389-users December 2006

389-users@lists.fedoraproject.org

57 participants
73 discussions

[Fedora-directory-users] New install with Admin Server issues
by Duncan McGreggor 02 Jan '07

02 Jan '07

Hey all, I'm having some troubles with the Admin Server (web). First, some details: * This is my first experience with FDS * I'm running Debian and followed the install instructions here: http://directory.fedora.redhat.com/wiki/Howto:DebianUbuntu * I created/installed the debian package from fedora- ds-1.0.4-1.RHEL3.i386.opt.rpm * I can run the java console application, login, create entries, etc. * I'm a python coder, not a java one, so I have no idea about the java stuff. Here are the issues I am seeing: 1) clicking on the "help" buttons on the java console results in a download dialog with the following message: The file "help" is of type application/octect-stream... 2) Clicking the "Restart" button (admin tasks) on the java console results in a 404 3) Attempting to visit the url http://myhost:62332/ results in a download dialog 4) If I download the file, open it and read it, it's a binary file. The file begins with the following: ELF

2 8

Re: [Fedora-directory-users] Can't connect to admin server as Directory Manager
by Bob Rossi 02 Jan '07

02 Jan '07

Could it be uninterruptible sleep? Just think about it. > On Sat, Dec 23, 2006 at 05:18:42AM -0500, Mike Mueller wrote: > > I just did a fresh install of FDS 1.0.4 on a Gentoo Linux workstation > > (built manually, not from RPM). After running the setup script to > > install it, everything appears to be working, except I can't login to > > the admin console. I can connect to the server via the web browser on > > my admin port (9419) and authenticate fine there. > > > > However, when I start the console up, I do: > > > > User ID: cn=Directory Manager > > Password: <my password> > > Administration URL: http://hostname.domain.com:9419/ > > > > The dialog that I get says: > > > > "Cannot logon because of an incorrect User ID, > > Incorrect password or Directory problem. > > > > HttpException > > Response: HTTP/1.1 401 Authorization Required > > Status: 401 > > URL: http://hostname.domain.com:9419/admin-serv/authenticate" > > > > I made sure that the admin server isn't configured to block any hosts > > or IP addresses (set them both to '*' in the local.conf file). > > > > Here's what the error log says: > > > > [Sat Dec 23 05:09:46 2006] [notice] [client 192.168.2.1] > > admserv_host_ip_check: ap_get_remote_host could not resolve > > 192.168.2.1 > > [Sat Dec 23 05:09:46 2006] [error] [client 192.168.2.1] user > > cn=Directory Manager not found: /admin-serv/authenticate > > > > How could the "cn=Directory Manager" user be not found? Doesn't it > > always exist? Yes, I used the default name for this user when I ran > > setup. > > > > Any input would be appreciated! > > > > Thanks, > > Mike >

5 6

[Fedora-directory-users] Re: Kerberos/Samba/LDAP? Was: FDS - using one password for Samba
by Howard Chu 28 Dec '06

28 Dec '06

> Date: Wed, 27 Dec 2006 10:01:42 -0800 > From: Jim Hogan <jimh(a)u.washington.edu> > I have a brand-new Samba 3.x domain working with LDAP/FDS backend; this > is just for my small (university) department of ~350 users. The > university operates an overarching Kerberos realm. My best possible > case would be to use that Kerberos realm for authentication/password but > continue to maintain department LDAP for actual user/group > authorization/rights. If I can get everything to use people's existing > university password, that would be very sweet; failing that, I have to > give out about 300 passwords in the next month :( > > I see the FDS Kerberos Howto, and it seems to make Kerberos integration > pretty simple, but what is not clear to me is whether it is possible to > pass this Kerberos authentication through to Samba clients. The few > references I see to Samba-Kerberos integration modify the smb.conf with > direct references to kerberos realm and keytab that would seem to result in: > > Samba ----> Kerberos > _____ <---- ________ > > where what I think I want is more like: > > Samba ----> LDAP ----> Kerberos > _____ <---- ____ <---- ________ > > (sorry for the awful ASCII!) where I retain "passdb backend = > ldapsam:ldap://x.x.x.x" as the user/group store, but where LDAP refers > to Kerberos for authn/passwd. > > I was going to pose this question to the Samba users list, but I thought > there might be more value to ask first whether anyone has worked on this > in a FDS context. Not to say anything bad about other LDAP servers, but > I can sometimes find it hard to map integration discussions that use > OpenLDAP examples to my situation. > > So, anyone on the list running a completely integrated > Samba/FDS/Kerberos setup that references an overarching Kerberos realm? You're confusing some of these steps. First of all, the direct Samba -> Kerberos route is only talking about a very special case - an SMB client with its own TGT, getting a service ticket from Kerberos for talking to Samba. In this case, Samba uses Kerberos as the actual client authentication mechanism. And as noted here: http://www.mail-archive.com/samba@lists.samba.org/msg80208.html this only works in Samba3 when Samba is talking to a real ActiveDirectory server. When Samba is configured to talk directly to LDAP, it only uses it as a data store, not as an authentication mechanism. In that case, it is expecting to find sambaNTPassword or sambaLMPassword attributes in the LDAP store, so that it can validate the authentication itself. As such, your Samba -> LDAP -> Kerberos picture doesn't apply. Currently the only way to have all of these things integrated in one place is to use the OpenLDAP server with smbk5pwd module, with Heimdal KDC using OpenLDAP as its data store, and Samba using OpenLDAP as its data store. I've contributed code to the Fedora project to assist them along these same lines but it's still missing secure ldapi:// support and a few other things, so AFAIK OpenLDAP is the only solution at the moment. The only way you could set things up so that authentication works as you want is if the clients send plaintext passwords over the wire. That's obviously a bad idea to begin with, and for recent clients (W2K etc) it's not even an option. If your existing Kerberos KDC is not Heimdal, and you don't have the option of migrating to Heimdal, then I think you're out of luck. I know that there's preliminary support for LDAP in recent MIT releases, but my experience with MIT Kerberos has been pretty unsatisfactory over the years. They only recently took steps to make their library thread-safe, and their library performance is still several times slower than Heimdal's, making it unsuitable for busy sites. Even if you decided to switch to using Heimdal integrated with LDAP, you still need the NTLM keys, which you cannot derive from the Kerberos keys, so I think you're looking at regenerating your ~300 passwords regardless. Of course, there's always the brute force approach of running a password cracker on the KDC database to try to guess the original plaintext. It's a self-defeating activity but I've been cajoled into doing it in the past. (It takes a long time, you may not successfully crack all the accounts, and succeeding only means that your users have poorly chosen passwords that they ought to change anyway.) -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

