389-users October 2005

389-users@lists.fedoraproject.org

31 participants
32 discussions

Re: [Fedora-directory-users] MD5 for password hashes
by Del 16 Nov '05

16 Nov '05

Hi, I did some digging on this issue. I suspect I have found a bug in Fedora Directory Server handling the importing of MD5 passwords, either that or the current download versions don't support MD5. The results are as follows: -- Run this command on OpenLDAP to set a user's password: ldappasswd -x -D 'uid=root,ou=People,dc=babel,dc=com,dc=au' -W -S 'uid=del,ou=People,dc=babel,dc=com,dc=au' Do a simple ldapsearch as that user, to verify that the password is correct: ldapsearch -x -D 'uid=del,ou=People,dc=babel,dc=com,dc=au' -W 'uid=del' If you have set your OpenLDAP permissions to be relatively transparent, the above ldapsearch will show a base64 representation of your password hash. It looks like this: userPassword:: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= You can un-base64 this hash with the following simple perl script: #!/usr/bin/perl # # Usage: $0 string # use MIME::Base64; my $data = $ARGV[0]; print("Input string is " . $data . "n"); $decoded = decode_base64($data); print("Decoded string is " . $decoded . "n"); You will see that the password contains the prefix {MD5}, which looks like this: Decoded string is {MD5}asdfasdfasdfasdfasdf== Import your OpenLDAP directory into Fedora Directory Server. I used LdapImport for this although I also tried it with ldif2db. What happens during the process of LdapImport is: * Passwords of type {CRYPT} are transferred across OK to the FedoraDirectoryServer. * Passwords of type {MD5} appear in the FedoraDirectoryServer as strings beginning with {SSHA}. This can be verified by examining the directory using GQ or a similar LDAP tool, while bound as "cn=Directory Manager". * Attempts to authenticate with the original password now fail. * Attempting to authenticate as the full MD5 string (i.e. use the hash string '{MD5}asdfasdf...==' as extracted from the OpenLDAP server as the password for Fedora Directory Server) in fact works. I expect that what has happened is that Fedora Directory Server has failed to recognise the {MD5} at the beginning of the string as a valid hash mechanism and re-encoded the entire string as an SSHA hash. I see that on the FDS wiki there is mention of MD5 hashing support being added on June 15th. I have fedora-ds-7.1-2.RHEL4 installed from the RPM I downloaded from the FDS web site. How do I verify that this version should have the MD5 support, or do I need a more recent version? -- Del

3 9

[Fedora-directory-users] Re: help for building FDS
by speedy zinc 14 Nov '05

14 Nov '05

Whoa, your replies already showed up in the archive, and I haven't received yet. What kind of email server does yahoo have??? Anyway, following Rob's suggestion, I did the patch, and it can get pass that issue. Rich, I have perl in my path (perl v5.8.3), but I don't think the build script actually generated the files oiddata.h/c. Both files are there, but the last modify time seems to date back to 2002-01-04. And the oidgen.perl is there too. Now, I'm getting a new problem: rm -f .libs/client.lo cc -DHAVE_CONFIG_H -I. -I. -I.. -I../include -I../plugins -I../include -I/tmp/fedora-ds-build/include -I/tmp/fedora-ds-build/include -I/tmp/fedora-ds-build/include -Wall -W -I/tmp/fedora-ds-build/include -L/tmp/fedora-ds-build/lib -O2 -pipe -I/tmp/fedora-ds-build/include -L/tmp/fedora-ds-build/lib -O2 -pipe -I/tmp/fedora-ds-build/include -L/tmp/fedora-ds-build/lib -O2 -pipe -MT client.lo -MD -MP -MF .deps/client.Tpo -c client.c -fPIC -DPIC -o .libs/client.lo client.c:64: error: static declaration of 'global_callbacks' follows non-static declaration saslint.h:112: error: previous declaration of 'global_callbacks' was here make[4]: *** [client.lo] Error 1 make[4]: Leaving directory `/home/csp/redhat/dsbuild/ds/cyrus-sasl/work/cyrus-sasl-2.1.20/lib' make[3]: *** [all-recursive] Error 1 make[3]: Leaving directory `/home/csp/redhat/dsbuild/ds/cyrus-sasl/work/cyrus-sasl-2.1.20' make[2]: *** [all] Error 2 make[2]: Leaving directory `/home/csp/redhat/dsbuild/ds/cyrus-sasl/work/cyrus-sasl-2.1.20' make[1]: *** [build-work/cyrus-sasl-2.1.20/Makefile] Error 2 make[1]: Leaving directory `/home/csp/redhat/dsbuild/ds/cyrus-sasl' make: *** [dep-../../ds/cyrus-sasl] Error 2 :( thx sz __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

4 18

[Fedora-directory-users] AD sync
by Darjo Gregoric 03 Nov '05

03 Nov '05

Hi, I have a problem with AD sync. I have established synchronization without SSL and works fine, but when I use SSL, connection is not established and I receive error: Simple bind failed, LDAP sdk error 81 (Can't contact LDAP server), Netscape Portable Runtime error -8179 (Peer's Certificate issuer is not recognized.) AD machine name is suzy. I have exported CA and imported it on Directory server. Certutil -L -d . gives: CA certificate CTu,u,u suzy CT,, Server-Cert u,u,u Did i miss something? Is there any HOW TO for this type of configuration? Regards Darjo

2 2

[Fedora-directory-users] Fedora Management Console 7.0
by Anthony Gabila 31 Oct '05

31 Oct '05

Hi, Not quite sure how to solve this problem, I'm trying to add a user via Fedora Management Console, but I am not able to log in to my Win2k Pro machine using that username. I manage to get around this problem by entering the command "smbpasswd -a testuser" I was wondering if I could skip this extra step by doing all these in the Management Console app? agabila

2 1

[Fedora-directory-users] openlda client and fedora-ds
by Enrico Valsecchi 28 Oct '05

28 Oct '05

Dear All, I'm install with your help my fedora-ds. Many thanks! Well, into my linux box are installed openldapclient, and I want browse my ldap dir content. O.K., i type: ldapsearch -L -b "dc=chiccomara,dc=org" -W "(objectclass=*)" LDAP server request a password. I type LDAP password, and result is: SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: Where is a problem? Many thanks, Enrico Valsecchi

2 1

[Fedora-directory-users] openlda client and fedora-ds
by Enrico Valsecchi 28 Oct '05

28 Oct '05

2 1

[Fedora-directory-users] Aboout Winsync
by joe 27 Oct '05

27 Oct '05

Hi! I followed the steps of Red Hat document to implement Windows 2000 sync with FDS. After my "initial re-synchronization" process was done, I checked my directory tree. I saw some entries like "cn=Domain Admins, ou=People, dc=example, dc=com", and it contained "Members/Static Group - uid=Administrator, , ou=People, dc=example, dc=com" in its properties. But I could not find the real entry dn named "uid=Administrator, , ou=People, dc=example, dc=com" in my ds tree. Is it the correct result? Or I did something wrong with configuration. Please tell me how to fix the problem. Thanks a lot. Regards Joe Yu

4 6

[Fedora-directory-users] Using 'localhost' for configuration directory
by George Holbert 27 Oct '05

27 Oct '05

If each directory server in an environment will be acting as its own configuration directory (i.e., for o=NetscapeRoot stuff), is it ok to just use 'localhost' as the value for the configuration directory server? Or, is it better/required to use the FQDN of the public network interface (e.g., ldaphost.example.com)? Thanks, -- George

2 1

[Fedora-directory-users] Very NewBye
by Enrico Valsecchi 27 Oct '05

27 Oct '05

Dear All, I'm a very newbye user of fedora-directory .... To start, I have a big problem! :-( Well, I have downloaded and installed from rpm package. O.K., I'm creat a .inf file, wit this content: [General] FullMachineName= localhost.localdomain SuiteSpotUserID= ldap ServerRoot= /opt/ldapserver [slapd] ServerPort= 389 ServerIdentifier= localhost Suffix= dc=localhost,dc=localdomain RootDN= cn=Directory Manager RootDNPwd= password and I'm go to /opt/fedora-ds/bin/slapd/admin/bin. Run perl ds_newinst.pl my_new_inf_file O.K., Perl script run and at console I retry this message: CGI /opt/ldapserver/bin/slapd/admin/bin/ds_newinst failed with 1: here is the output: Content-type: text/plain error:could not create server localhost - Could not write /opt/ldapserver/bin/slapd/admin/scripts/template-ldif2db.pl to /opt/ldapserver/slapd-localhost/ldif2db.pl (No such file or director). NMC_Status: 1 Error: could not run /opt/ldapserver/bin/slapd/admin/bin/ds_newinst: 1 Error: Could not create new directory server instance User "nobody" are o.k. into my system, and permission /opt/ldapserver is nobody.root with write permission on user, group and read to all Some people have a solutions? Many thanks, Enrico

4 7

[Fedora-directory-users] libdb problem on setup
by Chad Elwartowski 27 Oct '05

27 Oct '05

I'm trying to install the Fedora Directory and run into errors after executing the setup program. I'm running Redhat Linux: %uname -a Linux myhostname 2.6.9-5.ELsmp #1 SMP Wed Jan 5 19:30:39 EST 2005 i686 i686 i386 GNU/Linux I've downloaded the rpm: fedora-ds-7.1-2.RHEL4.i386.opt.rpm and installed it (rpm -iv ...). I cd into /opt/fedora-ds and run: ./setup/setup After entering my information in any of the three installation levels I get the error: - Fedora-Directory/7.1 B2005.146.2010 starting up - libdb: unable to initialize mutex: Function not implemented - libdb: /opt/fedora-ds/slapd-myhostname/db/__db.001: unable to initialize environment lock: Function not implemented - start: Failed to init database, err=38 Function not implemented etc...(I can't cut and paste into email so I'd have to type the rest, which is quite a bit) I've gone the route of re-installing the RPM then running the perl ds_newinst.pl /opt/fedora-ds/setup/install.inf (with the install.inf edited for my settings) That resulted in a "Success", but then looking in the fedora logs it shows the same error above as far as the libdb:... Neither allow me to get access using startconsole. My LD_LIBRARY_PATH includes /opt/fedora-ds/lib My PATH includes /opt/fedora-ds/bin/base/jre/bin My CLASSPATH includes /opt/fedora-ds/bin/base/jre/bin:/opt/fedora-ds/java:/opt/fedora-ds/java/jars:/opt/fedora-ds/bin/base/jre/lib:/opt/fedora-ds/bin/base/jre/lib/ext:/opt/fedora-ds/bin/base/jre/bin/classic My JAVA_HOME is /opt/fedora-ds/java Can anyone point me in the right direction to get past this problem? Thanks, Chad

3 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users October 2005