Steven Jones wrote: Have you seen this: http://directory.fedoraproject.org/wiki/Howto:PAM - search for ssh

Is this the correct rpm to use on RHAS4-32bit-U5? fedora-ds-1.0.4-1.RHEL4.i386.opt.rpm Are there any dependencies on the server and clients not installed by default? I have everything installed that I can see documented but its possible I have missed something, or there is an un-documented change as version upgrade. How practical is it to rip out any RHAS4 ldap client modules software and install Fedora ones? Are there different password hash mechanisms between versions? If so how do I check for these? These might seem odd Q's but I'm kinda desperate as to why I cannot get the system working.... regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272 -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Steven Jones Sent: Tuesday, 11 September 2007 8:31 a.m. To: General discussion list for the Fedora Directory server project. Subject: RE: [Fedora-directory-users] ssh login fail Yes. Thanks, I have this page book marked. Content looks identical to what I have...I have spent days on this googling with no joy. Since a Debian LDAP client also does not work I suspect it is a server side FDS mis-configuration and not client side, but I could be wrong. Previously I had a Debian Openldap setup working and that was fine. So it looks like something is missing/broken in FDS. I find it interesting that yours is the only reply for what I assume is a default type of problem....suggests a poor likelihood of the product being supportable long term.... regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272 -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Richard Megginson Sent: Tuesday, 11 September 2007 3:31 a.m. To: General discussion list for the Fedora Directory server project. Subject: Re: [Fedora-directory-users] ssh login fail Steven Jones wrote: Have you seen this: http://directory.fedoraproject.org/wiki/Howto:PAM - search for ssh ------------------------------------------------------------------------ -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

Steven Jones wrote: Yes. rpm installation should tell you if you are missing some dependency of the server. I have no idea. Fedora DS versions? If so, yes. I believe Fedora DS 7.1 supported only SHA, SSHA, and crypt. Fedora DS 1.0.1 added MD5. Fedora DS 1.0.4 added support for SHA and SSHA 256, 384, and 512.

Hi, See below. Regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272 -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Patrick Morris Sent: Tuesday, 11 September 2007 9:01 a.m. To: General discussion list for the Fedora Directory server project. Subject: Re: [Fedora-directory-users] ssh login fail Hi Steven! On Mon, 10 Sep 2007, Steven Jones wrote: its as how get Configuration of EL4 with FDS is normally dirt-simple, if you use authconfig. All I've ever had to do is give it the server address and where to look, and off it went. Thanks, I started by hand and recently re-ran using the authconfig tool and the gtk version... I am pretty much convinced/agree that it should be very simple, I have read so many docs all saying the same thing that I am assuming I have missed read or mis-understood some really easy setting that causes this.....OpenLdap on Debian certainly was easy so it is likely I have either missed something, hit a terminal bug or I am doing the wrong thing. If you're getting an error that the server can't be contacted, it seems that maybe auth isn't correctly configured (or you have more basic network issues). I can do a ldapsearch at the command line on the client which returns info The problem is also in login, so I am pretty sure it is a pam client issue....or encryption.... Eg., ============== [root@vuwunicvfwall02 pam.d]# ldapsearch -x -h 130.195.87.249 -b dc=vuw,dc=ac,dc=nz # extended LDIF # # LDAPv3 # base <dc=vuw,dc=ac,dc=nz> with scope sub # filter: (objectclass=*) # requesting: ALL # # vuw.ac.nz dn: dc=vuw,dc=ac,dc=nz objectClass: top objectClass: domain dc: vuw # Directory Administrators, vuw.ac.nz dn: cn=Directory Administrators, dc=vuw,dc=ac,dc=nz objectClass: top objectClass: groupofuniquenames cn: Directory Administrators # Groups, vuw.ac.nz dn: ou=Groups, dc=vuw,dc=ac,dc=nz objectClass: top objectClass: organizationalunit ou: Groups # People, vuw.ac.nz dn: ou=People, dc=vuw,dc=ac,dc=nz objectClass: top objectClass: organizationalunit ou: People # Special Users, vuw.ac.nz dn: ou=Special Users,dc=vuw,dc=ac,dc=nz objectClass: top objectClass: organizationalUnit ou: Special Users description: Special Administrative Accounts # Accounting Managers, groups, vuw.ac.nz dn: cn=Accounting Managers,ou=groups,dc=vuw,dc=ac,dc=nz objectClass: top objectClass: groupOfUniqueNames cn: Accounting Managers ou: groups description: People who can manage accounting entries # HR Managers, groups, vuw.ac.nz dn: cn=HR Managers,ou=groups,dc=vuw,dc=ac,dc=nz objectClass: top objectClass: groupOfUniqueNames cn: HR Managers ou: groups description: People who can manage HR entries # QA Managers, groups, vuw.ac.nz dn: cn=QA Managers,ou=groups,dc=vuw,dc=ac,dc=nz objectClass: top objectClass: groupOfUniqueNames cn: QA Managers ou: groups description: People who can manage QA entries # PD Managers, groups, vuw.ac.nz dn: cn=PD Managers,ou=groups,dc=vuw,dc=ac,dc=nz objectClass: top objectClass: groupOfUniqueNames cn: PD Managers ou: groups description: People who can manage engineer entries # search result search: 2 result: 0 Success # numResponses: 10 # numEntries: 9 ============== Thanks, I started by hand and recently re-ran using the authconfig tool... The most likely cause, off the top of my head, would be trying to using something like ldaps://ldapserver.yourdomain.com without having configured the server for SSL. As far as I know I am not running ssl but it is possible one end is and the other is not, however FDS is not set to do so in the gui and the client has no setting I can see beyond //etc/ldap.conf saying "ssl no". Hmmm possibly I have my test user in the wrong place in LDAP and hence I get a null return....cant see how to check for this though.... Regards Steven

Steven Jones wrote: err=32 means no such object. That is, ou=Group,dc=cognifide,dc=pl does not exist. In your file above, you have suffix "dc=vuw,dc=ac,dc=nz" Do you have ou=Groups,dc=vuw,dc=ac,dc=nz ?

Steven Jones wrote: ldapsearch -x -b dc=vuw,dc=ac,dc=nz Will see if dc=vuw,dc=ac,dc=nz exists and if there is any data there. I'm not sure what you mean by "positive password return".

Steven Jones wrote: I hope not. It really should do an LDAP BIND operation, which means it sends the clear text password to the server in the BIND request (for simple username/password auth). So, try ldapsearch -x -D "uid=someuser,ou=People,dc=vuw,dc=ac,dc=nz" -w thepasssword -s base -b "" That will test to see if that user exists and that the password is correct. looking in the wrong place would be my guess, based on the err=32 in the previous logs you posted.

I am getting things like this, but I did not enter them, so these are some sort of defaults? 8><-------- # PD Managers, groups, vuw.ac.nz dn: cn=PD Managers,ou=groups,dc=vuw,dc=ac,dc=nz objectClass: top objectClass: groupOfUniqueNames cn: PD Managers ou: groups description: People who can manage engineer entries 8><-------- Yet I cannot find then under the FDS gui.... regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272 -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Steven Jones Sent: Tuesday, 11 September 2007 12:41 p.m. To: General discussion list for the Fedora Directory server project. Subject: RE: [Fedora-directory-users] ssh login fail There you go, Looks like it is not in the right place in FDS....or it is but LDAP is looking in the wrong place... root@vuwunicvfwall02 openldap]# ldapsearch -x -D "uid=jonesst1,ou=People,dc=vuw,dc=ac,dc=nz" -w xxxxx -s base -b "" ldap_bind: No such object (32) matched DN: ou=people,dc=vuw,dc=ac,dc=nz [root@vuwunicvfwall02 openldap]# ldapsearch -x -D "uid=jonesst1,dc=vuw,dc=ac,dc=nz" -w xxxxx -s base -b "" ldap_bind: No such object (32) matched DN: dc=vuw,dc=ac,dc=nz ho hum.... regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272 -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Richard Megginson Sent: Tuesday, 11 September 2007 11:59 a.m. To: General discussion list for the Fedora Directory server project. Subject: Re: [Fedora-directory-users] ssh login fail Steven Jones wrote: to I hope not. It really should do an LDAP BIND operation, which means it sends the clear text password to the server in the BIND request (for simple username/password auth). So, try ldapsearch -x -D "uid=someuser,ou=People,dc=vuw,dc=ac,dc=nz" -w thepasssword -s base -b "" That will test to see if that user exists and that the password is correct. or looking in the wrong place would be my guess, based on the err=32 in the previous logs you posted. -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

looking in the wrong place would be my guess, based on the err=32 in the previous logs you posted. I seem to have been able to stop the err=32 by reconfiguring ldap.conf a bit and cleaning out FDS and I assume putting the user in the right place but still no login. [11/Sep/2007:16:21:47 +1200] conn=30 fd=78 slot=78 connection from 130.195.87.246 to 130.195.87.249 [11/Sep/2007:16:21:47 +1200] conn=30 op=0 BIND dn="" method=128 version=3 [11/Sep/2007:16:21:47 +1200] conn=30 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [11/Sep/2007:16:21:47 +1200] conn=30 op=1 SRCH base="ou=People,dc=vuw,dc=ac,dc=nz" scope=2 filter="(&(objectClass=posixAccount)(uid=jonesst1))" attrs=ALL [11/Sep/2007:16:21:47 +1200] conn=30 op=1 RESULT err=0 tag=101 nentries=0 etime=0 [11/Sep/2007:16:21:47 +1200] conn=30 op=2 BIND dn="" method=128 version=3 [11/Sep/2007:16:21:47 +1200] conn=30 op=2 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [11/Sep/2007:16:21:47 +1200] conn=30 op=3 SRCH base="ou=People,dc=vuw,dc=ac,dc=nz" scope=2 filter="(&(objectClass=posixAccount)(uid=jonesst1))" attrs=ALL [11/Sep/2007:16:21:47 +1200] conn=30 op=3 RESULT err=0 tag=101 nentries=0 etime=0 [11/Sep/2007:16:21:51 +1200] conn=30 op=4 BIND dn="" method=128 version=3 [11/Sep/2007:16:21:51 +1200] conn=30 op=4 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [11/Sep/2007:16:21:51 +1200] conn=30 op=5 SRCH base="ou=People,dc=vuw,dc=ac,dc=nz" scope=2 filter="(&(objectClass=posixAccount)(uid=jonesst1))" attrs=ALL [11/Sep/2007:16:21:51 +1200] conn=30 op=5 RESULT err=0 tag=101 nentries=0 etime=0 [11/Sep/2007:16:21:51 +1200] conn=30 op=6 BIND dn="" method=128 version=3 [11/Sep/2007:16:21:51 +1200] conn=30 op=6 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [11/Sep/2007:16:21:51 +1200] conn=30 op=7 SRCH base="ou=People,dc=vuw,dc=ac,dc=nz" scope=2 filter="(&(objectClass=posixAccount)(uid=jonesst1))" attrs=ALL [11/Sep/2007:16:21:51 +1200] conn=30 op=7 RESULT err=0 tag=101 nentries=0 etime=0 [11/Sep/2007:16:21:56 +1200] conn=30 op=8 BIND dn="" method=128 version=3 [11/Sep/2007:16:21:56 +1200] conn=30 op=8 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [11/Sep/2007:16:21:56 +1200] conn=30 op=9 SRCH base="ou=People,dc=vuw,dc=ac,dc=nz" scope=2 filter="(&(objectClass=posixAccount)(uid=jonesst1))" attrs=ALL [11/Sep/2007:16:21:56 +1200] conn=30 op=9 RESULT err=0 tag=101 nentries=0 etime=0 [11/Sep/2007:16:21:56 +1200] conn=30 op=10 BIND dn="" method=128 version=3 [11/Sep/2007:16:21:56 +1200] conn=30 op=10 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [11/Sep/2007:16:21:56 +1200] conn=30 op=11 SRCH base="ou=People,dc=vuw,dc=ac,dc=nz" scope=2 filter="(&(objectClass=posixAccount)(uid=jonesst1))" attrs=ALL [11/Sep/2007:16:21:56 +1200] conn=30 op=11 RESULT err=0 tag=101 nentries=0 etime=0 [11/Sep/2007:16:21:58 +1200] conn=30 op=13 UNBIND [11/Sep/2007:16:21:58 +1200] conn=30 op=13 fd=78 closed - U1 [11/Sep/2007:16:22:46 +1200] conn=31 fd=78 slot=78 connection from 130.195.87.246 to 130.195.87.249 [11/Sep/2007:16:22:46 +1200] conn=31 op=0 BIND dn="uid=jonesst1,ou=People,dc=vuw,dc=ac,dc=nz" method=128 version=3 [11/Sep/2007:16:22:46 +1200] conn=31 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=jonesst1,ou=people,dc=vuw,dc=ac,dc=nz" [11/Sep/2007:16:22:46 +1200] conn=31 op=1 SRCH base="" scope=0 filter="(objectClass=*)" attrs=ALL [11/Sep/2007:16:22:46 +1200] conn=31 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [11/Sep/2007:16:22:46 +1200] conn=31 op=2 UNBIND [11/Sep/2007:16:22:46 +1200] conn=31 op=2 fd=78 closed - U1 [11/Sep/2007:16:22:52 +1200] conn=32 fd=78 slot=78 connection from 130.195.87.246 to 130.195.87.249 [11/Sep/2007:16:22:52 +1200] conn=32 op=0 BIND dn="" method=128 version=3 [11/Sep/2007:16:22:52 +1200] conn=32 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [11/Sep/2007:16:22:52 +1200] conn=32 op=1 SRCH base="uid=jonesst1,ou=People,dc=vuw,dc=ac,dc=nz" scope=2 filter="(objectClass=*)" attrs=ALL [11/Sep/2007:16:22:52 +1200] conn=32 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [11/Sep/2007:16:22:52 +1200] conn=32 op=2 UNBIND [11/Sep/2007:16:22:52 +1200] conn=32 op=2 fd=78 closed - U1

Steven Jones wrote: Yes. By default, Fedora DS setup will create some organizational entries for you. If you do not want to do this, you can run setup in Custom mode and tell it to not add these entries. Try changing your identity in the console to cn=Directory Manager. Under the File menu, select the option to login as another user. Or use the Tasks tab - there is a button there to do the same thing.

On Tue, 2007-09-11 at 14:44 +1200, Steven Jones wrote: Your account does not have any posixAccount attributes defined. -Steve

Steven Jones wrote: Rarely, and only for advanced users. Typical is the default because it is the most useful, and most people usually want the default entries like ou=People. Please consider contributing them to the Fedora DS wiki.

