389-users April 2006

389-users@lists.fedoraproject.org

53 participants
82 discussions

[Fedora-directory-users] Bug in the console
by Jeff Applewhite 20 Apr '06

20 Apr '06

Hi All, There appears to be a bug in the console such that new schema changes do not appear until the console is restarted. Here's what I did -- you should be able to reproduce it. Created a custom objectclass (a child of inetOrgPerson) and some custom optional attributes associated with it, then tried to add the objectclass to a user except the new custom objectclass does not appear in the scrollable list when I go into advanced view and attempt to add it to the abjectclasses. Once I restart the console all is well. Has anyone seen this or similar problems before? -- Jeff Applewhite Systems Administration Lead P (919) 287-7392 M (919) 491-4161 jeff.applewhite(a)motricity.com NOTICE: This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Motricity. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

1 0

RE: [Fedora-directory-users]: SSL directory server gateway, one-button SSL Certs (slapd + Admin Server) generation script
by Tay, Gary 20 Apr '06

20 Apr '06

I couldn't find setupssl.sh anywhere on the HowTo SSL link. Anyway, I have written cr_ssl_certs.sh which works for both FDS and SUN-ONE DS, and this script will create also the Admin Server SSL Cert (the same as slapd), once you have used Admin Console to enable SSL for Admin Server at "Encryption" TAB, you would see a few .conf files including console.conf get updated at $SERVER_ROOT/admin-serv/config, the rest is history. Note that it is not a MUST to create different CA Certs for different FDS Servers, they are so for testing purposes only, for production usage, you would most likely purchase signed SSL Server Certs for your different FDS Servers HTH. Gary Content of cr_ssl_certs.sh #! /bin/sh # # cr_ssl_certs.sh - This script works for either Fedora or SUN-ONE DS # # Gary Tay # # 1) Make sure 'root' is used to run this script # 2) Make sure /home/ldap/dirmgr.pwd contains password of cn=Direcyory Manager # #set -vx IS_ROOT_UID=`id | grep "uid=0(root)"` if [ ! -n "$IS_ROOT_UID" ]; then echo "Please run this script as root" exit 1 fi chmod 700 $0 if [ ! -f /home/ldap/dirmgr.pwd ]; then echo "Please setup /home/ldap/dirmgr.pwd." exit 1 else chmod 600 /home/ldap/dirmgr.pwd fi # Pls customize the followings HOST=`hostname` DOMAIN="example.com" BASEDN="dc=example,dc=com" FQDN="$HOST.$DOMAIN" ORG="Example Companies" LOCALITY="NewYork City" STATE="NewYork" COUNTRY="US" # Uncomment for Fedora/RedHat Directory Server SERVER_ROOT="/opt/fedora-ds" # Uncomment for SUN-ONE/Java System Directory Server #SERVER_ROOT="/var/Sun/mps" if [ "$SERVER_ROOT" = "/opt/fedora-ds" ]; then LD_LIBRARY_PATH=$SERVER_ROOT/lib:$SERVER_ROOT/shared/lib SLAPD_OWNER="ldap" SLAPD_GROUP="ldap" TAR_CVF="tar -Pcvf" TAR_XVF="tar -Pxvf" fi if [ "$SERVER_ROOT" = "/var/Sun/mps" ]; then LD_LIBRARY_PATH=$SERVER_ROOT/lib SLAPD_OWNER="root" SLAPD_GROUP="root" TAR_CVF="tar -cvf" TAR_XVF="tar -xvf" fi export LD_LIBRARY_PATH PATH=$SERVER_ROOT/shared/bin:$PATH; export PATH echo "Please shutdown slapd and Admin Server and perform a tar backup" echo "and db2ldif backup of currently working system, and restart them again." echo "Example of tar command: $TAR_CVF /var/tmp/ds_backup.tar $SERVER_ROOT" echo "When you are ready, answer Yes and press Enter to continue." echo "Press Ctrl-C to cancel." read READY [ "$READY" != "Yes" ] && exit 1 echo "Enter an UNIQUE SERIAL NUMBER for CA Cert." echo "Eg: 1000 for ldap1, 2000 for ldap2, 3000 for ldap3, etc..." read