[Fedora-directory-users] non local access problem to FDS console
by Yoandy Mesa
hi,
i have a problem with non local acces to the fedora console, and all other FDS application (dsgw, etc) i always get http error code 401 (authorization required)
my /opt/fedora-ds/admin-serv/config/httpd.conf
<Directory /opt/fedora-ds>
Options Indexes FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
</Directory>
denies access from anywhere but in my /opt/fedora-ds/admin-serv/config/admserv.conf more specific <directory> clauses grant access to application like this:
<Directory "/opt/fedora-ds/clients/dsgw/bin/">
AllowOverride None
Options None
Order allow,deny
Allow from all
NESCompatEnv on
</Directory>
if i understand the:
Order allow,deny
Allow from all
above, should grant me acces from anywhere ... but i always get 401 error.
what i´m missing here ?
thanks in advanced, yoandy
17 years, 5 months
[Fedora-directory-users] password sync with 2 AD domains
by Mikael Kermorgant
Hello,
I've read about password sync between Active Directory and Fedora
Directory Server.
In my environment, there is one global LDAP server built upon FDS, and
two Active directory domains.
Is there any hope to get password sync between FDS and both Active
Directory domains or is this feature limited to one Active Directory
domain ?
Thanks in advance,
--
Mikael Kermorgant
17 years, 5 months
[Fedora-directory-users] modify userPassword via perl-ldap?
by Jo De Troy
Hello,
I'm trying to modify the userPassword value from within a perl script
using Perl::LDAP.
I generate an encrypted pwd in perl and then write it to FedoraDS via
ldap->modify
The update seems successfull but when I query FedoraDS afterwards the
string in userPassword is not the same as the one I generated. What
exactly is happening in the background giving this result? I tried
writing the same value to another attribute (eg mail) and then it is
as expected.
What's the best way to update the userPassword from within perl?
Thanks again,
Jo
17 years, 5 months
RE: [Fedora-directory-users] Issue with fine-grained password policy
by Howard Chu
> Date: Thu, 26 Oct 2006 12:06:08 -0500
> From: "Greg Copeland" <GCopeland(a)efjohnson.com>
>> > Actually PADL's pam_ldap has had support for Netscape password policy
>> > for many years - you just have to enable it and tell it the DN of the
>> > policy object. Recently support has also been added for the IETF draft
>
> Can you expand on the "...tell it the DN..." part there?
I misspoke. When you configure the pam_lookup_policy keyword pam_ldap
will do an anonymous search in the rootDSE with a filter
(objectclass=passwordPolicy) and use what it finds there. So the only
requirement is that you give anonymous enough privileges to perform the
search.
--
-- Howard Chu
Chief Architect, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc
OpenLDAP Core Team http://www.openldap.org/project/
17 years, 5 months
[Fedora-directory-users] Is it possible to use events to create homedirs when user entry is created or deleted? (resend)
by Kimmo Koivisto
Resending this message:
Hello
I have small environment with one FDS server and one application
server, both RHEL4ES. FDS server provides ldap authentication and home
directories for app server with ldap and nfs.
I administrate users and groups with phpldapadmin or windows based
ldapadmin, everything is working fine.
When I add new user to the FDS, I have to create home directory for
that user manually, set permissions and copy /etc/skel files.
I would like to do home directory administration tasks automatically
when user is added or deleted from FDS.
One solution (I don't like this) is that I use some command line ldap
capable adduser instead of ldapadmin or phpldapadmin.
Does FDS have any event support that I could use or are there any
existing solutions for this problem?
Best Regards
Kimmo Koivisto
17 years, 5 months
[Fedora-directory-users] Use of NetGroups breaks local logins
by Kyle Tucker
Hi all,
New installation of FDS 1.0.2 on FC5. I have gotten netgroup access
to host logins set up and working by following the steps in this document.
http://directory.fedora.redhat.com/wiki/Howto:Netgroups
This required the addition of this new (second) line in the account section
of /etc/pam.d/system-auth for the access.netgroup.conf file to avoid issues
with crond, which they don't elaborate on.
account required pam_unix.so broken_shadow debug
account required pam_access.so accessfile=/etc/security/access.netgroup.conf
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_ldap.so debug
account required pam_permit.so
But now I am seeing these failures in /var/log/secure.
Oct 25 18:01:01 lin2600 crond[22707]: pam_access(crond:account): access denied
for user `root' from `cron'
I also cannot log in as root.
So firstly, is all the advice in the above document accurate? Is the placement
of this line incorrect (I am just starting to play with PAM) or do I need to
add entries for root (or ALL) in /etc/security/access.conf (presently all
commented out as it appears to be the default setup)?
Thanks.
--
- Kyle
---------------------------------------------
kylet(a)panix.com http://www.panix.com/~kylet
---------------------------------------------
17 years, 6 months
Re: [Fedora-directory-users] Issue with fine-grained password policy
by Howard Chu
> Date: Wed, 25 Oct 2006 14:40:45 -0700
> From: "George Holbert" <gholbert(a)broadcom.com>
> Last time I looked at this, I vaguely recall finding that pam_ldap
> doesn't pay too much attention to FDS password metadata for expiration
> warnings or strength restrictions. So what you're seeing may be the norm.
> Hopefully someone else out there will have better news for you on this.
Actually PADL's pam_ldap has had support for Netscape password policy
for many years - you just have to enable it and tell it the DN of the
policy object. Recently support has also been added for the IETF draft
LDAP password policy specification too, and it works well with the
OpenLDAP implementation of this spec. The OpenLDAP implementation has
also been tested successfully with CA eTrust, so there are at least a
couple implementations out there supporting the IETF spec.
> Ian Meyer wrote:
>> > Hello all,
>> >
>> > I set up FDS 1.0.2 on a server and got everything configured and
>> > imported etc etc.. things
>> > work great, I can authenticate against it, make updates.. but I can
>> > not get our linux
>> > clients to warn me about changing my password, expiration, length,
>> > etc.. I followed the instructions on
>> > http://www.redhat.com/docs/manuals/dir-server/ag/7.1/password.html#1074672
>> >
>> > to set up a global config, and a user config. Is there anything on the
>> > client side for PAM that needs to be configured? I've been pouring
>> > over this for a couple of days now so I may just be blind to a small
>> > detail I may have missed. Any help/insight would be appreciated.
>> >
>> > Thanks in advance,
>> > Ian
--
-- Howard Chu
Chief Architect, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc
OpenLDAP Core Team http://www.openldap.org/project/
17 years, 6 months
[Fedora-directory-users] Root changing user password
by Greg Copeland
I've quickly checked the archive and I can find people having trouble
with users changing their own password but not the other way around.
Here, users can change their own password without issue but root fails.
What do I need to do to allow root, using the passwd command on RHES 4,
to change user passwords?
I've tried setting rootbinddn in my /etc/ldap.conf file. Without an
/etc/ldap.secret file, I observe an error in my logs, complaining about
the missing ldap.secret file. When I create it, the error goes away but
the passwd command still fails with, "passwd: Authentication token
manipulation error". In the logs I can observe, "passwd[23689]:
pam_ldap: error trying to bind (Invalid credentials)." I've tried
placing the admin password in cleartext, and base64 in the ldap.secret
file.
Frankly, I'd rather root be prompted for the LDAP admin password than
the password be stored in a file anyways. Is this possible?
Long of the short, what do I need to configure to allow root to change
other user's LDAP passwords?
Best Regards,
Greg Copeland
17 years, 6 months
