[Fedora-directory-users] ssl probleme with ldapsearch
by basile
i generate rootCA and servercertificate with openssl and import them
in fedora console
it works fine and i can use tls with /opt/fedora/shared/bin/ldapsearch
but when i use ldapsearch of openldap package i can t have it recognize
server
certificate
i give path to cacert in /etc/openldap/ldap.conf and /etc/ldap.conf
i give path to /opt/fedora-ds/alias in same files
nothing work
thanks for help
basile
18 years, 5 months
[Fedora-directory-users] Winsync - passwords?
by Dean Jones
Hey everyone,
I have setup winsync between FDS and AD and just want to clarify a few
points that i can't find in the docs or older posts..
1. Passwords. They do not appear to be syncing either direction but i
don't have SSL enabled. my guess is that this is normal?
2. Accounts. They are only syncing from AD -> FDS but i'm assuming this
is also due to lack of SSL?
3. Existing users. If i have identical users setup on both my FDS and AD
servers and then do a sync, what will happen? just a password sync? Has
anyone done this before?
thanks!
18 years, 5 months
[Fedora-directory-users] binary release
by Roman Portrait
Where can I download Fedora Directory server for Solaris 8 or 9?
Thanks,
RM
---------------------------------
Yahoo! FareChase - Search multiple travel sites in one click.
18 years, 5 months
Re: Re: [Fedora-directory-users] ssl client authentication
by Michael Montgomery
Thank you very much for your response. I just have a couple more
questions so I can be sure I know what I'm talking about.
> the directory server (your SSL server) replies with the certificate chain which includes
> the CA certificate, and the self-signed SSL certificate."
I'm assuming the 'self-signed SSL cerificate' is the client's ssl
certificate I imported into the SSL server's store, and NOT the server's
own client certificate?
> you should have the SSL certificate imported into your SSL client's security database,
> and it should be marked as trusted (i.e -t "CT,CT,CT").
Is there any documentation on how to do this with a RHEL4 server? The
only things that come to mind are the openssl dirs '/usr/share/ssl/*',
and possibly installing the certutil package on this machine...(but how
would the ldap.conf file reference this, and even know about it... I'm
curious about integration)
>Another way to do this is to sign your SSL server certificate with your self-signed CA
> certificate, and import your CA certificate into your SSL client's security database.
I'm assuming you're talking about this option to Sign/Validate a
self-signed cert:
-V Validate a certificate
-n cert-name The nickname of the cert to Validate
-b time validity time ("YYMMDDHHMMSS[+HHMM|-HHMM|Z]")
-e Check certificate signature
-u certusage Specify certificate usage:
C SSL Client
V SSL Server
S Email signer
R Email Recipient
-d certdir Cert database directory (default is ~/.netscape)
-P dbprefix Cert & Key database prefix
-X force the database to open R/W
But then there's still the above question of how to import it into
clients...
Once again, thank you very much for your answers up to this point, as
they were quite helpful.
Michael.
18 years, 5 months
[Fedora-directory-users] questions on ssl and certutil
by basile
hi
i have ssl enable in my directory server and it works fine
i use redhat documentation to do that with certutil
but i have a few questions for a good understanding of ssl in fds
1) i have two files slapd-myserver-cert8.db and slapd-myserver-key3.db
are they the key and self-signed certificate for directory server , or
are they files ( databases )
where thoses key and certificates are stored
2) i want to enable ssl in fedora console and in redhat documentation i
have to
generate new certificates . How can i use first certificate to signed
this new ( if i do 4 5 and 7 step in redhat documenation i got an
error , but i m not sure of the syntax i have to use ) , how can
i generate clients certificate , how can i generate new server
certificate ?
i find redhat documentation not very clear for this subject ( but so
clear on many others :)
if someone can explain me exactly how it works and how to generate new
certificates
thanks
basile
18 years, 5 months
Re: [Fedora-directory-users] MD5 for password hashes
by Del
Hi,
I did some digging on this issue. I suspect I have found a bug
in Fedora Directory Server handling the importing of MD5 passwords,
either that or the current download versions don't support MD5.
The results are as follows:
--
Run this command on OpenLDAP to set a user's password:
ldappasswd -x -D 'uid=root,ou=People,dc=babel,dc=com,dc=au' -W -S
'uid=del,ou=People,dc=babel,dc=com,dc=au'
Do a simple ldapsearch as that user, to verify that the password is correct:
ldapsearch -x -D 'uid=del,ou=People,dc=babel,dc=com,dc=au' -W 'uid=del'
If you have set your OpenLDAP permissions to be relatively transparent,
the above ldapsearch will show a base64 representation of your password
hash. It looks like this:
userPassword:: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa=
You can un-base64 this hash with the following simple perl script:
#!/usr/bin/perl
#
# Usage: $0 string
#
use MIME::Base64;
my $data = $ARGV[0];
print("Input string is " . $data . "n");
$decoded = decode_base64($data);
print("Decoded string is " . $decoded . "n");
You will see that the password contains the prefix {MD5}, which looks
like this:
Decoded string is {MD5}asdfasdfasdfasdfasdf==
Import your OpenLDAP directory into Fedora Directory Server. I used
LdapImport for this although I also tried it with ldif2db.
What happens during the process of LdapImport is:
* Passwords of type {CRYPT} are transferred across OK to the
FedoraDirectoryServer.
* Passwords of type {MD5} appear in the FedoraDirectoryServer as strings
beginning with {SSHA}. This can be verified by examining the directory
using GQ or a similar LDAP tool, while bound as "cn=Directory Manager".
* Attempts to authenticate with the original password now fail.
* Attempting to authenticate as the full MD5 string (i.e. use the hash
string '{MD5}asdfasdf...==' as extracted from the OpenLDAP server as the
password for Fedora Directory Server) in fact works.
I expect that what has happened is that Fedora Directory Server has
failed to recognise the {MD5} at the beginning of the string as a valid
hash mechanism and re-encoded the entire string as an SSHA hash.
I see that on the FDS wiki there is mention of MD5 hashing support
being added on June 15th. I have fedora-ds-7.1-2.RHEL4 installed from
the RPM I downloaded from the FDS web site. How do I verify that this
version should have the MD5 support, or do I need a more recent version?
--
Del
18 years, 5 months
[Fedora-directory-users] Directory server
by Fernando D. Tardini
Hello, i apology for my english, I'm from argentina and some technicals words i don't understand it verywell.
This is really simple, i have installed fc4 and the DS for this distribution and all work perfectly. Now i have a 2003 Active Directory server and i have to make a sync with this two.
I enable de replica in the directory server, and don't give any error, and I install the PassSync.msi in the 2003 server and i configured all and seem to work but don't sync the password, and i don´t get any log error.
I created the user cn=replication manager,cn=config in the DS.
Now i have some questions that i don´t understan verywell:
1- what base do i have to put in the passSync to look for, a base of the AD or the DS.? I mean the base where the passsync look for changes i supouse.
2- the PassSync work only with ssl or without ssl work too?
3- what is the supplier dn in the replication panel and what is the format ? I think that i have write it wrong and write the wrong supplier dn.
4- how the DS sync with the AD if I configure the DS as a consumer or i have to configure it as a single server?
For information, i have read all the documentation too many times, and i can't find the error. The strange thing is that i get no error, like if the sync work but don´t write the entries.
Another starnge thing is that with AD 2000, not 2003, the users sync good, not the passwords, but in 2003, sync once and then it's like if broke down.
i hope you will help to solve this errors and thanks a lot.
18 years, 5 months
[Fedora-directory-users] ssl client authentication
by Michael Montgomery
conn=31 op=-1 fd=67 closed - Peer does not recognize and trust the CA
that issued your certificate.
I've been trying to get client authentication via ssl working for quite
a while now. I've tried generating my own CA via openssl, creating a
self-signed ssl cert, importing CA cert via the interface, converting
the client ssl to pkcs12 format, importing it via the interface, and
trying to run a 'ldapsearch' using the cert (non-pkcs12 format) on the
client machine but get the above error.
I've also tried clearing the whole DB, regenerating everything (CA cert,
and server client cert), and generating a client cert for a test machine
with this:
/serverRoot/shared/bin/certutil -S -n "hostname-Cert" -s
"cn=server-cert" -c "CA certificate" -t "u,u,u" -m 1002 -v
120 -d . -z noise.txt -f pwdfile.txt
then running this:
'../shared/bin/certutil -L -d /opt/fedora-ds/alias/ -n "hostname-test-Cert"'
and putting that in a ssl cert file on the client, '/root/client.crt',
using this as an ldap.conf file:
host ***.***.***.***
base dc=test,dc=testdomain,dc=com
uri ldap://***.***.***.***
ldap_version 3
port 636
pam_filter objectclass=posixAccount
pam_login_attribute uid
ssl start_tls
ssl on
tls_cert /root/client.crt
pam_password md5
And testing again with ldapsearch.
But I still get the above error.
Does anyone have any ideas why this is happening, as I'm at a loss.
Thanks.
18 years, 5 months
[Fedora-directory-users] Need some pointers to information
by Mont Rothstein
I want to use a Linux server as a file server for Windows clients. I would
like to be able to add users to the Directory Server pragmatically and from
that have users be able to access the Linux server via Samba.
Save/edit/delete files, and set ACLs. This server will not be the PDC, and
there may or may not be a PDC on the network at all (computers may be a
simple workgroup).
I've been going through the various docs and how-tos on setting up Fedora
Directory Server, Samba, and integrating the two, but everything I have been
reading seems to assume that my Linux server will be the PDC. The process
for adding users seems to be to create a Unix user and then make them a
Samba user. Which is basically the opposite of what I want. I would like to
add the user to the Directory Server and have that fully enable the user's
access to the Linux server.
Perhaps I am just confused. I've searched and searched but I can't find
anything that looks at/talks about the Fedora Directory Server and Samba
from this direction.
Any help here is greatly appreciated.
Thanks,
-Mont
18 years, 5 months
[Fedora-directory-users] problem with ssl
by basile
hi
i try to enable ssl with redhat documentation
i use certutil to generate certificate
i store in /opt/fedora-ds/slapd_myserver/alias
but when in the console i check enable ssl and use cipher family rsa
i don t see my certificate
i use wiki fedora and do what they say but with same result
i have attribute nscertfile and nscertfile in cn=encryption,cn=config with
path to slapd-myserver-cert8.db and slapd-myserver-key3.db
what do i forget to do ?
thanks
basile
18 years, 5 months