UNIQUE_SN_CA echo "Enter an UNIQUE SERIAL NUMBER for LDAP Server Cert." echo "Eg: 1001 for ldap1, 1002 for ldap2, 1003 for ldap3." read UNIQUE_SN_LDAP cd $SERVER_ROOT/alias echo "Backing up existing *.db (if any) to backup_$$." mkdir -p backup_$$ >/dev/null 2>/dev/null cp -p *.db backup_$$ >/dev/null 2>/dev/null /bin/rm -f *.db >/dev/null 2>/dev/null echo "secretpwd" >pwdfile.txt chmod 600 pwdfile.txt echo "dsadasdasdasdadasdasdasdasdsadfwerwerjfdksdjfksdlfhjsdk" >noise.txt echo "Creating new security key3.db/cert8.db pair." ../shared/bin/certutil -N -d . -f pwdfile.txt echo "Generating encryption key." ../shared/bin/certutil -G -d . -z noise.txt -f pwdfile.txt echo "Generating self-signed CA certificate." ../shared/bin/certutil -S -n "CA certificate" \ -s "cn=CAcert $HOST" -x \ -t "CT,," -m $UNIQUE_SN_CA -v 120 -d . -z noise.txt -f pwdfile.txt echo "Generating self-signed Server certificate." ../shared/bin/certutil -S -n "Server-Cert" \ -s "cn=$FQDN,O=$ORG,L=$LOCALITY,ST=$STATE,C=$COUNTRY" -c "CA certificate" \ -t "u,u,u" -m $UNIQUE_SN_LDAP -v 120 -d . -z noise.txt -f pwdfile.txt echo "Renaming and linking modified security DBs." mv -f key3.db slapd-$HOST-key3.db mv -f cert8.db slapd-$HOST-cert8.db ln -s slapd-$HOST-key3.db key3.db ln -s slapd-$HOST-cert8.db cert8.db echo "Setting the correct ownership of security DBs" chown $SLAPD_OWNER:$SLAPD_GROUP *.db echo "Self-signed CA and SSL Server certs generated." echo "" echo "The following commands are OPTIONAL." echo "They are for backing up CA and Server Certs in PK12 format." echo "" echo "---Start of OPTIONAL commands---" cat <<EOF >optional_cmds.txt ../shared/bin/pk12util -d . -P slapd-$HOST- -o cacert.pfx -n "CA certificate" ../shared/bin/pk12util -d . -P slapd-$HOST- -o servercert.pfx -n "Server-Cert" EOF cat optional_cmds.txt echo "---End of OPTIONAL commands---" echo "" # echo "Enabling SSL." echo "NOTE: changes will be saved to config/dse.ldif when slapd is shutdown" cat <<EOF >/tmp/ssl_enable.ldif dn: cn=encryption,cn=config changetype: modify replace: nsSSL3 nsSSL3: on - replace: nsSSLClientAuth nsSSLClientAuth: allowed dn: cn=config changetype: modify add: nsslapd-security nsslapd-security: on EOF if [ "$SERVER_ROOT" = "/opt/fedora-ds" ]; then cat <<EOF >>/tmp/ssl_enable.ldif dn: cn=config replace: nsslapd-ssl-check-hostname nsslapd-ssl-check-hostname: off EOF fi ../shared/bin/ldapmodify -D "cn=Directory Manager" -w `cat /home/ldap/dirmgr.pwd` -f /tmp/ssl_enable.ldif [ $? -eq 0 ] && \ echo "Enabling SSL in cn=encryption,cn=config and cn=config done." [ $? -ne 0 ] && \ echo "Enabling SSL in cn=encryption,cn=config and cn=config failed." # cat <<EOF >/tmp/add_ssl_configs.ldif dn: cn=encryption,cn=config changetype: modify add: nsSSL3Ciphers nsSSL3Ciphers: -rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5, +rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_sha,+fortezz a, +fortezza_rc4_128_sha,+fortezza_null,+tls_rsa_export1024_with_rc4_56_sha , +tls_rsa_export1024_with_des_cbc_sha - add: nsKeyfile nsKeyfile: alias/slapd-$HOST-key3.db - add: nsCertfile nsCertfile: alias/slapd-$HOST-cert8.db EOF ../shared/bin/ldapmodify -D "cn=Directory Manager" -w `cat /home/ldap/dirmgr.pwd` -f /tmp/add_ssl_configs.ldif [ $? -eq 0 ] && echo "Adding SSL configs in cn=encryption,cn=config done." [ $? -ne 0 ] && echo "Adding SSL configs in cn=encryption,cn=config failed." # cat <<EOF >/tmp/addRSA.ldif dn: cn=RSA,cn=encryption,cn=config objectclass: top objectclass: nsEncryptionModule cn: RSA nsSSLPersonalitySSL: Server-Cert nsSSLToken: internal (software) nsSSLActivation: on EOF ../shared/bin/ldapmodify -a -c -D "cn=Directory Manager" -w `cat /home/ldap/dirmgr.pwd` -f /tmp/addRSA.ldif [ $? -eq 0 ] && echo "Adding cn=RSA,cn=encryption,cn=config done." [ $? -ne 0 ] && echo "Adding cn=RSA,cn=encryption,cn=config failed." # echo "Creating a pin.txt for auto-starting of slapd." echo "Internal (Software) Token:`cat pwdfile.txt`" >slapd-$HOST-pin.txt chown $SLAPD_OWNER:$SLAPD_GROUP slapd-$HOST-pin.txt chmod 400 slapd-$HOST-pin.txt echo "Exporting the CA Cert in ASCII format or DER format" ../shared/bin/certutil -L -d . -P slapd-$HOST- -n "CA certificate" \ -a > cacert.asc ../shared/bin/certutil -L -d . -P slapd-$HOST- -n "CA certificate" \ -r > cacert.der echo "Copying Server-Cert to Admin Server for Admin Server SSL connection." cp slapd-$HOST-key3.db admin-serv-$HOST-key3.db cp slapd-$HOST-cert8.db admin-serv-$HOST-cert8.db echo "Setting the correct ownership of Admin Server security DBs" chown $SLAPD_OWNER:$SLAPD_GROUP admin-serv-$HOST-*.db echo "Remember to enable SSL in Admin Server later." echo "Remember to select 'Server-Cert' as the Certificate and click OK." echo "Remember to restart Admin Server after that." echo "Creating a pin.txt for auto-starting of Admin Server." echo "`cat pwdfile.txt`" >admin-serv-$HOST-pin.txt chown $SLAPD_OWNER:$SLAPD_GROUP admin-serv-$HOST-pin.txt chmod 400 admin-serv-$HOST-pin.txt echo "Patching start-admin and creating start-admin.auto." if [ "$SERVER_ROOT" = "/opt/fedora-ds" ]; then sed -e \ '/^\$HTTPD/s/$/ \<"$SERVER_ROOT"\/alias\/admin-serv-`hostname`-pin.txt/' \ $SERVER_ROOT/start-admin >$SERVER_ROOT/start-admin.auto fi if [ "$SERVER_ROOT" = "/var/Sun/mps" ]; then sed -e \ '/uxwdog/s/$/ \<"$SERVER_ROOT"\/alias\/admin-serv-`hostname`-pin.txt/' \ $SERVER_ROOT/start-admin >$SERVER_ROOT/start-admin.auto fi chmod 755 $SERVER_ROOT/start-admin.auto echo "Please use $SERVER_ROOT/start-admin.auto in rc3.d as autostart script." echo "" echo "IMPORTANT NOTES:" echo "" echo "1. How to check if SSL Configurations are done properly?" echo "You may view config/dse.ldif after shutting down slapd" echo "to verify all the required SSL configurations are there." echo "" echo "2. How to fix slapd startup issue due to mis-configuration of SSL?" echo "If for any reason slapd fails to start due to SSL issue," echo "you may edit config/dse.ldif after shutting down slapd" echo "and revert back to non-SSL configs." echo "i.e. set nsSSL3: off, nsSSLActivation: off and nsslapd-security: off" echo "and then try to restart slapd." echo "" echo "3. How to fix Admin Server login issue due to mis-configuration of SSL?" echo "If for any reason Admin Server login fails and you wish to give up," echo "simply stop slapd and admin-serv and restore using the tar backup" echo "i.e. rm -f $SERVER_ROOT/alias/*.db;$TAR_XVF /var/tmp/ds_backup.tar" echo "" ===Sample Run=== # ./cr_ssl_certs.sh Please shutdown slapd and Admin Server and perform a tar backup and db2ldif backup of currently working system, and restart them again. Example of tar command: tar -cvf /var/tmp/ds_backup.tar /var/Sun/mps When you are ready, answer Yes and press Enter to continue. Press Ctrl-C to cancel. Yes Enter an UNIQUE SERIAL NUMBER for CA Cert. Eg: 1000 for ldap1, 2000 for ldap2, 3000 for ldap3, etc... 1000 Enter an UNIQUE SERIAL NUMBER for LDAP Server Cert. Eg: 1001 for ldap1, 1002 for ldap2, 1003 for ldap3. 1001 Backing up existing *.db (if any) to backup_24872. Creating new security key3.db/cert8.db pair. Generating encryption key. Generating key. This may take a few moments... Generating self-signed CA certificate. Generating key. This may take a few moments... Generating self-signed Server certificate. Generating key. This may take a few moments... Renaming and linking modified security DBs. Setting the correct ownership of security DBs Self-signed CA and SSL Server certs generated. The following commands are OPTIONAL. They are for backing up CA and Server Certs in PK12 format. ---Start of OPTIONAL commands--- ../shared/bin/pk12util -d . -P slapd-ldap1- -o cacert.pfx -n "CA certificate" ../shared/bin/pk12util -d . -P slapd-ldap1- -o servercert.pfx -n "Server-Cert" ---End of OPTIONAL commands--- Enabling SSL. NOTE: changes will be saved to config/dse.ldif when slapd is shutdown modifying entry cn=encryption,cn=config modifying entry cn=config Enabling SSL in cn=encryption,cn=config and cn=config done. modifying entry cn=encryption,cn=config Adding SSL configs in cn=encryption,cn=config done. adding new entry cn=RSA,cn=encryption,cn=config Adding cn=RSA,cn=encryption,cn=config done. Creating a pin.txt for auto-starting of slapd. Exporting the CA Cert in ASCII format or DER format Copying Server-Cert to Admin Server for Admin Server SSL connection. Setting the correct ownership of Admin Server security DBs Remember to enable SSL in Admin Server later. Remember to select 'Server-Cert' as the Certificate and click OK. Remember to restart Admin Server after that. Creating a pin.txt for auto-starting of Admin Server. Patching start-admin and creating start-admin.auto. Please use /var/Sun/mps/start-admin.auto in rc3.d as autostart script. IMPORTANT NOTES: 1. How to check if SSL Configurations are done properly? You may view config/dse.ldif after shutting down slapd to verify all the required SSL configurations are there. 2. How to fix slapd startup issue due to mis-configuration of SSL? If for any reason slapd fails to start due to SSL issue, you may edit config/dse.ldif after shutting down slapd and revert back to non-SSL configs. i.e. set nsSSL3: off, nsSSLActivation: off and nsslapd-security: off and then try to restart slapd. 3. How to fix Admin Server login issue due to mis-configuration of SSL? If for any reason Admin Server login fails and you wish to give up, simply stop slapd and admin-serv and restore using the tar backup i.e. rm -f /var/Sun/mps/alias/*.db;tar -xvf /var/tmp/ds_backup.tar -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Jason Russler Sent: Thursday, April 20, 2006 4:15 AM To: General discussion list for the Fedora Directory server project. Subject: [Fedora-directory-users] SSL directory server gateway Hi all, I'm pretty uncertain about the best way to go about configuring the admin server to use SSL (FDS1.0.2) . All of the docs I'm finding are pretty shaky. Ultimately, I want users to manage their passwords and info via the web-based Directory Server Gateway over SSL. This would appear to be the same thing as enabling SSL for the admin server. The setupssl.sh script provided by the SSL howto, generates the keys/certs for the admin server and imports them into the appropriate cert db (I guess, I've performed the process by hand as well, based on RedHat's docs and the script itself). This would imply to me that the admin console would find the generated certs and present them in the admin server's console (under the Configuration -> Encryption tab) in much the same way that it does in the directory server's console. I can't tell if something that's suppose to work isn't or if I'm misunderstanding something. I'd like to know before I try to generate new SSL certificates and import them. Thanks much, Jason -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

