Re: howto view slapd configuration : ldapsearch VS slapcat

2011-10-20 Thread Olivier
Hi Howard, As said in a previous mail, I had seen the -a option in the manual that also says : -a : Deprecated : use -H ldap:///???(filter) instead. I however tried -a and I humbly admit that I have not been able to say : ' -s sub -b cn=config (olcDatabase=*) olcAccess ' using that option ( by

Re: howto view slapd configuration : ldapsearch VS slapcat

2011-10-20 Thread Howard Chu
Olivier wrote: Hi Howard, As said in a previous mail, I had seen the -a option in the manual that also says : -a : Deprecated : use -H ldap:///???(filter) instead. I however tried -a and I humbly admit that I have not been able to say : ' -s sub -b cn=config (olcDatabase=*) olcAccess ' using

Securing cn=config and allowing micro-engineering

2011-10-20 Thread Nick Milas
Hello, Having migrated from slapd.conf, I would like to ask some questions regarding cases/scenarios where someone - unintentionally - breaks the configuration. So, let's assume that, due to some misspelling or use of wrong values (esp. when using a graphical LDAP Browser - like JXplorer -

Re: Securing cn=config and allowing micro-engineering

2011-10-20 Thread Howard Chu
Nick Milas wrote: Hello, Having migrated from slapd.conf, I would like to ask some questions regarding cases/scenarios where someone - unintentionally - breaks the configuration. So, let's assume that, due to some misspelling or use of wrong values (esp. when using a graphical LDAP Browser -

Google hits for OpenLDAP (was: Securing cn=config and allowing micro-engineering)

2011-10-20 Thread Hallvard B Furuseth
Howard Chu writes: Zytrax.com is not a reliable source of OpenLDAP documentation. Most of what they advise is misguided or flat wrong. Yet Google(OpenLDAP cn=config)'s two first hits are at Zytrax. It's not surprising people keep using that stuff. Maybe the OpenLDAP site could be improved to

Re: howto view slapd configuration : ldapsearch VS slapcat

2011-10-20 Thread Howard Chu
Olivier Guillard wrote: Thanks Howard, you can't ask for just a specific list of attributes. slapcat always returns whole entries. That's what I didn't get : thanks. The slapcat(8) manpage says: The entry records will include all (user and operational) attributes stored in the

Re: Google hits for OpenLDAP (was: Securing cn=config and allowing micro-engineering)

2011-10-20 Thread Brett @Google
On Thu, Oct 20, 2011 at 10:00 PM, Hallvard B Furuseth h.b.furus...@usit.uio.no wrote: Howard Chu writes: Zytrax.com is not a reliable source of OpenLDAP documentation. Most of what they advise is misguided or flat wrong. Yet Google(OpenLDAP cn=config)'s two first hits are at Zytrax.

Re: Google hits for OpenLDAP (was: Securing cn=config and allowing micro-engineering)

2011-10-20 Thread Giles Coochey
On Thu, October 20, 2011 16:20, Brett @Google wrote: I think the popularity of Zytrax guide on google indicates that there is a need for some simple guide or howto of how to get some sort of trivial ldap server running, in the first instance. Zytrax might fail with regard to accuracy in

Re: Google hits for OpenLDAP (was: Securing cn=config and allowing micro-engineering)

2011-10-20 Thread Hallvard B Furuseth
Brett @Google writes: I think the popularity of Zytrax guide on google indicates that there is a need for some simple guide or howto of how to get some sort of trivial ldap server running, in the first instance. True enough, but also OpenLDAP website doesn't look like a shining example of

Re: Securing cn=config and allowing micro-engineering

2011-10-20 Thread Nick Milas
On 20/10/2011 2:24 μμ, Howard Chu wrote: Where do you get this knowledge? From Zytrax? slaptest tests the server configuration - it doesn't matter whether it is in slapd.conf or slapd.d. I checked man slaptest (e.g. here: http://www.manpagez.com/man/8/slaptest/) which is titled:

Re: Google hits for OpenLDAP

2011-10-20 Thread Howard Chu
Brett @Google wrote: On Thu, Oct 20, 2011 at 10:00 PM, Hallvard B Furuseth h.b.furus...@usit.uio.no mailto:h.b.furus...@usit.uio.no wrote: Howard Chu writes: Zytrax.com is not a reliable source of OpenLDAP documentation. Most of what they advise is misguided or flat wrong.

Re: Securing cn=config and allowing micro-engineering

2011-10-20 Thread Quanah Gibson-Mount
--On Thursday, October 20, 2011 6:36 PM +0300 Nick Milas n...@eurobjects.com wrote: Manually editing slapd.d files is the surest way of causing a problem that prevents slapd from restarting. OK, understood! Obvious approach: slapcat -n0 -F old/slapd.d config.ldif edit config.ldif

Re: Google hits for OpenLDAP

2011-10-20 Thread Michael Ströder
Hallvard B Furuseth wrote: Brett @Google writes: I think the popularity of Zytrax guide on google indicates that there is a need for some simple guide or howto of how to get some sort of trivial ldap server running, in the first instance. True enough, but also OpenLDAP website doesn't look

Re: Google hits for OpenLDAP

2011-10-20 Thread Brett @Google
On Fri, Oct 21, 2011 at 3:35 AM, Howard Chu h...@symas.com wrote: Brett @Google wrote: Zytrax might fail with regard to accuracy in specific details as it seems to be infrequently updated (last August 2010, before that July 2009), but taken asis it gets people going such that they can at

Re: Google hits for OpenLDAP (was: Securing cn=config and allowing micro-engineering)

2011-10-20 Thread Brett @Google
On Fri, Oct 21, 2011 at 2:42 AM, Gavin Henry ghe...@openldap.org wrote: Do we skip that bit and just talk about config or what? I'd be inclined to document a source build, from the current release, at least then people would end up with a newer version and dependencies were provided (bdb