6:04 a.m.
Hi Michael and Dieter,
Thanks for your kindly replies.
In my case, I didn't use any SASL or TLS but "simple" method with
operation mode of user/password authenticated. However, I need the rootpw hashed (not
cleartext) and the 2 servers (master & slave) synchronized.
Could you pls advise how i should modify the syncrepl part? or could you pls provide a
sample of the slapd.conf file configuration?
Best regards,
Eileen
------------------ 原始邮件 ------------------
发件人: "Michael Ströder";<michael(a)stroeder.com>;
发送时间: 2014年3月5日(星期三) 下午4:09
收件人: "Dieter Klünter"<dieter(a)dkluenter.de>;
"openldap-technical"<openldap-technical(a)openldap.org>;
主题: Re: mirror mode & sasl question
Dieter Klünter wrote:
Am Wed, 5 Mar 2014 14:38:04 +0800
schrieb "Eileen(=^ω^=)" <123784635(a)qq.com>:
> This is Eileen from China SINAP. I am a beginner for openldap soft. I
> encountered a problem in my study on two LDAP services replication.
> I have 2 LDAP services, one name LDPA1, the other is LDAP2 . I want
> to make them synchronously in mirror mode. But when I set LDAP
> services rootpw both in hash, the 2 LDAP serivces can’t be
> synchronous. My question is
> 1. if I set my rootpw in hash, my bindmethod must be SASL? If I
> must use sasl method, can I put the sasl service in the same ldap
> service? If bindmethod=sasl then what is the saslmech should be?
> 2. If I change to sasl method, do I need change my database
> record?
In order to use sasl, passwords must be cleartext and you should
configure an apropriate authz-regexp, see man slapd.conf(5)
You may use any sasl mechanism that you sasl framework provides.
[...]
To be more precise: In order to use password-based SASL mechs the passwords
have to be stored in clear-text.
Well, if working with SASL and TLS (LDAPS, StartTLS) one should consider using
client certs and SASL/EXTERNAL for replication.
Ciao, Michael.
12:53 p.m.
Hi,
http://pastebin.de/41448
-Dieter
Am Wed, 5 Mar 2014 22:04:05 +0800
schrieb "Eileen(=^ω^=)" <123784635(a)qq.com>:
Hi Michael and Dieter,
Thanks for your kindly replies.
In my case, I didn't use any SASL or TLS but "simple" method with
operation mode of user/password authenticated. However, I need the
rootpw hashed (not cleartext) and the 2 servers (master & slave)
synchronized. Could you pls advise how i should modify the syncrepl
part? or could you pls provide a sample of the slapd.conf file
configuration?
Best regards,
Eileen
------------------ 原始邮件 ------------------
发件人: "Michael Ströder";<michael(a)stroeder.com>;
发送时间: 2014年3月5日(星期三) 下午4:09
收件人: "Dieter Klünter"<dieter(a)dkluenter.de>;
"openldap-technical"<openldap-technical(a)openldap.org>;
主题: Re: mirror mode & sasl question
Dieter Klünter wrote:
> Am Wed, 5 Mar 2014 14:38:04 +0800
> schrieb "Eileen(=^ω^=)" <123784635(a)qq.com>:
>> This is Eileen from China SINAP. I am a beginner for openldap
>> soft. I encountered a problem in my study on two LDAP services
>> replication. I have 2 LDAP services, one name LDPA1, the other is
>> LDAP2 . I want to make them synchronously in mirror mode. But when
>> I set LDAP services rootpw both in hash, the 2 LDAP serivces can’t
>> be synchronous. My question is
>> 1. if I set my rootpw in hash, my bindmethod must be SASL? If
>> I must use sasl method, can I put the sasl service in the same ldap
>> service? If bindmethod=sasl then what is the saslmech should be?
>> 2. If I change to sasl method, do I need change my database
>> record?
>
> In order to use sasl, passwords must be cleartext and you should
> configure an apropriate authz-regexp, see man slapd.conf(5)
> You may use any sasl mechanism that you sasl framework provides.
> [...]
To be more precise: In order to use password-based SASL mechs the
passwords have to be stored in clear-text.
Well, if working with SASL and TLS (LDAPS, StartTLS) one should
consider using client certs and SASL/EXTERNAL for replication.
Ciao, Michael.
--
Dieter Klünter | Systemberatung
http://sys4.de
GPG Key ID: E9ED159B
53°37'09,95"N
10°08'02,42"E
11:16 p.m.
New subject: 答复: 回复： mirror mode question
Hi Michael and Dieter,
I see the below mail, can I understand only the mirror mode replication can’t use the
HASH password in rootpw, other Synchronous replication mode(example: syncrepl proxy) can
use the HASH password?
Thanks and regards
tiangexuan
------------------ 原始邮件 ------------------
发件人: "Michael Ströder";<michael(a)stroeder.com
<mailto:michael@stroeder.com> >;
发送时间: 2014年3月5日(星期三) 下午4:09
收件人: "Dieter Klünter"<dieter(a)dkluenter.de <mailto:dieter@dkluenter.de>
>; "openldap-technical"<openldap-technical(a)openldap.org
<mailto:openldap-technical@openldap.org> >;
主题: Re: mirror mode & sasl question
Dieter Klünter wrote:
Am Wed, 5 Mar 2014 14:38:04 +0800
schrieb "Eileen(=^ω^=)" <123784635(a)qq.com <mailto:123784635@qq.com>
>:
> This is Eileen from China SINAP. I am a beginner for openldap soft. I
> encountered a problem in my study on two LDAP services replication.
> I have 2 LDAP services, one name LDPA1, the other is LDAP2 . I want
> to make them synchronously in mirror mode. But when I set LDAP
> services rootpw both in hash, the 2 LDAP serivces can’t be
> synchronous. My question is
> 1. if I set my rootpw in hash, my bindmethod must be SASL? If I
> must use sasl method, can I put the sasl service in the same ldap
> service? If bindmethod=sasl then what is the saslmech should be?
> 2. If I change to sasl method, do I need change my database
> record?
In order to use sasl, passwords must be cleartext and you should
configure an apropriate authz-regexp, see man slapd.conf(5)
You may use any sasl mechanism that you sasl framework provides.
[...]
To be more precise: In order to use password-based SASL mechs the passwords
have to be stored in clear-text.
Well, if working with SASL and TLS (LDAPS, StartTLS) one should consider using
client certs and SASL/EXTERNAL for replication.
Ciao, Michael.
1:25 a.m.
Hi,
If I remeber correctly, you mentioned sasl authentication. My comments
on plaintext passwords are only related to sasl authentication. A sasl
authentication is based on a SASL MECHANISM, as described in rfc-4422.
In order to compare the sasl authentication string with the stored
password value, this has to be cleartext.
If your ldap operation is based on a simple bind, the stored password
can, and should be, hashed.
-Dieter
Am Tue, 8 Apr 2014 14:16:31 +0800
schrieb 田格瑄 <tiangexuan(a)sinap.ac.cn>:
Hi Michael and Dieter,
I see the below mail, can I understand only the mirror mode
replication can’t use the HASH password in rootpw, other Synchronous
replication mode(example: syncrepl proxy) can use the HASH password?
Thanks and regards
tiangexuan
------------------ 原始邮件 ------------------
发件人: "Michael Ströder";<michael(a)stroeder.com
<mailto:michael@stroeder.com> >;
发送时间: 2014年3月5日(星期三) 下午4:09
收件人: "Dieter Klünter"<dieter(a)dkluenter.de
<mailto:dieter@dkluenter.de> >;
"openldap-technical"<openldap-technical(a)openldap.org
<mailto:openldap-technical@openldap.org> >;
主题: Re: mirror mode & sasl question
Dieter Klünter wrote:
> Am Wed, 5 Mar 2014 14:38:04 +0800
> schrieb "Eileen(=^ω^=)" <123784635(a)qq.com
<mailto:123784635@qq.com>
> >:
>> This is Eileen from China SINAP. I am a beginner for openldap
>> soft. I encountered a problem in my study on two LDAP services
>> replication. I have 2 LDAP services, one name LDPA1, the other is
>> LDAP2 . I want to make them synchronously in mirror mode. But when
>> I set LDAP services rootpw both in hash, the 2 LDAP serivces can’t
>> be synchronous. My question is
>> 1. if I set my rootpw in hash, my bindmethod must be SASL? If
>> I must use sasl method, can I put the sasl service in the same ldap
>> service? If bindmethod=sasl then what is the saslmech should be?
