October 2005 - 389-users - Fedora mailing-lists

Re: [Fedora-directory-users] MD5 for password hashes
by Del 16 Nov '05

16 Nov '05

Hi, I did some digging on this issue. I suspect I have found a bug in Fedora Directory Server handling the importing of MD5 passwords, either that or the current download versions don't support MD5. The results are as follows: -- Run this command on OpenLDAP to set a user's password: ldappasswd -x -D 'uid=root,ou=People,dc=babel,dc=com,dc=au' -W -S 'uid=del,ou=People,dc=babel,dc=com,dc=au' Do a simple ldapsearch as that user, to verify that the password is correct: ldapsearch -x -D 'uid=del,ou=People,dc=babel,dc=com,dc=au' -W 'uid=del' If you have set your OpenLDAP permissions to be relatively transparent, the above ldapsearch will show a base64 representation of your password hash. It looks like this: userPassword:: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= You can un-base64 this hash with the following simple perl script: #!/usr/bin/perl # # Usage: $0 string # use MIME::Base64; my $data = $ARGV[0]; print("Input string is " . $data . "n"); $decoded = decode_base64($data); print("Decoded string is " . $decoded . "n"); You will see that the password contains the prefix {MD5}, which looks like this: Decoded string is {MD5}asdfasdfasdfasdfasdf== Import your OpenLDAP directory into Fedora Directory Server. I used LdapImport for this although I also tried it with ldif2db. What happens during the process of LdapImport is: * Passwords of type {CRYPT} are transferred across OK to the FedoraDirectoryServer. * Passwords of type {MD5} appear in the FedoraDirectoryServer as strings beginning with {SSHA}. This can be verified by examining the directory using GQ or a similar LDAP tool, while bound as "cn=Directory Manager". * Attempts to authenticate with the original password now fail. * Attempting to authenticate as the full MD5 string (i.e. use the hash string '{MD5}asdfasdf...==' as extracted from the OpenLDAP server as the password for Fedora Directory Server) in fact works. I expect that what has happened is that Fedora Directory Server has failed to recognise the {MD5} at the beginning of the string as a valid hash mechanism and re-encoded the entire string as an SSHA hash. I see that on the FDS wiki there is mention of MD5 hashing support being added on June 15th. I have fedora-ds-7.1-2.RHEL4 installed from the RPM I downloaded from the FDS web site. How do I verify that this version should have the MD5 support, or do I need a more recent version? -- Del

3 9

[Fedora-directory-users] Re: help for building FDS
by speedy zinc 14 Nov '05

14 Nov '05

Whoa, your replies already showed up in the archive, and I haven't received yet. What kind of email server does yahoo have??? Anyway, following Rob's suggestion, I did the patch, and it can get pass that issue. Rich, I have perl in my path (perl v5.8.3), but I don't think the build script actually generated the files oiddata.h/c. Both files are there, but the last modify time seems to date back to 2002-01-04. And the oidgen.perl is there too. Now, I'm getting a new problem: rm -f .libs/client.lo cc -DHAVE_CONFIG_H -I. -I. -I.. -I../include -I../plugins -I../include -I/tmp/fedora-ds-build/include -I/tmp/fedora-ds-build/include -I/tmp/fedora-ds-build/include -Wall -W -I/tmp/fedora-ds-build/include -L/tmp/fedora-ds-build/lib -O2 -pipe -I/tmp/fedora-ds-build/include -L/tmp/fedora-ds-build/lib -O2 -pipe -I/tmp/fedora-ds-build/include -L/tmp/fedora-ds-build/lib -O2 -pipe -MT client.lo -MD -MP -MF .deps/client.Tpo -c client.c -fPIC -DPIC -o .libs/client.lo client.c:64: error: static declaration of 'global_callbacks' follows non-static declaration saslint.h:112: error: previous declaration of 'global_callbacks' was here make[4]: *** [client.lo] Error 1 make[4]: Leaving directory `/home/csp/redhat/dsbuild/ds/cyrus-sasl/work/cyrus-sasl-2.1.20/lib' make[3]: *** [all-recursive] Error 1 make[3]: Leaving directory `/home/csp/redhat/dsbuild/ds/cyrus-sasl/work/cyrus-sasl-2.1.20' make[2]: *** [all] Error 2 make[2]: Leaving directory `/home/csp/redhat/dsbuild/ds/cyrus-sasl/work/cyrus-sasl-2.1.20' make[1]: *** [build-work/cyrus-sasl-2.1.20/Makefile] Error 2 make[1]: Leaving directory `/home/csp/redhat/dsbuild/ds/cyrus-sasl' make: *** [dep-../../ds/cyrus-sasl] Error 2 :( thx sz __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

