib/ssl/cacerts/<ca>.chain.crt === END /etc/ldap/ldap.conf === after that, ldapsearch -x was successful. Then I re-installed libnss/libpam-ldap and set the neccessary nss/pam values in the auto-generated /etc/ldap.conf. Finally, I adapted common-* in /etc/pam.d/ and getent passwd, id <user> and su worked the way I wanted them to. I still have a problem with TLSVerifyClient demand, but that's something for another thread and only after some more reading and testing ;-) Thanks again for your help, I learned a lot :-) Best regards, Hauke ----- Ursprüngliche Mail ----- Von: "Buchan Milne" <bgmilne(a)staff.telkomsa.net> An: openldap-technical(a)openldap.org CC: hyc(a)symas.com, "Hauke Coltzau" <hauke.coltzau(a)FernUni-Hagen.de> Gesendet: Donnerstag, 28. August 2008 13:31:58 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: Re: [SOLVED] Re: SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server - client certificate not read On Thursday 28 August 2008 12:28:25 Hauke Coltzau wrote: > Hi everybody, > > thank you all for your immediate replies. > > As you correctly pointed out, the options I used were wrong. > With following ldap.conf, everything works out fine. > > base dc=... > URI ldaps://<fqdn of ldap server>/ > ldap_version 3 > rootbinddn cn=... > bind_policy soft > pam_password md5 > > TLS_REQCERT yes > TLS_CACERT /usr/lib/ssl/certs/<ca>.chain.crt > > The ldap.conf I used before has been created by dpkg-reconfigure > and I simply changed the default values there. That was a mistake ;-) > Creating a new ldap.conf from scratch with a man-page at hand > obviously did the trick. You still seem to be confused between different ldap.conf files, bind_policy, pam_password etc. are not valid in the OpenLDAP ldap.conf file, most likely one belongs in /etc/libnss_ldap.conf and the the other in /etc/libpam_ldap.conf (on Debian-based systems, or /etc/ldap.conf on distros that use the default config file location for nss_ldap/pam_ldap as shipped upstream). While you may have a working configuration, it may be more by luck than good judgement. Regards, Buchan -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------

1 0

Re: ldap_bind: Can't contact LDAP server (-1)
by Michael Ströder 28 Aug '08

28 Aug '08

Kristen, please stay on the mailing list you started the thread. Don't e-mail me solely personally. Kristen Walker wrote: > Thanks for your help. I can't seem to be able to start the server with the > -d flag. Here is what I tried: > > su root -c /usr/local/libexec/slapd -d 65535 > > I also tried: > > su root -d 65535 -c /usr/local/libexec/slapd > > And it complains in both cases that -d is an invalid option. Using -d works for me. Which version of OpenLDAP is this? Can you post any output it produces? Ciao, Michael.

4 6

SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server - client certificate not read
by Hauke Coltzau 28 Aug '08

28 Aug '08

Hello everybody, I'm just trying to set up a LDAPS server using my own certification authority, but the ldap server does not accept/understand my client certificate. Instead, the server sais: TLS: can't accept: The peer did not send any certificate.. What I did: 1.) I set up LDAP without SSL/TLS to make sure that it is configured properly. This worked out fine so far, I can use ldapsearch, ldapadd, phpldapadmin ... 2.) I created a self signed certificate for my RootCA, used it to sign my ServerCA and used the ServerCA to sign the certificates for my ldap server and client. The certificates of RootCA and ServerCA have been concatenated into one file <name of ca>.chain.crt 3.) Changed ldap.conf and slapd.conf as described below 4.) Tried to do an ldapsearch on the client -> failed 5.) Tried openssl client -> success Here are the details: Client: ======= # ldapsearch -x -LLL -ZZ -d 1 ldap_create ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP <serverip>:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying <serverip>:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 TLS: can't connect: A TLS packet with unexpected length was received.. ldap_err2string ldap_start_tls: Can't contact LDAP server (-1) Server: ======== # slapd -VV @(#) $OpenLDAP: slapd 2.4.9 (Aug 1 2008 01:09:46) $ buildd@king:/build/buildd/openldap2.3-2.4.9/debian/build/servers/slapd # slapd -h "ldaps://<ip>/" -u openldap -g openldap -d 127 ... ... connection_get(13): got connid=32 connection_read(13): checking for input on id=32 tls_read: want=5, got=5 0000: 16 03 02 00 07 ..... tls_read: want=7, got=7 0000: 0b 00 00 03 00 00 00 ....... TLS: can't accept: The peer did not send any certificate.. connection_read(13): TLS accept failure error=-1 id=32, closing connection_closing: readying conn=32 sd=13 for close connection_close: conn=32 sd=13 daemon: removing 13 But if I use openssl s_client, I get a differnet result: Client: ======= openssl s_client -showcerts -connect <serverfqdn>:636 \ -CAfile cacerts/<ca>.chain.crt -cert certs/<clientfqdn>.cert.pem \ -key private/<clientfqdn>.key.pem CONNECTED(00000003) depth=2 /C=... verify return:1 depth=1 /C=... verify return:1 depth=0 /C=... verify return:1 --- Certificate chain 0 s:/C=... i:/C=... -----BEGIN CERTIFICATE----- <Certificate data> -----END CERTIFICATE----- --- Server certificate subject=/C=... issuer=/C=... --- Acceptable client certificate CA names /C=... /C=... --- SSL handshake has read 1806 bytes and written 4358 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 2048 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: F63D4DB4A918CC3BC8F8617AD49F6C6EFCB316203466EC91DBCF0C2E3700DE1E Session-ID-ctx: Master-Key: <master key> Key-Arg : None Start Time: 1219848938 Timeout : 300 (sec) Verify return code: 0 (ok) --- And on server side, everything seems to be o.k. There is no error and the last lines of output are: => ldap_dn2bv(16) <= ldap_dn2bv(cn=<cn of client>,ou=<ou>,o=<o>,st=<st>,c=<c>)=0 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero ldap.conf (partially) --------------------- uri ldaps://132.176.4.6/ ssl yes tls_cacertfile /usr/lib/ssl/cacartes/<ca>.chain.crt tls_ciphers TLSv1 tls_cert /usr/lib/ssl/certs/<clientfqdn>.cert.pem tls_key /usr/lib/ssl/private/<clientfqdn>.key.pem ldap.conf (partially) --------------------- TLSCACertificateFile /usr/lib/ssl/certs/<ca>.chain.crt TLSCertificateFile /usr/lib/ssl/openldap/<serverfqdn>.cert.pem TLSCertificateKeyFile /usr/lib/ssl/openldap/private/<serverfqdn>.key.pem TLSVerifyClient demand What did I do wrong? Best regards, Hauke Coltzau --

3 3

How to restrict the simultaneous login
by Praveen Kumar 28 Aug '08

28 Aug '08

Hi, I using the LDAP server for authentication and log into a machine. Now i want the user should not be allowed log into any machine, if it is already logged into one machine using that LDAP server for the login and authentication. Means that there should not be any simultaneous login for the same user. Is this possible using the LDAP or Not. Waiting for the reply. Thanks in advance. Regards.

3 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical