ZBUG-3120 : Upgrade Zimbra OpenLDAP to 2.5.13 by umagmrit · Pull Request #176 · Zimbra/packages

umagmrit · 2022-12-21T03:03:39Z

No description provided.

umagmrit · 2022-12-21T03:18:44Z

@ghen2 Could you please review this ?

ghen2 · 2022-12-21T11:22:22Z

This is now running in our lab, as a drop-in upgrade (no slapcat/slapadd performed), I will test further.

A few remarks:

libssh2-devel is a missing build dependency (on centos7)
zimbra-perl-net-ldapapi is linked to the OS openldap libs, not Zimbra's, so that rebuild is not needed
need to reapply CAP_NET_BIND_SERVICE, maybe put this in the openldap package instead of relying on zmfixperms
I rebased Build OpenLDAP pw-argon2 module for Argon2 key derivation function #117, please consider it as well

umagmrit · 2022-12-21T11:59:18Z

This is now running in our lab, as a drop-in upgrade (no slapcat/slapadd performed), I will test further.

A few remarks:

libssh2-devel is a missing build dependency (on centos7)

zimbra-perl-net-ldapapi is linked to the OS openldap libs, not Zimbra's, so that rebuild is not needed

need to reapply CAP_NET_BIND_SERVICE, maybe put this in the openldap package instead of relying on zmfixperms

I rebased Build OpenLDAP pw-argon2 module for Argon2 key derivation function #117, please consider it as well

@ghen2 Thank you for your review.
regarding zimbra-perl-net-ldapapi package, this is linked to zimbra openldap.

$ ldd /opt/zimbra/common/lib/perl5/x86_64-linux-gnu-thread-multi/auto/Net/LDAPapi/LDAPapi.so
	linux-vdso.so.1 (0x00007ffd91fbc000)
	libldap-2.4.so.2 => /opt/zimbra/common/lib/libldap-2.4.so.2 (0x00007fcc6715f000)
	liblber-2.4.so.2 => /opt/zimbra/common/lib/liblber-2.4.so.2 (0x00007fcc66f4f000)
	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fcc66b5e000)
	libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007fcc66944000)
	libsasl2.so.3 => /opt/zimbra/common/lib/libsasl2.so.3 (0x00007fcc66728000)
	libssl.so.1.1 => /opt/zimbra/common/lib/libssl.so.1.1 (0x00007fcc66499000)
	libcrypto.so.1.1 => /opt/zimbra/common/lib/libcrypto.so.1.1 (0x00007fcc65fb0000)
	/lib64/ld-linux-x86-64.so.2 (0x00007fcc675d0000)
	libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fcc65dac000)
	libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fcc65b8d000)
$ dpkg -S /opt/zimbra/common/lib/libldap-2.4.so.2
zimbra-openldap-lib:amd64: /opt/zimbra/common/lib/libldap-2.4.so.2

ghen2 · 2022-12-21T12:03:02Z

Not on CentOS/RHEL 7:

$ rpm -q zimbra-perl-net-ldapapi
zimbra-perl-net-ldapapi-3.0.3-1zimbra8.7b1.el7.x86_64
$ ldd /opt/zimbra/common/lib/perl5/x86_64-linux-thread-multi/auto/Net/LDAPapi/LDAPapi.so
        linux-vdso.so.1 =>  (0x00007ffce6ff3000)
        libldap-2.4.so.2 => /lib64/libldap-2.4.so.2 (0x00007fe2fba95000)
        liblber-2.4.so.2 => /lib64/liblber-2.4.so.2 (0x00007fe2fb886000)
        libc.so.6 => /lib64/libc.so.6 (0x00007fe2fb4b8000)
        libresolv.so.2 => /lib64/libresolv.so.2 (0x00007fe2fb29e000)
        libsasl2.so.3 => /lib64/libsasl2.so.3 (0x00007fe2fb081000)
        libssl.so.10 => /lib64/libssl.so.10 (0x00007fe2fae0f000)
        libcrypto.so.10 => /lib64/libcrypto.so.10 (0x00007fe2fa9ac000)
        libssl3.so => /lib64/libssl3.so (0x00007fe2fa749000)
        libsmime3.so => /lib64/libsmime3.so (0x00007fe2fa521000)
        libnss3.so => /lib64/libnss3.so (0x00007fe2fa1e8000)
        libnssutil3.so => /lib64/libnssutil3.so (0x00007fe2f9fb8000)
        libplds4.so => /lib64/libplds4.so (0x00007fe2f9db4000)
        libplc4.so => /lib64/libplc4.so (0x00007fe2f9baf000)
        libnspr4.so => /lib64/libnspr4.so (0x00007fe2f9971000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fe2f9755000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00007fe2f9551000)
        /lib64/ld-linux-x86-64.so.2 (0x00007fe2fbf02000)
        libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007fe2f931a000)
        libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007fe2f90cd000)
        libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007fe2f8de4000)
        libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007fe2f8bb1000)
        libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007fe2f89ad000)
        libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007fe2f879d000)
        libz.so.1 => /lib64/libz.so.1 (0x00007fe2f8587000)
        librt.so.1 => /lib64/librt.so.1 (0x00007fe2f837f000)
        libfreebl3.so => /lib64/libfreebl3.so (0x00007fe2f817c000)
        libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007fe2f7f78000)
        libselinux.so.1 => /lib64/libselinux.so.1 (0x00007fe2f7d51000)
        libpcre.so.1 => /lib64/libpcre.so.1 (0x00007fe2f7aef000)

umagmrit · 2022-12-21T12:15:19Z

Not on CentOS/RHEL 7:

$ rpm -q zimbra-perl-net-ldapapi
zimbra-perl-net-ldapapi-3.0.3-1zimbra8.7b1.el7.x86_64
$ ldd /opt/zimbra/common/lib/perl5/x86_64-linux-thread-multi/auto/Net/LDAPapi/LDAPapi.so
        linux-vdso.so.1 =>  (0x00007ffce6ff3000)
        libldap-2.4.so.2 => /lib64/libldap-2.4.so.2 (0x00007fe2fba95000)
        liblber-2.4.so.2 => /lib64/liblber-2.4.so.2 (0x00007fe2fb886000)
        libc.so.6 => /lib64/libc.so.6 (0x00007fe2fb4b8000)
        libresolv.so.2 => /lib64/libresolv.so.2 (0x00007fe2fb29e000)
        libsasl2.so.3 => /lib64/libsasl2.so.3 (0x00007fe2fb081000)
        libssl.so.10 => /lib64/libssl.so.10 (0x00007fe2fae0f000)
        libcrypto.so.10 => /lib64/libcrypto.so.10 (0x00007fe2fa9ac000)
        libssl3.so => /lib64/libssl3.so (0x00007fe2fa749000)
        libsmime3.so => /lib64/libsmime3.so (0x00007fe2fa521000)
        libnss3.so => /lib64/libnss3.so (0x00007fe2fa1e8000)
        libnssutil3.so => /lib64/libnssutil3.so (0x00007fe2f9fb8000)
        libplds4.so => /lib64/libplds4.so (0x00007fe2f9db4000)
        libplc4.so => /lib64/libplc4.so (0x00007fe2f9baf000)
        libnspr4.so => /lib64/libnspr4.so (0x00007fe2f9971000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fe2f9755000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00007fe2f9551000)
        /lib64/ld-linux-x86-64.so.2 (0x00007fe2fbf02000)
        libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007fe2f931a000)
        libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007fe2f90cd000)
        libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007fe2f8de4000)
        libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007fe2f8bb1000)
        libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007fe2f89ad000)
        libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007fe2f879d000)
        libz.so.1 => /lib64/libz.so.1 (0x00007fe2f8587000)
        librt.so.1 => /lib64/librt.so.1 (0x00007fe2f837f000)
        libfreebl3.so => /lib64/libfreebl3.so (0x00007fe2f817c000)
        libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007fe2f7f78000)
        libselinux.so.1 => /lib64/libselinux.so.1 (0x00007fe2f7d51000)
        libpcre.so.1 => /lib64/libpcre.so.1 (0x00007fe2f7aef000)

yes correct, need to check why zimbra-perl-net-ldapapi is not linked to zimbra openldap on CentOS/RHEL 7

umagmrit · 2022-12-22T04:01:50Z

@quanah can you please review this ?

ghen2

Best do the chown root:zimbra and chmod 750 here as well (first), or it will revert the setcap later (see comments in zmfixperms).

umagmrit · 2023-01-05T07:14:39Z

This is now running in our lab, as a drop-in upgrade (no slapcat/slapadd performed), I will test further.

A few remarks:

libssh2-devel is a missing build dependency (on centos7)

zimbra-perl-net-ldapapi is linked to the OS openldap libs, not Zimbra's, so that rebuild is not needed

need to reapply CAP_NET_BIND_SERVICE, maybe put this in the openldap package instead of relying on zmfixperms

I rebased Build OpenLDAP pw-argon2 module for Argon2 key derivation function #117, please consider it as well

@ghen2 have you tested this by enabling olcIndexHash64 ( 64 bit hash for indexing ) ?

ghen2 · 2023-01-05T11:21:12Z

@ghen2 have you tested this by enabling olcIndexHash64 ( 64 bit hash for indexing ) ?

No, we use default 32 bit index hashes (I did not know this option).

quanah · 2023-01-08T20:32:07Z

@ghen2 have you tested this by enabling olcIndexHash64 ( 64 bit hash for indexing ) ?

No, we use default 32 bit index hashes (I did not know this option).

It's a fairly new option but will become the default in the future. Setting it requires a full DB reload. I'd strongly advise that a full review of the features and changes in OpenLDAP 2.5 is done prior to 2.5 being integrated, as there likely should be a one-time database export/import as a part of the upgrade process. Some upgrade items would likely require a zmlocalconfig key, but I wouldn't suggest one for the 64 bit index hashes, there's no reason to go backwards to 32-bit ones.

ghen2 · 2023-01-09T20:58:56Z

as there likely should be a one-time database export/import as a part of the upgrade process.

Hi Quanah

Previously you said an export/import is not required: #118 (comment), and we are indeed running this 2.5.13 Zimbra build as a drop-in replacement for 2.4 in our non-prod environments.

Or are you only suggesting this as part of a broader upgrade that also changes database configuration, like index_hash64 (and possibly others) ? But such changes could be done separately from the 2.5 upgrade itself?

Geert

quanah · 2023-01-09T21:04:28Z

as there likely should be a one-time database export/import as a part of the upgrade process.

Hi Quanah

Previously you said an export/import is not required: #118 (comment), and we are indeed running this 2.5.13 Zimbra build as a drop-in replacement for 2.4 in our non-prod environments.

Or are you only suggesting this as part of a broader upgrade that also changes database configuration, like index_hash64 (and possibly others) ? But such changes could be done separately from the 2.5 upgrade itself?

Geert

Hi Geert! I'm saying that it may be worthwhile where this is done for the Zimbra product as a whole, to take advantage of the new tuning options and do the necessary one time database reload. I'd also ensure the new feature to slapo-unique to serialize mod ops is implemented. The DB reload is certainly not required now, but will be at some point in the future when the 64-bit index hashes are turned on by default. It would help with very large customer bases in particular.

quanah · 2023-01-17T16:11:03Z

The ARGON2 change would only affect new password changes though, so nothing would break for existing users as long as they haven't changed their passwords. Since LDAP nodes are the first things that must be upgraded in a deployment, I think the risk there is relatively low (i.e., should only be a spate of minutes where it's even possible that someone who just changed their password would run the risk of not being able to authenticate).

ghen2 · 2023-01-17T20:13:00Z

Only if all LDAP's are upgraded in the same maintenance window - which I wasn't assuming, but could indeed be considered a requirement.

quanah · 2023-01-17T20:19:39Z

I don't know how Zimbra's changed vs the past, but IIRC it was always a documented requirement that all LDAP nodes be updated during the same window.

…SERVICE

) * Update libsodium to 1.0.18 for argon2 support. * Update OpenLDAP to 2.4.50 (for new pw-argon2 password module). * Build OpenLDAP pw-argon2 module to support the Argon2 key derivation function. See https://en.wikipedia.org/wiki/Argon2 for more information, and contrib/slapd-modules/passwd/argon2/README for OpenLDAP specific notes. Requires OpenLDAP >= 2.4.50 and libsodium >= 1.0.9. olcPasswordHash can be set to {ARGON2} (from current {SSHA512}) to use argon2 password hashes by default. * Update for OpenLDAP 2.4.56 * This bit was already there. * 2.4.56 * Fix compilation error 2.4.56 * Fix compilation * Upgrade openldap-2.4.56. * Openldap upgraded to 2.4.59 * Require libsodium >= 1.0.18 * The argon2 module is now part of OpenLDAP 2.5, no longer a contrib module. * The argon2 module is now part of OpenLDAP 2.5, no longer a contrib module. debian version not tested. Co-authored-by: Quanah Gibson-Mount <quanah@symas.com> Co-authored-by: Prashantsurana <prashant.surana@synacor.com> Co-authored-by: Prashant Surana <p.k.surana@gmail.com> Co-authored-by: Umashankar Avagadda <umagmrit@gmail.com>

silentsakky · 2023-03-08T11:00:47Z

If possible squash and reduce number of commits before merging this PR

ghen2 · 2023-05-31T08:37:17Z

Hi

Any idea when this will be merged?

(it has been running in our lab for months without issues, as a drop-in replacement for 2.4)

ghen2 · 2023-08-01T15:55:15Z

Can you please rebase this on OpenSSL 3.0.9 ?

ghen2 · 2023-08-02T17:01:26Z

I created a separate PR #192 for the libsodium upgrade, so we can more easily add Argon2 support to either OpenLDAP 2.4 or 2.5, independent of this PR (as we're already using this).

ghen2 · 2023-09-27T15:37:25Z

@silentsakky @umagmrit Can you please consider the separate libsodium upgrade already? Makes our local argon2 build easier to maintain.

ghen2 approved these changes Dec 21, 2022

View reviewed changes

umagmrit marked this pull request as ready for review December 21, 2022 13:04

ghen2 reviewed Dec 28, 2022

View reviewed changes

umagmrit requested review from GaneshAnarse, RakeshAMore, abhishekdeshmukh2209, dasiyogesh, dawoodshaikh, inpati, prashantajari, preshitaagrawal, shrutig0510, silentsakky, uttamtakalkar, vishnukantjangid and zimsuchitgupta December 29, 2022 08:40

silentsakky approved these changes Dec 29, 2022

View reviewed changes

shrutig0510 approved these changes Dec 29, 2022

View reviewed changes

ghen2 approved these changes Dec 29, 2022

View reviewed changes

umagmrit and others added 18 commits March 7, 2023 07:08

ZBUG-3120:Upgraded Openldap to 2.5.13

1810e23

ZBUG-3120:Updated postfix for Openldap-2.5.13

c9f6bda

ZBUG-3120:Updated opendkim for Openldap-2.5.13

8f9f7b9

ZBUG-3120:Updated perl-net-ldapapi for Openldap-2.5.13

416be7d

ZBUG-3120: Updated perl to 1.0.6 for Openldap-2.5.13

ac75bba

ZBUG-3120:Updated mta-components to 1.0.19

2dc6837

ZBUG-3120:Updated core-components to 3.0.16

9d90e44

ZBUG-3120:Updated ldap-components to 2.0.10

28fdfc2

ZBUG-3120:added post-install script for openldap to set CAP_NET_BIND_…

fe3469c

…SERVICE

ZBUG-3120:link zimbra-perl-net-ldapapi to zimbra openldap libs

db4b90d

ZBUG-3120:Updated perl-zmq-libzmq3 for zimbra-perl

28e565e

ZBUG-3120:Updated libsodium for zimbra-zeromq

86f041b

ZBUG-3120:Updated libsodium for OpenLDAP pw-argon2 module

5f63b5f

ZBUG-3120:Updated libsodium for OpenLDAP pw-argon2 module

3e75fba

ZBUG-3120:Updated zeromq for perl-zmq-libzmq3

da80733

ZBUG-3120:Updated openldap postinstall script

3ea8f19

ZBUG-3120:Updated zeromq version

d32dcb2

umagmrit force-pushed the ZBUG-3120 branch from fc74da8 to d32dcb2 Compare March 7, 2023 08:08

ghen2 mentioned this pull request Aug 2, 2023

Update libsodium to 1.0.18 (needed for Argon2 support in OpenLDAP). #192

Closed

umagmrit closed this May 23, 2024

umagmrit deleted the ZBUG-3120 branch May 23, 2024 08:09

Conversation

umagmrit commented Dec 21, 2022

Uh oh!

umagmrit commented Dec 21, 2022

Uh oh!

ghen2 commented Dec 21, 2022

Uh oh!

umagmrit commented Dec 21, 2022

Uh oh!

ghen2 commented Dec 21, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

umagmrit commented Dec 21, 2022

Uh oh!

umagmrit commented Dec 22, 2022

Uh oh!

ghen2 left a comment

Choose a reason for hiding this comment

Uh oh!

umagmrit commented Jan 5, 2023

Uh oh!

ghen2 commented Jan 5, 2023

Uh oh!

quanah commented Jan 8, 2023

Uh oh!

ghen2 commented Jan 9, 2023

Uh oh!

quanah commented Jan 9, 2023

Uh oh!

quanah commented Jan 17, 2023

Uh oh!

ghen2 commented Jan 17, 2023

Uh oh!

quanah commented Jan 17, 2023

Uh oh!

silentsakky commented Mar 8, 2023

Uh oh!

ghen2 commented May 31, 2023

Uh oh!

ghen2 commented Aug 1, 2023

Uh oh!

ghen2 commented Aug 2, 2023

Uh oh!

ghen2 commented Sep 27, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ghen2 commented Dec 21, 2022 •

edited

Loading