The Suretec Blog

It's taken us a while to get round to ordering one of these Yubikeys from Yubico, but they do look great and have lots of documentation via the wiki.

We're going to be testing them via the pam module for SSH access (and of course using pam_ldap).

So, users in LDAP^[?] via pam, and a Yubikey, let's see how it goes!

(will be interesting for logging in a SIP handset via Asterisk or FreeSWITCH that needs one too and all the others technologies Suretec use and support (Catalyst, Perl, PostgresSQL, Squid and more....). We'll see....

It's been a long process, almost 6 weeks, what with the new laws regarding PCI DSS compliance as of the 1st of October 2009, PCI DSS Scans, Business plans, website terms and connditions and many more things we have a merchant account at last!!!

This is mainly for our new Internet Telephony Service Provider called SureVoIP which is currently live with various customers but has no front facing sales and marketing site yet, only the admin and customer portal.

We'll keep you posted with a proper press release in due course.

Thanks,

Gavin.

At this years UKUUG's annual Large Installation Systems Administration (LISA) conference I gave a talk on OpenLDAP Replication Strategies. You can grab theOpenLDAP Replications Strategies PDF or SlideShare version.

Other presentations regarding OpenLDAP that day (including one from Howard, the Projects Chief Architect and Symas CTO), OpenLDAP and MySQL: Bridging the Data Model Divide and Andrew Findlays Writing Access Control Policies for LDAP^[?]

Gavin.

Grab it whilst it's hot!

OpenLDAP 2.4.14 is now available for download as detailed on our
download page:
http://www.openldap.org/software/download/

and should soon be available on all official mirrors:
ftp://ftp.openldap.org/pub/OpenLDAP/MIRRORS

This is a maintenance release and is made available for general use.
Users of OpenLDAP Software are encouraged to upgrade.

Significant contributors for this release, and the previously
unannounced 2.4.13 release, include:

Howard Chu (Symas Corp)
Emmanuel Dreyfus
Hallvard Furuseth (University of Oslo)
Quanah Gibson-Mount (Yahoo! Inc)
Ralf Haferkamp (SUSE Linux)
Gavin Henry (Suretec Systems)
Pierangelo Masarati (Sys-Net)
Rein Tollevik (Basefarm AS)

