[Date Prev][Date Next] [Chronological] [Thread] [Top]
smbk5pwd - slapd stops responding

To: openldap-technical@openldap.org
Subject: smbk5pwd - slapd stops responding
From: Eduardo Sachs <edu.sachs@gmail.com>
Date: Sun, 15 Mar 2009 09:23:59 -0400
Hi People,

I use the overlay smbk5pwd for sync password of Samba with the of
Heimdal Kerberos.

In Debian Etch using Samba 3.0.24-6etch10, OpenLDAP 2.3.30-5+etch2
and Heimdal Kerberos 0.7.2.dfsg.1-10, I don't have problems.

But, in Debian Lenny using Samba 2:3.2.5-4, OpenLDAP 2.4.11-1,
and Heimdal Kerberos 1.2.dfsg.1-2.1, I have problems.

When I invoke smbpasswd or ldappaswd and trying change
the password, slapd stops responding.

With kpasswd I do not have problems, change the password of
Samba and Kerberos correctly, and userPassword fixed with {K5KEY},
slapd not stops responding (working correctly), but, I need change
the password with smbpasswd for Windows clients.

Below follows a more detailed debug, has something else that I can show?
This is a bug?

slapd.conf configuration:
moduleload smbk5pwd
overlay smbk5pwd
smbk5pwd-enable krb5
smbk5pwd-enable samba
smbk5pwd-must-change 2592000
password-hash {K5KEY}

- OpenLDAP have permission to read/write the file /var/lib/heimdal-kdc/m-key.
- I configure OpenLDAP to run with user root and group root, for tests.

smb.conf configuration about password:
ldap passwd sync = Only
unix password sync = no


Look this example:

1 - LDAP OK:

root# ps aux|grep slapd
root      3841  3.0  0.8  21920  4512 ?        Ssl  14:47   0:00
/usr/sbin/slapd -h ldap://10.111.222.100:389/
ldaps://10.111.222.100:636/ ldapi:/// -g root -u root -f
/etc/ldap/slapd.conf
root      3844  0.0  0.1   3116   728 pts/0    S+   14:47   0:00 grep slapd

root# ldapwhoami -Y GSSAPI
SASL/GSSAPI authentication started
SASL username: sachs@LOCAL.INT.BR
SASL SSF: 56
SASL data security layer installed.
dn:uid=sachs,ou=samba,ou=usuarios,dc=local,dc=int,dc=br

2 - Change password witch LDAPPASSWD:

root# ldappasswd -x -D
"krb5PrincipalName=ldapmaster/admin@LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br"
"uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" -w secret -S
New password:
Re-enter new password:
ldap_result: Can't contact LDAP server (-1)

root# ps aux|grep slapd
root      3832  0.0  0.1   3116   724 pts/0    S+   14:47   0:00 grep slapd

root# ldapwhoami -Y GSSAPI
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)

Loglevel in 256, trying change password with LDAPPASWD, stop in PASSMOD:
conn=0 fd=18 ACCEPT from IP=10.111.222.100:40181 (IP=10.111.222.100:389)
conn=0 op=0 BIND
dn="krb5PrincipalName=ldapmaster/admin@LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br"
method=128
conn=0 op=0 BIND
dn="krb5PrincipalName=ldapmaster/admin@LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br"
mech=SIMPLE ssf=0
conn=0 op=0 RESULT tag=97 err=0 text=
conn=0 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1
conn=0 op=1 PASSMOD
id="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" new

Debug of Overlay Audit, trying change password with LDAPPASWD:
# modify 1236964911 dc=local,dc=int,dc=br
krb5PrincipalName=ldapmaster/admin@LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br
dn: uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br
changetype: modify
replace: userPassword
userPassword:: e0s1S0VZfQ==
-
replace: entryCSN
entryCSN: 20090313172151.459306Z#000000#000#000000
-
replace: modifiersName
modifiersName: krb5PrincipalName=ldapmaster/admin@LOCAL.INT.BR,ou=KerberosPrin
 cipals,ou=Usuarios,dc=local,dc=int,dc=br
-
replace: modifyTimestamp
modifyTimestamp: 20090313172151Z
-
# end replace 1236964911

3 - Change Password with SMBPASSWD:

LDAP running correctly.

root# ldapwhoami -Y GSSAPI
SASL/GSSAPI authentication started
SASL username: sachs@LOCAL.INT.BR
SASL SSF: 56
SASL data security layer installed.
dn:uid=sachs,ou=samba,ou=usuarios,dc=local,dc=int,dc=br

# smbpasswd sachs
New SMB password:
Retype new SMB password:
failed to bind to server ldaps://debian.local.int.br/ with
dn="krb5PrincipalName=ldapmaster/admin@LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br"
Error: Can't contact LDAP server
       (unknown)
Connection to LDAP server failed for the 2 try!
Connection to LDAP server failed for the 3 try!
Connection to LDAP server failed for the 4 try!
Connection to LDAP server failed for the 5 try!
Connection to LDAP server failed for the 6 try!
Connection to LDAP server failed for the 7 try!


Loglevel in 256, trying change password with SMBPASSWD, stop in PASSMOD:

conn=2 fd=27 ACCEPT from IP=10.111.222.100:35715 (IP=10.111.222.100:636)
conn=2 fd=27 TLS established tls_ssf=128 ssf=128
conn=2 op=0 BIND
dn="krb5PrincipalName=ldapmaster/admin@LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br"
method=128
conn=2 op=0 BIND
dn="krb5PrincipalName=ldapmaster/admin@LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br"
mech=SIMPLE ssf=0
conn=2 op=0 RESULT tag=97 err=0 text=
conn=2 op=1 SRCH base="ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br"
scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=sachs))"
conn=2 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn
homeDirectory loginShell gecos description objectClass
conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
conn=1 op=5 SRCH base="ou=Grupos,dc=local,dc=int,dc=br" scope=2
deref=0 filter="(&(objectClass=sambaGroupMapping)(gidNumber=513))"
conn=1 op=5 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList
description displayName cn objectClass
conn=1 op=5 SEARCH RESULT tag=101 err=0 nentries=1 text=
conn=1 op=6 SRCH base="ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br"
scope=2 deref=0
filter="(&(objectClass=sambaSamAccount)(|(sambaSID=s-1-5-21-1831924168-3154312721-1575139623-513)))"
conn=1 op=6 SRCH attr=uid sambaSid
conn=1 op=6 SEARCH RESULT tag=101 err=0 nentries=0 text=
conn=1 op=7 SRCH base="ou=Grupos,dc=local,dc=int,dc=br" scope=2
deref=0 filter="(&(objectClass=sambaGroupMapping)(|(sambaSID=s-1-5-21-1831924168-3154312721-1575139623-513)))"
conn=1 op=7 SRCH attr=cn displayName sambaSid sambaGroupType
conn=1 op=7 SEARCH RESULT tag=101 err=0 nentries=1 text=
conn=1 op=8 MOD dn="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br"
conn=1 op=8 MOD attr=sambaAcctFlags sambaAcctFlags
conn=1 op=9 SRCH base="" scope=0 deref=0 filter="(objectClass=*)"
conn=1 op=9 SRCH attr=supportedExtension
conn=1 op=9 SEARCH RESULT tag=101 err=0 nentries=1 text=
conn=1 op=10 EXT oid=1.3.6.1.4.1.4203.1.11.1
conn=1 op=10 PASSMOD
id="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" new
conn=1 op=8 RESULT tag=103 err=0 text=


Debug of Overlay Audit, trying change password with SMBPASSWD:
# modify 1236968199 dc=local,dc=int,dc=br
krb5PrincipalName=ldapmaster/admin@LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br
dn: uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br
changetype: modify
delete: sambaAcctFlags
sambaAcctFlags: [U]
-
add: sambaAcctFlags
sambaAcctFlags: [U          ]
-
replace: entryCSN
entryCSN: 20090313181639.613866Z#000000#000#000000
-
replace: modifiersName
modifiersName: krb5PrincipalName=ldapmaster/admin@LOCAL.INT.BR,ou=KerberosPrin
 cipals,ou=Usuarios,dc=local,dc=int,dc=br
-
replace: modifyTimestamp
modifyTimestamp: 20090313181639Z
-
# end replace 1236968199

Thanks!!!
Prev by Date: Re: Hostname does not match common name problem
Next by Date: Problem ldif encrypt MD5
Index(es):
- Chronological
- Thread