B*gger me.... # jonesst1, People, vuw.ac.nz dn: uid=jonesst1, ou=People, dc=vuw,dc=ac,dc=nz uid: jonesst1 givenName: steven objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetorgperson objectClass: posixAccount sn: jones cn: steven jones uidNumber: 500 gidNumber: 500 homeDirectory: /home/jonesst1 loginShell: /bin/bash I must have had multiple issues and initially I created accounts with a posix user but later as I had re-done fully it sooo many times, I stopped bothering....not realising it could have been an issue. SO I just setup the posix account settings (as shown above) and ssh login now works.... ****slaps self repeatedly***** So under the ssh howtos there needs to be at least some pre-requsits ie full posix setup.... Thanks.... regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272 -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Steve Rigler Sent: Wednesday, 12 September 2007 1:44 a.m. To: General discussion list for the Fedora Directory server project. Subject: RE: [Fedora-directory-users] ssh login fail On Tue, 2007-09-11 at 14:44 +1200, Steven Jones wrote: Your account does not have any posixAccount attributes defined. -Steve -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

Thanks, like a dictionary, google only retunrs useful stuff if you know what to look for...a bit catch 22. Some of the docs I did read only covered ssh, and while yes it is probably a wider issue, leaving this point out of an ssh setup page is an issue... regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272 -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Steve Rigler Sent: Thursday, 13 September 2007 12:17 a.m. To: General discussion list for the Fedora Directory server project. Subject: RE: [Fedora-directory-users] ssh login fail On Wed, 2007-09-12 at 10:07 +1200, Steven Jones wrote: a ie I wouldn't consider this a "ssh setup" issue. You'd probably finally plenty of helpful info googling for LDAP NIS replacement. This would translate into a setup that would work for ssh. -Steve -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

Anybody got some good URLs or docs? regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272

Since it appears the LDAP server was stuffed, I re-installed it and again followed the instructions, now I find that in attempting to re-start the server it will not....so I have had to re-install again. So this particular set of instructions, http://www.redhat.com/docs/manuals/dir-server/ag/7.1/ssl.html#1085091 breaks the setup.... So is there a set of instructions to setup a self certified SSL server? regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272 -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Steven Jones Sent: Thursday, 13 September 2007 3:01 p.m. To: General discussion list for the Fedora Directory server project. Subject: [Fedora-directory-users] Setting a self ssl certificate While following the RDS manual to make a self cert, the last command is to convert the certification database, 8><----- 9. Run pk12util to convert the certificate database to pkcs12 format, so it is accessible by the Directory Server: /serverRoot/shared/bin/pk12util -d . -o cert.pk12 -n Server-Cert It then asks me for, "Enter Password or Pin for "NSS Certificate DB":" Which I have no idea about....the password I have been using does not work so I have no idea what this password is! So where would I find it/set it, or am I using the wrong manual and if so what is the correct one? regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272 -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

Steven Jones wrote: How so? Any errors? How so? Did you see this - http://directory.fedoraproject.org/wiki/Howto:SSL The ssl.html above should mostly work, except for the NOTE under the link to ssl.html at http://directory.fedoraproject.org/wiki/Howto:SSL#Basic_Steps If http://directory.fedoraproject.org/wiki/Howto:SSL doesn't work for you, try http://www.csse.uwa.edu.au/~ashley/fedora-ds/fedora-ds-26072006.html which is also listed on the Howto:SSL page.

Steven Jones wrote: How so? Wont start, cannot access. Any errors? I never looked for logs, simply re-installed FDS, I'm getting good at it. How so? Following the RH page seemed to trash the setup so a start/restart failed. Also trying to login to the admin server failed...I suspect replacing the two keys under alias/ broke "something". Did you see this - http://directory.fedoraproject.org/wiki/Howto:SSL I found it last night while googl'ing from home after work, will work through it this morning. The ssl.html above should mostly work, except for the NOTE under the link to ssl.html at http://directory.fedoraproject.org/wiki/Howto:SSL#Basic_Steps server? If http://directory.fedoraproject.org/wiki/Howto:SSL doesn't work for you, try http://www.csse.uwa.edu.au/~ashley/fedora-ds/fedora-ds-26072006.html which is also listed on the Howto:SSL page. Ditto, I found that as well. Regards Steven

