June 2006 - 389-users - Fedora mailing-lists

Re: [Fedora-directory-users] New filesystem layout for directory server and admin server files
by Mike Jackson 03 Jul '06

03 Jul '06

Richard Megginson <rmeggins(a)redhat.com> kirjoitti: > -- > In order to be more linux friendly, we are currently considering changing the layout from having everything under > /opt/fedora-ds to putting files in their FHS specific paths FHS has it's place. However, as a very large user of this software, I am strongly against this idea. One of the biggest strengths of this software is that it is completely self-contained, which allows much simpler troubleshooting, research and development of administration tools, and testing multiple versions. It is easier to see if a file is missing or has the wrong permissions, and fix it. It is easier to backup and restore. I could go on and on. When an entire network depends on the LDAP infrastructure, these type of things really matter. I think this is a bad idea, and a waste of time. Time which could be much better spent on bring proper autoconf support. BR, Mike

6 6

[Fedora-directory-users] New filesystem layout for directory server and admin server files
by Rich Megginson 03 Jul '06

03 Jul '06

In order to be more linux friendly, we are currently considering changing the layout from having everything under /opt/fedora-ds to putting files in their FHS specific paths. The details are here - http://directory.fedora.redhat.com/wiki/FHS_Packaging I've heard some pretty strong opinions for both moving to this and sticking to the current packaging model. I'd like to open this debate up to the wider audience.

6 8

Re: [Fedora-directory-users] Referrals break everything ...
by Philip Kime 01 Jul '06

01 Jul '06

> PADL (usually in /etc/ldap.conf): > referrals yes Many thanks for both replies ... This looked good but I tried it and I still get the same error in syslog. Hmm. The binds are all anonymous and work fine so there doesn't seem to be a bind DN issue. http://www.redhat.com/docs/manuals/dir-server/deploy/7.1/dit.html#100588 9 Ah - this is more what I wanted but it appears that you can't do Virtual DITs from roots - has to be from an OU, for example, which is annoying since that means I have to create a new datbase for the old dc=x,dc=y and create an OU so I can create a virtual DIT view. What a game! I just want to redirect all queries for one thing somewhere else ...

2 1

Re: [Fedora-directory-users] New filesystem layout for directory server and admin server files
by Mike Jackson 30 Jun '06

30 Jun '06

Michael Chang <miranda(a)syndetic.org> kirjoitti: > > > You could always make a separate, FHS-specific package available and see > what people think. If the votes are high enough in support of the new > layout then you could make a permanent switch. The problem here is assuming that FDS updates will eventually be pushed into RHDS. Judging by a good portion of the traffic on this list, a good majority of the FDS users are still learning how to use an LDAP server, so they likely don't understand or care enough to have an opinion about file layout or why it matters in a package as large and complex as this one. OTOH, the RHDS package is used for critical infrastructure in banks, military, telecoms, etc. By the time those users notice the change and it's ramifications, it will be too late for them to have their vote (other than with their feet). -- mike

1 0

[Fedora-directory-users] Accessing the management console - error
by Greg Rich 30 Jun '06

30 Jun '06

I have Fedora Directory Server v1.0.2 install on one of my servers; I am trying to connect to it using my laptop. I am able to access the management console from the FDS server and have successfully got the console running on my laptop but when I try to log in get the following error: Cannot logon because of an incorrect User ID, Incorrect password or Directory problem. HttpException: Response: HTTP/1.1 401 Authorization Required Status: 401 URL: http://<full server name>:54294/admin-serv/authenticate I have read and tried http://directory.fedora.redhat.com/wiki/Howto:AdminServerLDAPMgmt to no avail. Thanks, Gregory Rich IT Manager Harmonix Music Systems

2 1

Re: [Fedora-directory-users] Fedora DS 1.0.2 Multiple Master SSL replication: empty bind DN...
by Kevin McCarthy 30 Jun '06

30 Jun '06

Richard, thank you for your response! .hopefully whatever configuration mistake I made to cause a NULL bind DN will soon come to light. > Dear List Members, > > Release: *fedora-ds-1.0.2-1.RHEL3.i386.opt.rpm* > > A typical replication error log entry now follows (seen repeatedly at > both fedora DS servers): > > [28/Jun/2006:18:29:21 +0100] NSMMReplicationPlugin - agmt="cn=EDS from > server 2" (ukstatlap:636): Unable to acquire replica: permission > denied. The *bind dn ""* does not have permission to supply > replication updates to the replica. Will retry later. > > Believe me, I have been investigating this one for 2 or 3 days now > (having just switched from OpenLDAP, since multiple master replication > is required) before sending this submission, just in case I missed a > configuration item or work-around, but unfortunately no luck (so far). > > The only reference I can find for SSL Client Authentication based > Multiple Master replication (2 Linux RHEL 3 servers being used) that > supplies empty DNs, is the Windows specific entry (whose work-around I > tried anyway, but without success)_ > > Unable to acquire replica: permission denied. The bind dn "" does not > have permission to supply replication updates to the replica. Will > retry later. > To workaround the problem, after you modify and save the replication > schedule of an agreement, refresh the console, reconfigure the > connection settings (to SSL client authentication) for the agreement, > and save your changes. > > http://www.redhat.com/docs/manuals/dir-server/release-notes/ds611relno > tes.html > > The mutual _Current Supplier DNs_ are indeed set (cn=Replication > Manager,cn=replication,cn=config) and the corresponding directory > entries do exist. > > The respective server certificates and CA certificates are installed, > with Subject DN entries loaded. > What are the SubjectDNs in the server certificates? CN=<SERVERNAME>,OU=EDS,O=teligent,DC=co,C=uk .where "<SERVERNAME>" is the respective server name of the replicating servers e.g. "nema2" rather than a full domain name. The following will hopefully also be relevant: 1) The tree being replicated is "OU=EDS,O=Teligent,DC=co,C=uk" i.e. the Subject DN is within the replicated tree. 2) certutil was used to generate the server and CA certificates. Surprisingly (to me at least) the CA certificate was then listed in the "Server Certs" panel on the Directory Server "Manage Certificates" panel. 3) I loaded the ascii version of the "other" server's CA Certificate directly into the "CA Certs" panel. 4) All CA certificates have both the accept and make connection trusts ticked. > I do _not_ have Legacy Consumer enabled. > You don't need it. > > CertMapping is also defined (though with a NULL DN being supplied, I > guess that will not be kicking in just yet, though there are entries > for the exact subject DN anyway.) > You might want to post your certmap.conf and see here - http://directory.fedora.redhat.com/wiki/Howto:CertMapping .I must admit that since the Bind DN was NULL I had not realized that certmap'ping would actually take affect. I ensured that the exact subject DN of the server certificates corresponded to an actual directory entry (with the respective server's user certificate loaded), which I had thought would be matched without the need for a certmap configuration via the original "default" option, but I tried one anyway. certmap nema ou=EDS,o=teligent,dc=co,c=uk nema:FilterComps cn nema:verifycert off certmap default default .indeed one server still runs with the default certmap configuration to see if it made any difference, but both servers receive a NULL bind DN "". > When using simple authentication, with or without SSL, all is well > (although replication did require both servers to Initialize the > Consumer, I thought that only one was required e.g. ID 1 initializing > ID 2, but ID 2 then needed to initialize ID 1 before successful 2-way > replication was achieved). > That's odd. You should only need to initialize once one way. .indeed, but I guess that it can not do any harm, as the secondary server will not actually need to supply any further updates back to the primary server and it does at least make the mutual replication work for me - until the certificates took their toll. Regards and thanks again, Kevin

2 1

[Fedora-directory-users] Authenticating / Binding user via LDAP to Fedora Directory Server
by Greg Rich 30 Jun '06

30 Jun '06

Running Fedora Directory Server v 1.0.2 on Fedora Core 4 I can access the directory server just fine anonymously but I can not bind as a user with a password. I am an AD guy slowly moving to Linux so it could very well be me. The FDS is a fresh install; I was able to sync users from my Windows 2000 AD. I know that the password do not sync up so I created a simple web page using php and ldap_mod_replace to set / change users passwords. This page works; I bind to a user w/o a password. I can even set the password using the page. But I can not bind as a user using a password, but for some odd reason even if a user has a password I can bind anonymously to them and set the password (I assume it's a ACL setting that is causing this). My main problem is binding as a user with a password. I have also tried an LDAP query with Mozilla Thunderbird and get similar results binding as anonymous I have no problems but if I try as a user I get nothing. Thanks in advance for your help. Gregory Rich IT Manager Harmonix Music Systems

1 0

[Fedora-directory-users] Accessing the management console - error
by Greg Rich 30 Jun '06

30 Jun '06

I have Fedora Directory Server v1.0.2 install on one of my servers; I am trying to connect to it using my laptop. I am able to access the management console from the FDS server and have successfully got the console running on my laptop but when I try to log in get the following error: Cannot logon because of an incorrect User ID, Incorrect password or Directory problem. HttpException: Response: HTTP/1.1 401 Authorization Required Status: 401 URL: http://<full server name>:54294/admin-serv/authenticate I have read and tried http://directory.fedora.redhat.com/wiki/Howto:AdminServerLDAPMgmt to no avail. Thanks, Gregory Rich IT Manager Harmonix Music Systems

1 0

[Fedora-directory-users] Referrals break everything ...
by Philip Kime 29 Jun '06

29 Jun '06

I am running the latest Fedora-DS and trying to use nss_ldap. I have to migrate an older LDAP server onto the Fedora-DS but keep temporarily the old tree structure for all current LDAP clients. So I was goint to leave the old search base in /etc/ldap.conf on the client and just re-direct queries to the new location (on the same server). A job for referrals, I thought. I'll just put a stub root dc on the new server and make it point to the new location, like this: dc=a,dc=y a referral to the new dc=a,dc=b I set this up, ldapsearch shows that it's getting the right referral (though I can't seem to get ldapsearch follow the the referral?) However, if I try to do anything involving nss_ldap (which otherwise works fine), I get this, for example, in syslog: getent: nss_ldap: could not search LDAP server - Referral Does nss_ldap not follow referalls? That would make it rather useless .... Is this a Fedora-DS problem? -- Philip Kime

3 2

[Fedora-directory-users] Install Error
by Brian Smith 29 Jun '06

29 Jun '06

Has anyone run into this problem? I looked through the archives but don't see anything. Here's my setup. I have a configuration server setup on config.domain.com. I made the admin domain config.domain.com and setup a new domain called dev.domain.com. I setup dev1.domain.com to use config.domain.com as the config storage server and everything installed fine. the server is listed in dev.domain.com domain and is using dc=dev,dc=domain,dc=com as it's base dn. I now am installing dev2.domain.com using config.domain.com and used the same values on the install except for the server id and name. It fails when it trys to add the sample accounts. Here's the part of the setup.log, any help would be appreciated: Hostname to use (default: dev2.domain.com) Server user ID to use (default: nobody) Server group ID to use (default: nobody) [slapd-dev2]: starting up server ... [slapd-dev2]: Fedora-Directory/1.0.2 B2006.060.1928 [slapd-dev2]: dev2.domain.com:389 (/opt/fedora-ds/slapd-dev2) [slapd-dev2]: [slapd-dev2]: [29/Jun/2006:11:11:51 -0400] - Fedora-Directory/1.0.2 B2006.060.1928 starting up [slapd-dev2]: [29/Jun/2006:11:11:53 -0400] - slapd started. Listening on All Interfaces port 389 for LDAP requests Your new directory server has been started. Created new Directory Server Start Slapd Starting Slapd server configuration. Warning Slapd Could not open the new directory server [ldap://dev2.domain.com:389/dc=dev,dc=domain,dc=com:cn=Directory Manager] to add an aci [151]. Success Slapd Added Directory Server information to Configuration Server. Warning Slapd Could not add sample entries, ldap error code 151 Warning Slapd Could not populate with ldif file Yes error code 151 Configuring Administration Server... Setting up Administration Server Instance... Configuring Administration Tasks in Directory Server... Configuring Global Parameters in Directory Server... You can now use the console. Here is the command to use to start the console: cd /opt/fedora-ds ./startconsole -u admin -a http://dev2.domain.com:36352/ Thanks, Brian Smith

2 1

[Fedora-directory-users] Attribute Subtypes in FDS
by Andrey Ivanov 29 Jun '06

29 Jun '06

Actually, I have found the answer. These limitations are imposed by the java console interface. With ldapadd & ldapmodify i can add any subtype one can imagine.... > Is there a simple way to add more attribute subtypes than the default ones > (lang-xx, Binary and Pronunciation)? I have searched through the schema > but i haven't found any place where these subtypes are defined. Are > they defined in sources? > > I want to use it to have different shell/uid/gid depending on the > workstation the user is logging in (for example, uidNumber;192.158.0.1=512, > uidNumber;192.168.0.2=512 etc). Maybe someone knows a more elegant/simple way to > do this? Andrey Ivanov tel +33-(0)1-69-33-99-24 fax +33-(0)1-69-33-99-55 Direction des Systemes d'Information Ecole Polytechnique 91128 Palaiseau CEDEX France

1 0

[Fedora-directory-users] Fedora DS 1.0.2 Multiple Master SSL replication: empty bind DN...
by Kevin McCarthy 29 Jun '06

29 Jun '06

Dear List Members, Release: fedora-ds-1.0.2-1.RHEL3.i386.opt.rpm A typical replication error log entry now follows (seen repeatedly at both fedora DS servers): [28/Jun/2006:18:29:21 +0100] NSMMReplicationPlugin - agmt="cn=EDS from server 2" (ukstatlap:636): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. Believe me, I have been investigating this one for 2 or 3 days now (having just switched from OpenLDAP, since multiple master replication is required) before sending this submission, just in case I missed a configuration item or work-around, but unfortunately no luck (so far). The only reference I can find for SSL Client Authentication based Multiple Master replication (2 Linux RHEL 3 servers being used) that supplies empty DNs, is the Windows specific entry (whose work-around I tried anyway, but without success). Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. To workaround the problem, after you modify and save the replication schedule of an agreement, refresh the console, reconfigure the connection settings (to SSL client authentication) for the agreement, and save your changes. http://www.redhat.com/docs/manuals/dir-server/release-notes/ds611relnotes.ht ml The mutual "Current Supplier DNs" are indeed set (cn=Replication Manager,cn=replication,cn=config) and the corresponding directory entries do exist. The respective server certificates and CA certificates are installed, with Subject DN entries loaded. I do not have Legacy Consumer enabled. CertMapping is also defined (though with a NULL DN being supplied, I guess that will not be kicking in just yet, though there are entries for the exact subject DN anyway.) When using simple authentication, with or without SSL, all is well (although replication did require both servers to Initialize the Consumer, I thought that only one was required e.g. ID 1 initializing ID 2, but ID 2 then needed to initialize ID 1 before successful 2-way replication was achieved). Any suggestions will be most gratefully received! Regards, Kevin

2 1

[Fedora-directory-users] apache win32
by Mickael Besse 29 Jun '06

29 Jun '06

I'm now trying to configure apache 2.2.0 install with xampp under windows 2000. With ldap it's ok but I ve got some probleme with SSL (again). In the log of apache, I have: LDAP : an attemp to set LDAP_OPT_SSL on failed. Parameter Error. did someone alreday configure apache (win32) with LDAPS??? _________________________________________________________________ Retrouvez tout en un clin d'oeil avec la barre d'outil MSN Search ! http://desktop.msn.fr/

3 3

[Fedora-directory-users] FDS crashed, how to find out the reason?
by Kimmo Koivisto 27 Jun '06

