389-users March 2006

389-users@lists.fedoraproject.org

55 participants
89 discussions

[Fedora-directory-users] blocking "unauthenticated bind"
by David Lewis 03 Mar '06

03 Mar '06

We have just migrated from openldap to fedora, and have realized with horror that some authentication clients (for example CAS) are giving the OK to users who submit un empty password string. We have been going slowly mad trying to find how to block this in the configuration. We previously allowed anonymous binds, but since discovering the problem we have disallowed them .. but this does NOT solve the problem. In a nutshell, this is what happens : % ldapbind -h fedora_ds_server.utc.fr -p 389 -D "uid=someuser,ou=people,dc=utc,dc=fr" -w "" bind successful % ldapbind -h openldap_server.utc.fr -p 389 -D "uid=someuser,ou=people,dc=utc,dc=fr" -w "" ldap_bind: DSA is unwilling to perform ldap_bind: additional info: unauthenticated bind (DN with no password) disallowed Could anyone tell us how to get fedora to behave like openldap in this respect ? There's a lot of stuff on the web about blocking "unauthenticated binds" in openldap, but hardly anything regarding other directory servers. Any useful tips would be gratefully received. David David Lewis system administrator University of Compiegne France

1 0

[Fedora-directory-users] Announcing Fedora Directory Server 1.0.2
by Rich Megginson 02 Mar '06

02 Mar '06

Fedora Directory Server 1.0.2 is released! This release contains new features, new platform support, and many bug fixes. * Extended Password Syntax checking - passwords can be checked to see if they conform to the following: ** minimum password character length (old feature, but now the default is 8 characters) ** minimum number of digit characters (0-9) ** minimum number of ASCII alpha characters (a-z, A-Z) ** minimum number of uppercase ASCII alpha characters (A-Z) ** minimum number of lowercase ASCII alpha characters (a-z) ** minimum number of special ASCII characters (!@#$, etc.) ** minimum number of 8-bit characters ** maximum number of times the same char can be immediately repeated (aaabbb) ** minimum number of character categories that are represented (categories are lower, upper, digit, special, and 8-bit) ** Screenshot - http://directory.fedora.redhat.com/wiki/Image:Pwdsyntax.png * Support for Linux x86_64 - RPMs for Fedora Core 4 and Fedora Core3/RHEL4 x86_64 are on the Download page. * Preliminary support for Fedora Core 5 - including support for Apache 2.2 and native java * Bug fixes - follow this link (https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=183369) to see the bugzilla report Release Notes: http://directory.fedora.redhat.com/wiki/Release_Notes Download: http://directory.fedora.redhat.com/wiki/Download Home Page: http://directory.fedora.redhat.com/wiki/Main_Page

6 10

RE: [Fedora-directory-users] Fedora DS v1.0.2 src RPMs?
by Jason Hane 02 Mar '06

02 Mar '06

Red Hat doesn't support SPARC. My co-worker just installed Aurora today on his SPARC box. It is similar, but I do see some differences. Hopefully it'll work for you. Jason Hane -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Dennis Gilmore Sent: Thursday, March 02, 2006 6:01 PM To: General discussion list for the Fedora Directory server project. Subject: Re: [Fedora-directory-users] Fedora DS v1.0.2 src RPMs? On Thursday 02 March 2006 16:42, Richard Megginson wrote: > Dennis Gilmore wrote: > >On Thursday 02 March 2006 16:24, Richard Megginson wrote: > >>If you want to build it yourself the information is here - > >>http://directory.fedora.redhat.com/wiki/Building#One-Step_Build > >> > >>In a nutshell: > >>wget > >>http://directory.fedora.redhat.com/sources/dsbuild-fds102.tar.gz > >>tar xfz dsbuild-fds102.tar.gz > >>cd dsbuild-fds102/meta/ds > >>make 2>&1 | tee build.log > >> > >>Use make BUILD_RPM=1 to make an RPM (default is an installable > >>setuputil package), use DEBUG=full to produce a debug build (default is optimize). > > > >How well do you think a build would go on sparc linux? > > What OS? I've never tried it, but RHEL or Fedora Core should work. Aurora SPARC Linux its a port of Fedora to SPARC. I guess ill give it a go and see what happens -- Regards Dennis Gilmore, RHCE Proud Australian -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

2 1

[Fedora-directory-users] Fedora DS v1.0.2 src RPMs?
by Graham Leggett 02 Mar '06

02 Mar '06

Hi all, Are there source RPMs available for Fedora DS v1.0.2? I need to build a version for the Opteron architecture. Regards, Graham --

4 11

[Fedora-directory-users] Fedora DS v1.0.2 new setup - admin server fails (153:Unknown error.)
by Graham Leggett 02 Mar '06

02 Mar '06

Hi all, Just tried to set up an FDS v1.0.2 from RHEL4 i386 RPM from scratch. The setup program tries to crank up the new server, but this fails as below. Anybody know what happened to the admin server? [slapd-ldap.domain.com]: starting up server ... [slapd-ldap.domain.com]: Fedora-Directory/1.0.2 B2006.060.1928 [slapd-ldap.domain.com]: ldap.domain.com:389 (/opt/fedora-ds/slapd-ldap.domain.com) [slapd-ldap.domain.com]: [slapd-ldap.domain.com]: [02/Mar/2006:15:16:21 -0600] - Fedora-Directory/1.0.2 B2006.060.1928 starting up [slapd-ldap.domain.com]: [02/Mar/2006:15:16:21 -0600] - slapd started. Listening on All Interfaces port 389 for LDAP requests Your new directory server has been started. Created new Directory Server Start Slapd Starting Slapd server configuration. Fatal Slapd ERROR: Ldap authentication failed for url ldap://ldap.domain.com:389/o=NetscapeRoot user id admin (153:Unknown error.) Fatal Slapd Did not add Directory Server information to Configuration Server. Configuring Administration Server... Setting up Administration Server Instance... ERROR: Administration Server configuration failed. You can now use the console. Here is the command to use to start the console: cd /opt/fedora-ds ./startconsole -u admin -a http://ldap.domain.com:1390/ INFO Finished with setup, logfile is setup/setup.log Regards, Graham --

2 1

RE: [Fedora-directory-users] Can't login to console
by Bliss, Aaron 02 Mar '06

02 Mar '06

If you can resolve the machine name via dns or local files, try this section of this wiki http://directory.fedora.redhat.com/wiki/Howto:AdminServerLDAPMgmt I had the exact same problems and this took care of it ________________________________ From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Mont Rothstein Sent: Thursday, March 02, 2006 3:26 PM To: General discussion list for the Fedora Directory server project. Subject: Re: [Fedora-directory-users] Can't login to console I am running Apache 2.0.52 As far as verifying that my directory server is up and running: ns-slapd is running under the dsuser account httpd.worker is running under the dsuser account I fear I need help with ldapsearch. If I try the following as root: ldapsearch -LLL "(cn=Directory Manager)" I get: ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) If I try the following: ldapsearch -LLL "(cn=Directory Manager)" -x -W it prompts me for a password. I enter the administrator (dsadmin) password and get: ldap_bind: Can't contact LDAP server (-1) This may indicate something is wrong, ot simply that I am trying to use ldapsearch incorrectly. Your assistance is greatly appreciated. -Mont On 3/2/06, Nathan Kinder <nkinder(a)redhat.com> wrote: Mont Rothstein wrote: > I am trying to setup Fedora Directory Server 1.0.1 on an x86 box > running RedHat ES4 in a VMWare session. What version of Apache are you running on the system? > > I've run setup. I've created a user and group dsuser which is set as > the server user. I set the admin to be dsadmin. I set the admin > server to be run as root. > > setup completes and appears to start correctly. > > I use the following line to launch the console: > > ./startconsole -x nologo -u dsadmin -a > http://rheles4rs1.forayadams.foray.com:45303 > > In the login window I enter the dsadmin password. I then get a panel > with the following message: > > Cannot logon because of incorrect User ID, > incorrect password or Directory problem. > > HttpException: > Response: HTTP/1.1 401 Authorization Required > Status: 401 > URL: http://rheles4rs1.forayadams.foray.com:45303/admin-serv/authenticate > > I'm sure I've done something stupid and basic somewhere, but I have no > idea what and I can't find anything about this via search. > > Does anyone have any ideas as to what I've done wrong? Make sure that your directory server is up and running. You should try doing an ldapsearch as the same user you are attempting to log into the Console as. If all else fails, tail your DS access log when you attempt to log in via Console to see if the Directory is even getting hit. -NGK > > Thanks, > -Mont > >----------------------------------------------------------------------- - > >-- >Fedora-directory-users mailing list >Fedora-directory-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users <https://www.redhat.com/mailman/listinfo/fedora-directory-users> > > -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users www.preferredcare.org "An Outstanding Member Experience," Preferred Care HMO Plans -- J. D. Power and Associates Confidentiality Notice: The information contained in this electronic message is intended for the exclusive use of the individual or entity named above and may contain privileged or confidential information. If the reader of this message is not the intended recipient or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that dissemination, distribution or copying of this information is prohibited. If you have received this communication in error, please notify the sender immediately by telephone and destroy the copies you received.

1 0

RE: [Fedora-directory-users] Can't login to console
by Bliss, Aaron 02 Mar '06

02 Mar '06

1 0

RE: [Fedora-directory-users] Announcing Fedora Directory Server 1.0.2
by Bliss, Aaron 02 Mar '06

02 Mar '06

In my environment, I have 2 directory servers, a supplier and consumer both running fds 1.0.1; is it necessary to upgrade them both at the same time or can I run in a mixed environment for a while? Also, it looks like that this bug fix https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=180515 is addressing this thread https://www.redhat.com/archives/fedora-directory-users/2006-February/msg 00087.html If so, is there any special configuration changes that I need to make on the directory servers to make it work? Thanks very much for a great product and it's awesome to see all of the improvements that have made. Aaron www.preferredcare.org "An Outstanding Member Experience," Preferred Care HMO Plans -- J. D. Power and Associates Confidentiality Notice: The information contained in this electronic message is intended for the exclusive use of the individual or entity named above and may contain privileged or confidential information. If the reader of this message is not the intended recipient or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that dissemination, distribution or copying of this information is prohibited. If you have received this communication in error, please notify the sender immediately by telephone and destroy the copies you received.

2 1

[Fedora-directory-users] TLS authentication without a user mapped
by François Beretti 01 Mar '06

01 Mar '06

Hi, is it possible to do a SASL/EXTERNAL bind with a TLS certificate, while no user in the directory is mapped to the certificate DN ? If yes, is it possible then to give rights to certificate DN (so, to a DN that is not in the directory) ? I would like this if I don't want to store users in a directory (because they already are in another one. Thank you François

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users March 2006