openldap-technical

openldap-technical@openldap.org

9 participants
9902 discussions

ProFTP + LDAP + SSL (LDAPServer 1.2.3.4:636)
by catia.lavalle＠bechtle.com 03 Jun '08

03 Jun '08

Hello, I do not know if this is the place to ask but maybe some of you have already had this configuration. I have a problem configuring ProFTP to use LDAP over SSL (i.e. ldaps on port 636). In short: ProFTP without TLS (TLSEngine off) DOES authenticate with LDAP without SSL (LDAPServer 1.2.3.4:389) ProFTP with TLS (TLSEngine on, path to the ftp-ssl certificates) DOES authenticate with LDAP without SSL (LDAPServer 1.2.3.4:389) ProFTP with TLS (TLSEngine on, path to the ftp-ssl certificates) DOES NOT authenticate with LDAP with SSL (LDAPUseTLS on; LDAPServer 1.2.3.4:636) The procedure is a 2 way SSL with 2 certificates: filezilla (for example) (acting as client for ProFTP) ->SSL(cert_ftp)-> ProFTP (acting as server for filezilla, cert_ftp) ProFTP (acting as client for LDAP) ->SSL(cert_LDAP)-> LDAP (acting as server for the ProFTP, cert_LDAP). If I look in the logs I see that the ProFTP Server connects to the LDAP server on the correct port, the LDAP server accepts the connection but the TLS fails! In principle for me it is obvious because in the ProFTP configuration I do give the path to the FTP-SSL certificates and keys but I do not input any path for the LDAP-SSL certificates i.e. in my opinion it can not work like this. So my question is how to make it work? As I have said in my opinion the key point is to be able to set the path where the ProFTP server finds the certificates for the LDAP server. I do not find any hint whatsoever in the net. The steps I have done: LDAP Server: The LDAP Server IP (say) 1.2.3.4 The LDAP Server listens to port 636 (ldaps) and port (ldap). I have created a certificate for the LDAP server (slapd.pem, slapd.key) The LDAP server itself is fully functioning on both ldap and ldaps (for example ldaps with apache ok) ProFTP Server: The ProFTP Server IP (say) 5.6.7.8 I have created a certificate for the ProFTP server (ftp2.pem, ftp2.key) I have copied locally the certificates of the LDAP server (slapd.pem) This is exactly what you do with apache (and it works) provided one gives the path for "both" certificates LDAPTrustedGlobalCert CA_BASE64 /apache/conf/ssl_certs/slapd.pem .... .... SSLCertificateFile /apache/conf/ssl_certs/apache.pem SSLCertificateKeyFile /apache/conf/ssl_certs/apache.key This is the ProFTP configuration (mod_tls and mod_ldap parts) <IfModule mod_tls.c> TLSEngine on TLSLog /ftp2/logs/tls.log TLSProtocol SSLv23 TLSOptions NoCertRequest TLSRSACertificateFile /ftp2/conf/ssl_certs/ftp2.pem TLSRSACertificateKeyFile /ftp2/conf/ssl_certs/ftp2.key TLSCACertificateFile /ftp2/conf/ssl_certs/ftp2.pem TLSVerifyClient off TLSRequired on TLSRenegotiate required off </IfModule> <IfModule mod_ldap.c> #LDAPServer 1.2.3.4:389 LDAPUseTLS on LDAPServer 1.2.3.4:636 LDAPDoAuth on "ou=bbb,dc=aaa,dc=de" "(&(uid=%v)(objectclass=posixAccount))" LDAPDNInfo "uid=1234,dc=aaa,dc=de" root LDAPAuthBinds on LDAPDoUIDLookups on "ou=bbb,dc=aaa,dc=de" LDAPSearchScope subtree </IfModule> Both LDAP server and ProFTP (proftp-ldap) server are: Linux version 2.6.18-6-amd64 (Debian 2.6.18.dfsg.1-18etch1) (waldi(a)debian.org) (gcc version 4.1.2 20061115 (prerelease) (Debian 4.1.1-21)) #1 SMP Sun Feb 10 17:50:19 UTC 2008 OpenLDAP server (slapd) dpkg -l | grep slapd ii slapd 2.3.30-5+etch1 I have used the ProFTP with precompiled LDAP (proftp-ldap) dpkg -l | grep proftp ii proftpd 1.3.0-19 Versatile, virtual-hosting FTP daemon ii proftpd-ldap 1.3.0-19 Versatile, virtual-hosting FTP daemon Error in /var/log/syslog from slapd May 27 10:54:05 ftp1test slapd[7323]: daemon: activity on 1 descriptor May 27 10:54:05 ftp1test slapd[7323]: daemon: listen=9, new connection on 19 May 27 10:54:05 ftp1test slapd[7323]: daemon: added 19r (active) listener=(nil) May 27 10:54:05 ftp1test slapd[7323]: conn=106 fd=19 ACCEPT from IP=5.6.7.8:42564 (IP=0.0.0.0:636) May 27 10:54:05 ftp1test slapd[7323]: daemon: select: listen=6 active_threads=0 tvp=NULL May 27 10:54:05 ftp1test slapd[7323]: daemon: select: listen=7 active_threads=0 tvp=NULL May 27 10:54:05 ftp1test slapd[7323]: daemon: select: listen=8 active_threads=0 tvp=NULL May 27 10:54:05 ftp1test slapd[7323]: daemon: select: listen=9 active_threads=0 tvp=NULL May 27 10:54:05 ftp1test slapd[7323]: daemon: activity on 1 descriptor May 27 10:54:05 ftp1test slapd[7323]: daemon: activity on: May 27 10:54:05 ftp1test slapd[7323]: 19r May 27 10:54:05 ftp1test slapd[7323]: May 27 10:54:05 ftp1test slapd[7323]: daemon: read activity on 19 May 27 10:54:05 ftp1test slapd[7323]: daemon: removing 19 May 27 10:54:05 ftp1test slapd[7323]: conn=106 fd=19 closed (TLS negotiation failure) Please Help Thanks.

