389-users September 2006

389-users@lists.fedoraproject.org

42 participants
58 discussions

[Fedora-directory-users] Building daemontools into an RPM
by Eric Brown 15 Sep '06

15 Sep '06

Is there a way to build an RPM for the daemontools package? If not, what commands do I need to run to get it to a point where it can be packaged into an RPM and what directories and files to I need to include in the package? Thanks, Eric

2 1

[Fedora-directory-users] Script after update operation
by Radek Hladik 13 Sep '06

13 Sep '06

Hi all, I would like to execute script after every update operation on specified subtree. I would like to know whether is there any best practice solution. I've found out I can write really simple post-operation plugin but before I start to do that I would like to know whether there is not any better solution I might be overlooking. I need to extract the configuration for ldap non-aware application and recreate it's config file. Radek

4 6

RE: [Fedora-directory-users] Startconsole Directory Server access causes traceback and hangs startconsole
by Kancianic, Jennifer C. 12 Sep '06

12 Sep '06

OK - I turned on debugging for the startconsole with this command: ./startconsole -D 9 > /tmp/console.log 2>&1 Around when the traceback happens, the logfile indicated "Unable to read <my_user_home>/.fedora-console/jars" directory. This directory did not exist in the user's home/.fedora-console directory. I checked a working Fedora DS installation on another machine and saw that there were two jar files that should be in that directory: ds10.jar and ds10_en.jar I created the jar directory by hand and put the two jarfiles in from the installation directory, then everything worked. It looks like there's a possible installation problem. Thanks, Jenny _____ From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Kancianic, Jennifer C. Sent: Sunday, September 10, 2006 1:41 PM To: 'fedora-directory-users(a)redhat.com' Subject: [Fedora-directory-users] Startconsole Directory Server access causes traceback and hangs s tartconsole I've been working on this for a few hours and am now stumped as to what to do next. Any pointers would be great: I installed fedora-ds-1.0.2-1RHEL4.x86_64.opt.rpm on RedHat 2.6.9-34.Elsmp on my Linux server, configured it to run as a non-root user, pointed the ports appropriately and started it up as the non-root user. I can login using JXplorer fine (it's using ldap:\\ method of connecting). I then want to initialize the database with an LDIF from another server, so did a startconsole and logged in as the Directory Manager using the <http://> http:// method of connection. I am able to see the Administration Server and Directory Server listed items, but when I click on the Directory Server to open it, I get this traceback, which hangs the startconsole: Exception in thread "<my_IP>" java.lang.IndexOutOfBoundsException at java.io.BufferedInputStream.read(BufferedInputStream.java:306) at com.netscape.management.client.com.AsyncByteArrayInputStream.write(Unknown Source) at com.netscape.management.client.com.HttpChannel.invoke(Unknown Source) at com.netscape.management.client.com.HttpChannel.run(Unknown Source) at java.lang.thread.run(Thread.java:595) Some other info: ------------------------- 1. When I open the server to see the Administration Server and Directory Server, the icons associated with them were not displayed (only white boxes). 2. In the error.log for the admin-serv, I see this text: Admserv_host_ip_check: ap_get_remote_host could not resolve <my_IP> 3. I saw reports about bug #183925 and configured the admin server as nsAdminAccessAddresses=255.255.255.255 and nsAdminAccessHosts: *, but this didn't help. When I do an nslookup <myIP>, it shows the appropriate hostname for all Ips involved, so reverse DNS seems to work. 4. When I use a web browser to browse to the Directory Server Gateway, images are also not shown there. Any thoughts about what may be causing the traceback or how to fix it? Thanks, Jenny

1 0

[Fedora-directory-users] dsgw : group management
by Mikael Kermorgant 12 Sep '06

12 Sep '06

Hello, I'm using fedora dsgw for group management. I have 2 concerns : 1 - When I view a group, I can only view the uniquemember attribute, which gives me the uid of each member As my students get an uid which looks like a serial number, it's not easy to figure out who is member of the group. 2 - When I add a new member, I have to fill a form with its name and click on "search and add". There are many cases where the search operation returns more than one person. This, coupled with concern n° 1 makes it even more difficult to find out who has been added. Is there something I can do about that ? Thanks in advance, -- Mikael Kermorgant

1 0

[Fedora-directory-users] FDS on RedHat9
by Radek Hladik 12 Sep '06

12 Sep '06

I have one old RH9 box which functions as a backup server. I'm periodically backing up DB from primary FDS to it but it would be also nice to have read-only replica for failover there. But I was not able to compile FDS on it as there were some very strange compile errors when compiling libraries for it. I have some ideas how to get it working and I would like to ask for your opinion: 1) Run complete FDS+FC5 in vmware, but I think running extra kernel and daemons will result in unnecessary overhead. On the other hand this should work and as replication can happen only few times per day there should be no big overhead till failover situation. 2) Run FDS binary for FC5/FC4 and copy all required libraries from FC5/4 and force FDS binary to use them. Or I can copy complete installed FC5+FDS somewhere and chroot into it. This should eliminate overhead in option 1 but the 2.4 kernel could be too old for FC5/4 libraries. I can use some RHEL3 binaries and centos installation but I'm afraid of compatibility of next FDS releases with those old OSes. Do you have any other ideas or is someone running FS on RH9? Radek P.S. I'm stuck with RH9 as there is more important service running on this box which requires RH9.

3 3

Re: [Fedora-directory-users] SASL authentication
by Howard Chu 11 Sep '06

11 Sep '06

> Date: Fri, 08 Sep 2006 09:01:41 -0600 > From: Richard Megginson <rmeggins(a)redhat.com> > Josh Kelley wrote: >> > On 9/7/06, Richard Megginson <rmeggins(a)redhat.com> wrote: >>> >> I checked RFC 4513 - http://www.ietf.org/rfc/rfc4513.txt - it doesn't >>> >> say anything about the correct result code to return in this case, other >>> >> than it is an error if anything other than success or bindinprogress is >>> >> returned. You might want to ask on ldap(a)umich.edu or on >>> >> IRC.freenode.net #ldap if there is a standard that covers this case. >> > >> > Thanks for the suggestion. I'll ask. >> > >> > I skimmed RFC 4513 (sans coffee) and didn't find the section you're >> > referring to. I did see that RFC 4422 (last paragraph of section 3.6) >> > seems to suggest that OS X's and OpenLDAP's behavior is legitimate and >> > useful. Before you go any further with this, please tell us which version of OpenLDAP you're using. Current releases (since 2.3.6) return invalidCredentials for a SASL bind failure: ldapsearch -H ldap://:9000 -Y DIGEST-MD5 SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database Probably we should also do something about not returning the SASL-specific error code in this case too, to adhere more to the intent of rfc4422. Logging it on the server side should be sufficient. I just checked, and releases 2.1 and 2.2 returned error code 80 here. So it seems Apple is relying on a broken behavior. > Yes. But it seems to differ from the behavior of a simple bind (rfc4513 > 5.1.3). In a simple bind, the server resultCode differentiates these cases: > 1) Invalid bind DN results in a noSuchObject (well, not exactly > specified, but this is the usual behavior) > 2) Valid bind DN but invalid password results in invalidCredentials > > However, the rfc (and also rfc 4511 Appendix A LDAP Result Codes) says > that other codes may be substituted for the above "to prevent > unauthorized disclosures (such as substitution of noSuchObject for > insufficientAccessRights, or invalidCredentials for > insufficientAccessRights)." > > The SASL doc (rfc4422) says: > > "It is also important that the server can be configured such that the outcome message will not distinguish between a valid user with invalid credentials and an invalid user." > > > So it seems that SASL wants the server not to differentiate these cases, > probably for security reasons. But this makes sasl binds have different > semantics than simple binds. >> > >> > Even if the standards permit either behavior (and even if it's >> > slightly more secure to not reveal additional information, as David >> > Boreham pointed out), wouldn't it be worth having FDS compatible with >> > OpenLDAP and OS X? > Yes. And please file a bug about this at http://bugzilla.redhat.com/ -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

3 3

[Fedora-directory-users] dsgw and group management (dsgw behind a an apache proxy)
by Mikael Kermorgant 11 Sep '06

11 Sep '06

Hello, I've just successfully set up fedora dsgw behind an apache proxy by using the technique presented here : http://www.daveyp.com/blog/index.php/archives/76/ Now, I face a strange problem : While editing a group to add a member, when I click on "Search and add", Internet explorer does nothing while Firefox behaves like expected. Without this trick with the perl module, it works well on both browsers. Anyone has an idea ? Thanks in advance, -- Mikael Kermorgant

1 1

[Fedora-directory-users] sasl-host in FedoraDS
by Hai Zaar 11 Sep '06

11 Sep '06

In OpenLDAP slapd.conf there were options sasl-host and sasl-realm. Is there anything similar in FedoraDS? My problem is, that on server side, SASL deduces sasl-host improperly: mashine's hostname is bigbox and it runs FDS on directory.example.com. Instead of using sasl-host "directory.example.com" and realm "EXAMPLE.COM", SASL runs gethostname and deduces host and realm from it. In the end, SASL expects for ldap/bigbox.example.com(a)EXAMPLE.COM credential, instead of correct ldap/directory.example.com(a)EXANOKE.COM credential which is supplied by client. -- Zaar

1 0

[Fedora-directory-users] Why does FDS issues gethostbyname('hostname') on startup
by Hai Zaar 11 Sep '06

11 Sep '06

I have server "bigbox", which is also known as directory.example.com. I've installed FDS-1.0.2 to run on directory.example.com. The problem is that when I'm trying to start it, it complains: gethostbyname("bigbox") failed which is true, cause DNS does not known any for bigboxes. It knows only about directory.example.com. My question is - why does slapd care about resolving `hostname`? During installation I explicitly specified to use directory.example.com. -- Zaar

1 0

[Fedora-directory-users] Startconsole Directory Server access causes traceback and hangs s tartconsole
by Kancianic, Jennifer C. 10 Sep '06

10 Sep '06

I've been working on this for a few hours and am now stumped as to what to do next. Any pointers would be great: I installed fedora-ds-1.0.2-1RHEL4.x86_64.opt.rpm on RedHat 2.6.9-34.Elsmp on my Linux server, configured it to run as a non-root user, pointed the ports appropriately and started it up as the non-root user. I can login using JXplorer fine (it's using ldap:\\ method of connecting). I then want to initialize the database with an LDIF from another server, so did a startconsole and logged in as the Directory Manager using the http:// <http://> method of connection. I am able to see the Administration Server and Directory Server listed items, but when I click on the Directory Server to open it, I get this traceback, which hangs the startconsole: Exception in thread "<my_IP>" java.lang.IndexOutOfBoundsException at java.io.BufferedInputStream.read(BufferedInputStream.java:306) at com.netscape.management.client.com.AsyncByteArrayInputStream.write(Unknown Source) at com.netscape.management.client.com.HttpChannel.invoke(Unknown Source) at com.netscape.management.client.com.HttpChannel.run(Unknown Source) at java.lang.thread.run(Thread.java:595) Some other info: ------------------------- 1. When I open the server to see the Administration Server and Directory Server, the icons associated with them were not displayed (only white boxes). 2. In the error.log for the admin-serv, I see this text: Admserv_host_ip_check: ap_get_remote_host could not resolve <my_IP> 3. I saw reports about bug #183925 and configured the admin server as nsAdminAccessAddresses=255.255.255.255 and nsAdminAccessHosts: *, but this didn't help. When I do an nslookup <myIP>, it shows the appropriate hostname for all Ips involved, so reverse DNS seems to work. 4. When I use a web browser to browse to the Directory Server Gateway, images are also not shown there. Any thoughts about what may be causing the traceback or how to fix it? Thanks, Jenny

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users September 2006