[Fedora-directory-users] how to add client to the my domain
by Bharath Ramakrishna
hi ,
I am bharath . I have already installed and deployed the directory
server,but i am not able to add my windows client to this domain and
authenicate. I changed the domain name of my windows client to
"testingczars.com" but it is not authenicating .Please tell me hoe to do
this.
--
Bharath Ramakrishna
Network Admnistrator
TestingCzars
Phone: +91.80.26722100, +91.80.26727234
TeleFax: +91.80.26727234
Email: bharath(a)testingczars.com
URL: www.testingczars.com
This email may contain material that is confidential, privileged and/or attorney work product for the sole use of the intended recipient. Any review, reliance or distribution by others or forwarding without express permission is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies.
18 years
[Fedora-directory-users] Search optimization?
by Vsevolod (Simon) Ilyushchenko
Hi,
I've noticed that FDS is significantly slower in answering queries than
openldap. If I run 'ls -l /home' on the list of 64 home directories
whose owners are all different, I get the list back in 1 second if I use
openldap. Version 7 of FDS took 16 seconds, and FDS 1.0.2 takes 12 seconds.
The docs mention increasing cache sides to improve performance, but my
cache is set to 10 M, which seems to be large enough, and the timing
does not improve if I run 'ls -l' repeatedly. Is there anything else I
can tune?
Thanks,
Simon
--
Simon (Vsevolod ILyushchenko) simonf(a)cshl.edu
http://www.simonf.com
"Think like a man of action, act like a man of thought."
Henri Bergson
18 years
[Fedora-directory-users] Odd admin console problem
by Brian Moyles
We're in the process of evaluating FDS, but have run into a small problem.
I'm forwarding X from the server back to my OS X box running Apple's X11.
When I run startconsole, I get a half-drawn login window. I've tried a few
different jvms from different vendors, no luck.
http://mirrors.playboy.com/~bmoyles/fds-console.png
I'm sure I'm missing something simple here... Any thoughts?
Thanks for your time,
Brian Moyles
Sr. Systems Administrator
Playboy Enterprises, Inc.
18 years
[Fedora-directory-users] Moving All Users to FDS
by Abdelrahman
Dear all,
I want to migrate all my users (about 10000) from OpenLDAP to FDS. The
problem is that I need to add a couple of fields to each user and set a
default value for these fields!
Is there a way to do that?
Regards,
Abdelrahman
18 years
RE: [Fedora-directory-users] Existing User Accounts
by Esquivel, Vicente
Thanks for the reply.
I ran the scripts and was able to get all of the users imported into the Directory server. The only question is how do I get their email address into the Directory of the passwd and shadow file information?
Thanks
Vince
> -----Original Message-----
> From: fedora-directory-users-bounces(a)redhat.com
> [mailto:fedora-directory-users-bounces@redhat.com] On Behalf
> Of Oscar A. Valdez
> Sent: Thursday, April 06, 2006 10:38 AM
> To: General discussion list for the Fedora Directory server project.
> Subject: Re: [Fedora-directory-users] Existing User Accounts
>
> El jue, 06-04-2006 a las 09:49 -0500, Esquivel, Vicente escribió:
> > I have the Directory server up and running. My question is
> how to get
> > the user accounts from one of my servers into the
> directory? I do not
> > have an existing ldap or nis server, we are using local systems
> > account creation and authentication. I did a search through the
> > archives but wasn't able to come up with anything. Any
> insight would
> > be very helpful and appreciated.
>
> Try the Migration Tools from PADL software (they are also the
> creators of the nss_ldap and pam_ldap modules):
>
> http://www.padl.com/OSS/MigrationTools.html
>
> You first have to edit migrate_base.pl for your
> organization's naming context. The scripts migrate_passwd.pl,
> migrate_group.pl, migrate_aliases.pl, etc., will do what
> their names suggest. They output in ldif format to standard
> output, so you can tweak the results before importing into
> your DS server.
>
> After importing my existing users, I wrote my own script for
> new user creation that generates the ldif stuff.
>
> --
> Oscar A. Valdez
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
18 years
RE: [Fedora-directory-users] Existing User Accounts
by Esquivel, Vicente
Ok I am a total newbie to the Directory so bear with me. Do you accomplish this by going to the configuration tab then selecting schema?
Vince
> -----Original Message-----
> From: fedora-directory-users-bounces(a)redhat.com
> [mailto:fedora-directory-users-bounces@redhat.com] On Behalf
> Of George Holbert
> Sent: Friday, April 07, 2006 3:22 PM
> To: General discussion list for the Fedora Directory server project.
