December 2006 - 389-users - Fedora mailing-lists

[Fedora-directory-users] SSH login and pwd expiration message
by Jo De Troy 05 Dec '06

05 Dec '06

Hello, I've configured a RHEL3 as LDAP client to my FedoraDS 1.0.2 on RHEL4. When I login via ssh with an LDAP account on the ldapclient I immediately get You are required to change your password immediately (password aged) Your password has expired, the session cannot proceed. You must change your password now and login again! After that I change the password and login again and I get the same error again. Any idea what's causing this? Is it an ACL that's preventing some attributes to be updates? Which attributes? If I just for testing delete these attributes I should get rid of this message, shouldn't I? Thanks in advance, Jo

3 4

[Fedora-directory-users] RE: Fedora-directory-users Digest, Vol 19, Issue 3
by t b 05 Dec '06

05 Dec '06

>From: fedora-directory-users-request(a)redhat.com >Reply-To: fedora-directory-users(a)redhat.com >To: fedora-directory-users(a)redhat.com >Subject: Fedora-directory-users Digest, Vol 19, Issue 3 >Date: Sat, 2 Dec 2006 12:00:05 -0500 (EST) > >Send Fedora-directory-users mailing list submissions to > fedora-directory-users(a)redhat.com > >To subscribe or unsubscribe via the World Wide Web, visit > https://www.redhat.com/mailman/listinfo/fedora-directory-users >or, via email, send a message with subject or body 'help' to > fedora-directory-users-request(a)redhat.com > >You can reach the person managing the list at > fedora-directory-users-owner(a)redhat.com > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of Fedora-directory-users digest..." > > >Today's Topics: > > 1. Re: RE: Fedora-directory-users Digest, Vol 19, Issue 1 > (Richard Megginson) > 2. Re: AD + FDS sync stops working? (To Ngan) > 3. Re: Memory usage (koniczynek) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Fri, 01 Dec 2006 12:55:24 -0700 >From: Richard Megginson <rmeggins(a)redhat.com> >Subject: Re: [Fedora-directory-users] RE: Fedora-directory-users > Digest, Vol 19, Issue 1 >To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> >Message-ID: <457088AC.1030004(a)redhat.com> >Content-Type: text/plain; charset="iso-8859-1" > >t b wrote: > > My logs seem to indicate that the connection is being encrypted; I can > > ssh to a client server and get the password prompt, but when I enter > > the password it just returns me to the password prompt again > > > > [01/Dec/2006:19:47:44 -0500] conn=650 fd=69 slot=69 connection from > > xxx.xxx.xxx.xxx to xxx.xxx.xxx.xxx > > [01/Dec/2006:19:47:44 -0500] conn=650 op=0 EXT > > oid="1.3.6.1.4.1.1466.20037" name="startTLS" > > [01/Dec/2006:19:47:44 -0500] conn=650 op=0 RESULT err=0 tag=120 > > nentries=0 etime=0 > > [01/Dec/2006:19:47:44 -0500] conn=650 SSL 256-bit AES >All of this means the client was able to successfully perform the >startTLS extended operation and start using SSL. > > [01/Dec/2006:19:47:44 -0500] conn=650 op=1 UNBIND > > [01/Dec/2006:19:47:44 -0500] conn=650 op=1 fd=69 closed - U1 >The UNBIND means the client had a problem and closed the connection. >Does the client print any errors? Are there any messages in the server >error log? On the client server it show, sshd[24149]: Failed password for invalid user xxxxx from xxx.xxx.xxx.xxx port xxx ssh2 > > > > If I disable