389-users June 2006

389-users@lists.fedoraproject.org

51 participants
61 discussions

[Fedora-directory-users] PassSync setup still not working
by Jeff Gamsby 08 Jun '06

08 Jun '06

Please help me, I cannot get this to work. It's driving me crazy. This is what I did: Setup FDS over SSL using certutil. Windows 2000 AD server with "Enterprise Certificate Authority" Can search AD over SSL ( using ldp.exe, people search over ssl, and openldap ldapsearch over ssl -H ldaps://) Installed PassSync ( used FDS host, port 636, FDS Manager account cn=Manager, FDS cert db password, FDS base ) Exported FDS certs ( per howto:ssl ) and imported them into AD ( certutil databases on windows side ) Setup changelog ( default ) and single master replication Setup windows sync agreement ( bind as AD administrator account cn=administrator,cn=users,....) Then I test SSL connection from FDS to AD: ../shared/bin/ldapsearch -X -h ad-host -p 636 -D "cn=administrator,cn=users,... -w - -s base -b "" "objectclass=*" ldap_init( ad.server.xxx.xxx, 636 ) ldaptool_getcertpath -- . ldaptool_getkeypath -- . ldaptool_getmodpath -- (null) ldaptool_getdonglefilename -- (null) ldap_simple_bind: Can't contact LDAP server SSL error -8179 (Peer's Certificate issuer is not recognized.) OpenLDAP ldapsearch ldapsearch -x -H ldaps://ad-host works On Windows Machine: certutil -L -d . CA certificate CT,C,C Server-Cert Pu,Pu,Pu On FDS server (FC4): # ../shared/bin/certutil -L -d . CA certificate CTu,u,u Server-Cert u,u,u I have no idea what to try next. Please help

2 3

[Fedora-directory-users] Admin server TLS error
by Matthias Saou 07 Jun '06

07 Jun '06

Hi, I'm setting up FDS 1.0.2 on RHEL4 x86_64, and everything was going rather well, until I started trying to use SSL/TLS everywhere. Following the instructions in the Wiki I got the certificates created and installed using the provided script. I can now see the FDS listening on port 636. But I think I also enabled SSL or TLS for the admin server... which now refuses to start. All I see in the admin-serv/logs/error file is this : [Wed Jun 07 13:16:30 2006] [crit] buildUGInfo(): unable to initialize TLS connection to LDAP host ldap.mydomain port 636: 4 [Wed Jun 07 13:16:30 2006] [crit] mod_admserv_post_config(): unable to build user/group LDAP server info: Configuration Failed And I really don't know how to fix this... I think I've really tried everything I could think of already. Setting the LogLevel to debug doesn't give any more useful output. Is there any way I can revert to a plain connection to port 389? I don't really understand the problem in the first place since I've put this in adm.conf but it didn't change the error : ldapHost: ldap.mydomain ldapPort: 389 Matthias -- Clean custom Red Hat Linux rpm packages : http://freshrpms.net/ Fedora Core release 5.89 (Rawhide) - Linux kernel 2.6.16-1.2232_FC6 Load : 1.51 1.39 1.22

3 4

[Fedora-directory-users] window sync certificate and Passsync
by nattapon viroonsri 07 Jun '06

07 Jun '06

RHEL 4.0 redhat-ds-7.1SP1-3 Window 2003 Passync-1.msi from directory.fedora.com /opt/redhat-ds/alias certutil -N -d . certutil -G -d .certutil -S -n "my ca" -s "cn=ice" -x -t "CT,CT,CT" -m 1000 -v 120 -d . certutil -S -n "ice cert" -s "cn=ice.icesolution.com" -c "my ca" -t "u,u,u" -m 1001 -v 120 -d . ln -s cert8.db slap-ice-cert8.db ln -s key3.db slap-ice-key3.db pk12util -d . -o ca.pfx -n "my ca" pk12util -d . -o ice.pfx -n "ice cert" import on Win2003 certutil.exe -d . -N pk12util -d . -i ca.pfx pk12util -d . -i ice.pfx restart "password" sync service test with /opt/redhat-ds/share/bin/ldapsearch DS# ldapsearch -v -Z -D "cn=administrator,cn=users,dc=win2003,dc=icesolution,dc=com" -w 123456 -P /etc/redhat-ds/alias -h <ip_of_ADS> -p 636 -b "cn=users,dc=win2003,dc=icesolution,dc=com" objectClass=* return: -8156 isuer certificate is invalid DS# openssl s_client -connect -showcerts its return different CA certificate that not import from my self sign certificate. its look like default certificate for window2003 passync not not bind nss certificate to ADS' port 636 ? i try to reboot window2003 but still same result and from directory console i try to config sync agreement but it return cannot contact ADS Regards, Nattapon _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

