Re: Turning SASL off

[Markus Schabel <markus.schabel@tgm.ac.at>]

Philip Juels wrote:
> Hi all,
>
> I've set up a very simple LDAP server (simple passwords) and when I use 
> ldapmodify, I get...

If you specify the parameter "-x" for ldapmodify it should work...

> SASL/GSSAPI authentication started
> ldap_sasl_interactive_bind_s: Local error (82)
>        additional info: SASL(-1): generic failure: GSSAPI Error:  
> Miscellaneous failure (see text) (open(/tmp/krb5cc_0): No such file or 
> directory)
>
> Now, I don't see anything in my slapd.conf related to SASL or GSSAPI 
> anywhere.  How do I get around this?  I know I shouldn't use cleartext 
> passwords but I just want to get something running, and I'll add 
> security features later.
>
> Here's my slapd.conf...
>
> # $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.23.2.5 2002/11/26 
> 18:26:01 kurt Exp $
> #
> # See slapd.conf(5) for details on configuration options.
> # This file should NOT be world readable.
> #
> include         /etc/openldap/schema/core.schema
> include         /etc/openldap/schema/cosine.schema
> include         /etc/openldap/schema/java.schema
> include         /etc/openldap/schema/inetorgperson.schema
> include         /etc/openldap/schema/nis.schema
>
> # Define global ACLs to disable default read access.
>
> # Do not enable referrals until AFTER you have a working directory
> # service AND an understanding of referrals.
> #referral       ldap://root.openldap.org
>
> pidfile         /var/run/slapd/slapd.pid
> argsfile        /var/run/slapd/slapd.args
>
> loglevel        768
> # Load dynamic backend modules:
> # modulepath    /usr/lib/openldap/openldap
> # moduleload    back_bdb.la
> # moduleload    back_ldap.la
> # moduleload    back_ldbm.la
> # moduleload    back_passwd.la
> # moduleload    back_shell.la
>
> # Sample security restrictions
> #
> #   Disallow clear text exchange of passwords
> # disallow bind_simple_unprotected
> #
> #       Require integrity protection (prevent hijacking)
> #       Require 112-bit (3DES or better) encryption for updates
> #       Require 63-bit encryption for simple bind
> # security ssf=1 update_ssf=112 simple_bind=64
> # Sample access control policy:
> #       Root DSE: allow anyone to read it
> #       Other DSEs:
> #               Allow self write access
> #               Allow authenticated users read access
> #               Allow anonymous users to authenticate
> #       Directives needed to implement policy:
> # access to dn.base="" by * read
> # access to *
> #       by self write
> #       by users read
> #       by anonymous auth
> #
> # if no access controls are present, the default policy is:
> #       Allow read by all
> #
> # rootdn can always write!
>
> # access to attrs=userPassword
> # access to *
> #       by *
>
> #######################################################################
> # ldbm database definitions
> #######################################################################
>
> database        ldbm
> #suffix         "dc=my-domain,dc=com"
> suffix          "dc=hpcgg,dc=org"
> #rootdn         "cn=Manager,dc=my-domain,dc=com"
> rootdn          "cn=root,dc=hpcgg,dc=org"
> # Cleartext passwords, especially for the rootdn, should
> # be avoid.  See slappasswd(8) and slapd.conf(5) for details.
> # Use of strong authentication encouraged.
> rootpw          secret
> # The database directory MUST exist prior to running slapd AND
> # should only be accessible by the slapd/tools. Mode 700 recommended.
> directory       /var/lib/ldap
> mode    0600
> # Indices to maintain
> #index  cn,sn,uid pres,eq,sub
> index   cn              pres,eq
> index   objectClass     eq
>
> Thanks for your help
>
> --Philip Juels
> pjuels@rics.bwh.harvard.edu


--
          \\\ ||| ///                               _\=/_
           (  @ @  )                                (o o)
+--------oOOo-(_)-oOOo--------------------------oOOo-(_)-oOOo------+
| Markus Schabel      TGM - Die Schule der Technik   www.tgm.ac.at |
| IT-Service          A-1200 Wien, Wexstrasse 19-23  net.tgm.ac.at |
| markus.schabel@tgm.ac.at                   Tel.: +43(1)33126/316 |
| markus.schabel@members.fsf.org             Fax.: +43(1)33126/154 |
| FSF Associate Member #597, Linux User #259595 (counter.li.org)   |
|        oOOo        Yet Another Spam Trap:     oOOo               |
|       (    )    oOOo    yast@tgm.ac.at       (   )     oOOo      |
+--------\  (----(   )--------------------------\ ( -----(   )-----+
          \_)     ) /                            \_)      ) /
                 (_/                                     (_/

Computers are like airconditioners:
  They stop working properly if you open windows.