TLS everything works fine, the client server can query > > the FDS and auth the client properly > > > > I am not sure if the problem has to do with the pam_ldap not properly > > formatted or the cert file not in proper format > > > > Does anyone have an example of what the pam_ldap config should look > > like? or suggestions on checking whether the cert file is in proper > > format >I'm not sure. PAM needs the ca cert of the CA that issued the directory >server server cert. See >http://directory.fedora.redhat.com/wiki/Howto:SSL for more information. > > That was the info I used to do the SSL setup, but I only see a part of the log output they indicated, Their logs, [18/Jul/2005:20:33:36 -0400] conn=4 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [18/Jul/2005:20:33:36 -0400] conn=4 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [18/Jul/2005:20:33:36 -0400] conn=4 SSL 256-bit AES [18/Jul/2005:20:33:36 -0400] conn=4 op=1 BIND dn="" method=128 version=3 [18/Jul/2005:20:33:36 -0400] conn=4 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [18/Jul/2005:20:33:36 -0400] conn=4 op=2 SRCH base="dc=example,dc=com" scope=2 filter="(uid=testuser)" attrs=ALL My Logs, [04/Dec/2006:14:35:52 -0500] conn=757 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [04/Dec/2006:14:35:52 -0500] conn=757 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [04/Dec/2006:14:35:52 -0500] conn=757 SSL 256-bit AES [04/Dec/2006:14:35:52 -0500] conn=757 op=1 UNBIND [04/Dec/2006:14:35:52 -0500] conn=757 op=1 fd=71 closed - U1 For some reason my setup dies just before querying the FDS to determine user details Do you know of any tests that I can run just on the client server to determine proper confuguration? > > Also what's the UNBIND shown in the logs? > > > > Thanks > > > >> From: fedora-directory-users-request(a)redhat.com > >> Reply-To: fedora-directory-users(a)redhat.com > >> To: fedora-directory-users(a)redhat.com > >> Subject: Fedora-directory-users Digest, Vol 19, Issue 1 > >> Date: Fri, 1 Dec 2006 12:00:06 -0500 (EST) > >> > >> Send Fedora-directory-users mailing list submissions to > >> fedora-directory-users(a)redhat.com > >> > >> To subscribe or unsubscribe via the World Wide Web, visit > >> https://www.redhat.com/mailman/listinfo/fedora-directory-users > >> or, via email, send a message with subject or body 'help' to > >> fedora-directory-users-request(a)redhat.com > >> > >> You can reach the person managing the list at > >> fedora-directory-users-owner(a)redhat.com > >> > >> When replying, please edit your Subject line so it is more specific > >> than "Re: Contents of Fedora-directory-users digest..." > >> > >> > >> Today's Topics: > >> > >> 1. pam_ldap with SSL/TLS (t b) > >> 2. RE: pam_ldap with SSL/TLS (Morris, Patrick) > >> 3. Re: pam_ldap with SSL/TLS (Richard Megginson) > >> 4. Problem with SSL console in X in specific circumstances > >> (Philip Kime) > >> 5. FW: [Fedora-directory-users] Extracting details from > >> ActiveDirectoryto FDS (Paxton, Darren) > >> 6. alias in fedora directory server (patrick ndjientcheu ngandjui) > >> 7. Re: FW: [Fedora-directory-users] Extracting details from > >> ActiveDirectoryto FDS (Nicholas Byrne) > >> 8. Re: Memory usage (koniczynek) > >> 9. Re: Memory usage (David Boreham) > >> 10. Re: Memory usage (koniczynek) > >> > >> > >> ---------------------------------------------------------------------- > >> > >> Message: 1 > >> Date: Thu, 30 Nov 2006 12:31:50 -0500 > >> From: "t b" <mxheadroom(a)hotmail.com> > >> Subject: [Fedora-directory-users] pam_ldap with SSL/TLS > >> To: fedora-directory-users(a)redhat.com > >> Message-ID: <BAY116-F322745E96D702ED748B1D0CDDB0(a)phx.gbl> > >> Content-Type: text/plain; format=flowed > >> > >> I am trying to setup pam_ldap to use TLS to communicate with the FDS, > >> but > >> having lots of problems doing so; it works if I use the unencrypted > >> way but > >> not if I use ldaps ( port 636 ) > >> > >> I used the instructions at, > >> http://directory.fedora.redhat.com/wiki/Howto:PAM > >> > >> Has anyone gotten PAM to work TLS > >> > >> > >> Thanks > >> > >> _________________________________________________________________ > >> Buy, Load, Play. The new Sympatico / MSN Music Store works seamlessly > >> with > >> Windows Media Player. Just Click PLAY. > >> >http://musicstore.sympatico.msn.ca/content/viewer.aspx?cid=SMS_Sept192006 > >> > >> > >> > >> > >> ------------------------------ > >> > >> Message: 2 > >> Date: Thu, 30 Nov 2006 13:00:56 -0500 > >> From: "Morris, Patrick" <patrick.morris(a)hp.com> > >> Subject: RE: [Fedora-directory-users] pam_ldap with SSL/TLS > >> To: "General discussion list for the Fedora Directory server project." > >> <fedora-directory-users(a)redhat.com> > >> Message-ID: > >> ><CD18C81835E18A40A64C4A0D16A237BE05FE850D(a)ATAEXC01.americas.cpqcorp.net> > >> > >> > >> Content-Type: text/plain; charset="US-ASCII" > >> > >> > I am trying to setup pam_ldap to use TLS to communicate with > >> > the FDS, but having lots of problems doing so; it works if I > >> > use the unencrypted way but not if I use ldaps ( port 636 ) > >> > >> Someone should jump in here and correct me if I'm wrong, but I believe > >> it's normal for TLS connections to happen on the standard LDAP port. > >> You should be able to tell from your logs whether the connection is > >> encrypted or not. > >> > >> > >> > >> ------------------------------ > >> > >> Message: 3 > >> Date: Thu, 30 Nov 2006 11:08:08 -0700 > >> From: Richard Megginson <rmeggins(a)redhat.com> > >> Subject: Re: [Fedora-directory-users] pam_ldap with SSL/TLS > >> To: "General discussion list for the Fedora Directory server project." > >> <fedora-directory-users(a)redhat.com> > >> Message-ID: <456F1E08.40601(a)redhat.com> > >> Content-Type: text/plain; charset="iso-8859-1" > >> > >> Morris, Patrick wrote: > >> >> I am trying to setup pam_ldap to use TLS to communicate with > >> >> the FDS, but having lots of problems doing so; it works if I > >> >> use the unencrypted way but not if I use ldaps ( port 636 ) > >> >> > >> > > >> > Someone should jump in here and correct me if I'm wrong, but I >believe > >> > it's normal for TLS connections to happen on the standard LDAP port. > >> > You should be able to tell from your logs whether the connection is > >> > encrypted or not. > >> > > >> Yes. The LDAP "preferred" way is to use the startTLS extended >operation > >> which starts a TLS session on the non-secure port. This will be logged > >> in the access log. > >> > -- > >> > Fedora-directory-users mailing list > >> > Fedora-directory-users(a)redhat.com > >> > https://www.redhat.com/mailman/listinfo/fedora-directory-users > >> > > >>

3 3

RE: [Fedora-directory-users] insufficient acces error (50)
by Jo De Troy 05 Dec '06

05 Dec '06

Hello, "nsslapd-readonly" on userRoot was on. Very weird, that is. I changed it back in the interface and it works again. Thanks a million, Jo

1 0

RE: [Fedora-directory-users] insufficient acces error (50)
by Jo De Troy 05 Dec '06

05 Dec '06

Hi Rich, certainly no replication was set up. The last thing I could do was disable a user, soon afterwards the helpdesk tried resetting a password via a perl script and we got this error. What would we the best and/or quickest way to get back to an operational directory service? A restore from a directory backup? Could I enable more logging to find out what is causing this behavior? Thanks again, Jo

2 1

[Fedora-directory-users] access permissions
by patrick ndjientcheu ngandjui 05 Dec '06

05 Dec '06

hi, I want to access a permission to a user so that he can create, in the entry he belongs to (say ou=SalesDept,ou=Employee,ou=example,ou=com),entries which are an instance of a particular object class say ExamplePerson. But, he must not have the right to modify or delete entries he has created. How can I resolve this problem? Thanks. --------------------------------- Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire.

2 1

RE: [Fedora-directory-users] insufficient acces error (50)
by Jo De Troy 05 Dec '06

05 Dec '06

Hi, I'm using the directory manager, he should have enough permissions. It has always worked just now it stopped working. I even tried adding an ou attribute and I get the message: LDAP server is unwilling to perform; database is read-only. Any ideas? Thans again, Jo

1 0

Re:[Fedora-directory-users] insufficient access (50) error
by Renato Ribeiro da Silva 05 Dec '06

05 Dec '06

Hi, Does the user that bind to the Directory is the same that is trying to change password ? By default FDS gives to the user rights to change his own password, but maybe the script is binding with another user. > Hello, > > suddenly when I try to change a password for a user via a perl script > I get the error above. Any ideas what could be causing this? > I'm running Fedora DS 1.0.2 on RHEL4. > > Thanks in advance, > Jo > > -- > Fedora-directory-users mailing list > Fedora-directory-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users >

1 0

[Fedora-directory-users] insufficient access (50) error
by Jo De Troy 05 Dec '06

05 Dec '06

Hello, suddenly when I try to change a password for a user via a perl script I get the error above. Any ideas what could be causing this? I'm running Fedora DS 1.0.2 on RHEL4. Thanks in advance, Jo

1 0

RE: [Fedora-directory-users] insufficient acces error (50)
by Jo De Troy 05 Dec '06

05 Dec '06

Hi, I've enabled heavy error logging by putting nsslapd-errorlog-level to 128 under cn=config When I try to change a password of an existing user (even from within the console) I get NSACLPlugin - conn=128 op=2 (main): Deny write on entry(uid=jdoe,ou=people,dc=example,dc=com): readonly backend Where should I be looking the entry nsslapd-readonly is false. I have tried restarting the directory server, without result. Thanks in advance, Jo

2 1

[Fedora-directory-users] ACI Design
by Radek Hladik 04 Dec '06

04 Dec '06

I'm designing new directory for keeping records about our company computers, accounts, etc... I would like to have number of different access levels like support, management, network technician,... Every entry would have multivalued attribute named for example accessclass to determine its access and there would be role for every access level. What is the best way to implement ACIs like "allow access to every entry with attribute accessclass=support for every member of role support"? I've found out that there are 3 options: 1) Create separate ACI for each access class 2) Create Macro ACI using something like roledn = "ldap:///($attr.accessclass),ou=roles,dc=....." But it seems, that this macro expands to accessclass=support,ou=roles,.. and thus my roles would need to be named using accessclass attribute instead of common name... 3) Create ACI using userattr like this: userattr = "accessclass#ROLEDN" but this would require to have complete role RDN in user accessclass attribute. Which way would you suggest? Radek

1 0

[Fedora-directory-users] Upgrade from 1.0.1 to 1.0.4 problems (admserver10.jar not found)
by Clayton Rogers 04 Dec '06

04 Dec '06

3 3

[Fedora-directory-users] Multimaster Replication Behind a Load Balancer
by Dave Augustus 04 Dec '06

04 Dec '06

Hello All. I want to have 2 hosts that are setup to do multimaster between themselves. Because my application on allows for a single server entry, I want to put both of these behind Linux Virtual Server director, which is a load-balancer that I use for other services currently. With this configuration, I can have either LDAP server go down and my application won't break. The load balancer requires that I tell the LDAP servers to not respond to arp requests so that the load balancer can. So how can the LDAP servers communicate with each other for updates ? I looked for some information on how to make the LDAP servers use more than one IP for LDAP but could find no answer. Thanks for your time, Dave

2 3

[Fedora-directory-users] Trouble upgrading 1.0.2 -> 1.0.4 w/ SSL-enabled configuration directory server
by Jeremy Thornhill 04 Dec '06

04 Dec '06

We have a single supplier / multiple replica setup, using SSL. The supplier is configured as the "Configuration Directory Server" and clients are configured accordingly. I attempted to upgrade one of the replicas in accordance with the release notes (i.e. Upgrade the RPM, restart the server, run /opt/fedora-ds/setup/setup). Setup proceeds as expected until the point where the application prompts for the admin password. This is the text of the dialogue: > In order to reconfigure your installation, the Configuration Directory > Administrator password is required. Here is your current information: > > Configuration Directory: ldaps://<myldapmaster>.<mydomain>:636/o=NetscapeRoot > Configuration Administrator ID: admin > > At the prompt, please enter the password for the Configuration Administrator. > > Fedora configuration directory server > administrator ID [admin]: > Password: Regardless of what information is entered, the application seems to hang, and does not display any new information or prompts after this point. Curious, I tried disabling SSL on the upgraded replica's admin server config by editing the following files (the information at this url pointed me in the right direction: http://directory.fedora.redhat.com/wiki/Howto:AdminServerLDAPMgmt) /opt/fedora-ds/admin-serv/config/adm.conf /opt/fedora-ds/shared/config/dbswitch.conf Disabling ssl in these locations and re-running setup resulted in success. Once the upgrade was complete, I shut the server down and re-enabled ssl - everything worked swimmingly thereafter. Now, we've been using ssl successfully for pretty much everything with no issue (certs all distributed and everything working fine), so I'm not sure why this is failing. Is this perhaps a bug in setup? Is there something else I need to be doing to have SSL work for the setup application? It's ultimately not a huge issue since it can be worked around, but it took a good chunk of time for me to track down the problem. Thanks, Jeremy Thornhill System administrator jeremy.thornhill(a)motricity.com NOTICE: This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Motricity. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

2 1

Re: [Fedora-directory-users] AD + FDS sync stops working?
by Dan Oglesby 04 Dec '06

04 Dec '06

I tried the following: In windows registry->HKLM->Software->PasswordSync, try add string value Log Level and set it to 1. Restart the passsync service. This should log all transactions and errors. Turn this back to "0" and restart passsync after troubleshooting. All I see in the log is this: 11/30/06 09:12:58: begin log 11/30/06 09:12:59: 0 new entries loaded from file 11/30/06 09:14:20: 0 new entries loaded from file 11/30/06 09:14:20: 0 entries saved to file 11/30/06 09:14:20: end log 11/30/06 09:14:22: begin log 11/30/06 09:14:22: 0 new entries loaded from file Thats after restarting the passsync service twice, and changing a users password in AD four times. --Dan

2 2

[Fedora-directory-users] store image or path to the image
by patrick ndjientcheu ngandjui 04 Dec '06

04 Dec '06

hi, I would like to store photo of people in my directory.But i don't know if it is better to store binary image or just the path to the image. If it is the first option which is the better choice,which type should I choose for the photo attribute? Thanks. --------------------------------- Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses.

1 0

[Fedora-directory-users] Memory usage
by Michał Droździewicz 04 Dec '06

04 Dec '06

Hello, I've installed FDS 1.0.4 on test system with only 256MiBs of RAM. Now I want to test performance and when I've started to query FDS with ldapsearch on my full LDAP tree the load of linux box raised to 12 but FDS memory usage stays @ 90-110MiBs of ram, regardless of that I've added RAM and now linux box has 2048MiBs. Is there any option to set for FDS, that it uses more ram for cache or some other purpose? -- xmpp/email: koniczynek(a)uaznia.net xmpp/email: koniczynek(a)gmail.com

3 9

[Fedora-directory-users] Upgrade from 1.0.1 to 1.0.4 problems (admserver10.jar not found)
by Clayton Rogers 04 Dec '06

04 Dec '06

Hi all, I just ran an rpm -Uvh fedora-ds-1.0.4-1.RHEL4.i386.opt.rpm on an existing 1.0.1 installation. Everything worked fine except for the Fedora Administration console comes up with the following error when I click on Administration Server:- * Installing Server Components * Downloading admserver10.jar * Failed to install a local copy of admserv10.jar or one of its support files: * admserv10.jar not found at http://server.domain:51211/ Any help greatly appreciated. Cheers -- Clayton Rogers <mailto:clayton@bundaberg.qld.gov.au> Systems Administrator Bundaberg City Council <http://www.bundaberg.qld.gov.au/> Phone: (07) 41539236 Fax: (07) 41529155

1 0

[Fedora-directory-users] Which is better - attribute of type dn or multivalued attribute?
by Ankur Agarwal 03 Dec '06

03 Dec '06

Hi, In our schema we need to have users who will belong to multiple groups. These groups are independent groups and do not have any parent child relationship. So while defining the ObjectClass for my user i have two options: 1) Have an attribute called - isMemberOf and make it of type distinguishedName. This will be a list of all groups to which a user belongs. 2) Have a multivalued attribute - groupName. which option makes more sense. Assume the functionalities that i need to support are: 1) Search all users belonging to a group 2) edit a user to add/remove a group from profile 3) Delete all the users belonging to a group regards, Ankur --------------------------------- Cheap Talk? Check out Yahoo! Messenger's low PC-to-Phone call rates.

3 2

FW: [Fedora-directory-users] Extracting details from ActiveDirectoryto FDS
by Paxton, Darren 01 Dec '06

01 Dec '06

Apologies for mailing yet again, however either my messages are not getting through (something I don't believe as I keep getting the post to the mailing list) - or for some reason, no one is willing to even acknowledge my issue. In the spirit of the community - can someone at least acknowledge a message as I find it quite disheartening that I have had no replies at all even if just to point me somewhere for assistance. ________________________________ From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Paxton, Darren Sent: 30 November 2006 08:46 To: General discussion list for the Fedora Directory server project. Subject: RE: [Fedora-directory-users] Extracting details from ActiveDirectoryto FDS Hi Has anyone had any thoughts on my query or can point me in the right direction? As is the nature of AD, I would have thought it is possible to extract this information using a scope setting or something similar. Thanks Darren ________________________________ From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Paxton, Darren Sent: 24 November 2006 14:56 To: fedora-directory-users(a)redhat.com Subject: [Fedora-directory-users] Extracting details from Active Directoryto FDS Hi all, I've been tinkering with integrating our Linux devices into our AD domain for some time and I've hit a few brick walls, however I've recently discovered FDS and the synchronisation features with AD. I've managed to set up a few replication jobs, however due to the extensive nature of our AD, I've realised that the sync only takes the group and user objects from the OU or CN being specified. Is there any way I can specify that it should traverse all subtrees of an OU and extract all that information back into FDS? Thanks Darren -- Darren Paxton EMEA Tier2 Red Hat Certified Engineer VMware Certified Professional MGTI Centralised ops This e-mail and any attachments may be confidential or legally privileged.If you received this message in error or are not the intended recipient, you should destroy the email message and any attachments or copies, and you are prohibited from retaining, distributing, disclosing or using any information contained herein. Please inform us of the erroneous delivery by return e-mail. Thank you for your co-operation. Mercer Human Resource Consulting Limited is authorised and regulated by the Financial Services Authority. Registered in England No. 984275. Registered Office: 1 Tower Place West, Tower Place, London, EC3R 5BU. -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

4 3

[Fedora-directory-users] RE: Fedora-directory-users Digest, Vol 19, Issue 1
by t b 01 Dec '06

01 Dec '06

My logs seem to indicate that the connection is being encrypted; I can ssh to a client server and get the password prompt, but when I enter the password it just returns me to the password prompt again [01/Dec/2006:19:47:44 -0500] conn=650 fd=69 slot=69 connection from xxx.xxx.xxx.xxx to xxx.xxx.xxx.xxx [01/Dec/2006:19:47:44 -0500] conn=650 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [01/Dec/2006:19:47:44 -0500] conn=650 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [01/Dec/2006:19:47:44 -0500] conn=650 SSL 256-bit AES [01/Dec/2006:19:47:44 -0500] conn=650 op=1 UNBIND [01/Dec/2006:19:47:44 -0500] conn=650 op=1 fd=69 closed - U1 If I disable TLS everything works fine, the client server can query the FDS and auth the client properly I am not sure if the problem has to do with the pam_ldap not properly formatted or the cert file not in proper format Does anyone have an example of what the pam_ldap config should look like? or suggestions on checking whether the cert file is in proper format Also what's the UNBIND shown in the logs? Thanks >From: fedora-directory-users-request(a)redhat.com >Reply-To: fedora-directory-users(a)redhat.com >To: fedora-directory-users(a)redhat.com >Subject: Fedora-directory-users Digest, Vol 19, Issue 1 >Date: Fri, 1 Dec 2006 12:00:06 -0500 (EST) > >Send Fedora-directory-users mailing list submissions to > fedora-directory-users(a)redhat.com > >To subscribe or unsubscribe via the World Wide Web, visit > https://www.redhat.com/mailman/listinfo/fedora-directory-users >or, via email, send a message with subject or body 'help' to > fedora-directory-users-request(a)redhat.com > >You can reach the person managing the list at > fedora-directory-users-owner(a)redhat.com > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of Fedora-directory-users digest..." > > >Today's Topics: > > 1. pam_ldap with SSL/TLS (t b) > 2. RE: pam_ldap with SSL/TLS (Morris, Patrick) > 3. Re: pam_ldap with SSL/TLS (Richard Megginson) > 4. Problem with SSL console in X in specific circumstances > (Philip Kime) > 5. FW: [Fedora-directory-users] Extracting details from > ActiveDirectoryto FDS (Paxton, Darren) > 6. alias in fedora directory server (patrick ndjientcheu ngandjui) > 7. Re: FW: [Fedora-directory-users] Extracting details from > ActiveDirectoryto FDS (Nicholas Byrne) > 8. Re: Memory usage (koniczynek) > 9. Re: Memory usage (David Boreham) > 10. Re: Memory usage (koniczynek) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Thu, 30 Nov 2006 12:31:50 -0500 >From: "t b" <mxheadroom(a)hotmail.com> >Subject: [Fedora-directory-users] pam_ldap with SSL/TLS >To: fedora-directory-users(a)redhat.com >Message-ID: <BAY116-F322745E96D702ED748B1D0CDDB0(a)phx.gbl> >Content-Type: text/plain; format=flowed > >I am trying to setup pam_ldap to use TLS to communicate with the FDS, but >having lots of problems doing so; it works if I use the unencrypted way but >not if I use ldaps ( port 636 ) > >I used the instructions at, >http://directory.fedora.redhat.com/wiki/Howto:PAM > >Has anyone gotten PAM to work TLS > > >Thanks > >_________________________________________________________________ >Buy, Load, Play. The new Sympatico / MSN Music Store works seamlessly with >Windows Media Player. Just Click PLAY. >http://musicstore.sympatico.msn.ca/content/viewer.aspx?cid=SMS_Sept192006 > > > >------------------------------ > >Message: 2 >Date: Thu, 30 Nov 2006 13:00:56 -0500 >From: "Morris, Patrick" <patrick.morris(a)hp.com> >Subject: RE: [Fedora-directory-users] pam_ldap with SSL/TLS >To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> >Message-ID: > <CD18C81835E18A40A64C4A0D16A237BE05FE850D(a)ATAEXC01.americas.cpqcorp.net> > >Content-Type: text/plain; charset="US-ASCII" > > > I am trying to setup pam_ldap to use TLS to communicate with > > the FDS, but having lots of problems doing so; it works if I > > use the unencrypted way but not if I use ldaps ( port 636 ) > >Someone should jump in here and correct me if I'm wrong, but I believe >it's normal for TLS connections to happen on the standard LDAP port. >You should be able to tell from your logs whether the connection is >encrypted or not. > > > >------------------------------ > >Message: 3 >Date: Thu, 30 Nov 2006 11:08:08 -0700 >From: Richard Megginson <rmeggins(a)redhat.com> >Subject: Re: [Fedora-directory-users] pam_ldap with SSL/TLS >To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> >Message-ID: <456F1E08.40601(a)redhat.com> >Content-Type: text/plain; charset="iso-8859-1" > >Morris, Patrick wrote: > >> I am trying to setup pam_ldap to use TLS to communicate with > >> the FDS, but having lots of problems doing so; it works if I > >> use the unencrypted way but not if I use ldaps ( port 636 ) > >> > > > > Someone should jump in here and correct me if I'm wrong, but I believe > > it's normal for TLS connections to happen on the standard LDAP port. > > You should be able to tell from your logs whether the connection is > > encrypted or not. > > >Yes. The LDAP "preferred" way is to use the startTLS extended operation >which starts a TLS session on the non-secure port. This will be logged >in the access log. > > -- > > Fedora-directory-users mailing list > > Fedora-directory-users(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > >

2 1

[Fedora-directory-users] alias in fedora directory server
by patrick ndjientcheu ngandjui 01 Dec '06

01 Dec '06

Hi, I would like to know how to use alias in fedora directory server.It seems that it is used for point to another entry in the directory,but i don't know how to use this feature.May someone helps me on this issue? I would really appreciate an example. Thanks ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 1

RE: [Fedora-directory-users] Extracting details from Active Directoryto FDS
by Paxton, Darren 01 Dec '06

01 Dec '06

Hi Has anyone had any thoughts on my query or can point me in the right direction? As is the nature of AD, I would have thought it is possible to extract this information using a scope setting or something similar. Thanks Darren ________________________________ From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Paxton, Darren Sent: 24 November 2006 14:56 To: fedora-directory-users(a)redhat.com Subject: [Fedora-directory-users] Extracting details from Active Directoryto FDS Hi all, I've been tinkering with integrating our Linux devices into our AD domain for some time and I've hit a few brick walls, however I've recently discovered FDS and the synchronisation features with AD. I've managed to set up a few replication jobs, however due to the extensive nature of our AD, I've realised that the sync only takes the group and user objects from the OU or CN being specified. Is there any way I can specify that it should traverse all subtrees of an OU and extract all that information back into FDS? Thanks Darren -- Darren Paxton EMEA Tier2 Red Hat Certified Engineer VMware Certified Professional MGTI Centralised ops

2 1

[Fedora-directory-users] Problem with SSL console in X in specific circumstances
by Philip Kime 01 Dec '06

01 Dec '06

Here's the problem: Running startconsole (SSL) to a remote display on a PC X-server (xwin32) works fine and requires that my windows home dir on the PC X-server machine has .fedora-console/ containing cert8.db and key3.db, as you'd expect. If I rename this dir, the console hangs at the splash screen. So far, so good, all makes sense. If I try the same thing to cygwin's X server on same machine or to an X server on a Mac running OSX, startconsole always hangs as if it can't find ~/.fedora-console on the local machine. I've tried copying this dir to what cygwin/OSX thinks is the user's home dir but no luck. Where should I put the Cert db files under "real" UNIX X to get the SSL console to work? Also tried ~/.mmc as per the docs but I could never get this to work. PK -- Philip Kime NOPS Systems Architect 310 401 0407

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users December 2006