389-users August 2005

389-users@lists.fedoraproject.org

40 participants
61 discussions

[Fedora-directory-users] Strange ldif export with é, è, ... french characters code
by Atr0pos 14 Aug '05

14 Aug '05

Hello all, When users have some french characters code in fields (i.e. givenName & cn), the ldif export file is bad. Here my ldif users import file and the ldif export file using admin console. import-with-french-char.ldif : dn: uid=s.courtin,ou=people,dc=domain,dc=fr changetype: add objectClass: person objectClass: organizationalperson objectClass: inetOrgPerson objectClass: top objectClass: mailrecipient uid: s.courtin sn: COURTIN givenName: Ségolène cn: Ségolène COURTIN employeeType: Etudiants userPassword: ****** mail: s.courtin(a)domain.fr export-bad.ldif: dn: uid=s.courtin,ou=people,dc=domain,dc=fr employeeType: Etudiants givenName:: U8OpZ29sw6huZQ== objectClass: person objectClass: organizationalperson objectClass: inetOrgPerson objectClass: top objectClass: mailrecipient uid: s.courtin mail: s.courtin(a)domain.fr cn:: U8OpZ29sw6huZSBDT1VSVElO sn: COURTIN userPassword: ********* creatorsname: cn=manager modifiersname: cn=manager createtimestamp: 20050814113424Z modifytimestamp: 20050814113424Z nsuniqueid: 4ced0081-1dd211b2-80efc6a3-3b060000 parentid: 4 entryid: 1874 entrydn: uid=s.courtin,ou=people,dc=domain,dc=fr numsubordinates: 0 subschemasubentry: cn=schema hassubordinates: FALSE If I use "cn: Segolene COURTIN" & "givenName: Segolene", the export file is correct ... but I would use french char. Is there a bug or (probably) a configuration error ? For information my FDS is running on FC3 with LANG=fr_FR.UTF-8. Thanks in advance for your help. - Lalas -

2 2

[Fedora-directory-users] Group members management
by Atr0pos 11 Aug '05

11 Aug '05

Hello all (and sorry for my poor english), One simple example to illustrate my question : I have one user in one group (all created with the admin console), when I delete the user, the group's field "Member Name" ever include the complete DN uid=my.user,ou=People,dc=my-domain,dc=com ... ("Member User ID" is empty) Is it possible to automatically clean the Member Name field (because wirh 2000 users and 150 groups it's harder to manage )? Thanks in advance. - Lalas -

2 2

[Fedora-directory-users] How mature is FDS?
by Alexander Stagun 10 Aug '05

10 Aug '05

Hi, I am currently evaluating different Directory Server software which will replace some part of our production NIS/Samba based authentication system. Our first tests looked really promising except for one bug we encountered: deleting a view crashes the ns-slapd process hard (bugzilla bug #164610). Now I have to admit, I am a bit unsure regarding the maturity of the FDS project. I thought we are dealing with the good old and mature Netscape iPlanet sources here, but I can't believe such a bug could go unnoticed. So I'd really like to know, is there anyone outside who uses FDS in a sort of mission critical environment? Is FDS on par with NDS or Sun's DS regarding stability and scalability? Regarding the bug we filed - is there anything we could do in order to help fixing that issue? Kind Regards, Alex -- Alexander Stagun MindMatics AG Marcel-Breuer-Str. 18 DE 80807 München email : alexander.stagun(a)mindmatics.de fon : +49 89 322986 15 fax : +49 89 322986 70 web : http://www.mindmatics.com http://www.mindmatics.de ------------------------------------------------------------------------ Die Information in dieser E-Mail ist vertraulich und exklusiv für den Adressatenkreis bestimmt. Unbefugte Empfänger haben kein Recht, vom Inhalt Kenntnis zu nehmen, fehlgeleitete E-Mails sind sofort zu löschen. Bitte informieren Sie hierüber unverzüglich die MindMatics AG. Weiterleiten oder Kopieren, darf auch auszugsweise nur mit ausdrücklicher, schriftlicher Einwilligung der MindMatics AG erfolgen. In jedem Fall ist sicherzustellen, dass keinerlei inhaltliche Veränderungen erfolgen. Die MindMatics AG ist von der Richtigkeit des Inhalts und der Übertragung dieser E-Mail überzeugt. Eine Haftung dafür ist jedoch ausgeschlossen. ------------------------------------------------------------------------ This is a confidential communication intended only for the named addresses. If you receive this communication in error, please notify us and return and delete it without reading it. This e-mail may not be disclosed, copied or distributed in any form without the obtained permission in writing of MindMatics AG. In any case it may not be altered or otherwise changed. Whilst MindMatics AG believes that the information is correct at the date of the e-mail, no warranty and representation is given to this effect and MindMatics AG can accept no responsibility.

