389-users December 2006

389-users@lists.fedoraproject.org

57 participants
73 discussions

[Fedora-directory-users] db2ldif hangs
by Jo De Troy 10 Dec '06

10 Dec '06

Hello, I have a daily cron job to run db2ldif. But one day last week it kept on running and during that time I couldn't write any changes. When I killed the job I could again write changes. When I rerun db2ldif it completes quickly as before. Has anyone else seen this behavior? I'm running FedoraDS1.0.2 on RHEL4. Thanks in advance, Jo

1 0

[Fedora-directory-users] Multiple Servers. Multiple Consoles?
by Dave Augustus 08 Dec '06

08 Dec '06

Hello All, I have 2 LDAP servers running in MultiMaster behind a load balancer. I also have FDS management consoles running on both. Is the management console required for each install of FDS ? Is there a way to consolidate them? Thanks, Dave

2 3

[Fedora-directory-users] Re: Multiple Servers. Multiple Consoles? (Richard Megginson)
by Phil Lembo 08 Dec '06

08 Dec '06

When we first started with the old iPlanet product all our prod directories were connected to a common admin server config instance. Over time, I found that made things difficult when something would "happen" to that admin server (whether intentionally or unintentionally). As a result, my practice now is to have a separate config instance for each physical server. I've often wanted to go back to using a single config instance, but never had the time to really think through what you'd need to do to recover if, for example, the admin server stopped working for some reason. I think i once saw a way to attach a running directory to a different admin server, just can't remmember where. Something covering that would make a great HOWTO. Phil Lembo On 12/8/06, fedora-directory-users-request(a)redhat.com < fedora-directory-users-request(a)redhat.com> wrote: > > Send Fedora-directory-users mailing list submissions to > fedora-directory-users(a)redhat.com > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.redhat.com/mailman/listinfo/fedora-directory-users > or, via email, send a message with subject or body 'help' to > fedora-directory-users-request(a)redhat.com > > You can reach the person managing the list at > fedora-directory-users-owner(a)redhat.com > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Fedora-directory-users digest..." > > > Today's Topics: > > 1. RE: Error: Database is read-only (Greg Copeland) > 2. Multiple Servers. Multiple Consoles? (Dave Augustus) > 3. Re: Multiple Servers. Multiple Consoles? (Richard Megginson) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 7 Dec 2006 11:16:58 -0600 > From: "Greg Copeland" <GCopeland(a)efjohnson.com> > Subject: RE: [Fedora-directory-users] Error: Database is read-only > To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> > Message-ID: > <273A72C669F45B4996896A031B88CCEF3E17BB(a)EFJDFWMX01.EFJDFW.local> > Content-Type: text/plain; charset="us-ascii" > > I had this happen to me too. I came in one day and found the database > was suddenly marked read-only. I had to find the read-only setting and > make it read/write and everything was happy again. > > Cheers, > > Greg Copeland > > ________________________________ > > From: fedora-directory-users-bounces(a)redhat.com > [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Ersin Er > Sent: Wednesday, December 06, 2006 3:43 PM > To: Fedora-directory-users mailing list > Subject: [Fedora-directory-users] Error: Database is read-only > > Hi all, > > After I played a little bit Fedora Directory Server I started to get an > error message: "Database is read-only", when I tried to modify anything. > Did I change any setting accidently? > > Thanks. > > -- > Ersin > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: > https://www.redhat.com/archives/fedora-directory-users/attachments/20061207… > > ------------------------------ > > Message: 2 > Date: Thu, 07 Dec 2006 17:17:54 -0600 > From: Dave Augustus <davea(a)support.kcm.org> > Subject: [Fedora-directory-users] Multiple Servers. Multiple Consoles? > To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> > Message-ID: <1165533474.16528.3.camel(a)kcm40202.kcmhq.org> > Content-Type: text/plain > > Hello All, > > I have 2 LDAP servers running in MultiMaster behind a load balancer. I > also have FDS management consoles running on both. > > Is the management console required for each install of FDS ? > > Is there a way to consolidate them? > > > Thanks, > Dave > > > > ------------------------------ > > Message: 3 > Date: Thu, 07 Dec 2006 16:34:42 -0700 > From: Richard Megginson <rmeggins(a)redhat.com> > Subject: Re: [Fedora-directory-users] Multiple Servers. Multiple > Consoles? > To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> > Message-ID: <4578A512.5030507(a)redhat.com> > Content-Type: text/plain; charset="iso-8859-1" > > Dave Augustus wrote: > > Hello All, > > > > I have 2 LDAP servers running in MultiMaster behind a load balancer. I > > also have FDS management consoles running on both. > > > > Is the management console required for each install of FDS ? > > > No. > > Is there a way to consolidate them? > > > When you installed the first instance of FDS, it should have created it > as the configuration DS. When you run setup subsequent times, in > Typical mode, you will be given the opportunity to register the new > instance with the configuration DS. > > > > Thanks, > > Dave > > > > -- > > Fedora-directory-users mailing list > > Fedora-directory-users(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > > -------------- next part -------------- > A non-text attachment was scrubbed... > Name: smime.p7s > Type: application/x-pkcs7-signature > Size: 3245 bytes > Desc: S/MIME Cryptographic Signature > Url : > https://www.redhat.com/archives/fedora-directory-users/attachments/20061207… > > ------------------------------ > > -- > Fedora-directory-users mailing list > Fedora-directory-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > > End of Fedora-directory-users Digest, Vol 19, Issue 11 > ****************************************************** > -- Phil Lembo e-mail: phil.lembo(a)gmail.com

1 0

[Fedora-directory-users] Error: Database is read-only
by Ersin Er 07 Dec '06

07 Dec '06

Hi all, After I played a little bit Fedora Directory Server I started to get an error message: "Database is read-only", when I tried to modify anything. Did I change any setting accidently? Thanks. -- Ersin

3 2

[Fedora-directory-users] Windows Sync without Domain Admin?
by Nicholas Byrne 07 Dec '06

07 Dec '06

Hi all, Is it possible to do a syncronisation of a windows peer without the windows user who i use to bind being a domain admin? I have a read only user with which i can run ldapsearch and find all users data in the AD directory but using the same user to sync with fails. The replication status says "total update completed" but i see no updates to the my FDS directory. If i modify this user in AD to be a domain admin it works correctly, but what i want to know is why can't i use a read-only user to sync? Is there any way around this? Thanks Nick This e-mail is the property of Quadriga Worldwide Ltd, intended for the addressee only and confidential. Any dissemination, copying or distribution of this message or any attachments is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer. Messages sent to and from Quadriga may be monitored. Quadriga cannot guarantee any message delivery method is secure or error-free. Information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. We do not accept responsibility for any errors or omissions in this message and/or attachment that arise as a result of transmission. You should carry out your own virus checks before opening any attachment. Any views or opinions presented are solely those of the author and do not necessarily represent those of Quadriga.

