[Fedora-directory-users] mailing lists , FDS , WinSync
by Nabeel Moidu
Hi
I am planning to put up postfix with authentication from Fedora Directory
Server (Synched to a Windows AD so that user creation is
completely done at the AD).I have sync'ed the AD and the FDS( thanks to Rich
M for that).
My doubts are
When a user account is created in the AD will its user attributes be enough
for authentication for a postfix user ? Does it require any schema updation
on the FDS or the AD?
When mailing lists are created on the mail server , does it have anything to
do with the LDAP server or will it be directly stored on the mail server
itself?
Thanks in Advance
Regards
Nabeel
18 years, 7 months
RE: [Fedora-directory-users] ldap_client_file issues on Solaris
by Tay, Gary
This line does not seem to make sense:
NS_LDAP_AUTH= none
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com on behalf of Vsevolod (Simon) Ilyushchenko
Sent: Tue 9/20/2005 4:46 AM
To: General discussion list for the Fedora Directory server project.
Cc:
Subject: [Fedora-directory-users] ldap_client_file issues on Solaris
Hi,
This is not technically FDS, but it pertains to some of the earlier
discussions about FDS/Sun interoperability.
A few weeks ago I have succesfully configured a Solaris 9 box to
authenticate against FDS and use the auto_home entries stored there. Now
that I revisit my setup, the auto_home part does not work:
bash-2.05$ sudo ldaplist -l auto_home
ldaplist: LDAP configuration problem (Unable to load configuration
'/var/ldap/ldap_client_file' ('').)
The message log is not helpful:
Sep 19 16:41:16 merman ldaplist[314]: [ID 293258 user.error] libsldap:
Status: 2 Mesg: Unable to load configuration
'/var/ldap/ldap_client_file' ('').
I'm using the same ldap_client_file that I did before:
NS_LDAP_FILE_VERSION= 2.0
NS_LDAP_SERVERS= server.cshl.edu
NS_LDAP_SEARCH_BASEDN= dc=cshl,dc=edu
NS_LDAP_AUTH= none
NS_LDAP_SEARCH_REF= FALSE
NS_LDAP_SEARCH_SCOPE= one
NS_LDAP_SEARCH_TIME= 30
NS_LDAP_CACHETTL= 3600
NS_LDAP_PROFILE= tls_automount_profile
NS_LDAP_CREDENTIAL_LEVEL= proxy
NS_LDAP_SERVICE_SEARCH_DESC= passwd: ou=People,dc=cshl,dc=edu?one
NS_LDAP_SERVICE_SEARCH_DESC= group: ou=group,dc=cshl,dc=edu?one
NS_LDAP_SERVICE_SEARCH_DESC= shadow: ou=People,dc=cshl,dc=edu?one
NS_LDAP_SERVICE_SEARCH_DESC= netgroup: ou=Netgroup,dc=cshl,dc=edu?one
NS_LDAP_SERVICE_SEARCH_DESC= auto.home: ou=auto.home,dc=cshl,dc=edu?one
NS_LDAP_BIND_TIME= 10
NS_LDAP_ATTRIBUTEMAP= automount: automountInformation=nisMapEntry
NS_LDAP_ATTRIBUTEMAP= automount: automountKey=cn
NS_LDAP_ATTRIBUTEMAP= automount: automountMapName=nisMapName
NS_LDAP_OBJECTCLASSMAP= automount: AUTOMount=nisObject
NS_LDAP_OBJECTCLASSMAP= automount: automountMap=nisMap
Does anybody know what's going on?
Thanks,
Simon
--
Simon (Vsevolod ILyushchenko) simonf(a)cshl.edu
http://www.simonf.com
Terrorism is a tactic and so to declare war on terrorism
is equivalent to Roosevelt's declaring war on blitzkrieg.
Zbigniew Brzezinski, U.S. national security advisor, 1977-81
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
18 years, 7 months
[Fedora-directory-users] ldap_client_file issues on Solaris
by Vsevolod (Simon) Ilyushchenko
Hi,
This is not technically FDS, but it pertains to some of the earlier
discussions about FDS/Sun interoperability.
A few weeks ago I have succesfully configured a Solaris 9 box to
authenticate against FDS and use the auto_home entries stored there. Now
that I revisit my setup, the auto_home part does not work:
bash-2.05$ sudo ldaplist -l auto_home
ldaplist: LDAP configuration problem (Unable to load configuration
'/var/ldap/ldap_client_file' ('').)
The message log is not helpful:
Sep 19 16:41:16 merman ldaplist[314]: [ID 293258 user.error] libsldap:
Status: 2 Mesg: Unable to load configuration
'/var/ldap/ldap_client_file' ('').
I'm using the same ldap_client_file that I did before:
NS_LDAP_FILE_VERSION= 2.0
NS_LDAP_SERVERS= server.cshl.edu
NS_LDAP_SEARCH_BASEDN= dc=cshl,dc=edu
NS_LDAP_AUTH= none
NS_LDAP_SEARCH_REF= FALSE
NS_LDAP_SEARCH_SCOPE= one
NS_LDAP_SEARCH_TIME= 30
NS_LDAP_CACHETTL= 3600
NS_LDAP_PROFILE= tls_automount_profile
NS_LDAP_CREDENTIAL_LEVEL= proxy
NS_LDAP_SERVICE_SEARCH_DESC= passwd: ou=People,dc=cshl,dc=edu?one
NS_LDAP_SERVICE_SEARCH_DESC= group: ou=group,dc=cshl,dc=edu?one
NS_LDAP_SERVICE_SEARCH_DESC= shadow: ou=People,dc=cshl,dc=edu?one
NS_LDAP_SERVICE_SEARCH_DESC= netgroup: ou=Netgroup,dc=cshl,dc=edu?one
NS_LDAP_SERVICE_SEARCH_DESC= auto.home: ou=auto.home,dc=cshl,dc=edu?one
NS_LDAP_BIND_TIME= 10
NS_LDAP_ATTRIBUTEMAP= automount: automountInformation=nisMapEntry
NS_LDAP_ATTRIBUTEMAP= automount: automountKey=cn
NS_LDAP_ATTRIBUTEMAP= automount: automountMapName=nisMapName
NS_LDAP_OBJECTCLASSMAP= automount: AUTOMount=nisObject
NS_LDAP_OBJECTCLASSMAP= automount: automountMap=nisMap
Does anybody know what's going on?
Thanks,
Simon
--
Simon (Vsevolod ILyushchenko) simonf(a)cshl.edu
http://www.simonf.com
Terrorism is a tactic and so to declare war on terrorism
is equivalent to Roosevelt's declaring war on blitzkrieg.
Zbigniew Brzezinski, U.S. national security advisor, 1977-81
18 years, 7 months
[Fedora-directory-users] fds on solaris 9 with PAM
by basile
hi
i ve got FDS install on a Solaris 9 server and want use
FDS as /etc/passwd and /etc/shadow files
FDS works fine i can populate the directory ( and use all ldapcommand ) and
id , getent , su ldaplist commands works fine
here are my problems :
login, ssh , telnet don t work with users in the directory
here are logs of sshd
sshd[1523]: [ID 800047 auth.error] error: PAM: No account present for user for
bmathieu from gentoo1
and for login
login: [ID 293258 auth.error] libsldap: Status: 49 Mesg: openConnection: simple
bind failed - Invalid credentials
a user can t change his passwd ( root can , and i can modify the password
with ldapmodify binding as this user )
i think that PAM don t work
here is my /etc/pam.conf
#
# Authentication management
#
# login service (explicit because of pam_dial_auth)
#
login auth requisite pam_authtok_get.so.1
login auth required pam_dhkeys.so.1
login auth required pam_unix_cred.so.1
login auth required pam_dial_auth.so.1
login auth binding pam_unix_auth.so.1 server_policy
login auth required pam_ldap.so.1
#sshd auth requisite pam_authtok_get.so.1
#sshd auth required pam_dhkeys.so.1
#sshd auth binding pam_unix_auth.so.1 server_policy
#sshd auth required pam_ldap.so.1
#sshd account required pam_unix_account.so.1
sshd auth requisite pam_authtok_get.so.1
sshd auth required pam_dhkeys.so.1
sshd auth sufficient pam_unix_auth.so.1
sshd auth required pam_ldap.so.1
sshd account required pam_unix_account.so.1
#
# rlogin service (explicit because of pam_rhost_auth)
#
rlogin auth sufficient pam_rhosts_auth.so.1
rlogin auth requisite pam_authtok_get.so.1
rlogin auth required pam_dhkeys.so.1
#rlogin auth required pam_unix_cred.so.1
rlogin auth binding pam_unix_auth.so.1 server_policy
rlogin auth required pam_ldap.so.1
#
# rsh service (explicit because of pam_rhost_auth,
# and pam_unix_auth for meaningful pam_setcred)
rsh auth sufficient pam_rhosts_auth.so.1
#rsh auth required pam_unix_cred.so.1
rsh auth binding pam_unix_auth.so.1 server_policy
rsh auth required pam_ldap.so.1
#
# PPP service (explicit because of pam_dial_auth)
#
ppp auth requisite pam_authtok_get.so.1
ppp auth required pam_dhkeys.so.1
ppp auth required pam_dial_auth.so.1
ppp auth binding pam_unix_auth.so.1 server_policy
ppp auth required pam_ldap.so.1
#
# Default definitions for Authentication management
# Used when service name is not explicitly mentioned for authentication
#
other auth requisite pam_authtok_get.so.1
other auth required pam_dhkeys.so.1
#other auth required pam_unix_cred.so.1
other auth binding pam_unix_auth.so.1 server_policy
other auth required pam_ldap.so.1
#
# passwd command (explicit because of a different authentication module)
#
passwd auth binding pam_passwd_auth.so.1 server_policy
passwd auth required pam_ldap.so.1
#
# cron service (explicit because of non-usage of pam_roles.so.1)
#
cron account required pam_unix_account.so.1
#
# Default definition for Account management
# Used when service name is not explicitly mentioned for account management
#
other account requisite pam_roles.so.1
other account binding pam_unix_account.so.1 server_policy
other account required pam_ldap.so.1
#
# Default definition for Session management
# Used when service name is not explicitly mentioned for session management
#
other session required pam_unix_session.so.1
#
# Default definition for Password management
# Used when service name is not explicitly mentioned for password management
#
other password required pam_dhkeys.so.1
other password requisite pam_authtok_get.so.1
other password requisite pam_authtok_check.so.1
other password required pam_authtok_store.so.1 server_policy
thanks
--------------------------------------------------------
Ce message a été envoyé par le Webmail Sorbonne via IMP.
http://courrier.sorbonne.fr/ http://mail.sorbonne.fr/
18 years, 7 months
[Fedora-directory-users] fds on solaris 9 with PAM
by basile
hi
i ve got FDS install on a Solaris 9 server and want use
FDS as /etc/passwd and /etc/shadow files
FDS works fine i can populate the directory ( and use all ldapcommand ) and
id , getent , su ldaplist commands works fine
here are my problems :
login, ssh , telnet don t work with users in the directory
here are logs of sshd
sshd[1523]: [ID 800047 auth.error] error: PAM: No account present for user for
bmathieu from gentoo1
and for login
login: [ID 293258 auth.error] libsldap: Status: 49 Mesg: openConnection: simple
bind failed - Invalid credentials
a user can t change his passwd ( root can , and i can modify the password
with ldapmodify binding as this user )
i think that PAM don t work
here is my /etc/pam.conf
#
# Authentication management
#
# login service (explicit because of pam_dial_auth)
#
login auth requisite pam_authtok_get.so.1
login auth required pam_dhkeys.so.1
login auth required pam_unix_cred.so.1
login auth required pam_dial_auth.so.1
login auth binding pam_unix_auth.so.1 server_policy
login auth required pam_ldap.so.1
#sshd auth requisite pam_authtok_get.so.1
#sshd auth required pam_dhkeys.so.1
#sshd auth binding pam_unix_auth.so.1 server_policy
#sshd auth required pam_ldap.so.1
#sshd account required pam_unix_account.so.1
sshd auth requisite pam_authtok_get.so.1
sshd auth required pam_dhkeys.so.1
sshd auth sufficient pam_unix_auth.so.1
sshd auth required pam_ldap.so.1
sshd account required pam_unix_account.so.1
#
# rlogin service (explicit because of pam_rhost_auth)
#
rlogin auth sufficient pam_rhosts_auth.so.1
rlogin auth requisite pam_authtok_get.so.1
rlogin auth required pam_dhkeys.so.1
#rlogin auth required pam_unix_cred.so.1
rlogin auth binding pam_unix_auth.so.1 server_policy
rlogin auth required pam_ldap.so.1
#
# rsh service (explicit because of pam_rhost_auth,
# and pam_unix_auth for meaningful pam_setcred)
rsh auth sufficient pam_rhosts_auth.so.1
#rsh auth required pam_unix_cred.so.1
rsh auth binding pam_unix_auth.so.1 server_policy
rsh auth required pam_ldap.so.1
#
# PPP service (explicit because of pam_dial_auth)
#
ppp auth requisite pam_authtok_get.so.1
ppp auth required pam_dhkeys.so.1
ppp auth required pam_dial_auth.so.1
ppp auth binding pam_unix_auth.so.1 server_policy
ppp auth required pam_ldap.so.1
#
# Default definitions for Authentication management
# Used when service name is not explicitly mentioned for authentication
#
other auth requisite pam_authtok_get.so.1
other auth required pam_dhkeys.so.1
#other auth required pam_unix_cred.so.1
other auth binding pam_unix_auth.so.1 server_policy
other auth required pam_ldap.so.1
#
# passwd command (explicit because of a different authentication module)
#
passwd auth binding pam_passwd_auth.so.1 server_policy
passwd auth required pam_ldap.so.1
#
# cron service (explicit because of non-usage of pam_roles.so.1)
#
cron account required pam_unix_account.so.1
#
# Default definition for Account management
# Used when service name is not explicitly mentioned for account management
#
other account requisite pam_roles.so.1
other account binding pam_unix_account.so.1 server_policy
other account required pam_ldap.so.1
#
# Default definition for Session management
# Used when service name is not explicitly mentioned for session management
#
other session required pam_unix_session.so.1
#
# Default definition for Password management
# Used when service name is not explicitly mentioned for password management
#
other password required pam_dhkeys.so.1
other password requisite pam_authtok_get.so.1
other password requisite pam_authtok_check.so.1
other password required pam_authtok_store.so.1 server_policy
thanks
--------------------------------------------------------
Ce message a été envoyé par le Webmail Sorbonne via IMP.
http://courrier.sorbonne.fr/ http://mail.sorbonne.fr/
18 years, 7 months
[Fedora-directory-users] NIS migration?
by Dean Jones
Can anyone point me to docs showing how to migrate from NIS to FDS?
I have found info for create LDIF files for OpenLDAP from NIS entries,
but those are not compatible with FDS from what i have read.
thanks
18 years, 7 months
[Fedora-directory-users] Windows Sync problems
by Nabeel Moidu
Hi
I am trying to sync my Fedora DS with Win 2k03 AD .
I have installed the AD and FDS on two different machines , but can't
proceed now.
The manual on the redhat site asks for Password Sync service to be installed
but I can't find the application Password Sync anywhere .
Is it available on the net for download ?I did a Google but couldn't find
it.
I have tried installing the Password Synchronization that comes along with
Services For Unix v3.5 from Microsoft on the Win2k03 AD, but that doesn't
seem
to have any option anywhere to specify the FDS server name, hostname and
search base as told in the Fedora DS manual.
Can somebody help?
Regards
Nabeel Moidu
18 years, 7 months
[Fedora-directory-users] Importing private key into certificate store
by Kevin M. Myer
Hello,
I would like to use an external application to handle my certificate request
(I'm using self-signed certificates - essentially my CA application would
generate the request and then sign it, instead of using any of the FDS
components to generate the request). This process works fine, except that
there doesn't appear to be an easy way to get the private key for the
certificate into the certificate store. Obviously, if you use the certificate
wizard or certutil to generate the request, the key ends up in the store. But
if you don't, is there a way to import a key, so that importing a certificate
will work? Currently it balks about importing a signed certificate because the
private key is missing. I tried combining key and certificate into one file
(PEM format) but that didn't help.
Kevin
--
Kevin M. Myer
Senior Systems Administrator
Lancaster-Lebanon Intermediate Unit 13 http://www.iu13.org
18 years, 7 months