4 18

[Fedora-directory-users] AD sync
by Darjo Gregoric 03 Nov '05

03 Nov '05

Hi, I have a problem with AD sync. I have established synchronization without SSL and works fine, but when I use SSL, connection is not established and I receive error: Simple bind failed, LDAP sdk error 81 (Can't contact LDAP server), Netscape Portable Runtime error -8179 (Peer's Certificate issuer is not recognized.) AD machine name is suzy. I have exported CA and imported it on Directory server. Certutil -L -d . gives: CA certificate CTu,u,u suzy CT,, Server-Cert u,u,u Did i miss something? Is there any HOW TO for this type of configuration? Regards Darjo

2 2

[Fedora-directory-users] Fedora Management Console 7.0
by Anthony Gabila 31 Oct '05

31 Oct '05

Hi, Not quite sure how to solve this problem, I'm trying to add a user via Fedora Management Console, but I am not able to log in to my Win2k Pro machine using that username. I manage to get around this problem by entering the command "smbpasswd -a testuser" I was wondering if I could skip this extra step by doing all these in the Management Console app? agabila

2 1

[Fedora-directory-users] openlda client and fedora-ds
by Enrico Valsecchi 28 Oct '05

28 Oct '05

Dear All, I'm install with your help my fedora-ds. Many thanks! Well, into my linux box are installed openldapclient, and I want browse my ldap dir content. O.K., i type: ldapsearch -L -b "dc=chiccomara,dc=org" -W "(objectclass=*)" LDAP server request a password. I type LDAP password, and result is: SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: Where is a problem? Many thanks, Enrico Valsecchi

2 1

[Fedora-directory-users] openlda client and fedora-ds
by Enrico Valsecchi 28 Oct '05

28 Oct '05

Dear All, I'm install with your help my fedora-ds. Many thanks! Well, into my linux box are installed openldapclient, and I want browse my ldap dir content. O.K., i type: ldapsearch -L -b "dc=chiccomara,dc=org" -W "(objectclass=*)" LDAP server request a password. I type LDAP password, and result is: SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: Where is a problem? Many thanks, Enrico Valsecchi

2 1

[Fedora-directory-users] Aboout Winsync
by joe 27 Oct '05

27 Oct '05

Hi! I followed the steps of Red Hat document to implement Windows 2000 sync with FDS. After my "initial re-synchronization" process was done, I checked my directory tree. I saw some entries like "cn=Domain Admins, ou=People, dc=example, dc=com", and it contained "Members/Static Group - uid=Administrator, , ou=People, dc=example, dc=com" in its properties. But I could not find the real entry dn named "uid=Administrator, , ou=People, dc=example, dc=com" in my ds tree. Is it the correct result? Or I did something wrong with configuration. Please tell me how to fix the problem. Thanks a lot. Regards Joe Yu

4 6

[Fedora-directory-users] Using 'localhost' for configuration directory
by George Holbert 27 Oct '05

27 Oct '05

If each directory server in an environment will be acting as its own configuration directory (i.e., for o=NetscapeRoot stuff), is it ok to just use 'localhost' as the value for the configuration directory server? Or, is it better/required to use the FQDN of the public network interface (e.g., ldaphost.example.com)? Thanks, -- George

2 1

[Fedora-directory-users] Very NewBye
by Enrico Valsecchi 27 Oct '05

27 Oct '05

Dear All, I'm a very newbye user of fedora-directory .... To start, I have a big problem! :-( Well, I have downloaded and installed from rpm package. O.K., I'm creat a .inf file, wit this content: [General] FullMachineName= localhost.localdomain SuiteSpotUserID= ldap ServerRoot= /opt/ldapserver [slapd] ServerPort= 389 ServerIdentifier= localhost Suffix= dc=localhost,dc=localdomain RootDN= cn=Directory Manager RootDNPwd= password and I'm go to /opt/fedora-ds/bin/slapd/admin/bin. Run perl ds_newinst.pl my_new_inf_file O.K., Perl script run and at console I retry this message: CGI /opt/ldapserver/bin/slapd/admin/bin/ds_newinst failed with 1: here is the output: Content-type: text/plain error:could not create server localhost - Could not write /opt/ldapserver/bin/slapd/admin/scripts/template-ldif2db.pl to /opt/ldapserver/slapd-localhost/ldif2db.pl (No such file or director). NMC_Status: 1 Error: could not run /opt/ldapserver/bin/slapd/admin/bin/ds_newinst: 1 Error: Could not create new directory server instance User "nobody" are o.k. into my system, and permission /opt/ldapserver is nobody.root with write permission on user, group and read to all Some people have a solutions? Many thanks, Enrico

