389-users June 2006

389-users@lists.fedoraproject.org

51 participants
61 discussions

RE: [Fedora-directory-users] SSL problems/questions for Fedora DS 1.02
by Dellwo, Martin J. [NCSUS] 22 Jun '06

22 Jun '06

Thanks, I'd seen the Howto:SSL but not the other stuff. I'll give it a shot. -- Martin J. Dellwo -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Richard Megginson Sent: Thursday, June 22, 2006 1:09 PM To: General discussion list for the Fedora Directory server project. Subject: Re: [Fedora-directory-users] SSL problems/questions for Fedora DS 1.02 -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

1 0

[Fedora-directory-users] SSL problems/questions for Fedora DS 1.02
by Dellwo, Martin J. [NCSUS] 22 Jun '06

22 Jun '06

Hello, How can one start up Fedora directory (1.02) server instances when one is using SSL? Can it be configured to read the security database password from a file? I believe it may have given me the option initially and I did not take advantage of it, so I am particularly wondering how to set up automatic startup (with no password prompt) after it is already set up to prompt. Right now, I have slapd running with SSL turned on, but could not restart the admin server after turning it on. I was able to edit two admin server configuration files to turn it back off for the admin server, so now I can start it without SSL. Any pointers to detailed documentation for using SSL with admin server? I also now have a new problem where I cannot open the 'Manage Certificates' task for the directory server (slapd) instance itself. In the admin server http logs I get this error [Thu Jun 22 11:56:06 2006] [notice] [client 10.24.224.137] admserv_host_ip_check: ap_get_remote_host could not resolve xxx.xxx.xxx.xxx Even though xxx.xxx.xxx.xxx is the IP address of the local server (both where slapd is running and where I am running the console from). It is properly defined in both the local /etc/hosts and in DNS. At the same time, the console gives a pop-up error, "org.mozilla.ssl.SSLSocketException: SSL_ForceHandshake failed: (-5938) Encountered end of file." Since I think this could be related to an out-of-date certificate CRL, how can one import new CRLs using command line tools? Thanks, Marty -- Martin J. Dellwo NCS Pharma R&D (Exton) NCS, a Johnson & Johnson Company mdellwo(a)ncsus.jnj.com

2 1

[Fedora-directory-users] Group syncing question
by Jeff Gamsby 21 Jun '06

21 Jun '06

OK, next problem. User sync is working great. I'm trying to migrate groups from OpenLDAP to FDS, then sync them to AD. I can do this, but there are a few issues: 1) Groups must live in the ou=people container in order to be synced. a) getent group works, but running "id" as LDAP user does not 2) AD expects the full dn name in the uniqueMember attribute, or it does not add the "uniquemember" a) will that work on the FDS side if I do something like "uniquemember: cn=blah,ou=people,dc=blah..."? a) I get this in the logs "map_dn_values: no local entry found for username" where username is a uniquemember value Is this how it's supposed to work, or am I doing something wrong? Thanks, Jeff

1 0

[Fedora-directory-users] Attempting to elminate authentication failure messages
by Bliss, Aaron 21 Jun '06

21 Jun '06

Hi everyone, I'm using fds for authentication; /etc/nsswitch.conf is configured to first query the ldap server and then local files for user information; I'm not sure why, however for some reason whenever a user attempts to authenticate to the box with a password, the box always reports in /var/log/messages an authentication failure, followed by a success (the success of course if only the user did in fact type their password correctly; in the excerpt below, I did not mistype my password; I would have expected that by configuring /etc/nsswitch.conf to first query the ldap server and then local files would have eliminated the misleading authentication messages...any ideas? Thanks very much Jun 21 11:16:27 ms-lnx-s53 sshd(pam_unix)[16642]: check pass; user unknown Jun 21 11:16:27 ms-lnx-s53 sshd(pam_unix)[16642]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=abliss.preferredcare.org Jun 21 11:16:27 ms-lnx-s53 sshd(pam_unix)[16644]: session opened for user awb by (uid=0) Confidentiality Notice: The information contained in this electronic message is intended for the exclusive use of the individual or entity named above and may contain privileged or confidential information. If the reader of this message is not the intended recipient or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that dissemination, distribution or copying of this information is prohibited. If you have received this communication in error, please notify the sender immediately by telephone and destroy the copies you received.

2 1

[Fedora-directory-users] admin-serv error log
by Jeff Gamsby 20 Jun '06

20 Jun '06

I am having a hard time getting the admin console to work in ssl mode. I get this "notice" error in the admin serv logs, is it a cause for concern? As far as I know, everything is setup correctly. [notice] [client xxx.xxx.xxx.xxx] admserv_host_ip_check: ap_get_remote_host could not resolve xxx.xxx.xxx.xxx I have created the certificates, then copied the slapd-<server>-* files to admin-serv-*, then tried to enable SSL in the admin console. I have followed the directions from "Managing SSL and SASL" but I get the error "Invalid LDAP Host/IP, could not connect to server in secure mode" when I change to secure mode in the "User DS" tab. Any suggestions? Thanks, Jeff

