389-users November 2005

389-users@lists.fedoraproject.org

49 participants
71 discussions

[Fedora-directory-users] design docs of FDS?
by speedy zinc 21 Nov '05

21 Nov '05

Is there any design documents about the internals of FDS (that can be open sourced)? thanks sz __________________________________ Start your day with Yahoo! - Make it your home page! http://www.yahoo.com/r/hs

4 7

[Fedora-directory-users] Binary Download links borken on main site -- Any mirrors?
by Jackson, Jon 21 Nov '05

21 Nov '05

Hi, I've been trying to get ahold of the 1.0.2 binaries for FC4, but the link is dead (and is dead for FC3/RHEL4, FC2/RHEL3). Is there another place to get these? I've done some googling and can't seem to locate a mirror. And I can't seem to find a site maintainer's email address, so I'm reaching out to the users. How are you obtaining binaries? How finicky is the build process, If I were to build from the sources? Do the sources include the recently released tools? Thanks, JJ

3 3

RE: [Fedora-directory-users] Binary Download links borken on main site -- Any mirrors?
by Jackson, Jon 21 Nov '05

21 Nov '05

All, Richard had already responded to my first post, sorry for the dupe. Thanks Richard M for the information. --JJ

1 0

[Fedora-directory-users] what is LA/LAS?
by speedy zinc 21 Nov '05

21 Nov '05

I'm reading the ACL plugin code, and it mentioned about "LA" or "LAS". I grep the code of the whole DS, but couldn't really figure out what that is. Could someone give a brief explanation about that? thanks sz __________________________________ Yahoo! FareChase: Search multiple travel sites in one click. http://farechase.yahoo.com