>> 2. If I change to sasl method, do I need change my database
>> record?
>
> In order to use sasl, passwords must be cleartext and you should
> configure an apropriate authz-regexp, see man slapd.conf(5)
> You may use any sasl mechanism that you sasl framework provides.
> [...]
To be more precise: In order to use password-based SASL mechs the
passwords have to be stored in clear-text.
Well, if working with SASL and TLS (LDAPS, StartTLS) one should
consider using client certs and SASL/EXTERNAL for replication.
Ciao, Michael.
--
Dieter Klünter | Systemberatung
http://sys4.de
GPG Key ID: E9ED159B
53°37'09,95"N
10°08'02,42"E
5:57 p.m.
New subject: 答复: 回复： mirror mode question
Hi Dieter,
Thanks for your kindly replies.
In my case, I don't use any SASL. I want to use simple bind, but my mirror
mode can't work when my rootpw in hash( if the rootpw is in cleartext , the mirror
mode can work). Could you pls advice what is wrong with my configration?
My slapd.conf file set as below.
moduleload syncprov.la
database bdb
suffix "dc=xxx,dc=xxx"
checkpoint 1024 15
rootdn "cn=manager,dc=xxx,dc=xxx"
rootpw {SSHA}aeiyuikahdkfjhdiuvy
directory /var/lib/ldap/xxx
access to *
by self write
by * read
# Indices to maintain for this database
index objectClass,entryCSN,entryUUID eq,pres
index ou,cn,mail,surname,givenname eq,pres,sub
index uidNumber,gidNumber,loginShell eq,pres
index uid,memberUid eq,pres,sub
index nisMapName,nisMapEntry eq,pres,sub
serverID 1 (ldap2 service is 2)
syncrepl rid=001
provider=ldap://other side ip
bindmethod=simple
binddn="cn=manager,dc=xxx,dc=xxx"
credentials={SSHA} aeiyuikahdkfjhdiuvy
searchbase="dc=xxx,dc=xxx"
schemachecking=on
type=refreshAndPersist
retry="60 +"
mirrormode on
overlay syncprov
syncprov-checkpoint 100 10
syncprov-sessionlog 100
Thanks and regards
tiangexuan
-----邮件原件-----
发件人: openldap-technical-bounces(a)OpenLDAP.org
[mailto:openldap-technical-bounces@OpenLDAP.org] 代表 Dieter Klünter
发送时间: 2014年4月8日 16:25
收件人: openldap-technical(a)openldap.org
主题: Re: 回复： mirror mode question
Hi,
If I remeber correctly, you mentioned sasl authentication. My comments on plaintext
passwords are only related to sasl authentication. A sasl authentication is based on a
SASL MECHANISM, as described in rfc-4422.
In order to compare the sasl authentication string with the stored password value, this
has to be cleartext.
If your ldap operation is based on a simple bind, the stored password can, and should be,
hashed.
-Dieter
Am Tue, 8 Apr 2014 14:16:31 +0800
schrieb 田格瑄 < <mailto:tiangexuan@sinap.ac.cn> tiangexuan(a)sinap.ac.cn>:
> 收件人: "Dieter Klünter"<
<mailto:dieter@dkluenter.de%20%3cmailto:dieter@dkluenter.de> dieter(a)dkluenter.de
<mailto:dieter@dkluenter.de
--
Dieter Klünter | Systemberatung
<http://sys4.de> http://sys4.de
GPG Key ID: E9ED159B
53°37'09,95"N
10°08'02,42"E
Hi Michael and Dieter,
I see the below mail, can I understand only the mirror mode
replication can’t use the HASH password in rootpw, other Synchronous
replication mode(example: syncrepl proxy) can use the HASH password?
Thanks and regards
tiangexuan
------------------ 原始邮件 ------------------
发件人: "Michael Ströder";<michael(a)stroeder.com
< <mailto:michael@stroeder.com>
mailto:michael@stroeder.com> >;
发送时间: 2014年3月5日(星期三) 下午4:09
>;
"openldap-technical"<openldap-technical(a)openldap.org
< <mailto:openldap-technical@openldap.org>
mailto:openldap-technical@openldap.org> >;
主题: Re: mirror mode & sasl question
Dieter Klünter wrote:
> Am Wed, 5 Mar 2014 14:38:04 +0800
> schrieb "Eileen(=^ω^=)" <
<mailto:123784635@qq.com%20%3cmailto:123784635@qq.com> 123784635(a)qq.com
<mailto:123784635@qq.com>
> >:
>> This is Eileen from China SINAP. I am a beginner for
openldap soft.
>> I encountered a problem in my study on two LDAP services
>> replication. I have 2 LDAP services, one name LDPA1, the
other is
>> LDAP2 . I want to make them synchronously in mirror mode.
But when
>> I set LDAP services rootpw both in hash, the 2 LDAP serivces
can’t
>> be synchronous. My question is
>> 1. if I set my rootpw in hash, my bindmethod must be
SASL? If
>> I must use sasl method, can I put the sasl service in the
same ldap
>> service? If bindmethod=sasl then what is the saslmech should
be?
>> 2. If I change to sasl method, do I need change my
database
>> record?
> > In order to use sasl, passwords must be cleartext and you should
> configure an apropriate authz-regexp, see man slapd.conf(5) You
may
> use any sasl mechanism that you sasl framework provides.
> [...]
To be more precise: In order to use password-based SASL mechs the
passwords have to be stored in clear-text.
Well, if working with SASL and TLS (LDAPS, StartTLS) one should
consider using client certs and SASL/EXTERNAL for replication.
Ciao, Michael.
10:48 p.m.
New subject: 答复: 回复： mirror mode question
Hi,
On Wed, 9 Apr 2014, 田格瑄 wrote:
Hi Dieter,
Thanks for your kindly replies.
In my case, I don't use any SASL. I want to use simple bind, but my mirror
mode can't work when my rootpw in hash( if the rootpw is in cleartext , the mirror
mode can work). Could you pls advice what is wrong with my configration?
My slapd.conf file set as below.
moduleload syncprov.la
database bdb
suffix "dc=xxx,dc=xxx"
checkpoint 1024 15
rootdn "cn=manager,dc=xxx,dc=xxx"
rootpw {SSHA}aeiyuikahdkfjhdiuvy
1. That is not a hash.
2. use slappasswd to generate the hash as follows
ck@ldap1:~ % slappasswd
New password: sillypassword
Re-enter new password: sillypassword
{SSHA}miU6lvcqHnP+bAlZz4DruvOm8DeEczQR
ck@ldap1:~ %
3. Use the result from slapasswd as your rootpw
rootpw {SSHA}miU6lvcqHnP+bAlZz4DruvOm8DeEczQR
4. Use a different password as you have now posted it to the list in cleartext
credentials={SSHA} aeiyuikahdkfjhdiuvy
5. no. You need to use the cleartext password for replication credentials
credentials=sillypassword
6. you can only hash your rootpw. You will need to use a cleartext password to
authenticate.
Greetings
Christian
--
Christian Kratzer CK Software GmbH
Email: ck(a)cksoft.de Wildberger Weg 24/2
Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden
Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart
Mobile: +49 171 1947 843 Geschaeftsfuehrer: Christian Kratzer
Web: http://www.cksoft.de/
11:06 p.m.
New subject: 答复: 答复: 回复： mirror mode question
Hi Christian,
Thank you very much~:)
Can I understand I should change my config as below? If yes, I have a question,
other people can see my rootpw, this is not safe, isn’t it ?
moduleload syncprov.la
database bdb
suffix "dc=xxx,dc=xxx"
checkpoint 1024 15
rootdn "cn=manager,dc=xxx,dc=xxx"
rootpw {SSHA}miU6lvcqHnP+bAlZz4DruvOm8DeEczQR
directory /var/lib/ldap/xxx
access to *
by self write
by * read
# Indices to maintain for this database
index objectClass,entryCSN,entryUUID eq,pres
index ou,cn,mail,surname,givenname eq,pres,sub
index uidNumber,gidNumber,loginShell eq,pres
index uid,memberUid eq,pres,sub
index nisMapName,nisMapEntry eq,pres,sub
serverID 1 (ldap2 service is 2)
syncrepl rid=001
provider=ldap://other side ip
bindmethod=simple
binddn="cn=manager,dc=xxx,dc=xxx"
credentials=sillypassword
searchbase="dc=xxx,dc=xxx"
schemachecking=on
type=refreshAndPersist
retry="60 +"
mirrormode on
overlay syncprov
syncprov-checkpoint 100 10
syncprov-sessionlog 100
Thanks and regards
tiangexuan
-----邮件原件-----
发件人: Christian Kratzer [mailto:ck-lists@cksoft.de]
发送时间: 2014年4月9日 13:49
收件人: 田格瑄
抄送: 'Dieter Klünter'; openldap-technical(a)openldap.org
主题: Re: 答复: 回复： mirror mode question
Hi,
On Wed, 9 Apr 2014, 田格瑄 wrote:
Hi Dieter,
Thanks for your kindly replies.