3 12

[Fedora-directory-users] File descriptor problem
by Morris, Patrick 20 Jun '06

20 Jun '06

I may be missing something obvious, but I've got a couple Red Hat EL4 servers running FDS 1.0.2, and I keep getting the dreaded "Not listening for new connections - too many fds open" error. I've looked at all the install and how-to guides, and have the following set up: /etc/security/limits.conf: * soft nofile 104851 * hard nofile 104851 /etc/sysctl.conf: fs.file-max = 131072 /etc/profile: ulimit -n 131072 /etc/pam.d/login: session required /lib/security/pam_limits.so Still, as soon as FDS hits 1024 FDs open, everything blows up. What have I missed? I've also added a "ulimit -n 131072" to the top of the server's init script, but no dice.

2 2

[Fedora-directory-users] RHAS 4.0 Pseries
by nattapon viroonsri 20 Jun '06

20 Jun '06

Compile Problem with RHAS 4.0 Pseries RHAS 4.0 for Pseries Linux# uname -rmpio 2.6.9-5.EL ppc64 ppc64 ppc64 GNU/Linux I have used dsbuil-fds102.tar.gz completely build fedora-ds on FC4.0 . but have many compile problem with this tool on RHAS 4.0 for Pseries. Can i use "dsbuild-fds102.tar.gz" build fedora-ds on RHAS4.0 Pseries ? I have stuck with Adminutil package ==== Building AdminUtil ========== cd lib/libadminutil; gmake NSPR_BASENAME= USE_PTHREADS= SECURITY=domestic MOZILLA_SOURCE_ROOT_EXT= ICU_SOURCE_ROOT_EXT= USE_64= gmake[3]: Entering directory `/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/lib/libadminutil' .../../nsconfig.mk:497: warning: overriding commands for target `/root/dsbuild-fds102/ds/adminutil/work/dist/RHEL4_ppc64_gcc3_DBG.OBJ' .../../nsconfig.mk:497: warning: ignoring old commands for target `/root/dsbuild-fds102/ds/adminutil/work/dist/RHEL4_ppc64_gcc3_DBG.OBJ' .../../nsconfig.mk:580: warning: overriding commands for target `clean' .../../nsconfig.mk:580: warning: ignoring old commands for target `clean' .../../nsconfig.mk:591: warning: overriding commands for target `.depends.RHEL4_ppc64_gcc3_DBG.OBJ' .../../nsconfig.mk:591: warning: ignoring old commands for target `.depends.RHEL4_ppc64_gcc3_DBG.OBJ' .../../nsconfig.mk:594: warning: overriding commands for target `depend' .../../nsconfig.mk:594: warning: ignoring old commands for target `depend' .../../nsconfig.mk:600: warning: overriding commands for target `strip' .../../nsconfig.mk:600: warning: ignoring old commands for target `strip' mkdir -p /root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/built/RHEL4_ppc64_gcc3_DBG.OBJ/lib/libadminutil UNKNOWN_SYSTEM_TYPE -c -DNO_NODELOCK -DXP_UNIX -Dppc64-unknown-linuxoldld -DMCC_DEBUG -DNET_SSL -DSPAPI20 -DBUILD_NUM=\" 2006.171.511\" -DNET_SSL -DSPAPI20 -DBUILD_NUM=\"2006.171.511\" -I/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/include -I/root/ dsbuild-fds102/ds/mozilla/work/mozilla/dist/DBG.OBJ/include -I/root/dsbuild-fds102/ds/mozilla/work/mozilla/dist/public/nss -I/root/dsbuild-fds102/ds/ mozilla/work/mozilla/dist/public/ldap -I/root/dsbuild-fds102/ds/icu/work/icu-3.4/built/include psetc.c -o /root/dsbuild-fds102/ds/adminutil/work/fedora- adminutil-1.0.2/built/RHEL4_ppc64_gcc3_DBG.OBJ/lib/libadminutil/psetc.o gmake[3]: UNKNOWN_SYSTEM_TYPE: Command not found gmake[3]: *** [/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/built/RHEL4_ppc64_gcc3_DBG.OBJ/lib/libadminutil/psetc.o] Error 127 gmake[3]: Leaving directory `/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/lib/libadminutil' make[2]: *** [buildAdminUtil] Error 2 make[2]: Leaving directory `/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2' make[1]: *** [build-work/fedora-adminutil-1.0.2/Makefile] Error 2 make[1]: Leaving directory `/root/dsbuild-fds102/ds/adminutil' make: *** [dep-../../ds/adminutil] Error 2 I check in nsconfig.mk it does not have architech to match with ppc Nattapon, Regards _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

[Fedora-directory-users] Compile Problem with RHAS4 Pseries
by nattapon viroonsri 20 Jun '06

20 Jun '06

RHAS 4.0 for Pseries Linux# uname -rmpio 2.6.9-5.EL ppc64 ppc64 ppc64 GNU/Linux I have used dsbuil-fds102.tar.gz completely build fedora-ds on FC4.0 . but have many compile problem with this tool on RHAS 4.0 for Pseries. Can i use "dsbuild-fds102.tar.gz" build fedora-ds on RHAS4.0 Pseries ? I have stuck with Adminutil package ==== Building AdminUtil ========== cd lib/libadminutil; gmake NSPR_BASENAME= USE_PTHREADS= SECURITY=domestic MOZILLA_SOURCE_ROOT_EXT= ICU_SOURCE_ROOT_EXT= USE_64= gmake[3]: Entering directory `/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/lib/libadminutil' .../../nsconfig.mk:497: warning: overriding commands for target `/root/dsbuild-fds102/ds/adminutil/work/dist/RHEL4_ppc64_gcc3_DBG.OBJ' .../../nsconfig.mk:497: warning: ignoring old commands for target `/root/dsbuild-fds102/ds/adminutil/work/dist/RHEL4_ppc64_gcc3_DBG.OBJ' .../../nsconfig.mk:580: warning: overriding commands for target `clean' .../../nsconfig.mk:580: warning: ignoring old commands for target `clean' .../../nsconfig.mk:591: warning: overriding commands for target `.depends.RHEL4_ppc64_gcc3_DBG.OBJ' .../../nsconfig.mk:591: warning: ignoring old commands for target `.depends.RHEL4_ppc64_gcc3_DBG.OBJ' .../../nsconfig.mk:594: warning: overriding commands for target `depend' .../../nsconfig.mk:594: warning: ignoring old commands for target `depend' .../../nsconfig.mk:600: warning: overriding commands for target `strip' .../../nsconfig.mk:600: warning: ignoring old commands for target `strip' mkdir -p /root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/built/RHEL4_ppc64_gcc3_DBG.OBJ/lib/libadminutil UNKNOWN_SYSTEM_TYPE -c -DNO_NODELOCK -DXP_UNIX -Dppc64-unknown-linuxoldld -DMCC_DEBUG -DNET_SSL -DSPAPI20 -DBUILD_NUM=\" 2006.171.511\" -DNET_SSL -DSPAPI20 -DBUILD_NUM=\"2006.171.511\" -I/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/include -I/root/ dsbuild-fds102/ds/mozilla/work/mozilla/dist/DBG.OBJ/include -I/root/dsbuild-fds102/ds/mozilla/work/mozilla/dist/public/nss -I/root/dsbuild-fds102/ds/ mozilla/work/mozilla/dist/public/ldap -I/root/dsbuild-fds102/ds/icu/work/icu-3.4/built/include psetc.c -o /root/dsbuild-fds102/ds/adminutil/work/fedora- adminutil-1.0.2/built/RHEL4_ppc64_gcc3_DBG.OBJ/lib/libadminutil/psetc.o gmake[3]: UNKNOWN_SYSTEM_TYPE: Command not found gmake[3]: *** [/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/built/RHEL4_ppc64_gcc3_DBG.OBJ/lib/libadminutil/psetc.o] Error 127 gmake[3]: Leaving directory `/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2/lib/libadminutil' make[2]: *** [buildAdminUtil] Error 2 make[2]: Leaving directory `/root/dsbuild-fds102/ds/adminutil/work/fedora-adminutil-1.0.2' make[1]: *** [build-work/fedora-adminutil-1.0.2/Makefile] Error 2 make[1]: Leaving directory `/root/dsbuild-fds102/ds/adminutil' make: *** [dep-../../ds/adminutil] Error 2 I check in nsconfig.mk it does not have architech to match with ppc Nattapon, Regards _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

[Fedora-directory-users] Failed to login from other Linux desktop
by Mohd Amin Sharifuldin B. Salleh 20 Jun '06

20 Jun '06

Hi, We installed fds few times already. The console works but it failed to authenticate from other RedHad Linux. It also failed when when ssh to the ldap server where the user name only registered on FDS. We use mostly microsoft with AD since WinNT times until now. But since last year, we decided to move to linux and than we started experimenting with linux (RedHad Centos and Ubuntu). What we do is 1. Install RH ES ver 4 2. Setting up DNS using webmin 3. Install JAVA than followed by installing FDS 4. Start console, it is all working fine 5. start populating the directory by inputting simple user, password dan the compusary input 6. start testing using Centos to authenticate to FDS after configuring the authentication - login suing user name only available on FDS - failed 7. Than test SSH to FDS on the same machine as FDS - using user only available on FDS - failed - err=49 tag=97 on access log 8. Is it wright what we do to test FDS Counld some one advice us, what we did wrong ? amin

1 0

[Fedora-directory-users] rename an instance, possible ?
by Mikael Kermorgant 19 Jun '06

19 Jun '06

Hello, During my tests of Fedora Directory Server, I've created a server with a temporary name. The instance of FDS herited of that name. Now that I'm going to put it in production, I'd like to give the instance a definitive name. Is it possible to rename the instance ? If not, what would the easiest way to achieve my goal ? (I've tested to clone my test instance but the option is disabled and it seems I'll still need the original test instance). Thanks in advance, -- Mikael Kermorgant

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users June 2006