2 1

[Fedora-directory-users] error and access logs
by Fernando D. Tardini 19 Nov '05

19 Nov '05

hello, can someone tell me what mean this acces log ] conn=49 op=5 RESULT err=0 tag=101 nentries=24 etime=0 [18/Nov/2005:00:07:43 -0300] conn=49 op=6 UNBIND [18/Nov/2005:00:07:43 -0300] conn=49 op=6 fd=68 closed - U1 [18/Nov/2005:00:17:49 -0300] conn=50 fd=67 slot=67 connection from 192.168.0.10 to 192.168.0.10 [18/Nov/2005:00:17:49 -0300] conn=50 op=0 BIND dn="cn=admin-serv-fedora-ldap, cn=Fedora Administration Server, cn=Server Group, cn=fedora-ldap.sotano.com, ou=sotano.com, o=NetscapeRoot" method=128 version=3 [18/Nov/2005:00:17:49 -0300] conn=50 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=admin-serv-fedora-ldap,cn=fedora administration server,cn=server group,cn=fedora-ldap.sotano.com,ou=sotano.com,o=netscaperoot" [18/Nov/2005:00:17:49 -0300] conn=50 op=1 BIND dn="uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot" method=128 version=3 [18/Nov/2005:00:17:49 -0300] conn=50 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot" [18/Nov/2005:00:17:49 -0300] conn=50 op=2 UNBIND [18/Nov/2005:00:17:49 -0300] conn=50 op=2 fd=67 closed - U1 [18/Nov/2005:00:17:49 -0300] conn=51 fd=68 slot=68 connection from 192.168.0.10 to 192.168.0.10 [18/Nov/2005:00:17:49 -0300] conn=51 op=0 BIND dn="uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot" method=128 version=3 [18/Nov/2005:00:17:49 -0300] conn=51 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot" [18/Nov/2005:00:17:49 -0300] conn=51 op=1 SRCH base="cn=statusping, cn=operation, cn=tasks, cn=admin-serv-fedora-ldap, cn=fedora administration server, cn=server group, cn=fedora-ldap.sotano.com, ou=sotano.com, o=netscaperoot" scope=0 filter="(nsExecRef=*)" attrs="nsExecRef nsLogSuppress" [18/Nov/2005:00:17:49 -0300] conn=51 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [18/Nov/2005:00:17:49 -0300] conn=51 op=2 SRCH base="cn=admin-serv-fedora-ldap, cn=Fedora Administration Server, cn=Server Group, cn=fedora-ldap.sotano.com, ou=sotano.com, o=NetscapeRoot" scope=2 filter="(nsExecRef=*)" attrs="nsExecRef nsLogSuppress" [18/Nov/2005:00:17:49 -0300] conn=51 op=2 RESULT err=0 tag=101 nentries=24 etime=0 [18/Nov/2005:00:17:49 -0300] conn=51 op=3 SRCH base="cn=slapd-fedora-ldap, cn=Fedora Directory Server, cn=Server Group, cn=fedora-ldap.sotano.com, ou=sotano.com, o=NetscapeRoot" scope=2 filter="(nsExecRef=*)" attrs="nsExecRef nsLogSuppress" [18/Nov/2005:00:17:49 -0300] conn=51 op=3 RESULT err=0 tag=101 nentries=13 etime=0 [18/Nov/2005:00:17:49 -0300] conn=51 op=4 SRCH base="cn=Fedora Directory Server, cn=Server Group, cn=fedora-ldap.sotano.com, ou=sotano.com, o=NetscapeRoot" scope=2 filter="(nsExecRef=*)" attrs="nsExecRef nsLogSuppress" [18/Nov/2005:00:17:49 -0300] conn=51 op=4 RESULT err=0 tag=101 nentries=17 etime=0 [18/Nov/2005:00:17:49 -0300] conn=51 op=5 SRCH base="cn=Fedora Administration Server, cn=Server Group, cn=fedora-ldap.sotano.com, ou=sotano.com, o=NetscapeRoot" scope=2 filter="(nsExecRef=*)" attrs="nsExecRef nsLogSuppress" [18/Nov/2005:00:17:49 -0300] conn=51 op=5 RESULT err=0 tag=101 nentries=24 etime=0 [18/Nov/2005:00:17:49 -0300] conn=51 op=6 UNBIND [18/Nov/2005:00:17:49 -0300] conn=51 op=6 fd=68 closed - U1 and this error log [13/Nov/2005:21:47:19 -0300] NSMMReplicationPlugin - agmt="cn=prueba" (192:389): Replica has no update vector. It has never been initialized. [13/Nov/2005:21:47:23 -0300] NSMMReplicationPlugin - agmt="cn=prueba" (192:389): Replica has no update vector. It has never been initialized. [13/Nov/2005:21:47:25 -0300] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn=prueba" (192:389)". [13/Nov/2005:21:47:29 -0300] - Entry "uid=Guest,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [13/Nov/2005:21:47:29 -0300] - Entry "uid=TsInternetUser,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [13/Nov/2005:21:47:29 -0300] - Entry "uid=Administrator,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [13/Nov/2005:21:47:29 -0300] - Entry "uid=krbtgt,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [13/Nov/2005:21:47:30 -0300] NSMMReplicationPlugin - Finished total update of replica "agmt="cn=prueba" (192:389)". Sent 19 entries. [13/Nov/2005:21:49:20 -0300] agmt="cn=prueba" (192:389) - Can't locate CSN 4370157b000114730000 in the changelog (DB rc=-30990). The consumer may need to be reinitialized. [13/Nov/2005:21:49:20 -0300] agmt="cn=prueba" (192:389) - Can't locate CSN 4370157b000114730000 in the changelog (DB rc=-30990). The consumer may need to be reinitialized. [13/Nov/2005:21:49:46 -0300] agmt="cn=prueba" (192:389) - Can't locate CSN 4370157b000114730000 in the changelog (DB rc=-30990). The consumer may need to be reinitialized. [13/Nov/2005:21:50:23 -0300] agmt="cn=prueba" (192:389) - Can't locate CSN 4370157b000114730000 in the changelog (DB rc=-30990). The consumer may need to be reinitialized. [13/Nov/2005:21:50:23 -0300] agmt="cn=prueba" (192:389) - Can't locate CSN 4370157b000114730000 in the changelog (DB rc=-30990). The consumer may need to be reinitialized. [13/Nov/2005:21:53:16 -0300] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn=prueba" (192:389)". [13/Nov/2005:21:53:17 -0300] - Entry "uid=Guest,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [13/Nov/2005:21:53:17 -0300] - Entry "uid=TsInternetUser,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [13/Nov/2005:21:53:17 -0300] - Entry "uid=Administrator,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [13/Nov/2005:21:53:17 -0300] - Entry "uid=krbtgt,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [13/Nov/2005:21:53:18 -0300] NSMMReplicationPlugin - Finished total update of replica "agmt="cn=prueba" (192:389)". Sent 19 entries. [13/Nov/2005:22:02:49 -0300] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn=prueba" (192:389)". [13/Nov/2005:22:02:49 -0300] - Entry "uid=Guest,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [13/Nov/2005:22:02:49 -0300] - Entry "uid=TsInternetUser,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [13/Nov/2005:22:02:49 -0300] - Entry "uid=Administrator,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [13/Nov/2005:22:02:49 -0300] - Entry "uid=krbtgt,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [13/Nov/2005:22:02:50 -0300] NSMMReplicationPlugin - Finished total update of replica "agmt="cn=prueba" (192:389)". Sent 19 entries. [13/Nov/2005:22:14:46 -0300] NSMMReplicationPlugin - failed to send dirsync search request: 2 [13/Nov/2005:22:39:46 -0300] NSMMReplicationPlugin - failed to send dirsync search request: 2 [13/Nov/2005:23:14:46 -0300] NSMMReplicationPlugin - failed to send dirsync search request: 2 [13/Nov/2005:23:19:46 -0300] NSMMReplicationPlugin - failed to send dirsync search request: 2 [13/Nov/2005:23:44:46 -0300] NSMMReplicationPlugin - failed to send dirsync search request: 2 [13/Nov/2005:23:54:46 -0300] NSMMReplicationPlugin - failed to send dirsync search request: 2 [17/Nov/2005:21:30:28 -0300] - Fedora-Directory/7.1 B2005.146.2010 starting up [17/Nov/2005:21:30:28 -0300] - Detected Disorderly Shutdown last time Directory Server was running, recovering database. [17/Nov/2005:21:30:32 -0300] - _csngen_parse_state: replica id mismatch; current id - 65535, replica id in the state - 5235 [17/Nov/2005:21:30:32 -0300] NSMMReplicationPlugin - _replica_init_from_config: failed to create csn generator for replica (cn=replica,cn=\22dc=sotano,dc=com\22,cn=mapping tree,cn=config) [17/Nov/2005:21:30:32 -0300] NSMMReplicationPlugin - Unable to configure replica dc=sotano,dc=com: failed to create csn generator for replica (cn=replica,cn=\22dc=sotano,dc=com\22,cn=mapping tree,cn=config) [17/Nov/2005:21:30:32 -0300] - slapd started. Listening on All Interfaces port 389 for LDAP requests [17/Nov/2005:21:35:16 -0300] NSMMReplicationPlugin - agmt_delete: begin [17/Nov/2005:21:35:49 -0300] NSMMReplicationPlugin - replica_config_modify: replica does not exist for dc=sotano,dc=com [17/Nov/2005:21:40:40 -0300] NSMMReplicationPlugin - agmt="cn=prueb" (organiza-a6b090:389): Replica has no update vector. It has never been initialized. [17/Nov/2005:21:40:40 -0300] NSMMReplicationPlugin - agmt="cn=prueb" (organiza-a6b090:389): Replica has no update vector. It has never been initialized. [17/Nov/2005:21:40:44 -0300] NSMMReplicationPlugin - agmt="cn=prueb" (organiza-a6b090:389): Replica has no update vector. It has never been initialized. [17/Nov/2005:21:40:47 -0300] NSMMReplicationPlugin - agmt="cn=prueb" (organiza-a6b090:389): Replica has no update vector. It has never been initialized. [17/Nov/2005:21:40:51 -0300] NSMMReplicationPlugin - agmt="cn=prueb" (organiza-a6b090:389): Replica has no update vector. It has never been initialized. [17/Nov/2005:21:40:55 -0300] NSMMReplicationPlugin - agmt="cn=prueb" (organiza-a6b090:389): Replica has no update vector. It has never been initialized. [17/Nov/2005:21:40:56 -0300] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn=prueb" (organiza-a6b090:389)". [17/Nov/2005:21:40:57 -0300] - Entry "uid=Guest,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [17/Nov/2005:21:40:57 -0300] - Entry "uid=TsInternetUser,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [17/Nov/2005:21:40:57 -0300] - Entry "uid=Administrator,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [17/Nov/2005:21:40:57 -0300] - Entry "uid=krbtgt,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [17/Nov/2005:21:40:58 -0300] NSMMReplicationPlugin - Finished total update of replica "agmt="cn=prueb" (organiza-a6b090:389)". Sent 20 entries. [17/Nov/2005:21:53:30 -0300] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn=prueb" (organiza-a6b090:389)". [17/Nov/2005:21:53:31 -0300] - Entry "uid=Guest,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [17/Nov/2005:21:53:31 -0300] - Entry "uid=TsInternetUser,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [17/Nov/2005:21:53:31 -0300] - Entry "uid=Administrator,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [17/Nov/2005:21:53:31 -0300] - Entry "uid=krbtgt,ou=People, dc=sotano,dc=com" missing attribute "sn" required by object class "person" [17/Nov/2005:21:53:31 -0300] NSMMReplicationPlugin - IsValidOperation: NULL operation CSN [17/Nov/2005:21:53:31 -0300] NSMMReplicationPlugin - write_changelog_and_ruv: can't add a change for uid=perroloco,ou=people,dc=sotano,dc=com (uniqid: ea326606-1dd111b2-8061a9f6-0b080000, optype: 8) to changelog csn [17/Nov/2005:21:53:32 -0300] NSMMReplicationPlugin - Finished total update of replica "agmt="cn=prueb" (organiza-a6b090:389)". Sent 21 entries. [17/Nov/2005:22:15:40 -0300] NSMMReplicationPlugin - failed to send dirsync search request: 2 [17/Nov/2005:22:30:40 -0300] NSMMReplicationPlugin - agmt="cn=prueb" (organiza-a6b090:389): Simple bind failed, LDAP sdk error 91 (Can't connect to the LDAP server), Netscape Portable Runtime error -5973 (A directory lookup on a network address has failed.) [17/Nov/2005:22:35:40 -0300] NSMMReplicationPlugin - agmt="cn=prueb" (organiza-a6b090:389): Simple bind resumed [17/Nov/2005:22:50:40 -0300] NSMMReplicationPlugin - failed to send dirsync search request: 2 [17/Nov/2005:23:00:40 -0300] NSMMReplicationPlugin - failed to send dirsync search request: 2 [17/Nov/2005:23:10:40 -0300] NSMMReplicationPlugin - failed to send dirsync search request: 2 [17/Nov/2005:23:25:40 -0300] NSMMReplicationPlugin - failed to send dirsync search request: 2 [17/Nov/2005:23:50:40 -0300] NSMMReplicationPlugin - failed to send dirsync search request: 2 thanks a lot

1 0

RE: [Fedora-directory-users] Account expiration on Solaris 2.8 doesnotwork.
by Tay, Gary 18 Nov '05

18 Nov '05

I believe the ACL and another one, see related post, are added by SUN DS5.2 "idsconfig" command (iPlanet Directory Server Config), since FDS7.1 does not provide this command, these two ACLs do not exist, you could simply add them in at the "dc=example,dc=com" (defaultSearchBase) level, using copy and paste and manual editing mode. See related post: https://www.redhat.com/archives/fedora-directory-users/2005-July/msg00133.h… I have seen Account Management features like account lockout, account pw reset leading to user forced pw change, and account expiration working on Solaris Native LDAP Client libraries, if you use OpenLDAP+PADL Client libraries, I do not what will be in for you, most likely it won't work. I highly recommend the use of Native Client libs, or else when SUN changes something your hard worked craft may not be working anymore. Gary -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com on behalf of Vsevolod (Simon) Ilyushchenko Sent: Sat 11/19/2005 2:49 AM To: General discussion list for the Fedora Directory server project. Cc: Subject: Re: [Fedora-directory-users] Account expiration on Solaris 2.8 doesnotwork. Gary, You totally rule! Thanks! I'll try patching next week. BTW - I'm not using native Solaris client, I have installed the Openldap client libraries. How do I change the ACL below? If I select "access permissions" menu item on the dc=example,dc=com, I get a window with the following ACls defined: Enable anonymous access Enable self write for common attributes Configuration Administrator Configuration Administrator Group Directory Administrator Group SIE Group I can also add new ACLs, but I'm not sure how to find the one you are referring to. Thanks, Simon > 1) Did you change this ACL? this is a workaround to make pam_ldap work with account management. > > In FDS, open Directory Server, select defaultSearchBase, i.e. dc=example,dc=com and edit one of the listed ACIs, which is usually named “LDAP_Naming_Services_proxy_password_read”: > > Change it. > > From: > (target="ldap:///dc=example,dc=com")(targetattr="userPa ssword")(version 3.0; acl LDAP_Naming_Services_proxy_password_read; allow (compare,read,search) userdn = "ldap:///cn=proxyagent,ou=profile,dc=example,dc=com" ;)<http://swforum.sun.com/jive/images/emoticons/wink.gif> > > To: > (target="ldap:///dc=example,dc=com")(targetattr="us erPassword")(version 3.0; acl LDAP_Naming_Services_proxy_password_read; allow (compare,search) userdn = ldap:///cn=proxyagent,ou=profile,dc=example,dc=com ;)<http://swforum.sun.com/jive/images/emoticons/wink.gif> > > > 2) After creating user entry, did you add "posixAccount" as well as "shadowAccount" to them in admin. console? and enter values for uidNumber and gidNumber posixAccount attributes. > > 3) Make VERY sure that your user entry contains VALID homeDirectory path and loginShell. > > 4) If netgroup compat mode is used on Solaris8 Native LDAP Client, you got to blank out 2nd and 3rd fields of all +@netgroupX lines, eg: > > +@netgroup1 <mailto:+@netgroup1> :::::::: > +@netgroup2 <mailto:+@netgroup2> :::::::: > > 5) Make sure LDAP domain name in /etc/defautdomain is defined at Solaris8 LDAP Client, and a nisDomainObject "example.com" exists at the root entry of the LDAP DIT. > > # echo "example.com" >/etc/defaultdomain > # domainname `cat /etc/defaultdomain` > > 6) Check that passwordStorageScheme in cn=config is "crypt" > > Gary > > -----Original Message----- > From: fedora-directory-users-bounces(a)redhat.com on behalf of Vsevolod (Simon) Ilyushchenko > Sent: Sat 11/19/2005 1:26 AM > To: General discussion list for the Fedora Directory server project. > Cc: > Subject: [Fedora-directory-users] Account expiration on Solaris 2.8 does notwork. > > > > Hi, > > I have successfully configured a Solaris 2.8 box to use FDS as the > authentication server. However, one detail eludes me. > > I'd like to be able to inactivate accounts. This feature works fine with > Linux clients. With Solaris, I can get either LDAP inactivation or local > accounts work. :( > > If I have this in pam.conf, then the LDAP accounts are locked out > correctly, but local accounts don't work at all! > > other account requisite pam_roles.so.1 > other account required pam_unix_account.so.1 server_policy > other account required pam_ldap.so > > If I run ssh -d -d -d to a local account, it tells me: > debug3: PAM: do_pam_account pam_acct_mgmt = 13 (No account present for user) > > On the other hand, if I have this in pam.conf (and that's what Gary > Tay's guide recommends), than local accounts work fine, but I have a > locked LDAP account that accepts ANY password: > > other account requisite pam_roles.so.1 > other account binding pam_unix_account.so.1 server_policy > other account required pam_ldap.so > > Is there a particular patch set, perhaps, that would solve this? > > Thanks, > Simon > -- > > Simon (Vsevolod ILyushchenko) simonf(a)cshl.edu > http://www.simonf.com > > "Think like a man of action, act like a man of thought." > > Henri Bergson > > -- > Fedora-directory-users mailing list > Fedora-directory-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > > > > ------------------------------------------------------------------------ > > -- > Fedora-directory-users mailing list > Fedora-directory-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users -- Simon (Vsevolod ILyushchenko) simonf(a)cshl.edu http://www.simonf.com "Think like a man of action, act like a man of thought." Henri Bergson -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

1 0

[Fedora-directory-users] Missing packages
by Jackson, Jon 18 Nov '05

18 Nov '05

Hi Community, It seems like the http://directory.fedora.redhat.com/downloads/* packages are missing. All of the links for binary packages are not working. Did these get moved, and the Wiki is not caught up yet? Is there a mirror for these packages? Thanks in advance, --JJ

2 1

RE: [Fedora-directory-users] Account expiration on Solaris 2.8 does notwork.
by Tay, Gary 18 Nov '05

18 Nov '05

While trying it against SUN ONE DS5.2, it actually worked, and below are the lessons learned: 0) Make sure Solaris8 Native LDAP Client has latest kernel and LDAP Patch 108993-49. 1) Did you change this ACL? this is a workaround to make pam_ldap work with account management. In FDS, open Directory Server, select defaultSearchBase, i.e. dc=example,dc=com and edit one of the listed ACIs, which is usually named “LDAP_Naming_Services_proxy_password_read”: Change it. From: (target="ldap:///dc=example,dc=com")(targetattr="userPa ssword")(version 3.0; acl LDAP_Naming_Services_proxy_password_read; allow (compare,read,search) userdn = "ldap:///cn=proxyagent,ou=profile,dc=example,dc=com" ;)<http://swforum.sun.com/jive/images/emoticons/wink.gif> To: (target="ldap:///dc=example,dc=com")(targetattr="us erPassword")(version 3.0; acl LDAP_Naming_Services_proxy_password_read; allow (compare,search) userdn = ldap:///cn=proxyagent,ou=profile,dc=example,dc=com ;)<http://swforum.sun.com/jive/images/emoticons/wink.gif> 2) After creating user entry, did you add "posixAccount" as well as "shadowAccount" to them in admin. console? and enter values for uidNumber and gidNumber posixAccount attributes. 3) Make VERY sure that your user entry contains VALID homeDirectory path and loginShell. 4) If netgroup compat mode is used on Solaris8 Native LDAP Client, you got to blank out 2nd and 3rd fields of all +@netgroupX lines, eg: +@netgroup1 <mailto:+@netgroup1> :::::::: +@netgroup2 <mailto:+@netgroup2> :::::::: 5) Make sure LDAP domain name in /etc/defautdomain is defined at Solaris8 LDAP Client, and a nisDomainObject "example.com" exists at the root entry of the LDAP DIT. # echo "example.com" >/etc/defaultdomain # domainname `cat /etc/defaultdomain` 6) Check that passwordStorageScheme in cn=config is "crypt" Gary -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com on behalf of Vsevolod (Simon) Ilyushchenko Sent: Sat 11/19/2005 1:26 AM To: General discussion list for the Fedora Directory server project. Cc: Subject: [Fedora-directory-users] Account expiration on Solaris 2.8 does notwork. Hi, I have successfully configured a Solaris 2.8 box to use FDS as the authentication server. However, one detail eludes me. I'd like to be able to inactivate accounts. This feature works fine with Linux clients. With Solaris, I can get either LDAP inactivation or local accounts work. :( If I have this in pam.conf, then the LDAP accounts are locked out correctly, but local accounts don't work at all! other account requisite pam_roles.so.1 other account required pam_unix_account.so.1 server_policy other account required pam_ldap.so If I run ssh -d -d -d to a local account, it tells me: debug3: PAM: do_pam_account pam_acct_mgmt = 13 (No account present for user) On the other hand, if I have this in pam.conf (and that's what Gary Tay's guide recommends), than local accounts work fine, but I have a locked LDAP account that accepts ANY password: other account requisite pam_roles.so.1 other account binding pam_unix_account.so.1 server_policy other account required pam_ldap.so Is there a particular patch set, perhaps, that would solve this? Thanks, Simon -- Simon (Vsevolod ILyushchenko) simonf(a)cshl.edu http://www.simonf.com "Think like a man of action, act like a man of thought." Henri Bergson -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

2 1

RE: [Fedora-directory-users] Account expiration on Solaris 2.8 does notwork.
by Tay, Gary 18 Nov '05

