DS 1.3.2.14 on Sparc: Authentication method not supported
by Carsten Grzemba
some tests later I stumble in this problem:
[14/03/12:10:03:41] - [Setup] Info Could not authenticate as user 'uid=admin,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot' to server 'ldap://testcsw.contac.lan:389/o=NetscapeRoot'. Error: Authentication method not supported
[14/03/12:10:03:41] - [Setup] Fatal Could not register the directory server with the configuration directory server.
I found in the mail archive a similar thread for PPC:
[389-users] Authentication method not supported (https://lists.fedoraproject.org/pipermail/389-users/2013-July/016073.html)
was there a solution found or a ticket created?
THX
10 years, 1 month
Re: [389-users] problem on Sparc with DS 1.3.2: Skipping entry ... which has no parent
by Carsten Grzemba
Am 11.03.14 schrieb Rich Megginson <rmeggins(a)redhat.com>:
>
>
>
>
>
> On 03/11/2014 07:32 AM, Carsten Grzemba wrote:
>
>
> >
> >
> > Am 11.03.14 schrieb Rich Megginson <rmeggins(a)redhat.com> <rmeggins(a)redhat.com>:
> > >
> > >
> > >
> > >
> > >
> > > On 03/11/2014 05:57 AM, Carsten Grzemba wrote:
> > >
> > >
> > > > interessting: it is only on 32bit build. 64bit build on Solaris10 Sparc works as expected.
> > > >
> > > >
> > >
> > > I'm not sure. I guess we could try to reproduce on Fedora 32-bit.
> > >
> > >
> > >
> > >
> > the Solaris10 i386 build works without problems, only on Sparc.
> >
>
> Then I suspect the slapi_counter code . . .
>
>
>
>
was there anything changed since 1.2.11.15? In 1.2.11.15 works also all fine.
>
>
>
>
>
>
> >
> > >
> > >
> > >
> > >
> > >
> > >
> > > >
> > > > --
> > > > 389 users mailing list
> > > > 389-users(a)lists.fedoraproject.org
> > > > https://admin.fedoraproject.org/mailman/listinfo/389-users
> > > >
> > >
> > >
> > >
> > >
> > >
> > >
> >
> >
> >
> > --
> > 389 users mailing list
> > 389-users(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
> >
>
>
>
>
>
10 years, 1 month
Issues with PAM Pass Through and pam_krb5 with sssd
by Trey Dockendorf
I have one 389 DS server successfully using PAM Pass through that goes
to a pam.d file that uses pam_krb5 for auth. I've setup a new system
and am now unable to get the pass through to work.
The second system is identical except it's updated to EL 6.5 while
working system is EL 6.4. The second system that's not working is
using SSSD instead of the PADL stack.
When performing either ldapsearch using my account for bind, or
performing SSH login to a client configured in SSSD with 389DS as the
LDAP server, I get these errors in /var/log/dirsrv/slapd-ldap01/errors
[11/Mar/2014:11:33:31 -0500] pam_passthru-plugin - Error from PAM
during pam_authenticate (7: Authentication failure)
[11/Mar/2014:11:33:31 -0500] pam_passthru-plugin - Invalid PAM
password for user id [treydock], bind DN
[uid=treydock,ou=people,dc=org,dc=domain,dc=edu]
Then these are in /var/log/secure
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: default/local realm
'DOMAIN.EDU'
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: configured realm 'DOMAIN.EDU'
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: debug
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flags: forwardable
not proxiable
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no ignore_afs
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no null_afs
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: cred_session
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: user_check
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no krb4_convert
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: krb4_convert_524
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: krb4_use_as_req
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: will try previously
set password first
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: will let libkrb5 ask questions
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no use_shmem
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no external
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no multiple_ccaches
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: validate
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: warn
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: ticket lifetime:
86400s (1d,0h,0m,0s)
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: renewable lifetime:
86400s (1d,0h,0m,0s)
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: minimum uid: 500
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: banner: Kerberos 5
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: ccache dir: /tmp
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: ccname template:
FILE:%d/krb5cc_%U_XXXXXX
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: keytab: FILE:/etc/krb5.keytab
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: token strategy: v4,524,2b,rxk5
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: called to
authenticate 'treydock', realm 'DOMAIN.EDU'
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: error resolving user
name 'treydock' to uid/gid pair
Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: error getting
information about 'treydock'
Mar 11 11:33:30 ldap01 ns-slapd: pam_unix(ldapserver:auth): check
pass; user unknown
Mar 11 11:33:30 ldap01 ns-slapd: pam_unix(ldapserver:auth):
authentication failure; logname= uid=99 euid=99 tty= ruser= rhost=
# cat /etc/krb5.conf
[libdefaults]
default_realm = DOMAIN.EDU
default_tkt_enctypes = aes256-cts-hmac-sha1-96 des3-hmac-sha1
default_tgs_enctypes = aes256-cts-hmac-sha1-96 des3-hmac-sha1
clockskew = 300
[realms]
DOMAIN.EDU = {
kdc = kerberos-3.domain.edu:88
kdc = kerberos-1.domain.edu:88
kdc = kerberos-2.domain.edu:88
admin_server = kerberos-master.domain.edu:749
default_domain = domain.edu
}
[domain_realm]
domain.edu = DOMAIN.EDU
.domain.edu = DOMAIN.EDU
[appdefaults]
pam = {
ticket_lifetime = 1d
renew_lifetime = 1d
forwardable = true
krb4_convert = false
proxiable = false
retain_after_close = false
minimum_uid = 500
debug = true
}
# cat /etc/pam.d/ldapserver
auth required pam_env.so
auth sufficient pam_krb5.so use_first_pass debug
auth sufficient pam_unix.so nullok try_first_pass
auth required pam_deny.so
account include password-auth
password include password-auth
session include password-auth
# cat /etc/pam.d/password-auth
#%PAM-1.0
# Managed by puppet - do not modify!
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so sha512 shadow nullok
try_first_pass use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in
crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
# cat /etc/sssd/sssd.conf
# Managed by puppet - do not modify
[sssd]
config_file_version = 2
debug_level = 0x02F0
reconnection_retries = 3
sbus_timeout = 30
services = nss,pam,sudo
domains = LDAP
[nss]
debug_level = 0x02F0
reconnection_retries = 3
filter_groups = root,wheel
filter_users = root
[pam]
debug_level = 0x02F0
reconnection_retries = 3
offline_credentials_expiration = 0
[sudo]
[domain/LDAP]
debug_level = 0x02F0
cache_credentials = TRUE
entry_cache_timeout = 6000
enumerate = TRUE
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
access_provider = ldap
sudo_provider = ldap
ldap_uri = ldap://ldap01.org.domain.edu
ldap_search_base = dc=org,dc=domain,dc=edu
ldap_network_timeout = 3
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.internal.crt
ldap_schema = rfc2307bis
ldap_id_use_start_tls = TRUE
ldap_chpass_update_last_change = TRUE
ldap_group_member = uniquemember
ldap_group_object_class = posixGroup
ldap_group_name = cn
ldap_pwd_policy = none
ldap_account_expire_policy = 389ds
ldap_access_order = filter,expire
ldap_access_filter = (objectclass=posixaccount)
ldap_sudo_search_base = ou=sudoers,dc=org,dc=domain,dc=edu
PAM pass through config:
# PAM Pass Through Auth, plugins, config
dn: cn=PAM Pass Through Auth,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: extensibleObject
objectClass: pamConfig
cn: PAM Pass Through Auth
nsslapd-pluginPath: libpam-passthru-plugin
nsslapd-pluginInitfunc: pam_passthruauth_init
nsslapd-pluginType: preoperation
nsslapd-pluginEnabled: on
nsslapd-pluginloadglobal: true
nsslapd-plugin-depends-on-type: database
pamMissingSuffix: ALLOW
pamExcludeSuffix: cn=config
pamIDMapMethod: ENTRY
pamIDAttr: tamuEduPersonNetID
pamFallback: TRUE
pamSecure: TRUE
pamService: ldapserver
nsslapd-pluginId: pam_passthruauth
nsslapd-pluginVersion: 1.2.11.15
nsslapd-pluginVendor: 389 Project
nsslapd-pluginDescription: PAM pass through authentication plugin
pamIncludeSuffix: ou=People,dc=org,dc=domain,dc=edu
pamFilter: (&(objectClass=tamuPerson)(tamuEduPersonNetID=*))
tamuPerson and tamuEduPersonNetID schema additions (from
/etc/dirsrv/slapd-ldap01/schema/99user.ldif):
objectclasses: ( 1.3.6.1.4.1.4391.1.0 NAME 'tamuPerson' DESC '' SUP
top STRUCTURAL MAY tamuEduPersonNetID X-ORIGIN 'user defined' )
attributetypes: ( 1.3.6.1.4.1.4391.0.13 NAME 'tamuEduPersonNetID' DESC
'NetID (login username)' EQUALITY caseIgnoreIA5Match SYNTAX
1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE X-ORIGIN 'user
defined' )
My account:
# treydock, People, org.domain.edu
dn: uid=treydock,ou=People,dc=org,dc=domain,dc=edu
uid: treydock
gidNumber: 999
mail: treydock(a)domain.edu
sn: Dockendorf
cn: Trey Dockendorf
givenName: Trey
tamuEduPersonNetID: treydock
loginShell: /bin/bash
homeDirectory: /home/treydock
objectClass: inetOrgPerson
objectClass: inetuser
objectClass: organizationalPerson
objectClass: person
objectClass: posixAccount
objectClass: tamuPerson
objectClass: top
uidNumber: 1380
Thanks
- Trey
10 years, 1 month
Non-contiguous attribute values
by Timothy Pollard
Hi,
We received this strange error a few hours ago for one of our DNS entries:
[10/Mar/2014:15:56:01 +0000] - str2entry_fast: Error. Non-contiguous attribute values for tXTRecord
[10/Mar/2014:15:56:01 +0000] - Entry "relativeDomainName=testingstatus,zoneName=OURORG.com,dc=DNS,o=Internet" required attribute "objectclass" missing
This is a monitor DNS entry that we update every four minutes to verify that our
Replication is working across the board, so that next error repeats every four
minutes as we try to update the entry.
The entry looks like it's had everything except for the tXTRecord field deleted
as well. Fortunately it's a testing entry, so we can easily rebuild it manually.
This error occurred a few minutes after a bad restart which required a changelog
regenerate, so that may be related.
Anyone know what might cause this?
--
TimP
[http://blog.timp.com.au]
[http://resume.timp.com.au]
10 years, 1 month
help with cert expired
by Maurizio Marini
Hello
I have this very old installation:
389-ds-1.1.3-5.fc12.noarch
389-ds-console-doc-1.2.0-5.fc12.noarch
389-ds-base-1.2.5-1.fc12.i686
389-ds-console-1.2.0-5.fc12.noarch
389-console-1.1.3-5.fc12.noarch
389-admin-console-1.1.4-2.fc12.noarch
389-dsgw-1.1.4-1.fc12.i686
389-admin-console-doc-1.1.4-2.fc12.noarch
389-adminutil-1.1.8-4.fc12.i686
389-admin-1.1.10-1.fc12.i686
into an old FC12.
Now certs under /etc/httpd/alias
are expired
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 3 (0x3)
Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
Issuer: "CN=Certificate Shack,O=example.com,C=US"
Validity:
Not Before: Mon Mar 01 10:50:54 2010
Not After : Sat Mar 01 10:50:54 2014
Subject: "CN=localhost4.localdomain4,O=example.com,C=US"
and I have this error into log:
[error] SSL Library Error: -8181 Certificate has expired
the it suggests to
" Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the
prob lem can be resolved."
I did, and it works.
Now I wonder how can I renew that expired cert.
I have googled around but I have not found any simple to re-create the cert.
I find this
http://directory.fedoraproject.org/wiki/Howto:SSL
but it is not so easy to regenerate an expired certificate.
Is there something simpler?
Can you help me?
My best rgards
Maurizio
10 years, 1 month
problem on Sparc with DS 1.3.2: Skipping entry ... which has no parent
by Carsten Grzemba
If I try to setup an DS1.3.2.13 DS intance on Solaris10 Sparc I got a error on setup-ds-admin.pl:
...
+Entry cn=PD Managers,ou=groups,dc=contac,dc=lan is added
+changeOwnerMode: changed mode of /tmp/ldifuO_wjV.ldif to 440
+changeOwnerMode: changed ownership of /tmp/ldifuO_wjV.ldif to user 389 group 389
+importing data ...
[11/Mar/2014:09:26:40 +0100] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database
[11/Mar/2014:09:26:40 +0100] - check_and_set_import_cache: pagesize: 8192, pages: 262144, procpages: 2640
[11/Mar/2014:09:26:40 +0100] - Import allocates 838856KB import cache.
[11/Mar/2014:09:26:40 +0100] - import userRoot: Beginning import job...
[11/Mar/2014:09:26:40 +0100] - import userRoot: Index buffering enabled with bucket size 100
[11/Mar/2014:09:26:41 +0100] - import userRoot: Processing file "/tmp/ldifuO_wjV.ldif"
[11/Mar/2014:09:26:41 +0100] - import userRoot: Finished scanning file "/tmp/ldifuO_wjV.ldif" (9 entries)
[11/Mar/2014:09:26:41 +0100] - import userRoot: WARNING: Skipping entry "dc=example,dc=lan" which has no parent, ending at line 17 of file "/tmp/ldifuO_wjV.ldif"[11/Mar/2014:09:26:41 +0100] entryrdn-index - _entryrdn_index_read: Suffix "dc=example,dc=lan" not found: Successful return: 0(0)
...
a lot of such errors following and the userRoot db or base db is not setup correctly.
I have tried the patch: https://fedorahosted.org/389/attachment/ticket/47734 without success.
Your help is greatly appreciated.
10 years, 1 month
multi-master changelog, tombstone entries
by Vesa Alho
Hi,
1. replication changelog
I've been running multi-master replication setup for a while and
realised hadn't configured expiration (changelog max age). Now my
changelog file is rather big and I would like get size down. I'm
planning to delete changelog and start with a fresh one following these
instructions:
https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Serv...
But since I have two multi-master servers, I was wondering what is the
best way to start with a fresh changelog?
Guide says I need to re-initialize consumers again, but if both
multi-master servers get new data during replication is off, I'm worried
I get into trouble when trying to get replication running again. In case
there is a risk, I rather keep the current state.
2. Tombstone entries
I was reading this:
https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Serv...
=>
I noticed that at least in 1.2.11.25 value
nsDS5ReplicaTombstonePurgeInterval is not set at all. I guess because it
depends on environment? But is there a reason why it's not directly
visible in Console => Configuration => Replication (on the same page as
changelog max age)? Just saying I would not have noticed tombstone
purging unless reading administration guide carefully.
-Vesa
10 years, 1 month
Importing Pre-Hashed Passwords
by Steven Crothers
Hello,
I'm trying to accomplish a poor mans replication from OpenDS from
Oracle/Sun. Basically the logic is as follows:
OpenDS is attached to our corporate IDM.
User is managed in OpenDS.
User updates information in OpenDS.
OpenDS read-replica is updated in our local read-slave.
Python script notices there was a change in our local read-slave.
Script isolates the change from our read-slave and sends the DNs to
sync to my 389 (FreeIPA) server.
FreeIPA replica receives input over the network from notification
agent which includes DNs.
DNs attributes are re-organized (OpenDS doesn't use anything logical,
all 100% custom attributes/objectclasses).
DNs with re-organized attributes are inserted/updated in 389 server
(FreeIPA), minus the updated SSHA password hash.
I get an error saying that adding pre-encoded passwords isn't allowed.
But, that makes me say "How the hell do you import an LDIF" backup,
and frankly, I can't find anything on the subject (albeit, I
admittedly didn't quite know how to search this issue either).
I've never seen a server not accept pre-encoded password hashes (or at
least I don't recall this specific error in OpenDS/LDAP), so my
question is, how can I store the SSHA password hash from OpenDS in my
389server (FreeIPA) server?
Steven Crothers
steven.crothers(a)gmail.com
10 years, 1 month