4 4

[Fedora-directory-users] RE: pam_ldap with SSL/TLS
by t b 06 Dec '06

06 Dec '06

>From: fedora-directory-users-request(a)redhat.com >Reply-To: fedora-directory-users(a)redhat.com >To: fedora-directory-users(a)redhat.com >Subject: Fedora-directory-users Digest, Vol 19, Issue 3 >Date: Sat, 2 Dec 2006 12:00:05 -0500 (EST) > >Send Fedora-directory-users mailing list submissions to > fedora-directory-users(a)redhat.com > >To subscribe or unsubscribe via the World Wide Web, visit > https://www.redhat.com/mailman/listinfo/fedora-directory-users >or, via email, send a message with subject or body 'help' to > fedora-directory-users-request(a)redhat.com > >You can reach the person managing the list at > fedora-directory-users-owner(a)redhat.com > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of Fedora-directory-users digest..." > > >Today's Topics: > > 1. Re: RE: Fedora-directory-users Digest, Vol 19, Issue 1 > (Richard Megginson) > 2. Re: AD + FDS sync stops working? (To Ngan) > 3. Re: Memory usage (koniczynek) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Fri, 01 Dec 2006 12:55:24 -0700 >From: Richard Megginson <rmeggins(a)redhat.com> >Subject: Re: [Fedora-directory-users] RE: Fedora-directory-users > Digest, Vol 19, Issue 1 >To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> >Message-ID: <457088AC.1030004(a)redhat.com> >Content-Type: text/plain; charset="iso-8859-1" > >t b wrote: > > My logs seem to indicate that the connection is being encrypted; I can > > ssh to a client server and get the password prompt, but when I enter > > the password it just returns me to the password prompt again > > > > [01/Dec/2006:19:47:44 -0500] conn=650 fd=69 slot=69 connection from > > xxx.xxx.xxx.xxx to xxx.xxx.xxx.xxx > > [01/Dec/2006:19:47:44 -0500] conn=650 op=0 EXT > > oid="1.3.6.1.4.1.1466.20037" name="startTLS" > > [01/Dec/2006:19:47:44 -0500] conn=650 op=0 RESULT err=0 tag=120 > > nentries=0 etime=0 > > [01/Dec/2006:19:47:44 -0500] conn=650 SSL 256-bit AES >All of this means the client was able to successfully perform the >startTLS extended operation and start using SSL. > > [01/Dec/2006:19:47:44 -0500] conn=650 op=1 UNBIND > > [01/Dec/2006:19:47:44 -0500] conn=650 op=1 fd=69 closed - U1 >The UNBIND means the client had a problem and closed the connection. >Does the client print any errors? Are there any messages in the server >error log? > > > > If I disable TLS everything works fine, the client server can query > > the FDS and auth the client properly > > > > I am not sure if the problem has to do with the pam_ldap not properly > > formatted or the cert file not in proper format > > > > Does anyone have an example of what the pam_ldap config should look > > like? or suggestions on checking whether the cert file is in proper > > format >I'm not sure. PAM needs the ca cert of the CA that issued the directory >server server cert. See >http://directory.fedora.redhat.com/wiki/Howto:SSL for more information. > > > > Also what's the UNBIND shown in the logs? > > > > Thanks > > Problem solved, the following link added the missing part to the puzzle, http://www.fedoraforum.org/forum/archive/index.php/t-1997.html The problem turns out to be that when you run the command /usr/bin/authconfig as recommended at, http://directory.fedora.redhat.com/wiki/Howto:PAM it does not make all of the necessary adjustments to /etc/ldap.conf -- you need to also add the settings mentioned in the link above Hopes this helps anyone having the same issues, and thanks to everyone for their suggestions As an addition, I am trying to download the posixuser auto creation script from, http://www.netauth.com/~jacksonm/ldap/newuser.pl.txt but the port seems to be blocked; does anyone know where I can get a hold of that script Thanks > >> From: fedora-directory-users-request(a)redhat.com > >> Reply-To: fedora-directory-users(a)redhat.com > >> To: fedora-directory-users(a)redhat.com > >> Subject: Fedora-directory-users Digest, Vol 19, Issue 1 > >> Date: Fri, 1 Dec 2006 12:00:06 -0500 (EST) > >> > >> Send Fedora-directory-users mailing list submissions to > >> fedora-directory-users(a)redhat.com > >> > >> To subscribe or unsubscribe via the World Wide Web, visit > >> https://www.redhat.com/mailman/listinfo/fedora-directory-users > >> or, via email, send a message with subject or body 'help' to > >> fedora-directory-users-request(a)redhat.com > >> > >> You can reach the person managing the list at > >> fedora-directory-users-owner(a)redhat.com > >> > >> When replying, please edit your Subject line so it is more specific > >> than "Re: Contents of Fedora-directory-users digest..." > >> > >> > >> Today's Topics: > >> > >> 1. pam_ldap with SSL/TLS (t b) > >> 2. RE: pam_ldap with SSL/TLS (Morris, Patrick) > >> 3. Re: pam_ldap with SSL/TLS (Richard Megginson) > >> 4. Problem with SSL console in X in specific circumstances > >> (Philip Kime) > >> 5. FW: [Fedora-directory-users] Extracting details from > >> ActiveDirectoryto FDS (Paxton, Darren) > >> 6. alias in fedora directory server (patrick ndjientcheu ngandjui) > >> 7. Re: FW: [Fedora-directory-users] Extracting details from > >> ActiveDirectoryto FDS (Nicholas Byrne) > >> 8. Re: Memory usage (koniczynek) > >> 9. Re: Memory usage (David Boreham) > >> 10. Re: Memory usage (koniczynek) > >> > >> > >> ---------------------------------------------------------------------- > >> > >> Message: 1 > >> Date: Thu, 30 Nov 2006 12:31:50 -0500 > >> From: "t b" <mxheadroom(a)hotmail.com> > >> Subject: [Fedora-directory-users] pam_ldap with SSL/TLS > >> To: fedora-directory-users(a)redhat.com > >> Message-ID: <BAY116-F322745E96D702ED748B1D0CDDB0(a)phx.gbl> > >> Content-Type: text/plain; format=flowed > >> > >> I am trying to setup pam_ldap to use TLS to communicate with the FDS, > >> but > >> having lots of problems doing so; it works if I use the unencrypted > >> way but > >> not if I use ldaps ( port 636 ) > >> > >> I used the instructions at, > >> http://directory.fedora.redhat.com/wiki/Howto:PAM > >> > >> Has anyone gotten PAM to work TLS > >> > >> > >> Thanks > >> > >> _________________________________________________________________ > >> Buy, Load, Play. The new Sympatico / MSN Music Store works seamlessly > >> with > >> Windows Media Player. Just Click PLAY. > >> >http://musicstore.sympatico.msn.ca/content/viewer.aspx?cid=SMS_Sept192006 > >> > >> > >> > >> > >> ------------------------------ > >> > >> Message: 2 > >> Date: Thu, 30 Nov 2006 13:00:56 -0500 > >> From: "Morris, Patrick" <patrick.morris(a)hp.com> > >> Subject: RE: [Fedora-directory-users] pam_ldap with SSL/TLS > >> To: "General discussion list for the Fedora Directory server project." > >> <fedora-directory-users(a)redhat.com> > >> Message-ID: > >> ><CD18C81835E18A40A64C4A0D16A237BE05FE850D(a)ATAEXC01.americas.cpqcorp.net> > >> > >> > >> Content-Type: text/plain; charset="US-ASCII" > >> > >> > I am trying to setup pam_ldap to use TLS to communicate with > >> > the FDS, but having lots of problems doing so; it works if I > >> > use the unencrypted way but not if I use ldaps ( port 636 ) > >> > >> Someone should jump in here and correct me if I'm wrong, but I believe > >> it's normal for TLS connections to happen on the standard LDAP port. > >> You should be able to tell from your logs whether the connection is > >> encrypted or not. > >> > >> > >> > >> ------------------------------ > >> > >> Message: 3 > >> Date: Thu, 30 Nov 2006 11:08:08 -0700 > >> From: Richard Megginson <rmeggins(a)redhat.com> > >> Subject: Re: [Fedora-directory-users] pam_ldap with SSL/TLS > >> To: "General discussion list for the Fedora Directory server project." > >> <fedora-directory-users(a)redhat.com> > >> Message-ID: <456F1E08.40601(a)redhat.com> > >> Content-Type: text/plain; charset="iso-8859-1" > >> > >> Morris, Patrick wrote: > >> >> I am trying to setup pam_ldap to use TLS to communicate with > >> >> the FDS, but having lots of problems doing so; it works if I > >> >> use the unencrypted way but not if I use ldaps ( port 636 ) > >> >> > >> > > >> > Someone should jump in here and correct me if I'm wrong, but I >believe > >> > it's normal for TLS connections to happen on the standard LDAP port. > >> > You should be able to tell from your logs whether the connection is > >> > encrypted or not. > >> > > >> Yes. The LDAP "preferred" way is to use the startTLS extended >operation > >> which starts a TLS session on the non-secure port. This will be logged > >> in the access log. > >> > -- > >> > Fedora-directory-users mailing list > >> > Fedora-directory-users(a)redhat.com > >> > https://www.redhat.com/mailman/listinfo/fedora-directory-users > >> > > >>

