December 2006 - 389-users - Fedora mailing-lists

[Fedora-directory-users] New install with Admin Server issues
by Duncan McGreggor 02 Jan '07

02 Jan '07

Hey all, I'm having some troubles with the Admin Server (web). First, some details: * This is my first experience with FDS * I'm running Debian and followed the install instructions here: http://directory.fedora.redhat.com/wiki/Howto:DebianUbuntu * I created/installed the debian package from fedora- ds-1.0.4-1.RHEL3.i386.opt.rpm * I can run the java console application, login, create entries, etc. * I'm a python coder, not a java one, so I have no idea about the java stuff. Here are the issues I am seeing: 1) clicking on the "help" buttons on the java console results in a download dialog with the following message: The file "help" is of type application/octect-stream... 2) Clicking the "Restart" button (admin tasks) on the java console results in a 404 3) Attempting to visit the url http://myhost:62332/ results in a download dialog 4) If I download the file, open it and read it, it's a binary file. The file begins with the following: ELF

2 8

Re: [Fedora-directory-users] Can't connect to admin server as Directory Manager
by Bob Rossi 02 Jan '07

02 Jan '07

Could it be uninterruptible sleep? Just think about it. > On Sat, Dec 23, 2006 at 05:18:42AM -0500, Mike Mueller wrote: > > I just did a fresh install of FDS 1.0.4 on a Gentoo Linux workstation > > (built manually, not from RPM). After running the setup script to > > install it, everything appears to be working, except I can't login to > > the admin console. I can connect to the server via the web browser on > > my admin port (9419) and authenticate fine there. > > > > However, when I start the console up, I do: > > > > User ID: cn=Directory Manager > > Password: <my password> > > Administration URL: http://hostname.domain.com:9419/ > > > > The dialog that I get says: > > > > "Cannot logon because of an incorrect User ID, > > Incorrect password or Directory problem. > > > > HttpException > > Response: HTTP/1.1 401 Authorization Required > > Status: 401 > > URL: http://hostname.domain.com:9419/admin-serv/authenticate" > > > > I made sure that the admin server isn't configured to block any hosts > > or IP addresses (set them both to '*' in the local.conf file). > > > > Here's what the error log says: > > > > [Sat Dec 23 05:09:46 2006] [notice] [client 192.168.2.1] > > admserv_host_ip_check: ap_get_remote_host could not resolve > > 192.168.2.1 > > [Sat Dec 23 05:09:46 2006] [error] [client 192.168.2.1] user > > cn=Directory Manager not found: /admin-serv/authenticate > > > > How could the "cn=Directory Manager" user be not found? Doesn't it > > always exist? Yes, I used the default name for this user when I ran > > setup. > > > > Any input would be appreciated! > > > > Thanks, > > Mike >

5 6

[Fedora-directory-users] Re: Kerberos/Samba/LDAP? Was: FDS - using one password for Samba
by Howard Chu 28 Dec '06

28 Dec '06

> Date: Wed, 27 Dec 2006 10:01:42 -0800 > From: Jim Hogan <jimh(a)u.washington.edu> > I have a brand-new Samba 3.x domain working with LDAP/FDS backend; this > is just for my small (university) department of ~350 users. The > university operates an overarching Kerberos realm. My best possible > case would be to use that Kerberos realm for authentication/password but > continue to maintain department LDAP for actual user/group > authorization/rights. If I can get everything to use people's existing > university password, that would be very sweet; failing that, I have to > give out about 300 passwords in the next month :( > > I see the FDS Kerberos Howto, and it seems to make Kerberos integration > pretty simple, but what is not clear to me is whether it is possible to > pass this Kerberos authentication through to Samba clients. The few > references I see to Samba-Kerberos integration modify the smb.conf with > direct references to kerberos realm and keytab that would seem to result in: > > Samba ----> Kerberos > _____ <---- ________ > > where what I think I want is more like: > > Samba ----> LDAP ----> Kerberos > _____ <---- ____ <---- ________ > > (sorry for the awful ASCII!) where I retain "passdb backend = > ldapsam:ldap://x.x.x.x" as the user/group store, but where LDAP refers > to Kerberos for authn/passwd. > > I was going to pose this question to the Samba users list, but I thought > there might be more value to ask first whether anyone has worked on this > in a FDS context. Not to say anything bad about other LDAP servers, but > I can sometimes find it hard to map integration discussions that use > OpenLDAP examples to my situation. > > So, anyone on the list running a completely integrated > Samba/FDS/Kerberos setup that references an overarching Kerberos realm? You're confusing some of these steps. First of all, the direct Samba -> Kerberos route is only talking about a very special case - an SMB client with its own TGT, getting a service ticket from Kerberos for talking to Samba. In this case, Samba uses Kerberos as the actual client authentication mechanism. And as noted here: http://www.mail-archive.com/samba@lists.samba.org/msg80208.html this only works in Samba3 when Samba is talking to a real ActiveDirectory server. When Samba is configured to talk directly to LDAP, it only uses it as a data store, not as an authentication mechanism. In that case, it is expecting to find sambaNTPassword or sambaLMPassword attributes in the LDAP store, so that it can validate the authentication itself. As such, your Samba -> LDAP -> Kerberos picture doesn't apply. Currently the only way to have all of these things integrated in one place is to use the OpenLDAP server with smbk5pwd module, with Heimdal KDC using OpenLDAP as its data store, and Samba using OpenLDAP as its data store. I've contributed code to the Fedora project to assist them along these same lines but it's still missing secure ldapi:// support and a few other things, so AFAIK OpenLDAP is the only solution at the moment. The only way you could set things up so that authentication works as you want is if the clients send plaintext passwords over the wire. That's obviously a bad idea to begin with, and for recent clients (W2K etc) it's not even an option. If your existing Kerberos KDC is not Heimdal, and you don't have the option of migrating to Heimdal, then I think you're out of luck. I know that there's preliminary support for LDAP in recent MIT releases, but my experience with MIT Kerberos has been pretty unsatisfactory over the years. They only recently took steps to make their library thread-safe, and their library performance is still several times slower than Heimdal's, making it unsuitable for busy sites. Even if you decided to switch to using Heimdal integrated with LDAP, you still need the NTLM keys, which you cannot derive from the Kerberos keys, so I think you're looking at regenerating your ~300 passwords regardless. Of course, there's always the brute force approach of running a password cracker on the KDC database to try to guess the original plaintext. It's a self-defeating activity but I've been cajoled into doing it in the past. (It takes a long time, you may not successfully crack all the accounts, and succeeding only means that your users have poorly chosen passwords that they ought to change anyway.) -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

2 1

[Fedora-directory-users] Do any one know Solution
by Junaid 27 Dec '06

27 Dec '06

Can any one help me, when i install FDS on FC4 and startconsole then following error occurs. Please tell me what to do to start console. the error is [root@fedorasix fedora-ds]# ./startconsole GC Warning: Out of Memory! Returning NIL! GC Warning: Out of Memory! Returning NIL! Exception in thread "main" GC Warning: Out of Memory! Returning NIL! java.lang.OutOfMemoryError GC Warning: Out of Memory! Returning NIL! *** Catastrophic failure while handling uncaught exception. GC Warning: Out of Memory! Returning NIL! [root@fedorasix fedora-ds]# I am waiting for reply.Thankx __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

[Fedora-directory-users] FDS - using one password for Samba and Linux accounts
by Saravana Kumar 27 Dec '06

