ldap_modify:更改密碼時訪問權限不足(50)
我正在嘗試在 CentOS 6.7(類似於 RHEL 6.7)上的全新 OpenLDAP 安裝上修改 LDAP 管理員密碼。
我創建了一個名為
change_ldap_password.ldif
:# Hash your password: # slappasswd -h {SSHA} -s "my_password" # I also tried {1}hdb instead of {0}config dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}YP8q2haCD1POSzQC3GAuBdrfaHh+/Y49
當我以 root 身份執行以下命令時,出現訪問錯誤:
# ldapmodify -x -W -D "cn=admin,dc=my_domain,dc=com" -f ./change_ldap_password.ldif Enter LDAP Password: modifying entry "olcDatabase={0}config,cn=config" ldap_modify: Insufficient access (50)
這是 ldapwhoami 的輸出:
# ldapwhoami -x -W -D "cn=admin,dc=my_domain,dc=com" Enter LDAP Password: dn:cn=admin,dc=my_domain,dc=com
這是 cn=config 中 olcRoot 的 grepping 的結果:
# grep -R olcRoot /etc/openldap/slapd.d/cn=config /etc/openldap/slapd.d/cn=config/olcDatabase={1}hdb.ldif:olcRootDN: cn=admin,dc=my_domain,dc=com /etc/openldap/slapd.d/cn=config/olcDatabase={1}hdb.ldif:olcRootPW:: ...
這是 ldapmodify 的調試資訊:
# ldapmodify -x -W -D "cn=admin,dc=my_domain,dc=com" -f ./change_ldap_password.ldif -d1 ldap_create Enter LDAP Password: ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 127.0.0.1:389 ldap_pvt_connect: fd: 4 tm: -1 async: 0 attempting to connect: connect errno: 111 ldap_close_socket: 4 ldap_int_open_connection ldap_connect_to_path ldap_new_socket: 4 ldap_connect_to_path: Trying /var/run/ldapi ldap_connect_timeout: fd: 4 tm: -1 async: 0 ldap_ndelay_on: 4 ldap_close_socket: 4 ldap_int_open_connection ldap_connect_to_host: TCP localhost:636 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 127.0.0.1:636 ldap_pvt_connect: fd: 4 tm: -1 async: 0 attempting to connect: connect success TLS: certdb config: configDir='/etc/openldap/certs' tokenDescription='ldap(0)' certPrefix='' keyPrefix='' flags=readOnly TLS: using moznss security dir /etc/openldap/certs prefix . TLS: certificate [CN=my_server.my_domain.com] is valid TLS certificate verification: subject: CN=my_server.my_domain.com, issuer: CN=my_server.my_domain.com, cipher: AES-256, security level: high, secret key bits: 256, total key bits: 256, cache hits: 0, cache misses: 0, cache not reusable: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({i) ber: ber_flush2: 50 bytes to sd 4 ldap_result ld 0x184a340 msgid 1 wait4msg ld 0x184a340 msgid 1 (infinite timeout) wait4msg continue ld 0x184a340 msgid 1 all 1 ** ld 0x184a340 Connections: * host: (null) port: 636 (default) refcnt: 2 status: Connected last used: Fri Oct 30 14:04:24 2015 ** ld 0x184a340 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x184a340 request count 1 (abandoned 0) ** ld 0x184a340 Response Queue: Empty ld 0x184a340 response count 0 ldap_chkResponseList ld 0x184a340 msgid 1 all 1 ldap_chkResponseList returns ld 0x184a340 NULL ldap_int_select read1msg: ld 0x184a340 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 0x184a340 msgid 1 message type bind ber_scanf fmt ({eAA) ber: read1msg: ld 0x184a340 0 new referrals read1msg: mark request completed, ld 0x184a340 msgid 1 request done: ld 0x184a340 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree modifying entry "olcDatabase={0}config,cn=config" ldap_modify_ext ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 102 bytes to sd 4 ldap_result ld 0x184a340 msgid 2 wait4msg ld 0x184a340 msgid 2 (timeout 100000 usec) wait4msg continue ld 0x184a340 msgid 2 all 1 ** ld 0x184a340 Connections: * host: (null) port: 636 (default) refcnt: 2 status: Connected last used: Fri Oct 30 14:04:24 2015 ** ld 0x184a340 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x184a340 request count 1 (abandoned 0) ** ld 0x184a340 Response Queue: Empty ld 0x184a340 response count 0 ldap_chkResponseList ld 0x184a340 msgid 2 all 1 ldap_chkResponseList returns ld 0x184a340 NULL ldap_int_select read1msg: ld 0x184a340 msgid 2 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 0x184a340 msgid 2 message type modify ber_scanf fmt ({eAA) ber: read1msg: ld 0x184a340 0 new referrals read1msg: mark request completed, ld 0x184a340 msgid 2 request done: ld 0x184a340 msgid 2 res_errno: 50, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_err2string ldap_modify: Insufficient access (50) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 4 ldap_free_connection: actually freed
如果我輸入了錯誤的密碼,錯誤會從 Insufficient Access 變為 Invalid Credentials:
ldap_bind: Invalid credentials (49)
我看到了這個 ServerFault 問題,但那個問題是關於權限有限的使用者,而不是管理員或 root。
我如何克服
ldap_modify: Insufficient access (50)
錯誤?為什麼標識為 LDAP 管理員的 root 無權更改密碼?
如果這是推薦的解決方案,我可以重新安裝 slapd。在進一步移動之前,我想解決此錯誤。
編輯:轉到 ldapi:/// 上的 cn=config 會出現以下錯誤:
# ldapsearch -H ldapi:/// -Y EXTERNAL -b 'cn=config' -d1 ldap_url_parse_ext(ldapi:///) ldap_create ldap_url_parse_ext(ldapi:///??base) ldap_sasl_interactive_bind: user selected: EXTERNAL ldap_int_sasl_bind: EXTERNAL ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_path ldap_new_socket: 3 ldap_connect_to_path: Trying /var/run/ldapi ldap_connect_timeout: fd: 3 tm: -1 async: 0 ldap_ndelay_on: 3 ldap_close_socket: 3 ldap_msgfree ldap_err2string ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
我想我已經
ldapi://
定義了/etc/openldap/ldap.conf
,但我不確定ldapi:///
# # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. BASE dc=my_domain,dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 URI ldap:// ldapi:// ldaps:// #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never TLS_CACERTDIR /etc/openldap/certs
編輯 2
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
:停止防火牆 ( ) 後我得到同樣的錯誤service iptables stop
,所以防火牆不是問題。
為了管理“cn=config”數據庫,您需要“cn=config”管理員,而不是數據數據庫的管理員。在 debian 中,這樣的管理員是具有 SASL TLS External 的 root。嘗試
sudo ldapsearch -H ldapi:/// -Y EXTERNAL -b 'cn=config'
確認上述工作後,您可以更改密碼。首先,散列值:
slappasswd -h {SSHA} -s "my_password"
然後,將散列值粘貼到 ldif 文件中,例如
./change_ldap_password.ldif
:dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}cZbRoOhRew8MBiWGSEOiFX0XqbAQwXUr
最後,應用 ldif 文件:
sudo ldapmodify -H ldapi:/// -Y EXTERNAL -D 'cn=config' -f ./change_ldap_password.ldif
ldapmodify
不鼓勵更改密碼。如果使用者存在(不是這種情況),ldappasswd
那就更好了。