1 0

could not hard reconnect to LDAP server - Server is unavailable
by Gar Nelson 03 Jun '08

03 Jun '08

"As it quite unlikely that issues raised in your message could not be discussed without talking about the particulars of nss_ldap, your message is more appropriately directed to the openldap-technical list." So, take two. :) Starting openldap takes about five minutes to come up due to all the timeouts indicated in /var/log/messages. I've been googling without success, and openldap-software is not the appropriate venue for discussion of my problem. Hopefully this is, since I'm running out of options on where to look. Thank you for any assistance, or pointers toward the right direction. Gar -------- Original Message -------- Subject: could not hard reconnect to LDAP server - Server is unavailable Date: Fri, 30 May 2008 15:17:32 -0600 From: Gar Nelson <gar.nelson(a)noaa.gov> Organization: National Weather Service To: openldap-software(a)openldap.org I'm currently using openldap-2.2.13-8.el4_6.4 on RHEL 4 and for the most part, it appears to be working. I can use ldap to log in on another machine, and on a different workstation, the Apache directory browser connects and browses (and edits) just fine. However, when watching /var/log/messages, all is not calm under the surface. A shortened snippet of the log is as follows; May 30 14:55:46 ggw-s-bdc runuser: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server May 30 14:55:46 ggw-s-bdc runuser: nss_ldap: reconnecting to LDAP server... May 30 14:55:46 ggw-s-bdc runuser: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server May 30 14:55:46 ggw-s-bdc runuser: nss_ldap: reconnecting to LDAP server... [...] May 30 14:57:46 ggw-s-bdc runuser: nss_ldap: could not hard reconnect to LDAP server - Server is unavailable May 30 14:57:46 ggw-s-bdc slaptest: sql_select option missing May 30 14:57:46 ggw-s-bdc slaptest: auxpropfunc error no mechanism available May 30 14:57:46 ggw-s-bdc runuser: config file testing succeeded May 30 14:57:46 ggw-s-bdc ldap: Checking configuration files for slapd: succeeded May 30 14:57:46 ggw-s-bdc slapd[16932]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server May 30 14:57:46 ggw-s-bdc slapd[16932]: nss_ldap: reconnecting to LDAP server... May 30 14:57:46 ggw-s-bdc slapd[16932]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server May 30 14:57:46 ggw-s-bdc slapd[16932]: nss_ldap: reconnecting to LDAP server... [...] May 30 14:59:46 ggw-s-bdc slapd[16932]: nss_ldap: could not hard reconnect to LDAP server - Server is unavailable May 30 14:59:46 ggw-s-bdc slapd[16932]: sql_select option missing May 30 14:59:46 ggw-s-bdc slapd[16932]: auxpropfunc error no mechanism available May 30 14:59:46 ggw-s-bdc ldap: slapd startup succeeded It takes around five minutes for ldap to come up waiting for all the bind timeouts. I've tried googling without success, I've tried changing from host to uri, and from the local 127 address to the machine's outside IP without success. SELinux is disabled. IPTables is not running. nmap localhost reports port 389 is open, along with an nmap to it's outside ip address. I'm at a loss as to how to get "nss-ldap" to bind. ldap.conf is as follows; # @(#)$Id: ldap.conf,v 1.34 2004/09/16 23:32:02 lukeh Exp $ # # PADL Software # http://www.padl.com # debug 256 logdir /var/log/ldap.log #host 127.0.0.1 base dc=ggw,dc=nws,dc=noaa uri ldap://127.0.0.1/ #uri ldaps://127.0.0.1/ #uri ldapi://%2fvar%2frun%2fldapi_sock/ # Note: %2f encodes the '/' used as directory separator binddn cn=Manager,dc=ggw,dc=nws,dc=noaa bindpw [correct ldap password] port 389 timelimit 50 bind_timelimit 50 bind_policy hard idle_timelimit 3600 pam_password exop nss_base_passwd ou=People,dc=ggw,dc=nws,dc=noaa?one nss_base_passwd ou=Computers,dc=ggw,dc=nws,dc=noaa?one nss_base_shadow ou=People,dc=ggw,dc=nws,dc=noaa?one nss_base_group ou=Groups,dc=ggw,dc=nws,dc=noaa?one #nss_base_hosts ou=Hosts,dc=ggw,dc=nws,dc=noaa?one #nss_base_services ou=Services,dc=ggw,dc=nws,dc=noaa?one #nss_base_networks ou=Networks,dc=ggw,dc=nws,dc=noaa?one #nss_base_protocols ou=Protocols,dc=ggw,dc=nws,dc=noaa?one #nss_base_rpc ou=Rpc,dc=ggw,dc=nws,dc=noaa?one #nss_base_ethers ou=Ethers,dc=ggw,dc=nws,dc=noaa?one #nss_base_netmasks ou=Networks,dc=ggw,dc=nws,dc=noaa?one #nss_base_bootparams ou=Ethers,dc=ggw,dc=nws,dc=noaa?one #nss_base_aliases ou=Aliases,dc=ggw,dc=nws,dc=noaa?one #nss_base_netgroup ou=Netgroup,dc=ggw,dc=nws,dc=noaa?one ssl no tls_cacertdir /etc/openldap/cacerts pam_password md5