18 Nov '05

Point 4, I meant those lines in /etc/shadow. 4) If netgroup compat mode is used on Solaris8 Native LDAP Client, you got to blank out 2nd and 3rd fields of all +@netgroupX lines in /etc/shadow, eg: +@netgroup1 <mailto:+@netgroup1> :::::::: +@netgroup2 <mailto:+@netgroup2> :::::::: See also: http://swforum.sun.com/jive/thread.jspa?threadID=52764&tstart=15 Configuring LDAP netgroups (related account expiration/reset/force password change bug was also discussed). Gary -----Original Message----- From: Tay, Gary on behalf of Tay, Gary Sent: Sat 11/19/2005 2:11 AM To: General discussion list for the Fedora Directory server project. Cc: Subject: RE: [Fedora-directory-users] Account expiration on Solaris 2.8 does notwork. While trying it against SUN ONE DS5.2, it actually worked, and below are the lessons learned: 0) Make sure Solaris8 Native LDAP Client has latest kernel and LDAP Patch 108993-49. 1) Did you change this ACL? this is a workaround to make pam_ldap work with account management. In FDS, open Directory Server, select defaultSearchBase, i.e. dc=example,dc=com and edit one of the listed ACIs, which is usually named “LDAP_Naming_Services_proxy_password_read”: Change it. From: (target="ldap:///dc=example,dc=com")(targetattr="userPa ssword")(version 3.0; acl LDAP_Naming_Services_proxy_password_read; allow (compare,read,search) userdn = "ldap:///cn=proxyagent,ou=profile,dc=example,dc=com" ;)<http://swforum.sun.com/jive/images/emoticons/wink.gif> To: (target="ldap:///dc=example,dc=com")(targetattr="us erPassword")(version 3.0; acl LDAP_Naming_Services_proxy_password_read; allow (compare,search) userdn = ldap:///cn=proxyagent,ou=profile,dc=example,dc=com ;)<http://swforum.sun.com/jive/images/emoticons/wink.gif> 2) After creating user entry, did you add "posixAccount" as well as "shadowAccount" to them in admin. console? and enter values for uidNumber and gidNumber posixAccount attributes. 3) Make VERY sure that your user entry contains VALID homeDirectory path and loginShell. 4) If netgroup compat mode is used on Solaris8 Native LDAP Client, you got to blank out 2nd and 3rd fields of all +@netgroupX lines, eg: +@netgroup1 <mailto:+@netgroup1> :::::::: +@netgroup2 <mailto:+@netgroup2> :::::::: 5) Make sure LDAP domain name in /etc/defautdomain is defined at Solaris8 LDAP Client, and a nisDomainObject "example.com" exists at the root entry of the LDAP DIT. # echo "example.com" >/etc/defaultdomain # domainname `cat /etc/defaultdomain` 6) Check that passwordStorageScheme in cn=config is "crypt" Gary -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com on behalf of Vsevolod (Simon) Ilyushchenko Sent: Sat 11/19/2005 1:26 AM To: General discussion list for the Fedora Directory server project. Cc: Subject: [Fedora-directory-users] Account expiration on Solaris 2.8 does notwork. Hi, I have successfully configured a Solaris 2.8 box to use FDS as the authentication server. However, one detail eludes me. I'd like to be able to inactivate accounts. This feature works fine with Linux clients. With Solaris, I can get either LDAP inactivation or local accounts work. :( If I have this in pam.conf, then the LDAP accounts are locked out correctly, but local accounts don't work at all! other account requisite pam_roles.so.1 other account required pam_unix_account.so.1 server_policy other account required pam_ldap.so If I run ssh -d -d -d to a local account, it tells me: debug3: PAM: do_pam_account pam_acct_mgmt = 13 (No account present for user) On the other hand, if I have this in pam.conf (and that's what Gary Tay's guide recommends), than local accounts work fine, but I have a locked LDAP account that accepts ANY password: other account requisite pam_roles.so.1 other account binding pam_unix_account.so.1 server_policy other account required pam_ldap.so Is there a particular patch set, perhaps, that would solve this? Thanks, Simon -- Simon (Vsevolod ILyushchenko) simonf(a)cshl.edu http://www.simonf.com "Think like a man of action, act like a man of thought." Henri Bergson -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

1 0

[Fedora-directory-users] Account expiration on Solaris 2.8 does not work.
by Vsevolod (Simon) Ilyushchenko 18 Nov '05

18 Nov '05

Hi, I have successfully configured a Solaris 2.8 box to use FDS as the authentication server. However, one detail eludes me. I'd like to be able to inactivate accounts. This feature works fine with Linux clients. With Solaris, I can get either LDAP inactivation or local accounts work. :( If I have this in pam.conf, then the LDAP accounts are locked out correctly, but local accounts don't work at all! other account requisite pam_roles.so.1 other account required pam_unix_account.so.1 server_policy other account required pam_ldap.so If I run ssh -d -d -d to a local account, it tells me: debug3: PAM: do_pam_account pam_acct_mgmt = 13 (No account present for user) On the other hand, if I have this in pam.conf (and that's what Gary Tay's guide recommends), than local accounts work fine, but I have a locked LDAP account that accepts ANY password: other account requisite pam_roles.so.1 other account binding pam_unix_account.so.1 server_policy other account required pam_ldap.so Is there a particular patch set, perhaps, that would solve this? Thanks, Simon -- Simon (Vsevolod ILyushchenko) simonf(a)cshl.edu http://www.simonf.com "Think like a man of action, act like a man of thought." Henri Bergson

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2005