Logged in as guest
Viewing Software Bugs/6661 Full headers
Major security issue: yes no
Notes: back-ndb fixed in HEAD fixed in RE24 Notification:
Date: Wed, 29 Sep 2010 14:00:11 +0000 From: gtzanetis@pylones.gr To: openldap-its@OpenLDAP.org Subject: rootpw is not verified with slapd.conf
Full_Name: George Tzanetis Version: 2.4.23 stable OS: Red Hat Enterprise 5.5 URL: Submission from: (NULL) (62.169.213.126) I have built openldap 2.4.23 with the back-ndb in 4 machines. I created the slapd.conf as follows: pidfile /usr/local/openldap/var/run/slapd.pid argsfile /usr/local/openldap/var/run/slapd.args ####################################################################### # NDB database definitions ####################################################################### #NDB database defintions database ndb suffix "dc=example,dc=gr" rootdn "cn=root,dc=example,dc=gr" rootpw secret dbconnect 192.168.6.11 dbhost 192.168.6.12 dbport 3306 dbname openldap dbuser ldapUser dbpass "1234" dbconnections 3 dbsocket /tmp/mysql.sock attrblob description index uid ####################################################################### # Monitor Database definitions ####################################################################### database monitor loglevel 5 My problem is that I can authenticate to the ldap with any password for the cn=root,dc=example,dc=gr (rootdn) user, as long as I specify a password. To make it clearer, all the following ldapsearches work: ldapsearch -h 192.168.6.10 -b 'dc=example,dc=gr' -w secret1 -D "cn=root,dc=example,dc=gr" ldapsearch -h 192.168.6.10 -b 'dc=example,dc=gr' -w secret -D "cn=root,dc=example,dc=gr" ldapsearch -h 192.168.6.10 -b 'dc=example,dc=gr' -w sec -D "cn=root,dc=example,dc=gr" ldapsearch -h 192.168.6.10 -b 'dc=example,dc=gr' -w " " -D "cn=root,dc=example,dc=gr" If I do not specify a password, (i.e. -w flag is omitted) I get the message: ldap_bind: Server is unwilling to perform (53) additional info: unauthenticated bind (DN with no password) disallowed In addition if I don input the correct rootdn user, I get the message: ldap_bind: Invalid credentials (49). This behavior exists in all instances of openldap with ndb as back-end. I did some more testing, and I built openldap with the bdb and ndb backends. The issue appears only to the suffix that is stored in the ndb back-end and not to the bdb back-end, so there must be something wrong with the bind operation of the slapd-ndb. Finally, I would like to state that with the slapd-ndb, all the ldapsearches / modifications / deletions are performed correctly, even if the rootpw password is wrong.
Date: Wed, 29 Sep 2010 16:37:20 +0200 From: Pierangelo Masarati <masarati@aero.polimi.it> To: gtzanetis@pylones.gr, openldap-its@openldap.org Subject: ITS#6661
Please try back-ndb/bind.cpp 1.5->1.6 from HEAD's CVS. Thanks for the report. p.
From: George Tzanetis <gtzanetis@pylones.gr> To: "openldap-its@openldap.org" <openldap-its@openldap.org> Subject: (ITS#6661) Date: Thu, 30 Sep 2010 07:37:12 +0000
Hi, I built openldap using the new code. The rootpw now works, but if a wrong p= assword in an ldap query, then the ldap query process locks. e.g.: with rootdn: 'cn=3Droot,dc=3Dexample,dc=3Dgr' and rootpw: secret -when rootdn and rootpw are correct: ldapwhoami -h 192.168.6.10 -D 'cn=3Droot,dc=3Dexample,dc=3Dgr' -w 'secret' >dn:cn=3Droot,dc=3Dexample,dc=3Dgr -when rootdn is wrong: Ldapwhoami -h 192.168.6.10 -D 'cn=3Droot,dc=3Dexample,dc=3Dcom' -w 'secret' >ldap_bind: Invalid credentials (49) -when rootdn is correct and rootpw is wrong Ldapwhoami -h 192.168.6.10 -D 'cn=3Droot,dc=3Dexample,dc=3Dcom' -w 'secret1= ' "NO RESULT, the ldapwhoami locks" Here are the logs of the slapd process: ################################### #with correct rootdn & rootpw # ################################### daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=3D7 active_threads=3D0 tvp=3DNULL daemon: epoll: listen=3D8 busy >>> slap_listener(ldap:///) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=3D7 active_threads=3D0 tvp=3DNULL daemon: epoll: listen=3D8 active_threads=3D0 tvp=3DNULL daemon: listen=3D8, new connection on 23 daemon: activity on 1 descriptor daemon: activity on: 23r daemon: read active on 23 daemon: added 23r (active) listener=3D(nil) daemon: epoll: listen=3D7 active_threads=3D0 tvp=3DNULL daemon: epoll: listen=3D8 active_threads=3D0 tvp=3DNULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=3D7 active_threads=3D0 tvp=3DNULL daemon: epoll: listen=3D8 active_threads=3D0 tvp=3DNULL conn=3D1000 fd=3D23 ACCEPT from IP=3D192.168.6.10:47722 (IP=3D0.0.0.0:389) connection_get(23) connection_get(23): got connid=3D1000 connection_read(23): checking for input on id=3D1000 ber_get_next ldap_read: want=3D8, got=3D8 ldap_read: want=3D36, got=3D36 ber_get_next: tag 0x30 len 42 contents: ber_dump: buf=3D0x1d047ee0 ptr=3D0x1d047ee0 end=3D0x1d047f0a len=3D42 op tag 0x60, time 1285831215 ber_get_next ldap_read: want=3D8 error=3DResource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=3D7 active_threads=3D0 tvp=3DNULL daemon: epoll: listen=3D8 active_threads=3D0 tvp=3DNULL conn=3D1000 op=3D0 do_bind ber_scanf fmt ({imt) ber: ber_dump: buf=3D0x1d047ee0 ptr=3D0x1d047ee3 end=3D0x1d047f0a len=3D39 ber_scanf fmt (m}) ber: ber_dump: buf=3D0x1d047ee0 ptr=3D0x1d047f01 end=3D0x1d047f0a len=3D9 >>> dnPrettyNormal: <cn=3Droot,dc=3Dexample,dc=3Dgr> =3D> ldap_bv2dn(cn=3Droot,dc=3Dexample,dc=3Dgr,0) <=3D ldap_bv2dn(cn=3Droot,dc=3Dexample,dc=3Dgr)=3D0 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3Droot,dc=3Dexample,dc=3Dgr)=3D0 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3Droot,dc=3Dexample,dc=3Dgr)=3D0 <<< dnPrettyNormal: <cn=3Droot,dc=3Dexample,dc=3Dgr>, <cn=3Droot,dc=3Dexamp= le,dc=3Dgr> conn=3D1000 op=3D0 BIND dn=3D"cn=3Droot,dc=3Dexample,dc=3Dgr" method=3D128 do_bind: version=3D3 dn=3D"cn=3Droot,dc=3Dexample,dc=3Dgr" method=3D128 =3D=3D> ndb_back_bind: dn: cn=3Droot,dc=3Dexample,dc=3Dgr conn=3D1000 op=3D0 BIND dn=3D"cn=3Droot,dc=3Dexample,dc=3Dgr" mech=3DSIMPLE= ssf=3D0 do_bind: v3 bind: "cn=3Droot,dc=3Dexample,dc=3Dgr" to "cn=3Droot,dc=3Dexamp= le,dc=3Dgr" send_ldap_result: conn=3D1000 op=3D0 p=3D3 send_ldap_result: err=3D0 matched=3D"" text=3D"" send_ldap_response: msgid=3D1 tag=3D97 err=3D0 ber_flush2: 14 bytes to sd 23 ldap_write: want=3D14, written=3D14 conn=3D1000 op=3D0 RESULT tag=3D97 err=3D0 text=3D daemon: activity on 1 descriptor daemon: activity on: 23r daemon: read active on 23 daemon: epoll: listen=3D7 active_threads=3D0 tvp=3DNULL daemon: epoll: listen=3D8 active_threads=3D0 tvp=3DNULL connection_get(23) connection_get(23): got connid=3D1000 connection_read(23): checking for input on id=3D1000 ber_get_next ldap_read: want=3D8, got=3D8 ldap_read: want=3D24, got=3D24 ber_get_next: tag 0x30 len 30 contents: ber_dump: buf=3D0x1d045c10 ptr=3D0x1d045c10 end=3D0x1d045c2e len=3D30 op tag 0x77, time 1285831215 ber_get_next ldap_read: want=3D8 error=3DResource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=3D7 active_threads=3D0 tvp=3DNULL daemon: epoll: listen=3D8 active_threads=3D0 tvp=3DNULL conn=3D1000 op=3D1 do_extended ber_scanf fmt ({m) ber: ber_dump: buf=3D0x1d045c10 ptr=3D0x1d045c13 end=3D0x1d045c2e len=3D27 conn=3D1000 op=3D1 EXT oid=3D1.3.6.1.4.1.4203.1.11.3 do_extended: oid=3D1.3.6.1.4.1.4203.1.11.3 conn=3D1000 op=3D1 WHOAMI send_ldap_extended: err=3D0 oid=3D len=3D26 send_ldap_response: msgid=3D2 tag=3D120 err=3D0 ber_flush2: 42 bytes to sd 23 ldap_write: want=3D42, written=3D42 conn=3D1000 op=3D1 RESULT oid=3D err=3D0 text=3D daemon: activity on 1 descriptor daemon: activity on: 23r daemon: read active on 23 daemon: epoll: listen=3D7 active_threads=3D0 tvp=3DNULL daemon: epoll: listen=3D8 active_threads=3D0 tvp=3DNULL connection_get(2
Date: Thu, 30 Sep 2010 13:04:08 +0200 (CEST) Subject: ITS#6661 (Was: FW: (6661)) From: masarati@aero.polimi.it To: "George Tzanetis" <gtzanetis@pylones.gr> Cc: openldap-its@openldap.org
> Hi Pierangelo, > > I replied to the ticket's list but I forgot to include your address. > > Here is my reply if you care to read it, > > Regards, > . > George > > . > > -----Original Message----- > From: George Tzanetis > Sent: Thursday, September 30, 2010 10:37 AM > To: 'openldap-its@openldap.org' > Subject: (ITS#6661) > > Hi, > > I built openldap using the new code. The rootpw now works, but if a wrong > password in an ldap query, then the ldap query process locks. > > e.g.: > with rootdn: 'cn=root,dc=example,dc=gr' > and rootpw: secret > > -when rootdn and rootpw are correct: > ldapwhoami -h 192.168.6.10 -D 'cn=root,dc=example,dc=gr' -w 'secret' >>dn:cn=root,dc=example,dc=gr > > -when rootdn is wrong: > Ldapwhoami -h 192.168.6.10 -D 'cn=root,dc=example,dc=com' -w 'secret' >>ldap_bind: Invalid credentials (49) > > -when rootdn is correct and rootpw is wrong > Ldapwhoami -h 192.168.6.10 -D 'cn=root,dc=example,dc=com' -w 'secret1' > "NO RESULT, the ldapwhoami locks" > > > Here are the logs of the slapd process: > > > ################################### > #with correct rootdn & rootpw # > ################################### > daemon: activity on 1 descriptor > daemon: activity on: > slap_listener_activate(8): > daemon: epoll: listen=7 active_threads=0 tvp=NULL > daemon: epoll: listen=8 busy >>>> slap_listener(ldap:///) > daemon: activity on 1 descriptor > daemon: activity on: > daemon: epoll: listen=7 active_threads=0 tvp=NULL > daemon: epoll: listen=8 active_threads=0 tvp=NULL > daemon: listen=8, new connection on 23 > daemon: activity on 1 descriptor > daemon: activity on: 23r > daemon: read active on 23 > daemon: added 23r (active) listener=(nil) > daemon: epoll: listen=7 active_threads=0 tvp=NULL > daemon: epoll: listen=8 active_threads=0 tvp=NULL > daemon: activity on 1 descriptor > daemon: activity on: > daemon: epoll: listen=7 active_threads=0 tvp=NULL > daemon: epoll: listen=8 active_threads=0 tvp=NULL > conn=1000 fd=23 ACCEPT from IP=192.168.6.10:47722 (IP=0.0.0.0:389) > connection_get(23) > connection_get(23): got connid=1000 > connection_read(23): checking for input on id=1000 > ber_get_next > ldap_read: want=8, got=8 > ldap_read: want=36, got=36 > ber_get_next: tag 0x30 len 42 contents: > ber_dump: buf=0x1d047ee0 ptr=0x1d047ee0 end=0x1d047f0a len=42 > op tag 0x60, time 1285831215 > ber_get_next > ldap_read: want=8 error=Resource temporarily unavailable > daemon: activity on 1 descriptor > daemon: activity on: > daemon: epoll: listen=7 active_threads=0 tvp=NULL > daemon: epoll: listen=8 active_threads=0 tvp=NULL > conn=1000 op=0 do_bind > ber_scanf fmt ({imt) ber: > ber_dump: buf=0x1d047ee0 ptr=0x1d047ee3 end=0x1d047f0a len=39 > ber_scanf fmt (m}) ber: > ber_dump: buf=0x1d047ee0 ptr=0x1d047f01 end=0x1d047f0a len=9 >>>> dnPrettyNormal: <cn=root,dc=example,dc=gr> > => ldap_bv2dn(cn=root,dc=example,dc=gr,0) > <= ldap_bv2dn(cn=root,dc=example,dc=gr)=0 > => ldap_dn2bv(272) > <= ldap_dn2bv(cn=root,dc=example,dc=gr)=0 > => ldap_dn2bv(272) > <= ldap_dn2bv(cn=root,dc=example,dc=gr)=0 > <<< dnPrettyNormal: <cn=root,dc=example,dc=gr>, <cn=root,dc=example,dc=gr> > conn=1000 op=0 BIND dn="cn=root,dc=example,dc=gr" method=128 > do_bind: version=3 dn="cn=root,dc=example,dc=gr" method=128 > ==> ndb_back_bind: dn: cn=root,dc=example,dc=gr > conn=1000 op=0 BIND dn="cn=root,dc=example,dc=gr" mech=SIMPLE ssf=0 > do_bind: v3 bind: "cn=root,dc=example,dc=gr" to "cn=root,dc=example,dc=gr" > send_ldap_result: conn=1000 op=0 p=3 > send_ldap_result: err=0 matched="" text="" > send_ldap_response: msgid=1 tag=97 err=0 > ber_flush2: 14 bytes to sd 23 > ldap_write: want=14, written=14 > conn=1000 op=0 RESULT tag=97 err=0 text= > daemon: activity on 1 descriptor > daemon: activity on: 23r > daemon: read active on 23 > daemon: epoll: listen=7 active_threads=0 tvp=NULL > daemon: epoll: listen=8 active_threads=0 tvp=NULL > connection_get(23) > connection_get(23): got connid=1000 > connection_read(23): checking for input on id=1000 > ber_get_next > ldap_read: want=8, got=8 > ldap_read: want=24, got=24 > ber_get_next: tag 0x30 len 30 contents: > ber_dump: buf=0x1d045c10 ptr=0x1d045c10 end=0x1d045c2e len=30 > op tag 0x77, time 1285831215 > ber_get_next > ldap_read: want=8 error=Resource temporarily unavailable > daemon: activity on 1 descriptor > daemon: activity on: > daemon: epoll: listen=7 active_threads=0 tvp=NULL > daemon: epoll: listen=8 active_threads=0 tvp=NULL > conn=1000 op=1 do_extended > ber_scanf fmt ({m) ber: > ber_dump: buf=0x1d045c10 ptr=0x1d045c13 end=
From: George Tzanetis <gtzanetis@pylones.gr> To: "masarati@aero.polimi.it" <masarati@aero.polimi.it> CC: "openldap-its@openldap.org" <openldap-its@openldap.org> Subject: RE: ITS#6661 (Was: FW: (6661)) Date: Thu, 30 Sep 2010 11:49:49 +0000
Yes it is fixed, But in your fix, only the rootpw password works. If we have the rootdn also= as a dn stored inside the ldap tree then openldap does not tries to bind t= o the dn of the tree if the rootpw is incorrect if we use the same code segment of bind.cpp written for back-bdb which is: /* allow noauth binds */ switch ( be_rootdn_bind( op, NULL ) ) { case LDAP_SUCCESS: /* frontend will send result */ return rs->sr_err; default: break; } And the rootpw is not matched, then slapd will continue to search the ldap = tree and if it finds a dn and its userPassword matches, then it authenticat= es. If an appropriate dn / password is not found in the tree, then it throu= ghs the invalid credentials error. Maybe the bind-dbd way is more correct?
Date: Thu, 30 Sep 2010 14:28:54 +0200 (CEST) Subject: RE: ITS#6661 (Was: FW: (6661)) From: masarati@aero.polimi.it To: "George Tzanetis" <gtzanetis@pylones.gr> Cc: "openldap-its@openldap.org" <openldap-its@openldap.org>
Should be fine now. The whole thing originated from the fact that be_rootdn_bind() was passed a NULL SlapReply* without handling results accordingly. Thanks, p. > Yes it is fixed, > > But in your fix, only the rootpw password works. If we have the rootdn > also as a dn stored inside the ldap tree then openldap does not tries to > bind to the dn of the tree if the rootpw is incorrect > > if we use the same code segment of bind.cpp written for back-bdb which is: > > /* allow noauth binds */ > switch ( be_rootdn_bind( op, NULL ) ) { > case LDAP_SUCCESS: > /* frontend will send result */ > return rs->sr_err; > default: > break; > } > And the rootpw is not matched, then slapd will continue to search the ldap > tree and if it finds a dn and its userPassword matches, then it > authenticates. If an appropriate dn / password is not found in the tree, > then it throughs the invalid credentials error. > > Maybe the bind-dbd way is more correct? > >
______________ © Copyright 2013, OpenLDAP Foundation, info@OpenLDAP.org