> Subject: Re: [Fedora-directory-users] Existing User Accounts
>
> The usual attribute for email addresses is "mail".
> You may need to add another objectclass (like inetOrgPerson)
> to your objects in order for the mail attribute to be available.
>
> Esquivel, Vicente wrote:
> > Thanks for the reply.
> >
> > I ran the scripts and was able to get all of the users
> imported into the Directory server. The only question is how
> do I get their email address into the Directory of the passwd
> and shadow file information?
> >
> > Thanks
> > Vince
> >
> >
> >> -----Original Message-----
> >> From: fedora-directory-users-bounces(a)redhat.com
> >> [mailto:fedora-directory-users-bounces@redhat.com] On
> Behalf Of Oscar
> >> A. Valdez
> >> Sent: Thursday, April 06, 2006 10:38 AM
> >> To: General discussion list for the Fedora Directory
> server project.
> >> Subject: Re: [Fedora-directory-users] Existing User Accounts
> >>
> >> El jue, 06-04-2006 a las 09:49 -0500, Esquivel, Vicente escribió:
> >>
> >>> I have the Directory server up and running. My question is
> >>>
> >> how to get
> >>
> >>> the user accounts from one of my servers into the
> >>>
> >> directory? I do not
> >>
> >>> have an existing ldap or nis server, we are using local systems
> >>> account creation and authentication. I did a search through the
> >>> archives but wasn't able to come up with anything. Any
> >>>
> >> insight would
> >>
> >>> be very helpful and appreciated.
> >>>
> >> Try the Migration Tools from PADL software (they are also the
> >> creators of the nss_ldap and pam_ldap modules):
> >>
> >> http://www.padl.com/OSS/MigrationTools.html
> >>
> >> You first have to edit migrate_base.pl for your
> organization's naming
> >> context. The scripts migrate_passwd.pl, migrate_group.pl,
> >> migrate_aliases.pl, etc., will do what their names suggest. They
> >> output in ldif format to standard output, so you can tweak the
> >> results before importing into your DS server.
> >>
> >> After importing my existing users, I wrote my own script
> for new user
> >> creation that generates the ldif stuff.
> >>
> >> --
> >> Oscar A. Valdez
> >>
> >> --
> >> Fedora-directory-users mailing list
> >> Fedora-directory-users(a)redhat.com
> >> https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >>
> >>
> >
> > --
> > Fedora-directory-users mailing list
> > Fedora-directory-users(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >
> >
>
>
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
18 years
[Fedora-directory-users] Dovecot and FDS
by Oscar A. Valdez
The Howto at http://directory.fedora.redhat.com/wiki/Howto:Dovecot is
really very skimpy (two lines that refer you offsite, to a Howto based
on OpenLDAP).
I spent most of yesterday banging my head, making dovecot authenticate
against FDS. The mail server on which dovecot is installed has the
nss_ldap and pam_ldap packages installed, and /etc/dovecot.conf has the
following two lines:
auth_userdb = ldap /etc/dovecot-ldap.conf
auth_passdb = pam
In other words, dovecot should use LDAP to access the user database, but
PAM for authentication. This part is working, since users authenticate
and get their mails through dovecot.
/etc/dovecot-ldap.conf contains the following:
hosts = 192.168.0.2
ldap_version = 3
base = ou=People, dc=duraflex, dc=com, dc=sv
deref = never
scope = subtree
user_attrs = uid,homeDirectory,,,uidNumber,gidNumber
user_filter = (&(objectClass=posixAccount)(uid=%u))
I haven't specified a dn or dnpass, since all I need is that dovecot
perform an anonymous query for the uid, homeDirectory, uidNumber and
gidNumber fields of its users, which are publically viewable. However,
my FDS server's access log has entries like these:
conn=3266227 fd=138 slot=138 connection from 192.168.0.100 to
192.168.0.2
conn=3266227 op=0 BIND dn="" method=128 version=3
conn=3266227 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn=""
conn=3266227 op=1 SRCH base="ou=People,dc=duraflex,dc=com,dc=sv" scope=1
filter="(&(objectClass=posixAccount)(uid=dovecot))" attrs=ALL
conn=3266227 op=1 RESULT err=0 tag=101 nentries=0 etime=0
conn=3266227 op=2 SRCH base="ou=Groups,dc=duraflex,dc=com,dc=sv" scope=1
filter="(&(objectClass=posixGroup)(memberUid=dovecot))"
attrs="gidNumber"
conn=3266227 op=2 RESULT err=0 tag=101 nentries=0 etime=0
conn=3266227 op=-1 fd=138 closed - B1
Dovecot tries binding with an empty dn, fails, the queries FDS for a
user or group called dovecot (which don't exist on the DS), and fails.