In my case, I don't use any SASL. I want to use simple
bind, but my mirror mode can't work when my rootpw in hash( if the rootpw is in
cleartext , the mirror mode can work). Could you pls advice what is wrong with my
configration?
My slapd.conf file set as below.
moduleload syncprov.la
database bdb
suffix "dc=xxx,dc=xxx"
checkpoint 1024 15
rootdn "cn=manager,dc=xxx,dc=xxx"
rootpw {SSHA}aeiyuikahdkfjhdiuvy
1. That is not a hash.
2. use slappasswd to generate the hash as follows
ck@ldap1:~ % slappasswd
New password: sillypassword
Re-enter new password: sillypassword
{SSHA}miU6lvcqHnP+bAlZz4DruvOm8DeEczQR
ck@ldap1:~ %
3. Use the result from slapasswd as your rootpw
rootpw {SSHA}miU6lvcqHnP+bAlZz4DruvOm8DeEczQR
4. Use a different password as you have now posted it to the list in cleartext
credentials={SSHA} aeiyuikahdkfjhdiuvy
5. no. You need to use the cleartext password for replication credentials
credentials=sillypassword
6. you can only hash your rootpw. You will need to use a cleartext password to
authenticate.
Greetings
Christian
--
Christian Kratzer CK Software GmbH
Email: <mailto:ck@cksoft.de> ck(a)cksoft.de Wildberger Weg 24/2
Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden
Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart
Mobile: +49 171 1947 843 Geschaeftsfuehrer: Christian Kratzer
Web: <http://www.cksoft.de/> http://www.cksoft.de/
12:21 a.m.
New subject: 答复: 答复: 回复： mirror mode question
Hi,
On Wed, 9 Apr 2014, 田格瑄 wrote:
<snipp/>
Hi Christian,
Thank you very much~:)
Can I understand I should change my config as below?
rootpw {SSHA}miU6lvcqHnP+bAlZz4DruvOm8DeEczQR
<snipp/>
syncrepl rid=001
provider=ldap://other side ip
bindmethod=simple
binddn="cn=manager,dc=xxx,dc=xxx"
credentials=sillypassword
yes above is the idea. You can hash the rootpw but your replication partners will of
course need the cleartext password so they can authenticte.
Use slappasswd to generate the hash from your own secret password.
If yes, I have a question, other people can see my rootpw, this is
not safe, isn’t it ?
Other people cannot decode the password from the hash. So you rootpw is safe on the
provider node.
There is now way to secure the credentials on the consumer node as it will have to know
the password in order to authenticate. Take a moment to think about how having a hashed
password on the consumer would allow it to authenticate. And if it would how would that
stop somebody from grabbing the hashed password and using it if that would work.
If you do not like to have cleartext credentials you could of course use SASL
method=external with client certificates as has been suggested before. You could then
have a configuration without any cleartext passwords. But of course you would need to have
the client certifcate and corresponding private key on the consumer node. In that case
this could be stolen.
Using a separate dn or client certificates for the replication user is good practice so
you can limit the respective privileges to read only.
You could even use an acl to further limit client ip address from where the consumers can
connect.
Greetings
Christian
--
Christian Kratzer CK Software GmbH
Email: ck(a)cksoft.de Wildberger Weg 24/2
Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden
Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart
Mobile: +49 171 1947 843 Geschaeftsfuehrer: Christian Kratzer
Web: http://www.cksoft.de/
3458
days inactive
3493
days old
openldap-technical@openldap.org
7 comments
4 participants
participants (4)
-
Christian Kratzer -
Dieter Klünter -
Eileen(=^ω^=) -
田格瑄