openldap-technical

openldap-technical@openldap.org

13 participants
9906 discussions

Re: SSHD doesn't start
by Jordi Espasa Clofent 29 Aug '08

29 Aug '08

> This is more of a sys-admin question, but change when sshd starts up so > ldap comes up first. Ok Gavin, I'd thought that the present 'openldap-technical' mail-list was the correct place to ask this kind of questions. ¿Can you point to me what is the correct list? -- Thanks, Jordi Espasa Clofent

1 0

AW: Re: TLSVerifyClient: Basic setup works, but SSHD and su fail (SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server)
by Hauke Coltzau 29 Aug '08

29 Aug '08

Hi Buchan, summary first: the su - <network_user> problem is solved thanks to your question. ssh <network_user>@<client> works only under certain circumstances (see below). > > I want to use TLS-communication between my ldap server and > > the clients. > > [...] > > > Next, I activated TLSVerifyClient on the server side > > Why ? You don't need this to address your single remaining problem, > unless you haven't stated it in full. Sorry, I did not point out that I want only valid users/services to be able to get information from the ldap server at all. A valid service or user shall be identified by a certificate that is signed by a valid CA of mine. All other connection attempts shall be rejected. That is how I understood the combination of TLS_REQCRT (to verify the server) and TLSVerifyClient (to verify the client). Am I wrong here? > Since I use the ldap server for network user authentication, I can (as > local user) make a su - <network_user>, enter the password and get > authenticated, but have a look at the shell: > > <local user>@<client>:~$ su - <network_user> > Password: <network user password here> > id: cannot find name for group ID <network_user group> > I have no name!@<client>:~$ > > Does 'strace -e open id' tell you anything interesting (specifically about > the key/cert)? Wow, one single question of yours gave me several hours of work and the solution for my first problem. Thanks ;-) I ensured that the requested files are readable by the user (they already were, but I checked it again, even made a chmod -R 777 on the directory). This was not the problem. But after creating a new certificate for that network user with the CN set to the users username (instead of the surname/name before), the problem with su - <network_user> disappeared. Now I can su from a certified local user to my network user. <local user>@<client>:~$ su - <network user> Password: <network user>@<client>:~$ That's cool! > > In /etc/ldap.conf (ubuntu 8.04 uses this as replacement for > > lib(pam|nss)_ldap.conf), > > Actually, Ubuntu reverts back to the upstream location, lib(pam|nss)_ldap.conf > is a Debian-ism. Thanks for the info, did not know that. > > I set the values for > > > > tls_cert /usr/lib/ssl/certs/<client>.ldap.cert.pem > > tls_key /usr/lib/ssl/private/<client>.ldap.key.pem > > You didn't indicate any of the other /etc/ldap.conf settings, such as > tls_cacertfile, tls_check_peer. Additionally, you don't specify if you are > using nscd, or whether the logged in user (below) can read the tls_cert and > tls_key files. Since the verification of the server certificate works out fine, I only provided the client-verification specific values. Here are the missing values: base dc=... uri ldaps://<fqdn of my server>/ ldap_version 3 bind_policy soft pam_password md5 tls_check_peer yes tls_cacertfile /usr/lib/ssl/cacerts/<serverca>.chain.pem tls_cert /usr/lib/ssl/certs/<client>.ldap.cert.pem tls_key /usr/lib/ssl/private/<client>.ldap.key.pem nss_initgroups_ignoreusers backup,bin,daemon,dhcp,fetchmail,games,gnats,irc,klog,libuuid,list,lp,mail,man, \ messagebus,news,postfix,proxy,root,sshd,statd,sync,sys,syslog,uucp,www-data,zimbra The nss_initgroups_ignoreusers entry is automatically created when executing /etc/init.d/libnss-ldap restart or when booting the system. I disabled the nscd caches for passwd and group before starting to deal with TLS just to make sure that the ldap server is always contacted. ==== /etc/nscd.conf ==== ... enable-cache passwd no ... enable-cache group no ... == END /etc/nscd.conf == After tideous testing I found out something new: I wanted to strace the sshd, too and therefore stopped the running instance with /etc/init.d/ssh stop and started a new instance manually <local user>@<client> sudo -s root@<client># /usr/sbin/sshd -D Doing so, the login via SSH works sout perfectly. I assumed that this is because sshd would read the .ldaprc of <local user>, which has a valid cert/key entry (see above), so I straced the above command. But: root@<client>:/etc/init.d# strace -e open /usr/sbin/sshd -D 2>&1 open("/etc/ld.so.cache", O_RDONLY) = 3 open("/lib/libwrap.so.0", O_RDONLY) = 3 open("/lib/libpam.so.0", O_RDONLY) = 3 open("/lib/libdl.so.2", O_RDONLY) = 3 open("/lib/libselinux.so.1", O_RDONLY) = 3 open("/usr/lib/libck-connector.so.0", O_RDONLY) = 3 open("/usr/lib/libdbus-1.so.3", O_RDONLY) = 3 open("/usr/lib/libcrypto.so.0.9.8", O_RDONLY) = 3 open("/lib/libutil.so.1", O_RDONLY) = 3 open("/usr/lib/libz.so.1", O_RDONLY) = 3 open("/lib/libnsl.so.1", O_RDONLY) = 3 open("/lib/libcrypt.so.1", O_RDONLY) = 3 open("/lib/libresolv.so.2", O_RDONLY) = 3 open("/usr/lib/libgssapi_krb5.so.2", O_RDONLY) = 3 open("/usr/lib/libkrb5.so.3", O_RDONLY) = 3 open("/usr/lib/libk5crypto.so.3", O_RDONLY) = 3 open("/lib/libcom_err.so.2", O_RDONLY) = 3 open("/lib/libc.so.6", O_RDONLY) = 3 open("/usr/lib/libkrb5support.so.0", O_RDONLY) = 3 open("/lib/libkeyutils.so.1", O_RDONLY) = 3 open("/etc/selinux/config", O_RDONLY) = -1 ENOENT (No such file or directory) open("/proc/mounts", O_RDONLY) = 3 open("/dev/null", O_RDWR) = 3 open("/proc/14556/fd", O_RDONLY|O_NONBLOCK|O_DIRECTORY|0x80000) = 3 open("/etc/ssh/sshd_config", O_RDONLY) = 3 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 3 open("/etc/gai.conf", O_RDONLY) = 3 open("/etc/nsswitch.conf", O_RDONLY) = 3 open("/etc/ld.so.cache", O_RDONLY) = 3 open("/lib/libnss_files.so.2", O_RDONLY) = 3 open("/etc/passwd", O_RDONLY|0x80000 /* O_??? */) = 3 open("/etc/ssh/ssh_host_rsa_key", O_RDONLY) = 3 open("/etc/ssh/blacklist.RSA-2048", O_RDONLY) = 3 open("/etc/ssh/ssh_host_dsa_key", O_RDONLY) = 3 open("/etc/ssh/blacklist.DSA-1024", O_RDONLY) = 3 open("/etc/localtime", O_RDONLY) = 4 open("/var/run/sshd.pid", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4 Now if I do ssh <network_user>@<client> from any machine in the net, everything works out perfectly: <some id>@<some host>:~> ssh <network_user>@<client> <network_user>@<client>'s password: Last login: Fri Aug 29 21:23:06 2008 from <fqdn of some host> <network user>@<client>:~$ But not a single ldap or libnss/libpam config file is stat'ed or read by the above sshd at all. The only thing that can be seen is that after logging out, the above sshd command echos --- SIGCHLD (Child exited) @ 0 (0) --- and that's it. When I kill the above sshd and do /etc/init.d/ssh start again, the login still works out. But after restarting the sytem, the login fails as always. As far as I can see, /etc/init.d/ssh starts sshd as root, obviously not chrooted or something similar. Do you have any idea, what this is all about? Kind regards, Hauke --

