389-users August 2005

389-users@lists.fedoraproject.org

40 participants
61 discussions

[Fedora-directory-users] problem importing DUAConfigProfile Schema in to FDS 7.1
by Justin Albstmeijer 19 Aug '05

19 Aug '05

fedora-directory-users, using: RHEL4 (update 1), fedora-ds-7.1-2.RHEL4 Trying to follow the instructions on http://directory.fedora.redhat.com/wiki/Howto:SolarisClient. Both the published DUAConfigProfile schema and the http://web.singnet.com.sg/~garyttt/DUAConfigProfile.schema.txt converted by ol-schema-migrate.pl don't seem to be able to be imported. Both result in : cn=schema: Error adding object 'dn: cn=schema'. The error sent by the server was 'Object class violation. missing required attribute "objectclass" Any suggestions? --- Note: in my case the ol-schema-migrate.pl output did not include the "objectClasses", had to fix this in the script by changing: - if ( /object[c|C]lass/ ) { + if ( /^object[c|C]lass/ ) { (There where comments in the DUAConfigProfile with an "objectclass" mentioned) --- Justin

5 10

[Fedora-directory-users] Problem with Samba - Fedora-ds Integration (HOWTO:SAMBA)
by Tom.Tran＠noaa.gov 19 Aug '05

19 Aug '05

I followed the document until I get the following error: #/opt/fedora-ds/slapd-miapogo/ldif2ldap "cn=Directory Manager" fds80000 /tmp/sambaGroups.ldif This command returns: adding new entry cn=Domain Admins,ou=Groups,dc=sefsc,dc=noaa,dc=gov adding new entry cn=Domain Users,ou=Groups,dc=sefsc,dc=noaa,dc=gov adding new entry cn=Domain Guests,ou=Groups,dc=sefsc,dc=noaa,dc=gov adding new entry cn=Domain Computers,ou=Groups,dc=sefsc,dc=noaa,dc=gov I then run the following command: # net groupmap add rid=512 ntgroup='Domain Admins' unixgroup='Domain Admins' This command returns: [2005/08/19 09:48:37, 0] passdb/pdb_ldap.c:ldapsam_add_group_mapping_entry(2330) ldapsam_add_group_mapping_entry: failed to add group 2512 error: Insufficient 'write' privilege to teh 'sambaSID' attribute of entry 'cn=domain admins,ou=groups,dc=sefsc,dc=noaa,dc=gov'. (Insufficient access) adding entry for group Domain Admins failed! I am a novice on this subject and have no idea how to fix it. Please help! Tom Tran ----- Original Message ----- From: <Tom.Tran(a)noaa.gov> Date: Wednesday, August 17, 2005 3:15 pm Subject: Samba - Fedora-ds Integration (HOWTO:SAMBA) > Hi, > > I have problems with following the instruction in the HOWTO:SAMBA > document. I have RedHat 4.1.18, samba-3.0.10, and > fedora-ds-7.1-2.RHEL4. I don't have ldap or openldap installed > because > I am using fedora-ds > instead. I tested samba and fedora-ds, both seemed to work fine. > I > also made sure that samba's daemons > (smbd, nmbd, winbindd), and fedora-ds were started > > I followed the steps in the HOWTO:SAMBA doc, when I reached the > step "Populating FDS with PDC > Entry" and ran the command: > # net getlocalsid > I got the message: > lib/smbldap.c:smbldap_search_domain_info(1392) > Adding domain info to SEFSC failed with NT_STATUS_UNSUCCESSFUL > SID for domain MIAPOGO is : S-1-5-21-2139381707-154793685- > 3088283579 > Here is my /etc/samba/smb.conf > ------------------------------ > # Global parameters > [global] > workgroup = SEFSC > netbios name = MIAPOGO > server string = Samba %u on (%L) > log file = /var/log/samba/%m.log > max log size = 50 > socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 > printcap name = /etc/printcap > dns proxy = No > idmap uid = 16777216-33554431 > idmap gid = 16777216-33554431 > cups options = raw > > security = user > passdb backend = ldapsam:ldap://miapogo.sefsc.noaa.gov > ldap suffix = dc=sefsc,dc=noaa,dc=gov > ldap user suffix = ou=People > ldap machine suffix = ou=Computers > ldap group suffix = ou=Groups > > os level = 33 > domain logons = yes > domain master = yes > local master = yes > preferred master = yes > > wins support = yes > > logon home = \\%L\%u\profiles > logon path = \\%L\profiles\%u > logon drive = H: > > template shell = /bin/false > winbind use default domain = yes > > [netlogon] > path = /var/lib/samba/netlogon > read only = yes > browseable = no > > [profiles] > path = /var/lib/samba/profiles > read only = no > create mask = 0600 > directory mask = 0700 > > [homes] > comment = Home Directories > read only = No > browseable = No > > [printers] > comment = All Printers > path = /var/spool/samba > printable = Yes > browseable = No > -------------------------- > > Tom Tran > > >

2 1

Re: [Fedora-directory-users] Building Management Console in Debian
by Marcio Kabke Pinheiro 18 Aug '05

18 Aug '05

2 1

Re: [Fedora-directory-users] Building Management Console in Debian
by Marcio Kabke Pinheiro 18 Aug '05

18 Aug '05

2 1

[Fedora-directory-users] Building Management Console in Debian
by Marcio Kabke Pinheiro 18 Aug '05

18 Aug '05

2 1

[Fedora-directory-users] Samba - Fedora-ds Integration (HOWTO:SAMBA)
by Tom.Tran＠noaa.gov 18 Aug '05

18 Aug '05

Hi, I have problems with following the instruction in the HOWTO:SAMBA document. I have RedHat 4.1.18, samba-3.0.10, and fedora-ds-7.1-2.RHEL4. I don't have ldap or openldap installed because I am using fedora-ds instead. I tested samba and fedora-ds, both seemed to work fine. I also made sure that samba's daemons (smbd, nmbd, winbindd), and fedora-ds were started I followed the steps in the HOWTO:SAMBA doc, when I reached the step "Populating FDS with PDC Entry" and ran the command: # net getlocalsid I got the message: lib/smbldap.c:smbldap_search_domain_info(1392) Adding domain info to SEFSC failed with NT_STATUS_UNSUCCESSFUL SID for domain MIAPOGO is : S-1-5-21-2139381707-154793685-3088283579 Here is my /etc/samba/smb.conf ------------------------------ # Global parameters [global] workgroup = SEFSC netbios name = MIAPOGO server string = Samba %u on (%L) log file = /var/log/samba/%m.log max log size = 50 socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 printcap name = /etc/printcap dns proxy = No idmap uid = 16777216-33554431 idmap gid = 16777216-33554431 cups options = raw security = user passdb backend = ldapsam:ldap://miapogo.sefsc.noaa.gov ldap suffix = dc=sefsc,dc=noaa,dc=gov ldap user suffix = ou=People ldap machine suffix = ou=Computers ldap group suffix = ou=Groups os level = 33 domain logons = yes domain master = yes local master = yes preferred master = yes wins support = yes logon home = \\%L\%u\profiles logon path = \\%L\profiles\%u logon drive = H: template shell = /bin/false winbind use default domain = yes [netlogon] path = /var/lib/samba/netlogon read only = yes browseable = no [profiles] path = /var/lib/samba/profiles read only = no create mask = 0600 directory mask = 0700 [homes] comment = Home Directories read only = No browseable = No [printers] comment = All Printers path = /var/spool/samba printable = Yes browseable = No -------------------------- If I commentted out the line: passdb backend = ldapsam:ldap://miapogo.sefsc.noaa.gov then the command 'net getlocalsid' works. But I got more problems when I continued following the instructions in the HOWTO:SAMBA. Please help! Tom Tran

2 1

RE: [Fedora-directory-users] problem importing DUAConfigProfile Schema in to FDS 7.1
by Tay, Gary 18 Aug '05

18 Aug '05

Is this what you need? # cat $FDS_ROOT/slapd-`hostname`/config/schema/61DUAConfigProfile.ldif dn: cn=schema attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.0 NAME 'defaultServerList' DESC 'Default LDAP server host address used by a DUA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.1 NAME 'defaultSearchBase' DESC 'Default LDAP base DN used by a DUA' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE ) attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.2 NAME 'preferredServerList' DESC 'Preferred LDAP server host addresses to be used by a DUA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.3 NAME 'searchTimeLimit' DESC 'Maximum time in seconds a DUA should allow for a search to complete' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.4 NAME 'bindTimeLimit' DESC 'Maximum time in seconds a DUA should allow for the bind operation to complete' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.5 NAME 'followReferrals' DESC 'Tells DUA if it should follow referrals returned by a DSA search result' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.6 NAME 'authenticationMethod' DESC 'A keystring which identifies the type of authentication method used to contact the DSA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.7 NAME 'profileTTL' DESC 'Time to live, in seconds, before a client DUA should re-read this configuration profile' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.14 NAME 'serviceSearchDescriptor' DESC 'LDAP search descriptor list used by a DUA' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.9 NAME 'attributeMap' DESC 'Attribute mappings used by a DUA' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.10 NAME 'credentialLevel' DESC 'Identifies type of credentials a DUA should use when binding to the LDAP server' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.11 NAME 'objectclassMap' DESC 'Objectclass mappings used by a DUA' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.12 NAME 'defaultSearchScope' DESC 'Default search scope used by a DUA' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.13 NAME 'serviceCredentialLevel' DESC 'Identifies type of credentials a DUA should use when binding to the LDAP server for a specific service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.15 NAME 'serviceAuthenticationMethod' DESC 'Authentication method used by a service of the DUA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) objectClasses: ( 1.3.6.1.4.1.11.1.3.1.2.4 NAME 'DUAConfigProfile' SUP top STRUCTURAL DESC 'Abstraction of a base configuration for a DUA' MUST ( cn ) MAY ( defaultServerList $ preferredServerList $ defaultSearchBase $ defaultSearchScope $ searchTimeLimit $ bindTimeLimit $ credentialLevel $ authenticationMethod $ followReferrals $ serviceSearchDescriptor $ serviceCredentialLevel $ serviceAuthenticationMethod $ objectclassMap $ attributeMap $ profileTTL ) ) Gary -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Justin Albstmeijer Sent: Thursday, August 18, 2005 4:21 PM To: General discussion list for the Fedora Directory server project. Subject: Re: [Fedora-directory-users] problem importing DUAConfigProfile Schema in to FDS 7.1 I suppose someone got it to work? non of the previous suggestions did the trick. Anyone? I seem to be looking for a modify ldif file to import the DUAConfigProfile Schema Justin -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

2 1

[Fedora-directory-users] Re: proper procedure to add a unix group
by Steve Bonneville 17 Aug '05

17 Aug '05

Rich Megginson wrote: > Igor wrote: > > >Hi, all. This is probably a dumb question but how do > >I add a group? Simply adding a group thru the UI > >doesn't allow one to specify a GID. I tried adding an > >object type "OTHER" and selecting posixGroup. That > >seemed to have worked, is that how this is to be done? > > > > > Yes. > > > Because under company name aci, it shows up with gid > >number, NOT the group name which is kind of ugly. > > > > > Right. A console "group" is a groupOfUniqueNames. A posixGroup is a > unix /etc/groups replacement group. One cool thing I've noticed while working on research for Red Hat's RH423 class: it turns out that Red Hat Directory Server allows you to assign an entry both the groupOfUniqueNames and posixGroup object classes at the same time! Strictly speaking this is a schema violation, since they are unrelated structural classes, but Directory Server does not enforce the rule that there can only be one structural class chain on an entry. Now, the interesting thing is that it's been proposed (in the expired Internet-Draft draft-howard-rfc2307bis-00.txt) that posixGroup be changed to an auxiliary class so that it and groupOfUniqueNames can be used together to make this legal. It was further proposed that group members can be stored not just as login names (in memberUid attributes from posixGroup), but ALSO as DNs of posixAccount entries (in uniqueMember attributes from groupOfUniqueNames). It turns out that the author of the proposal is the developer of the nss_ldap package used by Red Hat Enterprise Linux, so nss_ldap already supports this. This means that if there is a directory entry uid=testuser,ou=people,dc=example,dc=com that's a valid posixAccount user, you can define a static group entry with LDIF like the following: dn: cn=unixgroup,ou=groups,dc=example,dc=com objectclass: top objectclass: groupOfUniqueNames objectclass: posixGroup cn: unixgroup gidNumber: 1701 uniqueMember: uid=testuser,ou=people,dc=example,dc=com use system-config-authentication to set up a RHEL client to use nss_ldap to look up user information from the directory, and get this: [root@example ~]# getent group unixgroup unixgroup:x:1701:testuser -- Steve Bonneville

2 1

[Fedora-directory-users] proper procedure to add a unix group
by Susan 16 Aug '05

16 Aug '05

Hi, all. This is probably a dumb question but how do I add a group? Simply adding a group thru the UI doesn't allow one to specify a GID. I tried adding an object type "OTHER" and selecting posixGroup. That seemed to have worked, is that how this is to be done? Because under company name aci, it shows up with gid number, NOT the group name which is kind of ugly. Thank you. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 3

[Fedora-directory-users] Admin server setup issue on FC3
by Vsevolod (Simon) Ilyushchenko 15 Aug '05

15 Aug '05

Hi, After successfully running FDS on RH3, I've tried to install it on FC3. I got this: *** Your new directory server has been started. Created new Directory Server Start Slapd Starting Slapd server configuration. Fatal Slapd ERROR: Ldap authentication failed for url ldap://fds1.cshl.edu:389/o=NetscapeRoot user id admin (151:Unknown error.) Fatal Slapd Did not add Directory Server information to Configuration Server. Configuring Administration Server... Setting up Administration Server Instance... ERROR: Administration Server configuration failed. See install.log. INFO Finished with setup, logfile is setup/setup.log *** First of all, I'm not sure why it's using "o=NetscapeRoot" - I've specified a different manager DN. Second, the setup/nsperl/install.log file is not informative: *** You might want to reconfigure these parameters: ./reconfigure "myhostname=localhost" ./reconfigure "mydomain=.local.domain.com" ./reconfigure "perladmin=LOCAL.ADMIN(a)local.domain.com" ./reconfigure "cf_email=LOCAL.USER(a)local.domain.com" ./reconfigure "cf_by=LOCAL.USER" nsPerl is installed in /opt/fedora-ds/lib/nsPerl5.6.1 *** However, I've found part of the problem: the file ./admin-serv/config/server.xml contain several variables instead of variable values. For example: <VARS accesslog="$SERVER_ROOT/admin-serv/logs/access"/> So it looks like the configuration program had a glitch. Is there a way to fix that on FC3? Thanks, Simon -- Simon (Vsevolod ILyushchenko) simonf(a)cshl.edu http://www.simonf.com Terrorism is a tactic and so to declare war on terrorism is equivalent to Roosevelt's declaring war on blitzkrieg. Zbigniew Brzezinski, U.S. national security advisor, 1977-81

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users August 2005