389-users November 2006

389-users@lists.fedoraproject.org

68 participants
116 discussions

[Fedora-directory-users] access control lists help needed
by Eric Beda 27 Nov '06

27 Nov '06

Hi, i am trying to setup dovecot, with virtual domains to authenticate via ldap, through the tutorial i was reading i had to setup access list that will allow dovecot-auth user privelage to read passwords, how do i set that up ?

1 0

[Fedora-directory-users] Extracting details from Active Directory to FDS
by Paxton, Darren 24 Nov '06

24 Nov '06

Hi all, I've been tinkering with integrating our Linux devices into our AD domain for some time and I've hit a few brick walls, however I've recently discovered FDS and the synchronisation features with AD. I've managed to set up a few replication jobs, however due to the extensive nature of our AD, I've realised that the sync only takes the group and user objects from the OU or CN being specified. Is there any way I can specify that it should traverse all subtrees of an OU and extract all that information back into FDS? Thanks Darren -- Darren Paxton EMEA Tier2 Red Hat Certified Engineer VMware Certified Professional MGTI Centralised ops

1 0

[Fedora-directory-users] PassSync with Multi global catalog
by Jean-Baptiste CHARPENTIER 24 Nov '06

24 Nov '06

Hello, I have three domain controllers. Each controller has global catalog but there are on the same domain. I use PassSync only to synchronise password from Active Directory to Fedora Directory. Syncro it's ok only when I deploy PassSync on each domain controller . Is it normal? Thanks for your help. Jean-Baptiste CHARPENTIER

1 0

[Fedora-directory-users] LDAP search issue.
by A G 22 Nov '06

22 Nov '06

Hello; I am using Fedora Directory Server 1.0.2. I have a question on LDAP search issue. I want to disable full search on the LDAP tree. Eg: My LDAP Tree is: cn=John Smith, o=Dept1, c=US cn=Ann Adams, o=Dept1, c=US I want to deny to read full listing of the tree but only allow when the search condition meets only the required person. In the example above I want nobody to be listed. But when the search criteria is "c=US, o=Dept1, cn=Ann Adams" this entry must be listed. When a search on "c=US" comes, nothing must be listed. What is the correct Access Control Information for this request?? >You also posted this question to the OpenLDAP list. Fedora DS and >OpenLDAP have very different ACI models. What is your server vendor and >version? Thanks.

2 1

[Fedora-directory-users] AD problem
by Nicholas Byrne 22 Nov '06

22 Nov '06

A am fairly new to FDS, I am using fedora-ds-1.0.2-1.RHEL4 and my goal is to setup a syncronisation against a W2K3 based active directory domain controller. I've followed the Howto:SSL to setup SSL on the fedora server which works correctly and i've also followed the "Enabling SSL with Active Directory" section in Howto:WindowsSync using the TinyCA method. On the AD server I've imported the CA cert and AD server cert i created following the instructions in the howto. I've used ldp (running on the AD server) to query the AD system using SSL and it works after i create a connection on port 636, bind and run a search. Before complicating matters with PassSync i wanted to try remotely querying the server over SSL to see if that works (non-SSL queries work fine), so i can be sure that the standard sync agreement between FDS and AD will work. I've tried a number of methods, but i always get "ldap_bind: Can't contact LDAP server (-1)". On the system i'm making queries from, i've installed the my CA cert in /etc/openssl/cacerts and configured the following /etc/openldap/ldap.conf with: TLS_CACERTDIR /etc/openldap/cacerts/ TLS_REQCERT allow I'd be very grateful for some advice, it's driving me nutty... output of command below - ldapsearch -v -b dc=tech -s sub -H ldaps://w2k3virtual01.tech -x -W -LLL '(objectclass=user)' -D winsync@tech -d 9 ldap_initialize( ldaps://w2k3virtual01.tech ) ldap_create ldap_url_parse_ext(ldaps://w2k3virtual01.tech) Enter LDAP Password: ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP w2k3virtual01.tech:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.103.20.50:636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 0, subject: /C=UK/ST=Berkshire/L=Reading/O=Quadriga/OU=Technology/CN=Quadriga Certificate Authority/emailAddress=sysadmin(a)quadriga.com, issuer: /C=UK/ST=Berkshire/L=Reading/O=Quadriga/OU=Technology/CN=Quadriga Certificate Authority/emailAddress=sysadmin(a)quadriga.com TLS certificate verification: depth: 0, err: 0, subject: /C=UK/ST=Berkshire/L=Reading/O=Quadriga/OU=Technology/CN=w2k3virtual01.tech, issuer: /C=UK/ST=Berkshire/L=Reading/O=Quadriga/OU=Technology/CN=Quadriga Certificate Authority/emailAddress=sysadmin(a)quadriga.com TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:failed in SSLv3 read finished A TLS: can't connect. ldap_perror ldap_bind: Can't contact LDAP server (-1) This e-mail is the property of Quadriga Worldwide Ltd, intended for the addressee only and confidential. Any dissemination, copying or distribution of this message or any attachments is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer. Messages sent to and from Quadriga may be monitored. Quadriga cannot guarantee any message delivery method is secure or error-free. Information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. We do not accept responsibility for any errors or omissions in this message and/or attachment that arise as a result of transmission. You should carry out your own virus checks before opening any attachment. Any views or opinions presented are solely those of the author and do not necessarily represent those of Quadriga.