Errors while following, http://directory.fedoraproject.org/wiki/Howto:SSL # ../shared/bin/certutil -S -n "CA certificate" -s \ Generating key. This may take a few moments... certutil-bin: could not obtain certificate from file: DER-encoded message contained extra unused data. Does this mean anything? Followed by this error, [root@vuwunicvfdsm001 alias]# ../shared/bin/certutil -S -n "Server-Cert" -s\ Generating key. This may take a few moments... certutil-bin: could not find certificate named "CA certificate": security library: bad database. certutil-bin: unable to create cert (security library: bad database.) [root@vuwunicvfdsm001 alias]# Does this mean anything? The contents of alias/ are, [root@vuwunicvfdsm001 alias]# ls -l total 608 -rw------- 1 nobody nobody 65536 Sep 14 09:27 admin-serv-vuwunicvfdsm001-cert8.db -rw------- 1 nobody nobody 16384 Sep 14 09:27 admin-serv-vuwunicvfdsm001-key3.db -rw------- 1 root root 65536 Sep 14 09:46 cert8.db -rw------- 1 root root 16384 Sep 14 09:46 key3.db -rwxr-xr-x 1 nobody nobody 239744 Nov 8 2006 libnssckbi.so -rw-r--r-- 1 nobody nobody 62 Sep 14 09:44 noise.txt -rw------- 1 nobody nobody 65536 Sep 13 15:43 orig-slapd-vuwunicvfdsm001-cert8.db -rw------- 1 nobody nobody 16384 Sep 13 15:43 orig-slapd-vuwunicvfdsm001-key3.db -rw-r--r-- 1 nobody nobody 9 Sep 13 15:43 pwdfile.txt -rw------- 1 nobody nobody 16384 Sep 13 15:33 secmod.db -rw------- 1 nobody nobody 65536 Sep 13 15:33 slapd-vuwunicvfdsm001-cert8.db -rw------- 1 nobody nobody 16384 Sep 14 09:29 slapd-vuwunicvfdsm001-key3.db -rw-r----- 1 nobody nobody 416 Sep 14 09:27 tempcert -rw-r----- 1 nobody nobody 345 Sep 14 09:27 tempcertreq It is possible that since I generated some keys earlier there is some "residue" that needs removing? Secmod.db? Tempcert? Tempcertreq? Regards Steven

Attempting to run steps 9 and 10 I get failures, [root@vuwunicvfdsm001 alias]# ../shared/bin/pk12util -d . -P slapd-serverID- -o cacert.pfx -n "CA certificate" Enter Password or Pin for "NSS Certificate DB": pk12util-bin: find user certs from nickname failed: security library: bad database. [root@vuwunicvfdsm001 alias]# ../shared/bin/pk12util -d . -P slapd-serverID- -o servercert.pfx -n Server-Cert Enter Password or Pin for "NSS Certificate DB": pk12util-bin: find user certs from nickname failed: security library: bad database. [root@vuwunicvfdsm001 alias]# regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272

[root@vuwunicvfdsm001 slapd-vuwunicvfdsm001]# ./start-slapd Enter PIN for Internal (Software) Token: After installing a ssl certificate I now need to enter a password every time I start it, how to negate this need? [root@vuwunicvfdsm001 slapd-vuwunicvfdsm001]# ./start-slapd Enter PIN for Internal (Software) Token: [root@vuwunicvfdsm001 slapd-vuwunicvfdsm001]# cd ../ [root@vuwunicvfdsm001 fedora-ds]# ./startconsole -u admin -a http://vuwunicvfdsm001.vuw.ac.nz:54200/ & [1] 3244 [root@vuwunicvfdsm001 fedora-ds]# Regards Steven

Steven Jones wrote: I've never seen this error message before. I'm not sure what it means. Do you have a cert8.db and a key3.db in this directory? They should have been created by a previous step. It means the previous step failed, and you cannot continue until it is resolved. That's possible. Did you already have a CA certificate? Generated automatically by NSS if it doesn't exist. Not sure what these are.

Steven Jones wrote: Yes. This is correct. However, this step is not really necessary, it's only used in order to backup your newly generated private key material in a portable format. This step is not needed in order to activate SSL in the server. The setupssl.sh script http://directory.fedoraproject.org/wiki/Howto:SSL#Script does this: pk12util -d $secdir $prefixarg -o $secdir/adminserver.p12 -n server-cert -w $secdir/pwdfile.txt -k $secdir/pwdfile.txt There are two passwords. -w is the password used to encrypt the key material in the pk12 file. -k is the password for your key database, from where the private key is extracted. So you could do something like this (assuming you created a file pwdfile.txt with your password): pk12util -d . -o cert.pk12 -n Server-Cert -w pwdfile.txt -k pwdfile.txt This also assumes you use the same password for your key database as to encrypt your pk12 file. You can use or omit the -P slapd-serverID- step 8 does this: mv key3.db slapd-server-key3.db mv cert8.db slapd-server-cert8.db ln -s slapd-server-key3.db key3.db ln -s slapd-server-cert8.db cert8.db So you have both cert8.db and slapd-server-cert8.db which refer to the same file. So you can specify -P or omit it, it should not matter.

Steven Jones wrote: It looks like step 6 failed, so you have no CA certificate.

Steven Jones wrote: 1) You can use modutil to remove the password for your key/cert database: modutil -dbdir . -dbprefix slapd-serverID- -changepw 'NSS Certificate DB' Then just hit Enter for the new password. 2) You can create a pin.txt file cat > slapd-serverID-pin.txt Internal (Software) Token:thepasswordforyourkeydb ^D make sure the pin.txt file is owned by your server user (e.g. chown nobody:nobody) and is mode 0400

I checked DNS and it was indeed broken, but I am connecting to the IP, Fixing DNS still sees the same error on Debian. regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272 -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Richard Megginson Sent: Friday, 14 September 2007 1:35 p.m. To: General discussion list for the Fedora Directory server project. Subject: Re: [Fedora-directory-users] Setting up a Debian client for ssl Steven Jones wrote: I think this can happen if the server cert does not have a subject DN that starts with cn=foo.example.com, where foo.example.com is the FQDN of the directory server machine. Or, the server cert has a subject DN like this: cn=foo.example.com,.... and the client either cannot resolve (via DNS or /etc/hosts or whatever it says in the /etc/nsswitch.conf file) foo.example.com, or the reverse DNS lookup on the server's IP address does not resolve to foo.example.com

This looks broken?, 8><------ TLS: could not load client CA list (file:`',dir:`/etc/openldap/cacerts/'). TLS: error:0200A002:system library:opendir:No such file or directory ssl_cert.c:816 TLS: error:140D7002:SSL routines:SSL_add_dir_cert_subjects_to_stack:system lib ssl_cert.c:818 8><------ I tried cp'ing the file on the fds server, cp /opt/fedora-ds/alias/cacert.asc cacert.asc and changing the debian's client ldap.conf to, #TLS_CACERTDIR /etc/openldap/cacerts/ TLS_CACERT /etc/openldap/cacerts/cacert.asc But no joy.... ======================== vuwunicvdebian1:/etc/ldap# ldapsearch -d 1 -x -ZZ '(uid=jonesst1)' ldap_create ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 130.195.87.249:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 130.195.87.249:389 ldap_connect_timeout: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush: 31 bytes to sd 3 ldap_result ld 0x8057e30 msgid 1 ldap_chkResponseList ld 0x8057e30 msgid 1 all 1 ldap_chkResponseList returns ld 0x8057e30 NULL wait4msg ld 0x8057e30 msgid 1 (infinite timeout) wait4msg continue ld 0x8057e30 msgid 1 all 1 ** ld 0x8057e30 Connections: * host: 130.195.87.249 port: 389 (default) refcnt: 2 status: Connected last used: Fri Sep 14 14:32:25 2007 ** ld 0x8057e30 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 0x8057e30 Response Queue: Empty ldap_chkResponseList ld 0x8057e30 msgid 1 all 1 ldap_chkResponseList returns ld 0x8057e30 NULL ldap_int_select read1msg: ld 0x8057e30 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 95 contents: read1msg: ld 0x8057e30 msgid 1 message type extended-result ber_scanf fmt ({eaa) ber: read1msg: ld 0x8057e30 0 new referrals read1msg: mark request completed, ld 0x8057e30 msgid 1 request done: ld 0x8057e30 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eaa) ber: ber_scanf fmt (a) ber: ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (x) ber: ber_scanf fmt (}) ber: ldap_msgfree TLS: could not load client CA list (file:`',dir:`/etc/openldap/cacerts/'). TLS: error:0200A002:system library:opendir:No such file or directory ssl_cert.c:816 TLS: error:140D7002:SSL routines:SSL_add_dir_cert_subjects_to_stack:system lib ssl_cert.c:818 ldap_perror ldap_start_tls: Connect error (-11) additional info: Start TLS request accepted.Server willing to negotiate SSL. Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272 -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Richard Megginson Sent: Friday, 14 September 2007 2:29 p.m. To: General discussion list for the Fedora Directory server project. Subject: Re: [Fedora-directory-users] Setting up a Debian client for ssl Steven Jones wrote: Try -d 1 or -v arguments to ldapsearch Richard ssl whatever reverse

Steven Jones wrote: I'm not sure. It says "No such file or directory" - permissions? http://directory.fedoraproject.org/wiki/Howto:SSL#Configure_LDAP_clients

8><---- I'm not sure. It says "No such file or directory" - permissions? http://directory.fedoraproject.org/wiki/Howto:SSL#Configure_LDAP_clients 8><---- I tried changing permissions, [root@vuwunicvfdsm001 openldap]# ls -l total 16 drwxrwxrwx 2 root root 4096 Sep 14 14:38 cacerts -rw-r--r-- 1 root root 320 Aug 24 10:56 ldap.conf [root@vuwunicvfdsm001 openldap]# ls -l cacerts/ total 8 -rw-r--r-- 1 nobody nobody 619 Sep 14 12:49 5be5959f.0 -rw-r--r-- 1 nobody nobody 619 Sep 14 14:38 cacert.asc [root@vuwunicvfdsm001 openldap]# no joy, 8><---- TLS: could not load verify locations (file:`/etc/openldap/cacerts/5be5959f.0',dir:`/etc/openldap/cacerts/'). TLS: error:02001002:system library:fopen:No such file or directory bss_file.c:122 TLS: error:2006D080:BIO routines:BIO_new_file:no such file bss_file.c:125 TLS: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib by_file.c:274 ldap_perror ldap_start_tls: Connect error (-11) additional info: Start TLS request accepted.Server willing to negotiate SSL.

This is my pam_ldap.conf, I seem unable to get ssl to work....what am I missing? I also need to set ssl only so no plain text passwords are sent... #file copied from openldap syntax might have issues but seems to work. #but not in ssl mode # # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. host 130.195.87.249 base dc=vuw,dc=ac,dc=nz #ssl no # this syntax does not work --> ssl on ssl yes ssl start_tls pam_password exop #pam_password md5 HOST 130.195.87.249 BASE dc=vuw,dc=ac,dc=nz #nss_base_passwd ou=People,dc=vuw,dc=ac,dc=nz #nss_base_shadow ou=People,dc=vuw,dc=ac,dc=nz TLS_CACERTDIR /etc/openldap/cacerts/ TLS_CACERT /etc/openldap/cacerts/cacert.asc #TLS_CACERT /etc/openldap/cacerts/5be5959f.0 TLS_REQCERT allow #syntax not liked --> uri ldapi://130.195.87.249 URI ldap://ldap.vuw.ac.nz regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272

I seem unable to get this to work in anything but simple mode..... Here is my ldap.conf for RHAS4, URI ldap://ldap.vuw.ac.nz #host 130.195.87.249 base dc=vuw,dc=ac,dc=nz #ssl no #ssl on pam_password md5 #HOST 130.195.87.249 BASE dc=vuw,dc=ac,dc=nz TLS_CACERTDIR /etc/openldap/cacerts/ TLS_REQCERT allow Trying "ssl on" breaks ssh So has anyone got an example ldap.conf? Since Debian also wont ssl, it is possible the server is the issue..... regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272 -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Steven Jones Sent: Monday, 17 September 2007 10:20 a.m. To: General discussion list for the Fedora Directory server project. Subject: RE: [Fedora-directory-users] Setting up clients for ssl only? 8><---- Uh.....this means not a thing....where and how is it set? On the server? Client? Ie What and where is dse.ldif? You can set the nsslapd-port attribute in cn=config in dse.ldif to 0. 8><---- regards Steven -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

Steven Jones wrote: To rule out cert CA issues, set TLS_REQCERT to never. I don't think you can specify both TLS_CACERTDIR and TLS_CACERT - or maybe you can, but I always have problems when trying to use TLS_CACERTDIR

My /etc/ldap.conf now looks like this, # http://www.padl.com URI ldap://ldap.vuw.ac.nz #host 130.195.87.249 base dc=vuw,dc=ac,dc=nz #ssl no #ssl on pam_password md5 #HOST 130.195.87.249 BASE dc=vuw,dc=ac,dc=nz #tls_cacertdir /etc/openldap/cacerts tls_cacertfile /etc/openldap/cacerts/ca.crt #TLS_REQCERT allow TLS_REQCERT never host ldap.vuw.ac.nz ssl start_tls When I do, [root@vuwunicvfwall01 etc]# ldapsearch -x -ZZ '(uid=jonesst1)' # extended LDIF # # LDAPv3 # base <> with scope sub # filter: (uid=jonesst1) # requesting: ALL # # jonesst1, People, vuw.ac.nz dn: uid=jonesst1,ou=People,dc=vuw,dc=ac,dc=nz givenName: Steven sn: Jones loginShell: /bin/bash uidNumber: 500 gidNumber: 500 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetorgperson objectClass: posixAccount uid: jonesst1 cn: Steven Jones homeDirectory: /home/jonesst1 # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 [root@vuwunicvfwall01 etc]# Log file shows, [root@vuwunicvfdsm001 logs]# tail -f access [18/Sep/2007:05:46:37 +1200] conn=2326 fd=70 slot=70 connection from 130.195.87.250 to 130.195.87.249 [18/Sep/2007:05:46:37 +1200] conn=2326 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [18/Sep/2007:05:46:37 +1200] conn=2326 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [18/Sep/2007:05:46:37 +1200] conn=2326 SSL 256-bit AES [18/Sep/2007:05:46:37 +1200] conn=2326 op=1 BIND dn="" method=128 version=3 [18/Sep/2007:05:46:37 +1200] conn=2326 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [18/Sep/2007:05:46:37 +1200] conn=2326 op=2 SRCH base="dc=vuw,dc=ac,dc=nz" scope=2 filter="(uid=jonesst1)" attrs=ALL [18/Sep/2007:05:46:37 +1200] conn=2326 op=2 RESULT err=0 tag=101 nentries=1 etime=0 [18/Sep/2007:05:46:37 +1200] conn=2326 op=3 UNBIND [18/Sep/2007:05:46:37 +1200] conn=2326 op=3 fd=70 closed - U1 However ssh no longer works. The access log shows (it has "startTLS", which I guess is good), [18/Sep/2007:05:49:27 +1200] conn=2327 op=-1 fd=70 closed - Encountered end of file. [18/Sep/2007:05:49:52 +1200] conn=2328 fd=70 slot=70 connection from 130.195.87.250 to 130.195.87.249 [18/Sep/2007:05:49:52 +1200] conn=2328 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [18/Sep/2007:05:49:52 +1200] conn=2328 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [18/Sep/2007:05:50:00 +1200] conn=2329 fd=71 slot=71 connection from 127.0.0.1 to 127.0.0.1 [18/Sep/2007:05:50:00 +1200] conn=2329 op=0 BIND dn="" method=128 version=3 [18/Sep/2007:05:50:00 +1200] conn=2329 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [18/Sep/2007:05:50:00 +1200] conn=2329 op=1 SRCH base="dc=vuw,dc=ac,dc=nz" scope=2 filter="(&(objectClass=posixAccount)(uid=root))" attrs=ALL [18/Sep/2007:05:50:00 +1200] conn=2329 op=1 RESULT err=0 tag=101 nentries=0 etime=0 [18/Sep/2007:05:50:00 +1200] conn=2329 op=2 SRCH base="dc=vuw,dc=ac,dc=nz" scope=2 filter="(&(objectClass=posixGroup)(memberUid=root))" attrs="gidNumber" [18/Sep/2007:05:50:00 +1200] conn=2329 op=2 RESULT err=0 tag=101 nentries=0 etime=0 [18/Sep/2007:05:50:00 +1200] conn=2329 op=-1 fd=71 closed - B1 [18/Sep/2007:05:50:01 +1200] conn=2330 fd=71 slot=71 connection from 130.195.87.250 to 130.195.87.249 [18/Sep/2007:05:50:01 +1200] conn=2330 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [18/Sep/2007:05:50:01 +1200] conn=2330 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [18/Sep/2007:05:50:01 +1200] conn=2330 op=-1 fd=71 closed - Encountered end of file. [18/Sep/2007:05:50:01 +1200] conn=2331 fd=71 slot=71 connection from 130.195.87.246 to 130.195.87.249 [18/Sep/2007:05:50:01 +1200] conn=2331 op=0 BIND dn="" method=128 version=3 [18/Sep/2007:05:50:01 +1200] conn=2331 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [18/Sep/2007:05:50:01 +1200] conn=2331 op=1 SRCH base="ou=People,dc=vuw,dc=ac,dc=nz" scope=2 filter="(&(objectClass=posixAccount)(uid=root))" attrs=ALL [18/Sep/2007:05:50:01 +1200] conn=2331 op=1 RESULT err=0 tag=101 nentries=0 etime=0 [18/Sep/2007:05:50:01 +1200] conn=2331 op=2 SRCH base="ou=Groups,dc=vuw,dc=ac,dc=nz" scope=2 filter="(&(objectClass=posixGroup)(memberUid=root))" attrs="gidNumber" [18/Sep/2007:05:50:01 +1200] conn=2331 op=2 RESULT err=32 tag=101 nentries=0 etime=0 [18/Sep/2007:05:50:01 +1200] conn=2331 op=-1 fd=71 closed - B1 regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272 -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Richard Megginson Sent: Tuesday, 18 September 2007 2:01 a.m. To: General discussion list for the Fedora Directory server project. Subject: Re: [Fedora-directory-users] Setting up a Debian client for ssl Steven Jones wrote: To rule out cert CA issues, set TLS_REQCERT to never. I don't think you can specify both TLS_CACERTDIR and TLS_CACERT - or maybe you can, but I always have problems when trying to use TLS_CACERTDIR

