[Fedora-directory-users] Create client SSL certificates for Solaris boxes.
by James Chavez
Hello,
I am having a bit of difficulty creating SSL client certificates for my
Solaris boxes or client boxes in general.
What I am trying to accomplish is to use TLS with simple authentication
i believe. I want to log into my Solaris boxes authenticating to FDS but
have it done over a secure TLS/SSL connection so the passwords cannot be
intercepted. I successfully created ther root CA certificate and Server
cert on the FDS box using the beautiful setupSSL script.
However I am new to SSL and I am having a difficult time understanding
what needs to be done on the client side machines to get SSL working
correctly. I know I need to import and trust the Root CA certificate on
each client. But what about creating a client certificate for each of my
Linux and Solaris clients? Can the client certificates be created and
exported on the server that I created the Root CA cert on? And from
there can I just import them into the clients? I have read the NSS tools
links regarding PKI and SSL but I am still having a bit of difficulty.
On the FDS wiki documentation site there are some good links but I am
not sure how to go about this to use TLS:simple authentication.
Thank you
James
CONFIDENTIALITY
This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof.
ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity.
15 years, 4 months
[Fedora-directory-users] Ubuntu not enforcing password policies
by John A. Sullivan III
Hello, all. We're continuing to dive ever deeper into DS. Our thanks
to the developers for such a powerful product.
Our integration with the RedHat family has gone well but now we're
working on Ubuntu. Most is working well but we are finding Ubuntu is
not enforcing password policies. For example, we require a user to
change their password after a reset. When a user logs into a RedHat
system, they are prompted for the change. However, Ubuntu just lets
them right in again and again with the same reset password.
Any pointers on what to look for to fix this in our configuration before
we scour the world for a solution? We've already done quite a bit of
googling.
We've tried enabling pam_lookup_policy but that didn't
work. /etc/pam.d/common-password reads:
password requisite pam_cracklib.so retry=3 minlen=8 difok=3
password [success=2 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512
password [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass
# here's the fallback if no module succeeds
password requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password required pam_permit.so
We've also tried disabling that last pam_permit.so. That didn't help. Where should we look? Thanks - John
--
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan(a)opensourcedevel.com
http://www.spiritualoutreach.com
Making Christianity intelligible to secular society
15 years, 4 months
[Fedora-directory-users] Synchrinizing Active Directory and Directory server
by alper kuþkapan
Hi everybody,
I try to synchronize RH Directory Server and MS Directory Server. I applied RHDS 8.0 Administration Guide Chapter 19 step by step but Directory Server can't connect to Active Directory.
I don't know AD, and directory server knowledge is weak.
Have you ever did this? Do you have any hints, documents or knowledge specifif? Where may may mistake be?
Any help will welcome?
Thanks
/Alper
15 years, 4 months
[Fedora-directory-users] DSGW problem - browser user tries to change password
by John A. Sullivan III
Hello, all. As explained in the last email, we do not allow anonymous
browsing but have a specific user with limited rights browsing the tree
to find users' identities for logging into DSGW. We also have a policy
that users must change their passwords after a reset.
We have a test user sue.sutter. We reset her password and then had her
attempt to login to DSGW. Sure enough, she was told she needed to
changed her password and was given the option to do so. However, the
attempt failed with the below error messages:
Editing sue.sutter...
Sending changes to the directory server...
An error occurred while contacting the LDAP server.
(Insufficient access - Insufficient 'write' privilege to the
'userPassword' attribute of entry
'uid=sue.sutter,ou=users,o=a0000-0006,o=internal,dc=ssiservices,dc=biz'. )
You do not have sufficient privileges to perform the operation.
That seemed very strange because when we test changing passwords using
her posix account, it works just fine. We then gave the browsing user
(not sue.sutter) full rights to the tree and, lo and behold, it worked:
Giving the directory browser user all rights allowed a successful
password change.
It appears the browsing user is the one attempting to change the user's
password and not the user. Is that the way it's supposed to be? I
certainly would not want a browse only utility user able to change user
passwords. Perhaps I am missing something. Thanks - John
--
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan(a)opensourcedevel.com
http://www.spiritualoutreach.com
Making Christianity intelligible to secular society
15 years, 4 months
[Fedora-directory-users] Many DSGW authentication problems
by John A. Sullivan III
I'm finding several weird issues with DSGW authentication which make it
very difficult for our users to use. Not to complain - great DS - but
we're experiencing some problems.
