ldapdns-users — Users of LDAPDNS

[Ldapdns-users] Some way out of ldapdns

[Guillaume ! <gbe...@ko...>]

Hey !

I wrote some piece of code to create zone files for bind from
ldifs of ldapdns. I tought I would post this here, so its 
documented at the right place:

https://github.com/GuillaumeFromage/ldif2zones

Its just a python script:
./ldif2zone.py --base dc=org,dc=example,ou=system,ou=data,ou=dns --infile=slapdns.ldif --outdir=zones --ns1=ns1.example.org --ns2=ns2.example.org

It requires nothing but python-ldap. Feel free to send bug
reports or patches.

G

[Ldapdns-users] What's up with ldapdns 3?

[Dan M <str...@gm...>]

Hi. I am just wondering where it stands, how usable it is in its
present state, etc.

Thanks.

-- 
Dan

[Ldapdns-users] Problem resolving CNAME record

[J. <txe...@gm...>]

Hello,

I'm using ldapdns package from ubuntu hardy 8.04 (version 2.06-3.2)
with cosine schema and it's working fine except with CNAME records.

When I try to resolve a CNAME record with dig I get this:

; <<>> DiG 9.4.2 <<>> @localhost host.dominio.com
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13504
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;host.dominio.com.           IN      A

;; ANSWER SECTION:
host.dominio.com.    172800  IN      CNAME   otherhost.dominio.com.

;; AUTHORITY SECTION:
dominio.com.         172800  IN      NS      ns.dominio.com.
dominio.com.         172800  IN      NS      ns2.dominio.com.

;; ADDITIONAL SECTION:
ns.dominio.com. 172800  IN      A       1.2.3.4
ns2.dominio.com. 172800  IN      A       1.2.3.5

;; Query time: 2 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Nov 25 13:46:14 2008
;; MSG SIZE  rcvd: 162

but I don't get de A record for otherhost.dominio.com, in others DNS
server it returns:

; <<>> DiG 9.4.2 <<>> @localhost host.dominio.com
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38264
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 3

;; QUESTION SECTION:
;host.dominio.com.           IN      A

;; ANSWER SECTION:
host.dominio.com.    172800  IN      CNAME   otherhost.dominio.com.
otherhost.dominio.com. 172800   IN      A       1.2.3.6

;; AUTHORITY SECTION:
dominio.com.         172800  IN      NS      ns.dominio.com.
dominio.com.         172800  IN      NS      ns2.dominio.com.

;; ADDITIONAL SECTION:
ns.dominio.com. 172800  IN      A       1.2.3.4
ns2.dominio.com. 172800  IN      A       1.2.3.5

;; Query time: 101 msec
;; SERVER: 212.34.137.12#53(212.34.137.12)
;; WHEN: Tue Nov 25 13:56:34 2008
;; MSG SIZE  rcvd: 190

it has A record of otherhost.dominio.com.

In ldapdns server I get a warning because the request is recursive and
I know that ldapdns is not a recursive server but I think a CNAME is
not recursive if the A record is from same domain.  Is it correct?
Could you help me, please? I have read de schema definition from
http://ldapdns.cvs.sourceforge.net/viewvc/ldapdns/ldapdns/SCHEMA?revision=1.1.1.1&view=markup
but I'm not sure:

cNAMERecord	this produces a generic name-to-name mapping.

 				* if we are searching in-addr.arpa, and the
 				target is in-addr.arpa, we return literal CNAME.

 				* otherwise, if we are searching in-addr.arpa,
 				we return a literal PTR.

 				* otherwise, if we were explicitly looking for
 				CNAME records, we return a literal CNAME.

  				* otherwise, if the target is outside the
    				directory, then we return a literal CNAME.

    				* otherwise, we try and honor the original
    				request using values from the target.

Let me know if you need ldapdns configuration or a ldap tree example
for zone dominio.com.


Thanks in advance, txetxu.

[Ldapdns-users] DNS load balance by geographic location

[John M. <jm...@at...>]

Hi,

I am new to ldapdns. I wonder if there is any patch for ldapdns that can 
enable ldapdns to return different results to DNS queries by geographic 
locations, such that the returned IP address is the closest one to the 
client.

Thanks a lot.

John Mok

Re: [Ldapdns-users] Private root nameserver configuration

[<ld...@ja...>]

ha...@ai... wrote:
> Greetings all,
>=20
> Hopefully theres still a few listening to this list ;)

On occasion :)

> I have tried a few different things but can't seem
> to get my test server answering for the '.' domain.

This is exactly what I have, in my case, required so I can serve reverse-=
DNS from the in-addr.arpa zone.

> LDAP information looks like this at the moment:
>=20
> dc=3Dtest,dc=3Dorg
>   ou=3Ddns
>     dc=3Darpa
>       dc=3Din-addr
>         ...
>     dc=3Dbar
>       dc=3Dfoo
>         ...

I have (with all the associated intermediate entries):

dc=3D.
objectClass: top
objectClass: dcObject
objectClass: dNSDomain
dc: .

dc=3Duk,dc=3D.
objectClass: top
objectClass: dcObject
objectClass: dNSDomain
dc: uk

dc=3Dco,dc=3Duk,dc=3D.
objectClass: top
objectClass: dcObject
objectClass: dNSDomain
dc: co

dc=3Djamie-thompson,dc=3Dco,dc=3Duk,dc=3D.
objectClass: top
objectClass: dcObject
objectClass: dNSDomain
dc: jamie-thompson
mXRecord: 10 mail.jamie-thompson.co.uk
nSRecord: ns.jamie-thompson.co.uk
sOARecord: 2917 1200 900 604800 86400
aRecord: 192.168.69.250

dc=3Darpa,dc=3D.
dc: arpa
objectClass: top
objectClass: dcObject
objectClass: dNSDomain

dc=3Din-addr,dc=3Darpa,dc=3D.
dc: in-addr
objectClass: top
objectClass: dcObject
objectClass: dNSDomain

dc=3D192,dc=3Din-addr,dc=3Darpa,dc=3D.
objectClass: top
objectClass: dcObject
objectClass: dNSDomain
dc: 192

dc=3D168,dc=3D192,dc=3Din-addr,dc=3Darpa,dc=3D.
objectClass: top
objectClass: dcObject
objectClass: dNSDomain
dc: 168

dc=3D69,dc=3D168,dc=3D192,dc=3Din-addr,dc=3Darpa,dc=3D.
objectClass: top
objectClass: dcObject
objectClass: dNSDomain
dc: 69
nSRecord: ns.jamie-thompson.co.uk

=2E..and so on.

> Can anyone enlighten me on the ldap data requirements
> for root nameserver setup, and how to provide the glue
> records as NS entries on '.' ?

Hope that helps you along.

- Jamie

[Ldapdns-users] Private root nameserver configuration

[<ha...@ai...>]

Greetings all,

Hopefully theres still a few listening to this list ;)

I have a question about running ldapdns as a private
root nameserver, with regard to the structure of the
LDAP information.

I have tried a few different things but can't seem
to get my test server answering for the '.' domain.

LDAP information looks like this at the moment:

dc=test,dc=org
  ou=dns
    dc=arpa
      dc=in-addr
        ...
    dc=bar
      dc=foo
        ...

Can anyone enlighten me on the ldap data requirements
for root nameserver setup, and how to provide the glue
records as NS entries on '.' ?

Cheers,
Troy




 

Re: [Ldapdns-users] [SPAM] Re: DC tree structure

[<ib...@eu...>]

El S=C3=A1bado, 23 de Diciembre de 2006 23:29, Micha=C5=82 Sawicz escribi=
=C3=B3:
> Yes You need both the levels, 'cause it breaks up the domain into pieces
> - and then goes down the tree.

Ok, understood.


> > - Second question (maybe not related to ldapdns): What for is the
> > associatedDomain attribute? it works even if a put "blablabla" in this
> > field.=20
>
> AFAIK You don't need the assiociatedDomain, nor the objectClass:
> domainRelatedObject
>
> It works ok without those.

Yes, true ;) thanks.


> > - I've just started with ldapdns, am I doing something wrong in my LDAP
> > configuration? any recomendation?
>
> It works, doesn't it? So what's the problem? ;]

yes, it works :)


Thanks a lot for all.


=2D-=20
I=C3=B1aki

Re: [Ldapdns-users] DC tree structure

[<mi...@sa...>]

I=C3=B1aki wrote:
 > - My first question is: Do I need to separete the "dc=3Dorg" and
"dc=3Dmydomain"
> necesarily? is not anyway just to put the following?
>   dc=3Dmydomain.org,ou=3Ddns,dc=3Dmydomian,dc=3Dorg
> I think maybe using "o" instead of "dc", but isn't "o" "deprecated"
for it?

Yes You need both the levels, 'cause it breaks up the domain into pieces
- and then goes down the tree.

> - Second question (maybe not related to ldapdns): What for is the
> associatedDomain attribute? it works even if a put "blablabla" in this
field.

AFAIK You don't need the assiociatedDomain, nor the objectClass:
domainRelatedObject

It works ok without those.

> - I've just started with ldapdns, am I doing something wrong in my LDAP
> configuration? any recomendation?

It works, doesn't it? So what's the problem? ;]

Cheers,
Saviq

P.S. Unfortunately there hasn't been anyone here since november, when I
joined and asked a (as for today - unanswered) question :|

[Ldapdns-users] DC tree structure

[<ib...@eu...>]

Hi, this is my first message to the list.

I'm trying ldapdns for fisrt time. I've got making it working, but have som=
e=20
dudes about the LDAP structure I need for it.

In my example I have a domain "mydomain.org" so my LDAP top is:
  dc=3Dmydomin,dc=3Dorg

Reading the doc I have created a ou for dns entries:
  ou=3Ddns,dc=3Dmydomin,dc=3Dorg

Now I want an A record for my domain server so the only solution that worke=
d=20
for me is the following:


1) Create:
dn: dc=3Dorg,ou=3Ddns,dc=3Dmydomin,dc=3Dorg
  objectClass: dNSDomain
  objectClass: domainRelatedObject
  objectClass: top
  objectClass: dcObject
  structuralObjectClass: dNSDomain
dc: org
associatedDomain: net   <-- * =C2=BFwhat for?


2) Create:
dn: dc=3Dmydomain,dc=3Dorg,ou=3Ddns,dc=3Dmydomin,dc=3Dorg
  objectClass: dNSDomain
  objectClass: domainRelatedObject
  objectClass: top
  structuralObjectClass: dNSDomain
dc: mydomain
aRecord: 90.90.90.90
nSRecord: @
associatedDomain: blablabla


It works fine:

#> host mydomain.org 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

mydomain.org has address 90.90.90.90



=2D My first question is: Do I need to separete the "dc=3Dorg" and "dc=3Dmy=
domain"=20
necesarily? is not anyway just to put the following?
  dc=3Dmydomain.org,ou=3Ddns,dc=3Dmydomian,dc=3Dorg
I think maybe using "o" instead of "dc", but isn't "o" "deprecated" for it?

=2D Second question (maybe not related to ldapdns): What for is the  =20
associatedDomain attribute? it works even if a put "blablabla" in this fiel=
d.

=2D I've just started with ldapdns, am I doing something wrong in my LDAP=20
configuration? any recomendation?


Thanks for all, specially to the autor of this good application.
Regards.

=2D-=20
I=C3=B1aki Baz Castillo

[Ldapdns-users] PTR records...

[<mi...@sa...>]

I'm trying to set up my PTR records with my ISP...

I have a /4 subnet and I want to have some of my records CNAMEd, 'cause 
I don't know if - and how - I will use them.

So the records I sent to my ISP look like this:
 > 1 IN PTR something.
 > 2 IN CNAME 2.something.

And now I need a
 > 2 IN PTR smtp.something.

in my ldapdns... will this:
 > dc=2,dc=something,dc=dns
 > dc: 2
 > objectclass: top
 > objectclass: dnsrecord
 > objectclass: dcObject
 > nsrecord: @
 > cnamerecord: smtp.something.

work? It does not seem to respond to a PTR request :|

I'm not really sure that it should?

Cheers,
Saviq

[Ldapdns-users] resolving conflict

[JASON J. <jes...@ro...>]

It seems to me that I cannot have the ldapdns as a primary server.  I have added my hosts to openldap and can ping them through ldapdns.

The problem is when I ping an internet address like google.com (which would be in my secondary dns server, somewhere else).  I get unknown. 

Now when I make ldapdns a secondary server I have no problem with internet address and my local addresses.

Can someone help?  I would like ldapdns to be a primary server.

Hope I make sense here.

[Ldapdns-users] loading dns information with ldap

[JASON J. <jes...@ro...>]

Could someone suggest what's wrong with the following:

====================================
localhost jason # cat myhosts.ldif 
dn: dc=global-matrix,ou=hosts,o=Global-Matrix,c=lan
objectclass: top
objectclass: dcobject
objectclass: dnsdomain
objectclass: domainrelatedobject
dc: global-matrix.lan

dn:
dc=mercury,dc=global-matrix,ou=hosts,o=Global-Matrix,c=lan
objectclass: top
objectclass: dnsdomain
objectclass: domainrelatedobject
dc: mercury
arecord: 130.1.24.16
nSRecord: @
localhost jason # ldapadd -x -D
"cn=root,dc=global-matrix,dc=lan" -W -f myhosts.ldif 
Enter LDAP Password: 
adding new entry
"dc=global-matrix,ou=hosts,o=Global-Matrix,c=lan"
ldap_add: Server is unwilling to perform (53)
        additional info: no global superior knowledge

localhost jason # 
====================================

Thanks for any help.

Re: [Ldapdns-users] ICMP Destination Unreachable, Port 53 Unreachable

[Mark B. <ma...@ib...>]

On some further investigation I find that setting THREADS=128 and
HANDLERS=1 ldapdns does not crash out. If I set it to THREADS=1 and
HANDLERS=3 it will crash like before.

After watching this setting the GDB for a while, I did not see any
threads crash so for the time being THREADS=128 and HANDLERS=1 is my
solution.

Mark


On Mon, 2006-03-13 at 17:39 +0800, Mark Burring wrote:
> I apologise for the delay on this.
> 
> This is the output of GDB
> 
> Core was generated by `/bin/ldapdns'.
> Program terminated with signal 11, Segmentation fault.
> Reading symbols from /usr/local/lib/libldap_r-2.3.so.0...done.
> Loaded symbols for /usr/local/lib/libldap_r-2.3.so.0
> Reading symbols from /usr/local/lib/liblber-2.3.so.0...done.
> Loaded symbols for /usr/local/lib/liblber-2.3.so.0
> Reading symbols from /lib/libpthread.so.0...done.
> Loaded symbols for /lib/libpthread.so.0
> Reading symbols from /lib/libc.so.6...done.
> Loaded symbols for /lib/libc.so.6
> Reading symbols from /lib/libresolv.so.2...done.
> Loaded symbols for /lib/libresolv.so.2
> Reading symbols from /lib/ld-linux.so.2...done.
> Loaded symbols for /lib/ld-linux.so.2
> #0  ldap_parse_result (ld=0x807a010, r=0x8085700, errcodep=0xbf7ffa90,
> matcheddnp=0x0, errmsgp=0x0, referralsp=0x0, serverctrls=0x0, freeit=0)
>     at error.c:282
> 282             if ((lm->lm_msgtype == LDAP_RES_SEARCH_ENTRY) ||
> 
> 
> (gdb) backtrace
> #0  ldap_parse_result (ld=0x807a010, r=0x8085700, errcodep=0xbf7ffa90,
> matcheddnp=0x0, errmsgp=0x0, referralsp=0x0, serverctrls=0x0, freeit=0)
>     at error.c:282
> #1  0x0804e49d in ldapdns_process_zonesearch (c=0x80602b8) at
> engine.c:1612
> #2  0x080525a3 in ldap_msgwait_loop (c_void=0x805ec60) at engine.c:3156
> #3  0x40063e51 in pthread_start_thread () from /lib/libpthread.so.0
> #4  0x4018792a in clone () from /lib/libc.so.6
> 
> 
> Since I'm relatively new to GDB, please let me know if there is any
> other useful output.
> 
> Since it appears to be crashing in the middle of an LDAP call I will
> list out my relevant system stats here:
> 
> Debian Sarge
> openldap-2.3.13
> gcc version 3.3.5 (Debian 1:3.3.5-13)
> 
> 
> On Sun, 2006-02-05 at 21:56 -0500, Mrs. Brisby wrote:
> > On Tue, 2006-01-31 at 13:52 +0800, Mark Burring wrote:
> > > Greetings,
> > > 
> > > I am using ldapdns-2.05 with openldap 2.3.13 and have found that
> > > occasionally the server will return a port unreachable for udp port 53.
> > > I am trying to discover if this is normal behaviour as it has not caused
> > > and serious issues yet but a minor issue did come up because of this.
> > 
> > I would seriously consider setting firewall rules up to block outgoing
> > ICMP port unreachable messages, in general, because it'll cause dns
> > lookups to fail instead of retry.
> > 
> > If LDAPDNS crashes (and it can for lots of reasons, I'll go into that in
> > a moment), then it will be restarted if you're using supervise or
> > running it from init (which you SHOULD be doing for anything critical).
> > 
> > Now on my systems, OpenLDAP has a memory leak that I observe. I use
> > softlimit so the process either has malloc() fail or receives SEGV.
> > Either way, it's not exploitable by any means, and because it restarts
> > immediately, nothing is "lost" - except a potential retry.
> > 
> > It also happens infrequently enough that I'm not worried about
> > upgrading- if I were, I probably would increase the memory limit first,
> > or do more work on LDAPDNS3 :)
> > 
> > > There seems to be no pattern, it will send this message at random for
> > > any type of query.
> > 
> > You received port unreachable because LDAPDNS died. Simple as that.
> > 
> > Based on where your traces are, it occurs in a recvfrom() which either
> > points outside of usable memory, or the kernel is doing it to you during
> > the call. Or another thread is crashing, and you don't notice.
> > 
> > If you really want to find out, set HANDLERS=1 THREADS=128. Also, build
> > LDAPDNS with debug symbols and configure your system to dump LDAPDNS's
> > core so you can look at it later with gdb. It'll probably make things
> > much easier to spot, because you can look at other threads....
> 
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by xPML, a groundbreaking scripting language
> that extends applications into web and mobile media. Attend the live webcast
> and join the prime developer group breaking into this new coding territory!
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
> _______________________________________________
> Ldapdns-users mailing list
> Lda...@li...
> https://lists.sourceforge.net/lists/listinfo/ldapdns-users

Re: [Ldapdns-users] ICMP Destination Unreachable, Port 53 Unreachable

[Mark B. <ma...@ib...>]

I apologise for the delay on this.

This is the output of GDB

Core was generated by `/bin/ldapdns'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/local/lib/libldap_r-2.3.so.0...done.
Loaded symbols for /usr/local/lib/libldap_r-2.3.so.0
Reading symbols from /usr/local/lib/liblber-2.3.so.0...done.
Loaded symbols for /usr/local/lib/liblber-2.3.so.0
Reading symbols from /lib/libpthread.so.0...done.
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/libresolv.so.2...done.
Loaded symbols for /lib/libresolv.so.2
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  ldap_parse_result (ld=0x807a010, r=0x8085700, errcodep=0xbf7ffa90,
matcheddnp=0x0, errmsgp=0x0, referralsp=0x0, serverctrls=0x0, freeit=0)
    at error.c:282
282             if ((lm->lm_msgtype == LDAP_RES_SEARCH_ENTRY) ||


(gdb) backtrace
#0  ldap_parse_result (ld=0x807a010, r=0x8085700, errcodep=0xbf7ffa90,
matcheddnp=0x0, errmsgp=0x0, referralsp=0x0, serverctrls=0x0, freeit=0)
    at error.c:282
#1  0x0804e49d in ldapdns_process_zonesearch (c=0x80602b8) at
engine.c:1612
#2  0x080525a3 in ldap_msgwait_loop (c_void=0x805ec60) at engine.c:3156
#3  0x40063e51 in pthread_start_thread () from /lib/libpthread.so.0
#4  0x4018792a in clone () from /lib/libc.so.6


Since I'm relatively new to GDB, please let me know if there is any
other useful output.

Since it appears to be crashing in the middle of an LDAP call I will
list out my relevant system stats here:

Debian Sarge
openldap-2.3.13
gcc version 3.3.5 (Debian 1:3.3.5-13)


On Sun, 2006-02-05 at 21:56 -0500, Mrs. Brisby wrote:
> On Tue, 2006-01-31 at 13:52 +0800, Mark Burring wrote:
> > Greetings,
> > 
> > I am using ldapdns-2.05 with openldap 2.3.13 and have found that
> > occasionally the server will return a port unreachable for udp port 53.
> > I am trying to discover if this is normal behaviour as it has not caused
> > and serious issues yet but a minor issue did come up because of this.
> 
> I would seriously consider setting firewall rules up to block outgoing
> ICMP port unreachable messages, in general, because it'll cause dns
> lookups to fail instead of retry.
> 
> If LDAPDNS crashes (and it can for lots of reasons, I'll go into that in
> a moment), then it will be restarted if you're using supervise or
> running it from init (which you SHOULD be doing for anything critical).
> 
> Now on my systems, OpenLDAP has a memory leak that I observe. I use
> softlimit so the process either has malloc() fail or receives SEGV.
> Either way, it's not exploitable by any means, and because it restarts
> immediately, nothing is "lost" - except a potential retry.
> 
> It also happens infrequently enough that I'm not worried about
> upgrading- if I were, I probably would increase the memory limit first,
> or do more work on LDAPDNS3 :)
> 
> > There seems to be no pattern, it will send this message at random for
> > any type of query.
> 
> You received port unreachable because LDAPDNS died. Simple as that.
> 
> Based on where your traces are, it occurs in a recvfrom() which either
> points outside of usable memory, or the kernel is doing it to you during
> the call. Or another thread is crashing, and you don't notice.
> 
> If you really want to find out, set HANDLERS=1 THREADS=128. Also, build
> LDAPDNS with debug symbols and configure your system to dump LDAPDNS's
> core so you can look at it later with gdb. It'll probably make things
> much easier to spot, because you can look at other threads....

[Ldapdns-users] ldapaxfr eating copious CPU and mem

[James W. (S. Sysadmin) <sys...@su...>]

G'day,

ldapaxfr just up and made off with all my CPU and memory.  No TCP port 
53 traffic was going through at the time so it's unlikely to have been 
related to any axfr that was actually in progress.  The issue was 
noticed when an in-house script that searches LDAP and receives around 
400 entries each with one attribute specified in the result was left 
waiting forever.  Nothing else LDAP-related appeared to be affected 
adversely which may have been due to the use of indices.  Here's a 
snippet from top:

top - 10:12:08 up 135 days, 11:10,  4 users,  load average: 8.51, 7.82, 6.72
Tasks:  88 total,   3 running,  85 sleeping,   0 stopped,   0 zombie
Cpu(s): 95.7% us,  2.7% sy,  0.0% ni,  0.0% id,  0.0% wa,  0.0% hi,  1.7% si
Mem:    906736k total,   901652k used,     5084k free,     1120k buffers
Swap:  2891576k total,   742552k used,  2149024k free,    13108k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  
COMMAND          
  25213 ldapdns   25   0 1021m  740 3780 R 84.1  0.1 841:48.65 ldapaxfr  

Restarting ldapdns restored everything to normal.

Sorry I can't provide any more info at this time, and not sure I can 
replicate this in a dev. environment.  I'm suspicious of the openldap 
libs though haven't seen this particular behaviour from anything else 
dependant on them; or could it possibly be in the ldapaxfr code?

I'm running 2.06 as packaged in Debian Sarge.

Cheers,

-- 
James Wakefield
Systems Administrator
+61 03 5227 6888

We have now moved head office to 8-12 Pakington Street,
Geelong West.

Re: [Ldapdns-users] ICMP Destination Unreachable, Port 53 Unreachable

[James W. (S. Sysadmin) <sys...@su...>]

Hmm....only thing I could suggest here is building from source with 
debug symbols and tracing the stack at the SEGV using gdb...can't see 
anything really obvious in the strace though maybe others will.


James Wakefield
Systems Administrator
+61 03 5227 6888

We have now moved head office to 8-12 Pakington Street,
Geelong West.



Mark Burring wrote:

>Some additional output before the SIGSEV
>
>time([1138764831])                      = 1138764831
>old_mmap(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|
>MAP_NORESERVE, -1, 0) = 0x401f5000
>munmap(0x401f5000, 45056)               = 0
>munmap(0x40300000, 1003520)             = 0
>mprotect(0x40200000, 135168, PROT_READ|PROT_WRITE) = 0
>rt_sigprocmask(SIG_SETMASK, NULL, [RTMIN], 8) = 0
>rt_sigsuspend([] <unfinished ...>
>--- SIGRTMIN (Unknown signal 32) @ 0 (0) ---
><... rt_sigsuspend resumed> )           = -1 EINTR (Interrupted system
>call)
>sigreturn()                             = ? (mask now [RTMIN])
>time(NULL)                              = 1138764831
>write(4, "0\201\200\2\2\0\225cz\0044dc=icticc, dc=org, dc"..., 131) =
>131
>recvfrom(3, 0x806435a, 512, 0, 0xbffffc30, 0xbffffc2c) = ? ERESTARTSYS
>(To be restarted)
>--- SIGSEGV (Segmentation fault) @ 0 (0) ---
>+++ killed by SIGSEGV +++
>execve("/bin/ldapdns", ["/bin/ldapdns"], [/* 12 vars */]) = 0
>
>
>
>-------------------------------------------------------
>This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
>for problems?  Stop!  Download the new AJAX search engine that makes
>searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
>http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
>_______________________________________________
>Ldapdns-users mailing list
>Lda...@li...
>https://lists.sourceforge.net/lists/listinfo/ldapdns-users
>  
>

Re: [Ldapdns-users] ICMP Destination Unreachable, Port 53 Unreachable

[Mark B. <ma...@ib...>]

Some additional output before the SIGSEV

time([1138764831])                      = 1138764831
old_mmap(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|
MAP_NORESERVE, -1, 0) = 0x401f5000
munmap(0x401f5000, 45056)               = 0
munmap(0x40300000, 1003520)             = 0
mprotect(0x40200000, 135168, PROT_READ|PROT_WRITE) = 0
rt_sigprocmask(SIG_SETMASK, NULL, [RTMIN], 8) = 0
rt_sigsuspend([] <unfinished ...>
--- SIGRTMIN (Unknown signal 32) @ 0 (0) ---
<... rt_sigsuspend resumed> )           = -1 EINTR (Interrupted system
call)
sigreturn()                             = ? (mask now [RTMIN])
time(NULL)                              = 1138764831
write(4, "0\201\200\2\2\0\225cz\0044dc=icticc, dc=org, dc"..., 131) =
131
recvfrom(3, 0x806435a, 512, 0, 0xbffffc30, 0xbffffc2c) = ? ERESTARTSYS
(To be restarted)
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++
execve("/bin/ldapdns", ["/bin/ldapdns"], [/* 12 vars */]) = 0

Re: [Ldapdns-users] ICMP Destination Unreachable, Port 53 Unreachable

[Mark B. <ma...@ib...>]

James,

Thanks for your reply.

I used tcpdump on the server (tcpdump -i eth0 udp and port 53 or icmp -w
dns.cap) and used ethereal to get a look at the capture. I found that
there is no pattern to the sending of the icmp packets and that they do
originate from the DNS server.
@4000000043e0238b1c316264 ldapdns info: starting ldapdns 2.06 (1:1/128)
The only thing odd in the logs is that this line shows up randomly:

@4000000043e0238b1c316264 ldapdns info: starting ldapdns 2.06 (1:1/128)

and I feel that it could be in the same pattern as the icmp packets.

This section of an strace shows a segmentation fault.

@4000000043e02b0000848ba4 write(4, "0\201\204\2\1\4c\177\0049dc=ns1,
dc=ibc, dc=com"..., 135) = 135
@4000000043e02b00009bfba4 recvfrom(3, "F\212\0\0\0\1\0\0\0\0\0\1\3ns1
\3ibc\3com\2au\0\0\34\0\1"..., 512, 0, {sa_family=AF_INET,
sin_port=htons(1368), sin_addr=inet_addr("202.74.164.1")}, [16]) = 43
@4000000043e02b00009f5aec time([1138764534])                      =
1138764534
@4000000043e02b0000a38554 time(NULL)                              =
1138764534
@4000000043e02b0000a6a61c write(4, "0\201\204\2\1\5c\177\0049dc=ns1,
dc=ibc, dc=com"..., 135) = 135
@4000000043e02b0000d63db4 recvfrom(3, 0x805fc7a, 512, 0, 0xbffffc30,
0xbffffc2c) = ? ERESTARTSYS (To be restarted)
@4000000043e02b0000e0059c --- SIGSEGV (Segmentation fault) @ 0 (0) ---
@4000000043e02b0000eeaf84 +++ killed by SIGSEGV +++
@4000000043e02b002346d0ac execve("/bin/ldapdns", ["/bin/ldapdns"], [/*
12 vars */]) = 0
@4000000043e02b00234eb81c uname({sys="Linux", node="ns2", ...})   = 0
@4000000043e02b002352b3a4 brk(0)                                  =
0x805edc4
@4000000043e02b0023550d34 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40017000

I am assuming a SIGSEV isn't normal and for some reason my ldapdns is
dying on both my name servers. They are both Debian Sarge.

Mark.


On Tue, 2006-01-31 at 23:26 +1100, sys...@su... wrote:
> Hi Mark,
> 
> Sorry if you've tried and discounted this, but are you certain this is
> actually coming from ldapdns?  Can you see strace output or similar that
> will confirm this?  How often does it occur?  Can you rely on it occurring
> say, once an hour, once a day, etc?  It just sounds extremely odd to me
> that an application would respond in this manner, it's not correct
> behaviour, and not by omission or error, it's something the app has to go
> out of its way to do.  Can you categorically eliminate factors like the
> firewall on the box, firewalls upstream of the box, etc?
> 
> Again, sorry if you've gone through all this, but it does sound very
> strange to me.
> 
> Cheers,
> James.
> 
> >
> > Greetings,
> >
> > I am using ldapdns-2.05 with openldap 2.3.13 and have found that
> > occasionally the server will return a port unreachable for udp port 53.
> > I am trying to discover if this is normal behaviour as it has not caused
> > and serious issues yet but a minor issue did come up because of this.
> >
> > There seems to be no pattern, it will send this message at random for
> > any type of query.
> >
> > Mark.
> >
> >
> >
> > -------------------------------------------------------
> > This SF.net email is sponsored by: Splunk Inc. Do you grep through log
> > files
> > for problems?  Stop!  Download the new AJAX search engine that makes
> > searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
> > _______________________________________________
> > Ldapdns-users mailing list
> > Lda...@li...
> > https://lists.sourceforge.net/lists/listinfo/ldapdns-users
> >
> 
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid3432&bid#0486&dat1642
> _______________________________________________
> Ldapdns-users mailing list
> Lda...@li...
> https://lists.sourceforge.net/lists/listinfo/ldapdns-users
-- 
Regards,

Mark Burring
Systems Administrator
Internet Business Corporation
http://www.ibc.com.au/
Ph. 08 9228 9922
Fx. 08 9228 9044
mar...@ib...
                

Re: [Ldapdns-users] ICMP Destination Unreachable, Port 53 Unreachable

[<sys...@su...>]

Hi Mark,

Sorry if you've tried and discounted this, but are you certain this is
actually coming from ldapdns?  Can you see strace output or similar that
will confirm this?  How often does it occur?  Can you rely on it occurrin=
g
say, once an hour, once a day, etc?  It just sounds extremely odd to me
that an application would respond in this manner, it's not correct
behaviour, and not by omission or error, it's something the app has to go
out of its way to do.  Can you categorically eliminate factors like the
firewall on the box, firewalls upstream of the box, etc?

Again, sorry if you've gone through all this, but it does sound very
strange to me.

Cheers,
James.

>
> Greetings,
>
> I am using ldapdns-2.05 with openldap 2.3.13 and have found that
> occasionally the server will return a port unreachable for udp port 53.
> I am trying to discover if this is normal behaviour as it has not cause=
d
> and serious issues yet but a minor issue did come up because of this.
>
> There seems to be no pattern, it will send this message at random for
> any type of query.
>
> Mark.
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log
> files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D103432&bid=3D230486&dat=
=3D121642
> _______________________________________________
> Ldapdns-users mailing list
> Lda...@li...
> https://lists.sourceforge.net/lists/listinfo/ldapdns-users
>

[Ldapdns-users] ICMP Destination Unreachable, Port 53 Unreachable

[Mark B. <ma...@ib...>]

Greetings,

I am using ldapdns-2.05 with openldap 2.3.13 and have found that
occasionally the server will return a port unreachable for udp port 53.
I am trying to discover if this is normal behaviour as it has not caused
and serious issues yet but a minor issue did come up because of this.

There seems to be no pattern, it will send this message at random for
any type of query.

Mark.

Re: [Ldapdns-users] Real-world $HANDLERS and $THREADS values with OpenLDAP

[James W. (S. Sysadmin) <sys...@su...>]

Cool, that seems to have sorted it.  And thanks a heap for this 
software, it meets a very important need...

James Wakefield
Systems Administrator
+61 03 5227 6888

We have now moved head office to 8-12 Pakington Street,
Geelong West.



Mrs. Brisby wrote:

>LDAPDNS has to answer very quickly, and there are race conditions with
>the OpenLDAP client libraries.
>
>Some of these appear to disappear if you set HANDLERS=1 and THREADS=128
>
>On Wed, 2005-12-21 at 14:23 +1100, James Wakefield (Sunet Sysadmin)
>wrote:
>  
>
>>G'day guys,
>>
>>I'm running OpenLDAP 2.2.23 and ldapdns 2.06 (as per Debian stable) and 
>>every few minutes syslog is telling me that a handler or two has waited 
>>too long.  At this point, DNS lookups time out until ldapdns is 
>>restarted.  I am supporting some reasonably intense apps with the LDAP 
>>server (mail, web vhosts, RADIUS, NSS for user/group lookups), but those 
>>are working without complaint.  Following the FAQ, I tried upping 
>>$HANDLERS (to 256 from 128) but to no avail.  The LDAP server is on 
>>127.0.0.1 so I would think it's unlikely to be network latency.  Can 
>>someone with a similar setup let me know what values they're using, as 
>>restarting ldapdns from a cron job every few minutes is not what I want 
>>to be doing.
>>
>>Cheers,
>>
>>    
>>
>
>  
>

Re: [Ldapdns-users] tripple egg&chicken ?

[Mrs. B. <mrs...@ni...>]

LDAPDNS doesn't now and will likely never work with Kerberos.

LDAPDNS is almost always connected to your OpenLDAP server, and should
run as it's own user-id and group-id.

If your LDAPDNS is on the same network as your OpenLDAP, a user would
have to break TCP in order to cause problems. They'll likely have an
easier time breaking either of the machines, or if so included, your
kerberos servers.

So make OpenLDAP and LDAPDNS work by themselves using either a shared
secret or IP-based access control.


On Thu, 2005-12-22 at 12:37 +0200, user local wrote:
> As I read, ldapdns does the beautiful job to simplify the DNS service,
> reading from LDAP. OpenLDAP seems to be most secured w/ Kerberos.
> Kerberos is recommended to be installed based on the DNS registries in
> turn.
> 
> Which is the first setup to be done?
> 
> RTFM will be appreciated, especially if a reference will be pointed
> out.
> 
> TIA
> 
> [PS As you can figure out I'm not much of a hacker, I'm just an Open
> Source and friends fun, and, I hope, further supporter]
> 
> 
> 
> -- 
> OP1 CP116
> 700037
> Iaşi
> România

Re: [Ldapdns-users] Real-world $HANDLERS and $THREADS values with OpenLDAP

[Mrs. B. <mrs...@ni...>]

LDAPDNS has to answer very quickly, and there are race conditions with
the OpenLDAP client libraries.

Some of these appear to disappear if you set HANDLERS=1 and THREADS=128

On Wed, 2005-12-21 at 14:23 +1100, James Wakefield (Sunet Sysadmin)
wrote:
> G'day guys,
> 
> I'm running OpenLDAP 2.2.23 and ldapdns 2.06 (as per Debian stable) and 
> every few minutes syslog is telling me that a handler or two has waited 
> too long.  At this point, DNS lookups time out until ldapdns is 
> restarted.  I am supporting some reasonably intense apps with the LDAP 
> server (mail, web vhosts, RADIUS, NSS for user/group lookups), but those 
> are working without complaint.  Following the FAQ, I tried upping 
> $HANDLERS (to 256 from 128) but to no avail.  The LDAP server is on 
> 127.0.0.1 so I would think it's unlikely to be network latency.  Can 
> someone with a similar setup let me know what values they're using, as 
> restarting ldapdns from a cron job every few minutes is not what I want 
> to be doing.
> 
> Cheers,
> 

Re: [Ldapdns-users] ldapdns2 referrals ?

[Mrs. B. <mrs...@ni...>]

Don't obfuscate your data, it makes it very difficult to tell what you
missed.


On Wed, 2005-12-07 at 17:23 -0600, Glen Dosey wrote:
> I am having trouble getting referrals to work in ldapdns2. Perhaps I am 
> missing something simple.
> 
> I have domain.com and manage it's email etc...
> www.domain.com is hosted by otherdomain.com and randomly changes IP 
> addresses. I want to refer requests for www.domain.com to be answered by 
> ns1.otherdomain.com . In openLDAP I have something very similar to
> 
> dc=domain
> objectClass=dNSDomain
> description="v=spf1 mx ..."
> aRecord="192.168.0.1"
> mXRecord="mail.domain.com"
> mXRecord="mail2.domain.com"
> nSRecord="ns.domain.com"
> nSRecord="ns2.domain.com"
> sOARecord="ns1.domain.com support. etc..."
> 
> and
> 
> dc=www
> objectClass=dNSDomain
> nSRecord="ns1.otherdomain.com"
> 
> 
> With this configuration there is no A record returned for 
> www.domain.com. It seems it is never referred to ns1.otherdomain.com. 
> Everything else works fine and if you directly ask ns1.otherdomain.com 
> who www.domain.com is is responds properly.
> 
> A dig +trace www.domain.com results in the following
> 
> 
> com.                    172800  IN      NS      M.GTLD-SERVERS.NET.
> ;; Received 506 bytes from 128.63.2.53#53(H.ROOT-SERVERS.NET) in 42 ms
> 
> domain.com. 172800 IN      NS      ns1.r-networks.net.
> domain.com. 172800 IN      NS      ns2.r-networks.net.
> ;; Received 162 bytes from 192.5.6.30#53(A.GTLD-SERVERS.NET) in 53 ms
> 
> www.domain.com. 86400 IN  SOA     ns1.otherdomain.com. 
> support.r-networks.net. 1133995321 10800 7200 604800 86400
> www.domain.com. 86400 IN  NS      ns1.otherdomain.com.
> ;; Received 130 bytes from 66.184.238.200#53(ns1.r-networks.net) in 24 ms
> 
> I'd appreciate any help you can offer. I've been over the mailing lists 
> and FAQ and other documents again and again and can't figure it out.
> 
> Thanks,
> 

[Ldapdns-users] tripple egg&chicken ?

[user l. <loc...@gm...>]

QXMgSSByZWFkLCBsZGFwZG5zIGRvZXMgdGhlIGJlYXV0aWZ1bCBqb2IgdG8gc2ltcGxpZnkgdGhl
IEROUyBzZXJ2aWNlLApyZWFkaW5nIGZyb20gTERBUC4gT3BlbkxEQVAgc2VlbXMgdG8gYmUgbW9z
dCBzZWN1cmVkIHcvIEtlcmJlcm9zLiBLZXJiZXJvcwppcyByZWNvbW1lbmRlZCB0byBiZSBpbnN0
YWxsZWQgYmFzZWQgb24gdGhlIEROUyByZWdpc3RyaWVzIGluIHR1cm4uCgpXaGljaCBpcyB0aGUg
Zmlyc3Qgc2V0dXAgdG8gYmUgZG9uZT8KClJURk0gd2lsbCBiZSBhcHByZWNpYXRlZCwgZXNwZWNp
YWxseSBpZiBhIHJlZmVyZW5jZSB3aWxsIGJlIHBvaW50ZWQgb3V0LgoKVElBCgpbUFMgQXMgeW91
IGNhbiBmaWd1cmUgb3V0IEknbSBub3QgbXVjaCBvZiBhIGhhY2tlciwgSSdtIGp1c3QgYW4gT3Bl
biBTb3VyY2UKYW5kIGZyaWVuZHMgZnVuLCBhbmQsIEkgaG9wZSwgZnVydGhlciBzdXBwb3J0ZXJd
CgoKCi0tCk9QMSBDUDExNgo3MDAwMzcKSWG6aQpSb23ibmlhCg==