2 1

Custom Schema
by openLDAP 02 Jun '08

02 Jun '08

I am quite new to OpenLDAP and cannot seem resolve why slapd does not start when I add a custom schema. Nothing appears in syslog and the following appears when I try to start it: root@control:/etc/ldap# sudo slapd -d acl @(#) $OpenLDAP: slapd 2.4.7 (Apr 29 2008 08:44:27) $ buildd@rothera:/build/buildd/openldap2.3-2.4.7/debian/build/servers/slapd AttributeTypeDescription = "(" whsp numericoid whsp ; AttributeType identifier [ "NAME" qdescrs ] ; name used in AttributeType [ "DESC" qdstring ] ; description [ "OBSOLETE" whsp ] [ "SUP" woid ] ; derived from this other ; AttributeType [ "EQUALITY" woid ] ; Matching Rule name [ "ORDERING" woid ] ; Matching Rule name [ "SUBSTR" woid ] ; Matching Rule name [ "SYNTAX" whsp noidlen whsp ] ; see section 4.3 [ "SINGLE-VALUE" whsp ] ; default multi-valued [ "COLLECTIVE" whsp ] ; default not collective [ "NO-USER-MODIFICATION" whsp ]; default user modifiable [ "USAGE" whsp AttributeUsage ]; default userApplications ; userApplications ; directoryOperation ; distributedOperation ; dSAOperation whsp ")" slapd stopped. Can someone please point me in the right direction to resolving this type of error?

2 1

ldap_bind :Can't contact LDAP server
by Rakesh Yadav 02 Jun '08

02 Jun '08

Hi, I m using openldap-2.3.38 over linux platform. I have written a library using LDAP client API's according to my requirement. I m having RPC clients and a RPC server. This RPC server is multithreaded and uses the library which is written using LDAP client api. The problem is : 1. I have open a single connection with LDAP server and passed the global LDAP * ptr to all my library calls, And i sended a search request from rpc client in a loop, it works and gives the result but as i run second request for reading data from rpc server then i get error from LDAP server "*Broken pipe*". 2. Then i have decided i will use seprate connection with LDAP for each thread and use a local LDAP *ptr for thread. This time multiple requests from rpc client works for 2-3 minutes after that it also gives error. "*ldap_bind :Can't contact LDAP server*" In this case i opened and closed a connection with LDAP server for each thread. Please suggest me some solution for handling multiple threads with LDAP client API. In case of Solaris i got a sample for handling multiple threads with LDAP client api's. But this solution doesn't work over Linux. Please give me some solution. Thanks -- Rakesh Yadav Pune.

1 0

Sync State (Response) Control
by Srinidhi Sharma 02 Jun '08

02 Jun '08

Hi, Is the sync state control support available in 2.4.9 and is it exposed as suported control to JNDI and other client interfaces ? I tried a JNDI program using the novell's ldap.jar implementation, but couldnot get the Sync state control. Is this a known issue or am I missing something ??? I know that, this is not a JNDI forum, but in any of the other JNDI forum's I did not see any postings on Sync state control. Any pointers will be helpful. -- Thanks, Srinidhi

1 0

LDAP in deltasyncrepl method
by Aravind Arjunan 01 Jun '08

01 Jun '08

hi, am configuring openldap 2.3 in RHEL 5 operating system. I need the configuration file for master and slave slapd.conf file for reference. i need to configure *openldap in delta-syncrepl method.* If any one configured openldap in this method plz send me the configuration file reference. or any one plz say me how to configure ldap in master/slave in RHEL 5 OS

5 8

Log system
by Alain Siani 30 May '08

30 May '08

Hello, As soon as i activate LDAP log system in syslog, the system does not respond...and many many logs is written in log. I stop syslog, system is up and running ok CentOS release 5 (Final) any idea ? thks, Alain

2 1

slurpd replication problmes
by Almir Karic 30 May '08

30 May '08

i'm trying to set up the repliacation with openldap 2.3 (using the one debian etch), when i add things to master everything is fine, it replicates it to slave just fine, on the other hand when i add things to slave it simply writes it to it's own tree. here is slapd.conf of the slave (stripped of any comments): include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_bdb sizelimit 500 tool-threads 1 backend bdb checkpoint 512 30 TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /etc/ldap/cacert.pem TLSCertificateFile /etc/ldap/servercrt.pem TLSCertificateKeyFile /etc/ldap/serverkey.pem loglevel stats database bdb suffix "dc=kiberpipa,dc=org" directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=kiberpipa,dc=org" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=kiberpipa,dc=org" write by * read updatedn "cn=admin,dc=kiberpipa,dc=org" updateref "ldaps://chat.kiberpipa.org:636" with this command "ldapadd -d 65535 -WxD 'cn=admin,dc=kiberpipa,dc=org' -f /tmp/b00" (on slave) i'm getting http://static.kiberpipa.org/~redduck666/local_adding.txt with "ldapadd -d 65535 -WxD 'cn=admin,dc=kiberpipa,dc=org' -f /tmp/b00 -H ldaps://chat.kiberpipa.org:636" i get http://static.kiberpipa.org/~redduck666/add_to_master.txt (passing it the same password they write to i have seen the certificate error there, if i change the ldap.conf on slave to point to ldap:// instead of ldaps:// that error goes away, however it still doesn't touch master. i also read i really shouldn't set updatedn to be the same as rootdn, well, tried changing it and granting full priviledges to the newly created account, no difference any pointers appreciated :-) -- For far too long, power has been concentrated in the hands of "root" and his "wheel" oligarchy. We have instituted a dictatorship of the users. All system administration functions will be handled by the People's Committee for Democratically Organizing the System (PC-DOS).

2 1

Multithreaded LDAP client
by Rakesh Yadav 30 May '08

30 May '08

Hi, LDAP version: openldap-2.3.38 I want to write multithreaded ldap client but don't have any idea about multithreaded ldap client. I have seen somewhere a sample code for multithreaded client but it is having some structures which r available only on Solaris. struct ldap_thread_fns : available on Solaris but not present in linux Please give me a solution for writting a multithreaded client on linux .. waiting for reply Thanks -- Rakesh Yadav Pune.

1 0

Password management question
by daniel rahmeh 29 May '08

29 May '08

hi, I have a question about the password management. As i know, it is possible to use hach functions into openLDAP, for exemple: password-hash {CRYPT} password-crypt-salt-format "$1$somesalt$" my question is about the compatibility with applications. today, we have some applications that uses openLDAP to create and authenticate users. Is there a way to say to openLDAP to hash received userPassword before inserting it into his database? exemple: imagine an application (application1) that wants to insert a new record (user account) in a openLDAP directory. Application1 doesn't know how to hash a password, is there a way to say to openLDAP to hash this password before adding the entry. application1 ----------userPassword: testpasswd-----> openLDAP (hash(testpasswd))------------->bdb ({CRYPT}$1$salt$EdFRTTT.BNHH. the goal is to make openLDAP manage the hashing process and avoid to patch the applications thank you

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical