On Aug 19, 2010, at 12:10 PM, Bastian Blank wrote:
> Package: slapd
> Version: 2.4.23-3
> Severity: grave
>
> I installed 2.4.23-2 and updated to -3 without a config change. Now I
> cannot access cn=config.
>
> | # ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=config"
> | SASL/EXTERNAL authentication started
> | SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
> | SASL SSF: 0
> | # extended LDIF
> | #
> | # LDAPv3
> | # base <cn=config> with scope subtree
> | # filter: (objectclass=*)
> | # requesting: ALL
> | #
> |
> | # search result
> | search: 2
> | result: 32 No such object
> |
> | # numResponses: 1
>
> ACL debugging log:
> [startup]
> | slapd starting
> | => access_allowed: search access to "cn=config" "entry" requested
> | => acl_get: [1] attr entry
> | => acl_mask: access to entry "cn=config", attr "entry" requested
> | => acl_mask: to all values by "cn=localroot,cn=config", (=0)
> | <= check a_dn_pat: *
> | <= acl_mask: [1] applying none(=0) (stop)
> | <= acl_mask: [1] mask: none(=0)
> | => slap_access_allowed: search access denied by none(=0)
> | => access_allowed: no more rules
> | connection_read(12): no connection!
> | connection_read(12): no connection!
> | daemon: shutdown requested and initiated.
> | slapd shutdown: waiting for 0 operations/tasks to finish
> | slapd stopped.
>
> The access is done as cn=localroot,cn=config
> | # grep olcAuthz cn=config.ldif
> | olcAuthzPolicy: none
> | olcAuthzRegexp:
> gidNumber=[[:digit:]]+\+uidNumber=0,cn=peercred,cn=external,cn=auth
> cn=localroot,cn=config
>
> But the first access rule already rejects all access
> | # grep olcAcc cn=config/olcDatabase=\{0\}config.ldif
> | olcAccess: {0}to * by * none
> | olcAccess: {1}to * by dn.exact=cn=localroot,cn=config manage by * break
>
> Not sure why this stunt it done instead of using
> | gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
> directly. If seen the later in Ubuntu.
>
> Bastian
>
> -- System Information:
> Debian Release: squeeze/sid
> APT prefers unstable
> APT policy: (500, 'unstable'), (500, 'testing'), (1, 'experimental')
> Architecture: amd64 (x86_64)
>
> Kernel: Linux 2.6.35-trunk-amd64 (SMP w/4 CPU cores)
> Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
> Shell: /bin/sh linked to /bin/dash
>
> Versions of packages slapd depends on:
> ii adduser 3.112 add and remove users and groups
> ii coreutils 8.5-1 GNU core utilities
> ii debconf [debconf-2.0] 1.5.35 Debian configuration management
> sy
> ii libc6 2.11.2-2 Embedded GNU C Library: Shared
> lib
> ii libdb4.8 4.8.30-1 Berkeley v4.8 Database Libraries
> [
> ii libgnutls26 2.8.6-1 the GNU TLS library - runtime
> libr
> ii libldap-2.4-2 2.4.23-3 OpenLDAP libraries
> ii libltdl7 2.2.6b-2 A system independent dlopen
> wrappe
> ii libperl5.10 5.10.1-14 shared Perl library
> ii libsasl2-2 2.1.23.dfsg1-5.1 Cyrus SASL - authentication
> abstra
> ii libslp1 1.2.1-7.8 OpenSLP libraries
> ii libwrap0 7.6.q-19 Wietse Venema's TCP wrappers
> libra
> ii lsb-base 3.2-23.1 Linux Standard Base 3.2 init
> scrip
> ii perl [libmime-base64-pe 5.10.1-14 Larry Wall's Practical
> Extraction
> ii psmisc 22.12-1 utilities that use the proc file
> s
> ii unixodbc 2.2.14p2-1 ODBC tools libraries
>
> Versions of packages slapd recommends:
> ii libsasl2-modules 2.1.23.dfsg1-5.1 Cyrus SASL - pluggable
> authenticat
>
> Versions of packages slapd suggests:
> ii ldap-utils 2.4.23-3 OpenLDAP utilities
>
> -- Configuration Files:
> /etc/default/slapd changed:
> SLAPD_CONF="/etc/ldap/slapd.d"
> SLAPD_USER="openldap"
> SLAPD_GROUP="openldap"
> SLAPD_PIDFILE=
> SLAPD_SERVICES="ldapi:///"
> SLAPD_SENTINEL_FILE=/etc/ldap/noslapd
> SLAPD_OPTIONS=""
>
>
> -- debconf information excluded
Do you have any debconf information ?
Regards,
Matthijs Möhlmann
--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
