Archive for July, 2009

LDAP: A quick way to get the number of subentries

July 20th, 2009 1 comment

I actually manage a LDAP directory with a lot of entries (almost 1,5 millions entries in the same OU). In order to check the replication state, I was looking for a way to count the number of entries in this OU. Thanks to Ludovic Poitou (once again), this information is available via an hidden attribute in the OU.

% ldapsearch -Wxh ldap1 -D "cn=Directory Manager" -b 'ou=people,ou=ssousers,dc=asyd,dc=net' -s base '(objectClass=*)' 'numsubordinates'
dn: ou=people,ou=ssousers,dc=asyd,dc=net
numsubordinates: 1386931

Depends on the directory server, it’s also possible to get the number of entries for a given backend (the following code was tested for Sun Directory Server 5.2):

% ldapsearch -Wxh ldap1 -D 'cn=Directory Manager' -b 'cn=monitor' -s base '(objectclass=*)' 'backendmonitordn'
dn: cn=monitor
backendmonitordn: cn=monitor,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
backendmonitordn: cn=monitor,cn=ssoUsers,cn=ldbm database,cn=plugins,cn=config
backendmonitordn: cn=monitor,cn=NetscapeRoot,cn=ldbm database,cn=plugins,cn=config

% ldapsearch -Wxh lynx -D 'cn=Directory Manager' -b 'cn=monitor,cn=ssoUsers,cn=ldbm database,cn=plugins,cn=config' -s base '(objectclass=*)' 'ldapentrycount'
dn: cn=monitor, cn=ssoUsers, cn=ldbm database, cn=plugins, cn=config
ldapentrycount: 1408974

Categories: Sysadmin Tags:

How to convert a PKCS#12 to JKS

July 2nd, 2009 6 comments

Most of system administrators use OpenSSL (which is not a good idea, but it’s an another story) to manage their PKI. While OpenSSL is good to create/convert X509 certificates from PEM/DER to PKCS#12 (and vice versa, for sure) it doesn’t understand the JKS (Java KeyStore) format. JKS are used in Java world, for example Glassfish application server, OpenDS and so more. In this post, I’ll explain how to convert a PKCS#12 to a JKS using portecle. portecle is a small, but very useful application (written in Java) to manipulate keystores.

  1. Download portecle, extract it, and lauch it using java -jar portecle.jar (note that Java 6 seems required for version 1.4.x)
  2. Open your PKCS#12 file, provide the password
  3. Click on Tools/Change KeyStore Type/JKS menu
  4. If you don’t want to use the default password (which is password), click on the menu keystore password
  5. Save it, that’s all folks!

You can know list the contents of your JKS using keytool:

% keytool -list -v -keystore yourkeystore.jks

Categories: Security, Sysadmin Tags: