July 2007 - 389-users - Fedora Mailing-Lists

[Fedora-directory-users] Using certs from MS CA server

by J Davis

Hello, I have FDS 1.0.4 running using an SSL certificate generated by an Microsoft windows 2003 CA server. I choose this method as opposed to the setupssl.sh script from the wiki because I have read in the list archives that it is the best way to avoid trust issues when setting up PassSync over SSL between FDS and AD. I'm having a hard time finding references for configuring this properly and I know very little about SSL certificates so I'm making some guesses and likely missing a crucial step or two. The problem is that when trying to bind to the FDS using SSL I get certificate verification errors. > # ldapsearch -x -H ldaps://localhost/ > ldap_bind: Can't contact LDAP server (-1) > additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Here's how I set up the certificates... 1. Generated a CSR using the FDS console wizard and submitted it to the MS CA. 2. Imported the CA certificate (called "it") and the signed "server-cert" resulting from step 1 from the MS CA using the FDS admin console. 3. Enabled SSL (port 636) in the directory server using server-cert from step 1. I used certutil to display the list of certificates in the FDS cert db. > [alias]# ../shared/bin/certutil -L -d . -P slapd-<instance>- > server-cert u,u,u > it CT,, Then verified that "server-cert" was considered valid. > [alias]# ../shared/bin/certutil -V -n server-cert -e -u V -d . -P slapd-<instance>- > Enter Password or Pin for "NSS Certificate DB": > certutil-bin: certificate is valid I also verified that that I can connect using openssl client. > # openssl s_client -connect localhost:636 -showcerts -CAfile /path/to/it_ca.crt --snip-- > Verify return code: 0 (ok) > --- Any hints as to what I might be doing wrong are greatly appreciated. Thanks, -Jake

16 years, 9 months

4
7
0 / 0

[Fedora-directory-users] last login

by Maurizio Marini

is avalable the last login (last bind, successuful?) info? if yes, which is its name? Maurizio

16 years, 9 months

3
3
0 / 0

[Fedora-directory-users] What is syncronized?

by Dennis Crissman

The name PassSync would indicate that this utility synchronizes passwords, can anything else be sync'd? I need to be able to sync all of the following: users, groups, systems, email addresses, and passwords, etc. Can PassSync do all that? If not is there another utility you might recommend, either using FDS or not? -- The sender of this email subscribes to Perimeter Internetworking's email anti-virus service. This email has been scanned for malicious code and is believed to be virus free. For more information on email security please visit: http://www.perimeterusa.com/email-defense-content.html This communication is confidential, intended only for the named recipient(s) above and may contain trade secrets or other information that is exempt from disclosure under applicable law. Any use, dissemination, distribution or copying of this communication by anyone other than the named recipient(s) is strictly prohibited. If you have received this communication in error, please delete the email and immediately notify our Command Center at 203-541-3444.

16 years, 9 months

2
5
0 / 0

[Fedora-directory-users] disallow_pw_change_aci problem

by Omer Faruk Sen

Hi, I have installed fedora-ds 1.0.4 to Fedora 6 server. I am trying to install mail ldap cluster. I have added a domain like dc=my,dc=domain,dc=com and added a virtual domain like ou=virtdomain.com,dc=my,dc=domain,dc=com after adding a user like: uid=user,ou=virtdomain.com,dc=my,dc=domain,dc=com and changing its password gives me that error: aci: (targetattr = "userPassword") ( version 3.0; acl "disallow_pw_change_aci"; deny (write ) userdn = "ldap:///self";) I have read http://www.redhat.com/docs/manuals/dir-server/ag/7.1/acl.html and added an aci like: aci: (targetattr="userPassword || homePhone || homePostalAddress") (version 3.0; acl "Write my.domain.com"; allow (write) userdn= "ldap:///self";) for ou=virtdomain.com,dc=my,dc=domain,dc=com But I still get aci: (targetattr = "userPassword") ( version 3.0; acl "disallow_pw_change_aci"; deny (write ) userdn = "ldap:///self";) error. How can I disable disallow_pw_change aci since I couldn't find this aci anywhere using directory admin gui. By the way I think this comes from userRoot database. But I can't find a place to disable disallow_pw_change Best Regards, ____________________________________________________________________________________ Get the free Yahoo! toolbar and rest assured with the added security of spyware protection. http://new.toolbar.yahoo.com/toolbar/features/norton/index.php

16 years, 9 months

2
1
0 / 0

RE: [Fedora-directory-users] UNCLASSIFIED - Linux ClientConfigurations & LDAP Failover

by HAWKER, Dan 2 (external)

> > We had the same issue. It seems like nss_ldap fails over > after a reasonable timeout, but applications like autofs will > take much longer. Also, if you have two servers and all of > your clients are configured to talk to them in the same order > (if server1 is down use server2), then server2 would be idle > until server1 is down. > > We use Piranha to get around this. This way we can count on > both servers being equally utilized and clients fail over > seamlessly (so seamless they don't even realize they've failed over). > > I don't know if this is the "prescribed" way of handling it, > but it works well for us. > Hi Steve, Thanks for the info and pointer. I'll do some digging and also have a look at Piranha. Thanks again Dan -- Dan Hawker Linux System Administrator PMS x5602 -- This email (including any attachments) may contain confidential and/or privileged information or information otherwise protected from disclosure. If you are not the intended recipient, please notify the sender immediately, do not copy this message or any attachments and do not use it for any purpose or disclose its content to any person, but delete this message and any attachments from your system. Astrium disclaims any and all liability if this email transmission was virus corrupted, altered or falsified. --------------------------------------------------------------------- Astrium Limited, Registered in England and Wales No. 2449259 Registered Office: Gunnels Wood Road, Stevenage, Hertfordshire, SG1 2AS, England

16 years, 9 months

1
0
0 / 0

[Fedora-directory-users] No X

by Vampire D

Is there anything you cannot do with FDS when using the HTTP Control Panel rather than using the X Windows Java Control Panel? Is it highly recommended to use the X Windows Java Control Panel in production? -- "Do the actors on Unsolved Mysteries ever get arrested because they look just like the criminal they are playing?" Christopher

16 years, 9 months

3
4
0 / 0

[Fedora-directory-users] disallow_pw_change_aci

by Omer Faruk Sen

Hi, I have a problem with this aci. I have a dn like ou=x.com,dc=my,dc=domain,dc=com. I added aci to my dc=my,dc=domain,dc=com as depicted in: http://www.redhat.com/docs/manuals/dir-server/ag/7.1/acl.html I add following aci: (targetattr="userPassword || homePhone || homePostalAddress") (version 3.0; acl "Write my.domain.com"; allow (write) userdn= "ldap:///self";) restart fedora-ds but when i try to change password with uid=user,oid=x.com,dc=my,dc=domain,dc=com i get following error: aci: (targetattr = "userPassword") ( version 3.0; acl "disallow_pw_change_aci"; deny (write ) userdn = "ldap:///self";) My question is how can I disable disallow_pw_change_aci. I couldn't find that aci anywhere? By the way as far as I understood child entries inherits parent acis am I right? Because if not there is no explanation to that error Best Regards, -- Omer Faruk Sen http://www.faruk.net

16 years, 9 months

1
0
0 / 0

[Fedora-directory-users] UNCLASSIFIED - Linux Client Configurations & LDAP Failover

by HAWKER, Dan 2 (external)

Hi All, First off, apologies for the tagline. Work has gone mad ensuring we tag all outgoing emails with appropriate classifications. Very irritating :( Anyway... Not sure if this is strictly OT, however I'm having some trouble configuring my Linux clients to failover to secondary FDS boxes quickly enough. By that I mean, it all works (ppl can login, get home dirs, etc) however, despite adding a second FDS server to the clients ldap.conf file, and fiddling with the bind_timelimit and other settings (with no real change), if the first FDS box in the list fails for whatever reason, (panic, scheduled downtime, upgrades, etc) it takes the client(s) some time to failover to using the second LDAP box. During this time general access and logins slow to a crawl until the primary is back up again. My FDS boxes are FC5 with FDS 1.0.2 and my clients are all RHEL4/5 and FC4-7 boxes. BIND is also running on these two FDS boxes, however that fails over as expected. Has anyone some *best practice* guidelines/docs they can point me towards or some personal experiences/anecdotes so I can hopefully configure my clients such that a failure in a FDS box is almost un-noticeable by my clients boxes. TIA Dan -- Dan Hawker Linux System Administrator PMS x5602 -- This email (including any attachments) may contain confidential and/or privileged information or information otherwise protected from disclosure. If you are not the intended recipient, please notify the sender immediately, do not copy this message or any attachments and do not use it for any purpose or disclose its content to any person, but delete this message and any attachments from your system. Astrium disclaims any and all liability if this email transmission was virus corrupted, altered or falsified. --------------------------------------------------------------------- Astrium Limited, Registered in England and Wales No. 2449259 Registered Office: Gunnels Wood Road, Stevenage, Hertfordshire, SG1 2AS, England

16 years, 9 months

2
1
0 / 0

[Fedora-directory-users] http://directory.fedoraproject.org/

by Vampire D

Can anyone access http://directory.fedoraproject.org/ right now? It has been down for a while now. -- "Do the actors on Unsolved Mysteries ever get arrested because they look just like the criminal they are playing?" Christopher

16 years, 9 months

2
1
0 / 0

[Fedora-directory-users] FDS with samba

by surendhar surya

When I try to add windows client machine in FDS DOMAIN. I get error Unknown username and password. I have created a Administrator account in FDS with samba server. Now what i have todo add machine in COMPUTERS. Thanks and Regard Surendhar P Chennai --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

16 years, 9 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users July 2007