[Fedora-directory-users] password policy help
by Aaron Mills
Hi all,
I¹m looking for some direction with regard to implementing password policy
in unix authentication. I followed the ppolicy instructions here:
http://directory.fedoraproject.org/wiki/Howto:PAM
In the UI, I¹ve enabled password policy in the database, then on the
relevant subtree. I¹ve enabled password aging, history, and alphanumeric
standards. But it looks like Fedora DS is still letting me change my
password to anything, and doesn¹t maintain a history. Clearly I¹m missing
something. I¹ve checked out google and some of the list history to no avail.
Is there another doc I should take a look at, or has anyone run into this?
Thanks,
-Aaron
--
Aaron Mills
Systems Administrator
Return Path
http://www.returnpath.net
15 years, 1 month
[Fedora-directory-users] fdstools.pm - perl module for managing replication and encryption setup
by Ryan Braun [ADS]
Hey guys, I had been working on several scripts for fds to configure and
monitor replication and encryption across several servers. Well I decided to
move the guts of those scripts into a perl module called fdstools.
What started as a NET::ldap/perl learning experience, evolved into this
module. It's not near feature complete, but does work for setting up
replication and configuring and enabling TLS/SSL on fds. And it's my first
attempt at a perl module, so take it easy on me :)
The TLS/SSL setup is just basically a glorified wrapper for certutil and
pk12util, perl-ified. The replication setup is all done using ldap calls to
the appropriate servers.
There are 3 config files (2 that you need to edit). Default locations for all
3 are /etc/fdstools/
fdstools.conf - system wide defaults, file locations etc.
repman.conf - root DN specifics options for replication
serial - file to keep track of certs handed out, serial numbers on certs
etc. (generally don't touch this file, you could break the serial number
sequence when creating certs)
Just put the fdstools.pm module and the 2 helper scripts (repman.pl and
setup_ssl) in the same directory.
You can do a perldoc fdstools from the same directory as the module to get
some rudimentary docs. I like to think I'm comment heavy, so have a look at
the code aswell for any details. My perldoc-fu is lacking.
There are alot of options for the setup_ssl, so try running with -h to get
help and -e for a list of examples.
Hopefully it doesn't break any systems, but if it does make sure you have
backups of your security databases and directory server aswell as dse.ldif.
I used it to create a 2 server mmr setup with UserRoot and NetscapeRoot being
replicated over SSL. If you want to replicate NetscapeRoot, you need to
create the root suffex on the target server first. I've included an ldif to
help with that. so just run
ldapadd -x -h TARGETSERVER -D "cn=directory manager" -W -f ldif/ns.ldif
Then run the repman.pl script but tell it to use an alternate config like so.
my $blah = fdstools->new( prompt_bindpw => "1", config =>
/etc/fdstools/repman-ns.conf" );
Remember, if you are replicating NetscapeRoot, you need to install the
second server using setup-ds.pl FIRST, then setup the replication agreements
(and encryption if you want the agreement to be encrypted), initialize them,
then run register-ds-admin.pl.
Any questions/comments/complaints please let me know.
md5sum fdstools.tar.bz2
39b18c773578d58ac75be65c3efaca48 fdstools.tar.bz2
Ryan Braun
Informatics Operations
Aviation and Defence Services Division
Chief Information Officer Branch, Environment Canada
CIV: (204) 833-2500x2625 CSN: 257-2625 FAX: (204) 833-2524
E-Mail: Ryan.Braun(a)ec.gc.ca
15 years, 1 month
[Fedora-directory-users] OpenLDAP->FDS Migration
by Thorsten Scherf
Wondering if somebody recently did a migration from OpenLDAP to FDS and
is willing to share experiences.
Happy Day.
Thorsten
--
"Eternity is a very long time, especially towards the end."
— Stephen Hawking
15 years, 1 month
[Fedora-directory-users] Re:unique uid problem
by Eric
there is a radius server uses fedora-ds for authenticating. all users
name are in fedora_ds. One attribute of users is uid, which I want to be
unique.
essage: 1
> Date: Sun, 22 Feb 2009 21:08:56 -0500
> From: "John A. Sullivan III" <jsullivan(a)opensourcedevel.com>
> Subject: Re: [Fedora-directory-users] unique uid problem
> To: "General discussion list for the Fedora Directory server project."
> <fedora-directory-users(a)redhat.com>
> Message-ID:
> <1235354936.6456.2.camel(a)jaspav.missionsit.net.missionsit.net>
> Content-Type: text/plain
>
> On Sun, 2009-02-22 at 12:18 +0330, Eric wrote:
> > Hi,
> > when I want to make a new user in fedora-ds using console, can't set
> > the value that exists before for uid but when using command line for
> > ldapadd,it adds replicated uid valiue. how should I set the command
> > to check all the directory server for not adding replicated valiue for
> > uid?
> <snip>
> I'm not sure I understand the question. Is the unique attribute plugin
> what you are looking for? - John
> --
> John A. Sullivan III
> Open Source Development Corporation
>
> Street Preacher: Are you SAVED?????!!!!!!
> Educated Skeptic: Saved from WHAT?????!!!!!!
> Educated Believer: From our selfishness that hurts the ones we love
> and condemns us to an eternity of hurting each other.
> http://www.spiritualoutreach.com
> Christianity that makes sense
>
>
>
> ------------------------------
>
> Message: 2
> Date: Mon, 23 Feb 2009 12:08:01 +0100
> From: Roberto Polli <rpolli(a)babel.it>
> Subject: Re: [Fedora-directory-users] unique uid problem
> To: "General discussion list for the Fedora Directory server project."
> <fedora-directory-users(a)redhat.com>
> Message-ID: <200902231208.01500.rpolli(a)babel.it>
> Content-Type: text/plain; charset="iso-8859-15"
>
> On Monday 23 February 2009 03:08:56 John A. Sullivan III wrote:
> > > when I want to make a new user in fedora-ds using console, can't set
> > > the value that exists before for uid but when using command line for
> > > ldapadd,it adds replicated uid valiue.
> which uid?
> nsUniqueId or EntryUUID
>
> Peace, R.
> --
>
>
15 years, 1 month
[Fedora-directory-users] FDS ldapi autobind problem
by Ivanov Andrey (M.)
Hi,
When i'm trying to connect to FDS (built from today's cvs) by ldapi as a
root (on RHEL5.2) i have the following error message :
ldapsearch -Y EXTERNAL -H
ldapi://%2fLocal%2fdirsrv%2fvar%2frun%2fslapd-dmz.socket -b
"dc=id,dc=polytechnique,dc=edu" uid=toto
SASL/EXTERNAL authentication started
ldap_sasl_interactive_bind_s: Inappropriate authentication (48)
additional info: SASL EXTERNAL bind requires an SSL connection
the access log :
[23/Feb/2009:15:22:38 +0100] conn=1 fd=128 slot=128 connection from
localhost to localhost
[23/Feb/2009:15:22:38 +0100] conn=1 op=0 BIND dn="" method=sasl version=3
mech=EXTERNAL
[23/Feb/2009:15:22:38 +0100] conn=1 op=0 RESULT err=48 tag=97 nentries=0
etime=0.003000
[23/Feb/2009:15:22:38 +0100] conn=1 op=-1 fd=128 closed - B1
the dse.ldif lines:
nsslapd-ldapifilepath: /Local/dirsrv/var/run/slapd-dmz.socket
nsslapd-ldapilisten: on
nsslapd-ldapiautobind: on
nsslapd-ldapimaprootdn: cn=Directory Manager
Simple bind is ok (ldapsearch -x -H
ldapi://%2fLocal%2fdirsrv%2fvar%2frun%2fslapd-dmz.socket -b
"dc=id,dc=polytechnique,dc=edu" uid=toto)
access log :
[23/Feb/2009:15:26:11 +0100] conn=3 fd=128 slot=128 connection from
localhost to localhost
[23/Feb/2009:15:26:12 +0100] conn=3 op=0 BIND dn="" method=128 version=3
[23/Feb/2009:15:26:12 +0100] conn=3 op=0 RESULT err=0 tag=97 nentries=0
etime=0.001000 dn=""
[23/Feb/2009:15:26:12 +0100] conn=3 op=1 SRCH
base="dc=id,dc=polytechnique,dc=edu" scope=2 filter="(uid=toto)" attrs=ALL
[23/Feb/2009:15:26:12 +0100] conn=3 op=1 RESULT err=0 tag=101 nentries=1
etime=0.003000
[23/Feb/2009:15:26:12 +0100] conn=3 op=2 UNBIND
[23/Feb/2009:15:26:12 +0100] conn=3 op=2 fd=128 closed - U1
What am i doing wrong in the first case (with EXTERNAL mechanism)? :)
Thank you!
15 years, 1 month
[Fedora-directory-users] unique uid problem
by Eric
Hi,
when I want to make a new user in fedora-ds using console, can't set the
value that exists before for uid but when using command line for ldapadd,it
adds replicated uid valiue. how should I set the command to check all the
directory server for not adding replicated valiue for uid?
15 years, 1 month
[Fedora-directory-users] schema replication
by Jan-Frode Myklebust
We just had a bit of a scary situation.. We have two multimaster
replicating directory servers (server1 and server2), with a few
schema modifications residing in 99user.ldif.
dc=example, dc=com:
server1 <---> server2
Then we wanted to make these two directory servers be consumers
of another directory on server3, which has another set of schema
modifications in 99user.ldif. The result was that server1 and server2
dropped all their modifications to 99user.ldif, and started using a
99.ldif identical to server3. Resulting in lots of problems with
unknown object classes in their original directory tree..
o=ISP, o=example, c=NO
server3 (single master)
/ \
server1 server2 (consumers)
Which makes me wonder what the correct way of handling local
schema modifications are. Should we be creating our own 99my_classes.ldif,
instead of storing them in 99user.ldif ?
-jf
15 years, 2 months
[Fedora-directory-users] Installing 2 MMR servers, and the aci's don't match after everything is setup
by Ryan Braun [ADS]
Hey guys, I'm setting up 2 mmr servers, and am wondering why the aci's on both machines don't end up being the same. All of the replication and configuring of the servers
has been done in perl and NOT the console. Here is the process I used when setting up the servers. I'm using custom built packages on etch.
ii fedora-ds-admin 1.1.6 Fedora Administration Server (admin)
ii fedora-ds-admin-console 1.1.2 Fedora Admin Server Management Console
ii fedora-ds-base 1.1.3 Fedora Directory Server (base)
ii fedora-ds-console 1.1.2 Fedora Directory Server Management Console
ii mozldap 6.0.5 Mozilla LDAP C SDK
ii mozldap-dev 6.0.5 Mozilla LDAP C SDK
ii mozldap-tools 6.0.5 Mozilla LDAP C SDK
ii ldapsdk 4.17-4 Enables applications to manage information s
ii perldap 1.5.2 PerLDAP is a set of modules written in Perl
ii libadminutil 1.1.7 Utility library for directory server adminis
ii libsvrcore 4.0.4 Secure PIN handling using NSS crypto
ii libapache2-mod-nss 1.0.8 mod_nss is an SSL provider derived from the
1. install mmr1 server using setup-ds-admin.pl
2. install mmr2 server using setup-ds.pl
3. configure ssl/tls on each machine and confirm ldapsearchs etc are encrypted.
4. create root suffix o=netscaperoot on mmr2.
5. enable mmr replication of userroot on both mmr1 and mmr2
6. init UserRoot replication agreement on mmr1.
7. enable mmr replication of o=netscaperoot on both mmr1 and mmr2.
8. init NetscapeRoot replication agreement on mmr1.
9. run register-ds-admin.pl on mmr2
At this point, I can confirm that encryption is working over both machines, all replication agreements are over SSL and are working as expected. admin server is running on
both machines, and both servers are accessible from each admin-server instance.
So I opened up the console, and opened up a session to each server and thats when I noticed the different amount of aci's on each server
on mmr1. o=NetscapeRoot has 5 acis'
UserRoot has 6
cn=schema has 4
cn=monitor has 1
cn=config has 3
on mmr2. o=NetscapeRoot has 5 acis'
UserRoot has 6
cn=schema has 1
cn=monitor has 1
cn=config has 0
So I'm wondering, if mmr2 server is missing those aci's because of the different install procedure of running setup-ds.pl first, then register-ds-admin.pl
Here are the aci's in question
mmr1 - cn=schema
# schema
dn: cn=schema
aci: (target="ldap:///cn=schema")(targetattr !="aci")(version 3.0;acl "anonymo
us, no acis"; allow (read, search, compare) userdn = "ldap:///anyone";)
aci: (targetattr="*")(version 3.0; acl "Configuration Administrators Group"; a
llow (all) groupdn="ldap:///cn=Configuration Administrators, ou=Groups, ou=To
pologyManagement, o=NetscapeRoot";)
aci: (targetattr="*")(version 3.0; acl "Configuration Administrator"; allow (a
ll) userdn="ldap:///uid=admin,ou=Administrators, ou=TopologyManagement, o=Net
scapeRoot";)
aci: (targetattr = "*")(version 3.0; acl "SIE Group"; allow (all) groupdn = "l
dap:///cn=slapd-xxxdmns0, cn=Fedora Directory Server, cn=Server Group, cn=xxx
dmns0.xxx.xx.xx.xx, ou=xxx.xx.xx.ca, o=NetscapeRoot";)
mmr2 - cn=schema
# schema
dn: cn=schema
aci: (target="ldap:///cn=schema")(targetattr !="aci")(version 3.0;acl "anonymo
us, no acis"; allow (read, search, compare) userdn = "ldap:///anyone";)
mmr1 - cn=config
dn: cn=config
aci: (targetattr="*")(version 3.0; acl "Configuration Administrators Group"; a
llow (all) groupdn="ldap:///cn=Configuration Administrators, ou=Groups, ou=To
pologyManagement, o=NetscapeRoot";)
aci: (targetattr="*")(version 3.0; acl "Configuration Administrator"; allow (a
ll) userdn="ldap:///uid=admin, ou=Administrators, ou=TopologyManagement, o=Ne
tscapeRoot";)
aci: (targetattr = "*")(version 3.0; acl "SIE Group"; allow (all) groupdn = "l
dap:///cn=slapd-xxxdmns0, cn=Fedora Directory Server, cn=Server Group, cn=xxx
dmns0.xxx.xx.xx.ca, ou=xxx.xx.xx.ca, o=NetscapeRoot";)
mmr2 - cn=config
none.
15 years, 2 months
[Fedora-directory-users] Problems with multimaster replication configuration
by Rocio Quirantes
Hello, I'm trying to configure multimaster replication with two servers, and I get a permission error when the supplier tries to send the copie to the consumer. This is the error I get:
supplier: ldap1 -> NSMMReplicationPlugin - agmt="cn=ldap1" (ldap2:636):
Unable to acquire replica: permission denied. The bind dn
"cn=replication manager,cn=config" does not have permission to supply
replication updates to the replica. Will retry later.
consumer: ldap2 -> NSMMReplicationPlugin - conn=245 op=3
replica="dc=example,dc=es": Unable to acquire replica: error: permission
denied
The other wa:
supplier: ldap2 -> NSMMReplicationPlugin - agmt="cn=ldap2" (ldap1:636):
Unable to acquire replica: permission denied. The bind dn
"cn=replication manager,cn=config" does not have permission to supply
replication updates to the replica. Will retry later.
consumer: ldap1 -> NSMMReplicationPlugin - conn=32 op=3
replica="dc=example,dc=es": Unable to acquire replica: error: permission
denied
I have follow the configuration manual from red hat to configure the multimaster from:
http://www.redhat.com/docs/manuals/dir-server/ag/replicat.htm#74262
This is my configuration:
dn: cn=replication manager,cn=config
objectClass: person
objectClass: top
cn: replication manager
sn: RM
userPassword: {SSHA} XXX
passwordExpirationTime: 20380119031407Z
modifiersName:
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoo
t
modifyTimestamp: 20090217141706Z
dn: cn=legacy consumer,cn=replication,cn=config
objectClass: top
objectClass: extensibleObject
cn: legacy consumer
nsslapd-legacy-updatedn: cn=replication manager,cn=config
creatorsName:
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot
modifiersName:
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoo
t
createTimestamp: 20090216083802Z
modifyTimestamp: 20090216100926Z
nsslapd-legacy-updatepw: {SHA} xxx
dn: cn=replica,cn="dc=example,dc=es",cn=mapping tree, cn=config
objectClass: nsDS5Replica
objectClass: top
nsDS5ReplicaRoot: dc=example,dc=es
nsDS5ReplicaType: 3
nsDS5Flags: 1
nsDS5ReplicaId: 1
nsds5ReplicaPurgeDelay: 604800
cn: replica
creatorsName:
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot
modifiersName: cn=Multimaster Replication Plugin,cn=plugins,cn=config
createTimestamp: 20090217095448Z
modifyTimestamp: 20090218092048Z
nsState:: AQAAANnSm0kAAAAAAAAAAAEAAAA=
nsDS5ReplicaName: 000df382-1dd211b2-a7f6fad4-efd80000
nsDS5ReplicaBindDN: cn=replication manager,cn=config
numSubordinates: 1
dn: cn=ldap1, cn=replica, cn="dc=example,dc=es", cn=mapping tree, cn=config
objectClass: top
objectClass: nsDS5ReplicationAgreement
description: Replicacion multimaster entre ldap1 y ldap2
cn: ldap1
nsDS5ReplicaRoot: dc=example,dc=es
nsDS5ReplicaHost: ldap2.example.es
nsDS5ReplicaPort: 636
nsDS5ReplicaBindDN: cn=replication manager,cn=config
nsDS5ReplicaTransportInfo: SSL
nsDS5ReplicaBindMethod: SIMPLE
nsDS5ReplicaCredentials: {DES} xxxx
creatorsName:
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot
modifiersName:
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoo
t
createTimestamp: 20090217100103Z
modifyTimestamp: 20090218103445Z
dn: cn=ldap2, cn=replica, cn="dc=example,dc=es", cn=mapping tree, cn=config
objectClass: top
objectClass: nsDS5ReplicationAgreement
description: Replicacion multimaster entre ldap2 y ldap1
cn: ldap1
nsDS5ReplicaRoot: dc=example,dc=es
nsDS5ReplicaHost: ldap1.example.es
nsDS5ReplicaPort: 636
nsDS5ReplicaBindDN: cn=replication manager,cn=config
nsDS5ReplicaTransportInfo: SSL
nsDS5ReplicaBindMethod: SIMPLE
nsDS5ReplicaCredentials: {DES} xxxx
creatorsName:
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot
modifiersName:
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot
createTimestamp: 20090217100103Z
modifyTimestamp: 20090218103445Z
I can see where the error is, I hope you can help me
Thank you
--
Rocio Quirantes Rodal
Área de Seguridad Informática
Centro Informático Científico de Andalucía (CICA)
Avda. Reina Mercedes s/n - 41012 - Sevilla (Spain)
Tfno.: +34 955 056 648 / +34 955 056 600 / FAX: +34 955 056 650
Consejería de Innovación, Ciencia y Empresa
Junta de Andalucía
--------------------------------------------------
Este mensaje esta firmado digitalmente. Para poder
reconocer la firma desde su cliente debera tener
instalado el certificado raiz de la CA del CICA en
el mismo. Puede descargarlo desde:
http://pki.cica.es/cacert/
--------------------------------------------------
15 years, 2 months