27 Jun '06

Hello I have MMR environment, 2x FDS, version 1.0.2, Red Hat Enterprise 4 ES 32bit x86. My servers are server1.ton.fi and server2.ton.fi. Server2 died couple of days ago (friday I think) and I restarted it today. Everything seems to be okay, but I need to provide some reasons why this happened. My /opt/fedora-ds/slapd-server2/logs/error shows the following: <error log> Fedora-Directory/1.0.2 B2006.060.1928 server2.ton.fi:389 (/opt/fedora-ds/slapd-server2.ton.fi) [17/Jun/2006:00:00:00 +0300] NSMMReplicationPlugin - agmt="cn="Replication to server1.ton.fi"" (server1:389): Incremental protocol: event update_window_opened should no t occur in state wait_for_changes [18/Jun/2006:00:00:00 +0300] NSMMReplicationPlugin - agmt="cn="Replication to server1.ton.fi"" (server1:389): Incremental protocol: event update_window_opened should no t occur in state wait_for_changes Fedora-Directory/1.0.2 B2006.060.1928 server2.ton.fi:389 (/opt/fedora-ds/slapd-server2.ton.fi) [18/Jun/2006:04:23:11 +0300] - Backing up file 1 (/tmp/tmp.dJIDpX3348/fdsbackup/userRoot/sn.db4) [18/Jun/2006:04:23:11 +0300] - Backing up file 2 (/tmp/tmp.dJIDpX3348/fdsbackup/userRoot/entrydn.db4) [18/Jun/2006:04:23:11 +0300] - Backing up file 3 (/tmp/tmp.dJIDpX3348/fdsbackup/userRoot/parentid.db4) [18/Jun/2006:04:23:11 +0300] - Backing up file 4 (/tmp/tmp.dJIDpX3348/fdsbackup/userRoot/objectclass.db4) [18/Jun/2006:04:23:11 +0300] - Backing up file 5 (/tmp/tmp.dJIDpX3348/fdsbackup/userRoot/aci.db4) [18/Jun/2006:04:23:11 +0300] - Backing up file 6 (/tmp/tmp.dJIDpX3348/fdsbackup/userRoot/cn.db4) [18/Jun/2006:04:23:11 +0300] - Backing up file 7 (/tmp/tmp.dJIDpX3348/fdsbackup/userRoot/givenName.db4) [18/Jun/2006:04:23:12 +0300] - Backing up file 8 (/tmp/tmp.dJIDpX3348/fdsbackup/userRoot/nsUniqueId.db4) [18/Jun/2006:04:23:12 +0300] - Backing up file 9 (/tmp/tmp.dJIDpX3348/fdsbackup/userRoot/numsubordinates.db4) [18/Jun/2006:04:23:12 +0300] - Backing up file 10 (/tmp/tmp.dJIDpX3348/fdsbackup/userRoot/DBVERSION) [18/Jun/2006:04:23:12 +0300] - Backing up file 11 (/tmp/tmp.dJIDpX3348/fdsbackup/userRoot/ancestorid.db4) [18/Jun/2006:04:23:12 +0300] - Backing up file 12 (/tmp/tmp.dJIDpX3348/fdsbackup/userRoot/uid.db4) [18/Jun/2006:04:23:12 +0300] - Backing up file 13 (/tmp/tmp.dJIDpX3348/fdsbackup/userRoot/nscpEntryDN.db4) [18/Jun/2006:04:23:12 +0300] - Backing up file 14 (/tmp/tmp.dJIDpX3348/fdsbackup/userRoot/id2entry.db4) [18/Jun/2006:04:23:12 +0300] - Backing up file 15 (/tmp/tmp.dJIDpX3348/fdsbackup/userRoot/nsds5ReplConflict.db4) [18/Jun/2006:04:23:12 +0300] - Backing up file 16 (/tmp/tmp.dJIDpX3348/fdsbackup/log.0000002860) [18/Jun/2006:04:23:12 +0300] - Backing up file 17 (/tmp/tmp.dJIDpX3348/fdsbackup/DBVERSION) [19/Jun/2006:00:00:00 +0300] NSMMReplicationPlugin - agmt="cn="Replication to server1.ton.fi"" (server1:389): Incremental protocol: event update_window_opened should no t occur in state wait_for_changes [20/Jun/2006:00:00:00 +0300] NSMMReplicationPlugin - agmt="cn="Replication to server1.ton.fi"" (server1:389): Incremental protocol: event update_window_opened should no t occur in state wait_for_changes [21/Jun/2006:00:00:00 +0300] NSMMReplicationPlugin - agmt="cn="Replication to server1.ton.fi"" (server1:389): Incremental protocol: event update_window_opened should no t occur in state wait_for_changes [22/Jun/2006:00:00:00 +0300] NSMMReplicationPlugin - agmt="cn="Replication to server1.ton.fi"" (server1:389): Incremental protocol: event update_window_opened should no t occur in state wait_for_changes Fedora-Directory/1.0.2 B2006.060.1928 server2.ton.fi:389 (/opt/fedora-ds/slapd-server2.ton.fi) [22/Jun/2006:17:01:10 +0300] - Fedora-Directory/1.0.2 B2006.060.1928 starting up Fedora-Directory/1.0.2 B2006.060.1928 server2.ton.fi:389 (/opt/fedora-ds/slapd-server2.ton.fi) [25/Jun/2006:20:25:48 +0300] - Fedora-Directory/1.0.2 B2006.060.1928 starting up [25/Jun/2006:20:25:48 +0300] - Detected Disorderly Shutdown last time Directory Server was running, recovering database. [25/Jun/2006:20:26:06 +0300] - slapd started. Listening on All Interfaces port 389 for LDAP requests [25/Jun/2006:20:27:05 +0300] NSMMReplicationPlugin - agmt="cn="Replication to server1.ton.fi"" (server1:389): Unable to receive the response for a startReplication exte nded operation to consumer (Can't contact LDAP server). Will retry later. [25/Jun/2006:20:27:09 +0300] NSMMReplicationPlugin - agmt="cn="Replication to server1.ton.fi"" (server1:389): Simple bind resumed </error log> Any ideas? Best Regards Kimmo Koivisto

3 4

[Fedora-directory-users] Need information about phpldapadmin and Fedora DS
by Rich Megginson 27 Jun '06

27 Jun '06

We have the Howto here - http://directory.fedora.redhat.com/wiki/Howto:phpLdapAdmin But it seems apparent from some recent IRC conversations that users can't even get this far - they can't even get phpldapadmin to display anything, even though it works fine with openldap. So if you have any information about setting up phpldapadmin with fedora ds, please let me know. Thanks.

3 6

Re: [Fedora-directory-users] Setting up multi-master via thecommand-line
by Mike Jackson 26 Jun '06

26 Jun '06

Joe Sheehan <triswimjoe(a)hotmail.com> kirjoitti: > Not at all - I can download it and I was just going to test it out today for > my systems. > I was just trying to automate the install of everything off the default > install so I was just curious if there were other ways. You can write LDIF files to configure the replication, and use the included ldapmodify tool. In my automated installations, I generate these LDIFs from parsed configuration files. It's quite a lot of work. The mmr.pl tool is seen as a blessing by nearly everybody who has ever tried to setup MMR by hand. I wrote it because I got tired of taking 10 minutes to setup a replication testbed, over and over again. BR, -- mike http://www.netauth.com

1 0

Re: [Fedora-directory-users] Setting up multi-master via the command-line
by Mike Jackson 26 Jun '06

26 Jun '06

Joe Sheehan <triswimjoe(a)hotmail.com> kirjoitti: > Is there any utilities or instructions for setting up multi-master > via the command-line. The only ones I can find are > http://directory.fedora.redhat.com/wiki/Howto:MultiMasterReplication > but the mmr.pl doesn't come by default. > Hi, Do you mean that you can't access the netauth.com website? It's my website, and it should be working. I'm sitting next to my server right now, and from here, it works. -- mike

2 1

[Fedora-directory-users] data design for inactive users?
by Philip Lembo 26 Jun '06

26 Jun '06

We archive inactive entries by removing them from the "active" part of the DIT and then recreating them in an "inactive" branch, where permissioning prevents all but a few administrative apps from seeing them. This allows us to prevent further use of the account while at the same time preserving information that might be helpful in an audit. If a user becomes active again (e.g. where an employee is rehired), we simply restore their entry to the active part of the tree. The two problems with this approach are accidental creation of duplicate entries (like when an employee returns after having a name change) and the fact that no off-the-shelf tool will do the archive/unarchive operation for you. I handle the former by yelling at HR alot and the latter by deploying some in-house created cgi scripts. The problem with using an "inactive" flag is that every COTS vendor who interfaces with LDAP has a different standard, and few are very customizable. Entrenched homegrown apps pose the same issue. Theoretically, the number of entries in a particular directory or directory container shouldn't be an issue. Unfortunately, many developers insist on treating LDAP like an RDMS, doing massive "data mining" queries and invoking Server Side Sort to boot. As a result, anything you can do to reduce the number of entries they can search through helps.

