5505l1.txt0100775000204600003300000000372007563031215011443 0ustar jillljedit 1 # $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.8.8.6 2001/04/20 23:32:43 kurt Exp $ 2 # 3 # See slapd.conf(5) for details on configuration options. 4 # This file should NOT be world readable. 5 # 6 include /usr/local/etc/openldap/schema/core.schema 7 include /usr/local/etc/openldap/schema/cosine.schema 8 include /usr/local/etc/openldap/schema/inetorgperson.schema 9 include /usr/local/etc/openldap/schema/misc.schema 10 # Define global ACLs to disable default read access. 11 # Do not enable referrals until AFTER you have a working directory 12 # service AND an understanding of referrals. 13 #referral ldap://root.openldap.org 14 pidfile /usr/local/var/slapd.pid 15 argsfile /usr/local/var/slapd.args 16 replogfile /usr/local/var/slapd.replog 17 # Load dynamic backend modules: 18 ####################################################################### 19 # ldbm database definitions 20 ####################################################################### 21 database ldbm 22 suffix "dc=lcc,dc=ibm,dc=com" 23 rootdn "cn=Manager,dc=lcc,dc=ibm,dc=com" 24 # Cleartext passwords, especially for the rootdn, should 25 # be avoid. See slappasswd(8) and slapd.conf(5) for details. 26 # Use of strong authentication encouraged. 27 rootpw secret 28 # The database directory MUST exist prior to running slapd AND 29 # should only be accessible by the slapd/tools. Mode 700 recommended. 30 directory /usr/local/var/openldap-ldbm 31 # Indices to maintain 32 index objectClass eq 33 index sn pres,eq 34 replica host=slave5:389 35 binddn="cn=Manager,dc=lcc,dc=ibm,dc=com" 36 bindmethod=simple credentials=secret5505l2.txt0100775000204600003300000000350207563031215011442 0ustar jillljedit 1 # $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.8.8.6 2001/04/20 23:32:43 kurt Exp $ 2 # 3 # See slapd.conf(5) for details on configuration options. 4 # This file should NOT be world readable. 5 # 6 include /usr/local/etc/openldap/schema/core.schema 7 include /usr/local/etc/openldap/schema/cosine.schema 8 include /usr/local/etc/openldap/schema/inetorgperson.schema 9 include /usr/local/etc/openldap/schema/misc.schema 10 # Define global ACLs to disable default read access. 11 # Do not enable referrals until AFTER you have a working directory 12 # service AND an understanding of referrals. 13 #referral ldap://root.openldap.org 14 pidfile /usr/local/var/slapd.pid 15 argsfile /usr/local/var/slapd.args 16 # Load dynamic backend modules: 17 ####################################################################### 18 # ldbm database definitions 19 ####################################################################### 20 database ldbm 21 suffix "dc=lcc,dc=ibm,dc=com" 22 rootdn "cn=Manager,dc=lcc,dc=ibm,dc=com" 23 # Cleartext passwords, especially for the rootdn, should 24 # be avoid. See slappasswd(8) and slapd.conf(5) for details. 25 # Use of strong authentication encouraged. 26 rootpw secret 27 # The database directory MUST exist prior to running slapd AND 28 # should only be accessible by the slapd/tools. Mode 700 recommended. 29 directory /usr/local/var/openldap-ldbm 30 # Indices to maintain 31 index objectClass eq 32 index sn pres,eq 33 updatedn "cn=Manager,dc=lcc,dc=ibm,dc=com"5505l3.txt0100775000204600003300000000360607563031215011450 0ustar jillljeditHeartbeat client query program 1 /* taken from api_test.c in the heartbeat package, with thanx */ 2 #include 3 #include 4 #include 5 #include 6 #include 7 #include 8 #include 9 #include 10 #include 11 #include 12 #include 13 #include 14 #include 15 #include 16 #include 17 int 18 main(int argc, char ** argv) 19 { 20 unsigned fmask; 21 ll_cluster_t* hb; 22 (void)_heartbeat_h_Id; 23 (void)_ha_msg_h_Id; 24 hb = ll_cluster_new("heartbeat"); 25 if (hb->llc_ops->signon(hb, NULL)!= HA_OK) { 26 fprintf(stderr, "Cannot sign on with heartbeat\n"); 27 fprintf(stderr, "REASON: %s\n", hb->llc_ops->errmsg(hb)); 28 exit(1); 29 } 30 /* here is where we ask for status */ 31 fprintf(stdout, "%s\n" ,hb->llc_ops->node_status(hb, "slave5")); 32 33 if (hb->llc_ops->signoff(hb) != HA_OK) { 34 fprintf(stderr, "Cannot sign off from heartbeat.\n"); 35 fprintf(stderr, "REASON: %s\n", hb->llc_ops->errmsg(hb)); 36 exit(10); 37 } 38 if (hb->llc_ops->delete(hb) != HA_OK) { 39 fprintf(stderr, "REASON: %s\n", hb->llc_ops->errmsg(hb)); 40 fprintf(stderr, "Cannot delete API object.\n"); 41 fprintf(stderr, "REASON: %s\n", hb->llc_ops->errmsg(hb)); 42 exit(11); 43 } 44 return 0; 45 }5505l4.txt0100775000204600003300000000730507563031215011451 0ustar jillljeditSlapd startup script 1 #!/bin/sh 2 # 3 # Startup script LDAP stuff. 4 # 5 # 6 # description: startup/shutdown script for slapd 7 # processname: slapd 8 # 9 # Licence: GPL 10 #our primary node 11 MASNODE='slave6' 12 # process information for kill 13 PIDFILE=/usr/local/var/slapd.pid 14 APP=/usr/local/libexec/slapd 15 SLURP=/usr/local/libexec/slurpd 16 # we use two configuration files, depending on role 17 MASTER=/usr/local/etc/openldap/slapd.master.conf 18 SLAVE=/usr/local/etc/openldap/slapd.slave.conf 19 # Source function library. 20 . /etc/ha.d/shellfuncs 21 test_start () { 22 # first we kill everything possible 23 ha_log "info: $0: Starting" 24 if [ -f $PIDFILE ]; then 25 PID=`head -1 $PIDFILE` 26 ha_log "info: $0: Appears to already be running, killing [$PID]" 27 kill -9 $PID > /dev/null 28 rm $PIDFILE 29 fi 30 # slurpd should die when the slapd process does, but just in case: 31 for i in `ps -ef | grep slurp | grep -v grep | awk '{print $2}' ` 32 do 33 kill -9 $i 34 done 35 36 # slight delay to allow for stability 37 sleep 2 38 # now we will attempt to start as a master 39 $APP -f $MASTER 40 41 if [ ! -f $PIDFILE ]; then 42 ha_log "warn: $0: Slapd did not start properly" 43 exit 1 44 fi 45 # Now we determine if this is the primary or secondary node 46 # first wait a bit for stability 47 sleep 10 48 # if we are secondary, do nothing: otherwise 49 if [ $HA_CURHOST == $MASNODE ]; then 50 OTHER=`/etc/ha.d/resource.d/other_state` 51 ha_log "info: $0 other node test returns $OTHER" 52 if [[ $OTHER == 'active' || $OTHER == 'up' ]]; then 53 /usr/bin/rsh slave5 '/etc/ha.d/resource.d/slapd.slave' 54 $SLURP -f $MASTER 55 else 56 ha_log "warn: $0: slave node is not responding" 57 fi 58 fi 59 60 } 61 test_stop () { 62 ha_log "info: $0: Shutting down" 63 if [ -f $PIDFILE ]; then 64 PID=`head -1 $PIDFILE` 65 kill -9 $PID > /dev/null 66 rm $PIDFILE 67 fi 68 # Let's be sure it's dead, Jim 69 for i in `ps -ef | grep slap | grep -v grep | awk '{print $2}' ` 70 do 71 kill -9 $i 72 done 73 for i in `ps -ef | grep slurp | grep -v grep | awk '{print $2}' ` 74 do 75 kill -9 $i 76 done 77 78 79 } 80 # See how we were called. 81 case "$1" in 82 start) 83 test_start 84 ;; 85 stop) 86 test_stop 87 ;; 88 restart) 89 $0 stop 90 $0 start 91 ;; 92 status) 93 if [ -f $PIDFILE ]; then 94 echo running 95 else 96 echo stopped 97 fi 98 ;; 99 *) 100 echo "Usage: $0 {start|stop|restart|status}" 101 exit 1 102 esac 103 exit 05505s1.txt0100775000204600003300000000750507563031215011457 0ustar jillljeditWeb Authentication Example Our Web Server is Apache. (www.apache.org) Apache allows us proctect specific directories in our web space with password authentification. The standard Apache installation stores those passwords in a flat file ( much like /etc/password ) created with the Apache htpasswd tool. When requesting a password-protected item, the server will send the browser an authentication request. The browser will request a username/password from you. This information is stored by the browser. Upon subsequent requests, the server will again ask for a password and the browser will automatically respond with the cached information. The standard flat-file storage method can be replaced by an LDAP Apache module. We used the mod_auth_ldap bits, also part of the RedHat 7.1 distro (auth_ldap-1.4.7). Important Note: there are at least six different LDAP modules registered with apache.org. We choose this one (lead author Dave Carrigan, www.rudedog.org) because it is included in our RedHat distro. Apache uses the term realm to refer to a protected space. Typically, access control is applied to directories, however later versions of Apache allow individual files to be protected. For a good guide in setting up basic password authentification on Apache, see http://www.apacheweek.com/features/userauth or consult the Apache documentation. First, we define the realm, in Apache's http.conf file: Standard Apache realm: AuthName "SecretBits" AuthType Basic AuthUserFile /usr/local/etc/httpd/users require valid-user This realm uses the htpasswd method ( the file location is specified with the AuthUserFile directive) We change one line to use the LDAP server. Options Indexes AuthType Basic AuthName "SecretBits" AuthLDAPURL ldap://bigldap:389/o=bigldap,c=US?uid require valid-user The AuthLDAPURL directive identifies the method ("ldap://") the OpenLDAP host:port ("bigldap:389/") and the base domain name ("o=bigldap,c=US"). The "?uid" bits indicates the LDAP attribute ("uid") which will be used for our search. We defined the 'uid' attribute in our LDAP database. This URL format is specified in RFC 2255. The full syntax is: ldap://host:port/basedn?attribute?scope?filter You will notice we do not specify scope or filter. Scope defaults to 'sub' and filter defaults to '(objectclass=*)' and these defaults work fine for us. Add the mod_auth_ldap module to Apache's module list, and restart the server, and you are ready to go. Here is an example Perl script which creates the password entries. Notice on line 21 where we build be entry. The type of encoding used for the password is specified by the {crypt} keyword. 1 #!/usr/bin/perl -w 2 use Net::LDAP; 3 use Net::LDAP::Entry; 4 my $ldap = new Net::LDAP('hnode2'); 5 my $mesg = $ldap->bind('cn=Manager,o=litldap,c=US',password => 'secret'); 6 die("failed to bind with ", $mesg->code(),"\n") if $mesg->code(); 7 my $DNend = "o=litldap, c=US"; 8 my $Name = 'ugly'; 9 $salt = 666; 10 $test = "password"; 11 for ( $i = 11; $i < 20; $i++ ) 12 { 13 $pass = crypt($test, $salt); 14 my $NewItem = [ 15 objectClass => ["organizationalPerson","inetLocalMailRecipient","person","uidObject","organizationalRole","simpleSecurityObject"], 16 uid => $Name.$i, 17 cn => $Name.$i, 18 sn => $Name.$i, 19 mailLocalAddress => $Name.$i.'@bogus.com', 20 mailRoutingAddress => $Name.$i.'@bogus.com', 21 userPassword => '{crypt}'.$pass 22 ]; 23 my $NewDN = "@$NewItem[4]="."@$NewItem[5],".$DNend; 24 my $res = $ldap->add($NewDN, attrs => [ @$NewItem ]); 25 print "result".$res->code()."\n"; 26 sleep(5); 27 } 28