2 1

[Fedora-directory-users] Does anyone has the document of performance of fedora DS ?
by William.Zhang 09 Aug '05

09 Aug '05

thanks in advance. ��j(��m��)��ｗ(��

1 0

[Fedora-directory-users] Enabling SSL
by Kevin Kovach 03 Aug '05

03 Aug '05

Hello, I've worked through the SSL howto on the FDS site and everything went well until I got to the part where I modified the schema. The /tmp/ssl_enable.ldif modifications that are suggested work well up to the point where it tries to modify cn=RSA,cn=encryption,cn=config To be specific, the recommended changes are as follows... dn: cn=encryption,cn=config changetype: modify replace: nsSSL3 nsSSL3: on - replace: nsSSLClientAuth nsSSLClientAuth: allowed - add: nsSSL3Ciphers nsSSL3Ciphers: -rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5,+rsa_des_sha,+rsa_fips_des_sha, +rsa_3des_sha,+rsa_fips_3des_sha,+fortezza,+fo - add: nsKeyfile nsKeyfile: alias/slapd-directory-key3.db - add: nsCertfile nsCertfile: alias/slapd-directory-cert8.db dn: cn=RSA,cn=encryption,cn=config changetype: modify add: nsSSLPersonalitySSL nsSSLPersonalitySSL: Server-Cert dn: cn=config changetype: modify add: nsslapd-security nsslapd-security: on - replace: nsslapd-ssl-check-hostname nsslapd-ssl-check-hostname: off It seems as though when I get to the point where I want to add the 'nsSSLPersonalitySSL' attribute my directory server complains that the 'cn=RSA,cn=encryption,cn=config' object does not exist to be modified. I don't see anywhere in the HOWTO where I would have created this object. Am I missing something? Thanks. - Kevin

5 21

[Fedora-directory-users] What next?
by Chris Curran 03 Aug '05

03 Aug '05

Hi, hello: I've just installed the Fedora Directory Server (on a Fedora 3 machine) and I seem to have all modules up and running. I've created one user and I can "browse" the DS server from another machine using a Java based tool. What isn't clear to me is where do I go from here? What entries do I need to create in the Directory Console so that the user can (for example) access a Thunderbird contact list in the DS? Or a 'favorites' url list? thanks, Chris Curran

7 16

[Fedora-directory-users] Re: [Fedora Directory Users] Winsync woes
by Dimitri Yioulos 03 Aug '05

03 Aug '05

On Tuesday August 2 2005 6:15 pm, David Boreham wrote: > >But I've checked and rechecked those. My bind DN is cn=Admin. That's the > >correct format, isn't it? > > > >- > > Indeed no. You want the DN for the Administrator user in AD. > Typically that would be something like 'cn=Administrator, ou=users, > dc=company, dc=com'. > However, I would recommend that you use ldapsearch to first establish > the correct DN > (search for all users in AD and go looking for the administrator user). David, I changed the DN as you suggested, and my sync worked (just as I imagine you expected it would). Thank you very much! If I may be so bold as to take advantage of your knowledge and kindness - when I created the Windows Sync Agreement, I specified the DS subtree as ou=People,dc=headquarters,dc=mydomain,dc=com, and the Windows subtree as cn=People,dc=headquarters,dc=mydomain,dc=com. When the sync completed, all Windows users and groups ended up in the FDS People subtree. How would I get Windows groups to populate the FDS gorups subtree, and only users to populate the People subtree? Dimitri

2 3

[Fedora-directory-users] too many fds open
by Craig Ayliffe 03 Aug '05

03 Aug '05

Hi, Has anyone come across problem with directory server having too many fds open, which then causes it to not receive any new connections? Version: Fedora-Directory/7.1 B2005.146.2010 OS: Linux ds01 2.6.11-1.1369_FC4 #1 Thu Jun 2 22:55:56 EDT 2005 i686 i686 i386 GNU/Linux >From the logs/error: [28/Jul/2005:19:22:42 +1000] - Listening for new connections again [28/Jul/2005:19:22:42 +1000] - Not listening for new connections - too many fds open [28/Jul/2005:19:22:42 +1000] - Listening for new connections again [28/Jul/2005:19:22:42 +1000] - Not listening for new connections - too many fds open [28/Jul/2005:21:00:22 +1000] - Listening for new connections again One thing I have noticed is a lot of tcp connections owned by the ns-slapd process, that are suspended in the CLOSE_WAIT state. # netstat -nap ... tcp 0 0 ::ffff:10.10.246.31:389 ::ffff:10.10.245.12:54566 CLOSE_WAIT 17118/ns-slapd tcp 0 0 ::ffff:10.10.246.31:389 ::ffff:10.10.245.12:54502 CLOSE_WAIT 17118/ns-slapd tcp 0 0 ::ffff:10.10.246.31:389 ::ffff:10.10.245.12:54758 CLOSE_WAIT 17118/ns-slapd tcp 0 0 ::ffff:10.10.246.31:389 ::ffff:10.10.245.12:54569 CLOSE_WAIT 17118/ns-slapd tcp 0 0 ::ffff:10.10.246.31:389 ::ffff:10.10.245.12:54312 CLOSE_WAIT 17118/ns-slapd tcp 0 0 ::ffff:10.10.246.31:389 ::ffff:10.10.245.12:54440 CLOSE_WAIT 17118/ns-slapd tcp 0 0 ::ffff:10.10.246.31:389 ::ffff:10.10.245.12:54379 CLOSE_WAIT 17118/ns-slapd tcp 0 0 ::ffff:10.10.246.31:389 ::ffff:10.10.245.12:54315 CLOSE_WAIT 17118/ns-slapd Regards, -- Craig Ayliffe

3 2

[Fedora-directory-users] Winsync woes
by Dimitri Yioulos 02 Aug '05

02 Aug '05

Hello to all. I recently installed FDS on a CentOS 3 box. My network authenticates to a win2k3 AD box. I'd like to use the Winsync feature of FDS to keep it automatically updated. Firstly, FDS does work, to the extent that I populated ou=People, and can see and use those entries in Kmail. I've followed the Admin manual regarding installation and configuration of Winsync on both the FDS and AD boxes, but I can't get it to work. I receive an error "81- LDAP error: can't contact LDAP server". By now, it's entirely probable that I've munged up the configuration, having tried so many tweaks. I'm really not sure where to begin in terms of providing info to you so that you can help me out. With your kind indulgence, it might be better for you to ask me questions about my setup, and we can go from there (I realize that's a bassackwards way to ask for help, but ...). Here, at least, are some basics: I obtained server and CA certs from CACert.org, and plugged those into FDS. I created the user Admin on both the FDS and ADS boxes. I created a Replica Agreement. I ran the Winsync utility on the ADS box. I'm trying to use port 636. I do have a couple of questions: what's the proper way to specify a Supplier DN, and should I use "SSL client authentication" or simple authentication" in the Replica Agreement? Many thanks. Dimitri

2 5

[Fedora-directory-users] Manager login on port 389?
by Vsevolod (Simon) Ilyushchenko 02 Aug '05

02 Aug '05

Hi, I'm trying to bind to FDS as "cn=Manager, ..." and looks like it does not work unless I use SSL (I can only do it from an application, not from command-line tools, though). TLS on port 389 does not work either. Is it a feature or am I missing something? Thanks, Simon -- Simon (Vsevolod ILyushchenko) simonf(a)cshl.edu http://www.simonf.com Terrorism is a tactic and so to declare war on terrorism is equivalent to Roosevelt's declaring war on blitzkrieg. Zbigniew Brzezinski, U.S. national security advisor, 1977-81

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users August 2005