27 Dec '06

Hi List, I have FDS configured in the server. There are windows and Linux client in our network. Windows users also have Linux. Linux clients are authenticating to fds. Samba server is running in a different server and refers to the fds server(ldapbackend). For windows i had to create a separate password with smbpasswd -a username for each user which means samba password can be different from Linux password. Also the password policy doesn't apply to the smbpasswd i create. Is there a way to use one password for both windows and linux logins? TIA, SK

6 7

[Fedora-directory-users] Fwd: Fedora-directory-users Digest, Vol 19, Issue 23
by Linux Kid 27 Dec '06

27 Dec '06

Reminder # 01 help me plz Message: 2 Date: Wed, 20 Dec 2006 14:42:19 +0500 From: "Linux Kid" <khankhn2(a)gmail.com> Subject: [Fedora-directory-users] help about RedHat Directory Server To: fedora-directory-users(a)redhat.com Message-ID: <6bacfd1c0612200142h24edda9cs156c8c34cd9dd990(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" I need help about how to users in Redhat Directory Server. 1. First to Add on a system with a command line [useradd] and then add in RDS 2. First add in RDS and then with useradd because i am getting this error. [root@station4 ~]# su - ali id: cannot find name for group ID 501 [ali@station4 ~]$ where station4 is client , and home directory of RDS server is mounted here. and that user is added in server. So why i am getting this error, kindly waiting for a fast reply. Regards Linux Kid -------------- next part -------------- An HTML attachment was scrubbed... URL: https://www.redhat.com/archives/fedora-directory-users/attachments/20061220…

3 2

[Fedora-directory-users] Hello plz resolve my problem
by Linux Kid 27 Dec '06

27 Dec '06

I am Waiting for FDS help but no one is helping me.

1 0

[Fedora-directory-users] Password lockout and Account inactivation
by Ankur Agarwal 26 Dec '06

26 Dec '06

Hi, In my application i need to implement password lockout (after 3 unsuccessful attempts) and account inactivation by admin. I am using Weblogic security provider for authenticating my users residing in redhat LDAP. I have 2 questions: 1) Using directory management console i have set lockout account after 3 login attempts. Account does get locked out but i dont know which attribute gets set in user profile to indicate the same? 2) For account inactivation i am setting nsAccountLock=true. Is this correct? When i am trying to login i always get same exception that login failed. Is there a mechanism so that i can identify why login failed ie due to password lockout or account inactivation? regards, Ankur __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

[Fedora-directory-users] Replication multiple suffixes
by Jo De Troy 26 Dec '06

26 Dec '06

Hello, I was wondering what the best way to setup multi-master replication was when multiple suffixes exist on each supplier. Should we first setup each supplier with the same root suffix in the userRoot DB, then setup replication. Then create the 2nd suffix in a separare database and setup replication for this suffix ... I'm currently trying to use the mmr script to setup replication without succes. I have 2 Fedora DS servers running each with a different suffix in their userRoot and would like to setup replication te each other. Thanks in advance, Jo

3 4

[Fedora-directory-users] Using client web applications
by Ersin Er 23 Dec '06

23 Dec '06

Hi, Is there any documentation related to installing/configuring/using dsgw, dsmlgw and orgchart? Thanks. -- Ersin

1 1

[Fedora-directory-users] Can't connect to admin server as Directory Manager
by Mike Mueller 23 Dec '06

23 Dec '06

I just did a fresh install of FDS 1.0.4 on a Gentoo Linux workstation (built manually, not from RPM). After running the setup script to install it, everything appears to be working, except I can't login to the admin console. I can connect to the server via the web browser on my admin port (9419) and authenticate fine there. However, when I start the console up, I do: User ID: cn=Directory Manager Password: <my password> Administration URL: http://hostname.domain.com:9419/ The dialog that I get says: "Cannot logon because of an incorrect User ID, Incorrect password or Directory problem. HttpException Response: HTTP/1.1 401 Authorization Required Status: 401 URL: http://hostname.domain.com:9419/admin-serv/authenticate" I made sure that the admin server isn't configured to block any hosts or IP addresses (set them both to '*' in the local.conf file). Here's what the error log says: [Sat Dec 23 05:09:46 2006] [notice] [client 192.168.2.1] admserv_host_ip_check: ap_get_remote_host could not resolve 192.168.2.1 [Sat Dec 23 05:09:46 2006] [error] [client 192.168.2.1] user cn=Directory Manager not found: /admin-serv/authenticate How could the "cn=Directory Manager" user be not found? Doesn't it always exist? Yes, I used the default name for this user when I ran setup. Any input would be appreciated! Thanks, Mike

1 0

[Fedora-directory-users] Simple Paged Results Control Support in Future?
by Phil Lembo 23 Dec '06

23 Dec '06

> > Date: Fri, 22 Dec 2006 09:30:59 -0700 > From: David Boreham > Subject: Re: [Fedora-directory-users] Simple Paged Results Control > Support in Future? > To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> > > Phil Lembo wrote: > > > Any chance we'll get to see support for Simple Paged Results Control > > in a future version of Fedora Directory? > > It wouldn't be hard to implement because the existing VLV code could be > mostly re-used. > > Are you looking to support an application that already uses simple paged > results ? > Or is there something you're looking for that VLV doesn't do ? > Just like to be able to use the same techniques for paging through different directories. Today I've got to maintain 2 different methods in any scripts that query both FDS and AD -- I know, I know, I should have modularized them long ago... Anyway, OpenLDAP and a couple of other proprietary directories also support SPRC, so the only one I've still got to shift over to VLV for is FDS (and it's proprietary cousins). -- Phil Lembo

1 0

[Fedora-directory-users] DNS?
by Derrick MacPherson 22 Dec '06

22 Dec '06

I'm installing on a server I've got at home, and at the end of the setup I get the gethostbyname failed when creating the server; I'm assuming this is because the server is unable to get DNS cause there is none. Is there a way around this cause it seems like the setup doesn't finish properly? As well, if I go to redo the setup, is it better to uninstall, rpm -e the rpm, then reinstall, run the setup again? When I try to do the setup I get an error after it asks for the admin username and password, seems like it's trying to connect and access information that didn't get into the ldap? Thanks, I hope that all makes sense to someone. -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.15.26/598 - Release Date: 12/22/2006 3:22 PM

3 2

[Fedora-directory-users] Persistent MMR problems
by Chris St. Pierre 22 Dec '06

22 Dec '06

A few months ago, I had a machine die suddenly when the power cord was tripped over. (Oops!) After that, I had some replication issues that I solved with the help of this list. Before long, they came back, and back, and back. Basically, I get a bunch of messages like this in the error logs: [22/Dec/2006:09:26:08 -0600] agmt="cn="Replication to zeppo.nebrwesleyan.edu (o=pab)"" (zeppo:389) - Can't locate CSN 458acc0e000000020000 in the changelog (DBrc=-30990). The consumer may need to be reinitialized. [22/Dec/2006:09:31:09 -0600] agmt="cn="Replication to chico.nebrwesleyan.edu (o=pab)"" (chico:389) - Can't locate CSN 458acc0e000000020000 in the changelog (DBrc=-30990). The consumer may need to be reinitialized. I get similar messages on every host in the 4-way MMR group. Each machine only complains about one CSN, but they're different CSNs on each machine. This morning, I took down all of the replication agreements, and reinitialized every host from one, which I temporarily treated as the authoritative master. Within minutes, these messages were appearing again. Does anyone have any ideas how to solve this once and for all? I've rebuilt my replication agreements countless times, and nothing seems to get them in sync. Any and all ideas are welcome. Thanks. Chris St. Pierre Unix Systems Administrator Nebraska Wesleyan University ---------------------------- Never send mail to thobrux(a)nebrwesleyan.edu

