[Fedora-directory-users] error in yum fedora-ds
by Eric
Hi
I tried yum install fedora-ds. all parts installed but at the last:
warning: rpmts_HdrFromFdno: Header V3 DSA signature: NOKEY, key ID 1ac70ce6
Importing GPG key 0x1AC70CE6 "Fedora Project <
fedora-extras(a)fedoraproject.org>"
Is this ok [y/N]: y
warning: rpmts_HdrFromFdno: Header V3 DSA signature: NOKEY, key ID a7b02652
Public key for fedora-ds-1.1.2-1.fc6.i386.rpm is not installed
hwo acn I install it?
15 years, 4 months
[Fedora-directory-users] Re: Windows sync: how do you populate the posixUser attributes?
by Erling Ringen Elvsrud
I have managed to make Windows sync work and have one user synced from AD in
my directory.
The posixUser-attributes are still empty. How do you populate those
attributes in an effective way?
If I have an empty directory, and the users alredy exists in AD I have
been thinking of this manual approach:
1. Perform a full re-sync from AD.
2. Export all the users in directory server in a LDIF-file and with scripts
populate the needed attributes like uid, shell, home, etc.
3. Write the changes back in directory server.
For new users, if not too many, perform the needed changes manually.
What do you think? Is it possible to do this automatically with Windows
Sync or do I have to use approaches like I described?
Thanks,
Erling
15 years, 4 months
[Fedora-directory-users] RE: userPassword
by Dharmin Mandalia
Hello Rich Megginson
Thanks... without "" am able to login.
Regards
Dharmin
Re: [Fedora-directory-users] userPassword
Rich Megginson
Mon, 24 Nov 2008 07:26:56 -0800
Dharmin Mandalia wrote:
>> Hi
>>
>> I used below script to assign password(123.com) to user test1 account
>> which has no password assigned and it does assign the password, when
>> try to login as user test1 with password 123.com, am unable to login.
>> Assigned passwords to few test accounts using below script and same
>> issue unable to login.
>> # ./script test1 123.com
>> ######### START ######################################
>> #!/bin/ksh -x
>> uid=$1 ; password=$2
>> PASSWD=`slappasswd -v -h {SSHA} -s "$password"`
>>
>> ldapmodify -x -D "cn=Directory Manager" -w `cat /tmp/p` <<
>> ALLDONE
>> dn: uid=$uid,ou=People, dc=trust, dc=co, dc=uk
>> changetype: modify
>> add: userpassword
>> userpassword: "$PASSWD"
>> ALLDONE
>> ######### END ####################
>>
>> When I export the database do see the the userPassword entry as :-
>> userPassword: {SSHA}Q7B+QFu2iRXxH8Ys8bfW/i3O0HrjSKfwbZHn4A==
>>
> Have you tried it without the quotes in the here document? I think the
> quotes may be interpreted literally in here documents. e.g.
> userpassword: $PASSWD
>
>> In the script I also tried PASSWD=123.com , still the same , unable to
>> login.
>>
>> Any helpers to why above script assigns the password but unable to
>> login and what should I do so am able to login.
>>
>> Thanks
>>
>> Regards
>> Dharmin
>>
>>
>>
15 years, 5 months
[Fedora-directory-users] FDS silent setup: Could not find user "admin" in the server 'ldap://ldap.testdomain.local:389/o=NetscapeRoot. Error: No such object
by forn
Hello. I'm trying to automate FDS installation. I provide the .inf file
with required parameters to setup-ds-admin.pl script. In particular,
ConfigDirectoryAdminID=admin. Directory server installs fine, but admin
server fails with "Could not find user "admin" in the server
'ldap://ldap.testdomain.local:389/o=NetscapeRoot. Error: No such object"
error. Looking in slapd log, there is no such object, indeed. It just
not getting created. If I use setup-ds-admin scipt manually, all is ok.
I also tried to provide ConfigDirectoryAdminID from command line (found
this method somewhere in CentOS mailing lists). "setup-ds-admin.pl -s -f
fds.inf General.ConfigDirectoryAdminID=admin" results in the very same
error. The system is Fedora 9 i386 and FDS version is 1.1.3, if i if of
any interest.
I'd be grateful for any assistance.
15 years, 5 months
[Fedora-directory-users] userPassword
by Dharmin Mandalia
Hi
I used below script to assign password(123.com) to user test1 account
which has no password assigned and it does assign the password, when
try to login as user test1 with password 123.com, am unable to login.
Assigned passwords to few test accounts using below script and same
issue unable to login.
# ./script test1 123.com
######### START ######################################
#!/bin/ksh -x
uid=$1 ; password=$2
PASSWD=`slappasswd -v -h {SSHA} -s "$password"`
ldapmodify -x -D "cn=Directory Manager" -w `cat /tmp/p` << ALLDONE
dn: uid=$uid,ou=People, dc=trust, dc=co, dc=uk
changetype: modify
add: userpassword
userpassword: "$PASSWD"
ALLDONE
######### END ####################
When I export the database do see the the userPassword entry as :-
userPassword: {SSHA}Q7B+QFu2iRXxH8Ys8bfW/i3O0HrjSKfwbZHn4A==
In the script I also tried PASSWD=123.com , still the same , unable to
login.
Any helpers to why above script assigns the password but unable to login
and what should I do so am able to login.
Thanks
Regards
Dharmin
15 years, 5 months
[Fedora-directory-users] LDAP authentication against SAMBA?
by Seppel
Hi Fedora Directory User Group,
I am Carsten from Cologne, Germany.
I am searching for a solution where i can import all my ActiveDirectory Users to LDAP.
If one of this "Imported" users try to authenticate via LDAP this request should be done against the real AD password.
I don`t want install something on the ActiveDirectory! -> NoPAssSync!
I found a lot of solution where samba is able to authenticate against LDAP. Is there a possibility that LDAP authenticate against SAMBA -> ActiveDirectory.
I found the PassThrough PAM Plugin, would it be possible to combine that with SAMBA PAM?
Thanks for any Input.
Best regards
carsten
--
Sensationsangebot nur bis 30.11: GMX FreeDSL - Telefonanschluss + DSL
für nur 16,37 Euro/mtl.!* http://dsl.gmx.de/?ac=OM.AD.PD003K11308T4569a
15 years, 5 months
[Fedora-directory-users] posixgroup name lookups
by John A. Sullivan III
Hello, all. We're trying to move all our user access control to DS
including file system rights management and thus group management.
We've hit a few problems and would like to share how we've gotten around
them both for documentation and so someone with more experience can tell
us if we are going about this the wrong way.
The first problem we hit was the various hosts could not resolve the
gidnumber to a name:
-sh-3.2$ id -gn
id: cannot find name for group ID 2000
2000
We noticed in the access query that the hosts were looking for
posixgroups:
SRCH base="dc=ssiservices,dc=biz" scope=2
filter="(&(objectClass=posixGroup)(gidNumber=2000))" attrs="cn
userPassword memberUid uniqueMember gidNumber"
The problem comes with user's initial groups which are typically named
after the uid. Since we had not created these explicitly as DS groups
but rather simply assigned the gidnumber in the posixaccount's gidnumber
attribute, there was no posixgroup to seek.
I suppose the ideal way to address this is the change the query to look
for a posixgroup or a posixaccount. I do not see how one does this.
Instead, we added posixgroup as an objectclass to the users. Is this a
reasonable way to go about this?
Then we hit our next problem. The user's initial group is usually the
same as their uid, e.g., user bsmith belongs to group bsmith. However,
the query is looking for cn rather than uid. I suppose this is because
a posixgroup, as opposed to a user, does not have a uid but does have a
cn. This turned up as a problem where we wanted to control the umask in
bashrc which uses logic such as:
if [ $UID -gt 99 ] && [ "`id -gn`" = "`id -un`" ]; then
umask 002
id -un would return bsmith but id -gn would return something like Brian
Smith.
Thus, we will need to make it a user creation procedure to override the
cn to be the same as the uid rather than FirstName LastName. Is this
the correct approach? Thanks - John
--
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan(a)opensourcedevel.com
http://www.spiritualoutreach.com
Making Christianity intelligible to secular society
15 years, 5 months
[Fedora-directory-users] Question about upgrading
by Ryan Manikowski
Long time fedora-ds user here with a few questions about upgrading and
hoping knowledgeable folks can provide some feedback.
I am currently running Fedora DS on Centos 4.7 and Centos 5 servers. All
servers run v1.0.1.
1) Can the Centos 4 machines running v1.0.1 upgrade to the latest v1.1.3
without any problems?
2) Is v1.1.3 even supported on Centos 4? Are there rpm's for it?
3) When upgrading Fedora DS versions, must they all be upgraded
simultaneously?
4) Say one server is running v1.0.1 and another server is running 1.1.3,
can data be replicated from a v1.0.1 server to a v1.1.3 server? How
about vice-a-versa?
3 of our 4 Fedora DS servers can be upgraded to run Centos 5 w/ Fedora
DS v1.1.3 but we'd like to keep one server running Centos 4.7 for the
time being due to legacy software requirements.
--
Ryan Manikowski
System Administrator
2ergo Americas Inc.
:703.677.8499:
www.2ergo.com
Arlington, Virginia
This message (including attachments) is confidential and may be legally privileged. The content and views expressed are those of the sender and not necessarily the 2ergo Group. If you are not the intended recipient, you must not disclose, copy or use any part of it. Please delete all copies immediately and notify the sender. 2ergo Americas Inc. was formerly known as Proteus Inc.
15 years, 5 months
[Fedora-directory-users] Dynamic groups not supplying posixgroup membership
by John A. Sullivan III
Hello, all. We have a multi-tenant set up where each client has a group
which contains all their internal users. We thought we would save time
by creating a dynamic group using a filter such as:
ldap:///ou=internal,ou=users,dc=X,dc=com,dc=ssiservices,
dc=biz??sub?(&(objectclass=person)(uid=*))
This appears to work and adequately populates the group. However, when
the user logs in to a Linux system, the Linux system queries for group
membership. We are noticing that we do not get any results when using
dynamic groups. If we make the same group managed, we see the group
membership. Notice these two records from the access log (truncated
because of screen scraping):
filter="(&(objectClass=posixGroup)(|(memberUid=te.kee)(uniqueMember=uid=te.kee,ou=internal,ou=Users,dc=ebc-co,dc=com,dc=ssiservices,dc=
RESULT err=0 tag=101 nentries=1 etime=0
N.B. we have an entry. This used managed groups.
When we change to dynamic groups, we see this:
filter="(&(objectClass=posixGroup)(|(memberUid=te.kee)(uniqueMember=uid=te.kee,ou=internal,ou=Users,dc=ebc-co,dc=com,dc=ssiservices,dc
RESULT err=0 tag=101 nentries=0 etime=0
N.B. no entries!
Have we done something wrong? Is this a bug or is it the way it is
supposed to work? Thanks - John
--
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan(a)opensourcedevel.com
http://www.spiritualoutreach.com
Making Christianity intelligible to secular society
15 years, 5 months
[Fedora-directory-users] synchronize fedora with Lotus Domino and MS Active directory
by Hugo Hendriks
Hi,
I have a brief question. I'm not really experienced in the whole LDAP
field but I was trying to figure out if the following setup is possible.
I have 2 different directory servers...a Lotus Notes/Domino server and a
Active Directory server. Can we use Fedora as a central LDAP server and
is it possible to easily synchronize/replicate the Fedora server with
the Notes and AD server? I tried to find some documentation about this
but only found http://directory.fedoraproject.org/wiki/Howto:WindowsSync
so I guess synchronization with AD is covered but is this also possible
with Notes?
It also seems quite technical....are there perhaps certain tools which
makes this more easy for you?
Much thanks is advance!
Best Regards,
Hugo
15 years, 5 months