2 1

[Fedora-directory-users] Do any one know Solution
by Junaid 27 Dec '06

27 Dec '06

Can any one help me, when i install FDS on FC4 and startconsole then following error occurs. Please tell me what to do to start console. the error is [root@fedorasix fedora-ds]# ./startconsole GC Warning: Out of Memory! Returning NIL! GC Warning: Out of Memory! Returning NIL! Exception in thread "main" GC Warning: Out of Memory! Returning NIL! java.lang.OutOfMemoryError GC Warning: Out of Memory! Returning NIL! *** Catastrophic failure while handling uncaught exception. GC Warning: Out of Memory! Returning NIL! [root@fedorasix fedora-ds]# I am waiting for reply.Thankx __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

[Fedora-directory-users] FDS - using one password for Samba and Linux accounts
by Saravana Kumar 27 Dec '06

27 Dec '06

Hi List, I have FDS configured in the server. There are windows and Linux client in our network. Windows users also have Linux. Linux clients are authenticating to fds. Samba server is running in a different server and refers to the fds server(ldapbackend). For windows i had to create a separate password with smbpasswd -a username for each user which means samba password can be different from Linux password. Also the password policy doesn't apply to the smbpasswd i create. Is there a way to use one password for both windows and linux logins? TIA, SK

6 7

[Fedora-directory-users] Fwd: Fedora-directory-users Digest, Vol 19, Issue 23
by Linux Kid 27 Dec '06

27 Dec '06

Reminder # 01 help me plz Message: 2 Date: Wed, 20 Dec 2006 14:42:19 +0500 From: "Linux Kid" <khankhn2(a)gmail.com> Subject: [Fedora-directory-users] help about RedHat Directory Server To: fedora-directory-users(a)redhat.com Message-ID: <6bacfd1c0612200142h24edda9cs156c8c34cd9dd990(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" I need help about how to users in Redhat Directory Server. 1. First to Add on a system with a command line [useradd] and then add in RDS 2. First add in RDS and then with useradd because i am getting this error. [root@station4 ~]# su - ali id: cannot find name for group ID 501 [ali@station4 ~]$ where station4 is client , and home directory of RDS server is mounted here. and that user is added in server. So why i am getting this error, kindly waiting for a fast reply. Regards Linux Kid -------------- next part -------------- An HTML attachment was scrubbed... URL: https://www.redhat.com/archives/fedora-directory-users/attachments/20061220…

3 2

[Fedora-directory-users] Hello plz resolve my problem
by Linux Kid 27 Dec '06

27 Dec '06

I am Waiting for FDS help but no one is helping me.

1 0

[Fedora-directory-users] Password lockout and Account inactivation
by Ankur Agarwal 26 Dec '06

26 Dec '06

Hi, In my application i need to implement password lockout (after 3 unsuccessful attempts) and account inactivation by admin. I am using Weblogic security provider for authenticating my users residing in redhat LDAP. I have 2 questions: 1) Using directory management console i have set lockout account after 3 login attempts. Account does get locked out but i dont know which attribute gets set in user profile to indicate the same? 2) For account inactivation i am setting nsAccountLock=true. Is this correct? When i am trying to login i always get same exception that login failed. Is there a mechanism so that i can identify why login failed ie due to password lockout or account inactivation? regards, Ankur __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

[Fedora-directory-users] Replication multiple suffixes
by Jo De Troy 26 Dec '06

26 Dec '06

Hello, I was wondering what the best way to setup multi-master replication was when multiple suffixes exist on each supplier. Should we first setup each supplier with the same root suffix in the userRoot DB, then setup replication. Then create the 2nd suffix in a separare database and setup replication for this suffix ... I'm currently trying to use the mmr script to setup replication without succes. I have 2 Fedora DS servers running each with a different suffix in their userRoot and would like to setup replication te each other. Thanks in advance, Jo

3 4

[Fedora-directory-users] Using client web applications
by Ersin Er 23 Dec '06

23 Dec '06

Hi, Is there any documentation related to installing/configuring/using dsgw, dsmlgw and orgchart? Thanks. -- Ersin

1 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users December 2006