3 2

[Fedora-directory-users] Extracting details from ActiveDirectoryto FDS
by Phil Lembo 22 Dec '06

22 Dec '06

Darren: I wrote a Perl script using the Net::LDAP module and Kartik Subbrao's ldifdiff.pl (in Net::LDAP contrib section on search.cpan.org) to go the other way, updating AD from LDAP (in our case the FDS-related Sun Directory). The basic process I followed was to dump the contents of each directory to LDIF (after all, AD is "just another LDAP directory", ;-), transform the dns so that the source looks like the target (we get the dn by doing a search against the target on a attribute value common to both, in our case, AD CN = LDAP UID), then diffing the transformed files, and using the resulting diff to make my changes to the target. The current version is heavily customized for my company's environment so the code would probably be pretty useless to you, but if a barely competent Perl programmer like me could come up with something like this I'd guess that someone who *really* knew what they were doing could come up with something much better. There are also commercial products out there like Microsoft or Sun's metadirectory, and HP's LDAP Directory Synchronizer (LDSU) (see http://h20219.www2.hp.com/services/cache/11215-0-0-0-121.html) All of these are quite costly. The Sun product is freely downloadable but it is very complex and I'd wouldn't recommend exploring it without professional services assistance. You should also look at Sun's latest Directory Resource Kit, http://developers.sun.com/prodtech/dirserver/reference/techart/DSRK_52.html, which provides a number of tools that can be used together to synchronize disparate directories. The doc is a worthwhile read for getting you thinking about how you'd go about it in your environment. -- Phil Lembo

1 0

[Fedora-directory-users] Simple Paged Results Control Support in Future?
by Phil Lembo 22 Dec '06

22 Dec '06

Any chance we'll get to see support for Simple Paged Results Control in a future version of Fedora Directory? -- Phil Lembo

2 1

[Fedora-directory-users] Signed Documents
by Patricio A. Bruna 21 Dec '06

21 Dec '06

Im looking for a project that works with digital signed documents and can verify the identity against Fedora DS. anyone knows one?

2 1

[Fedora-directory-users] Migration from i-planet 52
by Edward Capriolo 21 Dec '06

21 Dec '06

I recently did an ldif backup of our iplanet 52 database. Its about an 88 MB ldif file. I took this to a new FDS server Dell 850 3 ghz duel core 2 sata hard disks. I ran an ldapadd the data imported perfectly. Then I tried to cutover some systems and give the database some load. System went 200% processor Eventually I realized I was missing indexes so I added them through the graphical tool. The log seemed to do something like this generating index 1% generating index 2% .... generating index 49% Done Seemed weird that they would jump from 49% to Done At this point the new system was running at 100% processor But the queries are running faster on our old 440 MHZ sparc t1 server52 database I ran DB ERROR: db_verify: Page 30: out-of-order key at entry 498 DB ERROR: db_verify: DB->verify: db/o_com/channelcontentowner.db4: DB_VERIFY_BAD: Database verification failed then I tried db2_index. The program seemed to be in a tight loop complaining about 1 missing entry. I do not realize how the data can be so corrupted right after an import. These are someone generic symptoms. Any ideas? Thanks

4 9

[Fedora-directory-users] adding an attribute, howto?
by MJD Shop Account 21 Dec '06

21 Dec '06

I would like to use the pam_passthru plugin to use kerberos authentication via pam_krb5, but am running into a few issues. I need to specify an attribute to use, as I have multiple realms--my uid is just a login name, for the kerberos to work I need <uid>@<realm>. I wasn't sure what to use for the attribute, and was thinking of hijacking the 'description' attribute for this purpose. However another posting to this list gave me the idea of just extending the schema with an additional attribute in 99user.ldif. I would likely want to copy the definition for 'uid' from, say class posixaccount, but rename it to krb5uid or something. Can anyone point me to detailed instructions? Is this trivial or difficult? I looked at the current schema files and was not sure what I wold need to copy to make it work, and how to add the new attribute explicitly to the class schema as an optional attribute. What are the consequences of adding such an attribute when replication is occurring? I assume I must extend the schema on each server, what happens if I neglect to extend the schema on one server and it receives replica info that has this new attribute populated for some users? I would also entertain the idea of having an attribute with just the realm (or a proxy for the realm), and constructing the krbuid equivalent via some operational attribute that constructs it via uid + "@" + realm on the fly, if this is possible. I might even be able to do this using existing location attribute or another existing attribute, I can easily determine the correct realm from corresponding location-specific info associated with each user. But, I don't know how to do this in practice. Also, if anyone has an example pam ldapserver file they could share, I would appreciate it. -Marty

2 1

[Fedora-directory-users] migrating users from Tru64 to Fedora DS
by Israel Garcia 20 Dec '06

20 Dec '06

Hi, I have 4 Tru64 servers with a lot of users and I want to unify the authentication of them using FDS. My idea is to install FDS on a fedora server with replicas if possible. Have anybody done this before? Have FDS scripts to migrate users/home_directory/UID/GID from a passwd file? What do you recommend me? Can I use FDS as en LDAP server for Tru64 clients? thanks in advance regards; Israel

1 0

[Fedora-directory-users] help about RedHat Directory Server
by Linux Kid 20 Dec '06

20 Dec '06

I need help about how to users in Redhat Directory Server. 1. First to Add on a system with a command line [useradd] and then add in RDS 2. First add in RDS and then with useradd because i am getting this error. [root@station4 ~]# su - ali id: cannot find name for group ID 501 [ali@station4 ~]$ where station4 is client , and home directory of RDS server is mounted here. and that user is added in server. So why i am getting this error, kindly waiting for a fast reply. Regards Linux Kid

1 0

[Fedora-directory-users] RE: fds newbie
by Jonathan Loh 19 Dec '06

19 Dec '06

Solved. I just used Sun's JDK. Thanks! __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

[Fedora-directory-users] RE: ds newbie question
by Jonathan Loh 18 Dec '06

18 Dec '06

Ok here we are, for folks who've just joined the fray: I had a FC3 now updated to an FC6 box PIII(800) 512Mb Memory 16gb (I was off by a factor of 10 when I initially reported the problem) 2 to 3 users (this is a test machine) Under FC3 no apparent errors. The admin server just wouldn't take my password. Under FC6 it balks saying there is a lack of memory. The exact message is: GC Warning: Out of Memory! Returning NIL! OK. But according to the documentation this is enough memory for the system. http://www.redhat.com/docs/manuals/dir-server/install/7.1/ch.prereq.prereq.… __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

[Fedora-directory-users] Standalone Windows Console?
by Glenn 18 Dec '06

18 Dec '06

Netscape Directory had a standalone application that gave Windows users access to the directory console. The 4.2 version of this app does not seem to work with Red Hat Directory Server 7.1SP3, and I'm wondering if there is a standalone console available that will. Thanks. -Glenn.

2 1

[Fedora-directory-users] Fedora Directory Server as OS authentication
by Sigurður Bjarnason 18 Dec '06

18 Dec '06

Hi all I have been testing the Fedora Directory server as central authentication for Redhat server environment, it works ok with the authentication but I need to know if there is any other way of managing users centrally and then with tool that can also manage access rights to the clients as well. Or is there maybe a simple way of using FDS in co-op with access rights program like SUDO ..or other ?.. or is using FDS not the recommended way to go here ? Please comment on this and give me suggestions I sure don't want to invent the wheel all over again!! Regards Siggi

3 2

[Fedora-directory-users] make dies with NSS problems
by Eric A. Hall 18 Dec '06

18 Dec '06

Trying to build fds104 and NSS produces pages of errors. At the end of it all is the following: mod_nss.c:434: error: expected '{' at end of input make[2]: *** [mod_nss.lo] Error 1 make[2]: Leaving directory `/tmp/dsbuild-fds104/ds/mod_nss/work/mod_nss-1.0.5' make[1]: *** [build-work/mod_nss-1.0.5/Makefile] Error 2 make[1]: Leaving directory `/tmp/dsbuild-fds104/ds/mod_nss' make: *** [dep-../../ds/mod_nss] Error 2 Is this a known problem in the current release? Any workarounds? Thanks

2 3

[Fedora-directory-users] ACL migration from OpenLDAP to FDS
by Taymour A. El Erian 17 Dec '06

17 Dec '06

Hi, We have OpenLDAP installation which runs Qmail, Horde/IMP, FreeRADIUS. We are looking into moving to FDS and had converted the schemas and populated the database with sample entries. The problem is I do not know how to migrate the current ACLs in OpenLDAP configuration files (we use OpenLDAP 2.0.x) -- Taymour A El Erian System Division Manager RHCE, LPIC, CCNA, MCSE, CNA TE Data E-mail: taymour.elerian(a)tedata.net Web: www.tedata.net Tel: +(202)-3320700 Fax: +(202)-3320800 Ext: 1101

2 1

Re: [Fedora-directory-users] can't lookup UNIX group Domain Admins
by listman 16 Dec '06

16 Dec '06

Craig White wrote .. > On Fri, 2006-12-15 at 22:24 -0800, listman wrote: > > >> On Fri, 2006-12-15 at 16:35 -0800, listman wrote: > > >>> Can some one please point me in the right direction to fix this? > Iâ€™ve > > >>> searched samba group and the only thing I can find is something about > > >>> having the right scripts but they donâ€™t tell you where to > get them or > > >>> how > > >>> to run them. > > >>> Any help would be greatly appreciated. > > >> ---- > > >> sounds like you are looking for smbldap-tools from idealx > > >> > > >> Perhaps you are using packaging from a distribution that offers these > > >> tools or start here if that is indeed what you are looking for... > > >> > > >> http://sourceforge.net/projects/smbldap-tools > > >> > > >> Craig > > >> > > > Thanks Craig > > > That does explain the scripts that I read about but it's not helping > my > > > problem any. > > > I'm going through the samba doc on the FDS site and keep running into > > > problems here and no one seems to know the answer. I have installed > > > everything I need, configurd samba, ldap, bind, and everything else > > > refrenced from the FDS site. I'm missing something thats isn't covered > on > > > the site but I dont know enough to figure out what it is. Heres my > > > smb.conf file if that helps any.. > > > > > > [global] > > > workgroup = DEPFYFFER > > > security = user > > > passdb backend = ldapsam:ldap://depfyffer.com > > > ldap admin dn = cn=Directory Manager > > > ldap suffix = dc=depfyffer,dc=com > > > ldap user suffix = ou=People > > > ldap machine suffix = ou=Computers > > > ldap group suffix = ou=Groups > > > > > > add machine script = /usr/local/sbin/smbldap-useradd -w "%u" > > > add user script = /usr/local/sbin/smbldap-useradd -m "%u" > > > ldap delete dn = Yes > > > #delete user script = /usr/local/sbin/smbldap-userdel "%u" > > > add group script = /usr/local/sbin/smbldap-groupadd -p "%g" > > > #delete group script = /usr/local/sbin/smbldap-groupdel "%g" > > > add user to group script = /usr/local/sbin/smbldap-groupmod -m "%u" > "%g" > > > delete user from group script = /usr/local/sbin/smbldap-groupmod -x > "%u" > > > "%g" > > > set primary group script = /usr/local/sbin/smbldap-usermod -g "%g" > "%u" > > > add machine script = /usr/local/sbin/smbldap-useradd -w "%u" > > > > > > log file = /var/log/%m.log > > > socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 > > > > > > os level = 33 > > > domain logons = yes > > > domain master = yes > > > local master = yes > > > preferred master = yes > > > > > > wins support = yes > > > > > > logon home = \\%L\%u\profiles > > > logon path = \\%L\profiles\%u > > > logon drive = H: > > > > > > template shell = /bin/false > > > winbind use default domain = no > > > > > > [netlogon] > > > path = /var/lib/samba/netlogon > > > read only = yes > > > browsable = no > > > > > > [profiles] > > > path = /var/lib/samba/profiles > > > read only = no > > > create mask = 0600 > > > directory mask = 0700 > > > > > > [homes] > > > browsable = no > > > writable = yes > > > > > > > This may help also?? > > > > [root@depfyffer log]# smbpasswd -D 10 -a -m > > Netbios name list:- > > my_netbios_names[0]="DEPFYFFER" > > Attempting to register passdb backend ldapsam > > Successfully added passdb backend 'ldapsam' > > Attempting to register passdb backend ldapsam_compat > > Successfully added passdb backend 'ldapsam_compat' > > Attempting to register passdb backend NDS_ldapsam > > Successfully added passdb backend 'NDS_ldapsam' > > Attempting to register passdb backend NDS_ldapsam_compat > > Successfully added passdb backend 'NDS_ldapsam_compat' > > Attempting to register passdb backend smbpasswd > > Successfully added passdb backend 'smbpasswd' > > Attempting to register passdb backend tdbsam > > Successfully added passdb backend 'tdbsam' > > Attempting to find an passdb backend to match ldapsam:ldap://depfyffer.com > > (ldapsam) > > Found pdb backend ldapsam > > smbldap_search_domain_info: Searching > > for:[(&(objectClass=sambaDomain)(sambaDomainName=DEPFYFFER))] > > smbldap_search_ext: base => [dc=depfyffer,dc=com], filter => > > [(&(objectClass=sambaDomain)(sambaDomainName=DEPFYFFER))], scope => [2] > > The connection to the LDAP server was closed > > smb_ldap_setup_connection: ldap://depfyffer.com > > smbldap_open_connection: connection opened > > ldap_connect_system: Binding to ldap server ldap://depfyffer.com as > > "cn=Directory Manager" > > ldap_connect_system: succesful connection to the LDAP server > > ldap_connect_system: LDAP server does not support paged results > > The LDAP server is succesfully connected > > smbldap_get_single_attribute: [sambaAlgorithmicRidBase] = [<does not > exist>] > > pdb backend ldapsam:ldap://depfyffer.com has a valid init > > smbldap_search_ext: base => [dc=depfyffer,dc=com], filter => > > [(&(uid=root$)(objectclass=sambaSamAccount))], scope => [2] > > ldapsam_getsampwnam: Unable to locate user [root$] count=0 > > Failed to modify password entry for user root$ > ---- > assuming that you have installed smbldap-tools installed and configured > properly (assuming facts not in evidence from the above), you would need > to run smblpdap_populate which will automatically populate your LDAP > with the needed configuration entries for Samba to work properly. > > Official Samba documentation lists the idealx tools (smbldap-tools) > information here... > http://samba.org/samba/docs/man/Samba-Guide/happy.html#sbeidealx > > and consider this section on making happy users... > http://samba.org/samba/docs/man/Samba-Guide/happy.html#id2574922 > > Craig Thanks again Craig, It looks like I'm going to have to start fresh and just try the idealx route. Maybe I can learn enough about samba and ldap that route then move on to FDS after that. FDS seems a little too much for me, I think my biggest downfall is never being exposed to ldap, I've used samba quit a bit but never in this extent. Thanks again for all the pointers.. see ya next time.