2 1

[Fedora-directory-users] apache ldap over SSL.
by Mickael Besse 23 Jun '06

23 Jun '06

I have a problem to use apache ldap over SSL. os: fedora core 3 (updated with yum) tools :fedora directory server 1.0.2, HTTPd 2.0.53, mod_ssl 1:2.0.53, mod_auth_ldap, mod_ldap, errors : In /var/log/http/error_log: auth_ldap authenticate: user test authentication failed; URI / [LDAP: ldap_simple_bind_s() failed][Can't contact LDAP server] In /opt/fedora-ds/slapd-id/logs/access : SSL connection from 127.0.0.1 to 127.0.0.1 closed - Encountered end of file I have no probleme without ssl. In http.conf: LDAPTrustedCA /etc/httpd/conf/ssl.crt/certificat.pem LDAPTrustedCAType BASE64_FILE <Directory "/var/www/html"> AuthLDAPEnabled on AuthLDAPURL ldaps://name_of_LDAPserver:636/dc=***,dc=***?uid require group dn_groupe </Directory> In fedora directory server, I use certutil -L -d . -P slapd-serverID- -n "CA certificate" -a > cacert.asc to export CA cert. Then, I copy the contents of cacert.asc in /etc/httpd/conf/ssl.crt/certificat.pem. So /etc/httpd/conf/ssl.crt/certificat.pem look like: -----BEGIN CERTIFICATE----- kjbfilqbvlsdbvlisdf........ -----END CERTIFICATE----- Note this message in access log when the httpd server start LDAP: Built with OpenLDAP LDAP SDK LDAP: SSL support unavailable Did a solution for this problem ? Can I use apache / ssl / auth_mod_ldap / ldap(s) togheter ? Maybe a miss somethings ? Did I have to rebuild my module auth_ldap module ? I want to rebuild the srpm from fedora core 3 updates, and include --with-ldap-sdk=netscape for the auth_ldap module. But I have no idea where to specifie this. httpd.spec file defines core options, but not modules options. Where can I specied configure options for auth_ldap modules ? This hints would be very appreciated... The time you spend to me is very appreciated regards _________________________________________________________________ Windows Live Mail : découvrez et testez la version bêta ! http://www.ideas.live.com/programpage.aspx?versionId=5d21c51a-b161-4314-9b0…

6 28

[Fedora-directory-users] slow mass deletion
by Dirk Kastens 23 Jun '06

23 Jun '06

Hi, I'm using fedora-ds-1.0.2-1.RHEL4. When I try to delete a whole branch in my ldap tree that contains several thousand entries, the deletion is extremely slow. The server needs about 10 seconds to delete a single entry. I can watch the progress in the server's logfiles. Deleting the branch will take nearly a day in my case. It doesn't matter if I use ldapdelete, ldapmodify with an ldif file as input, or the server console. My IBM directory server only needs a few seconds to delete a whole branch. How can I speed up the deletion? Regards, Dirk

2 2

RE: [Fedora-directory-users] SSL problems/questions for Fedora DS 1.02
by Dellwo, Martin J. [NCSUS] 22 Jun '06

22 Jun '06

Thanks, I'd seen the Howto:SSL but not the other stuff. I'll give it a shot. -- Martin J. Dellwo -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Richard Megginson Sent: Thursday, June 22, 2006 1:09 PM To: General discussion list for the Fedora Directory server project. Subject: Re: [Fedora-directory-users] SSL problems/questions for Fedora DS 1.02 -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

1 0

[Fedora-directory-users] SSL problems/questions for Fedora DS 1.02
by Dellwo, Martin J. [NCSUS] 22 Jun '06

22 Jun '06

Hello, How can one start up Fedora directory (1.02) server instances when one is using SSL? Can it be configured to read the security database password from a file? I believe it may have given me the option initially and I did not take advantage of it, so I am particularly wondering how to set up automatic startup (with no password prompt) after it is already set up to prompt. Right now, I have slapd running with SSL turned on, but could not restart the admin server after turning it on. I was able to edit two admin server configuration files to turn it back off for the admin server, so now I can start it without SSL. Any pointers to detailed documentation for using SSL with admin server? I also now have a new problem where I cannot open the 'Manage Certificates' task for the directory server (slapd) instance itself. In the admin server http logs I get this error [Thu Jun 22 11:56:06 2006] [notice] [client 10.24.224.137] admserv_host_ip_check: ap_get_remote_host could not resolve xxx.xxx.xxx.xxx Even though xxx.xxx.xxx.xxx is the IP address of the local server (both where slapd is running and where I am running the console from). It is properly defined in both the local /etc/hosts and in DNS. At the same time, the console gives a pop-up error, "org.mozilla.ssl.SSLSocketException: SSL_ForceHandshake failed: (-5938) Encountered end of file." Since I think this could be related to an out-of-date certificate CRL, how can one import new CRLs using command line tools? Thanks, Marty -- Martin J. Dellwo NCS Pharma R&D (Exton) NCS, a Johnson & Johnson Company mdellwo(a)ncsus.jnj.com

2 1

[Fedora-directory-users] Group syncing question
by Jeff Gamsby 21 Jun '06

21 Jun '06

OK, next problem. User sync is working great. I'm trying to migrate groups from OpenLDAP to FDS, then sync them to AD. I can do this, but there are a few issues: 1) Groups must live in the ou=people container in order to be synced. a) getent group works, but running "id" as LDAP user does not 2) AD expects the full dn name in the uniqueMember attribute, or it does not add the "uniquemember" a) will that work on the FDS side if I do something like "uniquemember: cn=blah,ou=people,dc=blah..."? a) I get this in the logs "map_dn_values: no local entry found for username" where username is a uniquemember value Is this how it's supposed to work, or am I doing something wrong? Thanks, Jeff

1 0

[Fedora-directory-users] Attempting to elminate authentication failure messages
by Bliss, Aaron 21 Jun '06

21 Jun '06

Hi everyone, I'm using fds for authentication; /etc/nsswitch.conf is configured to first query the ldap server and then local files for user information; I'm not sure why, however for some reason whenever a user attempts to authenticate to the box with a password, the box always reports in /var/log/messages an authentication failure, followed by a success (the success of course if only the user did in fact type their password correctly; in the excerpt below, I did not mistype my password; I would have expected that by configuring /etc/nsswitch.conf to first query the ldap server and then local files would have eliminated the misleading authentication messages...any ideas? Thanks very much Jun 21 11:16:27 ms-lnx-s53 sshd(pam_unix)[16642]: check pass; user unknown Jun 21 11:16:27 ms-lnx-s53 sshd(pam_unix)[16642]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=abliss.preferredcare.org Jun 21 11:16:27 ms-lnx-s53 sshd(pam_unix)[16644]: session opened for user awb by (uid=0) Confidentiality Notice: The information contained in this electronic message is intended for the exclusive use of the individual or entity named above and may contain privileged or confidential information. If the reader of this message is not the intended recipient or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that dissemination, distribution or copying of this information is prohibited. If you have received this communication in error, please notify the sender immediately by telephone and destroy the copies you received.

2 1

[Fedora-directory-users] admin-serv error log
by Jeff Gamsby 20 Jun '06

20 Jun '06

I am having a hard time getting the admin console to work in ssl mode. I get this "notice" error in the admin serv logs, is it a cause for concern? As far as I know, everything is setup correctly. [notice] [client xxx.xxx.xxx.xxx] admserv_host_ip_check: ap_get_remote_host could not resolve xxx.xxx.xxx.xxx I have created the certificates, then copied the slapd-<server>-* files to admin-serv-*, then tried to enable SSL in the admin console. I have followed the directions from "Managing SSL and SASL" but I get the error "Invalid LDAP Host/IP, could not connect to server in secure mode" when I change to secure mode in the "User DS" tab. Any suggestions? Thanks, Jeff

3 12

[Fedora-directory-users] File descriptor problem
by Morris, Patrick 20 Jun '06

20 Jun '06

I may be missing something obvious, but I've got a couple Red Hat EL4 servers running FDS 1.0.2, and I keep getting the dreaded "Not listening for new connections - too many fds open" error. I've looked at all the install and how-to guides, and have the following set up: /etc/security/limits.conf: * soft nofile 104851 * hard nofile 104851 /etc/sysctl.conf: fs.file-max = 131072 /etc/profile: ulimit -n 131072 /etc/pam.d/login: session required /lib/security/pam_limits.so Still, as soon as FDS hits 1024 FDs open, everything blows up. What have I missed? I've also added a "ulimit -n 131072" to the top of the server's init script, but no dice.

2 2

[Fedora-directory-users] RHAS 4.0 Pseries
by nattapon viroonsri 20 Jun '06

20 Jun '06

Compile Problem with RHAS 4.0 Pseries RHAS 4.0 for Pseries Linux# uname -rmpio 2.6.9-5.EL ppc64 ppc64 ppc64 GNU/Linux I have used dsbuil-fds102.tar.gz completely build fedora-ds on FC4.0 . but have many compile problem with this tool on RHAS 4.0 for Pseries. Can i use "dsbuild-fds102.tar.gz" build fedora-ds on RHAS4.0 Pseries ? I have stuck with Adminutil package ==== Building AdminUtil ========== cd lib/libadminutil; gmake NSPR_BASENAME= USE_PTHREADS= SECURITY=domestic MOZILLA_SOURCE_ROOT_EXT= ICU_SOURCE_ROOT_EXT= USE_64= gmake[3]: Entering directory `/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/lib/libadminutil' .../../nsconfig.mk:497: warning: overriding commands for target `/root/dsbuild-fds102/ds/adminutil/work/dist/RHEL4_ppc64_gcc3_DBG.OBJ' .../../nsconfig.mk:497: warning: ignoring old commands for target `/root/dsbuild-fds102/ds/adminutil/work/dist/RHEL4_ppc64_gcc3_DBG.OBJ' .../../nsconfig.mk:580: warning: overriding commands for target `clean' .../../nsconfig.mk:580: warning: ignoring old commands for target `clean' .../../nsconfig.mk:591: warning: overriding commands for target `.depends.RHEL4_ppc64_gcc3_DBG.OBJ' .../../nsconfig.mk:591: warning: ignoring old commands for target `.depends.RHEL4_ppc64_gcc3_DBG.OBJ' .../../nsconfig.mk:594: warning: overriding commands for target `depend' .../../nsconfig.mk:594: warning: ignoring old commands for target `depend' .../../nsconfig.mk:600: warning: overriding commands for target `strip' .../../nsconfig.mk:600: warning: ignoring old commands for target `strip' mkdir -p /root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/built/RHEL4_ppc64_gcc3_DBG.OBJ/lib/libadminutil UNKNOWN_SYSTEM_TYPE -c -DNO_NODELOCK -DXP_UNIX -Dppc64-unknown-linuxoldld -DMCC_DEBUG -DNET_SSL -DSPAPI20 -DBUILD_NUM=\" 2006.171.511\" -DNET_SSL -DSPAPI20 -DBUILD_NUM=\"2006.171.511\" -I/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/include -I/root/ dsbuild-fds102/ds/mozilla/work/mozilla/dist/DBG.OBJ/include -I/root/dsbuild-fds102/ds/mozilla/work/mozilla/dist/public/nss -I/root/dsbuild-fds102/ds/ mozilla/work/mozilla/dist/public/ldap -I/root/dsbuild-fds102/ds/icu/work/icu-3.4/built/include psetc.c -o /root/dsbuild-fds102/ds/adminutil/work/fedora- adminutil-1.0.2/built/RHEL4_ppc64_gcc3_DBG.OBJ/lib/libadminutil/psetc.o gmake[3]: UNKNOWN_SYSTEM_TYPE: Command not found gmake[3]: *** [/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/built/RHEL4_ppc64_gcc3_DBG.OBJ/lib/libadminutil/psetc.o] Error 127 gmake[3]: Leaving directory `/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/lib/libadminutil' make[2]: *** [buildAdminUtil] Error 2 make[2]: Leaving directory `/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2' make[1]: *** [build-work/fedora-adminutil-1.0.2/Makefile] Error 2 make[1]: Leaving directory `/root/dsbuild-fds102/ds/adminutil' make: *** [dep-../../ds/adminutil] Error 2 I check in nsconfig.mk it does not have architech to match with ppc Nattapon, Regards _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

[Fedora-directory-users] Compile Problem with RHAS4 Pseries
by nattapon viroonsri 20 Jun '06

20 Jun '06

RHAS 4.0 for Pseries Linux# uname -rmpio 2.6.9-5.EL ppc64 ppc64 ppc64 GNU/Linux I have used dsbuil-fds102.tar.gz completely build fedora-ds on FC4.0 . but have many compile problem with this tool on RHAS 4.0 for Pseries. Can i use "dsbuild-fds102.tar.gz" build fedora-ds on RHAS4.0 Pseries ? I have stuck with Adminutil package ==== Building AdminUtil ========== cd lib/libadminutil; gmake NSPR_BASENAME= USE_PTHREADS= SECURITY=domestic MOZILLA_SOURCE_ROOT_EXT= ICU_SOURCE_ROOT_EXT= USE_64= gmake[3]: Entering directory `/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/lib/libadminutil' .../../nsconfig.mk:497: warning: overriding commands for target `/root/dsbuild-fds102/ds/adminutil/work/dist/RHEL4_ppc64_gcc3_DBG.OBJ' .../../nsconfig.mk:497: warning: ignoring old commands for target `/root/dsbuild-fds102/ds/adminutil/work/dist/RHEL4_ppc64_gcc3_DBG.OBJ' .../../nsconfig.mk:580: warning: overriding commands for target `clean' .../../nsconfig.mk:580: warning: ignoring old commands for target `clean' .../../nsconfig.mk:591: warning: overriding commands for target `.depends.RHEL4_ppc64_gcc3_DBG.OBJ' .../../nsconfig.mk:591: warning: ignoring old commands for target `.depends.RHEL4_ppc64_gcc3_DBG.OBJ' .../../nsconfig.mk:594: warning: overriding commands for target `depend' .../../nsconfig.mk:594: warning: ignoring old commands for target `depend' .../../nsconfig.mk:600: warning: overriding commands for target `strip' .../../nsconfig.mk:600: warning: ignoring old commands for target `strip' mkdir -p /root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/built/RHEL4_ppc64_gcc3_DBG.OBJ/lib/libadminutil UNKNOWN_SYSTEM_TYPE -c -DNO_NODELOCK -DXP_UNIX -Dppc64-unknown-linuxoldld -DMCC_DEBUG -DNET_SSL -DSPAPI20 -DBUILD_NUM=\" 2006.171.511\" -DNET_SSL -DSPAPI20 -DBUILD_NUM=\"2006.171.511\" -I/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/include -I/root/ dsbuild-fds102/ds/mozilla/work/mozilla/dist/DBG.OBJ/include -I/root/dsbuild-fds102/ds/mozilla/work/mozilla/dist/public/nss -I/root/dsbuild-fds102/ds/ mozilla/work/mozilla/dist/public/ldap -I/root/dsbuild-fds102/ds/icu/work/icu-3.4/built/include psetc.c -o /root/dsbuild-fds102/ds/adminutil/work/fedora- adminutil-1.0.2/built/RHEL4_ppc64_gcc3_DBG.OBJ/lib/libadminutil/psetc.o gmake[3]: UNKNOWN_SYSTEM_TYPE: Command not found gmake[3]: *** [/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/built/RHEL4_ppc64_gcc3_DBG.OBJ/lib/libadminutil/psetc.o] Error 127 gmake[3]: Leaving directory `/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/lib/libadminutil' make[2]: *** [buildAdminUtil] Error 2 make[2]: Leaving directory `/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2' make[1]: *** [build-work/fedora-adminutil-1.0.2/Makefile] Error 2 make[1]: Leaving directory `/root/dsbuild-fds102/ds/adminutil' make: *** [dep-../../ds/adminutil] Error 2 I check in nsconfig.mk it does not have architech to match with ppc Nattapon, Regards _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

[Fedora-directory-users] Failed to login from other Linux desktop
by Mohd Amin Sharifuldin B. Salleh 20 Jun '06

20 Jun '06

Hi, We installed fds few times already. The console works but it failed to authenticate from other RedHad Linux. It also failed when when ssh to the ldap server where the user name only registered on FDS. We use mostly microsoft with AD since WinNT times until now. But since last year, we decided to move to linux and than we started experimenting with linux (RedHad Centos and Ubuntu). What we do is 1. Install RH ES ver 4 2. Setting up DNS using webmin 3. Install JAVA than followed by installing FDS 4. Start console, it is all working fine 5. start populating the directory by inputting simple user, password dan the compusary input 6. start testing using Centos to authenticate to FDS after configuring the authentication - login suing user name only available on FDS - failed 7. Than test SSH to FDS on the same machine as FDS - using user only available on FDS - failed - err=49 tag=97 on access log 8. Is it wright what we do to test FDS Counld some one advice us, what we did wrong ? amin

1 0

[Fedora-directory-users] rename an instance, possible ?
by Mikael Kermorgant 19 Jun '06

19 Jun '06

Hello, During my tests of Fedora Directory Server, I've created a server with a temporary name. The instance of FDS herited of that name. Now that I'm going to put it in production, I'd like to give the instance a definitive name. Is it possible to rename the instance ? If not, what would the easiest way to achieve my goal ? (I've tested to clone my test instance but the option is disabled and it seems I'll still need the original test instance). Thanks in advance, -- Mikael Kermorgant

2 1

[Fedora-directory-users] Download package for various FC/RHEL versions?
by Bryan Smith 19 Jun '06

19 Jun '06

On the download pages, I noted that the same package should be used for both FC2 and RHEL3. Is this correct? It was always my assumption that RHL8, RHL9 and FC1 used the same packages as RHEL3, while FC2 and FC3 were the same as RHEL4. As such, should it not be that the FC3/RHEL4 version is also what should be downloaded for FC2? And then the RHEL3 would also be for FC1, not FC2? About the only place where FC2 differs from FC3/RHEL4 seems to be GCC (3.3 for the former instead of 3.4 like the latter two). FC1 actually ships the same version as FC2, and not the same as FC1/RHEL3 (3.3 for the former instead of 3.2 like the latter two). So I'm just curious if the download recommendation is correct for FC2? -- Bryan P.S. I've been tracking Kernel, C and GLibC (among other, core ABI packages) on Red Hat releases over the years. I recently posted a simplified history table through FC5 on my blog here: http://thebs413.blogspot.com/2006/05/fedora-red-hat-abi-compatibility.html -- Bryan J. Smith Professional, technical annoyance mailto:b.j.smith@ieee.org http://thebs413.blogspot.com ---------------------------------------------------------- The existence of Linux has far more to do with the breakup of AT&T's monopoly than anything Microsoft has ever done.

2 1

[Fedora-directory-users] Migrate to FDS
by David A. Hopkins 19 Jun '06

19 Jun '06

Sorry if this is obvious, but I have an existing LDAP directory based on Openldap and the smbldap-tools. Can I simply migrate the existing system to FDS? It is running on an x86_64 architecture. I suspect I could install FDS on a second system, sync with the existing system, then decommission the existing, install FDS, sync, and be good to go? But ... I am not sure. Thanks, Dave Hopkins

1 0

[Fedora-directory-users] phpldapadmin acl configuration
by Mikael Kermorgant 17 Jun '06

17 Jun '06

Hello, I've tried to setup phpldapadmin but it fails after login with this error : --- Our attempts to find your SCHEMA for "attributetypes" have FAILED. --- I've read that Fedora DS works with phpldapadmin and that this error can be due to wrong acl : http://wiki.pldapadmin.com/tiki-view_faq.php?faqId=1#q11 I've created a special user phpldapadmin but don't know what rights to give to him as I haven't found cn=subschema Would someone have an idea ? Regards, -- Mikael Kermorgant

2 4

[Fedora-directory-users] Password synchronization error
by Jeff Gamsby 16 Jun '06

16 Jun '06

Has anyone ever come across this error: [15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): Received error [0000216C: AtrErr: DSID-031D0AC0, #1: 0:0000216C: DSID-031D0AC0, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 9005a (unicodePwd) ] when attempting to modify entry [<GUID=e873f710d5b9394db14c701cf5f11821>]: Please correct the attribute specified in the error message. Refer to the Windows Active Directory docs for more information. [15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): windows_replay_update: update password returned 1 [15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): Consumer failed to replay change (uniqueid 3783a101-1dd211b2-802fd24c-a4ed0000, CSN 4492399a000000010000): Constraint violation. Skipping. I used ldapmodify to change the password. This is the ldif file that I used: dn: uid=user,ou=people,dc=server,dc=example,dc=com changetype: modify replace: userpassword userpassword:: e2NyeXB0fSQxJHREb0RZV3JxJFE5UDVmMmVnSzc4NHAvVXVKVldnTS4= It successfully changes the password in FDS, but not in AD Thanks, Jeff

2 3

[Fedora-directory-users] Password synchronization error
by Jeff Gamsby 16 Jun '06

16 Jun '06

Has anyone ever come across this error: [15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): Received error [0000216C: AtrErr: DSID-031D0AC0, #1: 0:0000216C: DSID-031D0AC0, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 9005a (unicodePwd) ] when attempting to modify entry [<GUID=e873f710d5b9394db14c701cf5f11821>]: Please correct the attribute specified in the error message. Refer to the Windows Active Directory docs for more information. [15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): windows_replay_update: update password returned 1 [15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): Consumer failed to replay change (uniqueid 3783a101-1dd211b2-802fd24c-a4ed0000, CSN 4492399a000000010000): Constraint violation. Skipping. I used ldapmodify to change the password. This is the ldif file that I used: dn: uid=user,ou=people,dc=server,dc=example,dc=com changetype: modify replace: userpassword userpassword:: (cut and paste from userpassword attribute after ldapsearch) It successfully changes the password in FDS, but not in AD Thanks, Jeff

1 0

[Fedora-directory-users] Fedora DS installation on Ubuntu Dapper Drake
by Olivier Brugman 16 Jun '06

16 Jun '06

Hi all, Thank you for the FDS software! This morning I installed the Fedora Directory Server (FDS) on Ubuntu Dapper Drake (6.06 LTS). This procedure seems to work for me in order to get FDS running on the Dapper platform: The procedure is almost equal to the existing howto for Ubuntu Breezy Badger and Debian GNU/Linux Sarge which is available at http://directory.fedora.redhat.com/wiki/Howto:DebianUbuntu I'll just describe the parts that deviate. I installed the FDS on a clean minimal installation of Ubuntu Dapper Drake server-version (x86), which is available at http://www.ubuntu.com/download As Dapper uses libc6 version 2.3.6 I took the Fedora Core 4-rpm (version 1.0.2) as a base for conversion to '.deb'. You can download the rpm at http://directory.fedora.redhat.com/wiki/Download The necessary termcap-compat package does not seem to be available for 'Dapper', so I just used the 'Breezy' version of that package. termcap-compat depends on the 'libc5' and 'ldso' packages which aren't available for 'Dapper' eighter. You can get the Breezy-version of these packages at http://packages.ubuntu.com/ BTW, I used the Sun jdk 1.5.0_02. After the installation of the fedora-ds .deb-package I used the setuputil and an existing 'install.inf' file (see example hereunder) to do a silent install of the FDS. You can invoke the silent install like so: sudo /opt/fedora-ds/setup/setup -s -f /opt/install.inf Example install.inf: [General] FullMachineName= xenfds.intra.example.com SuiteSpotUserID= fds SuiteSpotGroup= fds ServerRoot= /opt/fedora-ds AdminDomain= intra.example.com ConfigDirectoryAdminID= admin ConfigDirectoryAdminPwd= yourpasswordhere ConfigDirectoryLdapURL= ldap://xenfds.intra.example.com:389/o=NetscapeRoot UserDirectoryAdminID= admin UserDirectoryAdminPwd= yourpasswordhere UserDirectoryLdapURL= ldap://xenfds.intra.example.com:389/dc=intra,dc=example,dc=com [slapd] SlapdConfigForMC= Yes SecurityOn= No UseExistingMC= No UseExistingUG= No ServerPort= 389 ServerIdentifier= xenfds Suffix= dc=intra, dc=example, dc=com RootDN= cn=Directory Manager AddSampleEntries= No InstallLdifFile= suggest AddOrgEntries= Yes DisableSchemaChecking= No RootDNPwd= hannibal [admin] SysUser= root Port= 7777 ServerIpAddress= ServerAdminID= admin ServerAdminPwd= yourpasswordhere ApacheDir= /usr/sbin ApacheRoot= /usr/lib/apache2 HTH, Olivier Brugman

2 6

[Fedora-directory-users] PassSync only working one way
by Jeff Gamsby 14 Jun '06

14 Jun '06

I thought that I had the PassSync working until I ran into this problem: Passwords are not synchronized from FDS to AD. When accounts are added to FDS, they do show up in AD ( Although sometimes the cn attribute gets base64 encoded ), but I cannot authenticate to AD. When I change passwords in the FDS side, they are not changed ( or not sent ) to AD. If I change passwords in AD, they are changed in the FDS. The logs show that something is happening (changed host names and dn's) [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): No linger to cancel on the connection [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - windows_acquire_replica returned success (101) [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): State: ready_to_acquire_replica -> sending_updates [13/Jun/2006:15:03:41 -0700] - _cl5PositionCursorForReplay (agmt="cn=AD" (ad:636)): Consumer RUV: [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): {replicageneration} 448f18ae000000010000 [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): {replica 1 ldap://fds:389} 448f18e4000100010000 448f363d03d400010000 448f363d [13/Jun/2006:15:03:41 -0700] - _cl5PositionCursorForReplay (agmt="cn=AD" (ad:636)): Supplier RUV: [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): {replicageneration} 448f18ae000000010000 [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): {replica 1 ldap://fds:389} 448f18e4000100010000 448f363d03d700010000 448f363d [13/Jun/2006:15:03:41 -0700] agmt="cn=AD" (ad:636) - session start: anchorcsn=448f363d03d400010000 [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - changelog program - agmt="cn=AD" (ad:636): CSN 448f363d03d400010000 found, position set for replay [13/Jun/2006:15:03:41 -0700] agmt="cn=AD" (ad:636) - load=1 rec=1 csn=448f363d03d600010000 [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): windows_replay_update: Looking at modify operation local dn="uid=user,ou=people,dc=server,dc=,dc=" (ours,user,not group) [13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): windows_replay_update: Processing modify operation local dn="uid=user,ou=people,dc=server,dc=,dc=" remote dn="<GUID=16f869dcfdde3d42bcb075fd4a1c7980>" I'm not sure what is going on, I can talk via SSL from FDS to AD, and I'm assuming that the PassSync service is working properly since the changes from AD to FDS work. Any suggestions?