Is there a way to tell dovecot to query anonymously?
--
Oscar A. Valdez
18 years
[Fedora-directory-users] Re: Hostname does not match CN
by Howard Chu
> Date: Tue, 04 Apr 2006 11:30:30 -0700
> From: "George Holbert" <gholbert(a)broadcom.com>
>
>
>> Does Directory Server support the subjectAltName extension on SSL certs?
>>
>>
>
> Yes, the NSS toolkit which Directory Server uses can handle these certs.
>
> The next question is, do your SSL-enabled LDAP clients support these certs?
> I need to support both Solaris and RedHat Linux LDAP name service
> clients (i.e., passwd, group, automount, etc.). I've found that:
> - Solaris clients can handle wildcard certs. RHEL 3 clients can't.
> - RHEL 3 clients can handle subjectAltName certs. Solaris clients can't.
>
> So, while the server can present either of these cert types, your
> clients' limitations will also influence how you sign your certs.
>
>
Someone should file a bug report with Sun then, since LDAP RFC2830
defines support for subjectAltName and not for wildcard certs. The
LDAPbis specifications will be pretty much the same here. I.e., Sun's
LDAP library is not LDAPv3 compliant. RHEL uses OpenLDAP libraries,
which are fully LDAPv3 compliant.
--
-- Howard Chu
Chief Architect, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc
OpenLDAP Core Team http://www.openldap.org/project/
18 years
[Fedora-directory-users] Schema Conversion (again).
by Robert r. Sanders
We're trying to get the Zimbra Collaboration Suite to talk to a Fedora
Directory Server (Zimbra by default uses its own version of OpenLDAP).
Zimbra includes LDAP schema files, and we've tried to use Mike Jackson's
schema migration tool ol-schema-migrate.pl as well as the ol2rhds.pl
script. The problem appears to be that the schema in question makes
heavy use of the OpenLDAP OID Macros (see
http://www.openldap.org/doc/admin23/schema.html , the "OID Macros"
section at the bottom of the page).
Does anyone know of any tools which would help?
A sample of the original schema is:
objectIdentifier ZimbraRoot 1.3.6.1.4.1.19348
objectIdentifier ZimbraLDAP ZimbraRoot:2
...
objectIdentifier ZimbraAttrType ZimbraLDAP:1
...
objectIdentifier zimbraComponentAvailable ZimbraAttrType:242
...
attributetype ( zimbraComponentAvailable
NAME 'zimbraComponentAvailable'
DESC 'Names of additonal components that have been installed'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{64} )
The complete schema can be viewed at -
http://cvs.zimbra.com:8080/viewrep/~raw,r=1.48/zimbra_main/ZimbraServer/c...
My understanding is that OpenLDAP knows to replace the "attributetype (
zimbraComponentAvailable" with "attributetype ( 1.3.6.1.4.1.19348.2.242"
(or something similar).
The referenced perl scripts output:
attributeTypes: (
zimbraComponentAvailable
NAME 'zimbraComponentAvailable'
DESC 'Names of additonal components that have been installed'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{64}
)
which fails to load properly as the symbolic name
"zimbraComponentAvailable" is not replaced by the actual value.
Anyway, any help would be very appreciated.
Thanks,
--
Robert r. Sanders
Chief Technologist
iPOV
(334) 821-5412
www.ipov.net
18 years
[Fedora-directory-users] Mac OS X Client authenticating against Fedora Directory Server
by Jim Summers
Hello List,
I am following up on a thread that was initiated by David Schibeci a few weeks
back. He was trying to configure os/x machines to authenticate against fds.
I to will have to authenticate some os/x machines when I migrate over to fds.
So I thought I should test it out.
Unfortunately I was not able to get it to work. All I am seeing in the
system.log file are entries such as:
DSOpenNode(): dsOpenDirNode("/LDAPv3/ipaddress") == -14002
DSGetCurrentConfigInfo(): dsGetRecordEntry() == -14061
Not to informative.
Any ideas or suggestions will be greatly appreciated.
Thanks
--
Jim Summers
School of Computer Science-University of Oklahoma
-------------------------------------------------
18 years
