389-users February 2012

389-users@lists.fedoraproject.org

35 participants
60 discussions

Start a nNew thread

Re: [389-users] 389-users mailing list submissions <brendasmithharley@yahoo.com>
by Brenda Smith_Harley 27 Feb '12

27 Feb '12

1 0

Named log pipe + normal access log
by Daniel Fenert 27 Feb '12

27 Feb '12

Hi, I'd like to log to named pipe (just like said here: http://directory.fedoraproject.org/wiki/Named_Pipe_Log_Script) for some live analysis and ALSO log to access log as usual. Is it possible? I'd like to avoid logging everything via this script (I have 1GB logs every 20 minutes in peak hours on each slave). -- Daniel Fenert

3 3

Re: [389-users] Post to this mailing list<brendasmithharley@yahoo.com>
by Brenda Smith_Harley 26 Feb '12

26 Feb '12

1 0

systemd warning message
by Marco Pizzoli 24 Feb '12

24 Feb '12

Hi, I don't know if this the right place to report this, but on my Fedora16 system, running with: systemd-37-13.fc16.x86_64 389-ds-base-libs-1.2.10.1-1.fc16.x86_64 389-ds-base-1.2.10.1-1.fc16.x86_64 I get these lines in my /var/log/messages file: Feb 24 20:50:11 freeipa01 systemd-tmpfiles[1409]: Successfully loaded SELinux database in 18ms 763us, size on heap is 485K. Feb 24 20:50:11 freeipa01 systemd-tmpfiles[1409]: Two or more conflicting lines for /var/run/dirsrv configured, ignoring. Feb 24 20:50:11 freeipa01 systemd-tmpfiles[1409]: Two or more conflicting lines for /var/lock/dirsrv configured, ignoring. Are they an actual problem? One information maybe useful: this is an IPA system and 389-ds has been installed from IPA rpm dependencies Thanks in advance Marco

2 4

Announcing 389 Directory Server version 1.2.10.2 Testing
by Rich Megginson 23 Feb '12

23 Feb '12

The 389 Project team is pleased to announce the release of 389-ds-base-1.2.10.2. No new features were added after alpha 8, just many bug fixes. There are also 389-adminutil, 389-admin, and 389-dsgw packages in Testing. NEW: EL6 support Beginning with RHEL 6.2, the 389-ds-base package is included in the base OS. Therefore, the 389-ds-base package can no longer be provided via EPEL, due to RHEL/EPEL packaging restrictions. However, the 389 Project will still make the full 389-ds-base package available via http://repos.fedorapeople.org/repos/rmeggins/389-ds-base. See http://directory.fedoraproject.org/wiki/Download for more information. NEW: Issue Tracking System We have moved our ticket tracking system from the Red Hat Bugzilla https://bugzilla.redhat.com/enter_bug.cgi?product=389 to our Fedora Hosted Trac https://fedorahosted.org/389. All of the old 389 bugs have been copied to Trac. All new bugs, feature requests, and tasks should be entered in Trac This link shows all of the issues fixed in the 1.2.10 branch - https://fedorahosted.org/389/report/12 NEW: Plugin Authors WARNING: Plugins should be made transaction aware so that they can be called from within a backend pre/post transaction plugin. Otherwise, attempting to perform an internal operation will cause a deadlock. See http://directory.fedoraproject.org/wiki/Plugins Installation yum install --enablerepo=updates-testing 389-ds # or for EPEL yum install --enablerepo=epel-testing [--enablerepo=epel-testing-389-ds-base] 389-ds setup-ds-admin.pl Upgrade yum upgrade --enablerepo=updates-testing 389-ds-base idm-console-framework 389-admin 389-ds-console 389-admin-console 389-dsgw 389-adminutil # or for EPEL yum upgrade --enablerepo=epel-testing [--enablerepo=epel-testing-389-ds-base] 389-ds-base idm-console-framework 389-admin 389-ds-console 389-admin-console 389-dsgw 389-adminutil setup-ds-admin.pl -u How to Give Feedback The best way to provide feedback is via the Fedora Update system. * Go to https://admin.fedoraproject.org/updates * In the Search box in the upper right hand corner, type in the name of the package * In the list, find the version and release you are using (if you're not sure, use rpm -qi <package name> on your system) and click on the release * On the page for the update, scroll down to "Add a comment" and provide your input Or just send us an email to 389-users(a)lists.fedoraproject.org Reporting Issues https://fedorahosted.org/389 More Information * Release Notes - http://port389.org/wiki/Release_Notes * Install_Guide - http://port389.org/wiki/Install_Guide * Download - http://port389.org/wiki/Download

1 0

389 Segfault
by Rafael Cervillera Cortés 23 Feb '12

23 Feb '12

Hi. Yesterday, one of our 389 Directory Server crashed with the message: ldap kernel: ns-slapd[4300]: segfault at 0000000000000000 rip 00002b91c2db3bab rsp 000000005302cca0 error 4 We haven't found any information about the 4300 code on Internet, and there isn't any illegal ldap operation in the access log file. Someone has any idea about this error code? Thanks. -- --------------------------------------- Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by professional privilege. If you are not the intended recipient you are hereby notified that any dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. ____ __ | _ \ __ _ / _| __ _ | |_) / _` | |_ / _` | | _< (_| | _| (_| | |_| \_\__,_|_| \__,_| Rafael Cervillera Cortés e-mail: rccortes(a)ujaen.es Telefono 953 21 34 05 UNIVERSIDAD DE JAEN Servicio de Informática Edificio Zabaleta-Planta Baja Campus "Las Lagunillas" E-23071 - Jaén (España) "Dime y lo olvido, enséñame y lo recuerdo, involúcrame y lo aprendo" -- Benjamín Franklin ---------------------------------------

2 3

Re: [389-users] dirsrv-admin with existing (remote) configuration server using SSL
by Rich Megginson 22 Feb '12

22 Feb '12

On 02/21/2012 07:15 AM, MATON Brett wrote: > > Hi Rich, > > I'm still banging my head with this one. > > I did notice though that the slave server doesn't ask for the > CertificateDB password. > > Is there any way to check where it's actually looking for the key > databases? > Not without trying to use gdb to run the CGI programs through the debugger. > > Brett > > *From:*389-users-bounces@lists.fedoraproject.org > [mailto:389-users-bounces@lists.fedoraproject.org] *On Behalf Of > *MATON Brett > *Sent:* 10 February 2012 07:24 > *To:* General discussion list for the 389 Directory server project.; > Rich Megginson > *Subject:* Re: [389-users] dirsrv-admin with existing (remote) > configuration server using SSL > > On 02/08/2012 01:31 PM, MATON Brett wrote: > > Platform is RHEL6.2 x64 > > $ rpm -qa|grep 389 > > 389-admin-console-doc-1.1.8-1.el6.noarch > > 389-ds-base-libs-1.2.9.14-1.el6_2.2.x86_64 > > 389-admin-console-1.1.8-1.el6.noarch > > 389-adminutil-1.1.14-2.el6.x86_64 > > 389-ds-console-1.2.6-1.el6.noarch > > 389-ds-1.2.2-1.el6.noarch > > 389-ds-base-1.2.9.14-1.el6_2.2.x86_64 > > 389-ds-console-doc-1.2.6-1.el6.noarch > > 389-console-1.1.7-1.el6.noarch > > 389-admin-1.1.25-1.el6.x86_64 > > 389-dsgw-1.1.7-2.el6.x86_64 > > $ rpm -qi openldap > > Name : openldap Relocations: (not relocatable) > > Version : 2.4.23 Vendor: Red Hat, Inc. > > Release : 20.el6 Build Date: Tue 04 Oct > 2011 01:48:15 PM CEST > > Install Date: Wed 08 Feb 2012 09:20:30 AM CET Build Host: > x86-010.build.bos.redhat.com > > Group : System Environment/Daemons Source RPM: > openldap-2.4.23-20.el6.src.rpm > > Size : 779076 License: OpenLDAP > > Signature : RSA/8, Mon 07 Nov 2011 08:37:10 AM CET, Key ID > 199e2f91fd431d51 > > Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla> > > URL : http://www.openldap.org/ > > Summary : LDAP support libraries > > Description : <snipped> > > rpm -qi nss > > Name : nss Relocations: (not relocatable) > > Version : 3.12.10 Vendor: Red Hat, Inc. > > Release : 17.el6_2 Build Date: Sat 10 Dec > 2011 12:32:24 AM CET > > Install Date: Wed 08 Feb 2012 09:20:30 AM CET Build Host: > x86-003.build.bos.redhat.com > > Group : System Environment/Libraries Source RPM: > nss-3.12.10-17.el6_2.src.rpm > > Size : 2602368 License: MPLv1.1 or > GPLv2+ or LGPLv2+ > > Signature : RSA/8, Wed 14 Dec 2011 01:37:20 PM CET, Key ID > 199e2f91fd431d51 > > Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla> > > URL : http://www.mozilla.org/projects/security/pki/nss/ > > Summary : Network Security Services > > Description : <snipped> > > grep -i admconfigdir /etc/dirsrv/admin-serv/* > > # grep -i admconfigdir /etc/dirsrv/admin-serv/* > > /etc/dirsrv/admin-serv/admserv.conf:ADMConfigDir "/etc/dirsrv/admin-serv" > > > grep -i NSSEngine /etc/dirsrv/admin-serv/* > > # grep -i NSSEngine /etc/dirsrv/admin-serv/* > > /etc/dirsrv/admin-serv/console.conf:NSSEngine off > > > service dirsrv stop > /usr/sbin/start-ds-admin -e debug > > # service dirsrv stop > > Shutting down dirsrv: > > <host>... [ OK ] > > # /usr/sbin/start-ds-admin -e debug > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module > authz_host_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module > auth_basic_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module > authn_file_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module > log_config_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module env_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module > mime_magic_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module > unique_id_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module > setenvif_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module > mime_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module > negotiation_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module dir_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module > alias_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module > rewrite_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module cgi_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module > restartd_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module nss_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_so.c(246): loaded module > admserv_module > > [Wed Feb 08 22:03:59 2012] [debug] mod_admserv/mod_admserv.c(2509): > [25197] create_server_config [0xbogus %p for (null) > > [Wed Feb 08 22:03:59 2012] [debug] mod_admserv/mod_admserv.c(2497): > [25197] create_config [0xbogus %p for (null) > > [Wed Feb 08 22:03:59 2012] [debug] mod_admserv/mod_admserv.c(2570): > [25197] Set [0xbogus %p [ADMCacheLifeTime] to 600 > > [Wed Feb 08 22:03:59 2012] [debug] mod_admserv/mod_admserv.c(2588): > [25197] Set [0xbogus %p [ADMServerVersionString] to > 389-Administrator/1.1.25 > > [Wed Feb 08 22:03:59 2012] [debug] mod_admserv/mod_admserv.c(2497): > [25197] create_config [0xbogus %p for /*/[tT]asks/[Oo]peration/* > > [Wed Feb 08 22:03:59 2012] [debug] mod_admserv/mod_admserv.c(2522): > [25197] adminsdk [0xbogus %p flag 1 > > [Wed Feb 08 22:03:59 2012] [debug] mod_admserv/mod_admserv.c(2497): > [25197] create_config [0xbogus %p for /*/[tT]asks/[Cc]onfiguration/* > > [Wed Feb 08 22:03:59 2012] [debug] mod_admserv/mod_admserv.c(2522): > [25197] adminsdk [0xbogus %p flag 1 > > [Wed Feb 08 22:03:59 2012] [debug] mod_admserv/mod_admserv.c(2497): > [25197] create_config [0xbogus %p for > /*/[tT]asks/[Oo]peration/(?i:stop|start|restart|startconfigds|create|remove)$ > > [Wed Feb 08 22:03:59 2012] [debug] mod_admserv/mod_admserv.c(2522): > [25197] adminsdk [0xbogus %p flag 0 > > Server failed to start !!! Please check errors log for problems > > # tail /var/log/dirsrv/admin-serv/error > > [Wed Feb 08 22:04:05 2012] [debug] mod_admserv/mod_admserv.c(1456): > populate_tasks_from_server(): getting tasks for server [admin-serv] > siedn [cn=admin-serv-<host>,cn=389 Administration Server,cn=Server > Group,cn=<host FQDN>,ou=admins.unix,o=NetscapeRoot] > > [Wed Feb 08 22:04:05 2012] [crit] sslinit: NSS is required to use > LDAPS, but security initialization failed [-12285:Unable to find the > certificate or key necessary for authentication.]. Cannot start server > > Ok. Well, it's just not working and I don't know why. Please file a > ticket and we'll get around to it. > > Sure, I'll do that tomorrow and add the ticket reference here. > > Trac: https://fedorahosted.org/389/ticket/287 > > Thanks, > > Brett > > *De :*Rich Megginson [mailto:rmeggins@redhat.com] > *Envoyé :* mercredi 8 février 2012 21:16 > *À :* MATON Brett > *Cc :* General discussion list for the 389 Directory server project. > *Objet :*Re: [389-users] dirsrv-admin with existing (remote) > configuration server using SSL > > On 02/08/2012 12:18 PM, MATON Brett wrote: > > Thanks for your help Rich, > > LDAPTLS_CACERTDIR=/etc/dirsrv/admin-serv > > ldapsearch -x -H ldaps://<config server FQDN> -D "cn=Directory > Manager" --W --s base --b "" > > # extended LDIF > > # > > # LDAPv3 > > # base <> with scope baseObject > > # filter: (objectclass=*) > > # requesting: ALL > > # > > # > > dn: > > objectClass: top > > namingContexts: dc=admins,dc=unix > > ... > > No complaints from those commands, the plot thickens ;) > > What platform is this? > rpm -qa|grep 389 > rpm -qi openldap > rpm -qi nss > > > Brett > > *De :*Rich Megginson [mailto:rmeggins@redhat.com] > *Envoyé :* mercredi 8 février 2012 16:43 > *À :* General discussion list for the 389 Directory server project. > *Cc :* MATON Brett > *Objet :* Re: [389-users] dirsrv-admin with existing (remote) > configuration server using SSL > > On 02/08/2012 07:20 AM, MATON Brett wrote: > > Installation appears to go fine until it tries to start the admin server: > > Configuration directory server URL [ldap://<local > FQDN>:389/o=NetscapeRoot]: ldaps://<Config Server FQDN>:636/o=NetscapeRoot > > ... > > CA certificate filename: /etc/openldap/cacerts/<base64 cert file> > > ... > > output: Server failed to start !!! Please check errors log for problems > > output: [FAILED] > > /var/log/dirsrv/admin-serv/error: > > [Wed Feb 08 13:35:26 2012] [notice] SELinux policy enabled; httpd > running as context unconfined_u:system_r:httpd_t:s0 > > [Wed Feb 08 13:35:32 2012] [crit] sslinit: NSS is required to use > LDAPS, but security initialization failed [-12285:Unable to find the > certificate or key necessary for authentication.]. Cannot start server > > The server, has however successfully registered itself with the remote > Configuration Directory Server. > > (shows up in the server group in 389-Console and Directory Server is > available). > > I wasn't asked to provide a keystore password when adding the > certificate to the store, as you would be with 389-Console GUI when > first opening the certificate store. > > Is that intentional or not? > > I'm now a bit stumped (again), I had a look at the certdb with certutil: > > [root@<host> admin-serv]# certutil -d . -L > > Certificate Nickname Trust > Attributes > > > SSL,S/MIME,JAR/XPI > > CA certificate CT,, > > Which leads me to believe that it should be able to at least find the > certificate... > > I also checked file/directory ownership and permissions which match > those on the working 'master' server. > > Installer issue: > > If you make a mistake and get asked to try again (I typed the ldaps > port as 633 instead if 636), you get stuck at the CA Certificate > filename stage with the following: > > CA certificate filename [/etc/openldap/cacerts/CAServer.crt]: > > The certificate database in '/etc/dirsrv/admin-serv' already contains > a CA certificate. Please remove it first, or use the certutil program > to add the CA certificate with a different name. > > Please try again, in case you mis-typed something. > > Simple enough solution as for me this is a fresh install, is to delete > cert8.db and keys3.db in /etc/dirserv/admin-serv/from another session. > > You can use ldapsearch to test if the cert db is correct: > > LDAPTLS_CACERTDIR=/etc/dirsrv/admin-serv ldapsearch -x -H > ldaps://<Config Server FQDN> -D "cn=directory manager" -W -s base -b "" > if that doesn't work, use ldapsearch -d 1 -x .... to get more > debugging information. > > The error is strange though. It seems to imply that the admin server > is looking for a cert or key. If the admin server is acting only as > an SSL client, it should not need to look up a cert or key, it should > only need the CA cert. > > > > ------------------------------------------------------------------- > > *GreeNRB** > */NRB considers its environmental responsibility and goes for green IT./ > /May we ask you to consider yours before printing this e-mail? /** > > *NRB, daring to commit > */This e-mail and any attachments, which may contain information that > is confidential and/or protected by intellectual property rights, are > intended for the exclusive use of the above-mentioned addressee(s). > Any use (including reproduction, disclosure and whole or partial > distribution in any form whatsoever) of their content is prohibited > without prior authorization of NRB. If you have received this message > by error, please contact the sender promptly by resending this e-mail > back to him (her), or by calling the above number. Thank you for > subsequently deleting this e-mail and any files attached thereto./ > > > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org <mailto:389-users@lists.fedoraproject.org> > https://admin.fedoraproject.org/mailman/listinfo/389-users > > ------------------------------------------------------------------- > > *GreeNRB** > */NRB considers its environmental responsibility and goes for green IT./ > /May we ask you to consider yours before printing this e-mail? /** > > *NRB, daring to commit > */This e-mail and any attachments, which may contain information that > is confidential and/or protected by intellectual property rights, are > intended for the exclusive use of the above-mentioned addressee(s). > Any use (including reproduction, disclosure and whole or partial > distribution in any form whatsoever) of their content is prohibited > without prior authorization of NRB. If you have received this message > by error, please contact the sender promptly by resending this e-mail > back to him (her), or by calling the above number. Thank you for > subsequently deleting this e-mail and any files attached thereto./ > > ------------------------------------------------------------------- > > *GreeNRB** > */NRB considers its environmental responsibility and goes for green IT./ > /May we ask you to consider yours before printing this e-mail? /** > > *NRB, daring to commit > */This e-mail and any attachments, which may contain information that > is confidential and/or protected by intellectual property rights, are > intended for the exclusive use of the above-mentioned addressee(s). > Any use (including reproduction, disclosure and whole or partial > distribution in any form whatsoever) of their content is prohibited > without prior authorization of NRB. If you have received this message > by error, please contact the sender promptly by resending this e-mail > back to him (her), or by calling the above number. Thank you for > subsequently deleting this e-mail and any files attached thereto./ > > ------------------------------------------------------------------- > > *GreeNRB** > */NRB considers its environmental responsibility and goes for green IT./ > /May we ask you to consider yours before printing this e-mail? /** > > *NRB, daring to commit > */This e-mail and any attachments, which may contain information that > is confidential and/or protected by intellectual property rights, are > intended for the exclusive use of the above-mentioned addressee(s). > Any use (including reproduction, disclosure and whole or partial > distribution in any form whatsoever) of their content is prohibited > without prior authorization of NRB. If you have received this message > by error, please contact the sender promptly by resending this e-mail > back to him (her), or by calling the above number. Thank you for > subsequently deleting this e-mail and any files attached thereto./ > > ------------------------------------------------------------------- > > *GreeNRB** > */NRB considers its environmental responsibility and goes for green IT./ > /May we ask you to consider yours before printing this e-mail? /** > > *NRB, daring to commit > */This e-mail and any attachments, which may contain information that > is confidential and/or protected by intellectual property rights, are > intended for the exclusive use of the above-mentioned addressee(s). > Any use (including reproduction, disclosure and whole or partial > distribution in any form whatsoever) of their content is prohibited > without prior authorization of NRB. If you have received this message > by error, please contact the sender promptly by resending this e-mail > back to him (her), or by calling the above number. Thank you for > subsequently deleting this e-mail and any files attached thereto./ > > ------------------------------------------------------------------- > > *GreeNRB** > */NRB considers its environmental responsibility and goes for green IT./ > /May we ask you to consider yours before printing this e-mail? /** > > *NRB, daring to commit > */This e-mail and any attachments, which may contain information that > is confidential and/or protected by intellectual property rights, are > intended for the exclusive use of the above-mentioned addressee(s). > Any use (including reproduction, disclosure and whole or partial > distribution in any form whatsoever) of their content is prohibited > without prior authorization of NRB. If you have received this message > by error, please contact the sender promptly by resending this e-mail > back to him (her), or by calling the above number. Thank you for > subsequently deleting this e-mail and any files attached thereto./ > > ------------------------------------------------------------------- > > *GreeNRB** > */NRB considers its environmental responsibility and goes for green IT./ > /May we ask you to consider yours before printing this e-mail? /** > > *NRB, daring to commit > */This e-mail and any attachments, which may contain information that > is confidential and/or protected by intellectual property rights, are > intended for the exclusive use of the above-mentioned addressee(s). > Any use (including reproduction, disclosure and whole or partial > distribution in any form whatsoever) of their content is prohibited > without prior authorization of NRB. If you have received this message > by error, please contact the sender promptly by resending this e-mail > back to him (her), or by calling the above number. Thank you for > subsequently deleting this e-mail and any files attached thereto./ > > ------------------------------------------------------------------- > > *GreeNRB > */NRB considers its environmental responsibility and goes for green IT./ > /May we ask you to consider yours before printing this e-mail? /** > > *NRB, daring to commit > */This e-mail and any attachments, which may contain information that > is confidential and/or protected by intellectual property rights, are > intended for the exclusive use of the above-mentioned addressee(s). > Any use (including reproduction, disclosure and whole or partial > distribution in any form whatsoever) of their content is prohibited > without prior authorization of NRB. If you have received this message > by error, please contact the sender promptly by resending this e-mail > back to him (her), or by calling the above number. Thank you for > subsequently deleting this e-mail and any files attached thereto./ >

1 0

ACL Console
by Argentin Andrea Luigi 22 Feb '12

22 Feb '12

Hello All, I would like to profile ACLs in order to let some users manage their own OU via Console. Example: -OUone | USERone, USERtwo, USERthree -OUtwo | USERfour, USERfive -OUthree | USERsix, USERseven, USEReight In every OU I have many users, but I would like to give console access to one user x OU and let them manage their own OU without list and manage the other OUs. USERone can add or remove users ONLY for OUone USERfour can add or remove users ONLY for OUtwo USERsix can add or remove users ONLY for OUthree Thanks!! Andrea ________________________________ -- The information transmitted is intended for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer.

1 0

help - Host Access Based on Group Membership
by Gilbert Martin 16 Feb '12

16 Feb '12

Hi, I would like to control host access via groups/role? Has anyone done this? If so, can you give me some pointers in the correct direction? I've done my own research, but found that I need to allow more than one group to log into a system. So, pam_groupdn is out of the question. The other way of doing it would be to use SSH, but this involves a lot of client configuration. The 3rd option would be to use a netgroup style in 389. Please advice??? Thanks!

2 1

Re: [389-users] Update of uniquemember attribute on DN change of a user
by Carsten Grzemba 16 Feb '12

16 Feb '12

Oh, thats is so old, that I have it forgotten completly: referential integrity plugin is the answer Am 16.02.12, schrieb Carsten Grzemba <grzemba(a)contac-dt.de>: > Hi, > > if I move a user entry which is member of a group too a different OU or I delete a user, than the corresponding uniquemember attribute value will not updated automatically. > Is this behaviour correct? > Is there a tool/task to fixup this broken uniquemember entries? > > 389 Project > 389-Directory/1.2.9.9 B2012.027.89 > > Thanks, > Carsten > > > > -- Carsten Grzemba Tel.: +49 3677 64740 Mobil: +49 171 9749479 Fax:: +49 3677 6474111 Email: carsten.grzemba(a)contac-dt.de contac Datentechnik GmbH

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users February 2012