2 1

[Fedora-directory-users] Centos with Fedora Directory Server
by Hariharan R 20 Apr '06

20 Apr '06

Hai, I have installed CentOS 4.3 in my system. I have two mode to boot my system,one is CentOS General mode and the other one is CentOS smp mode. Actually i want to test Fedora Directory Server 7.1 with CentOS SMP mode. Fedora Directory Server 7.1 is running perfectly in CentOS General mode. If i try to run the Fedora Directory Server 7.1 in CentOS4.3 SMP mode it was not running.That is, there is some problem in starting the Admin server.It seems to start the admin server but it is not actually. Is there is any option or suggestion to make Fedora Directory Server 7.1 working in CentOS 4.3 SMP mode. Pls advice me. --- Thanks, Hariharan.R

1 0

RE: **Caution-External**: [Fedora-directory-users] Automated script for complementing SSLHowTo
by Tay, Gary 20 Apr '06

20 Apr '06

Version 2 of this script has been renamed cr_ssl_certs.sh and works for both FDS and SUN-ONE DS, check it out at: https://www.redhat.com/archives/fedora-directory-users/2006-April/msg001 45.html -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Tay, Gary Sent: Wednesday, April 12, 2006 6:20 PM To: fedora-directory-users(a)redhat.com Subject: **Caution-External**: [Fedora-directory-users] Automated script for complementing SSLHowTo FDS Folks, I wrote this script for the benefits of all. Gary Content of cr_ssl_certs_fds1ldap.sh #! /bin/sh # # cr_ssl_certs_fds1ldap.sh # # 1) Make sure 'root' is used to run this script # 2) Make sure /home/ldap/dirmgr.pwd contains password of cn=Direcyory Manager # #set -vx IS_ROOT_UID=`id | grep "uid=0(root)"` if [ ! -n "$IS_ROOT_UID" ]; then echo "Please run this script as root" exit 1 fi if [ ! -f /home/ldap/dirmgr.pwd ]; then echo "Please setup /home/ldap/dirmgr.pwd." exit 1 else chmod 600 /home/ldap/dirmgr.pwd fi # Pls customize the followings HOST="ldap1" DOMAIN="example.com" BASEDN="dc=example,dc=com" FQDN="$HOST.$DOMAIN" ORG="Example Companies" LOCALITY="NewYork City" STATE="NewYork" COUNTRY="US" SLAPD_OWNER="nobody" SLAPD_GROUP="nobody" FDS1_PATH=/opt/fedora-ds LD_LIBRARY_PATH=$FDS1_PATH/shared/lib:$FDS1_PATH/lib export LD_LIBRARY_PATH PATH=$FDS1_PATH/shared/bin:$PATH; export PATH cd $FDS1_PATH/alias DOW=`date | cut -d' ' -f1` echo "Backing up existing *.db (if any) to backup_$DOW." mkdir -p backup_$DOW >/dev/null 2>/dev/null cp -p *.db backup_$DOW >/dev/null 2>/dev/null /bin/rm -f *.db >/dev/null 2>/dev/null echo "secretpwd" >pwdfile.txt chmod 600 pwdfile.txt echo "dsadasdasdasdadasdasdasdasdsadfwerwerjfdksdjfksdlfhjsdk" >noise.txt echo "Creating new security key3.db/cert8.db pair." ../shared/bin/certutil -N -d . -f pwdfile.txt echo "Generating encryption key." ../shared/bin/certutil -G -d . -z noise.txt -f pwdfile.txt echo "Generating self-signed CA certificate." ../shared/bin/certutil -S -n "CA certificate" -s "cn=CAcert" -x \ -t "CT,," -m 1000 -v 120 -d . -z noise.txt -f pwdfile.txt echo "Generating self-signed Server certificate." ../shared/bin/certutil -S -n "Server-Cert" -s \ "cn=$FQDN,O=$ORG,L=$LOCALITY,ST=$STATE,C=$COUNTRY" -c "CA certificate" \ -t "u,u,u" -m 1001 -v 120 -d . -z noise.txt -f pwdfile.txt echo "Renaming and linking modified security DBs." mv -f key3.db slapd-$HOST-key3.db mv -f cert8.db slapd-$HOST-cert8.db ln -s slapd-$HOST-key3.db key3.db ln -s slapd-$HOST-cert8.db cert8.db echo "Setting the correct ownership of security DBs" chown $SLAPD_OWNER:$SLAPD_GROUP *.db echo "Self-signed CA and SSL Server certs generated." echo "" echo "The following commands are OPTIONAL." echo "They are for backing up CA and Server Certs in PK12 format," echo "exporting the CA Cert in ASCII format or DER format, and" echo "importing the CA Cert into the Admin Server" echo "" echo "---Start of OPTIONAL commands---" cat <<EOF >optional_cmds.txt ../shared/bin/pk12util -d . -P slapd-$HOST- -o cacert.pfx -n "CA certificate" ../shared/bin/pk12util -d . -P