We do not allow anonymous browsing of the tree. Each client has a user
who has rights to search only their portion of the tree for possible
DSGW logins. The ACI, place on the root, is thus:
(target =
"ldap:///ou=Users,($dn),o=Internal,dc=ssiservices,dc=biz")(targetattr =
"uid || st || sn || ou || name || entrydn || dn || dc || objectClass ||
cn || o || l || c || givenName") (version 3.0;acl "Client DSGW
Lister";allow (search,read)(userdn =
"ldap:///uid=*dsgwlister,[$dn],o=sysaccounts,dc=ssiservices,dc=biz");)
We have an example test user named sue.sutter. The full dn is
uid=sue.sutter,ou=users,o=a0000-0006,o=internal,dc=ssiservices,dc=biz
The first step is to go the authentication page where we read:
"The first step in authenticating to the directory is identifying
yourself."
This is why we created a user with rights to browse for other users and
defined it with a binddnfile entry. That part is working fine.
If I enter sue.sutter, it does not find her directly but rather offers a
list with a single hyperlinked choice. That's the first problem (a
problem for anyone with a "." in their uid). The query has replaced the
"." with a space:
filter="(&(objectClass=person)(|(sn=sue sutter)(cn=sue sutter)))
I tried surrounding it with quotes and escaping it with a back slash but
the quote was interpreted literally and the back slash gave the same
results as the period alone.
Is this a bug, a configuration error, or just the way it's supposed to
be? If the latter, this is very user unfriendly. A techie might
understand escape characters or special encoding but not an everyday
user.
It wouldn't be so bad if they could simply click on the hyperlink and be
allowed to login. However, the hyperlink does not work. Mousing over
gives:
javascript:authSubmit('uid%3Dsue.sutter%2Cou%3DUsers%2Co%3Da0000-0006%
2Co%3DInternal%2Cdc%3Dssiservices%2Cdc%3Dbiz');%20onMouseOver=
but it goes nowhere. A packet trace shows no packets coming from the
browser to the DS. What might we have configured incorrectly to cause
this? We see the same thing in Konqueror as we see in Firefox3 all
running on fully patched Ubuntu 8.0.4.
Hmmm . . . this is getting long. I'll put the other problem into
another email. Thanks - John
--
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan(a)opensourcedevel.com
http://www.spiritualoutreach.com
Making Christianity intelligible to secular society
15 years, 4 months
[Fedora-directory-users] Passsync fails to update directory
by Jeff Williams
Hello all,
I'm unable to get the windows passsync service to provide password updates to our ds. I can see it start, and it appears to be running. The resulting log looks like this:
12/01/08 07:56:21: PassSync service started
12/01/08 07:56:21: Failed to load entries from file
12/01/08 07:58:39: Failed to load entries from file
12/01/08 07:58:39: PassSync service stopped
12/01/08 07:59:42: PassSync service started
12/01/08 07:59:42: Failed to load entries from file
12/01/08 08:05:42: Failed to load entries from file
12/01/08 08:05:42: PassSync service stopped
12/01/08 08:05:44: PassSync service started
12/01/08 08:05:44: Failed to load entries from file
I've seen a previous thread that pointed at c:\windows\system32\passhook.dat needing correct permissions, so I've confirmed that any service or user has full read/write to write to the this file
Is there something I'm missing?
Thanks,
Jeff Williams
15 years, 4 months
[Fedora-directory-users] adding ssl from the FMC
by McManus, Thomas
I've been trying for the last 2 days to setup SSL on FDS without any luck and little feedback. Following the Redhat Directory Server 8.0 Administration Guide, Chapter 11, I've tried to install a local certificate both through the console and at the command line using certutil.
>From the console going through every step. In step 2 the DN is:
CN="ldap1.chip.org", OU="CHIP", O="Childrens Hospital Boston", L="Boston", ST="Massachusetts", C="US"
In step 3 I get:
Unable to convert DN to certificate name.
Using the certutil these commands worked:
certutil -N -d . -f pwdfile -P slapd-ldap1 certutil -S -n "CA certificate" -s "cn=Childrens Hospital Informatics Program, dc=chip, dc=org" -x -t "CT,," -m 1000 -v 120 -d . -k rsa -g 1024 -f pwdfile -P slapd-ldap1 certutil -S -n "Server-Cert" -s "cn=ldap1.chip.org,cn=DS1" -c "CA certificate" -t "u,u,u" -m 1001 -v 120 -d . -k rsa -g 1024 -f ./pwdfile -P slapd-ldap1 certutil -d . -L -n "CA certificate" -a > cacert.asc -P slapd-ldap1
Using the pk12util failed
pk12util -d . -o ldap1.p12 -n Server-Cert1 -w ./pwdfile.txt -k ./pwdfile.txt The error is: pk12util: find user certs from nickname failed: security library: bad database.
I've run these 2 programs multiple times and googled to no avail. Could anyone help with this?
Tom McManus
System Manager II
Research Computing
Children's Hospital Boston
300 Longfellow Ave., Enders 146.1
Boston MA 02115
Office: 617 919 2308
Mobile: 617 997 2665
15 years, 4 months
[Fedora-directory-users] Re: fedora-idm-console error
by Eric
/root/.fedora-idm-console/Console.1.1.2.Login.preferences is on the system
and is writable. I removed /root/.fedora-idm-console and tried to start
console but there is same error and this directory was made also.
> Message: 3
> Date: Mon, 01 Dec 2008 08:52:48 -0700
> From: Rich Megginson <rmeggins(a)redhat.com>
> Subject: Re: [Fedora-directory-users] fedora-idm-console error
> To: "General discussion list for the Fedora Directory server project."
> <fedora-directory-users(a)redhat.com>
> Message-ID: <49340850.80602(a)redhat.com>
> Content-Type: text/plain; charset="iso-8859-1"
>
> Eric wrote:
> > Hi,
> > fedora-ds is migrated from 1.0.4 to fedora-ds-1.1.2-1.fc6.
> > fedora-idm-console opens console but with error:
> >
> > class loader error : failed to install a local copy of
> > fedora-ds-1.1.jar or one of its supporting files.please ensure that
> > the appropriate console package is installed on the administration
> > server.
> >
> > I did this:
> > rpm -ql fedora-idm-console:
> > /usr/bin/fedora-idm-console
> > /usr/share/doc/fedora-idm-console-1.1.1
> > /usr/share/doc/fedora-idm-console-1.1.1/LICENSE
> > /usr/share/java/fedora-idm-console-1.1.1_en.jar
> > /usr/share/java/fedora-idm-console-1.1_en.jar
> > /usr/share/java/fedora-idm-console_en.jar
> >
> > are there other jars not downloded?
> > when I started console with -D , error is:
> >
> > ClassLoader: getLocalJarList():Unable to read
> > /root/.fedora-idm-console/patch/ directory
> > ClassLoader: start parsing
> > ClassLoader: getLocalJarList():Unable to read
> > /root/.fedora-idm-console/jars/ directory
> Does this directory exist? Is it writable? If it exists and is
> writable, try rm -rf /root/.fedora-idm-console and try again
> > ClassLoader: done
> > ClassLoader: Cannot create LocalJarClassLoader for fedora-ds-1.1.jar
> > ClassLoader: File not found: fedora-ds-1.1.jar
> >
> ClassLoaderUtil.getClass(com.netscape.admin.dirserv.roledit.ResEditorRoleMembers(a)fedora-ds-1.1.jar
> )
> > ClassLoader: Cannot create LocalJarClassLoader for fedora-ds-1.1.jar
> > ClassLoader: File not found: fedora-ds-1.1.jar
> >
> ClassLoaderUtil.getClass(com.netscape.admin.dirserv.roledit.ResEditorRoleAccountPage(a)fedora-ds-1.1.jar
> )
> > ClassLoader: Cannot create LocalJarClassLoader for fedora-ds-1.1.jar
> > ClassLoader: File not found: fedora-ds-1.1.jar
> >
> ClassLoaderUtil.getClass(com.netscape.admin.dirserv.cosedit.ResEditorCosInfo(a)fedora-ds-1.1.jar
> )
> > ClassLoader: Cannot create LocalJarClassLoader for fedora-ds-1.1.jar
> > ClassLoader: File not found: fedora-ds-1.1.jar
> >
> ClassLoaderUtil.getClass(com.netscape.admin.dirserv.cosedit.ResEditorCosAttributes(a)fedora-ds-1.1.jar
> )
> > ClassLoader: Cannot create LocalJarClassLoader for fedora-ds-1.1.jar
> > ClassLoader: File not found: fedora-ds-1.1.jar
> >
> ClassLoaderUtil.getClass(com.netscape.admin.dirserv.cosedit.ResEditorCosTemplate(a)fedora-ds-1.1.jar
> )
> > ClassLoader: Cannot create LocalJarClassLoader for fedora-ds-1.1.jar
> > ClassLoader: File not found: fedora-ds-1.1.jar
> > ..
> > ..
> > AdminGroupNode.findAdminURL: LDAP Error: netscape.ldap.LDAPException:
> > error result (32)
> >
> >
> >
> > ------------------------------------------------------------------------
> >
> > --
> > Fedora-directory-users mailing list
> > Fedora-directory-users(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >
>
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: smime.p7s
> Type: application/x-pkcs7-signature
> Size: 3258 bytes
> Desc: S/MIME Cryptographic Signature
> Url :
> https://www.redhat.com/archives/fedora-directory-users/attachments/200812...
>
> -
15 years, 4 months
