"ldapadduser" adds the user and hangs

[Zaphod]

I followed this guide
https://help.ubuntu.com/10.04/serverguide/C/openldap-server.html

I have installed the ldapscripts package and when I use the command "ldapadduser <user> <group>"
It says the user has been added to LDAP but then it hangs if I press CTRL-C I can see the user has been added but the user has not been added to the group. I can then manually add the user to the group.

There seams to be some issue with the "ldapadduser" command.

[Josejulio (josejulio)]

I also have this problem. followed the guide as well.

[Serge Hallyn (serge-hallyn)]

Could you try doing

   strace -f -o/tmp/strace.out ldapadduser <user> <group>

and see where it it hangs? Assuming it is the server and not the client
which hangs, then you'll probably want to do

    p=`pidof slapd`
    strace -f -o/tmp/strace2.out -p $p

and leave that running while you do the ldapadduser command in another
terminal. (Please make sure there is no sensitive information before
posting that, but I assume this is all test data?)

[Simon Kelsall (simon-kelsall)]

I get this to,

[Dave Moore (d-moore)]

I had the same issue and it was possible to work around by changing the password generation method.
In /etc/ldapscripts/ldapscripts.conf change to PASSWORDGEN="pwgen" and apt-get install pwgen. I'm sure other methods may work.
It would seem that the default password gen
PASSWORDGEN="cat /dev/random | LC_ALL=C tr -dc 'a-zA-Z0-9' | head -c8"
causes the hang for me.

[Dave Walker (davewalker)]

This seems to indicate that there isn't enough entropy to generate the password from /dev/random.

[Dave Walker (davewalker)]

Subscribing ~ubuntu-security for an 'ack'.

I imagine that on a well populated server, gaining the entropy isn't an issue. However, that isn't a clean default solution.

It seems to me that we have two options:
 * Use the /dev/urandom which seems less than ideal.
 * Use pwgen (main), with -s.

Security Team, can you comment on these proposed default settings?

Thanks.

[Marc Deslauriers (mdeslaur)]

pwgen uses urandom, so you might as well simply switch to /dev/urandom. Although less ideal than using /dev/random, it is probably okay for generating initial 8-character passwords.

[Marc Deslauriers (mdeslaur)]

As discussed on irc, I now recommend we use pwgen, so we don't drain the entropy, and we make sure we have a password that has the correct length.

[Dave Walker (davewalker)]

Attached is a debdiff for Maverick. Submitted patch to debian.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ldapscripts - 1.9.0-2ubuntu1

---------------
ldapscripts (1.9.0-2ubuntu1) maverick; urgency=low

  * etc/ldapscripts.conf: Changed default password generation for initial
    usage. Now uses "pwgen", as there is often not enough entropy to
    use the previous default, causing blocking/freezing. (LP: #602540)
  * debian/control:
    - Depend on pwgen.
    - Updated maintainer field to reflect policy.
 -- Dave Walker (Daviey) <email address hidden> Mon, 09 Aug 2010 17:18:37 +0100

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".