forum.lissyara.su

Добрым словом и кулаком, добьёшься больше чем одним добрым словом.
https://forum.lissyara.su/

проблема с настройкой LDAP

https://forum.lissyara.su/viewtopic.php?f=8&t=7856

Страница 1 из 1

проблема с настройкой LDAP

Добавлено: 2008-03-28 12:04:57
Andrew
Устанавливал по этой схеме
http://www.lissyara.su/?id=1487&comment ... mment_3427

при загрузке зависает долго и чтото пытается делать
Mar 28 14:16:57 server sm-mta[699]: My unqualified host name (server) unknown; sleeping for retry

при команде /usr/local/etc/openldap/> ldapadd -x -D "cn=root,dc=sco,dc=ru" -w password -f main.ldif
выдает ошибку ldap_bind: Invalid credentials (49)

мб подсажете где ошибся

FreeBSD server 6.3-STABLE FreeBSD 6.3-STABLE #0: Wed Mar 26 21:59:44 OMST 2008 nnn@server:/usr/obj/usr/src/sys/NOX i386

установленные пакеты
  • cvsup-without-gui-16.1h_3 General network file distribution system optimized for
    CVS
    db44-4.4.20.4 The Berkeley DB package, revision 4.4
    ezm3-1.2_1 Easier, more portable Modula-3 distribution for building CV
    gamin-0.1.9_1 A file and directory monitoring system
    gettext-0.16.1_3 GNU gettext package
    gio-fam-backend-2.16.1_1 FAM backend for GLib's GIO library
    glib-2.16.1_2 Some useful routines of C programming (current stable versi
    gmake-3.81_2 GNU version of 'make' utility
    libiconv-1.9.2_2 A character set conversion library
    libltdl-1.5.24 System independent dlopen wrapper
    libtool-1.5.24 Generic shared library support script
    mc-4.6.1_6 Midnight Commander, a free Norton Commander Clone
    openldap-client-2.3.41 Open source LDAP client implementation
    openldap-server-2.3.41 Open source LDAP server implementation
    pcre-7.6 Perl Compatible Regular Expressions library
    perl-5.8.8_1 Practical Extraction and Report Language
    pkg-config-0.23_1 A utility to retrieve information about installed libraries
    python25-2.5.2_1 An interpreted object-oriented programming language
конфиг /usr/local/etc/openldap/slapd.conf

Код: Выделить всё

#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include		/usr/local/etc/openldap/schema/core.schema

include		/usr/local/etc/openldap/schema/cosine.schema
include		/usr/local/etc/openldap/schema/inetorgperson.schema
include		/usr/local/etc/openldap/schema/misc.schema
include		/usr/local/etc/openldap/schema/nis.schema
inclede		/usr/local/etc/openldap/schema/openldap.schema

# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral	ldap://root.openldap.org

pidfile		/var/run/openldap/slapd.pid
argsfile	/var/run/openldap/slapd.args

# Load dynamic backend modules:
modulepath	/usr/local/libexec/openldap
#moduleload	back_bdb
#moduleload	back_ldap
moduleload	back_ldbm
# moduleload	back_passwd
# moduleload	back_shell

# Sample security restrictions
#	Require integrity protection (prevent hijacking)
#	Require 112-bit (3DES or better) encryption for updates
#	Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#	Root DSE: allow anyone to read it
#	Subschema (sub)entry DSE: allow anyone to read it
#	Other DSEs:
#		Allow self write access
#		Allow authenticated users read access
#		Allow anonymous users to authenticate
#	Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read

access to attrs=userPassword
	by self write
	by anonymous auth
	by * none

 access to *
	by self write
	by anonymous read
	by * none
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

#######################################################################
# BDB database definitions
#######################################################################

database	ldbm
#suffix		"dc=my-domain,dc=com"
#rootdn		"cn=Manager,dc=my-domain,dc=com"
suffix		"dc=sco,dc=ru"
rootdn		"cn=root,dc=sco,dc=ru"

# Cleartext passwords, especially for the rootdn, should
# be avoid.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw		{SSHA}srOCP7gm1aV1hdN4IS6cHquwCgmQ0QbC
# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory	/var/db/openldap-data
loglevel	256
# Indices to maintain
index	objectClass	eq
index	cn		eq
конфиг /etc/rc.conf

Код: Выделить всё

font8x14="cp866-8x14"
font8x16="cp866b-8x16"
font8x8="cp866-8x8"
hostname="server"
ifconfig_sk0="DHCP"
keymap="ru.koi8-r"
mousechar_start="3"
usbd_enable="YES"
inetd_enable="YES"
local_startup="/usr/local/etc/rc.d"
slapd_enable="YES"
slapd_flags='-h "ldapi://%2fvar%2frun%2fopenldap%2fldapi/ ldap://172.31.0.63/ ldap://127.0.0.1"'
slapd_sockets="/var/run/openldap/ldapi"
ntpdate_enable="YES"
ntpdate_flags="ru.pool.ntp.org"
/var/log/debug.log

Код: Выделить всё

Mar 28 13:58:02 server slapd[581]: @(#) $OpenLDAP: slapd 2.3.41 (Mar 27 2008 15:29:59) $ 	root@server:/usr/ports/net/openldap23-server/work/openldap-2.3.41/servers/slapd
Mar 28 13:58:02 server slapd[582]: WARNING: No dynamic config support for database ldbm.
Mar 28 13:58:02 server slapd[582]: slapd starting
Mar 28 14:05:45 server slapd[582]: conn=0 fd=10 ACCEPT from IP=127.0.0.1:62327 (IP=127.0.0.1:389)
Mar 28 14:05:45 server slapd[582]: conn=0 op=0 BIND dn="cn=root,dc=zsz,dc=ru" method=128
Mar 28 14:05:45 server slapd[582]: conn=0 op=0 RESULT tag=97 err=49 text=
Mar 28 14:05:45 server slapd[582]: conn=0 fd=10 closed (connection lost)
Mar 28 14:49:54 server slapd[582]: conn=1 fd=10 ACCEPT from IP=127.0.0.1:60551 (IP=127.0.0.1:389)
Mar 28 14:49:54 server slapd[582]: conn=1 op=0 BIND dn="cn=root,dc=zsz,dc=ru" method=128
Mar 28 14:49:54 server slapd[582]: conn=1 op=0 RESULT tag=97 err=49 text=
Mar 28 14:49:54 server slapd[582]: conn=1 fd=10 closed (connection lost)

Re: проблема с настройкой LDAP

Добавлено: 2008-03-28 12:28:15
romzes
копать в сторону днс..
по ходу ip hostnam'a неизвестен. убедись что

Код: Выделить всё

nslookup `hostname`
правильно отработает

Re: проблема с настройкой LDAP

Добавлено: 2008-03-28 12:30:37
fr33man
Andrew писал(а):Устанавливал по этой схеме
http://www.lissyara.su/?id=1487&comment ... mment_3427

при загрузке зависает долго и чтото пытается делать
Mar 28 14:16:57 server sm-mta[699]: My unqualified host name (server) unknown; sleeping for retry

при команде /usr/local/etc/openldap/> ldapadd -x -D "cn=root,dc=artpaint,dc=spb,dc=ru" -w password -f main.ldif
выдает ошибку ldap_bind: Invalid credentials (49)

мб подсажете где ошибся

FreeBSD server 6.3-STABLE FreeBSD 6.3-STABLE #0: Wed Mar 26 21:59:44 OMST 2008 nnn@server:/usr/obj/usr/src/sys/NOX i386

установленные пакеты
  • cvsup-without-gui-16.1h_3 General network file distribution system optimized for
    CVS
    db44-4.4.20.4 The Berkeley DB package, revision 4.4
    ezm3-1.2_1 Easier, more portable Modula-3 distribution for building CV
    gamin-0.1.9_1 A file and directory monitoring system
    gettext-0.16.1_3 GNU gettext package
    gio-fam-backend-2.16.1_1 FAM backend for GLib's GIO library
    glib-2.16.1_2 Some useful routines of C programming (current stable versi
    gmake-3.81_2 GNU version of 'make' utility
    libiconv-1.9.2_2 A character set conversion library
    libltdl-1.5.24 System independent dlopen wrapper
    libtool-1.5.24 Generic shared library support script
    mc-4.6.1_6 Midnight Commander, a free Norton Commander Clone
    openldap-client-2.3.41 Open source LDAP client implementation
    openldap-server-2.3.41 Open source LDAP server implementation
    pcre-7.6 Perl Compatible Regular Expressions library
    perl-5.8.8_1 Practical Extraction and Report Language
    pkg-config-0.23_1 A utility to retrieve information about installed libraries
    python25-2.5.2_1 An interpreted object-oriented programming language
конфиг /usr/local/etc/openldap/slapd.conf

Код: Выделить всё

#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include		/usr/local/etc/openldap/schema/core.schema

include		/usr/local/etc/openldap/schema/cosine.schema
include		/usr/local/etc/openldap/schema/inetorgperson.schema
include		/usr/local/etc/openldap/schema/misc.schema
include		/usr/local/etc/openldap/schema/nis.schema
inclede		/usr/local/etc/openldap/schema/openldap.schema

# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral	ldap://root.openldap.org

pidfile		/var/run/openldap/slapd.pid
argsfile	/var/run/openldap/slapd.args

# Load dynamic backend modules:
modulepath	/usr/local/libexec/openldap
#moduleload	back_bdb
#moduleload	back_ldap
moduleload	back_ldbm
# moduleload	back_passwd
# moduleload	back_shell

# Sample security restrictions
#	Require integrity protection (prevent hijacking)
#	Require 112-bit (3DES or better) encryption for updates
#	Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#	Root DSE: allow anyone to read it
#	Subschema (sub)entry DSE: allow anyone to read it
#	Other DSEs:
#		Allow self write access
#		Allow authenticated users read access
#		Allow anonymous users to authenticate
#	Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read

access to attrs=userPassword
	by self write
	by anonymous auth
	by * none

 access to *
	by self write
	by anonymous read
	by * none
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

#######################################################################
# BDB database definitions
#######################################################################

database	ldbm
#suffix		"dc=my-domain,dc=com"
#rootdn		"cn=Manager,dc=my-domain,dc=com"
suffix		"dc=sco,dc=ru"
rootdn		"cn=root,dc=sco,dc=ru"

# Cleartext passwords, especially for the rootdn, should
# be avoid.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw		{SSHA}srOCP7gm1aV1hdN4IS6cHquwCgmQ0QbC
# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory	/var/db/openldap-data
loglevel	256
# Indices to maintain
index	objectClass	eq
index	cn		eq
конфиг /etc/rc.conf

Код: Выделить всё

font8x14="cp866-8x14"
font8x16="cp866b-8x16"
font8x8="cp866-8x8"
hostname="server"
ifconfig_sk0="DHCP"
keymap="ru.koi8-r"
mousechar_start="3"
usbd_enable="YES"
inetd_enable="YES"
local_startup="/usr/local/etc/rc.d"
slapd_enable="YES"
slapd_flags='-h "ldapi://%2fvar%2frun%2fopenldap%2fldapi/ ldap://172.31.0.63/ ldap://127.0.0.1"'
slapd_sockets="/var/run/openldap/ldapi"
ntpdate_enable="YES"
ntpdate_flags="ru.pool.ntp.org"
/var/log/debug.log

Код: Выделить всё

Mar 28 13:58:02 server slapd[581]: @(#) $OpenLDAP: slapd 2.3.41 (Mar 27 2008 15:29:59) $ 	root@server:/usr/ports/net/openldap23-server/work/openldap-2.3.41/servers/slapd
Mar 28 13:58:02 server slapd[582]: WARNING: No dynamic config support for database ldbm.
Mar 28 13:58:02 server slapd[582]: slapd starting
Mar 28 14:05:45 server slapd[582]: conn=0 fd=10 ACCEPT from IP=127.0.0.1:62327 (IP=127.0.0.1:389)
Mar 28 14:05:45 server slapd[582]: conn=0 op=0 BIND dn="cn=root,dc=zsz,dc=ru" method=128
Mar 28 14:05:45 server slapd[582]: conn=0 op=0 RESULT tag=97 err=49 text=
Mar 28 14:05:45 server slapd[582]: conn=0 fd=10 closed (connection lost)
Mar 28 14:49:54 server slapd[582]: conn=1 fd=10 ACCEPT from IP=127.0.0.1:60551 (IP=127.0.0.1:389)
Mar 28 14:49:54 server slapd[582]: conn=1 op=0 BIND dn="cn=root,dc=zsz,dc=ru" method=128
Mar 28 14:49:54 server slapd[582]: conn=1 op=0 RESULT tag=97 err=49 text=
Mar 28 14:49:54 server slapd[582]: conn=1 fd=10 closed (connection lost)