1 0

[Fedora-directory-users] Show Effective Rights via the console
by Ersin Er 06 Dec '06

06 Dec '06

Hi all, I am trying to use the "Show Effective Rights" feature via the console, however I get nothing when I check the box. Just an "Entry Level Rights:" label is displayed at the bottom of the window but no value is displayed for neither the Entry nor attributes. Do I have to do some more configuration to make this work? Thanks. -- Ersin

3 3

RE: [Fedora-directory-users] Adding admin users
by Jo De Troy 06 Dec '06

06 Dec '06

Hi Rich, what exactly do you mean? Searching for the uid=admin? So adding a user to the Directory Administrators is not good enough. What extra rights does an extra admin user need? And how should I enable these rights for this user? Can I do this from the console? Or do I better do it via an ldif import? Thanks in advance, Jo > Hello, > > I was wondering what the correct way is to add a extra admin user (not > directory manager or admin) who could login via the console to do > maintenance tasks. Add users/groups, reset passwords, unlock users, > restore backups, do imports, etc > I tried adding a user as uniquemember to the group Directory > Administrators and I can login to the console but I can only see the > domain in the default view I cannot select the server or the admin > server or directory server console. > I guess using an aci for every specific user that needs privileged > access is not the best way. > No. I suggest searching for the uid=admin user that gets created during setup. Thanks in advance, > Jo > -- Fedora-directory-users mailing list Fedora-directory-users redhat com https://www.redhat.com/mailman/listinfo/fedora-directory-users

2 1

[Fedora-directory-users] Adding admin users
by Jo De Troy 06 Dec '06

06 Dec '06

Hello, I was wondering what the correct way is to add a extra admin user (not directory manager or admin) who could login via the console to do maintenance tasks. Add users/groups, reset passwords, unlock users, restore backups, do imports, etc I tried adding a user as uniquemember to the group Directory Administrators and I can login to the console but I can only see the domain in the default view I cannot select the server or the admin server or directory server console. I guess using an aci for every specific user that needs privileged access is not the best way. Thanks in advance, Jo

2 1

[Fedora-directory-users] Advanced button hidden when editing user and groups
by Renato Ribeiro da Silva 06 Dec '06

06 Dec '06

Hello, I'm trying to edit users properties using the Fedora Management Console ( users and groups tab ), but I need to update advanced attributes too. The problem is that the "Advanced Button" doesn't appear. If I use the Directory Console I can access the button without problems. Any idea about what is happening? Thanks in advance, Renato.

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users December 2006