389-users November 2005

389-users@lists.fedoraproject.org

49 participants
71 discussions

[Fedora-directory-users] ssl probleme with ldapsearch
by basile 18 Nov '05

18 Nov '05

i generate rootCA and servercertificate with openssl and import them in fedora console it works fine and i can use tls with /opt/fedora/shared/bin/ldapsearch but when i use ldapsearch of openldap package i can t have it recognize server certificate i give path to cacert in /etc/openldap/ldap.conf and /etc/ldap.conf i give path to /opt/fedora-ds/alias in same files nothing work thanks for help basile

1 1

[Fedora-directory-users] Winsync - passwords?
by Dean Jones 18 Nov '05

18 Nov '05

Hey everyone, I have setup winsync between FDS and AD and just want to clarify a few points that i can't find in the docs or older posts.. 1. Passwords. They do not appear to be syncing either direction but i don't have SSL enabled. my guess is that this is normal? 2. Accounts. They are only syncing from AD -> FDS but i'm assuming this is also due to lack of SSL? 3. Existing users. If i have identical users setup on both my FDS and AD servers and then do a sync, what will happen? just a password sync? Has anyone done this before? thanks!

4 3

[Fedora-directory-users] binary release
by Roman Portrait 17 Nov '05

17 Nov '05

Where can I download Fedora Directory server for Solaris 8 or 9? Thanks, RM --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

1 0

Re: Re: [Fedora-directory-users] ssl client authentication
by Michael Montgomery 17 Nov '05

17 Nov '05

Thank you very much for your response. I just have a couple more questions so I can be sure I know what I'm talking about. > the directory server (your SSL server) replies with the certificate chain which includes > the CA certificate, and the self-signed SSL certificate." I'm assuming the 'self-signed SSL cerificate' is the client's ssl certificate I imported into the SSL server's store, and NOT the server's own client certificate? > you should have the SSL certificate imported into your SSL client's security database, > and it should be marked as trusted (i.e -t "CT,CT,CT"). Is there any documentation on how to do this with a RHEL4 server? The only things that come to mind are the openssl dirs '/usr/share/ssl/*', and possibly installing the certutil package on this machine...(but how would the ldap.conf file reference this, and even know about it... I'm curious about integration) >Another way to do this is to sign your SSL server certificate with your self-signed CA > certificate, and import your CA certificate into your SSL client's security database. I'm assuming you're talking about this option to Sign/Validate a self-signed cert: -V Validate a certificate -n cert-name The nickname of the cert to Validate -b time validity time ("YYMMDDHHMMSS[+HHMM|-HHMM|Z]") -e Check certificate signature -u certusage Specify certificate usage: C SSL Client V SSL Server S Email signer R Email Recipient -d certdir Cert database directory (default is ~/.netscape) -P dbprefix Cert & Key database prefix -X force the database to open R/W But then there's still the above question of how to import it into clients... Once again, thank you very much for your answers up to this point, as they were quite helpful. Michael.

1 0

[Fedora-directory-users] questions on ssl and certutil
by basile 17 Nov '05

17 Nov '05

hi i have ssl enable in my directory server and it works fine i use redhat documentation to do that with certutil but i have a few questions for a good understanding of ssl in fds 1) i have two files slapd-myserver-cert8.db and slapd-myserver-key3.db are they the key and self-signed certificate for directory server , or are they files ( databases ) where thoses key and certificates are stored 2) i want to enable ssl in fedora console and in redhat documentation i have to generate new certificates . How can i use first certificate to signed this new ( if i do 4 5 and 7 step in redhat documenation i got an error , but i m not sure of the syntax i have to use ) , how can i generate clients certificate , how can i generate new server certificate ? i find redhat documentation not very clear for this subject ( but so clear on many others :) if someone can explain me exactly how it works and how to generate new certificates thanks basile

1 0

Re: [Fedora-directory-users] MD5 for password hashes
by Del 16 Nov '05

16 Nov '05

Hi, I did some digging on this issue. I suspect I have found a bug in Fedora Directory Server handling the importing of MD5 passwords, either that or the current download versions don't support MD5. The results are as follows: -- Run this command on OpenLDAP to set a user's password: ldappasswd -x -D 'uid=root,ou=People,dc=babel,dc=com,dc=au' -W -S 'uid=del,ou=People,dc=babel,dc=com,dc=au' Do a simple ldapsearch as that user, to verify that the password is correct: ldapsearch -x -D 'uid=del,ou=People,dc=babel,dc=com,dc=au' -W 'uid=del' If you have set your OpenLDAP permissions to be relatively transparent, the above ldapsearch will show a base64 representation of your password hash. It looks like this: userPassword:: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= You can un-base64 this hash with the following simple perl script: #!/usr/bin/perl # # Usage: $0 string # use MIME::Base64; my $data = $ARGV[0]; print("Input string is " . $data . "n"); $decoded = decode_base64($data); print("Decoded string is " . $decoded . "n"); You will see that the password contains the prefix {MD5}, which looks like this: Decoded string is {MD5}asdfasdfasdfasdfasdf== Import your OpenLDAP directory into Fedora Directory Server. I used LdapImport for this although I also tried it with ldif2db. What happens during the process of LdapImport is: * Passwords of type {CRYPT} are transferred across OK to the FedoraDirectoryServer. * Passwords of type {MD5} appear in the FedoraDirectoryServer as strings beginning with {SSHA}. This can be verified by examining the directory using GQ or a similar LDAP tool, while bound as "cn=Directory Manager". * Attempts to authenticate with the original password now fail. * Attempting to authenticate as the full MD5 string (i.e. use the hash string '{MD5}asdfasdf...==' as extracted from the OpenLDAP server as the password for Fedora Directory Server) in fact works. I expect that what has happened is that Fedora Directory Server has failed to recognise the {MD5} at the beginning of the string as a valid hash mechanism and re-encoded the entire string as an SSHA hash. I see that on the FDS wiki there is mention of MD5 hashing support being added on June 15th. I have fedora-ds-7.1-2.RHEL4 installed from the RPM I downloaded from the FDS web site. How do I verify that this version should have the MD5 support, or do I need a more recent version? -- Del