I have almost have a debian client working but it has a small error, the first login fails but the second succeeds.... /etc/pam_ldap.conf looks like this, # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #pam_password exop BASE dc=vuw,dc=ac,dc=nz #URI ldap://ldap.vuw.ac.nz base dc=vuw,dc=ac,dc=nz #ssl no ssl on pam_password md5 BASE dc=vuw,dc=ac,dc=nz tls_cacertfile /etc/ssl/certs/ldap/ca.crt TLS_REQCERT allow #TLS_REQCERT never host ldap.vuw.ac.nz ssl start_tls log output for ssh connections has "startTLS", [root@vuwunicvfdsm001 logs]# > access [root@vuwunicvfdsm001 logs]# tail -f access [18/Sep/2007:07:19:26 +1200] conn=2409 fd=71 slot=71 connection from 130.195.87.235 to 130.195.87.249 [18/Sep/2007:07:19:26 +1200] conn=2409 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [18/Sep/2007:07:19:26 +1200] conn=2409 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [18/Sep/2007:07:19:26 +1200] conn=2409 SSL 256-bit AES [18/Sep/2007:07:19:30 +1200] conn=2409 op=2 BIND dn="" method=128 version=3 [18/Sep/2007:07:19:30 +1200] conn=2409 op=2 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [18/Sep/2007:07:19:30 +1200] conn=2409 op=3 SRCH base="dc=vuw,dc=ac,dc=nz" scope=2 filter="(uid=jonesst1)" attrs=ALL [18/Sep/2007:07:19:30 +1200] conn=2409 op=3 RESULT err=0 tag=101 nentries=1 etime=0 [18/Sep/2007:07:19:30 +1200] conn=2409 op=4 BIND dn="uid=jonesst1,ou=People,dc=vuw,dc=ac,dc=nz" method=128 version=3 [18/Sep/2007:07:19:30 +1200] conn=2409 op=4 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=jonesst1,ou=people,dc=vuw,dc=ac,dc=nz" [18/Sep/2007:07:19:30 +1200] conn=2409 op=5 BIND dn="" method=128 version=3 [18/Sep/2007:07:19:30 +1200] conn=2409 op=5 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [18/Sep/2007:07:19:30 +1200] conn=2409 op=6 UNBIND [18/Sep/2007:07:19:30 +1200] conn=2409 op=6 fd=71 closed - U1 So I just need to figure out why the first attempt fails but the second succeeds. Regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272