4 7

[Fedora-directory-users] libdb problem on setup
by Chad Elwartowski 27 Oct '05

27 Oct '05

I'm trying to install the Fedora Directory and run into errors after executing the setup program. I'm running Redhat Linux: %uname -a Linux myhostname 2.6.9-5.ELsmp #1 SMP Wed Jan 5 19:30:39 EST 2005 i686 i686 i386 GNU/Linux I've downloaded the rpm: fedora-ds-7.1-2.RHEL4.i386.opt.rpm and installed it (rpm -iv ...). I cd into /opt/fedora-ds and run: ./setup/setup After entering my information in any of the three installation levels I get the error: - Fedora-Directory/7.1 B2005.146.2010 starting up - libdb: unable to initialize mutex: Function not implemented - libdb: /opt/fedora-ds/slapd-myhostname/db/__db.001: unable to initialize environment lock: Function not implemented - start: Failed to init database, err=38 Function not implemented etc...(I can't cut and paste into email so I'd have to type the rest, which is quite a bit) I've gone the route of re-installing the RPM then running the perl ds_newinst.pl /opt/fedora-ds/setup/install.inf (with the install.inf edited for my settings) That resulted in a "Success", but then looking in the fedora logs it shows the same error above as far as the libdb:... Neither allow me to get access using startconsole. My LD_LIBRARY_PATH includes /opt/fedora-ds/lib My PATH includes /opt/fedora-ds/bin/base/jre/bin My CLASSPATH includes /opt/fedora-ds/bin/base/jre/bin:/opt/fedora-ds/java:/opt/fedora-ds/java/jars:/opt/fedora-ds/bin/base/jre/lib:/opt/fedora-ds/bin/base/jre/lib/ext:/opt/fedora-ds/bin/base/jre/bin/classic My JAVA_HOME is /opt/fedora-ds/java Can anyone point me in the right direction to get past this problem? Thanks, Chad

3 4

[Fedora-directory-users] Sync AD
by Pedro Rodrigues 26 Oct '05

26 Oct '05

Hi Does anyone have a document like an howto that can explain how we can syncronize FDS with AD ? Anyone that have already do this . Thanks. -- Cumprimentos Cordiais, Pedro Rodrigues Tecnologias de Informação Centimfe - Centro Tecnológico da Indústria dos Moldes, Ferramentas Especiais e Plásticos Zona Industrial Rua da Espanha, Lote 8 Apartado 313 2431-904 Marinha Grande tel.: (+351) 244 545 600 email.: pedro.rodrigues(a)centimfe.com Web.: http://www.centimfe.com

6 18

[Fedora-directory-users] Schema Conversion
by D Canfield 26 Oct '05

26 Oct '05

I don't suppose anyone has found an easy way to convert OpenLDAP schema into fedora-ds compatible ldif files? We've got about 100 attributes defined, and I'm really not looking forward to entering them all by hand... Thanks DC

4 7

[Fedora-directory-users] Available Revisions
by Scott Boggs 26 Oct '05

26 Oct '05

I have just started using the Fedora-DS. I have to say that I am very impressed. I currently am turning my attention towards working with the server on a SE Linux platform. However, I was wondering if it is best to keep with the current static version that is provided via the source download site, or could I get the latest and greatest to see how in integrates. Thanks in advance and I look forward to my participation with all of you on this project..

3 3

[Fedora-directory-users] crypt password with AD ?
by Jón Björn Njálsson 25 Oct '05

25 Oct '05

Hi. Is there any way to sync FDS crypt passwords with Active Directory or do they have to be encrypted with SSHA ? Jon

3 2

[Fedora-directory-users] help for building FDS
by speedy zinc 19 Oct '05

19 Oct '05

Sorry to direct this question on this list. I've been trying to subscribe to the dev list 3 times in the last 3 days, but have never received the confirmation. Stupid yahoo email... I'm trying to build FDS on my Ubuntu 5.10 machine using dsbuild, I've installed on the required packages (db4-dev, krb5-dev, ncurses-dev, etc). But I got the following error: gmake[4]: Entering directory `/home/csp/redhat/dsbuild/ds/mozilla/work/mozilla/security/nss/lib/pki' gcc -o Linux2.6_x86_glibc_PTH_OPT.OBJ/asymmkey.o -c -O2 -fPIC -DLINUX1_2 -Di386 -D_XOPEN_SOURCE -DLINUX2_1 -ansi -Wall -pipe -DLINUX -Dlinux -D_POSIX_SOURCE -D_BSD_SOURCE -DHAVE_STRERROR -DXP_UNIX -DNSS_3_4_CODE -UDEBUG -DNDEBUG -D_REENTRANT -I../../../../dist/Linux2.6_x86_glibc_PTH_OPT.OBJ/include -I../../../../dist/public/nss -I../../../../dist/private/nss -I../../../../dist/public/nspr asymmkey.c In file included from ../../../../dist/private/nss/nsspki1.h:57, from nsspki.h:56, from asymmkey.c:39: ../../../../dist/private/nss/oiddata.h:46: error: array type has incomplete element type gmake[4]: *** [Linux2.6_x86_glibc_PTH_OPT.OBJ/asymmkey.o] Error 1 gmake[4]: Leaving directory `/home/csp/redhat/dsbuild/ds/mozilla/work/mozilla/security/nss/lib/pki' gmake[3]: *** [libs] Error 2 gmake[3]: Leaving directory `/home/csp/redhat/dsbuild/ds/mozilla/work/mozilla/security/nss/lib' gmake[2]: *** [libs] Error 2 gmake[2]: Leaving directory `/home/csp/redhat/dsbuild/ds/mozilla/work/mozilla/security/nss' make[1]: *** [build-custom] Error 2 make[1]: Leaving directory `/home/csp/redhat/dsbuild/ds/mozilla' make: *** [dep-../../ds/mozilla] Error 2 Somehow, looks like the file where nss_builtin_oids is defined was not included. Could someone give a hint on solving this problem? I have no problem running FDS on this machine, by converting the rpm package into a deb package with alien and installing it. Distro: Ubuntu 5.10 2.6.12-9-386 gcc/g++: gcc (GCC) 4.0.2 20050808 (prerelease) (Ubuntu 4.0.1-4ubuntu9) thanks a lot. sz __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

3 2

[Fedora-directory-users] where is the API and library?
by speedy zinc 19 Oct '05

19 Oct '05

Sorry if this question should be directed to the dev list. I want to write some programs that can use the FDS API to manipulate entries in the directory, but where can I find the API and libraries for FDS? The include directory is empty. thanks sz __________________________________ Start your day with Yahoo! - Make it your home page! http://www.yahoo.com/r/hs

2 1

[Fedora-directory-users] How is access control done?
by speedy zinc 19 Oct '05

19 Oct '05

Hi all, Sorry if the question is not FDS-specific. I'm a university student and trying to learn how LDAP is used in managing access control. I can setup FDS, create basic schema (mostly user information), setup postfix to use FDS as authentication server, set up PAM on linux to use FDS as authentication server, etc. But that's only limited to user authentication. Everyone is talking about how LDAP can be used to manage access, in fact, it is on every vendor's features list. But I've never seen a real example of how it is used. Maybe I'm dumb, but I just couldn't imagine how it is set up and used. Let's take the following scenario. I have a network of servers, running different services and applications. Let's say, I called my machines M1, M2, M3, and called the services S1, S2, S3. All machines runs all 3 services. I have 3 groups of users, G1, G2, G3. Now, the question is, how can use LDAP to manage access control of my users? Let's say, I want to let users in G1 to access S1 and S2 on M1 only. And here are the requirements: G1 -> M1(S1, S2) G2 -> M1(S3), M2(S1, S2, S3) G3 -> M3(S1, S2, S3) Maybe I'm not understanding the meaning of "access control" correctly. But I just could not figure out how to set up to achieve this goal. What I want to know, besides the standard schema for storing user information, how do I: - define the schema for storing access control information? - tell the servers and services that specific user has what access permissions? - define extensible schema, so that if I add more servers and applications to my network, I can add new access control information without having to re-design the schema? If I have to use any features that are specific to FDS (ie. non-standard), so be it. Gurus on this list, mind giving any hint on that? Or if anyone could give a real life example, that would great. Thanks in advance sz __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

5 13

[Fedora-directory-users] set of attributes?
by speedy zinc 18 Oct '05

18 Oct '05

Hi, Is it possible to add a set of attribute to an entry, instead of adding one by one? That would be like a struct in C, for example myattr { departmentnumber, manager } and I would access it (myattr.manager=john) or something like that. thanks sz __________________________________ Yahoo! Music Unlimited Access over 1 million songs. Try it free. http://music.yahoo.com/unlimited/

3 3

[Fedora-directory-users] IIS Authentication on FDS
by Nabeel Moidu 18 Oct '05

18 Oct '05

Hi I am not sure if this is the right forum to ask the question but..... Has anyone successfully done IIS authentication on Fedora Directory Server ?The only method i find on STfG is one given for Novel eDirectory?Will that work for FDS? Regards Nabeel Moidu System Administrator OnMobile Systems Inc www.onmobile.com <http://www.onmobile.com>

2 1

[Fedora-directory-users] Question about Kerberos and FDS
by speedy zinc 18 Oct '05

18 Oct '05

Hi, I've read the white paper "Red Hat Identity Management and Security Solutions", and on page 13, it said that Red Hat Directory Server supports a variety of authentication standards and technologies, including: - ... - Kerberos tickets via SASL/GSSAPI - ... What does that exactly mean? Does that mean RHDS can issue kerberos ticket out of the box? Or does that mean I need to setup a kerberos server and use RHDS as the backend for user information? And this one: - Impersonation (proxy) for multi-tier client applications. Could someone explain what does it mean and how can it be used? Thanks a lot sz __________________________________ Yahoo! Music Unlimited Access over 1 million songs. Try it free. http://music.yahoo.com/unlimited/

3 5

[Fedora-directory-users] Settings remembered?
by Vsevolod (Simon) Ilyushchenko 17 Oct '05

17 Oct '05

Hi, I've noticed that if you remove and reinstall FDS, the admin console tries to connect by default to the port that the admin server was running during the previous installation. So the settings are stored somewhere, I guess. I've run into a problem when I've moved a server behind a firewall. Even though I've reinstalled the RPM, the LDAP server still tries to connect to a replication slave which is no more accessible, I suppose due to some settings being stored somewhere. So the startup is hanging. I've looked for hidden files in root's home dir, but there are none. I'm removing the /opt/fedora-ds directory each time after removing the RPM, so that's not it either. Where else could the settings be stored? Thanks, Simon -- Simon (Vsevolod ILyushchenko) simonf(a)cshl.edu http://www.simonf.com Terrorism is a tactic and so to declare war on terrorism is equivalent to Roosevelt's declaring war on blitzkrieg. Zbigniew Brzezinski, U.S. national security advisor, 1977-81

2 1

[Fedora-directory-users] Install FC4 in Fujitsu Siemens Amilo M1437G
by mario rossi 14 Oct '05

14 Oct '05

I have a notebook: Fujitsu Siemens Amilo M1437G. I'd like to install Fedora Core 4, but I'm not sure it's possible. Fedora DVD doesn't detect the Samsung 80GB SCSI hard disk and, I think,VIA VT6421 RAID controller (name from Windows Control Panel). The installation failure after the boot, where check the root partition. Are there any boot parameter for this notebook? Thank you, and excuse-me for my english. Mario Rossi _________________________________________________________________ Ricerche online più semplici e veloci con MSN Toolbar! http://toolbar.msn.it/

2 1

[Fedora-directory-users] strange problem with group of more than 2000 users
by basile 14 Oct '05

14 Oct '05

hi i have fds 7.1 on solaris 9 and users and group stored in the directory all works fine except for a group of more than 2000 users when i use id or getent system did not recognize the group maybe it s not a fds problem but if someone can give me an idea thanks basile

4 11

[Fedora-directory-users] VLV search filter granularity
by George Holbert 12 Oct '05

12 Oct '05

If I set up a VLV index with a simple filter like this: vlvFilter: (objectClass=posixAccount) ...then will the VLV mechanism benefit searches that use a superset of this filter? e.g., if a ldapsearch is run with a filter like: (&(objectClass=posixAccount)(location=California)) ...will the vlv index help, even though the search also has a location specified in the filter? OR, must I create separate vlv indexes with every possible search filter combination? Thanks, -- George

2 1

[Fedora-directory-users] windows sync problem
by Jón Björn Njálsson 12 Oct '05

12 Oct '05

Hi all. I have managed to set up FDS with SSL and I am able to sync users from FDS to windows 2003 AD, but I have a problem syncing groups. I have created a group called staff but I am unable to sync that group. The error message I get in the error log is : NSMMReplicationPlugin - agmt="cn=Active dir" (badabing:636): windows_replay_update: failed to fetch local entry for add operatio n dn="cn=rhi_staff,dc=rhi,dc=hi,dc=is" Can anyone tell me what this error means and how to fix it ? regards Jon

3 4

[Fedora-directory-users] Consumer directory server crashes during configuring Single-Master replication in Console ("Unable to contact LDAP Server")
by JURGEN KOBIERCZYNSKI 11 Oct '05

11 Oct '05

Hi, Are there issues known with configuring replication? I try to configure the read-only replica for a Single-Master replication. Therefore I've deleted the original root-suffix on the consumer(,because I will replicate this from the supplier), recreated a new suffix, create a replication entry, and then enable the replica checkbox on the suffix' database in the replication folder under the configuration tab. Then I check dedicated consumer, fill in the bind DN, and the supplier url. When I try to save this configuration the directory server console looses all connection to the ldap server (message "can not connect to LDAP server", and the ldap process terminates. I tried this in 2 configurations: a Single-Master replication between 2 servers, and a Single-Master replication between 2 directory instances on the same server, and in both scenarios the ldap server terminates. What did I wrong? Should I leave the original root-suffix intact on the consumer and do I need to define 2 different root-suffixes on the servers? I've used the same root suffix on both servers. Thanks in advance. Jurgen Kobierczynski Assistant Network & Security Engineer Nationale Loterij Departement Operations & ICT Tel. : +32 (0)2 238.47.42 Fax : +32 (0)2 238.47.18 GSM : +32 (0) 477 43.68.31 E-mail : jurgen.kobierczynski(a)nationale-loterij.be This email and any attachments thereto may contain confidential and/or privileged information intended for the sole use of the recipient(s). Any review, use, retention, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient, please contact the sender by reply email and delete all copies of this message. This email and any attachments are susceptible to data corruption, interception, tampering, unauthorized amendment and viruses. The National Lottery accepts no liability in connection therewith.