1) nvalid creditianals... Ошибка в том, что неправильно указан root аккаунт: у тебя в строке:

Код: Выделить всё

/usr/local/etc/openldap/> ldapadd -x -D "[b]cn=root,dc=artpaint,dc=spb,dc=ru[/b]" -w password -f main.ldif
А в конфиге:

Код: Выделить всё

rootdn		"[b]cn=root,dc=sco,dc=ru[/b]"
Улавливаешь разницу?

2) ldbm уже никто не юзает... Глючная она... переходи на bdb или dbd -- всегда их путаю. )))

3) смотри dns.

Re: проблема с настройкой LDAP

Добавлено: 2008-03-28 12:46:01
Andrew
/usr/local/etc/openldap/> ldapadd -x -D "cn=root,dc=sco,dc=ru" -w password -f main.ldif
сорри указываю правильно просто копернул но не подправил

а чтоб испоьзовать bdb нужно просто поменять в конфиге на bdb и он автоматом будет использовать bdb ?

Re: проблема с настройкой LDAP

Добавлено: 2008-03-28 12:57:18
Andrew
romzes писал(а):копать в сторону днс..
по ходу ip hostnam'a неизвестен. убедись что

Код: Выделить всё

nslookup `hostname`
правильно отработает
а что должно выдавать ? у меня просто выдало dns провайдера
домен во вне не смотрит
server# nslookup
> server
Default server: 84.21.74.254
Address: 84.21.74.254#53
Default server: 84.21.75.254
Address: 84.21.75.254#53
> 172.31.0.63
Server: 84.21.74.254
Address: 84.21.74.254#53

sk0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=b<RXCSUM,TXCSUM,VLAN_MTU>
inet 172.31.0.63 netmask 0xffffff00 broadcast 172.31.0.255
ether 00:1b:fc:9c:cc:69
media: Ethernet autoselect (100baseTX <full-duplex,flag0,flag1>)
status: active

Re: проблема с настройкой LDAP

Добавлено: 2008-03-28 14:18:14
romzes
не важно внутренний или внешний днс.
hostname должен иметь ip.
у меня была трабла: все связаное с лдапом тормозило по 15-25 секунд при старте, из-за отсутсвия соответствия.
сейчас у меня:

Код: Выделить всё

[romzes] /home/romzes> hostname
romzes.office
[romzes] /home/romzes> nslookup romzes.office
Server:         10.31.0.5
Address:        10.31.0.5#53

Name:   romzes.office
Address: 10.31.0.42

[romzes] /home/romzes> nslookup 10.31.0.42
Server:         10.31.0.5
Address:        10.31.0.5#53

42.0.31.10.in-addr.arpa name = romzes.office.
обратка не обязательна (вроде как). но прямое соответсвие needed =)

Re: проблема с настройкой LDAP

Добавлено: 2008-03-28 14:31:11
Andrew
не подскажешь может я чтото в hosts не прописал или в resolv.conf

server# nslookup server
Server: 84.21.74.254
Address: 84.21.74.254#53

** server can't find server: NXDOMAIN

Re: проблема с настройкой LDAP

Добавлено: 2008-03-28 14:45:52
romzes
я все в днс прописывал...
но вроде можно и в /etc/hosts - насчет последнего не подскажу как правильно... читай man hosts

Re: проблема с настройкой LDAP

Добавлено: 2008-04-02 8:15:11
Andrew
romzes писал(а):я все в днс прописывал...
но вроде можно и в /etc/hosts - насчет последнего не подскажу как правильно... читай man hosts
а что именно прописывал ?
а то я так и не разобрался
Часовой пояс: UTC+03:00
Страница 1 из 1
Powered by phpBB® Forum Software © phpBB Limited
https://www.phpbb.com/