1 0

[Fedora-directory-users] can't lookup UNIX group Domain Admins
by listman 16 Dec '06

16 Dec '06

Can some one please point me in the right direction to fix this? Ive searched samba group and the only thing I can find is something about having the right scripts but they dont tell you where to get them or how to run them. Any help would be greatly appreciated.

2 4

[Fedora-directory-users] Re: Fedora-directory-users Digest, Vol 19, Issue 17
by Jonathan Loh 15 Dec '06

15 Dec '06

Richard wrote: >Please post your admin server access and error log files, and the output >of startconsole -D Did you want the whole access log? pretty big. 727 lines in ~40 mins. Though now I'm noticing a bunch of lines with err=32. Here's a snippet: > [15/Dec/2006:10:39:59 -0800] conn=0 op=15 SRCH base="o=NetscapeRoot" scope=0 filter="(objectClass=*)" attrs=ALL > [15/Dec/2006:10:39:59 -0800] conn=0 op=14 RESULT err=0 tag=103 nentries=0 etime=0 > [15/Dec/2006:10:39:59 -0800] conn=0 op=15 RESULT err=32 tag=101 nentries=0 etime=0 > [15/Dec/2006:10:39:59 -0800] conn=0 op=16 ADD dn="o=NetscapeRoot" > [15/Dec/2006:10:39:59 -0800] conn=0 op=16 RESULT err=0 tag=105 nentries=0 etime=0 Here's my errors file: > Fedora-Directory/1.0.4 B2006.312.435 > alphascorp.lchq.us:389 (/opt/fedora-ds/slapd-alphascorp) > [15/Dec/2006:10:39:57 -0800] - Fedora-Directory/1.0.4 B2006.312.435 starting up > [15/Dec/2006:10:39:58 -0800] - slapd started. Listening on All Interfaces port 389 for LDAP requests Thats is it, nothing much. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

[Fedora-directory-users] Re: newbie question
by Jonathan Loh 15 Dec '06

15 Dec '06

Richard wrote: >Please post your admin server access and error log files, and the output >of startconsole -D Did you want the whole access log? pretty big. 727 lines in ~40 mins. Though now I'm noticing a bunch of lines with err=32. Here's a snippet: > [15/Dec/2006:10:39:59 -0800] conn=0 op=15 SRCH base="o=NetscapeRoot" scope=0 filter="(objectClass=*)" attrs=ALL > [15/Dec/2006:10:39:59 -0800] conn=0 op=14 RESULT err=0 tag=103 nentries=0 etime=0 > [15/Dec/2006:10:39:59 -0800] conn=0 op=15 RESULT err=32 tag=101 nentries=0 etime=0 > [15/Dec/2006:10:39:59 -0800] conn=0 op=16 ADD dn="o=NetscapeRoot" > [15/Dec/2006:10:39:59 -0800] conn=0 op=16 RESULT err=0 tag=105 nentries=0 etime=0 Here's my errors file: > Fedora-Directory/1.0.4 B2006.312.435 > alphascorp.lchq.us:389 (/opt/fedora-ds/slapd-alphascorp) > [15/Dec/2006:10:39:57 -0800] - Fedora-Directory/1.0.4 B2006.312.435 starting up > [15/Dec/2006:10:39:58 -0800] - slapd started. Listening on All Interfaces port 389 for LDAP requests Thats is it, nothing much. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

[Fedora-directory-users] User is locked out- ERR 3 LDAP TIMELIMIT EXCEEDED
by Dave Augustus 15 Dec '06

15 Dec '06

I have a check script running on 2 server. One of them is failing. The logs are stating this: RESULT err=3 tag=101 nentries=0 etime=0 Why? How can I fix this? TIA, Dave

3 4

[Fedora-directory-users] Password Policy Question
by Steve Rigler 15 Dec '06

15 Dec '06

Is it possible to specify different types of password encryption on a subtree level from the that which is specified in the global policy? Using 1.0.4, it seems that if I specify "crypt" on the global level, specifying "sha" on a subtree level has no affect on the hashing algorithm used on that subtree. Thanks, Steve

2 2

[Fedora-directory-users] FDS newbie
by Jonathan Loh 15 Dec '06

15 Dec '06

So I've decided to learn FDS by doing. But am running into trouble. I can't log in to the console. Here's what I've done so far: I'm running FC3. I have 1.5GB disk space which should not be a problem since it's about 200M per user and there's just one user I also have 512M of Ram. I'm running the 2.6.12-1.1381 version of the kernel. installed j2sdk 1.4.2-13 made the kernel and other fs tweaks listed on the directory.fedora.redhat.com site. installed fedora-ds 1.0.4 So I did the startconsole thing and couldn't login. The password was even copy and pasted from /opt/fedora-ds/setup/myinstall.inf! nmap originally found my admin port when run within minutes of my initial setup but 10-15 mins later the admin port was gone. I tried running setup/setup again and this time it did give me some errors. But there are none in the errors or access log. Below is the edited output of my last setup command. ----------------------------------------------- In order to reconfigure your installation, the Configuration Directory Administrator password is required. Here is your current information: Configuration Directory: ldap://<hostname>.<domainname>:<port>/o=NetscapeRoot Configuration Administrator ID: admin At the prompt, please enter the password for the Configuration Administrator. administrator ID: admin Password: Converting slapd-<hostname> to new format password file . . . Copying new schema ldiffiles . . . Starting slapd-<hostname> . . . NMC_ErrInfo: NMC_STATUS: -2 Start Slapd Starting Slapd server reconfiguration. Info Slapd No old nsperl references found Configuring Administration Server... InstallInfo: Apache Directory "ApacheDir" is missing. You can now use the console. Here is the command to use to start the console: cd /opt/fedora-ds ./startconsole -u admin -a http://<hostname.domainname>:<port>/ INFO Finished with setup, logfile is setup/setup.log ---------------------------------------------- Any ideas? ____________________________________________________________________________________ Cheap talk? Check out Yahoo! Messenger's low PC-to-Phone call rates. http://voice.yahoo.com

2 1

[Fedora-directory-users] Using FDS to replace ActiveDirectory
by Wayne Johnson 14 Dec '06

14 Dec '06

I've tried to research this but been coming up relatively empty, so any references and examples you can give would be appreciated. I've used LDAP but not in this context. We have a network at our school of various Fedora Core servers and Windows desktops. We'd like to create a homogeneous login system. Fedora can use LDAP of course, but what about Windows. I know ActiveDirectory runs an LDAP server, but can we use FDS as a replacement to AD so that the Windows98 and XP machines we have will use FDS for authentication? Will FDS also do the various other AD functions (like Outlook addresses, etc)? Thanks. --- Wayne Johnson, | There are two kinds of people: Those 3943 Penn Ave. N. | who say to God, "Thy will be done," Minneapolis, MN 55412-1908 | and those to whom God says, "All right, (612) 522-7003 | then, have it your way." --C.S. Lewis __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

[Fedora-directory-users] Extending inetOrgPerson Class
by Ankur Agarwal 13 Dec '06

13 Dec '06

Hi, I want to add some attributes to my users hence want to extend inetOrgPerson class. Have a few questions related to that: 1) I am able to add attributes and create a new class extending inetOrgPerson using Red Hat directory console. But if i want to move these chanegs to other environment do i need to use console only to make chanegs maually? How can i export this new class and attributes and import on target environment? 2) If there is an optional attribute in inetOrgPerson that i want to make mandatory how can i do that? 3) How can i export my new ou and import it to target env? I have looked at dsadm pdf documentation and could not find any ways to move chanegs using scripts/ldif files. Please help me here. Thanks, --------------------------------- Check out the all-new Yahoo! Mail beta - Fire up a more powerful email and get things done faster.