3 9

[Fedora-directory-users] Directory server
by Fernando D. Tardini 16 Nov '05

16 Nov '05

Hello, i apology for my english, I'm from argentina and some technicals words i don't understand it verywell. This is really simple, i have installed fc4 and the DS for this distribution and all work perfectly. Now i have a 2003 Active Directory server and i have to make a sync with this two. I enable de replica in the directory server, and don't give any error, and I install the PassSync.msi in the 2003 server and i configured all and seem to work but don't sync the password, and i don´t get any log error. I created the user cn=replication manager,cn=config in the DS. Now i have some questions that i don´t understan verywell: 1- what base do i have to put in the passSync to look for, a base of the AD or the DS.? I mean the base where the passsync look for changes i supouse. 2- the PassSync work only with ssl or without ssl work too? 3- what is the supplier dn in the replication panel and what is the format ? I think that i have write it wrong and write the wrong supplier dn. 4- how the DS sync with the AD if I configure the DS as a consumer or i have to configure it as a single server? For information, i have read all the documentation too many times, and i can't find the error. The strange thing is that i get no error, like if the sync work but don´t write the entries. Another starnge thing is that with AD 2000, not 2003, the users sync good, not the passwords, but in 2003, sync once and then it's like if broke down. i hope you will help to solve this errors and thanks a lot.

1 0

[Fedora-directory-users] ssl client authentication
by Michael Montgomery 16 Nov '05

16 Nov '05

conn=31 op=-1 fd=67 closed - Peer does not recognize and trust the CA that issued your certificate. I've been trying to get client authentication via ssl working for quite a while now. I've tried generating my own CA via openssl, creating a self-signed ssl cert, importing CA cert via the interface, converting the client ssl to pkcs12 format, importing it via the interface, and trying to run a 'ldapsearch' using the cert (non-pkcs12 format) on the client machine but get the above error. I've also tried clearing the whole DB, regenerating everything (CA cert, and server client cert), and generating a client cert for a test machine with this: /serverRoot/shared/bin/certutil -S -n "hostname-Cert" -s "cn=server-cert" -c "CA certificate" -t "u,u,u" -m 1002 -v 120 -d . -z noise.txt -f pwdfile.txt then running this: '../shared/bin/certutil -L -d /opt/fedora-ds/alias/ -n "hostname-test-Cert"' and putting that in a ssl cert file on the client, '/root/client.crt', using this as an ldap.conf file: host ***.***.***.*** base dc=test,dc=testdomain,dc=com uri ldap://***.***.***.*** ldap_version 3 port 636 pam_filter objectclass=posixAccount pam_login_attribute uid ssl start_tls ssl on tls_cert /root/client.crt pam_password md5 And testing again with ldapsearch. But I still get the above error. Does anyone have any ideas why this is happening, as I'm at a loss. Thanks.

2 1

[Fedora-directory-users] Need some pointers to information
by Mont Rothstein 15 Nov '05

15 Nov '05

I want to use a Linux server as a file server for Windows clients. I would like to be able to add users to the Directory Server pragmatically and from that have users be able to access the Linux server via Samba. Save/edit/delete files, and set ACLs. This server will not be the PDC, and there may or may not be a PDC on the network at all (computers may be a simple workgroup). I've been going through the various docs and how-tos on setting up Fedora Directory Server, Samba, and integrating the two, but everything I have been reading seems to assume that my Linux server will be the PDC. The process for adding users seems to be to create a Unix user and then make them a Samba user. Which is basically the opposite of what I want. I would like to add the user to the Directory Server and have that fully enable the user's access to the Linux server. Perhaps I am just confused. I've searched and searched but I can't find anything that looks at/talks about the Fedora Directory Server and Samba from this direction. Any help here is greatly appreciated. Thanks, -Mont

1 0

[Fedora-directory-users] problem with ssl
by basile 15 Nov '05

15 Nov '05

hi i try to enable ssl with redhat documentation i use certutil to generate certificate i store in /opt/fedora-ds/slapd_myserver/alias but when in the console i check enable ssl and use cipher family rsa i don t see my certificate i use wiki fedora and do what they say but with same result i have attribute nscertfile and nscertfile in cn=encryption,cn=config with path to slapd-myserver-cert8.db and slapd-myserver-key3.db what do i forget to do ? thanks basile

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2005