[Fedora-directory-users] PassSync problems (Peer's Certificate issuer is not recognized)
by Jeff Gamsby 06 Jun '06

06 Jun '06

I have followed RHDS Admin guide and Howto:WindowsSync several times, but I keep getting this error: ldapsearch -Z -P . -h ad-host -p 636 -D "cn=administrator,cn=users,dc=xxx,dc=xxx,dc=xxx" -w - -s base -b "" "objectclass=*" -v Enter bind password: ldapsearch: started Tue Jun 6 11:28:46 2006 ldap_init( ad-host, 636 ) ldaptool_getcertpath -- . ldaptool_getkeypath -- . ldaptool_getmodpath -- (null) ldaptool_getdonglefilename -- (null) ldap_simple_bind: Can't contact LDAP server SSL error -8179 (Peer's Certificate issuer is not recognized.) I can search FDS over SSL. I have exported the Server-Cert from FDS and imported it into AD (PassSync). I have changed the trust attributes per the Howto, eventhough the attributes only change to "CT,C,C (CA certificate)" and "Pu,Pu,Pu Server-Cert"

1 0

[Fedora-directory-users] TLS trace: SSL3 alert write:fatal:unknown CA
by Jeff Gamsby 06 Jun '06

06 Jun '06

I am trying to get FDS 1.0.2 working in SSL mode. I am using a OpenSSL CA, I have installed the Server Cert and the CA Cert, can start FDS in SSL mode, but when I run ldapsearch -x -ZZ I get TLS trace: SSL3 alert write:fatal:unknown CA. In /etc/ldap.conf, I have put in TLS_CACERT /path/to/cert TLSREQCERT allow ssl on ssl start_tls If I run openssl s_client -connect localhost:636 -showcerts -state -CAfile /path/to/cacert.pem It looks OK Please help Thanks -- Jeff Gamsby Center for X-Ray Optics Lawrence Berkeley National Laboratory (510) 486-7783

4 28

[Fedora-directory-users] fedora directory server on Windows
by paul barnes 06 Jun '06

06 Jun '06

Hello, I've compiled,installed,run,configured FDS with no pb so far, for a simple applicative schema, on Linux. I wish to do same things on Windows 2003, then to begin with, to compile. I've tried with MKS (see 1 below) but some pbs, I've tried with cygwin (see 2 below) but some pbs as well... I wonder what is the best strategy: going on with MKS, going on with cygwin, What must I check to succeed in compiling FDS on windows ? Or can I find "somewhere" a binary version for windows.... Thank you very much in advance Paul Barnes 1) MKS (gmake), but quite quickly, make fails the following way **************************************************************************** > make [ : ] make: execvp: true: Invalid argument make: *** [pre-everything] Error 127 2) I've tried on cygwin, I do face an other pb : ****************************************************** cd md; make export make[5]: Entering directory `/home/desgranp/fedora/dsbuild-fds102/ds/mozilla/wor k/mozilla/nsprpub/OPT.OBJ/pr/include/md' sh ../../../../build/cygwin-wrapper nsinstall -m 444 ../../../../pr/include/md/_ aix32.cfg ../../../../pr/include/md/_aix64.cfg ../../../../pr/include/md/_beos.c fg ../../../../pr/include/md/_bsdi.cfg ../../../../pr/include/md/_darwin.cfg ../ ../../../pr/include/md/_dgux.cfg ../../../../pr/include/md/_freebsd.cfg ../../.. /../pr/include/md/_hpux32.cfg ../../../../pr/include/md/_hpux64.cfg ../../../../ pr/include/md/_irix32.cfg ../../../../pr/include/md/_irix64.cfg ../../../../pr/i nclude/md/_linux.cfg ../../../../pr/include/md/_ncr.cfg ../../../../pr/include/m d/_nec.cfg ../../../../pr/include/md/_netbsd.cfg ../../../../pr/include/md/_next step.cfg ../../../../pr/include/md/_nto.cfg ../../../../pr/include/md/_openbsd.c fg ../../../../pr/include/md/_openvms.cfg ../../../../pr/include/md/_os2.cfg ../ ../../../pr/include/md/_osf1.cfg ../../../../pr/include/md/_qnx.cfg ../../../../ pr/include/md/_reliantunix.cfg ../../../../pr/include/md/_rhapsody.cfg ../../../ ../pr/include/md/_scoos.cfg ../../../../pr/include/md/_solaris.cfg ../../../../p r/include/md/_sony.cfg ../../../../pr/include/md/_sunos4.cfg ../../../../pr/incl ude/md/_unixware.cfg ../../../../pr/include/md/_unixware7.cfg ../../../../pr/inc lude/md/_win16.cfg ../../../../pr/include/md/_win95.cfg ../../../../pr/include/m d/_winnt.cfg ../../../../pr/include/md/_aix.h ../../../../pr/include/md/_beos.h ../../../../pr/include/md/_bsdi.h ../../../../pr/include/md/_darwin.h ../../../. ./pr/include/md/_dgux.h ../../../../pr/include/md/_freebsd.h ../../../../pr/incl ude/md/_hpux.h ../../../../pr/include/md/_irix.h ../../../../pr/include/md/_linu x.h ../../../../pr/include/md/_macos.h ../../../../pr/include/md/_ncr.h ../../.. /../pr/include/md/_nec.h ../../../../pr/include/md/_netbsd.h ../../../../pr/incl ude/md/_nextstep.h ../../../../pr/include/md/_nspr_pthread.h ../../../../pr/incl ude/md/_nto.h ../../../../pr/include/md/_openbsd.h ../../../../pr/include/md/_op envms.h ../../../../pr/include/md/_os2.h ../../../../pr/include/md/_os2_errors.h ../../../../pr/include/md/_osf1.h ../../../../pr/include/md/_pcos.h ../../../.. /pr/include/md/_pth.h ../../../../pr/include/md/_qnx.h ../../../../pr/include/md /_reliantunix.h ../../../../pr/include/md/_rhapsody.h ../../../../pr/include/md/ _scoos.h ../../../../pr/include/md/_solaris.h ../../../../pr/include/md/_sony.h ../../../../pr/include/md/_sunos4.h ../../../../pr/include/md/_unix_errors.h ../ ../../../pr/include/md/_unixos.h ../../../../pr/include/md/_unixware.h ../../../ ../pr/include/md/_win16.h ../../../../pr/include/md/_win32_errors.h ../../../../ pr/include/md/_win95.h ../../../../pr/include/md/_winnt.h ../../../../pr/include /md/prosdep.h ../../../../pr/include/md/sunos4.h /home/desgranp/fedora/dsbuild-f ds102/ds/mozilla/work/mozilla/dist/OPT.OBJ/include/md ../../../../build/cygwin-wrapper: line 75: exec: nsinstall: not found make[5]: *** [export] Error 127 __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

4 7

[Fedora-directory-users] Windows Sync agreement supplier port
by Jeff Gamsby 06 Jun '06

06 Jun '06

Thanks for everyone's help to get my FDS server running in SSL mode. I have another problem: I'm trying to setup PassSync, and I have got to the point whwre I can run ldapsearch over SSL to talk to AD. I'm trying to setup the sync agreement but cannot change the suppliers port from 389 to 636. Does the admin console need to run in SSL mode in order to do this? If I run the admin console in SSL mode, then will the suppliers port change to 636? The suppliers field cannot be edited. Thanks, Jeff

2 1

[Fedora-directory-users] Extending the New user objectclass
by Paul Clayton 06 Jun '06

06 Jun '06

Hi, When adding a new user, we require additonal objectclasses to be added. We require the Account objectclasses and the account host attribute to be default. Currently we add them manually, but how do you extend this so the objectclass and the required attributes are already there when you create a new user. Regards Paul Clayton Global Unix Co-ordinator Intec Billing 240 Main Rondebosch Cape Town Tel: +27(0)21 6588000 Fax: +27(0)21 6588001 Mobile: +27(0)83 2853403 -------------------------------------------------------- This e-mail and any attachments are confidential and may also be legally privileged and/or copyright material of Intec Telecom Systems PLC (or its affiliated companies). If you are not an intended or authorised recipient of this e-mail or have received it in error, please delete it immediately and notify the sender by e-mail. In such a case, reading, reproducing, printing or further dissemination of this e-mail or its contents is strictly prohibited and may be unlawful. Intec Telecom Systems PLC does not represent or warrant that an attachment hereto is free from computer viruses or other defects. The opinions expressed in this e-mail and any attachments may be those of the author and are not necessarily those of Intec Telecom Systems PLC.

1 0

Re: [Fedora-directory-users] TLS trace: SSL3 alert write:fatal:unknown CA
by Howard Chu 03 Jun '06

03 Jun '06

fedora-directory-users-request(a)redhat.com wrote: > Date: Fri, 02 Jun 2006 17:48:00 -0700 > From: Jeff Gamsby <JFGamsby(a)lbl.gov> > > > Jeff Gamsby > Center for X-Ray Optics > Lawrence Berkeley National Laboratory > (510) 486-7783 > > > Geeze you guys, these messages could seriously use some trimming. >>>>> >>>>>>>>> >>>>>>>>> Richard Megginson wrote: >>>>>>>>> >>>>>>>>>> Jeff Gamsby wrote: >>>>>>>>>> >>>>>>>>>>> I blew away the server and installed a new one, then I used >>>>>>>>>>> the setupssl.sh script to setup SSL. The script completed >>>>>>>>>>> successfully, and the server is listening on port 636, but >>>>>>>>>>> I'm back to a familiar error: >>>>>>>>>>> >>>>>>>>>>> ldapsearch -x -ZZ -d -1 >>>>>>>>>>> Listening on port 636 with SSL means you have an ldaps:// listener. The ldapsearch -Z options are for LDAPv3 StartTLS, which is incompatible with (LDAPv2+) ldaps://. Use either ldaps:// or StartTLS, you cannot use both together. This is already noted in the manpages. >>> >> I'm not sure I understand what's going on either, but the message >> "Peer does not recognize and trust the CA that issued your >> certificate." means that ldapsearch did not verify your LDAP server >> certificate (Server-Cert). This is usually due to one or both of the >> following: >> 1) The value of the cn attribute in the leftmost RDN of the subjectDN >> in the LDAP server cert is not the fqdn of the LDAP server host, or >> the client cannot resolve it. >> 2) The /etc/openldap/cacerts/cacert.asc CA cert is not the cert of the >> CA that issued the LDAP server certificate (Server-Cert) >> No, on the client side this error can only be caused by (2), there is a completely different error message for (1). Also for (1), "client cannot resolve it" is not a consideration; as mandated by RFC2830 the hostname supplied by the user (on the command line) must exactly match the name in the cert CN (or one of the subjectAltNames). No resolution procedures are allowed. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

1 0

[Fedora-directory-users] /etc/init.d startup script issues on reboot
by Joe Sheehan 02 Jun '06

02 Jun '06

We are using the startup script for Fedora as shown below with the corresponding /etc/sysconfig/ns-slapd The problem is during a reboot ns-slapd doesn't start. (the run levels are set to 3,4,5). >From the command line though using this script it starts. In the /var/log/messages for a reboot we see sql_select option missing auxpropfunc error no mechanism available ns-slapd failed For a command line start we see sql_select option missing auxpropfunc error no mechanism available ns-slapd started successfully. Those two errors seem to be consist with a permission problem similar to openldap but we haven't had any luck with that yet BUT is there a way to figure out why during a reboot it doesn't start besides getting a "ns-slapd failed". Thanks (scripts below) Joe # Source function library. . /etc/init.d/functions SLAPD_HOST=`hostname -a` SLAPD_DIR=/opt/fedora-ds/bin/slapd/server PIDFILE=$SLAPD_DIR/logs/pid STARTPIDFILE=$SLAPD_DIR/logs/startpid if [ -f /etc/sysconfig/ns-slapd ]; then . /etc/sysconfig/ns-slapd fi start() { echo -n "Starting Fedora Directory Server: " if [ -f $STARTPIDFILE ]; then PID=`cat $STARTPIDFILE` echo ns-slapd already running: $PID exit 2; elif [ -f $PIDFILE ]; then PID=`cat $PIDFILE` echo ns-slapd already running: $PID exit 2; else echo Here we go... cd $SLAPD_DIR daemon ./ns-slapd $OPTIONS RETVAL=$? echo [ $RETVAL -eq 0 ] && touch /var/lock/subsys/ns-slapd return $RETVAL fi } stop() { echo -n "Shutting down Fedora Directory Server: " echo killproc ns-slapd echo rm -f /var/lock/subsys/ns-slapd return 0 } case "$1" in start) start ;; stop) stop ;; status) status ns-slapd ;; restart) stop start ;; *) echo "Usage: <servicename> {start|stop|status|restart}" exit 1 ;; esac exit $?

2 3

[Fedora-directory-users] Multiple database links (chaining)
by Ben Steeves 01 Jun '06

01 Jun '06

Hi Folks, I'm having a problem that I'm going to go bald trying to solve, it seems... I've been tasked with creating a single searchable suffix for two different trees (dc=one,dc=com and dc=two,dc=com for arguments sake). The application that needs this suffix doesn't deal with referals, so my first (and the obvious, I thought) solution won't work. I delved into the Administrator's Guide and discovered the section on chained suffixes (ie., Directory Links), and it seems good. The problem? I can't make it work right. On a test server, I've set up a "master" suffix, "dc=com", and created directory links to "dc=one,dc=com" and "dc=two,dc=com". I've added the proxy ACI on the One and Two LDAP directories. When I search the test server, I can successfully find objects in the One tree, so it's half working -- but the Two tree doesn't work. I've check and re-checked and everything appears kosher. Am I barking up the wrong tree? Is there an easier way to do this? Should I give up and take up basket weaving as a nice, harmless job, and forget systems administration altogether? Any help or suggestions would be appreciated. -- _ Ben Steeves bcs(a)metacon.ca ( ) The ASCII ribbon campaign ben.steeves(a)unb.ca X against HTML e-mail GPG ID: 0xB3EBF1D9 / \ http://www.metacon.ca/ascii Yahoo Messenger: ben_steeves

2 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users June 2006