OpenLDAP 2.4.14 Release (2009/02/14)
Added libldap option to disable SASL host canonicalization
(ITS#5812)
Added libldap TLS_PROTOCOL_MIN (ITS#5655)
Added libldap GnuTLS support for TLS_CIPHER_SUITE (ITS#5887)
Added libldap GnuTLS setting random file (ITS#5462)
Added libldap alias dereferencing in C API (ITS#5916)
Fixed libldap chasing multiple referrals (ITS#5853)
Fixed libldap deref handling (ITS#5768)
Fixed libldap NULL pointer deref (ITS#5934)
Fixed libldap peer cert memory leak (ITS#5849)
Fixed libldap interaction with GnuTLS CN IP-based matches (ITS#5789)
Fixed libldap intermediate response behavior (ITS#5896)
Fixed libldap IPv6 address handling (ITS#5937)
Fixed libldap_r deref building (ITS#5768)
Fixed libldap_r slapd lockup when paused during shutdown (ITS#5841)
Added slapd syncrepl default retry setting (ITS#5825)
Added slapd val.regex expansion (ITS#5804)
Added slapd TLS_PROTOCOL_MIN (ITS#5655)
Added slapd slapi_pw_find (ITS#2615,ITS#4359)
Added slapd compatibility with MSAD ranged values (ITS#5927)
Fixed slapd bconfig to return error codes (ITS#5867)
Fixed slapd bconfig encoding incorrectly (ITS#5897)
Fixed slapd bconfig dangling pointers (ITS#5924)
Fixed slapd behavior with superior objectClasses (ITS#5517)
Fixed slapd connection assert (ITS#5835)
Fixed slapd epoll handling (ITS#5886)
Fixed slapd frontend/backend options handling (ITS#5857)
Fixed slapd glue with MMR (ITS#5925)
Fixed slapd logging on Windows (ITS#5392)
Fixed slapd listener comparison (ITS#5613)
Fixed slapd manageDSAit with glue entries (ITS#5921)
Fixed slapd syncrepl rename handling (ITS#5809)
Fixed slapd syncrepl MMR when adding new server (ITS#5850)
Fixed slapd syncrepl MMR with deleted entries (ITS#5843)
Fixed slapd syncrepl replication with glued DB (ITS#5866)
Fixed slapd syncrepl replication with moddn (ITS#5901)
Fixed slapd syncrepl replication with referrals (ITS#5881)
Fixed slapd syncrepl replication with config tree (ITS#5935)
Fixed slapd wake_sds close on Windows (ITS#5855)
Fixed slapd-bdb/hdb dncachesize handling (ITS#5860)
Fixed slapd-bdb/hdb RFC4528 control support (ITS#5861)
Fixed slapd-bdb/hdb trickle task usage (ITS#5864)
Fixed slapd-hdb idlcache with empty suffix (ITS#5859)
Fixed slapd-ldap^[?] idassert-bind validity checking (ITS#5863)
Fixed slapd-ldap/meta RFC4525 increment support (ITS#5912)
Fixed slapd-ldap/meta search dereferencing (ITS#5916)
Fixed slapd-ldap/meta with intermediate response (ITS#5931)
Fixed slapd-ldif numerous bugs (ITS#5408)
Fixed slapd-ldif rename on same DN (ITS#5319)
Fixed slapd-ldif deadlock (ITS#5329)
Fixed slapd-meta double response sending (ITS#5854)
Fixed slapd-meta alias deref for retry (ITS#5889)
Fixed slapd-relay recursion detection (ITS#5943)
Fixed slapd-sock descriptor leak (ITS#5939)
Fixed slapo-accesslog on glued dbs (ITS#5907)
Fixed slapo-dynlist handling of flags (ITS#5898)
Fixed slapo-memberof multiple instantiation (ITS#5903)
Fixed slapo-pcache filter sorting (ITS#5756)
Fixed slapo-ppolicy to not be global (ITS#5858)
Fixed slapo-rwm double free (ITS#5923)
Fixed slapo-rwm with back-config (ITS#5906)
Fixed slapo-rwm olcRwmRewrite modification (ITS#5940)
Added slapo-rwm newRDN rewriting (ITS#5834)
Added slapadd progress meter (ITS#5922)
Updated contrib/addpartial module (ITS#5764)
Added contrib/cloak module (ITS#5872)
Added contrib/smbk5pwd gcrypt support (ITS#5410)
Added contrib/passwd sha2 support (ITS#5660)
Build Environment
Fixed test006 appending to log file (ITS#5910)
Fixed test036,test039 behavior on error (ITS#5893)
Fixed test048 sed pathname substitution (ITS#5910)
Fixed test049,test050 to work on windows (ITS#5842)
Updated test017,test018,test019 to cover more cases (ITS#5883)
Removed patch for BerkeleyDB 4.7.25 (Official patch available)
Fixed MSVC 9.0 build issues (ITS#5888)
Fixed gss detection on Solaris (ITS#5846)
Fixed uuid_create/uuid_unparse_lower detection (ITS#5905)
Fixed liblutil tavl_delete to macroize constants (ITS#5909)
Documentation
admin24 added limits chapter (ITS#5818)
admin24 access-control clarify global ACLS (ITS#5851,ITS#5852)
admin24 search on nested naming contexts (ITS#5788)
admin24 consistent loglevel documentation (ITS#5904)
slapd-bdb/hdb expansion on dncachesize behavior (ITS#5721)
slapo-constraint(5) example fix (ITS#5895)
slap*(8) man pages should mention slapd-config (ITS#5828)
slapacl(8c) fix wording (ITS#5918)
slapd(8) document sid (ITS#5873)
slapd.access(5) clarify global ACLS (ITS#5851,ITS#5852)
slapadd/cat/index(8) note -n 0 for slapd-config (ITS#5891)
Added SEE ALSO slapd-config(5) to relevant man pages (ITS#5914)

MD5 (openldap-2.4.14.tgz) = fe2089adac9e9bef7172c2fb61cb6ae9
SHA1 (openldap-2.4.14.tgz) = d762022958ae5697334e0f6ad52fc2bf02aaf1d4


Previously released but not announced:

OpenLDAP 2.4.13 Release (2008/11/24)
Added libldap dereference control support (ITS#5768)
Fixed libldap parameter checking (ITS#5817)
Fixed liblutil hex conversion (ITS#5699)
Fixed liblutil returning undefined data (ITS#5748)
Fixed libldap error code return (ITS#5762)
Fixed libldap interaction with GnuTLS CN IP-based matches
(ITS#5789)
Fixed libldap MAXHOSTNAMELEN typo (ITS#5815)
Fixed libldap Ipv6 detection (ITS#5739)
Fixed libldap setuid usage with .ldaprc (ITS#4750)
Fixed slapacl crasher (ITS#5820)
Fixed slapd acl checks on ADD (ITS#4556,ITS#5723)
Fixed slapd acl application to newly created backends (ITS#5572)
Fixed slapd #if/#elif issues in thread includes (ITS#5824)
Added slapd keyword add_content_acl for add checks
(ITS#4556,ITS#5723)
Fixed slapd concurrent access to connections (ITS#5814)
Fixed slapd config backend olcLogFile support (ITS#5765)
Fixed slapd contextCSN^[?] pending list (ITS#5709)
Fixed slapd control criticality (ITS#5785)
Added slapd dn.this search limits (ITS#5734)
Fixed slapd error status on shutdown (ITS#5745)
Fixed slapd filter substring handling (ITS#5803)
Fixed slapd nameUIDPretty bitstring parsing (ITS#5750)
Fixed slapd null termination of password (ITS#5794)
Fixed slapd overlay/database open with real structure (ITS#5724)
Fixed slapd parsing of read entry control (ITS#5741)
Added slapd PMI schema (ITS#5695)
Added slapd private databases in global overlays
(ITS#5735,ITS#5736)
Fixed slapd rdn generation when it isn't specified (ITS#5819)
Fixed slapd slapd.conf validation to LDIF (ITS#5755)
Fixed slapd startup scan for CSN (ITS#5640)
Fixed slapd statslog printing of released entry (ITS#5775)
Added slapd support for certificateListExactMatch (ITS#5700)
Fixed slapd syncrepl event loss (ITS#5710)
Fixed slapd syncrepl MOD of attrs with no EQ rule (ITS#5781)
Fixed slapd syncrepl rename handling (ITS#5809)
Fixed slapd syncrepl schema checking (ITS#5798)
Fixed slapd syncrepl filter leak (ITS#5826)
Fixed slapd undef promote (ITS#5783,ITS#5795)
Added slapd What failed? control (ITS#5784)
Fixed slapd-bdb/hdb invalid db crash (ITS#5698)
Added slapd-bdb/hdb dbpagesize keyword
Added slapd-bdb/hdb checksum keyword
Fixed slapd-bdb/hdb indexing of entryDN (ITS#5790)
Fixed slapd-bdb/hdb lookup of entryDN with equality (ITS#5791)
Fixed slapd-bdb/hdb uninitialized bli_flag
Fixed slapd-ldap snprintf buffer overflow test (ITS#4467)
Fixed slapd-ldap search stop on minor failure (ITS#5816)
Fixed slapd-ldif file rename on windows (ITS#5774)
Fixed slapd-null read controls support (ITS#5757)
Fixed slapd-sql value length with right index (ITS#5779)
Fixed slapo-chain/translucent back-config support (ITS#5736)
Fixed slapo-chain segv with search references (ITS#5742)
Fixed slapo-collect compile with C89 (ITS#5747)
Added slapo-constraint support for LDAP^[?] URI constraints (ITS#5704)
Added slapo-constraint support for constraining rename (ITS#5703)
Added slapo-constraint support for relax control (ITS#5705)
Added slapo-constraint "set" type (ITS#5702)
Fixed slapo-constraint filter parsing error (ITS#5751)
Added slapo-dynlist URI restriction ability (ITS#5761)
Fixed slapo-ppolicy unaligned BerElement (ITS#5770)
Fixed slapo-rwm objectClass preservation (ITS#5760)
Fixed slapo-rwm rewriting undefined filter (ITS#5731)
Fixed slapo-rwm rewritten DN-valued attrs (ITS#5772)
Fixed slapo-rwm reusing freed filter (ITS#5732)
Fixed slapo-rwm entry get (ITS#5773)
Fixed slapo-syncprov runqueue removal (ITS#5776)
Fixed slapo-syncprov unreplicatable ops (ITS#5709)
Fixed slapo-syncprov psearch leak (ITS#5827)
Added slapo-translucent try local bind when remote fails (ITS#5656)
Added slapo-translucent support for PasswordModify exop (ITS#5656)
Fixed tools simple bind without SASL (ITS#5753)
Fixed tools unaligned BerElement (ITS#5770)
Fixed contrib nssov crash on empty groups (ITS#5800)
Fixed contrib nssov crash with nssov-map (ITS#5801)
Fixed contrib nssov filter and search limits (ITS#5802)
Added contrib smbk5pwd honor principal expiration (ITS#5766)
Build Environment
Added ldapurl command
Added slapd GSSAPI refactoring (ITS#5369)
Added slapo-deref overlay (ITS#5768)
Documentation
admin24 added olcLimits to example (ITS#5746)
admin24 consolidated on whitespace (ITS#5759)
slapd.conf,config(5) subordinate/olcSubordinate keyword
(ITS#5788)
slapd.conf(5) fixed disable keyword for limits (ITS#5821)
slapo-dds(5) manageDIT to relax (ITS#5780)
slapo-dds(5) rootdn requirement added (ITS#5811)
slapo-syncprov(5) sessionlog clarification (ITS#5806)

