openbsd+ldap+qmail: a nightmare
Friedrich Locke <[email protected]> Mon, 14 Jan 2013 14:15:26 -0200
| Newsgroups | gmane.mail.qmail.ldap,gmane.os.openbsd.misc,gmane.network.openldap.technical |
|---|---|
| Message-ID | <CANMDHqfH+QbPW296Q6W45DZtr-Pbx_KOUBH6f1gy=jXJOxnL9g@mail.gmail.com> |
--e89a8ffba8a300b8fa04d341f4a5
Content-Type: text/plain; charset=ISO-8859-1
Hi folks,
i have been walking around and now i need to get qmail+ldap+openbsd working.
I could configure everything, as usual openbsd runs rock solid. But i
believe openldap does not like openbsd somehow. That's what i want to
figure it out.
The point is: i have just setted up obsd+oldap+qmail. I am trying to send a
message for the only user i have in the tree: somehow, i don't know why is
"eating" all my system memory. I am really curious why it happens on OBSD.
I am running amd64 5.2, but i remenber to have given up some time ago when
the obsd version was not 5.2. When i issue ldapsearch not memory increase
is realized.
The problem remains even with the 5.2 version.
Some information is provided below :
sioux@gustav$ uname -a
OpenBSD gustav.cpd.ufv.br 5.2 GENERIC.MP#368 amd64
sioux@gustav$ pkg_info | grep openldap
openldap-client-2.4.31 Open source LDAP software (client)
openldap-server-2.4.31p0 Open source LDAP software (server)
sioux@gustav$
For the /etc/openldap/slapd.conf, here you have it:
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/qmail.schema
# Define global ACLs to disable default read access.
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
# Load dynamic backend modules:
# modulepath /usr/local/libexec/openldap
# moduleload back_bdb.la
# moduleload back_hdb.la
# moduleload back_ldap.la
# Sample security restrictions
# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64
# Sample access control policy:
# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:
# Allow self write access
# Allow authenticated users read access
# Allow anonymous users to authenticate
# Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
# by self write
# by users read
# by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!
#######################################################################
# BDB database definitions
#######################################################################
database bdb
#suffix "dc=my-domain,dc=com"
suffix "dc=ufv,dc=br"
#rootdn "cn=Manager,dc=my-domain,dc=com"
rootdn "cn=oldap,dc=ufv,dc=br"
# Cleartext passwords, especially for the rootdn, should
# be avoid. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
#rootpw secret
rootpw {SSHA}HBjSmSCbiE8J26EuDg3ULnSj2SmN1x5g
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /var/openldap-data
# Indices to maintain
index cn eq
index objectClass eq
index mail,mailalternateaddress,uid eq,sub
index accountstatus,mailhost,deliverymode eq
index default eq
cachesize 4096
checkpoint 128 15
dbnosync
dirtyread
sasl-host gustav.cpd.ufv.br
sasl-realm UFV.BR
sasl-regexp uid=([^,]+),cn=UFV.BR,cn=gssapi,cn=auth
uid=$1,ou=people,dc=ufv,dc=br
limits dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" time=2048 size=16384
limits dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" time=2048 size=16384
limits dn.onelevel="ou=people,dc=ufv,dc=br" time=4 size=16384
################################################################################
# access definition on ou=appsrv,dc=ufv,dc=br
################################################################################
access to dn.one="ou=appsrv,dc=ufv,dc=br" attrs=userPassword
by self read
by anonymous auth
# by * none
access to dn.one="ou=appsrv,dc=ufv,dc=br"
by dn.one="ou=appsrv,dc=ufv,dc=br" read
access to dn.base="ou=appsrv,dc=ufv,dc=br" attrs=entry
by dn.one="ou=appsrv,dc=ufv,dc=br" read
################################################################################
# access definition on ou=group,dc=ufv,dc=br
################################################################################
access to dn.one="ou=group,dc=ufv,dc=br"
by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read
by dn.one="ou=people,dc=ufv,dc=br" read
access to dn.base="ou=group,dc=ufv,dc=br" attrs=entry
by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read
by dn.one="ou=people,dc=ufv,dc=br" read
################################################################################
# access definition on ou=people,dc=ufv,dc=br
################################################################################
access to dn.one="ou=people,dc=ufv,dc=br" attrs=userPassword
by self read
by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read
by anonymous auth
by * none
access to dn.one="ou=people,dc=ufv,dc=br" attrs=uid,homeDirectory
by self read
by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read
by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read
access to dn.one="ou=people,dc=ufv,dc=br"
attrs=cn,uidNumber,gidNumber,loginShell,gecos,description
by self read
by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read
access to dn.one="ou=people,dc=ufv,dc=br"
attrs=mail,mailMessageStore,mailAlternateAddress,qmailUID,qmailGID,mailHost,mailForwardingAddress,deliveryProgramPath,qmailDotMode,deliveryMode,mailReplyText,accountStatus,qmailAccountPurge,mailQuotaSize,mailQuotaCount,mailSizeMax
by self read
by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read
access to dn.one="ou=people,dc=ufv,dc=br"
by self read
by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read
by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read
access to dn.base="ou=people,dc=ufv,dc=br" attrs=entry
by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read
by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read
################################################################################
# access definition for the root (ufv.br)
################################################################################
access to dn.base="dc=ufv,dc=br" attrs=entry
by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read
by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read
#######################################################################
# Monitor database definitions
#######################################################################
database monitor
access to dn.subtree="cn=monitor"
by dn.base="cn=oldap,dc=ufv,dc=br" read
# by * none
--e89a8ffba8a300b8fa04d341f4a5
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Hi folks,<br><br>i have been walking around and now i need to get qmail+lda=
p+openbsd working.<br>I could configure=A0 everything, as usual openbsd run=
s rock solid. But i believe openldap does not like openbsd somehow. That=
9;s what i want to figure it out.<br>
<br>The point is: i have just setted up obsd+oldap+qmail. I am trying to se=
nd a message for the only user i have in the tree: somehow, i don't kno=
w why is "eating" all my system memory. I am really curious why i=
t happens on OBSD. I am running amd64 5.2, but i remenber to have given up =
some time ago when the obsd version was not 5.2. When i issue ldapsearch no=
t memory increase is realized.<br>
<br>The problem remains even with the 5.2 version.<br>Some information is p=
rovided below :<br><br>sioux@gustav$ uname -a<br>OpenBSD <a href=3D"http://=
gustav.cpd.ufv.br">gustav.cpd.ufv.br</a> 5.2 <a href=3D"http://GENERIC.MP#3=
68">GENERIC.MP#368</a> amd64<br>
sioux@gustav$ pkg_info | grep openldap<br>openldap-client-2.4.31 Open sourc=
e LDAP software (client)<br>openldap-server-2.4.31p0 Open source LDAP softw=
are (server)<br>sioux@gustav$ <br><br>For the /etc/openldap/slapd.conf, her=
e you have it:<br>
<br>#<br># See slapd.conf(5) for details on configuration options.<br># Thi=
s file should NOT be world readable.<br>#<br>include=A0=A0=A0=A0=A0=A0=A0=
=A0 /etc/openldap/schema/core.schema<br>include=A0=A0=A0=A0=A0=A0=A0=A0 /et=
c/openldap/schema/cosine.schema<br>
include=A0=A0=A0=A0=A0=A0=A0=A0 /etc/openldap/schema/nis.schema<br>include=
=A0=A0=A0=A0=A0=A0=A0=A0 /etc/openldap/schema/qmail.schema<br><br># Define =
global ACLs to disable default read access.<br><br># Do not enable referral=
s until AFTER you have a working directory<br>
# service AND an understanding of referrals.<br>#referral=A0=A0=A0=A0=A0=A0=
ldap://<a href=3D"http://root.openldap.org">root.openldap.org</a><br><br>p=
idfile=A0=A0=A0=A0=A0=A0=A0=A0 /var/run/openldap/slapd.pid<br>argsfile=A0=
=A0=A0=A0=A0=A0=A0 /var/run/openldap/slapd.args<br>
<br># Load dynamic backend modules:<br># modulepath=A0=A0=A0 /usr/local/lib=
exec/openldap<br># moduleload=A0=A0=A0 <a href=3D"http://back_bdb.la">back_=
bdb.la</a><br># moduleload=A0=A0=A0 <a href=3D"http://back_hdb.la">back_hdb=
.la</a><br># moduleload=A0=A0=A0 <a href=3D"http://back_ldap.la">back_ldap.=
la</a><br>
<br># Sample security restrictions<br>#=A0=A0=A0=A0=A0=A0 Require integrity=
protection (prevent hijacking)<br>#=A0=A0=A0=A0=A0=A0 Require 112-bit (3DE=
S or better) encryption for updates<br>#=A0=A0=A0=A0=A0=A0 Require 63-bit e=
ncryption for simple bind<br># security ssf=3D1 update_ssf=3D112 simple_bin=
d=3D64<br>
<br># Sample access control policy:<br>#=A0=A0=A0=A0=A0=A0 Root DSE: allow =
anyone to read it<br>#=A0=A0=A0=A0=A0=A0 Subschema (sub)entry DSE: allow an=
yone to read it<br>#=A0=A0=A0=A0=A0=A0 Other DSEs:<br>#=A0=A0=A0=A0=A0=A0=
=A0=A0=A0=A0=A0=A0=A0=A0 Allow self write access<br>#=A0=A0=A0=A0=A0=A0=A0=
=A0=A0=A0=A0=A0=A0=A0 Allow authenticated users read access<br>
#=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 Allow anonymous users to authen=
ticate<br>#=A0=A0=A0=A0=A0=A0 Directives needed to implement policy:<br># a=
ccess to dn.base=3D"" by * read<br># access to dn.base=3D"cn=
=3DSubschema" by * read<br># access to *<br>
#=A0=A0=A0=A0=A0=A0 by self write<br>#=A0=A0=A0=A0=A0=A0 by users read<br>#=
=A0=A0=A0=A0=A0=A0 by anonymous auth<br>#<br># if no access controls are pr=
esent, the default policy<br># allows anyone and everyone to read anything =
but restricts<br># updates to rootdn.=A0 (e.g., "access to * by * read=
")<br>
#<br># rootdn can always read and write EVERYTHING!<br><br>################=
#######################################################<br># BDB database d=
efinitions<br>#############################################################=
##########<br>
<br>database=A0=A0=A0=A0=A0=A0=A0 bdb<br>#suffix=A0=A0=A0=A0=A0=A0=A0=A0 &q=
uot;dc=3Dmy-domain,dc=3Dcom"<br>suffix=A0=A0=A0=A0=A0=A0=A0=A0=A0 &quo=
t;dc=3Dufv,dc=3Dbr"<br>#rootdn=A0=A0=A0=A0=A0=A0=A0=A0 "cn=3DMana=
ger,dc=3Dmy-domain,dc=3Dcom"<br>rootdn=A0=A0=A0=A0=A0=A0=A0=A0=A0 &quo=
t;cn=3Doldap,dc=3Dufv,dc=3Dbr"<br>
# Cleartext passwords, especially for the rootdn, should<br># be avoid.=A0 =
See slappasswd(8) and slapd.conf(5) for details.<br># Use of strong authent=
ication encouraged.<br>#rootpw=A0=A0=A0=A0=A0=A0=A0=A0 secret<br>rootpw=A0=
=A0=A0=A0=A0=A0=A0=A0=A0 {SSHA}HBjSmSCbiE8J26EuDg3ULnSj2SmN1x5g<br>
# The database directory MUST exist prior to running slapd AND <br># should=
only be accessible by the slapd and slap tools.<br># Mode 700 recommended.=
<br>directory=A0=A0=A0=A0=A0=A0 /var/openldap-data<br># Indices to maintain=
<br>index=A0=A0 cn=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 eq<br>
index=A0=A0 objectClass=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 eq<br>index=A0=A0 mail,mailalternateaddre=
ss,uid=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 eq,sub<br>index=A0=A0 accountstatus,ma=
ilhost,deliverymode=A0=A0=A0=A0 eq<br>index=A0=A0 default=A0=A0=A0=A0=A0=A0=
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=
=A0 eq<br><br>
cachesize=A0=A0=A0=A0=A0=A0 4096<br>checkpoint=A0=A0=A0=A0=A0 128 15<br>dbn=
osync<br>dirtyread<br><br>sasl-host=A0=A0=A0=A0=A0=A0 <a href=3D"http://gus=
tav.cpd.ufv.br">gustav.cpd.ufv.br</a><br>sasl-realm=A0=A0=A0=A0=A0 <a href=
=3D"http://UFV.BR">UFV.BR</a><br>sasl-regexp=A0=A0=A0=A0 uid=3D([^,]+),cn=
=3D<a href=3D"http://UFV.BR">UFV.BR</a>,cn=3Dgssapi,cn=3Dauth<br>
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 uid=3D$1,ou=3Dpeople,dc=3Dufv=
,dc=3Dbr<br><br>limits dn.base=3D"cn=3Dypldap,ou=3Dappsrv,dc=3Dufv,dc=
=3Dbr" time=3D2048 size=3D16384<br>limits dn.base=3D"cn=3Dmail,ou=
=3Dappsrv,dc=3Dufv,dc=3Dbr" time=3D2048 size=3D16384<br>limits dn.onel=
evel=3D"ou=3Dpeople,dc=3Dufv,dc=3Dbr" time=3D4 size=3D16384<br>
<br>#######################################################################=
#########<br># access definition on ou=3Dappsrv,dc=3Dufv,dc=3Dbr<br>#######=
#########################################################################<b=
r>
<br>access to dn.one=3D"ou=3Dappsrv,dc=3Dufv,dc=3Dbr" attrs=3Duse=
rPassword<br>=A0=A0=A0=A0=A0=A0=A0 by self read<br>=A0=A0=A0=A0=A0=A0=A0 by=
anonymous auth<br>#=A0=A0=A0=A0=A0=A0 by * none<br><br>access to dn.one=3D=
"ou=3Dappsrv,dc=3Dufv,dc=3Dbr"<br>=A0=A0=A0=A0=A0=A0=A0 by dn.one=
=3D"ou=3Dappsrv,dc=3Dufv,dc=3Dbr" read<br>
<br>access to dn.base=3D"ou=3Dappsrv,dc=3Dufv,dc=3Dbr" attrs=3Den=
try<br>=A0=A0=A0=A0=A0=A0=A0 by dn.one=3D"ou=3Dappsrv,dc=3Dufv,dc=3Dbr=
" read<br><br>########################################################=
########################<br>
# access definition on ou=3Dgroup,dc=3Dufv,dc=3Dbr<br>#####################=
###########################################################<br><br>access t=
o dn.one=3D"ou=3Dgroup,dc=3Dufv,dc=3Dbr"<br>=A0=A0=A0=A0=A0=A0=A0=
by dn.base=3D"cn=3Dypldap,ou=3Dappsrv,dc=3Dufv,dc=3Dbr" read<br>
=A0=A0=A0=A0=A0=A0=A0 by dn.one=3D"ou=3Dpeople,dc=3Dufv,dc=3Dbr" =
read<br><br>access to dn.base=3D"ou=3Dgroup,dc=3Dufv,dc=3Dbr" att=
rs=3Dentry<br>=A0=A0=A0=A0=A0=A0=A0 by dn.base=3D"cn=3Dypldap,ou=3Dapp=
srv,dc=3Dufv,dc=3Dbr" read<br>=A0=A0=A0=A0=A0=A0=A0 by dn.one=3D"=
ou=3Dpeople,dc=3Dufv,dc=3Dbr" read<br>
<br>#######################################################################=
#########<br># access definition on ou=3Dpeople,dc=3Dufv,dc=3Dbr<br>#######=
#########################################################################<b=
r>
<br>access to dn.one=3D"ou=3Dpeople,dc=3Dufv,dc=3Dbr" attrs=3Duse=
rPassword<br>=A0=A0=A0=A0=A0=A0=A0 by self read<br>=A0=A0=A0=A0=A0=A0=A0 by=
dn.base=3D"cn=3Dmail,ou=3Dappsrv,dc=3Dufv,dc=3Dbr" read<br>=A0=
=A0=A0=A0=A0=A0=A0 by anonymous auth<br>=A0=A0=A0=A0=A0=A0=A0 by * none<br>
<br>access to dn.one=3D"ou=3Dpeople,dc=3Dufv,dc=3Dbr" attrs=3Duid=
,homeDirectory<br>=A0=A0=A0=A0=A0=A0=A0 by self read<br>=A0=A0=A0=A0=A0=A0=
=A0 by dn.base=3D"cn=3Dmail,ou=3Dappsrv,dc=3Dufv,dc=3Dbr" read<br=
>=A0=A0=A0=A0=A0=A0=A0 by dn.base=3D"cn=3Dypldap,ou=3Dappsrv,dc=3Dufv,=
dc=3Dbr" read<br>
<br>access to dn.one=3D"ou=3Dpeople,dc=3Dufv,dc=3Dbr" attrs=3Dcn,=
uidNumber,gidNumber,loginShell,gecos,description<br>=A0=A0=A0=A0=A0=A0=A0 b=
y self read<br>=A0=A0=A0=A0=A0=A0=A0 by dn.base=3D"cn=3Dypldap,ou=3Dap=
psrv,dc=3Dufv,dc=3Dbr" read<br><br>access to dn.one=3D"ou=3Dpeopl=
e,dc=3Dufv,dc=3Dbr" attrs=3Dmail,mailMessageStore,mailAlternateAddress=
,qmailUID,qmailGID,mailHost,mailForwardingAddress,deliveryProgramPath,qmail=
DotMode,deliveryMode,mailReplyText,accountStatus,qmailAccountPurge,mailQuot=
aSize,mailQuotaCount,mailSizeMax<br>
=A0=A0=A0=A0=A0=A0=A0 by self read<br>=A0=A0=A0=A0=A0=A0=A0 by dn.base=3D&q=
uot;cn=3Dmail,ou=3Dappsrv,dc=3Dufv,dc=3Dbr" read<br><br>access to dn.o=
ne=3D"ou=3Dpeople,dc=3Dufv,dc=3Dbr"<br>=A0=A0=A0=A0=A0=A0=A0 by s=
elf read<br>=A0=A0=A0=A0=A0=A0=A0 by dn.base=3D"cn=3Dypldap,ou=3Dappsr=
v,dc=3Dufv,dc=3Dbr" read<br>
=A0=A0=A0=A0=A0=A0=A0 by dn.base=3D"cn=3Dmail,ou=3Dappsrv,dc=3Dufv,dc=
=3Dbr" read<br><br>access to dn.base=3D"ou=3Dpeople,dc=3Dufv,dc=
=3Dbr" attrs=3Dentry<br>=A0=A0=A0=A0=A0=A0=A0 by dn.base=3D"cn=3D=
ypldap,ou=3Dappsrv,dc=3Dufv,dc=3Dbr" read<br>=A0=A0=A0=A0=A0=A0=A0 by =
dn.base=3D"cn=3Dmail,ou=3Dappsrv,dc=3Dufv,dc=3Dbr" read<br>
=A0=A0=A0=A0=A0=A0=A0 <br>#################################################=
###############################<br># access definition for the root (<a hre=
f=3D"http://ufv.br">ufv.br</a>)<br>########################################=
########################################<br>
<br>access to dn.base=3D"dc=3Dufv,dc=3Dbr" attrs=3Dentry<br>=A0=
=A0=A0=A0=A0=A0=A0 by dn.base=3D"cn=3Dypldap,ou=3Dappsrv,dc=3Dufv,dc=
=3Dbr" read<br>=A0=A0=A0=A0=A0=A0=A0 by dn.base=3D"cn=3Dmail,ou=
=3Dappsrv,dc=3Dufv,dc=3Dbr" read<br>=A0=A0=A0=A0=A0=A0=A0 <br>########=
###############################################################<br>
# Monitor database definitions<br>#########################################=
##############################<br><br>database monitor<br><br>access to dn.=
subtree=3D"cn=3Dmonitor"<br>=A0=A0=A0=A0=A0=A0=A0 by dn.base=3D&q=
uot;cn=3Doldap,dc=3Dufv,dc=3Dbr" read<br>
#=A0=A0=A0=A0=A0=A0 by * none<br><br>
--e89a8ffba8a300b8fa04d341f4a5--