The Suretec Blog

Hi All,

Here's my 8th tip in the "OpenLDAP Quick Tips" series:

"You want to create your own LDAP^[?] Schema for your directory server":

The golden rule:

Under no circumstances should you hijack name space belonging to others!

When you want to extend or create one yourself, get your own OID or PEN using the Private Enterprise Number (PEN) Request Template.

It takes around 2 weeks and you will then always be listed on the PRIVATE ENTERPRISE NUMBERS page if you forget the number and it means your namespace will never clash with others.

Anyone in the LDAP field that is worth their salt should be listed, we are (Suretec Systems Ltd.).

Thanks,

Gavin.

If you have an entry for our "OpenLDAP Quick Tips" series, why not e-mail your tip to us.

P.S. For direct access to this section, you can click OpenLDAP Quick Tips.

Hi All,

Here's my 7th tip in the "OpenLDAP Quick Tips" series:

"You want to check your Access Control Lists configured in your directory server":

Previously we covered slaptest and slappasswd, so next is slapacl

Let's take a standard ACL example for protecting access to the userPassword attribute:



We can verify that this does what is expected by using the slapacl tool:



Here we point to our config file, stating that the entry we want to test against is the ghenry user entry and that the user we want to test that has access permissions is the ghenry user. Because we have self write access, we can obviously read that attribute too.

Now if we try to access someone elses password, we get:



I'm not allowed to see the laura users password.

Of course, the rootdn user by passes all ACLs, so as expected, they can read the userPassword attribute:



This should give you a taster of how to test your ACLs on the command line.

Thanks,

Gavin.

If you have an entry for our "OpenLDAP Quick Tips" series, why not e-mail your tip to us.

P.S. For direct access to this section, you can click OpenLDAP Quick Tips.

Hi All,

Here's my 6th tip in the "OpenLDAP Quick Tips" series:

"You want to encrypt the passwords that are stored in your directory server":

Previously we covered slaptest, so the next one we will cover in the slap* set of command lines tools is slappasswd

To create an encrypted password for a password "testing", we do:



The default is SSHA encryption, which is the recommended. You can also generate a random password with the -g option:



Thanks,

Gavin.

If you have an entry for our "OpenLDAP Quick Tips" series, why not e-mail your tip to us.

P.S. For direct access to this section, you can click OpenLDAP Quick Tips.

Hi All,

Here's my 5th tip in the "OpenLDAP Quick Tips" series:

"You are not sure what LDAP^[?] attributes to chose and what LDAP ObjectClasses they belong to":

The online LDAP Schema Viewer resource is great for quickly browsing what belongs to what.

You can of course use the LDAP Schema browser of any decent LDAP GUI

Thanks,

Gavin.

If you have an entry for our "OpenLDAP Quick Tips" series, why not e-mail your tip to us.

P.S. For direct access to this section, you can click OpenLDAP Quick Tips.

Hi All,

Here's my forth tip in the "OpenLDAP Quick Tips" series:

"You want to test your configuration for your directory server":

The OpenLDAP Software Suite comes with many great command line tools which we will cover in the OpenLDAP Quick Tips series. The first one you should always use is slaptest:



The above means our configuration is all good. If we are using dynamic configuration, we would use -F. For more information, always use the -d flag which we will cover in another tip.

For some errors like below, it's obvious what's wrong:



Thanks,

Gavin.

If you have an entry for our "OpenLDAP Quick Tips" series, why not e-mail your tip to us.

P.S. For direct access to this section, you can click OpenLDAP Quick Tips.

Hi All,

Here's my third tip in the "OpenLDAP Quick Tips" series:

"You want to enable logging via syslog or syslog-ng for your directory server":

For syslog, depending on your distro, you would edit /etc/syslog.conf or /etc/rsyslog.conf:



and then restart syslog/rsyslog:



For syslog-ng, the following will work:



You can also add:



and then restart as per your distro tools.

Thanks,

Gavin.

If you have an entry for our "OpenLDAP Quick Tips" series, why not e-mail your tip to us.

Hi All,

Here's my second tip in the "OpenLDAP Quick Tips" series:

"You want to manage the rootdn users password using the same tools as you use for normal users in your OpenLDAP directory server":

You would normally set your rootpw in slapd.conf like so:



If you leave out the rootpw line and add the rootdn user as a normal user with a userPassword attribute:



This then means you can change the rootdn password with tools like ldappasswd etc.

Note: this example does not cover cn=config where you can change 99% of OpenLDAP settings and config on the fly. The equivalent rootdn entry in cn=config would look like:



you could use ldapmodify or similar to change above.


If you have an entry for our "OpenLDAP Quick Tips" series, why not e-mail your tip to us.

Hi All,

I might as well start easing back into the OpenLDAP Weekly Newsletter by doing some "OpenLDAP Quick Tips". Here's the first one.

"Check that the synchronisation state indicators of any slaves or masters are the same":



If they are the same, then replication has finished, otherwise replication has not finished or has failed.

For more technical detail, please see http://www.openldap.org/doc/admin24/replication.html#LDAP^[?]%20Sync%20Replication