1 2

[Fedora-directory-users] ldappasswd problem
by Eric Beda 22 Nov '06

22 Nov '06

Hi, i am trying to set up virtual mailserver using postfix,dovecot and jamm, i'm walking through a tutorial that is based on openldap, i am required to make fedora ds use CRYPT password mechanism how do i set that up? also i seem to fail to change users passwords, whenever i issue the command ldappasswd -D "cn=manager,dc=example,dc=example" -x -w "secret" -s "secret" "mail=ebeda@somedomain,jvd=somename,dc=example,dc=example" i get the following error Result: Confidentiality required (13) Additional info: Operation requires a secure connection. note that my directory manager dn is "cn=manager,dc=example,dc=example" and i'm using fedora ds 7.1 please help

3 2

[Fedora-directory-users] Is it possible to use events to create homedirs when user entry is created or deleted?
by Kimmo Koivisto 21 Nov '06

21 Nov '06

Hello I have small environment with one FDS server and one application server, both RHEL4ES. FDS server provides ldap authentication and home directories for app server with ldap and nfs. I administrate users and groups with phpldapadmin or windows based ldapadmin, everything is working fine. When I add new user to the FDS, I have to create home directory for that user manually, set permissions and copy /etc/skel files. I would like to do home directory administration tasks automatically when user is added or deleted from FDS. One solution (I don't like this) is that I use some command line ldap capable adduser instead of ldapadmin or phpldapadmin. Does FDS have any event support that I could use or are there any existing solutions for this problem? Best Regards Kimmo Koivisto

6 5

Re: [Fedora-directory-users] pass-thru questions
by MJD Shop Account 21 Nov '06

21 Nov '06

>> How does use of this plugin relate to setting the userPassword attribute to something like '{KERBEROS}user@REALM'? Is that a completely separate method for using kerberos? >Yes. It is completely different and doesn't use a special userPassword >value. Where would it be appropriate to use the {KERBEROS}user@REALM method? Any pointers to read up on it? I think an earlier message thread indicated it was deprecated... I'm not sure which is the best for my situation. If it required saslauthd, for instance, that would not work for me. >SASL mapping should work for SASL BINDs. The PAM passthru plugin should >only be used in those cases where you have a client that only supports >simple (i.e. username/password) BIND. I guess I'm not 100% sure how this will work for, say, someone logging in via a console. Right now, I have a pam modules stack with pam_ldap.so followed by pam_krb5.so. How would a login at a console terminal (either text or RH graphical Xwindows login) result in an SASL bind to LDAP? My /etc/ldap.conf is set for anonymous binds. Perhaps I should reverse the order and have krb5 before ldap, as I want krb5 to be used ultimately for authentication. Right now, the user might have an LDAP password and a separate krb5 password, if they log in with the krb5 password they get KerberosV credentials as shown by klist. To be clear again, I would still need the passthrough to support the cross-realm situation, I think. So maybe ldap before krb5 is just fine for that reason. Another more general question. As I want to use the passthrough module strictly to do the the Kerberos logins, I assume the 'ldapserver' pam file would only need pam_krb5.so and not, for example, pam_unix.so. Is that right? Thanks! Marty

2 1

Re: [Fedora-directory-users] pass-thru questions
by MJD Shop Account 21 Nov '06

21 Nov '06

>Fedora DS does not support the {KERBEROS}user@REALM method in the >userPassword attribute. That is an OpenLDAP only feature, AFAIK. Ah, well that makes my life easy! >> Another more general question. As I want to use the passthrough module strictly to do the the Kerberos logins, I assume the 'ldapserver' pam file would only need pam_krb5.so and not, for example, pam_unix.so. Is that right? >> >I think so, but I'm not sure. You'll have to ask a PAM guru for that. If anyone has pointers, please let me know. Thanks! Marty

1 0

[Fedora-directory-users] Host based ACI
by Greg Hetrick 21 Nov '06

21 Nov '06

I am trying to implement host based ACI for either users or groups. Basic question can you acheive the same results as using the host ACI as you would with host attributes per user. I am trying to find a way not to specifically include each host in each user that needs access to every host or multiple hosts. Is it possible to add Host based ACI to a group and have the members of that group be granted access to only those specific hosts? Say for example having a group for admins with every host and adding users to that group thus giving them access to all hosts, same with a development group with only access to development hosts. Any direction that you can give would be much appreciated. I have attempted to setup ACIs for a particular user to a single host, but it doesn't appear that it is working, seems like I am missing either a client side LDAP setting or an Attribute on the user to handle the ACI. I was able to setup host based access using the host attribute per user, that just seems tedious. Thanks, Greg

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2006