MD5 (openldap-2.4.13.tgz) = 5382bbb4c67172c48c871b6d24b7f8cc
SHA1 (openldap-2.4.13.tgz) = bb6fe22808d36425b3bad6ce367e882530ccbf51

Andrew Findlay kindly posted a reminder today of the upcoming LDAP^[?] events in March:

The UKUUG Spring 2009 Conference (24-26 March 2009 in London) has
a strong LDAP flavour.

OpenLDAP and other LDAP technologies are covered by several papers:

- OpenLDAP Replication Strategies
Gavin Henry (Suretec Systems & OpenLDAP project)

- OpenLDAP and MySQL: Bridging the Data Model Divide
Howard Chu (Symas Corp. & OpenLDAP project)

- Writing Access Control Policies for LDAP
Andrew Findlay (Skills 1st)

- Securing Access to UNIX, Linux and Mac with Active Directory
Barry Scott (Centrify)

There is also a Kerberos tutorial and several papers on systems
monitoring.

The programme is here:
http://www.ukuug.org/events/spring2009/programme/

Andrew

Hi All,

Here's the 22nd tip in the "OpenLDAP Quick Tips" series:

"You are not sure what type of OpenLDAP replication to use, but you know you need to".

This tip won't actually go into the technical setup (and isn't very quick ) of the different replication types, we'll leave that for another set of tips. You can always read up on them yourself in the Replication section of the OpenLDAP 2.4 Administrator's Guide. Or if you're coming to the UKUUG's annual Large Installation Systems Administration (LISA) you'll be able to hear Howard Chu and myself give our talks:

- OpenLDAP Replication Strategies - Gavin Henry (Suretec Systems & OpenLDAP project)
- OpenLDAP and MySQL: Bridging the Data Model Divide - Howard Chu (Symas Corp. & OpenLDAP project).

Andrew Findlay (Skills 1st), another respected authority on LDAP^[?] will also be giving a talk on Writing Access Control Policies for LDAP.


Anyway, on to the strategies.

