389-users November 2005

389-users@lists.fedoraproject.org

49 participants
71 discussions

[Fedora-directory-users] SASL-GSSAPI - KRB5
by Barry R. Ribbeck 28 Nov '05

28 Nov '05

SASL-GSAPPI - Kerberos When I attempt to bind to the directory and search for the same > information with the command line below. > > ldapsearch -Y GSSAPI -X u:<valid uid> -b "" -s base -LLL -H > ldaps://FQDN supportedSASLMechanism Did you really mean to initiate a SASL/GSSAPI bind over SSL ? I'm not sure that will work. It might, but it may not be supported. I know for sure that encrypted gssapi will _not_ work. It uses the same layered I/O hooks that SSL does, and you can't have both active at the same time (nor would you want to AFAIK). Try the non-ssl port and see what happens. The new and improved error after changing from -H ldaps://..... to -H ldap://... follows SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Invalid credentials additional info: SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context [28/Nov/2005:07:47:47 -0600] - new connection on 68 [28/Nov/2005:07:47:47 -0600] - activity on 68r [28/Nov/2005:07:47:47 -0600] - read activity on 68 [28/Nov/2005:07:47:47 -0600] - conn 10 activity level = 0 [28/Nov/2005:07:47:47 -0600] - sasl(2): GSSAPI Error: Miscellaneous failure (Bad encryption type)[28/Nov/2005:07:47:47 -0600] - listener got signaled [28/Nov/2005:07:47:47 -0600] - activity on 68r [28/Nov/2005:07:47:47 -0600] - read activity on 68 [28/Nov/2005:07:47:47 -0600] - listener got signaled Thanks for the hint. I did read that it would not be supported over SSL the competing port would be a valid reason. I did get the mapping pieces completed but had some difficulty understanding the REALMS docs. http://www.redhat.com/docs/manuals/dir-server/ag/7.1/ssl.html#1083165 The docs state that GSS-API must be enabled as a SASL mechanism in the Directory to make this work, but it does not state how if this is the default or if not how to enable GSS-API. The Realms section reads as if I have to change the DN of all users in the directory to be under cn=gssapi,cn=auth and therefore the confusion. Thanks again for any clarity given Barry

2 1

[Fedora-directory-users] Creating Replication Agreements at the Command Line
by Philip Lembo 28 Nov '05

28 Nov '05

If anyone has successfully set up replication end-to-end (starting with configuring the replicas and on to creating and enabling a replication agreement) from the command line as opposed to using the GUI console, I'd appreciate seeing any notes they may have on the subject. While the Red Hat doc does a terrific job of covering replication (someone should get a medal for the troubleshooting section ...), there's no discussion there on how to administer this from the command line. For reliability and efficiency reasons I've been doing more and more of my directory management using command line tools, and would like to extend this into replication management. Thanks in advance. Phil Lembo

2 1

[Fedora-directory-users] What does "Cert Token" mean?
by joe 28 Nov '05

28 Nov '05

Dear all When I tried to fill all of fields of passSync service in windows 2000. I didn't really know what should I put in Cert Token field. The Document answer is "password". But I want to understand what it means? Thanks a lot. Joe

2 1

[Fedora-directory-users] Apps switched in SysV admin init script
by Kevin M. Myer 28 Nov '05

28 Nov '05

The SysV init script at: http://www.directory.fedora.redhat.com/download/fedora-ds-admin-init.d has the apps for stopping and restarting the admin service switched. Can someone update the Wiki with the following change? --- fedora-ds-admin-init.d 2005-11-26 15:38:24.000000000 -0500 +++ fedora-ds-admin-init.d 2005-11-26 15:38:36.000000000 -0500 @@ -14,8 +14,8 @@ # Set up some common variables before we launch into what might be # considered boilerplate by now. path_start=/opt/fedora-ds/start-admin -path_restart=/opt/fedora-ds/stop-admin -path_stop=/opt/fedora-ds/restart-admin +path_restart=/opt/fedora-ds/restart-admin +path_stop=/opt/fedora-ds/stop-admin path=./ns-httpd prog="Fedora-DS Admin" Kevin -- Kevin M. Myer Senior Systems Administrator Lancaster-Lebanon Intermediate Unit 13 http://www.iu13.org

2 1

[Fedora-directory-users] SASL-GSSAPI and KRB5
by Barry R Ribbeck 28 Nov '05

28 Nov '05

I am trying to use SASL-GSSAPI to leverage our Kerberos V authentication REALM with Fedora Directory server. When I search anonymously for supported SASL mechanisms, I get the following response. Seeing GSSAPI is comforting, but I am sure that is not the whole story. I am running the directory on RHL E3 with SASL2. What I am looking for are some docs for the entire process. Turbo Fredriksson has some excellent docs on Open LDAP, but they don't seem to map well to the Fedora Directory. Any suggestion would be greatly apprectiated and I would love to document the process for others. ldapsearch -H ldaps://FQDN/ -x -b "" -s base -LLL supportedSASLMechanisms dn: supportedSASLMechanisms: EXTERNAL supportedSASLMechanisms: PLAIN supportedSASLMechanisms: GSSAPI supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: ANONYMOUS When I attempt to bind to the directory and search for the same information with the command line below. ldapsearch -Y GSSAPI -X u:<valid uid> -b "" -s base -LLL -H ldaps://FQDN supportedSASLMechanism I get the following command line error SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Invalid credentials additional info: SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context and the following directory error log error [27/Nov/2005:20:21:18 -0600] - new SSL connection on 69 [27/Nov/2005:20:21:18 -0600] - activity on 69r [27/Nov/2005:20:21:18 -0600] - read activity on 69 [27/Nov/2005:20:21:18 -0600] - conn 12 activity level = 0 [27/Nov/2005:20:21:18 -0600] - sasl(2): GSSAPI Error: Miscellaneous failure (Bad encryption type)[27/Nov/2005:20:21:18 -0600] - listener got signaled The directory seems to support SASL, and SASL2 is installed, I am just not sure if anything else is required. A blank ldapsearch reveals the following ldapsearch SASL/DIGEST-MD5 authentication started The directory docs are pretty thin. Any help would be appreciated.

2 1

Re: [Fedora-directory-users] Winsync Problem with NT4
by Elliot Schlegelmilch 26 Nov '05

26 Nov '05

> Maybe it is because I used the wrong password at the first try (PDC side)? I > read in the manual that > "After the service is installed and started the first time the password can > only be changed via an LDAP modify operation, not the configuration file." I'm glad to hear someone is giving this a try. A ldapmodify command similar to this can change the default password: ldapmodify -D 'uid=admin,ou=system' -h pdc.my.domain -p 389 -w secret dn: uid=admin,ou=system changetype: modify replace: userpassword userpassword: foob4r Then I believe you use this user and password (uid=admin,ou=system, foob4r) in the replication agreement. Regards, Elliot

1 0

Re: [Fedora-directory-users] Winsync Problem with NT4
by Hartmut Wöhrle 24 Nov '05

24 Nov '05

Am Mittwoch, 23. November 2005 16:57 schrieb David Boreham: > Hi, can you post the entire log segment where this shows up please ? I have to setup the Loglevel to Replication to debug first... hope I can do it tomorrow. BTW. where can I set the loglevel for the usersync.log? The wrapper.conf entries about loglevels just make the wrapper.log bigger and more informative, but not the usersync.log > Wrong password would just mean that the connection would fail. It > wouldn't have any > persistent effect. Hmm, as I understand the "hardcoded" user at the PDC side is cn=admin,ou=system When I started the first time this user didn't exist - of security reasons our Admin is called different (Superroot for example). Does this have any effects? > Anyway, the ldapmodify operation will be to the userpassword attribute > on the ApacheDS root entry. I'll look that up and post the command... Would be nice :) And where is this ApacheDS? In the usual C:\Program Files\Red Hat Directory Synchronization > You shouldn't need to reinstall. Ufff.... Thanks -- =========================================== Hartmut Woehrle EMail: hartmut.woehrle(a)mail.pcom.de -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

1 0

[Fedora-directory-users] Require SSL/TLS Only Connections
by Thomas Cramer 24 Nov '05

24 Nov '05

I would like to require that *only* SSL/TLS connections be allowed to my server. This is not to be confused with wanting SSL client authentication. I had initially thought I could do this with ACI using the authmethod="ssl", however after looking at the documentation closely and experimentation this refers to do client based SSL authentication as well. I do have SSL/TLS set up correctly, I just want to disallow non-encrypted traffic. In OpenLDAP I would merely state "security ssf=128" to require SSL/TLS only connections. Anyone know how to do this in FDS? == tc

3 2

[Fedora-directory-users] Active Directory Interaction
by Scott Boggs 23 Nov '05

23 Nov '05

I have recently started working with the fedora directory server and I think the project totally rocks!. I am hoping that a seasoned directory server veteran can educate me on where I am going wrong with setting a Fedora-ds and Active directory server to sync passwords. The following is my configuration and observations: I am running Fedora Core 4 loaded with the fedora-ds-7.1-2.RHEL4.i386.opt.rpm that the project provided for evaluation. Part of my evaluation is to demonstrate how the the directory sever will interact with a active directory system. I have followed the instructions listed in chapter 18 of the Red Hat Directory Server Administration Guide. Where I am running into issues is that the step 6 of the setup instructions states that once the suffix is selected within the console configuration area that sync can be chosen and a New Synchronization Agreement created. This area seems to be missing on my version. I am guessing that I have hit a limitation of the evaluation version and I need to now build my own to enable this functionality. Am I correct? If not, could someone please point me in the correct direction. Thank you for you time.

2 1

[Fedora-directory-users] Consult about experience with Red Hat Directory Server
by Wilmer Jaramillo M. 23 Nov '05

23 Nov '05

i want know cases of study and experiences of installation and implantation of form satisfactory of software in other institutions and/or companies the part of Red Hat Inc. around the world or in Latinoamerica in the framework of yours extensive trajectory in this matter. Thanks and Greetings. Wil.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2005