1 0

Re: Mistake in the doc ?
by Gavin Henry 29 Aug '08

29 Aug '08

----- "Vincent Panel" <yohonet(a)gmail.com> wrote: > Hi, > > Maybe I don't understand but, I'm looking at § 8.2.4.1 in this > document : http://www.openldap.org/doc/admin22/schema.html > > The goal is to create an attributetype called "myUniqueName" which is > unique. With the last definition of this attributetype : > > attributetype ( 1.1.2.1.1 NAME 'myUniqueName' > DESC 'unique name with my organization' > SUP name ) > > How can openldap guess that we cant a unique attributetype ? > > Isn't there a SINGLE-VALUE missing at the end of the description ? It's just talking about the name of the attribute, not the attribute value. SINGLE-VALUE means attributes of this type are restricted to a single value, nothing about uniqueness. Please have a read of doc/rfc/rfc4512.txt at your leisure. -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

1 0

TLSVerifyClient: Basic setup works, but SSHD and su fail (SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server)
by Hauke Coltzau 29 Aug '08

29 Aug '08

Hi everybody, hope, this is still the right group for my question, might also be a lib{pam|nss}_ldap problem. I am very happy to say that I have an almost completely running installation now. But one single problem still remains: I want to use TLS-communication between my ldap server and the clients. I started up with an own RootCA, created 2 SubCAs (one for server certs, one for user certs) and generated a certificate for my server, signed by the ServerCA. On client side, I have set ==== /etc/ldap/ldap.conf ==== BASE dc=... URI ldaps://<fqdn>/ # Require valid cert from server TLS_REQCERT yes # CA for trusted server certs TLS_CACERT /usr/lib/ssl/cacerts/<serverca>.chain.pem == END /etc/ldap/ldap.conf == This works out perfectly, as I can see using a paket sniffer. The client only communicates with the server using TLSv1 and only if the server's certificate is valid. Next, I activated TLSVerifyClient on the server side ==== /etc/ldap/slapd.conf ==== ... # The CA chain for valid client certs TLSCACertificateFile /usr/lib/ssl/cacerts/<userca>.chain.pem # The server's cert TLSCertificateFile /usr/lib/ssl/certs/<server>.cert.pem # The server's key TLSCertificateKeyFile /usr/lib/ssl/private/<server>.key.pem # Verify clients always TLSVerifyClient demand == END /etc/ldap/slapd.conf == and created a client cert without password for my local client user, signed by the UserCA. This cert and the according key are referenced in the (local) users .ldaprc on the client machine: ==== /home/<user>/.ldaprc ==== TLS_CERT /home/<user>/openldap/<user>.ldap.cert.pem TLS_KEY /home/<user>/openldap/<user>.ldap.key.pem == END /home/<user>/.ldaprc == So, when I start ldapsearch -x as local user, I get a positive result as long as the above mentioned certificate is valid. If the user's certificate is not valid, ldapsearch fails. Wonderful, that's exactly what I wanted. But now to my problem: Since I use the ldap server for network user authentication, I can (as local user) make a su - <network_user>, enter the password and get authenticated, but have a look at the shell: <local user>@<client>:~$ su - <network_user> Password: <network user password here> id: cannot find name for group ID <network_user group> I have no name!@<client>:~$ Without TLSVerifyClient, this works out fine: <local user>@<client>:~$ su - <network_user> Password: <network user password here> <network_user>@<client>:~$ Secondly: How do I make it possible that when connecting via ssh to the client machine (from any other machine), I can login as <network_user>? Here are the details: In /etc/ldap.conf (ubuntu 8.04 uses this as replacement for lib(pam|nss)_ldap.conf), I set the values for tls_cert /usr/lib/ssl/certs/<client>.ldap.cert.pem tls_key /usr/lib/ssl/private/<client>.ldap.key.pem The certificate has been signed by the same CA as the above user certificate. The CN is the name of the host (not fqdn, that is, just the hostname). But when I try to login via ssh, quits the connection saying slapd -d127 -h "ldaps:///" -u openldap -g openldap ... TLS: can't accept: The peer did not send any certificate.. connection_read(12): TLS accept failure error=-1 id=0, closing ... Whithout TLSVerifyClient, I can login. I assume that both problems have the same background, but I just don't get it. Hope, this time I didn't miss reading a manual again ;-) Best regards, Hauke --

2 1

Proxy to Active Directory
by Nazeeruddin Mohammad 29 Aug '08

29 Aug '08

Hi Everyone, Like many organizations, we have two authentication systems here. I am trying to figure out a way of synchronizing LDAP passwords with AD passwords; or proxying the requests to AD. Management wants to keep LDAP intact, while enjoying the flexibility of single password. I have unsuccessfully tried to use proxy functionally of LDAP to get user information from AD. First of all, AD needs a user name and password to retrieve information. Is there a way of specifying username/password? Even the following ldapsearch FAILS on openldap server, but the same query works fine for AD server. ldapsearch -LLL -x -h localhost -b 'cn=users,dc=internal,dc=phg,dc=com,dc=au' -D "ldapauth(a)internal.phg.com.au" -W -x ldapsearch -LLL -x -h localhost -b 'dc=internal,dc=phg,dc=com,dc=au' -D "CN=Ldap Authentication,OU=Linux,OU=InformationTechnology,OU=Portland House,OU=Sites,DC=internal,DC=phg,DC=com,DC=au" -W -x Here is the relevant sladp.conf snippet. database ldap suffix "cn=users,dc=internal,dc=phg,dc=com,dc=au" subordinate rebind-as-user uri "ldap://192.168.100.100/" chase-referrals yes Any help is appreciated. Thank you very much. Cheers Nazeer *************************************************************************** CAUTION: This email message and accompanying data may contain information that is confidential and/or subject to legal privilege. If you are not the intended recipient, you are notified that any use, dissemination, distribution or copying of this message or data is prohibited. If you have received this email message in error, please notify us immediately and erase all copies of this message and attachments. Thank you. ***************************************************************************

5 6

Changing the structural objectclass within the same hierarchy
by Vincent Panel 29 Aug '08

29 Aug '08

On Wed, Jul 30, 2008 at 4:55 PM, Vincent Panel <yohonet(a)gmail.com> wrote: > Hi, > > It seems that openldap didn't allow changing the structural > objectclass of an object, even if both classes are in the same > "branch", back in 2006 : > http://www.openldap.org/lists/openldap-software/200602/msg00459.html > > I now have a similar problem : is it still planned to be solved ? > > Specififaclly, my object is from class "inetOrgPerson" and I want to > change it to "myClass" which SUP is inetOrgPerson. > > Thanks, > > Vincent > About this problem, I've seen this FAQ entry : http://www.openldap.org/faq/data/cache/1341.html Quote : "In 2.4, support for a new control will (hopefully) be introduced to allow the (authorized) user to request this (and various other model restrictions) be temporarily relaxed." Has this really been introduced ? Actually, I'm using openldap 2.3, but it's definitely an argument for me to upgrade to 2.4... In particular, am I allowed to change the object class from "fruit" to "pear" (I refer the FAQ) ?

1 0

LDAP + PAM, authentication of users in certain group
by Peter V 29 Aug '08

29 Aug '08

Hi, I have got users and groups in LDAP and I use it for authentication from several servers. I need users to be able to log into the servers only if they are in "admin" group. I use pam_ldap.so module for the authentication. I added these lines into /etc/pam_ldap.conf pam_groupdn cn=admins,ou=Groups,dc=domain,dc=com pam_member_attribute memberUid And the following line into /etc/pam.d/ssh: account required pam_ldap.so Basically, this works alright, BUT I have got root account in local databse /etc/passwd and I need root to be able to log in even if he is not in the "admin" group and also if the LDAP server is off. This does not work, because with this setting, the PAM module requires also root to be in the "admin" group and when the LDAP server is off, there is no admin group. Does anyone know how to set this up? Thanks, Peter

2 1

Create EntryDN
by LITLE TUX 29 Aug '08

29 Aug '08

Hi all ..... Would Like know as create entry DN in my ldap server???? Thanks

1 0

Problem allow bind_v3
by LITLE TUX 29 Aug '08

29 Aug '08

Hi list.... would like know to lieve version OpenLdap in can use option "allow bind_v3" ? Thanks!

1 0

OpenLDAP Client + IBM Directory Server + TLS
by Klaus Heinrich Kiwi 29 Aug '08

29 Aug '08

Hi, has anyone ever managed to set-up an TLS connection between an OpenLDAP client and an IBM LDAP Server (more specifically, ITDS 6.1, linux platform)? I can submit queries in the standard way, but using TLS seems to be a bit of a problem. I have the server certificate specified as TLS_CACERT in my client config since it's self-signed. The query result goes like this: ------ klausk@klausk:~/sandbox/Kerberos_work$ ldapsearch -D cn=root -W -H ldap://fqdn -s sub -x -ZZ -d 9 objectclass=* ldap_url_parse_ext(ldap://fqdn) ldap_create ldap_url_parse_ext(ldap://fqdn:389/??base) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP fqdn:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 2.2.2.222:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 31 bytes to sd 3 ldap_result ld 0x8059240 msgid 1 wait4msg ld 0x8059240 msgid 1 (infinite timeout) wait4msg continue ld 0x8059240 msgid 1 all 1 ** ld 0x8059240 Connections: * host: fqdn port: 389 (default) refcnt: 2 status: Connected last used: Thu Aug 28 13:43:57 2008 ** ld 0x8059240 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x8059240 request count 1 (abandoned 0) ** ld 0x8059240 Response Queue: Empty ld 0x8059240 response count 0 ldap_chkResponseList ld 0x8059240 msgid 1 all 1 ldap_chkResponseList returns ld 0x8059240 NULL ldap_int_select read1msg: ld 0x8059240 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 38 contents: read1msg: ld 0x8059240 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: read1msg: ld 0x8059240 0 new referrals read1msg: mark request completed, ld 0x8059240 msgid 1 request done: ld 0x8059240 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ber_scanf fmt (a) ber: ber_scanf fmt (O) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (x) ber: ber_scanf fmt (x) ber: ber_scanf fmt (}) ber: ldap_msgfree TLS: can't connect: Decryption has failed.. ldap_err2string ldap_start_tls: Connect error (-11) klausk@klausk:~/sandbox/Kerberos_work$ ------ Note: the server is configured to accept TLS in the standard port (389), after a START_TLS extended LDAP operation. It works fine using the IBM Client. After sniffing the packets I could see that the OpenLDAP Client sends a "Client Hello" message advertising TLS 1.1 support (0x0302), whereas the IBM Client asks for TLS 1.0 (0x0301). In both cases the server replies with a TLS 1.0 "Server Hello" message, with the certificate and TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite. The following client messages are TLS 1.0, indicating that the OpenLDAP correctly fell back the version. But with the OpenLDAP Client, after Change Cipher Spec and Encrypted Handshake, the server sends an "Encrypted Alert" message and the connection is dropped, with the output above. I'm using a certificate generated using GSKIT in the server box, and exported the .PEM key, which OpenSSL appears to recognize fine. Is there anything more I can do to debug this error? I'm particularly interested in further debugging the TLS connection. Maybe there is an environment variable that will enable debugging output from OpenSSL? Any pointers are helpful. Thanks, -Klaus K. -- Klaus Heinrich Kiwi <klausk(a)linux.vnet.ibm.com> Linux Security Development, IBM Linux Technology Center

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical