LDAP on AIX - the continuing tragedy...

by **Menno Willemse** » Sat, 17 Feb 2007 01:56:31 GMT

h fellow AIXers,

A while back I reported on the success I had configuring a rather
simple LDAP server on AIX. All it needs to do is spoon out passwords
to everybody who asks. And for weeks on end it ran without fail,
whereupon it shat itself afer a reboot. My Test/Dev domain has been
without LDAP since.

Now I do have one NON-NEGOTIABLE requirement: LDAP must keep its
{*filter*} mitts out of /home, because that is reserved, surprisingly, for
users' home directories. It lives on an NFS server, and is accessed
using the automounter. Putting a symlink there is Not Possible. I have
also tried, and failed, to mount a local directory using the
Automounter, so /home is a no-go area for authentication servers.
Period.

This rules out using mksecldap for the whole of the operation, because
that piece of shi^H^Hoftware actually assumes not only that I want to
put DB2 databases in ldapdb2's home directory, but also that that home
directory is /home/ldapdb2. It is actually HARD-CODED in the script.
After a week of installing, reinstalling, browsing the Usenet groups,
perusing IBM-style documentation in dozens of PDFs, I want to meet the
maker of that program. In a dark alley. With no witnesses.

I am now turning to the Community At Large, asking what I'm doing
wrong. This is the procedure, more or less in script form, though I
type in the commands as you see them:

#----------------------------------------------------------------------
# STARTING POINT: Freshly installed AIX 5.3 system. TL5, SP5.
#----------------------------------------------------------------------

#----------------------------------------------------------------------
# STAGE ONE: INSTALLING AND STARTING THE SERVER
#----------------------------------------------------------------------

# Make the users and groups
mkgroup id=30006 ldap
mkgroup id=30007 users=root dbsysadm
mkuser id=30002 pgrp=ldap groups=ldap umask=002 home=/local/data/ldap/
ldap \
gecos="Lightweight Directory Access Protocol administrative
user" ldap
mkuser id=30003 pgrp=dbsysadm groups=ldap umask=002 \
home=/local/data/ldap/ldapdb2 \
gecos="LDAP DB2 database administrator" ldapdb2

# Set passwords on non-personal accounts to p@ssw0rd
# - security is overrated anyway.
passwd ldap;pwdadm -c ldap
passwd ldapdb2;pwdadm -c ldapdb2

# Found this in a post somewhere...
chmod 775 /local/data/ldap/ldapdb2

# DB2 likes async I/O.
chdev -l aio0 -a autoconfig=available
mkdev -l aio0

# Install the requisite software
installp -acgXYd /data/sw/AIX/aix53/latest \
db2_08_01.ca db2_08_01.cc db2_08_01.cj \
db2_08_01.client db2_08_01.cnvucs db2_08_01.conn
db2_08_01.conv \
db2_08_01.cs.rte db2_08_01.das db2_08_01.db2.engn
db2_08_01.db2.rte \
db2_08_01.db2.samples db2_08_01.essg db2_08_01.icuc
db2_08_01.icut \
db2_08_01.jdbc db2_08_01.ldap \
db2_08_01.msg.en_US.iso88591 db2_08_01.pext db2_08_01.repl \
db2_08_01.sqlproc ldap.client.adt ldap.client.rte
ldap.server.cfg \
ldap.server.com ldap.server.java ldap.server.rte \
X11.apps.config
# X11.apps.config is just so I can ssh -X to the box, and run ldapxcfg

# Reboot the server here...
reboot
#----------------------------------------------------------------------

# License the DB2 server for LDAP
/usr/opt/db2_08_01/adm/db2licm -a /usr/ldap/etc/ldap-custom-db2ese.lic

# Pre-configure the LDAP server
expo

by **Hajo Ehlers** » Sat, 17 Feb 2007 07:44:45 GMT

n 15 Feb., 17:56, "Menno Willemse" < XXXX@XXXXX.COM > wrote:

Have you read tech note:
Technote (FAQ)
On UNIX systems you cannot configure the database in a location other
than /home when /home is an NFS mount

Problem
Steps to manually configure the database in a location other than /
home, when /home is an NFS mount.

http://www-1.ibm.com/support/docview.wss?rs=0&dc=DB500&q1=ldap&q2=aix&q3=%2fhome&uid=swg21079155&loc=en_US&cs=utf-8&cc=us&lang=en

hth
Hajo

by **Menno Willemse** » Sat, 17 Feb 2007 19:00:56 GMT



 http://www.**--****.com/ %2fhome&uid=swg21079155&loc=en_US&cs=utf-8&cc=us&lang=en

Well, I just tried doing it their way:

#----------------------------------------------------------------------
# STAGE THREE-A: PRE-CONFIGURING THE DATABASE - THE WAY OF THE BARE
HAND
#----------------------------------------------------------------------

/usr/ldap/db2/instance/db2icrt -u ldapdb2 ldapdb2
cp /etc/services /etc/services.PRE-LDAP
echo "ldapdb2svc 3700/tcp" >> /etc/services
echo "ldapdb2svci 3701/tcp" >> /etc/services

# SWITCH TO THE LDAPDB2 ACCOUNT HERE
su - ldapdb2

# Create the database and set its tuning parameters
db2 create db ldapdb2 on ~ldapdb2 using codeset UTF-8
db2empfa ldapdb2
db2 update db cfg for ldapdb2 using applheapsz 4096
db2 update db cfg for ldapdb2 using pckcachesz 720

# Update the database for local loopback connections
db2 update dbm cfg using SVCENAME ldapdb2svc
db2 catalog tcpip node ldapdb2n remote localhost server ldapdb2svc
db2 catalog db ldapdb2 as ldapdb2b at node ldapdb2n authentication
server
db2set DB2COMM=TCPIP

# Restart the DB2 server to enable happiness
db2stop
db2start

# Add the following to the /usr/ldap/etc/ibmslapd.conf
# At the end of the stanza that starts:
# dn: cn=Directory,cn=RDBM Backends

# mrw added these
ibm-slapdDbInstance: ldapdb2
ibm-slapdDbAlias: ldapdb2b
ibm-slapdDbUserId: ldapdb2
ibm-slapdDbName: ldapdb2
ibm-slapdDbUserPw: p@ssw0rd
ibm-slapdDbLocation: /local/data/ldap/ldapdb2
ibm-slapdSetEnv: DB2CP=1208
# End of mrw additions

Now that last line it told me to uncomment rather than add, but I
couldn't find it. I then added the administrator account to the LDAP
config as shown here:

ldapcfg \
        -u 'cn=root,dc=utopia,dc=johnguest,dc=com' \
        -p 'Z@rqu0n' \
        -n

And tried to start ibmslapd, which failed in a slightly different way
this time:

Plugin of type DATABASE is successfully loaded from /lib/libback-
config.a.
Error code -2 from odbc string:" SQLTransact "  .
Failed to initialize be_config.
Error encountered.  Server starting in configuration only mode.

Mind you, previously I hadn't added ldap to the dbsysadm group, so
maybe that's worth trying. Will report on any progress.

Cheers,
Menno

by **Menno Willemse** » Sun, 18 Feb 2007 01:45:44 GMT

Well, that went up like a lead balloon.

- Standard install of AIX 5.3.

- mksecldap -s \
        -a 'cn=root,dc=utopia,dc=johnguest,dc=com' \
        -p 'p@ssw0rd' \
        -S RFC2307AIX \
        -d 'dc=utopia,dc=johnguest,dc=com' \
        -u NONE

Forget about putting the database somewhere sensible. Forget about pre-
configuring databases. The *only* thing I did was pre-create the users
WITH the correct group memberships.

End result:

Plugin of type EXTENDEDOP is successfully loaded from libevent.a.
Plugin of type DATABASE is successfully loaded from /lib/libback-
config.a.
Error code -1 from odbc string:" SQLAllocEnv "  .
Failed to initialize be_config.
Error encountered.  Server starting in configuration only mode.
Plugin of type EXTENDEDOP is successfully loaded from libloga.a.
Non-SSL port initialized to 389.

And no working LDAP server. My opinion on this is not fit for polite
company.

by **Hajo Ehlers** » Sun, 18 Feb 2007 11:56:18 GMT



IBM say about this error:

 http://www.**--****.com/ 

meaning more or less you are using the wrong db2 version . Have you
update any db2 version ?

regards
Hajo

by **Henry** » Tue, 20 Feb 2007 05:02:06 GMT





apparently this is useful too
 http://www.**--****.com/ #main

by **Menno Willemse** » Tue, 20 Feb 2007 21:44:55 GMT

i Hajo and Henry,

Help is much appreciated. (Especially since IBM has seen fit to move
my TCP/IP course to July. It never rains, but it pours).

On Feb 18, 8:02 pm, "Henry" < XXXX@XXXXX.COM > wrote:

Responding to both:

ldapsearch -h ldap.acme.com "objectClass=*"
# lslpp -L |grep db2
db2_08_01.ca 8.1.1.16 C F Configuration
Assistant
db2_08_01.cc 8.1.1.16 C F Control Center
db2_08_01.ch.en_US.iso88591
db2_08_01.cj 8.1.1.16 C F Java Common files
db2_08_01.client 8.1.1.16 C F Base Client
Support
db2_08_01.cnvucs 8.1.1.16 C F Code Page
Conversion Tables -
db2_08_01.conn 8.1.1.16 C F Connect Support
db2_08_01.conv 8.1.1.16 C F Code Page
Conversion Tables
db2_08_01.cs.rte 8.1.1.16 C F Communication
Support - TCP/IP
db2_08_01.das 8.1.1.16 C F Administration
Server
db2_08_01.db2.engn 8.1.1.16 C F Base DB2 UDB
Support
db2_08_01.db2.rte 8.1.1.16 C F Run-time
Environment
db2_08_01.db2.samples 8.1.1.16 C F Sample Database
Source
db2_08_01.essg 8.1.1.16 C F Product Signature
for DB2 UDB
db2_08_01.icuc 8.1.1.16 C F ICU Collation
db2_08_01.icut 8.1.1.16 C F ICU Utilities
db2_08_01.jdbc 8.1.1.16 C F Java Support
db2_08_01.jhlp.en_US.iso88591
db2_08_01.ldap 8.1.1.16 C F DB2 LDAP Support
db2_08_01.msg.en_US.iso88591
db2_08_01.pext 8.1.1.16 C F Parallel Extension
db2_08_01.repl 8.1.1.16 C F Replication
db2_08_01.sqlproc 8.1.1.16 C F SQL Procedures

This is what came with AIX 5.3, TL5, SP5. I could try to find a more
recent one, but this one is pretty high up already. The move database
utility could be useful, but only if I can't create the database in
the right place in the first place.

As far as I can tell with ldapsearch, I do get a functional LDAP
server, all that needs doing is to populate it with my domain
information. But when I try doing that with mksecldap the database
ceases to function. I could try upgrading my DB2 to a more recent
version if there is one. Will tell you if this has any good results.

Cheers,
Menno.

by **Menno Willemse** » Tue, 20 Feb 2007 23:55:40 GMT

Hello World,

Right. Did a fresh install again - this time with DB2 8.1.1.80. Same
result. I get a running empty ldap server, then mksecldap {*filter*}s it
up and it won't start anymore. Same messages as above.

Theoretically, It might be something to do with my installation, so I
could try a reinstall from BOS rather than from my standard mksysb.
But I don't believe that is it.

This should just work, dammit!

Cheers,
Menno

by **Menno Willemse** » Wed, 21 Feb 2007 02:05:12 GMT

Hello World,

Okay... I've just found an efix that could solve the problem because
one of the APARs in it describes the problem accurately enough:

 http://www.**--****.com/ 

Unfortunately the install script that comes with it... doesn't work
properly. So now I'll reinstall the machine yet again, install the
requisite software, then BEFORE configuring it any further or even
rebooting, apply the efix. This should keep the file free. Will report
on progress.

So where would one normally download ldap.server PTFs? They aren't in
the Quick Links for AIX Fixes page.

Cheers,
Menno "Seriously considering NIS" Willemse

by **Menno Willemse** » Wed, 21 Feb 2007 02:37:52 GMT



Aaaand...

Error code -1 from odbc string:" SQLAllocEnv "  .

{*filter*} this for a lark. LDAP was never meant to work on AIX. Does
anyone have an idea on how to add the aix bit in rfc2307aix to
OpenLDAP?

by **Menno Willemse** » Fri, 23 Feb 2007 02:09:03 GMT



Post-script - Just installed a server fresh with no modifications at
all. AIX up to the max level. I let mksecldap set everything up
itself.

It bombed.

I think this one is over to IBM - go fix your program.

And I used to *LIKE* IBM software.

CHeers,
Menno

LDAP on AIX - the continuing tragedy...

LDAP on AIX - the continuing tragedy...

Jump to:

Next

LDAP on AIX - the continuing tragedy...

Re: LDAP on AIX - the continuing tragedy...

Re: LDAP on AIX - the continuing tragedy...

Re: LDAP on AIX - the continuing tragedy...

Re: LDAP on AIX - the continuing tragedy...

Re: LDAP on AIX - the continuing tragedy...

Re: LDAP on AIX - the continuing tragedy...

Re: LDAP on AIX - the continuing tragedy...

Re: LDAP on AIX - the continuing tragedy...

Re: LDAP on AIX - the continuing tragedy...

Re: LDAP on AIX - the continuing tragedy...

Similar Threads:

Who is online