5 8

[Fedora-directory-users] data design for inactive users?
by Scott Roberts 13 Jun '06

13 Jun '06

In our ldap we do not delete users, we deactivate them with nsaccountlock. All user entries are in the same branch of the tree. In this data structure, all uid's are unique and are not used again. Ok well now our ldap is getting large and I would like active users separate from inactive users to provide better search performance. AFAIK lot of services keep uid's so they cannot be used again. What's a good design approach? Do inactive users move to another tree? Maybe move to another server and use a referral somehow. What do ldap admins do with all this dead weight? :) __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 4

[Fedora-directory-users] Sync problem
by Atr0pos 13 Jun '06

13 Jun '06

Hi list, I'm running FDS on FC4 and have configure windows sync (not password sync for the moment - just groups and accounts) against my AD. All is working well (add - delete) but when I move an AD account from an OU to another one OU (ie. from ou=service,ou=people to ou=people), he is not replicated on FDS (account still on the old OU - ou=service,ou=people). Have you ever seen that ?

1 2

[Fedora-directory-users] Person object unable to update their own attributes
by Paul Clayton 13 Jun '06

13 Jun '06

I have set up a special user with the details Cn=nextuid,ou=Cape Town,dc=mycompany,dc=com The main attribute is "uid". In this is attribute, is a number for example "500" My PHP program uses this person object to determine the next "uid" to use when creating a new user. Problem I am experiencing, is that I am not able to update or modify this person object using the person objects (cn=nextuid) own credentials. I get a "Insufficient 'write' privilege to the 'uid' attribute of entry" (error 50) The ACL allows self write and targets the attribute. Any ideas were I am going wrong. Regards Paul Clayton -------------------------------------------------------- This e-mail and any attachments are confidential and may also be legally privileged and/or copyright material of Intec Telecom Systems PLC (or its affiliated companies). If you are not an intended or authorised recipient of this e-mail or have received it in error, please delete it immediately and notify the sender by e-mail. In such a case, reading, reproducing, printing or further dissemination of this e-mail or its contents is strictly prohibited and may be unlawful. Intec Telecom Systems PLC does not represent or warrant that an attachment hereto is free from computer viruses or other defects. The opinions expressed in this e-mail and any attachments may be those of the author and are not necessarily those of Intec Telecom Systems PLC.

1 0

[Fedora-directory-users] PassSync service stopped working
by Dan Oglesby 12 Jun '06

12 Jun '06

PassSync has been working fine for me in production on a couple different systems, but has stopped working on one for some reason. I've tried reinstalling the PassSync software, removed the passhook.log and passhook.dat between installations, verified passwords and user info is correct for the service, still nothing. When I restart the service, I get the following in my access log file on the LDAP server (IPs and user info removed): [12/Jun/2006:14:42:48 -0500] conn=896 fd=178 slot=178 SSL connection from 192.168.X.X to 192.168.X.X [12/Jun/2006:14:42:48 -0500] conn=896 SSL 128-bit RC4 [12/Jun/2006:14:42:48 -0500] conn=896 op=0 BIND dn="userinfo" method=128 version=2 [12/Jun/2006:14:42:48 -0500] conn=896 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="userinfo" [12/Jun/2006:14:42:48 -0500] conn=896 op=1 UNBIND [12/Jun/2006:14:42:48 -0500] conn=896 op=1 fd=178 closed - U1 After the service has started, I get nothing else in either the access or errors log files. The passhook.log never shows any info, and the log file in the PassSync directory only contains info regarding the service stopping and starting. Any hints as to where else I need to be looking to fix this issue? --Dan

1 0

[Fedora-directory-users] updating/renewing CA and server cert
by Brian Jones 12 Jun '06

12 Jun '06

Hi all, The SSL Howto on the wiki doesn't really cover a procedure for what to do when your root CA has to be renewed, along with your server certs. I have 3 servers whose server certs are all signed with our own root CA, but that root CA is expiring, and needs to be replaced. Presumably this means I also need to replace the server certs, since they were signed with this expiring root CA. What I was able to do was just blow away /opt/fedora-ds/alias/*.db, and then run: ###### CREATE NEW *.db FILES ######## /opt/fedora-ds/share/bin/certutil -N -d /opt/fedora-ds/alias -P slapd-ldap- ###### INSTALL NEW ROOT CA ######## /opt/fedora-ds/share/bin/certutil -A -n "My Dept. Root CA" -P slapd-ldap- -d /opt/fedora-ds/alias -t "CT,," -a -i ./cacert.pem ###### CREATE NEW SERVER CERT REQUEST ####### /opt/fedora-ds/share/bin/certutil -R -d /opt/fedora-ds/alias -a -P slapd-ldap- -s "cn=ldap.my-domain.com" -o /tmp/csr.der.txt -g 1024 ###### SIGN THE NEW SERVER CERT REQUEST ######## openssl ca -config openssl.cnf -policy policy_anything -out certs/ldapcert.pem -infiles csr.der.txt ###### INSTALL NEW SERVER CERT ######### /opt/fedora-ds/shared/bin/certutil -A -d /opt/fedora-ds/alias -n "ldap-server-cert" -P slapd-ldap- -t u,u,u -a -i /opt/fedora-ds/alias/ldapcert.pem At this point, my server starts up just fine and all appears to be well, but it doesn't seem like it should be absolutely necessary to start over from scratch on each server when our root CA expires. Can someone detail a shorter method to replace expired root CAs *and* server certificates? thanks. brian.

1 0

[Fedora-directory-users] FDS and eGroupWare
by Matthias Saou 12 Jun '06

12 Jun '06

Hi, I've found an old post in the list archives regarding the integration of eGroupWare with FDS, and some posts in the eGroupWare forums. Unfortunately, none of the discussions lead to a solution. References : http://www.redhat.com/archives/fedora-directory-users/2005-July/msg00199.ht… http://forum.egroupware.org/viewtopic.php?t=3257 http://forum.egroupware.org/viewtopic.php?t=7456 I'm having the same problem : The schema files provided with eGroupWare don't work as-is with FDS, it's not just a matter of renaming them to "NNfilename.ldif". Files for OpenLDAP, iPlanet (unfortunately quite different, they don't even have any "dn: cn=schema" lines) and Novell eDirectory (the closest match is seems, but still different and marked as EXPERIMENTAL) can all be found here : http://svn.egroupware.org/egroupware/trunk/phpgwapi/doc/ldap/ The README contains all the details. So... the same question : Has anyone created FDS LDIF files based on these, to drop in the config/schemas/ directory and have eGroupWare working? :-) Matthias -- Clean custom Red Hat Linux rpm packages : http://freshrpms.net/ Fedora Core release 5.89 (Rawhide) - Linux kernel 2.6.16-1.2232_FC6 Load : 0.49 0.33 0.34

2 3

[Fedora-directory-users] account expiration time
by Mikael Kermorgant 12 Jun '06

12 Jun '06

Hello, I'd like to know if there's a common way to manage account expiration by specifying an expiration date ? In my case, I have some accounts which have to be renewed each year. They should by default be disactivated automatically. I've considered adding a dedicated attribute and running a script via cron but I'd welcome any suggestion. Best regards, -- Mikael Kermorgant

1 0

[Fedora-directory-users] ns-slapd process growing
by Frits Hoogland 12 Jun '06

12 Jun '06

I am running the fedora directory server version 1.0.2 on debian gnu linux version 3.1 (debian sarge) The ldap server itself (ns-slapd) worked alright, but upon increased usage, the ns-slapd process is ever increasing memory usage. ps shows size (SZ col) of 220669, top show virt 863m, res 407m, shr 47m Is this normal behavior? Any way to restrict memory usage in any form? frits

2 1

[Fedora-directory-users] Replica has no update vector. It has never been initialized
by Jeff Gamsby 10 Jun '06

10 Jun '06

I have setup passSync and replication, but I get this error: Replica has no update vector. It has never been initialized. I have run the "Initiate full re-initialization" and restarted the PassSync service on AD. I'm not sure what to do. I had it working before, but had to re-install. I had this problem before, but it seemed to solve itself. Please help. Thanks

1 1

[Fedora-directory-users] Attribute uniqueness of multiple attributes
by Arjan Franzen 09 Jun '06

09 Jun '06

Hi all, I'm using FDS as a component in a software development project. up until now I've had no problems but what puzzles me is the status of attribute uniqueness. FDS is based on Netscape iPlanet and or Sun ONE directory from what I read. if I look at the documentation of FDS (iPlanet 7.0 based) I see clearly no support for multiple unique attributes (page 594 of the admin manual): If I on the other hand look at the Sun documenation: http://docs.sun.com/source/816-6400-10/attruniq.html#wp19660 see section: "Configuring the Plug-In From the Command-Line" I see that there is a way! only I can't get it to work which suggests what I read in the FDS documentation. My question: Can FDS now or in the future support multiple unique attributes? I'm using it to keep integrity intact of some objects stored both in FDS and in a RDBMS. regards, Arjan

2 1

[Fedora-directory-users] Question regarding FDS and Samba Integration re: group security
by timmmyyy＠mts.net 08 Jun '06

08 Jun '06

Greetings, I have been a linux user for sometime, but have only recently started working with LDAP after hearing about the Fedora Directory Server. I have been using it primarily with integration into Samba as a replacement for Active Directory, and it has been working well thus far. I have deployed a servers into a production environment, and it's working great. I followed the howto for Samba found on the main page, and the server is setup in this way. My question though relates to group security. Since I wish to delegate access to files on the samba fileserver via group membership, how can I accomplish this using FDS and Samba? Am I able to create a group using the Admin Console, add the user accounts to be members of the group, and then set security on shares based on group? Or is there a specific procedure to follow? I'm becoming fairly versed at samba, but LDAP is still quite new to me. Obviously the more I can do using the Admin console, the happier I, and my customers are. I have tried creating a share in samba, allowing only access to the group that I created in the directory, then adding a user to that group, but the user is unable to access the share, as samba doesn't seem to be aware of the group created in the directory. A bit of searching has told me that samba wants the group to be a posix group, or to exist in the /etc/group file on the system. Several LDAP/Samba howtos have also suggested at needing to run a net groupmap command to map the ldap group to a posix id. This makes sense, as in the Fedora howto this is necessary to create the well-known groups which users are added to later on, but then how is group membership managed? The well-known groups that are created during the initial howto appear differently in the administration console, and double clicking them only opens the advanced the properties, and not the ability to add additional members to the group. I apologize for any parts that don't make sense, but hopefully someone will catch what I'm actually meaning and be able to offer some help. If any more information is required, please ask, and I will gladly provide. Tim Friesen

2 1

[Fedora-directory-users] FDS over SSL with PassSync -- How I did it
by Jeff Gamsby 08 Jun '06

08 Jun '06

Thanks to everyone who helped me. Since it was a struggle for me, I thought that I would post how I did it in case others have the same problems that I had. Maybe it will help someone else. My Setup: Fedora Core 4 Fedora Directory Server 1.0.2 Windows 2000 Server Install FDS ( or reinstall: rpm -qa | grep fedora-ds | xargs rpm -e; rm -rf /opt/fedora-ds ; rpm -i fedora-ds-1.0.2 ) create certificates, etc.. I used this simple script that I wrote: (cd to /opt/fedora-ds/alias) ----------------------------------------------------------------------- echo -n "Creating password and noise file..." echo "8904859034905834-580943502385430958430958049385" > /opt/fedora-ds/alias/pwdfile.txt echo "8374893jkhsdfjkhdjksfah89dskjfkdghkjdfhguiert9348khkfhgkjfd79" > /opt/fedora-ds/alias/noise.txt echo -n "Creating Databases..." $serverroot/shared/bin/certutil -N -d . -f pwdfile.txt echo -n "Generating encryption key..." $serverroot/shared/bin/certutil -G -d . -z noise.txt -f pwdfile.txt echo -n "Generating self-signed certificate..." $serverroot/shared/bin/certutil -S -n "CA certificate" -s "cn=CAcert" -x -t "CT,," -m 1000 -v 120 -d . -z noise.txt -f pwdfile.txt echo -n "Generating server certificate.." $serverroot/shared/bin/certutil -S -n "Server-Cert" -s "cn=msas.msd.lbl.gov" -c "CA certificate" -t "u,u,u" -m 1001 -v 120 -d . -z noise.txt -f pwdfile.txt mv key3.db slapd-msas-key3.db mv cert8.db slapd-msas-cert8.db ln -s slapd-msas-key3.db key3.db ln -s slapd-msas-cert8.db cert8.db echo -n "Setting permissions.." chown nobody.nobody /opt/fedora-ds/alias/slapd-msas* echo -n "Exporting certificate.." $serverroot/shared/bin/certutil -L -d . -n "CA certificate" -r > cacert.der echo "Converting certificate.." openssl x509 -inform DER -in cacert.der -outform PEM -out cacert.pem echo "Copying cacert.pem to /etc/openldap/cacerts.." cp cacert.pem /etc/openldap/cacerts/ echo -n "Enabling SSL in FDS" echo "" echo -n "Please enter Manager password..(twice)" ldapmodify -x -D cn=Manager -W -f /tmp/ssl_enable.ldif ldapmodify -x -D cn=Manager -W -a -f /tmp/addRSA.ldif --------------------------------------------------------- restart FDS Test SSL connections and ldapsearch netstat -an | grep 636 Install Active Directory on Windows Server Install Certificate Services --> Enterprise root CA reboot Enable SSL on AD 1. Install Certificate Services on Windows 2000 Server and an Enterprise Certificate Authority in the Active Directory Domain. Make sure you install an Enterprise Certificate Authority. 2. Create a Security (Group) Policy to direct Domain Controllers to get an SSL certificate from the Certificate Authority (CA). 1. Open the Active Directory Users and Computers Administrative tool. 2. Under the domain, right-click on Domain Controllers. 3. Select Properties. 4. In the Group Policy tab, click to edit the Default Domain Controllers Policy. 5. Go to Computer Configuration->Windows Settings->Security Settings->Public Key Policies. 6. Right click Automatic Certificate Request Settings. 7. Select New. 8. Select Automatic Certificate Request. 9. Run the wizard. Select the Certificate Template for a Domain Controller. 10. Select your Enterprise Certificate Authority as the CA. Selecting a third-party CA works as well. 11. Complete the wizard. 12. All Domain Controllers now automatically request a certificate from the CA, and support LDAP using SSL on port 636. 3. Retrieve the Certificate Authority Certificate 1. Open a Web browser on the AD machine 2. Go to http://localhost/certsrv/ 3. Select the task Retrieve the CA certificate or certificate revocation list. 4. Click Next. 5. The next page automatically highlights the CA certificate. Click Download CA certificate. 6. A new download window opens. Save the file to the hard drive. Save in DER mode Copy file to FDS server, convert to PEM format openssl x509 -inform DER -in ad-cert.der -outform PEM -out ad-cert.pem Import AD CA cert into FDS certutil -A -d . -P slapd-instance- -t "CT,CT,CT" -a -i ad-cert.pem check certs ( from /opt/fedora-ds/alias) certutil -L -d . -P slapd-instance Check ldapsearch from FDS to AD ldapsearch -Z -P <RHDS-cert8.db> -h <AD/NT Hostname> -p <AD SSL port> -D "<sync manager user> -w < sync manager password> -s <scope> -b "<AD base>" "<filter>" Install PassSync on Windows machine. Follow directions from Howto:WindowsSync (certificate creation) restart AD server Enable Replication in Directory Server Console: Go to configuration tab --> Replication --> enable changelog --> default Expand Replication, click UserRoot Check "Enable Replica" Single-master Right Click UserRoot --> Create new windows sync agreement Up log level in FDS: dn: cn=config changetype: modify replace: nsslapd-errorlog-level nsslapd-errorlog-level: 8192 ldapmodify -x -D "cn=directory manager" -a -f repl_log.ldif restart FDS right click win sync agreement --> Initiate Full Sync check error logs (/opt/fedora/slapd-instance/logs/errors) In order for users to be created on the Windows side, users must have certain attributes. e.g. dn: uid=TBird,ou=People, dc=server,dc=com givenName: Tweetie ntUserCreateNewAccount: true objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetorgperson objectClass: ntuser objectClass: posixAccount facsimileTelephoneNumber: 510-555-5555 uid: TBird mail: tbird(a)server.com uidNumber: 71209 cn: Tweetie Bird ntUserComment: Tweetie Bird User Account telephoneNumber: 510-555-5555 loginShell: /bin/bash ntUserDomainId: tbird gidNumber: 5000 ntUserDeleteAccount: true gecos: Tweetie Bird homeDirectory: /home/tbird sn: Bird userPassword:: I hope that I have this right.

1 0

[Fedora-directory-users] post to fedora directory users list
by Mickael Besse 08 Jun '06

08 Jun '06

mickaelb(a)hotmail.com _________________________________________________________________ Windows Live Mail : venez tester la version bêta ! http://www.ideas.live.com/programpage.aspx?versionId=5d21c51a-b161-4314-9b0…

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users June 2006