2 1

Re: [Fedora-directory-users] Sort Objects problem in Directory Server Console
by Renato Ribeiro da Silva 12 Dec '06

12 Dec '06

I've made more tests with the Console and the problem is not related to use numbers in attribute uid. Sorry. The problem is that when I click in "sort objects" the console doesn't sort by "uid" but by "cn" attribute. I need to sort by the uid attribute. Thanks, Renato. > Renato Ribeiro da Silva wrote: > > Ok, > > But when I use the ldapsearch command it works succeffuly. ( ./ldapsearch -b <context> objectclass=* -h <host> -S uid ) > > The problem is that I really need to use Personal ID's to identify users on the network. It's not allowed to use another kind of identification. > > Is there any configuration that I can change to sort the users correctly? > > > In what way does it fail in the console? > > -- > Pete > >

3 2

[Fedora-directory-users] FDS and samba
by listman 11 Dec '06

11 Dec '06

Ive gone over a fair share of docs that showed up on google and keep coming back to http://directory.fedora.redhat.com/wiki/Howto:Samba Mainly because it doesnt involve the conlsole. Ive checked it out a few times and added a few users with it but what I really want is a windows/linux pdc and found myself just lost. I checked out http://www.linux.com/article.pl?sid=06/11/28/2019258 but it doesnt really go into depth on setting up samba. So my actual question is, I follow http://directory.fedora.redhat.com/wiki/Howto:Samba to a tee and when I get to /opt/fedora-ds/slapd-<server>/ldif2ldap "cn=Directory manager" password /tmp/sambaGroups.ldif I get Ldap_add: No such object Ldap_add: matched : dc=localdomain I assumed dc=localhost was missing so I changed user directory subtree: from dc=localdomain to dc=localhost,dc=localdomain But I still get the same error. I thought maybe I could ignore it so I continue and type net groupmap add rid=512 ntgroup='Domain Admins' unixgroup='Domain Admins' And get Cant lookup UNIX group Domain Admins Do I just need to add the unix group before I run this? Or do I have other problems? If there is anything else I can provide to help me figure this out just let me know. Oh and yes this is my first encounter with FDS Thanks for any input

1 0

Re: [Fedora-directory-users] Sort Objects problem in Directory Server Console
by Renato Ribeiro da Silva 11 Dec '06

11 Dec '06

Ok, But when I use the ldapsearch command it works succeffuly. ( ./ldapsearch -b <context> objectclass=* -h <host> -S uid ) The problem is that I really need to use Personal ID's to identify users on the network. It's not allowed to use another kind of identification. Is there any configuration that I can change to sort the users correctly? Thank you, Renato. > Renato Ribeiro da Silva wrote: > > Hello, > > I'm trying to sort objects in Directory Server Console ( View Menu -> Sort Objects ) but this function isn't working. I need to use only numbers to identify the users (ex. uid=12345678910). Any idea? > > > > > You should probably use uidNumber from the posixAccount objectclass - > uid is being sorted alphabetically according to its syntax. > > Thanks in advance, > > Renato. > > > > > > -- > > Fedora-directory-users mailing list > > Fedora-directory-users(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > > > > -- > Pete > >

2 1

[Fedora-directory-users] Sort Objects problem in Directory Server Console
by Renato Ribeiro da Silva 11 Dec '06

11 Dec '06

Hello, I'm trying to sort objects in Directory Server Console ( View Menu -> Sort Objects ) but this function isn't working. I need to use only numbers to identify the users (ex. uid=12345678910). Any idea? Thanks in advance, Renato.

2 1

[Fedora-directory-users] db2ldif hangs
by Jo De Troy 10 Dec '06

10 Dec '06

Hello, I have a daily cron job to run db2ldif. But one day last week it kept on running and during that time I couldn't write any changes. When I killed the job I could again write changes. When I rerun db2ldif it completes quickly as before. Has anyone else seen this behavior? I'm running FedoraDS1.0.2 on RHEL4. Thanks in advance, Jo

1 0

[Fedora-directory-users] Multiple Servers. Multiple Consoles?
by Dave Augustus 08 Dec '06

08 Dec '06

Hello All, I have 2 LDAP servers running in MultiMaster behind a load balancer. I also have FDS management consoles running on both. Is the management console required for each install of FDS ? Is there a way to consolidate them? Thanks, Dave

2 3

[Fedora-directory-users] Re: Multiple Servers. Multiple Consoles? (Richard Megginson)
by Phil Lembo 08 Dec '06

08 Dec '06

When we first started with the old iPlanet product all our prod directories were connected to a common admin server config instance. Over time, I found that made things difficult when something would "happen" to that admin server (whether intentionally or unintentionally). As a result, my practice now is to have a separate config instance for each physical server. I've often wanted to go back to using a single config instance, but never had the time to really think through what you'd need to do to recover if, for example, the admin server stopped working for some reason. I think i once saw a way to attach a running directory to a different admin server, just can't remmember where. Something covering that would make a great HOWTO. Phil Lembo On 12/8/06, fedora-directory-users-request(a)redhat.com < fedora-directory-users-request(a)redhat.com> wrote: > > Send Fedora-directory-users mailing list submissions to > fedora-directory-users(a)redhat.com > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.redhat.com/mailman/listinfo/fedora-directory-users > or, via email, send a message with subject or body 'help' to > fedora-directory-users-request(a)redhat.com > > You can reach the person managing the list at > fedora-directory-users-owner(a)redhat.com > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Fedora-directory-users digest..." > > > Today's Topics: > > 1. RE: Error: Database is read-only (Greg Copeland) > 2. Multiple Servers. Multiple Consoles? (Dave Augustus) > 3. Re: Multiple Servers. Multiple Consoles? (Richard Megginson) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 7 Dec 2006 11:16:58 -0600 > From: "Greg Copeland" <GCopeland(a)efjohnson.com> > Subject: RE: [Fedora-directory-users] Error: Database is read-only > To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> > Message-ID: > <273A72C669F45B4996896A031B88CCEF3E17BB(a)EFJDFWMX01.EFJDFW.local> > Content-Type: text/plain; charset="us-ascii" > > I had this happen to me too. I came in one day and found the database > was suddenly marked read-only. I had to find the read-only setting and > make it read/write and everything was happy again. > > Cheers, > > Greg Copeland > > ________________________________ > > From: fedora-directory-users-bounces(a)redhat.com > [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Ersin Er > Sent: Wednesday, December 06, 2006 3:43 PM > To: Fedora-directory-users mailing list > Subject: [Fedora-directory-users] Error: Database is read-only > > Hi all, > > After I played a little bit Fedora Directory Server I started to get an > error message: "Database is read-only", when I tried to modify anything. > Did I change any setting accidently? > > Thanks. > > -- > Ersin > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: > https://www.redhat.com/archives/fedora-directory-users/attachments/20061207… > > ------------------------------ > > Message: 2 > Date: Thu, 07 Dec 2006 17:17:54 -0600 > From: Dave Augustus <davea(a)support.kcm.org> > Subject: [Fedora-directory-users] Multiple Servers. Multiple Consoles? > To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> > Message-ID: <1165533474.16528.3.camel(a)kcm40202.kcmhq.org> > Content-Type: text/plain > > Hello All, > > I have 2 LDAP servers running in MultiMaster behind a load balancer. I > also have FDS management consoles running on both. > > Is the management console required for each install of FDS ? > > Is there a way to consolidate them? > > > Thanks, > Dave > > > > ------------------------------ > > Message: 3 > Date: Thu, 07 Dec 2006 16:34:42 -0700 > From: Richard Megginson <rmeggins(a)redhat.com> > Subject: Re: [Fedora-directory-users] Multiple Servers. Multiple > Consoles? > To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> > Message-ID: <4578A512.5030507(a)redhat.com> > Content-Type: text/plain; charset="iso-8859-1" > > Dave Augustus wrote: > > Hello All, > > > > I have 2 LDAP servers running in MultiMaster behind a load balancer. I > > also have FDS management consoles running on both. > > > > Is the management console required for each install of FDS ? > > > No. > > Is there a way to consolidate them? > > > When you installed the first instance of FDS, it should have created it > as the configuration DS. When you run setup subsequent times, in > Typical mode, you will be given the opportunity to register the new > instance with the configuration DS. > > > > Thanks, > > Dave > > > > -- > > Fedora-directory-users mailing list > > Fedora-directory-users(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > > -------------- next part -------------- > A non-text attachment was scrubbed... > Name: smime.p7s > Type: application/x-pkcs7-signature > Size: 3245 bytes > Desc: S/MIME Cryptographic Signature > Url : > https://www.redhat.com/archives/fedora-directory-users/attachments/20061207… > > ------------------------------ > > -- > Fedora-directory-users mailing list > Fedora-directory-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > > End of Fedora-directory-users Digest, Vol 19, Issue 11 > ****************************************************** > -- Phil Lembo e-mail: phil.lembo(a)gmail.com

1 0

[Fedora-directory-users] Error: Database is read-only
by Ersin Er 07 Dec '06

07 Dec '06

Hi all, After I played a little bit Fedora Directory Server I started to get an error message: "Database is read-only", when I tried to modify anything. Did I change any setting accidently? Thanks. -- Ersin

3 2

[Fedora-directory-users] Windows Sync without Domain Admin?
by Nicholas Byrne 07 Dec '06

07 Dec '06

Hi all, Is it possible to do a syncronisation of a windows peer without the windows user who i use to bind being a domain admin? I have a read only user with which i can run ldapsearch and find all users data in the AD directory but using the same user to sync with fails. The replication status says "total update completed" but i see no updates to the my FDS directory. If i modify this user in AD to be a domain admin it works correctly, but what i want to know is why can't i use a read-only user to sync? Is there any way around this? Thanks Nick This e-mail is the property of Quadriga Worldwide Ltd, intended for the addressee only and confidential. Any dissemination, copying or distribution of this message or any attachments is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer. Messages sent to and from Quadriga may be monitored. Quadriga cannot guarantee any message delivery method is secure or error-free. Information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. We do not accept responsibility for any errors or omissions in this message and/or attachment that arise as a result of transmission. You should carry out your own virus checks before opening any attachment. Any views or opinions presented are solely those of the author and do not necessarily represent those of Quadriga.

4 4

[Fedora-directory-users] RE: pam_ldap with SSL/TLS
by t b 06 Dec '06

06 Dec '06

>From: fedora-directory-users-request(a)redhat.com >Reply-To: fedora-directory-users(a)redhat.com >To: fedora-directory-users(a)redhat.com >Subject: Fedora-directory-users Digest, Vol 19, Issue 3 >Date: Sat, 2 Dec 2006 12:00:05 -0500 (EST) > >Send Fedora-directory-users mailing list submissions to > fedora-directory-users(a)redhat.com > >To subscribe or unsubscribe via the World Wide Web, visit > https://www.redhat.com/mailman/listinfo/fedora-directory-users >or, via email, send a message with subject or body 'help' to > fedora-directory-users-request(a)redhat.com > >You can reach the person managing the list at > fedora-directory-users-owner(a)redhat.com > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of Fedora-directory-users digest..." > > >Today's Topics: > > 1. Re: RE: Fedora-directory-users Digest, Vol 19, Issue 1 > (Richard Megginson) > 2. Re: AD + FDS sync stops working? (To Ngan) > 3. Re: Memory usage (koniczynek) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Fri, 01 Dec 2006 12:55:24 -0700 >From: Richard Megginson <rmeggins(a)redhat.com> >Subject: Re: [Fedora-directory-users] RE: Fedora-directory-users > Digest, Vol 19, Issue 1 >To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> >Message-ID: <457088AC.1030004(a)redhat.com> >Content-Type: text/plain; charset="iso-8859-1" > >t b wrote: > > My logs seem to indicate that the connection is being encrypted; I can > > ssh to a client server and get the password prompt, but when I enter > > the password it just returns me to the password prompt again > > > > [01/Dec/2006:19:47:44 -0500] conn=650 fd=69 slot=69 connection from > > xxx.xxx.xxx.xxx to xxx.xxx.xxx.xxx > > [01/Dec/2006:19:47:44 -0500] conn=650 op=0 EXT > > oid="1.3.6.1.4.1.1466.20037" name="startTLS" > > [01/Dec/2006:19:47:44 -0500] conn=650 op=0 RESULT err=0 tag=120 > > nentries=0 etime=0 > > [01/Dec/2006:19:47:44 -0500] conn=650 SSL 256-bit AES >All of this means the client was able to successfully perform the >startTLS extended operation and start using SSL. > > [01/Dec/2006:19:47:44 -0500] conn=650 op=1 UNBIND > > [01/Dec/2006:19:47:44 -0500] conn=650 op=1 fd=69 closed - U1 >The UNBIND means the client had a problem and closed the connection. >Does the client print any errors? Are there any messages in the server >error log? > > > > If I disable TLS everything works fine, the client server can query > > the FDS and auth the client properly > > > > I am not sure if the problem has to do with the pam_ldap not properly > > formatted or the cert file not in proper format > > > > Does anyone have an example of what the pam_ldap config should look > > like? or suggestions on checking whether the cert file is in proper > > format >I'm not sure. PAM needs the ca cert of the CA that issued the directory >server server cert. See >http://directory.fedora.redhat.com/wiki/Howto:SSL for more information. > > > > Also what's the UNBIND shown in the logs? > > > > Thanks > > Problem solved, the following link added the missing part to the puzzle, http://www.fedoraforum.org/forum/archive/index.php/t-1997.html The problem turns out to be that when you run the command /usr/bin/authconfig as recommended at, http://directory.fedora.redhat.com/wiki/Howto:PAM it does not make all of the necessary adjustments to /etc/ldap.conf -- you need to also add the settings mentioned in the link above Hopes this helps anyone having the same issues, and thanks to everyone for their suggestions As an addition, I am trying to download the posixuser auto creation script from, http://www.netauth.com/~jacksonm/ldap/newuser.pl.txt but the port seems to be blocked; does anyone know where I can get a hold of that script Thanks > >> From: fedora-directory-users-request(a)redhat.com > >> Reply-To: fedora-directory-users(a)redhat.com > >> To: fedora-directory-users(a)redhat.com > >> Subject: Fedora-directory-users Digest, Vol 19, Issue 1 > >> Date: Fri, 1 Dec 2006 12:00:06 -0500 (EST) > >> > >> Send Fedora-directory-users mailing list submissions to > >> fedora-directory-users(a)redhat.com > >> > >> To subscribe or unsubscribe via the World Wide Web, visit > >> https://www.redhat.com/mailman/listinfo/fedora-directory-users > >> or, via email, send a message with subject or body 'help' to > >> fedora-directory-users-request(a)redhat.com > >> > >> You can reach the person managing the list at > >> fedora-directory-users-owner(a)redhat.com > >> > >> When replying, please edit your Subject line so it is more specific > >> than "Re: Contents of Fedora-directory-users digest..." > >> > >> > >> Today's Topics: > >> > >> 1. pam_ldap with SSL/TLS (t b) > >> 2. RE: pam_ldap with SSL/TLS (Morris, Patrick) > >> 3. Re: pam_ldap with SSL/TLS (Richard Megginson) > >> 4. Problem with SSL console in X in specific circumstances > >> (Philip Kime) > >> 5. FW: [Fedora-directory-users] Extracting details from > >> ActiveDirectoryto FDS (Paxton, Darren) > >> 6. alias in fedora directory server (patrick ndjientcheu ngandjui) > >> 7. Re: FW: [Fedora-directory-users] Extracting details from > >> ActiveDirectoryto FDS (Nicholas Byrne) > >> 8. Re: Memory usage (koniczynek) > >> 9. Re: Memory usage (David Boreham) > >> 10. Re: Memory usage (koniczynek) > >> > >> > >> ---------------------------------------------------------------------- > >> > >> Message: 1 > >> Date: Thu, 30 Nov 2006 12:31:50 -0500 > >> From: "t b" <mxheadroom(a)hotmail.com> > >> Subject: [Fedora-directory-users] pam_ldap with SSL/TLS > >> To: fedora-directory-users(a)redhat.com > >> Message-ID: <BAY116-F322745E96D702ED748B1D0CDDB0(a)phx.gbl> > >> Content-Type: text/plain; format=flowed > >> > >> I am trying to setup pam_ldap to use TLS to communicate with the FDS, > >> but > >> having lots of problems doing so; it works if I use the unencrypted > >> way but > >> not if I use ldaps ( port 636 ) > >> > >> I used the instructions at, > >> http://directory.fedora.redhat.com/wiki/Howto:PAM > >> > >> Has anyone gotten PAM to work TLS > >> > >> > >> Thanks > >> > >> _________________________________________________________________ > >> Buy, Load, Play. The new Sympatico / MSN Music Store works seamlessly > >> with > >> Windows Media Player. Just Click PLAY. > >> >http://musicstore.sympatico.msn.ca/content/viewer.aspx?cid=SMS_Sept192006 > >> > >> > >> > >> > >> ------------------------------ > >> > >> Message: 2 > >> Date: Thu, 30 Nov 2006 13:00:56 -0500 > >> From: "Morris, Patrick" <patrick.morris(a)hp.com> > >> Subject: RE: [Fedora-directory-users] pam_ldap with SSL/TLS > >> To: "General discussion list for the Fedora Directory server project." > >> <fedora-directory-users(a)redhat.com> > >> Message-ID: > >> ><CD18C81835E18A40A64C4A0D16A237BE05FE850D(a)ATAEXC01.americas.cpqcorp.net> > >> > >> > >> Content-Type: text/plain; charset="US-ASCII" > >> > >> > I am trying to setup pam_ldap to use TLS to communicate with > >> > the FDS, but having lots of problems doing so; it works if I > >> > use the unencrypted way but not if I use ldaps ( port 636 ) > >> > >> Someone should jump in here and correct me if I'm wrong, but I believe > >> it's normal for TLS connections to happen on the standard LDAP port. > >> You should be able to tell from your logs whether the connection is > >> encrypted or not. > >> > >> > >> > >> ------------------------------ > >> > >> Message: 3 > >> Date: Thu, 30 Nov 2006 11:08:08 -0700 > >> From: Richard Megginson <rmeggins(a)redhat.com> > >> Subject: Re: [Fedora-directory-users] pam_ldap with SSL/TLS > >> To: "General discussion list for the Fedora Directory server project." > >> <fedora-directory-users(a)redhat.com> > >> Message-ID: <456F1E08.40601(a)redhat.com> > >> Content-Type: text/plain; charset="iso-8859-1" > >> > >> Morris, Patrick wrote: > >> >> I am trying to setup pam_ldap to use TLS to communicate with > >> >> the FDS, but having lots of problems doing so; it works if I > >> >> use the unencrypted way but not if I use ldaps ( port 636 ) > >> >> > >> > > >> > Someone should jump in here and correct me if I'm wrong, but I >believe > >> > it's normal for TLS connections to happen on the standard LDAP port. > >> > You should be able to tell from your logs whether the connection is > >> > encrypted or not. > >> > > >> Yes. The LDAP "preferred" way is to use the startTLS extended >operation > >> which starts a TLS session on the non-secure port. This will be logged > >> in the access log. > >> > -- > >> > Fedora-directory-users mailing list > >> > Fedora-directory-users(a)redhat.com > >> > https://www.redhat.com/mailman/listinfo/fedora-directory-users > >> > > >>

1 0

[Fedora-directory-users] Show Effective Rights via the console
by Ersin Er 06 Dec '06

06 Dec '06

Hi all, I am trying to use the "Show Effective Rights" feature via the console, however I get nothing when I check the box. Just an "Entry Level Rights:" label is displayed at the bottom of the window but no value is displayed for neither the Entry nor attributes. Do I have to do some more configuration to make this work? Thanks. -- Ersin

3 3

RE: [Fedora-directory-users] Adding admin users
by Jo De Troy 06 Dec '06

06 Dec '06

Hi Rich, what exactly do you mean? Searching for the uid=admin? So adding a user to the Directory Administrators is not good enough. What extra rights does an extra admin user need? And how should I enable these rights for this user? Can I do this from the console? Or do I better do it via an ldif import? Thanks in advance, Jo > Hello, > > I was wondering what the correct way is to add a extra admin user (not > directory manager or admin) who could login via the console to do > maintenance tasks. Add users/groups, reset passwords, unlock users, > restore backups, do imports, etc > I tried adding a user as uniquemember to the group Directory > Administrators and I can login to the console but I can only see the > domain in the default view I cannot select the server or the admin > server or directory server console. > I guess using an aci for every specific user that needs privileged > access is not the best way. > No. I suggest searching for the uid=admin user that gets created during setup. Thanks in advance, > Jo > -- Fedora-directory-users mailing list Fedora-directory-users redhat com https://www.redhat.com/mailman/listinfo/fedora-directory-users

2 1

[Fedora-directory-users] Adding admin users
by Jo De Troy 06 Dec '06

06 Dec '06

Hello, I was wondering what the correct way is to add a extra admin user (not directory manager or admin) who could login via the console to do maintenance tasks. Add users/groups, reset passwords, unlock users, restore backups, do imports, etc I tried adding a user as uniquemember to the group Directory Administrators and I can login to the console but I can only see the domain in the default view I cannot select the server or the admin server or directory server console. I guess using an aci for every specific user that needs privileged access is not the best way. Thanks in advance, Jo

2 1

[Fedora-directory-users] Advanced button hidden when editing user and groups
by Renato Ribeiro da Silva 06 Dec '06

06 Dec '06

Hello, I'm trying to edit users properties using the Fedora Management Console ( users and groups tab ), but I need to update advanced attributes too. The problem is that the "Advanced Button" doesn't appear. If I use the Directory Console I can access the button without problems. Any idea about what is happening? Thanks in advance, Renato.

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users December 2006