My logs seem to indicate that the connection is being encrypted; I can ssh to a client server and get the password prompt, but when I enter the password it just returns me to the password prompt again
[01/Dec/2006:19:47:44 -0500] conn=650 fd=69 slot=69 connection from xxx.xxx.xxx.xxx to xxx.xxx.xxx.xxx [01/Dec/2006:19:47:44 -0500] conn=650 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [01/Dec/2006:19:47:44 -0500] conn=650 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [01/Dec/2006:19:47:44 -0500] conn=650 SSL 256-bit AES [01/Dec/2006:19:47:44 -0500] conn=650 op=1 UNBIND [01/Dec/2006:19:47:44 -0500] conn=650 op=1 fd=69 closed - U1
If I disable TLS everything works fine, the client server can query the FDS and auth the client properly
I am not sure if the problem has to do with the pam_ldap not properly formatted or the cert file not in proper format
Does anyone have an example of what the pam_ldap config should look like? or suggestions on checking whether the cert file is in proper format
Also what's the UNBIND shown in the logs?
Thanks
From: fedora-directory-users-request@redhat.com Reply-To: fedora-directory-users@redhat.com To: fedora-directory-users@redhat.com Subject: Fedora-directory-users Digest, Vol 19, Issue 1 Date: Fri, 1 Dec 2006 12:00:06 -0500 (EST)
Send Fedora-directory-users mailing list submissions to fedora-directory-users@redhat.com
To subscribe or unsubscribe via the World Wide Web, visit https://www.redhat.com/mailman/listinfo/fedora-directory-users or, via email, send a message with subject or body 'help' to fedora-directory-users-request@redhat.com
You can reach the person managing the list at fedora-directory-users-owner@redhat.com
When replying, please edit your Subject line so it is more specific than "Re: Contents of Fedora-directory-users digest..."
Today's Topics:
- pam_ldap with SSL/TLS (t b)
- RE: pam_ldap with SSL/TLS (Morris, Patrick)
- Re: pam_ldap with SSL/TLS (Richard Megginson)
- Problem with SSL console in X in specific circumstances (Philip Kime)
- FW: [Fedora-directory-users] Extracting details from ActiveDirectoryto FDS (Paxton, Darren)
- alias in fedora directory server (patrick ndjientcheu ngandjui)
- Re: FW: [Fedora-directory-users] Extracting details from ActiveDirectoryto FDS (Nicholas Byrne)
- Re: Memory usage (koniczynek)
- Re: Memory usage (David Boreham)
- Re: Memory usage (koniczynek)
Message: 1 Date: Thu, 30 Nov 2006 12:31:50 -0500 From: "t b" mxheadroom@hotmail.com Subject: [Fedora-directory-users] pam_ldap with SSL/TLS To: fedora-directory-users@redhat.com Message-ID: BAY116-F322745E96D702ED748B1D0CDDB0@phx.gbl Content-Type: text/plain; format=flowed
I am trying to setup pam_ldap to use TLS to communicate with the FDS, but having lots of problems doing so; it works if I use the unencrypted way but not if I use ldaps ( port 636 )
I used the instructions at, http://directory.fedora.redhat.com/wiki/Howto:PAM
Has anyone gotten PAM to work TLS
Thanks
Buy, Load, Play. The new Sympatico / MSN Music Store works seamlessly with Windows Media Player. Just Click PLAY. http://musicstore.sympatico.msn.ca/content/viewer.aspx?cid=SMS_Sept192006
Message: 2 Date: Thu, 30 Nov 2006 13:00:56 -0500 From: "Morris, Patrick" patrick.morris@hp.com Subject: RE: [Fedora-directory-users] pam_ldap with SSL/TLS To: "General discussion list for the Fedora Directory server project." fedora-directory-users@redhat.com Message-ID: CD18C81835E18A40A64C4A0D16A237BE05FE850D@ATAEXC01.americas.cpqcorp.net
Content-Type: text/plain; charset="US-ASCII"
I am trying to setup pam_ldap to use TLS to communicate with the FDS, but having lots of problems doing so; it works if I use the unencrypted way but not if I use ldaps ( port 636 )
Someone should jump in here and correct me if I'm wrong, but I believe it's normal for TLS connections to happen on the standard LDAP port. You should be able to tell from your logs whether the connection is encrypted or not.
Message: 3 Date: Thu, 30 Nov 2006 11:08:08 -0700 From: Richard Megginson rmeggins@redhat.com Subject: Re: [Fedora-directory-users] pam_ldap with SSL/TLS To: "General discussion list for the Fedora Directory server project." fedora-directory-users@redhat.com Message-ID: 456F1E08.40601@redhat.com Content-Type: text/plain; charset="iso-8859-1"
Morris, Patrick wrote:
I am trying to setup pam_ldap to use TLS to communicate with the FDS, but having lots of problems doing so; it works if I use the unencrypted way but not if I use ldaps ( port 636 )
Someone should jump in here and correct me if I'm wrong, but I believe it's normal for TLS connections to happen on the standard LDAP port. You should be able to tell from your logs whether the connection is encrypted or not.
Yes. The LDAP "preferred" way is to use the startTLS extended operation which starts a TLS session on the non-secure port. This will be logged in the access log.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
t b wrote:
My logs seem to indicate that the connection is being encrypted; I can ssh to a client server and get the password prompt, but when I enter the password it just returns me to the password prompt again
[01/Dec/2006:19:47:44 -0500] conn=650 fd=69 slot=69 connection from xxx.xxx.xxx.xxx to xxx.xxx.xxx.xxx [01/Dec/2006:19:47:44 -0500] conn=650 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [01/Dec/2006:19:47:44 -0500] conn=650 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [01/Dec/2006:19:47:44 -0500] conn=650 SSL 256-bit AES
All of this means the client was able to successfully perform the startTLS extended operation and start using SSL.
[01/Dec/2006:19:47:44 -0500] conn=650 op=1 UNBIND [01/Dec/2006:19:47:44 -0500] conn=650 op=1 fd=69 closed - U1
The UNBIND means the client had a problem and closed the connection. Does the client print any errors? Are there any messages in the server error log?
If I disable TLS everything works fine, the client server can query the FDS and auth the client properly
I am not sure if the problem has to do with the pam_ldap not properly formatted or the cert file not in proper format
Does anyone have an example of what the pam_ldap config should look like? or suggestions on checking whether the cert file is in proper format
I'm not sure. PAM needs the ca cert of the CA that issued the directory server server cert. See http://directory.fedora.redhat.com/wiki/Howto:SSL for more information.
Also what's the UNBIND shown in the logs?
Thanks
From: fedora-directory-users-request@redhat.com Reply-To: fedora-directory-users@redhat.com To: fedora-directory-users@redhat.com Subject: Fedora-directory-users Digest, Vol 19, Issue 1 Date: Fri, 1 Dec 2006 12:00:06 -0500 (EST)
Send Fedora-directory-users mailing list submissions to fedora-directory-users@redhat.com
To subscribe or unsubscribe via the World Wide Web, visit https://www.redhat.com/mailman/listinfo/fedora-directory-users or, via email, send a message with subject or body 'help' to fedora-directory-users-request@redhat.com
You can reach the person managing the list at fedora-directory-users-owner@redhat.com
When replying, please edit your Subject line so it is more specific than "Re: Contents of Fedora-directory-users digest..."
Today's Topics:
- pam_ldap with SSL/TLS (t b)
- RE: pam_ldap with SSL/TLS (Morris, Patrick)
- Re: pam_ldap with SSL/TLS (Richard Megginson)
- Problem with SSL console in X in specific circumstances (Philip Kime)
- FW: [Fedora-directory-users] Extracting details from ActiveDirectoryto FDS (Paxton, Darren)
- alias in fedora directory server (patrick ndjientcheu ngandjui)
- Re: FW: [Fedora-directory-users] Extracting details from ActiveDirectoryto FDS (Nicholas Byrne)
- Re: Memory usage (koniczynek)
- Re: Memory usage (David Boreham)
- Re: Memory usage (koniczynek)
Message: 1 Date: Thu, 30 Nov 2006 12:31:50 -0500 From: "t b" mxheadroom@hotmail.com Subject: [Fedora-directory-users] pam_ldap with SSL/TLS To: fedora-directory-users@redhat.com Message-ID: BAY116-F322745E96D702ED748B1D0CDDB0@phx.gbl Content-Type: text/plain; format=flowed
I am trying to setup pam_ldap to use TLS to communicate with the FDS, but having lots of problems doing so; it works if I use the unencrypted way but not if I use ldaps ( port 636 )
I used the instructions at, http://directory.fedora.redhat.com/wiki/Howto:PAM
Has anyone gotten PAM to work TLS
Thanks
Buy, Load, Play. The new Sympatico / MSN Music Store works seamlessly with Windows Media Player. Just Click PLAY. http://musicstore.sympatico.msn.ca/content/viewer.aspx?cid=SMS_Sept192006
Message: 2 Date: Thu, 30 Nov 2006 13:00:56 -0500 From: "Morris, Patrick" patrick.morris@hp.com Subject: RE: [Fedora-directory-users] pam_ldap with SSL/TLS To: "General discussion list for the Fedora Directory server project." fedora-directory-users@redhat.com Message-ID: CD18C81835E18A40A64C4A0D16A237BE05FE850D@ATAEXC01.americas.cpqcorp.net
Content-Type: text/plain; charset="US-ASCII"
I am trying to setup pam_ldap to use TLS to communicate with the FDS, but having lots of problems doing so; it works if I use the unencrypted way but not if I use ldaps ( port 636 )
Someone should jump in here and correct me if I'm wrong, but I believe it's normal for TLS connections to happen on the standard LDAP port. You should be able to tell from your logs whether the connection is encrypted or not.
Message: 3 Date: Thu, 30 Nov 2006 11:08:08 -0700 From: Richard Megginson rmeggins@redhat.com Subject: Re: [Fedora-directory-users] pam_ldap with SSL/TLS To: "General discussion list for the Fedora Directory server project." fedora-directory-users@redhat.com Message-ID: 456F1E08.40601@redhat.com Content-Type: text/plain; charset="iso-8859-1"
Morris, Patrick wrote:
I am trying to setup pam_ldap to use TLS to communicate with the FDS, but having lots of problems doing so; it works if I use the unencrypted way but not if I use ldaps ( port 636 )
Someone should jump in here and correct me if I'm wrong, but I believe it's normal for TLS connections to happen on the standard LDAP port. You should be able to tell from your logs whether the connection is encrypted or not.
Yes. The LDAP "preferred" way is to use the startTLS extended operation which starts a TLS session on the non-secure port. This will be logged in the access log.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
-------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3178 bytes Desc: S/MIME Cryptographic Signature Url : https://www.redhat.com/archives/fedora-directory-users/attachments/20061130/...
Message: 4 Date: Thu, 30 Nov 2006 18:02:55 -0800 From: "Philip Kime" pkime@Shopzilla.com Subject: [Fedora-directory-users] Problem with SSL console in X in specific circumstances To: fedora-directory-users@redhat.com Message-ID: 9C0091F428E697439E7A773FFD083427435BE3@szexchange.Shopzilla.inc Content-Type: text/plain; charset="us-ascii"
Here's the problem:
Running startconsole (SSL) to a remote display on a PC X-server (xwin32) works fine and requires that my windows home dir on the PC X-server machine has .fedora-console/ containing cert8.db and key3.db, as you'd expect. If I rename this dir, the console hangs at the splash screen. So far, so good, all makes sense.
If I try the same thing to cygwin's X server on same machine or to an X server on a Mac running OSX, startconsole always hangs as if it can't find ~/.fedora-console on the local machine. I've tried copying this dir to what cygwin/OSX thinks is the user's home dir but no luck. Where should I put the Cert db files under "real" UNIX X to get the SSL console to work? Also tried ~/.mmc as per the docs but I could never get this to work.
PK
-- Philip Kime NOPS Systems Architect 310 401 0407
-------------- next part -------------- An HTML attachment was scrubbed... URL: https://www.redhat.com/archives/fedora-directory-users/attachments/20061130/...
Message: 5 Date: Fri, 1 Dec 2006 08:04:30 -0000 From: "Paxton, Darren" Darren.Paxton@mercer.com Subject: FW: [Fedora-directory-users] Extracting details from ActiveDirectoryto FDS To: Fedora-directory-users@redhat.com Message-ID: 52F7C07B119CF4439B7EFBFE0FB3256B027CBD02@eidwpexms06.mercer.com Content-Type: text/plain; charset="us-ascii"
Skipped content of type multipart/alternative-------------- next part
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
Message: 6 Date: Fri, 1 Dec 2006 08:10:42 +0000 (GMT) From: patrick ndjientcheu ngandjui tchen_pat@yahoo.fr Subject: [Fedora-directory-users] alias in fedora directory server To: Fedora-directory-users@redhat.com Message-ID: 20061201081042.78578.qmail@web25801.mail.ukl.yahoo.com Content-Type: text/plain; charset="iso-8859-1"
Hi, I would like to know how to use alias in fedora directory server.It seems that it is used for point to another entry in the directory,but i don't know how to use this feature.May someone helps me on this issue? I would really appreciate an example.
Thanks
Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com -------------- next part -------------- An HTML attachment was scrubbed... URL: https://www.redhat.com/archives/fedora-directory-users/attachments/20061201/...
Message: 7 Date: Fri, 01 Dec 2006 11:50:13 +0000 From: Nicholas Byrne nicholas.byrne@quadriga.com Subject: Re: FW: [Fedora-directory-users] Extracting details from ActiveDirectoryto FDS To: "General discussion list for the Fedora Directory server project." fedora-directory-users@redhat.com Message-ID: 457016F5.5030202@quadriga.com Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Your messages got through - you can confirm by checking the archives - https://www.redhat.com/archives/fedora-directory-users/
I'm a new user as well so i'm afraid i can't answer your question, but if you keep asking i'm sure someone will know! Nick
Paxton, Darren wrote:
Apologies for mailing yet again, however either my messages are not getting through (something I don't believe as I keep getting the post to the mailing list) - or for some reason, no one is willing to even acknowledge my issue.
In the spirit of the community - can someone at least acknowledge a message as I find it quite disheartening that I have had no replies at all even if just to point me somewhere for assistance.
*From:* fedora-directory-users-bounces@redhat.com [mailto:fedora-directory-users-bounces@redhat.com] *On Behalf Of *Paxton, Darren *Sent:* 30 November 2006 08:46 *To:* General discussion list for the Fedora Directory server project. *Subject:* RE: [Fedora-directory-users] Extracting details from ActiveDirectoryto FDS
Hi
Has anyone had any thoughts on my query or can point me in the right direction?
As is the nature of AD, I would have thought it is possible to extract this information using a scope setting or something similar.
Thanks
Darren
*From:* fedora-directory-users-bounces@redhat.com [mailto:fedora-directory-users-bounces@redhat.com] *On Behalf Of *Paxton, Darren *Sent:* 24 November 2006 14:56 *To:* fedora-directory-users@redhat.com *Subject:* [Fedora-directory-users] Extracting details from Active Directoryto FDS Hi all, I've been tinkering with integrating our Linux devices into our AD domain for some time and I've hit a few brick walls, however I've recently discovered FDS and the synchronisation features with AD. I've managed to set up a few replication jobs, however due to the extensive nature of our AD, I've realised that the sync only takes the group and user objects from the OU or CN being specified. Is there any way I can specify that it should traverse all subtrees of an OU and extract all that information back into FDS? Thanks Darren -- Darren Paxton EMEA Tier2 Red Hat Certified Engineer VMware Certified Professional MGTI Centralised opsThis e-mail and any attachments may be confidential or legally privileged.If you received this message in error or are not the intended recipient, you should destroy the email message and any attachments or copies, and you are prohibited from retaining, distributing, disclosing or using any information contained herein. Please inform us of the erroneous delivery by return e-mail. Thank you for your co-operation.
Mercer Human Resource Consulting Limited is authorised and regulated by the Financial Services Authority. Registered in England No. 984275. Registered Office: 1 Tower Place West, Tower Place, London, EC3R 5BU.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
This e-mail is the property of Quadriga Worldwide Ltd, intended for the addressee only and confidential. Any dissemination, copying or distribution of this message or any attachments is strictly prohibited.
If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer.
Messages sent to and from Quadriga may be monitored.
Quadriga cannot guarantee any message delivery method is secure or error-free. Information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses.
We do not accept responsibility for any errors or omissions in this message and/or attachment that arise as a result of transmission.
You should carry out your own virus checks before opening any attachment.
Any views or opinions presented are solely those of the author and do not necessarily represent those of Quadriga.
Message: 8 Date: Fri, 01 Dec 2006 16:45:28 +0100 From: koniczynek koniczynek@uaznia.net Subject: Re: [Fedora-directory-users] Memory usage To: "General discussion list for the Fedora Directory server project." fedora-directory-users@redhat.com Message-ID: 45704E18.3070705@uaznia.net Content-Type: text/plain; charset=ISO-8859-2; format=flowed
Richard Megginson napisa³(a):
This is an excellent cache/memory tuning document from a Sun employee, primarily targeted to Sun DS users, but almost all of the
information is
relevant to Fedora DS (since they share a common lineage).
Lets say I heven't got much time lately so without thinking I've changed in dse.ldif nsslapd-import-cache-autosize from -1 to 1 and after restarting I've started to receive errors like: "3 Time limit exceeded" Someone do know what to do? ;)
-- xmpp/email: koniczynek@uaznia.net xmpp/email: koniczynek@gmail.com
Message: 9 Date: Fri, 01 Dec 2006 09:15:14 -0700 From: David Boreham david_list@boreham.org Subject: Re: [Fedora-directory-users] Memory usage To: "General discussion list for the Fedora Directory server project." fedora-directory-users@redhat.com Message-ID: 45705512.4070808@boreham.org Content-Type: text/plain; charset=ISO-8859-2; format=flowed
koniczynek wrote:
Richard Megginson napisa³(a):
This is an excellent cache/memory tuning document from a Sun employee, primarily targeted to Sun DS users, but almost all of the information is relevant to Fedora DS (since they share a common lineage).
Lets say I heven't got much time lately so without thinking I've changed in dse.ldif nsslapd-import-cache-autosize from -1 to 1 and after restarting I've started to receive errors like: "3 Time limit exceeded" Someone do know what to do? ;)
Change it back ?
Message: 10 Date: Fri, 01 Dec 2006 17:53:22 +0100 From: koniczynek koniczynek@uaznia.net Subject: Re: [Fedora-directory-users] Memory usage To: "General discussion list for the Fedora Directory server project." fedora-directory-users@redhat.com Message-ID: 45705E02.7020709@uaznia.net Content-Type: text/plain; charset=ISO-8859-2
David Boreham, dnia 2006-12-01 17:15 napisal:
Lets say I heven't got much time lately so without thinking I've changed in dse.ldif nsslapd-import-cache-autosize from -1 to 1 and after restarting I've started to receive errors like: "3 Time limit exceeded" Someone do know what to do? ;)
Change it back ?
man, please, show some respect ;) I did change it back, but to no avail. Also I can say (to stop further questions): yes, I've stopped the server before change.
-- email/xmpp: koniczynek@uaznia.net
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
End of Fedora-directory-users Digest, Vol 19, Issue 1
Off to school, going on a trip, or moving? Windows Live (MSN) Messenger lets you stay in touch with friends and family wherever you go. Click here to find out how to sign up! http://www.telusmobility.com/msnxbox/
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
389-users@lists.fedoraproject.org
-
Rich Megginson -
t b