# Fetch port services from LDAP server

**URL:** <https://forums.suse.com/t/fetch-port-services-from-ldap-server/29202>\
**Category:** SLES Configure-Administer\
**Created:** [January 5, 2017, 3:37pm UTC](https://forums.suse.com/t/fetch-port-services-from-ldap-server/29202 "2017-01-05T15:37:18Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![srisum0728](https://avatars.discourse-cdn.com/v4/letter/s/4491bb/32.png) [@srisum0728](https://forums.suse.com/u/srisum0728)\
**Post date:** [January 5, 2017, 3:37pm UTC](https://forums.suse.com/t/fetch-port-services-from-ldap-server/29202/1 "2017-01-05T15:37:18Z")

</div>

Hi,

We have a ldap server configured with services (port) and want to know how to fetch that to the ldap clients:

# cat /etc/nsswitch.conf|grep -i services

services: files sss (neither sss nor ldap works)

by doing “#getent services” I am getting only the result from /etc/services but I need to fetch all the services entry from LDAP server.

LDAP server:  
Objectclass top  
Objectclass Organizationunit  
ou Services

Do we have to add anything on sssd.conf or ldap.conf ?

Thanks in advance!

Regards,  
Sridaran G

---

<div class="post-metadata">

**Author:** ![Lawrence1](https://avatars.discourse-cdn.com/v4/letter/l/e56c9b/32.png) [@Lawrence1](https://forums.suse.com/u/Lawrence1)\
**Post date:** [January 10, 2017, 5:38pm UTC](https://forums.suse.com/t/fetch-port-services-from-ldap-server/29202/2 "2017-01-10T17:38:43Z")

</div>

Sridaran,  
Hello!

How are you trying to fetch these attributes/values ?

Please be specific as to clients/utilities and commands/arguments, we’ll see if we can help.

– lawrence

---

<div class="post-metadata">

**Author:** ![srisum0728](https://avatars.discourse-cdn.com/v4/letter/s/4491bb/32.png) [@srisum0728](https://forums.suse.com/u/srisum0728)\
**Post date:** [January 12, 2017, 9:19am UTC](https://forums.suse.com/t/fetch-port-services-from-ldap-server/29202/3 "2017-01-12T09:19:19Z")

</div>

Hello Lawrence,

Thanks for responding!

Actually we contacted a consultant and we came to know there is a limitation set on LDAP query and it will not list all the port services configured in LDAP server. So you have to specify the exact port number to get the TCP/UDP port details from LDAP server EX:  
#getent services 24678 → this will search in /etc/services , if its not available then it will search in LDAP and give respective output.

We wanted to do below commands but its not possible itseems:  
#getent services → to list all the services in ldap.  
#getent serivces |grep -i 24678 → This is also not working but as mentioned above if we search without greping then its listing from LDAP server.

Also if we do ldapsearch its listing:

# ldapsearch -x -b “ou=Services,dc=xxx,dc=xxx” “ipServicePort=10000”

# extended LDIF

# 

# LDAPv3

# base \<ou=Services,dc=xxx,dc=xxx\> with scope subtree

# filter: ipServicePort=10000

# requesting: ALL

# 

# portapp + tcp, Services, xxx.xxx

dn: cn=portapp+ipServiceProtocol=tcp,ou=Services,dc=xxx,dc=xxx  
objectClass: top23  
objectClass: ipService  
cn: portMMI  
ipServiceProtocol: tcp  
ipServicePort: 10000

# search result

search: 2  
result: 0 Success

# numResponses: 2

# numEntries: 1

if we tried to search all the services w.r.t object class its not listing as the limit exceeding issue:

#ldapsearch -x -b “ou=Services,dc=xxx,dc=xxx” “objectclass=\*”

# extended LDIF

# 

# LDAPv3

# base \<ou=Services,dc=xxx,dc=xxx\> with scope subtree

# filter: objectclass=\*

# requesting: ALL

# 

# search result

search: 2  
result: 11 Administrative limit exceeded

# numResponses: 1

Regards,  
Sridaran G

---

<div class="post-metadata">

**Author:** ![Lawrence1](https://avatars.discourse-cdn.com/v4/letter/l/e56c9b/32.png) [@Lawrence1](https://forums.suse.com/u/Lawrence1)\
**Post date:** [January 13, 2017, 2:08pm UTC](https://forums.suse.com/t/fetch-port-services-from-ldap-server/29202/4 "2017-01-13T14:08:49Z")

</div>

ahhh, firstly well done.

The limit you are exceeding is most likely the search result limitation imposed by the LDAP back end. Your first step in this situation should be to apply a filter to the search to reduce the enumeration of the possible results.

#~ ldapsearch -x -b “ou=Services,dc=xxx,dc=xxx” “objectclass=ipService”

If that fails you may be able to page search results to the limit imposed by the LDAP back end.

#~ ldapsearch -x -E pr=200/prompt -b “ou=Services,dc=xxx,dc=xxx” “objectclass=ipService”

(prompting you to press a key to see each set of 200 search results)

“Possibly” circumvent the search result limitation imposed by the LDAP back ends entirely, as with Active Directory and possibly others (then grep).

#~ ldapsearch -x -E pr=2147483647/noprompt -b “ou=Services,dc=xxx,dc=xxx” “objectclass=ipService”

The last is an extreme example that would likely only be useful if you had tens of thousands of ipService class objects, but is provided here to be an example for other types of broad searches, like searching a large directory for all user class objects and grepping for a specific text string found in an attribute common to that class.

#~ ldapsearch -x -E pr=2147483647/noprompt -b “ou=Users,dc=xxx,dc=xxx” “(&(objectclass=inetOrgPerson”)(displayName=\*)) | grep -i Smith

Hope it helps!

– lawrence

---

<div class="post-metadata">

**Author:** ![srisum0728](https://avatars.discourse-cdn.com/v4/letter/s/4491bb/32.png) [@srisum0728](https://forums.suse.com/u/srisum0728)\
**Post date:** [January 13, 2017, 2:43pm UTC](https://forums.suse.com/t/fetch-port-services-from-ldap-server/29202/5 "2017-01-13T14:43:50Z")

</div>

Hello Lawrence,

Thanks alot, you are genius 🙂  
The greping large directory for all user class object is very useful!!!

The enumeration is working for the search which is listing the entire entries in ldap like “ldapsearch -x -E pr=200/prompt uid=\*” which was very very useful but for ipService its not listing.

The output:  
ldapsearch -x -E pr=200/prompt -b “ou=Services,dc=xxx,dc=xxx” “objectclass=ipService”

# extended LDIF

# 

# LDAPv3

# base \<ou=Services,dc=xxx,dc=xxx\> with scope subtree

# filter: objectclass=ipService

# requesting: ALL

# with pagedResults control: size=200

# 

# search result

search: 2  
result: 11 Administrative limit exceeded

# numResponses: 1

The output with Debug mode enabled:

ldapsearch -d1 -x -E pr=200/prompt -b “ou=Services,dc=xxx,dc=xxx” “objectclass=ipService”  
ldap\_create  
ldap\_sasl\_bind  
ldap\_send\_initial\_request  
ldap\_new\_connection 1 1 0  
ldap\_int\_open\_connection  
ldap\_connect\_to\_host: TCP hostname:389  
ldap\_new\_socket: 3  
ldap\_prepare\_socket: 3  
ldap\_connect\_to\_host: Trying xx.xx.xx.xx:389  
ldap\_pvt\_connect: fd: 3 tm: -1 async: 0  
ldap\_open\_defconn: successful  
ldap\_send\_server\_request  
ber\_scanf fmt ({it) ber:  
ber\_scanf fmt ({i) ber:  
ber\_flush2: 14 bytes to sd 3  
ldap\_result ld 0x7f5feasdfad230 msgid 1  
wait4msg ld 0x7asdffecad343 msgid 1 (infinite timeout)  
wait4msg continue ld 0x7f5sdfewad230 msgid 1 all 1  
\*\* ld 0x7f59sadfwd12 Connections:

- host: hostname port: 389 (default)  
refcnt: 2 status: Connected  
last used: Fri Jan 13 13:31:41 2017

\*\* ld 0x7f5asdfcad567 Outstanding Requests:

- msgid 1, origid 1, status InProgress  
outstanding referrals 0, parent count 0  
ld 0x7f5asdfad567 request count 1 (abandoned 0)  
\*\* ld 0x7f59feasdfd567 Response Queue:  
Empty  
ld 0x7f59fasdfd567 response count 0  
ldap\_chkResponseList ld 0x7f59feasdf567 msgid 1 all 1  
ldap\_chkResponseList returns ld 0x7fasdfcad567 NULL  
ldap\_int\_select  
read1msg: ld 0x7fasfecad567 msgid 1 all 1  
ber\_get\_next  
ber\_get\_next: tag 0x30 len 12 contents:  
read1msg: ld 0x7asfsfcad567 msgid 1 message type bind  
ber\_scanf fmt ({eAA) ber:  
read1msg: ld 0x7fsafdcad567 0 new referrals  
read1msg: mark request completed, ld 0x7fasdfcad567 msgid 1  
request done: ld 0x7fasdfsfd567 msgid 1  
res\_errno: 0, res\_error: \<\>, res\_matched: \<\>  
ldap\_free\_request (origid 1, msgid 1)  
ldap\_parse\_result  
ber\_scanf fmt ({iAA) ber:  
ber\_scanf fmt (}) ber:  
ldap\_msgfree

# extended LDIF

# 

# LDAPv3

# base \<ou=Services,dc=xxx,dc=xxx\> with scope subtree

# filter: objectclass=ipService

# requesting: ALL

# with pagedResults control: size=200

# 

ldap\_search\_ext  
put\_filter: “objectclass=ipService”  
put\_filter: default  
put\_simple\_filter: “objectclass=ipService”  
ldap\_send\_initial\_request  
ldap\_send\_server\_request  
ber\_scanf fmt ({it) ber:  
ber\_scanf fmt ({) ber:  
ber\_flush2: 123 bytes to sd 3  
ldap\_result ld 0x7f5sadfad567 msgid -1  
wait4msg ld 0x7f5asdfad567 msgid -1 (infinite timeout)  
wait4msg continue ld 0x7asdfecad567 msgid -1 all 0  
\*\* ld 0x7f59fasdf567 Connections:

- host: hostname port: 389 (default)  
refcnt: 2 status: Connected  
last used: Fri Jan 13 13:31:41 2017

\*\* ld 0x7f5asdfd567 Outstanding Requests:

- msgid 2, origid 2, status InProgress  
outstanding referrals 0, parent count 0  
ld 0x7f59feasf567 request count 1 (abandoned 0)  
\*\* ld 0x7f5asfad567 Response Queue:  
Empty  
ld 0x7f59fsafd567 response count 0  
ldap\_chkResponseList ld 0x7f59fsdf567 msgid -1 all 0  
ldap\_chkResponseList returns ld 0x7f59fasdfd567 NULL  
ldap\_int\_select  
read1msg: ld 0x7f5sadfad567 msgid -1 all 0  
ber\_get\_next  
ber\_get\_next: tag 0x30 len 12 contents:  
read1msg: ld 0x7fasdfecad567 msgid 2 message type search-result  
ber\_scanf fmt ({eAA) ber:  
read1msg: ld 0x7f59fasdfd567 0 new referrals  
read1msg: mark request completed, ld 0xasdffecad230 msgid 2  
request done: ld 0x7asdfsafda1445 msgid 2  
res\_errno: 11, res\_error: \<\>, res\_matched: \<\>  
ldap\_free\_request (origid 2, msgid 2)

# search result

search: 2  
ldap\_parse\_result  
ber\_scanf fmt ({iAA) ber:  
ber\_scanf fmt (}) ber:  
ldap\_err2string  
result: 11 Administrative limit exceeded  
ldap\_msgfree

# numResponses: 1

ldap\_free\_connection 1 1  
ldap\_send\_unbind  
ber\_flush2: 7 bytes to sd 3  
ldap\_free\_connection: actually freed

Regards,  
Sridaran G

---

<div class="post-metadata">

**Author:** ![Lawrence1](https://avatars.discourse-cdn.com/v4/letter/l/e56c9b/32.png) [@Lawrence1](https://forums.suse.com/u/Lawrence1)\
**Post date:** [January 13, 2017, 5:11pm UTC](https://forums.suse.com/t/fetch-port-services-from-ldap-server/29202/6 "2017-01-13T17:11:40Z")

</div>

…hmmm. Possibly something remarkable about the object that requires a proper filter format. Just as a test, try the following to see if the issue is with the paging of the class/attribute format:

#~ ldapsearch -x -E pr=2147483647/noprompt -b “ou=Services,dc=xxx,dc=xxx” “(&(objectclass=ipService)(ipServicePort=\*))”

– lawrence

---

<div class="post-metadata">

**Author:** ![srisum0728](https://avatars.discourse-cdn.com/v4/letter/s/4491bb/32.png) [@srisum0728](https://forums.suse.com/u/srisum0728)\
**Post date:** [January 19, 2017, 12:58pm UTC](https://forums.suse.com/t/fetch-port-services-from-ldap-server/29202/7 "2017-01-19T12:58:39Z")

</div>

Hi Lawrence,

Apologies for delay in response.

Please find the output below:

# ldapsearch -x -E pr=2147483647/noprompt -b “ou=Services,dc=xxx,dc=xxx” “(&(objectclass=ipService)(ipServicePort=\*))”

# extended LDIF

# 

# LDAPv3

# base \<ou=Services,dc=xxx,dc=xxx\> with scope subtree

# filter: (&(objectclass=ipService)(ipServicePort=\*))

# requesting: ALL

# with pagedResults control: size=2147483647

# 

# search result

search: 2  
result: 11 Administrative limit exceeded  
text: illegal pagedResults page size

# numResponses: 1

Kind Regards,  
Sridaran G