2 1

[Fedora-directory-users] Winsync issues
by Jón Björn Njálsson 07 Oct '05

07 Oct '05

Hi all. After setting up FSD and windows 2003 AD server, I have a problem with winsync. I am trying to synchronize users from FDS to AD. Users are replicated to the Domain Controller but all user accounts are disabled and have the "User must change password on logon" set. Is there a reason for this ? regards Jon Bjorn

2 1

Re: [Fedora-directory-users] Issues with SSL/Admin console
by Brian Kosick 07 Oct '05

07 Oct '05

Thanks Everyone, I got it working. ldapmodify was the right one, along with making a few modifications to the enable_ssl and addrsa files. For instance, the values for the cert db's were all ready in there, as I had all ready had it enabled, and getting the "Server-Cert" name right. As for the windows issue, it was an issue with the jss3.jar/dll, I was using jre 1.5.0_04. I followed the instructions in the Windows Console HOWTO, including DL'ing the additional files required for SSL, and no luck, it kept dieing trying to make the SSL connection. Right now, I don't have enough time to try setting up Admin Console on Windows again. I'll get back with the list when I have time to try again. Thanks, Brian On Thu, 2005-10-06 at 18:06 -0700, uffe(a)loop.to wrote: > The instructions were probably tested with the tools that accompany FDS, > can you try with ldapmodify instead of ldapadd? > cd /opt/fedora/shared/bin > ./ldapmodify -f /tmp/ssl_enable.ldif -v -D "cn=Directory Manager" -h > qapxe.corp.mxlogic.com -w <snip> > > For the Windows Console SSL problem, do you recall what class the > exception mentioned wasn't found? I'm guessing it was a jss class, the > jar might have had the wrong filename, like jss33.jar instead of jss3.jar... > > Brian Kosick wrote: > > >Here it is. > > > >Thanks > >Brian > > > >On Thu, 2005-10-06 at 13:22 -0600, Rich Megginson wrote: > > > > > >>I'm not sure. Are you sure you have no extraneous or trailing white > >>spaces anywhere? It might help if you could post the raw file. > >> > >>Brian Kosick wrote: > >> > >> > >> > >>>Hi All, > >>> > >>>I have a quick question. I had SSL all setup and running on both the > >>>admin server, and the directory server. My manager wanted it setup on > >>>his windows box, so I followed the WindowsConsole HOWTO, and kept > >>>getting stuck in the Mozilla libs not being able to make the SSL socket > >>>connection, returning with class not found. I disabled SSL on the > >>>admin server and was able to connect to that, and then disabled SSL on > >>>the directory server, but couldn't get it to work. Now on my linux > >>>admin console, which worked beautifully before, It keeps trying to > >>>connect to port 636, rather than 389. > >>> > >>>I have tried re-enabling SSL in the directory server by following the > >>>SSL Howto, but I keep getting > >>> > >>>ldapadd -f /tmp/ssl_enable.ldif -xv -D "cn=Directory Manager" -h > >>>qapxe.corp.mxlogic.com -w <snip> > >>>ldap_initialize( ldap://qapxe.corp.mxlogic.com ) > >>>ldapadd: invalid format (line 8) entry: "cn=encryption,cn=config" > >>> > >>>Based on a list thread that I found, I removed all the newlines in > >>>cipher list and still have the same issue. > >>> > >>>Here's my enable_ssl.ldif > >>>dn: cn=encryption,cn=config > >>>changetype: modify > >>>replace: nsSSL3 > >>>nsSSL3: on > >>>- > >>>replace: nsSSLClientAuth > >>>nsSSLClientAuth: allowed > >>>- > >>>add: nsSSL3Ciphers > >>>nsSSL3Ciphers: -rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5, > >>>+rsa_rc2_40_md5,+rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha, > >>>+rsa_fips_3des_sha,+fortezza,+fortezza_rc4_128_sha,+fortezza_null, > >>>+tls_rsa_export1024_with_rc4_56_sha,+tls_rsa_export1024_with_des_cbc_sha > >>>- > >>>add: nsKeyfile > >>>nsKeyfile: alias/slapd-qapxe-key3.db > >>>- > >>>add: nsCertfile > >>>nsCertfile: alias/slapd-qapxe-cert8.db > >>> > >>>dn: cn=config > >>>changetype: modify > >>>add: nsslapd-security > >>>nsslapd-security: on > >>>- > >>>replace: nsslapd-ssl-check-hostname > >>>nsslapd-ssl-check-hostname: off > >>> > >>>My question is how do I either get the admin console to try to connect > >>>via 389, rather than 636, or get SSL re-enabled on the directory server. > >>> > >>>Thanks in advance > >>>Brian > >>> > >>> > >>>------------------------------------------------------------------------ > >>> > >>>-- > >>>Fedora-directory-users mailing list > >>>Fedora-directory-users(a)redhat.com > >>>https://www.redhat.com/mailman/listinfo/fedora-directory-users > >>> > >>> > >>> > >>> > >>-- > >>Fedora-directory-users mailing list > >>Fedora-directory-users(a)redhat.com > >>https://www.redhat.com/mailman/listinfo/fedora-directory-users > >> > >> > >>------------------------------------------------------------------------ > >> > >>dn: cn=encryption,cn=config > >>changetype: modify > >>replace: nsSSL3 > >>nsSSL3: on > >>- > >>replace: nsSSLClientAuth > >>nsSSLClientAuth: allowed > >>- > >>add: nsSSL3Ciphers > >>nsSSL3Ciphers: -rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5,+rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_sha,+fortezza,+fortezza_rc4_128_sha,+fortezza_null,+tls_rsa_export1024_with_rc4_56_sha,+tls_rsa_export1024_with_des_cbc_sha > >>- > >>add: nsKeyfile > >>nsKeyfile: alias/slapd-qapxe-key3.db > >>- > >>add: nsCertfile > >>nsCertfile: alias/slapd-qapxe-cert8.db > >> > >>dn: cn=config > >>changetype: modify > >>add: nsslapd-security > >>nsslapd-security: on > >>- > >>replace: nsslapd-ssl-check-hostname > >>nsslapd-ssl-check-hostname: off > >> > >> > >>------------------------------------------------------------------------ > >> > >>-- > >>Fedora-directory-users mailing list > >>Fedora-directory-users(a)redhat.com > >>https://www.redhat.com/mailman/listinfo/fedora-directory-users > >> > >> > > -- > Fedora-directory-users mailing list > Fedora-directory-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users

1 0

Re: [Fedora-directory-users] Issues with SSL/Admin console
by Brian Kosick 06 Oct '05

06 Oct '05

Here it is. Thanks Brian On Thu, 2005-10-06 at 13:22 -0600, Rich Megginson wrote: > I'm not sure. Are you sure you have no extraneous or trailing white > spaces anywhere? It might help if you could post the raw file. > > Brian Kosick wrote: > > >Hi All, > > > >I have a quick question. I had SSL all setup and running on both the > >admin server, and the directory server. My manager wanted it setup on > >his windows box, so I followed the WindowsConsole HOWTO, and kept > >getting stuck in the Mozilla libs not being able to make the SSL socket > >connection, returning with class not found. I disabled SSL on the > >admin server and was able to connect to that, and then disabled SSL on > >the directory server, but couldn't get it to work. Now on my linux > >admin console, which worked beautifully before, It keeps trying to > >connect to port 636, rather than 389. > > > >I have tried re-enabling SSL in the directory server by following the > >SSL Howto, but I keep getting > > > >ldapadd -f /tmp/ssl_enable.ldif -xv -D "cn=Directory Manager" -h > >qapxe.corp.mxlogic.com -w <snip> > >ldap_initialize( ldap://qapxe.corp.mxlogic.com ) > >ldapadd: invalid format (line 8) entry: "cn=encryption,cn=config" > > > >Based on a list thread that I found, I removed all the newlines in > >cipher list and still have the same issue. > > > >Here's my enable_ssl.ldif > >dn: cn=encryption,cn=config > >changetype: modify > >replace: nsSSL3 > >nsSSL3: on > >- > >replace: nsSSLClientAuth > >nsSSLClientAuth: allowed > >- > >add: nsSSL3Ciphers > >nsSSL3Ciphers: -rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5, > >+rsa_rc2_40_md5,+rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha, > >+rsa_fips_3des_sha,+fortezza,+fortezza_rc4_128_sha,+fortezza_null, > >+tls_rsa_export1024_with_rc4_56_sha,+tls_rsa_export1024_with_des_cbc_sha > >- > >add: nsKeyfile > >nsKeyfile: alias/slapd-qapxe-key3.db > >- > >add: nsCertfile > >nsCertfile: alias/slapd-qapxe-cert8.db > > > >dn: cn=config > >changetype: modify > >add: nsslapd-security > >nsslapd-security: on > >- > >replace: nsslapd-ssl-check-hostname > >nsslapd-ssl-check-hostname: off > > > >My question is how do I either get the admin console to try to connect > >via 389, rather than 636, or get SSL re-enabled on the directory server. > > > >Thanks in advance > >Brian > > > > > >------------------------------------------------------------------------ > > > >-- > >Fedora-directory-users mailing list > >Fedora-directory-users(a)redhat.com > >https://www.redhat.com/mailman/listinfo/fedora-directory-users > > > > > -- > Fedora-directory-users mailing list > Fedora-directory-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users

3 2

[Fedora-directory-users] Password Sync Search Scope
by Brian Peters 06 Oct '05

06 Oct '05

Hi, I have a user directory structure in AD that mimics a typical org chart such that my ou=People directory contains additional ou's as subtrees that represent different departments. I have a windows sync agreement in FDS set up, and after manually adding the various ou's on the FDS side, all the users sync over properly in all the subtrees. My problem is with the password sync service for windows. Upon changing a user's password that has already been replicated to FDS from AD, I see in the access logs a search along these lines: SRCH base="ou=People,dc=my,dc=domain" scope=1 filter="(ntUserDomainId=myUser)" attrs=ALL with the result indicating no entries found: RESULT err=0 tag=101 nentries=0 etime=0 The myUser account is at ou=MyDept,ou=People,dc=my,dc=domain, but the password sync service issues a search request to only search the ou=People directory non-recursively (i.e. scope=1). I don't see any options in either the PassSync.msi setup or in the registry keys to force the service to do a scope=2 recursive search. I tried to use the syntax "ou=People,dc=my,dc=domain?sub", but it doesn't seem to recognize that either. Is there any workaround for this besides to synchronize all of my users to a single directory on FDS? Thanks, Brian

3 3

[Fedora-directory-users] Issues with SSL/Admin console
by Brian Kosick 06 Oct '05

06 Oct '05

Hi All, I have a quick question. I had SSL all setup and running on both the admin server, and the directory server. My manager wanted it setup on his windows box, so I followed the WindowsConsole HOWTO, and kept getting stuck in the Mozilla libs not being able to make the SSL socket connection, returning with class not found. I disabled SSL on the admin server and was able to connect to that, and then disabled SSL on the directory server, but couldn't get it to work. Now on my linux admin console, which worked beautifully before, It keeps trying to connect to port 636, rather than 389. I have tried re-enabling SSL in the directory server by following the SSL Howto, but I keep getting ldapadd -f /tmp/ssl_enable.ldif -xv -D "cn=Directory Manager" -h qapxe.corp.mxlogic.com -w <snip> ldap_initialize( ldap://qapxe.corp.mxlogic.com ) ldapadd: invalid format (line 8) entry: "cn=encryption,cn=config" Based on a list thread that I found, I removed all the newlines in cipher list and still have the same issue. Here's my enable_ssl.ldif dn: cn=encryption,cn=config changetype: modify replace: nsSSL3 nsSSL3: on - replace: nsSSLClientAuth nsSSLClientAuth: allowed - add: nsSSL3Ciphers nsSSL3Ciphers: -rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5, +rsa_rc2_40_md5,+rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha, +rsa_fips_3des_sha,+fortezza,+fortezza_rc4_128_sha,+fortezza_null, +tls_rsa_export1024_with_rc4_56_sha,+tls_rsa_export1024_with_des_cbc_sha - add: nsKeyfile nsKeyfile: alias/slapd-qapxe-key3.db - add: nsCertfile nsCertfile: alias/slapd-qapxe-cert8.db dn: cn=config changetype: modify add: nsslapd-security nsslapd-security: on - replace: nsslapd-ssl-check-hostname nsslapd-ssl-check-hostname: off My question is how do I either get the admin console to try to connect via 389, rather than 636, or get SSL re-enabled on the directory server. Thanks in advance Brian

2 1

[Fedora-directory-users] About the password sync feature
by Thierry Lanfranchi 04 Oct '05

04 Oct '05

Hello there, I'm in the process of installing a new LDAP directory using FDS, and am willing to synchronize the password modifications between AD domains and the corresponding users in the LDAP directory. These users are not synchronized, but the ntUserDomain attribute is set to the corresponding AD account. After reading the RH admin guide, I still have a few questions, which are : 1_ Can the Password Sync feature be implemented without having to implement synchronization of the accounts between AD and FDS ? 2_ When you have multiple AD servers per domain, and multiple AD domains, how many copies of the PassSync service do you need to install ? Can the service be installed on only one server per domain, or do I need to install it on every server ? (I'm no AD guru, so I'm not sure how and when the password is definitly encoded on AD). Thanks in advance for your answers, Regards, Thierry

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users October 2005