OpenLDAP 2.4.12 Release (2008/10/12)
Fixed libldap ldap_utf8_strchar arguments (ITS#5720)
Fixed libldap TLS_CRLFILE (ITS#5677)
Fixed liblutil executables on Windows (ITS#5604)
Fixed liblutil microsecond overflows on Windows (ITS#5668)
Fixed librewrite memory handling (ITS#5691)
Fixed slapd aci performance (ITS#5636)
Fixed slapd aci's with sets (ITS#5627)
Fixed slapd attribute leak (ITS#5683)
Fixed slapd config backend with index greater than sibs (ITS#5684)
Fixed slapd custom attribute inheritance (ITS#5642)
Fixed slapd dynacl mask handling (ITS#5637)
Fixed slapd firstComponentMatch normalization (ITS#5634)
Added slapd caseIgnoreListMatch (ITS#5608)
Fixed slapd connection events enabled twice (ITS#5725)
Fixed slapd memory handling (ITS#5691)
Fixed slapd objectClass canonicalization (ITS#5681)
Fixed slapd objectClass termination (ITS#5682)
Fixed slapd overlay control registration (ITS#5649)
Fixed slapd runqueue checking (ITS#5726)
Fixed slapd spurious text output (ITS#5688)
Fixed slapd socket closing on Windows (ITS#5606)
Fixed slapd sortvals comparison (ITS#5578)
Added slapd substitute syntax support (ITS#5663)
Fixed slapd syncrepl contextCSN^[?] detection (ITS#5675)
Fixed slapd syncrepl error logging (ITS#5618)
Fixed slapd syncrepl runqueue interval (ITS#5719)
Fixed slapd-bdb entry return if attr not present (ITS#5650)
Fixed slapd-bdb olcDbMode syntax (ITS#5713)
Fixed slapd-bdb/hdb release search entries earlier (ITS#5728,ITS#5730)
Fixed slapd-bdb/hdb subtree search with empty suffix (ITS#5729)
Fixed slapd-dnssrv memory handling (ITS#5691)
Fixed slapd-ldap^[?],slapd-meta invalid filter behavior (ITS#5614)
Fixed slapd-meta memory handling (ITS#5691)
Fixed slapd-meta objectClass filtering (ITS#5647)
Fixed slapd-meta quarantine behavior (ITS#5592)
Added slapd-ndb experimental backend
Fixed slapd-relay initialization (ITS#5643)
Fixed slapd-sql freeing of connection (ITS#5607)
Fixed slapd-sql fault on NULL fields (ITS#5653)
Fixed slapo-accesslog entryCSN generation on purge (ITS#5694)
Fixed slapo-constraint string termination (ITS#5609)
Fixed slapo-dynlist expansion with mapped attributes (ITS#5717)
Fixed slapo-memberof internal operations DN (ITS#5622)
Fixed slapo-pcache attrset crash (ITS#5665)
Fixed slapo-pcache caching with invalid schema (ITS#5680)
Fixed slapo-ppolicy control return on password modify exop (ITS#5711)
Fixed slapo-rwm callback cleanup (ITS#5601,ITS#5687)
Fixed slapo-rwm attr mapping and merging (ITS#5624)
Fixed slapo-rwm objectClass filtering (ITS#5647)
Fixed slapo-translucent back-config support (ITS#5689)
Fixed slapo-translucent filter usage on merged entries (ITS#5679)
Fixed slapo-unique filter validation (ITS#5581)
Fixed slapo-unique suffix testing (ITS#5641)
Build Environment
Fixed ODBC library detection (ITS#5602)
Added BDB 4.7 support (ITS#5523)
Added slapo-collect overlay with enhancements(ITS#5659)
Documentation
Added slapd-ldap(5), slapd-meta(5) noundeffilter (ITS#5614)
Fixed slapd-ldap(5), slapd-meta(5), slapo-pcache(5) schema requirements (ITS#5680)
Added slapo-collect(5) man page (ITS#5706)
Added slapo-pcache(5) proxycheckcacheability option (ITS#5680)
Added slapo-retcode(5) retcode.conf location (ITS#5633)
admin24 dontusecopy control update (ITS#5718)
admin24 guide updates (ITS#5616)
admin24 octetString fix (ITS#5670)

I got back last night, after a somewhat hectic Flybe.com flight (long story).

I really enjoyed the conference, my first time speaking at one, bit nervous, but it can only get better

Tuesday: