May 2014 - 389-users - Fedora Mailing-Lists

dirsrv gosa to 389 questions on some capabilities

by Zynda, Bradley V. (GSFC-423.0)[ADNET SYSTEMS INC]

Hi All, We are currently in the process of moving to a fresh Cent6.5 389 setup. The old setup was an improperly configured Gosa dirsrv and we would like to get away from gosa on the new 389 build. Though I have come across some needs that I can't seem to find documentation on: 1. The ability to restrict users to specific hosts, adding hosts list. 2. The ability to restrict users to specific sudo commands. 3. Tying in svn or git with changes. Thanks, Brad

9 years, 11 months

1
0
0 / 0

defining DEBUG in LDAP 389 builds

by G, Rajendra Babu (STSD campus)

Hi, When 389 LDAP server is built for "optimized" mode (--disable-debug), I see that debug_defs is still set to "-DDEBUG -DMCC_DEBUG" as the code is always getting landed in the successful if condition check. I am wondering if this is an expected behavior ?. if test "${enable_debug+set}" = set; then enableval=$enable_debug; { $as_echo "$as_me:$LINENO: result: yes" >&5 $as_echo "yes" >&6; } debug_defs="-DDEBUG -DMCC_DEBUG" else { $as_echo "$as_me:$LINENO: result: no" >&5 $as_echo "no" >&6; } debug_defs="" fi Regards, Rajendra

9 years, 11 months

1
0
0 / 0

change internal token password

by Elizabeth Jones

I'm finally ready to configure encryption on our LDAP servers, but I just discovered the previous admin had already set the password - to something I don't know. The previous admin was summarily dismissed one morning and would not be the type of guy who I could call and say by the way what was the password you used for the internal security token. Is there a way to clear this/reset it without knowing what the original password was? thanks, EJ

9 years, 11 months

1
1
0 / 0

db2bak.pl error with changelogdb

by Orion Poplawski

We are backing up our database daily with db2bak.pl, and have started to notice the following messages: [13/May/2014:03:59:08 -0600] - Backend instance "changelogdb" does not exist; Instance path /var/lib/dirsrv/slapd-cora/changelogdb could be invalid. [13/May/2014:03:59:08 -0600] - Backup: error in copying directory (/var/lib/dirsrv/slapd-cora/changelogdb -> /var/lib/dirsrv/slapd-cora/bak/cora-2014_05_13_03_59_08/.repl_changelog_backup): err=-1 # ls -l /var/lib/dirsrv/slapd-cora/changelogdb total 2796 -rw-------. 1 dirsrv dirsrv 2859008 May 14 13:22 dab99282-1dd111b2-84f8fd5b-e7890000_4e7cb85b000000010000.db4 -rw-rw-r--. 1 dirsrv dirsrv 0 May 12 14:30 dab99282-1dd111b2-84f8fd5b-e7890000.sema -rw-------. 1 dirsrv dirsrv 30 Dec 9 2012 DBVERSION Configuration issue? Bug? Thanks, Orion -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 http://www.nwra.com

9 years, 11 months

5
13
0 / 0

Multiple Users Same UID

by John Trump

If I create posix users and manually assign uid's 389-ds will allow me to assign the same uid to multiple users. If I do not manually assign uid's, the uid's will be incremented and not duplicate uid's. Is there a check / rule that canbe applied to prevent duplicate uid's when assigning uid's manually?

9 years, 11 months

2
2
0 / 0

encryption and load balancing

by Elizabeth Jones

I'm kind of confused about how to handle encryption certificates with a load balancer in place. I'm using the setupssl.sh script to create our certs and insert them into the LDAP instances - and this uses each LDAP servers hostname. Our current configuration is that ldap requests go to a GTM, which directs the request to its closest data center load balancers. We have identical certs on each load balancer, and encrypt from the client to the load balancer, then plain text inside the data center from load balancer to ldap servers. We want to make the entire path encrypted so the load balancers would just act as pass throughs. But what I'm not quite clear on is how we would direct the requests - can we continue to use our GTM url or do we somehow need to tell the clients which servers they are connecting to? In my testing I've appended the certs from my test LDAPs to the F5 cert that I have on my test clients and I can authenticate making a direct connection to any of the test LDAPs, but I am putting in a server name. No test load balancers to test this out on so I have no idea what will happen when I actually try to go through the load balancers. Do the certs have to have the server hostnames in them or can I create a cert that has a virtual name and put that on all the LDAP servers? EJ

9 years, 11 months

4
5
0 / 0

LDAP import

by Herb Burnswell

All, I'm attempting to import an LDAP schema (is that the correct term?) from one LDAP implementation to another and it appears that I may be doing it incorrectly. I created a ldif file for import as: ldapsearch -b "o=companyA" -D "dc=hq,dc=example,dc=com" -h original_system > output.ldif I then used the GUI in the new LDAP implementation to import the ldif file. Everything seemed to work find as I have the entire tree but there appears to be a problem with passwords. Am I missing the passwords for users with this export to ldif file? What is the proper procedure to import all information from a schema (is that the correct term?) to import into a new LDAP implementation? Thanks in advance for any assistance, Herb

9 years, 11 months

5
10
0 / 0

inetUser issue

by Ssureshot

I've added the inetUser object class to the nsdefaultobjectclass the the cn=user. However when I add a new user the user does not have inetUser object class. Any idea? # extended LDIF # # LDAPv3 # base <o=netscaperoot> with scope subtree # filter: cn=user # requesting: ALL # # user + inetorgperson, defaultObjectClassesContainer, 1.1, Admin, Global Pre ferences, example.local, NetscapeRoot dn: cn=user+nsdefaultobjectclass=inetorgperson,cn=defaultObjectClassesContaine r,ou=1.1,ou=Admin,ou=Global Preferences,ou=example.local,o=NetscapeRoot objectClass: top objectClass: nsResourceRef objectClass: nsdefaultObjectClasses cn: user nsDefaultObjectClass: top nsDefaultObjectClass: person nsDefaultObjectClass: organizationalPerson nsDefaultObjectClass: inetorgperson nsDefaultObjectClass: inetUser # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Thank you Aaron

9 years, 11 months

3
3
0 / 0

Users with the same ID

by Enrico Morelli

Dear, I'm porting my working areas authentication on 389-ds. I've nominal user credential and project credential. So I have user and project that has the same POSIX ID but different POSIX group and OU. EG: morelli PosixID: 1000 groupID: 100 OU: Technical Staff java PosixID: 1000 groupID: 900 OU: Project Research Now under Linux, if I login with my credential I find that all my files are of the java project user. In the systems sssd.conf I have: access_provider = ldap ldap_access_order = filter ldap_access_filter = (gidNumber=100) Is it possible to avoid this problem? I want that in some machine only components of a determined group is able to login. The other users/groups hasn't to be visible. Thanks -- ------------------------------------------------------------- Enrico Morelli System Administrator | Programmer | Web Developer CERM - Polo Scientifico Via Sacconi, 6 - 50019 Sesto Fiorentino (FI) - ITALY phone: +39 055 457 4269 fax: +39 055 457 4927 -------------------------------------------------------------

9 years, 11 months

2
1
0 / 0

enforcing password policy

by Elizabeth Jones

I finally have permission to configure password policy in our ldap servers, but have a question about how it is enforced. Our service desk is able to access our LDAPs using LDAP Account Manager (LAM) and other admins can use LAM or tools like jexplorer. Once I have password policy in place, does anyone know how these types of tools would react if a user tries to change a password that doesn't conform to the policy? thanks - EJ

9 years, 11 months

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users May 2014