slapd-$HOST- -o servercert.pfx -n "Server-Cert" ../shared/bin/certutil -L -d . -P slapd-$HOST- -n "CA certificate" \ -a > cacert.asc ../shared/bin/certutil -L -d . -P slapd-$HOST- -n "CA certificate" \ -r > cacert.der ../shared/bin/certutil -A -d . -P admin-serv-$HOST- -n "CA certificate" \ -t "CT,," -a -i cacert.asc EOF cat optional_cmds.txt echo "---End of OPTIONAL commands---" echo "" echo "Modifying server SSL configurations." echo "NOTE: changes will be saved to config/dse.ldif when slapd is shutdown" cat <<EOF >/tmp/ssl_enable.ldif dn: cn=encryption,cn=config changetype: modify replace: nsSSL3 nsSSL3: on - replace: nsSSLClientAuth nsSSLClientAuth: allowed - add: nsSSL3Ciphers nsSSL3Ciphers: -rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5, +rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_sha,+fortezz a, +fortezza_rc4_128_sha,+fortezza_null,+tls_rsa_export1024_with_rc4_56_sha , +tls_rsa_export1024_with_des_cbc_sha - add: nsKeyfile nsKeyfile: alias/slapd-$HOST-key3.db - add: nsCertfile nsCertfile: alias/slapd-$HOST-cert8.db dn: cn=config changetype: modify add: nsslapd-security nsslapd-security: on - replace: nsslapd-ssl-check-hostname nsslapd-ssl-check-hostname: off EOF ../shared/bin/ldapmodify -D "cn=Directory Manager" -w `cat /home/ldap/dirmgr.pwd` -f /tmp/ssl_enable.ldif cat <<EOF >/tmp/delRSA.ldif cn=RSA,cn=encryption,cn=config EOF ../shared/bin/ldapdelete -c -D "cn=Directory Manager" -w `cat /home/ldap/dirmgr.pwd` -f /tmp/delRSA.ldif [ $? -eq 0 ] && echo "deleting cn=RSA,cn=encryption,cn=config" cat <<EOF >/tmp/addRSA.ldif dn: cn=RSA,cn=encryption,cn=config objectclass: top objectclass: nsEncryptionModule cn: RSA nsSSLPersonalitySSL: Server-Cert nsSSLToken: internal (software) nsSSLActivation: on EOF ../shared/bin/ldapmodify -a -c -D "cn=Directory Manager" -w `cat /home/ldap/dirmgr.pwd` -f /tmp/addRSA.ldif echo "Creating a pin.txt for auto-starting of slapd." echo "Internal (Software) Token:`cat pwdfile.txt`" >slapd-$HOST-pin.txt chown $SLAPD_OWNER:$SLAPD_GROUP slapd-$HOST-pin.txt chmod 400 slapd-$HOST-pin.txt echo "" echo "IMPORTANT NOTES:" echo "" echo "1. How to check if SSL Configurations are done properly?" echo "You may view config/dse.ldif after shutting down slapd" echo "to verify all the required SSL configurations are there." echo "" echo "2. How to fix slapd startup issue due to mis-configuration of SSL?" echo "If for any reason slapd fails to start due to SSL issue," echo "you may edit config/dse.ldif after shutting down slapd" echo "and revert back to non-SSL configs." echo "i.e. set nsSSL3: off, nsslapd-security: off" echo "and then try to restart slapd." echo "" =======Sample run. # ./cr_ssl_certs_fds1ldap.sh Backing up existing *.db (if any) to backup_Wed. Creating new security key3.db/cert8.db pair. Generating encryption key. Generating key. This may take a few moments... Generating self-signed CA certificate. Generating key. This may take a few moments... Generating self-signed Server certificate. Generating key. This may take a few moments... Renaming and linking modified security DBs. Setting the correct ownership of security DBs Self-signed CA and SSL Server certs generated. The following commands are OPTIONAL. They are for backing up CA and Server Certs in PK12 format, exporting the CA Cert in ASCII format or DER format, and importing the CA Cert into the Admin Server ---Start of OPTIONAL commands--- ../shared/bin/pk12util -d . -P slapd-nj1net200plmon- -o cacert.pfx -n "CA certificate" ../shared/bin/pk12util -d . -P slapd-nj1net200plmon- -o servercert.pfx -n "Server-Cert" ../shared/bin/certutil -L -d . -P slapd-nj1net200plmon- -n "CA certificate" -a > cacert.asc ../shared/bin/certutil -L -d . -P slapd-nj1net200plmon- -n "CA certificate" -r > cacert.der ../shared/bin/certutil -A -d . -P admin-serv-nj1net200plmon- -n "CA certificate" -t "CT,," -a -i cacert.asc ---End of OPTIONAL commands--- Modifying server SSL configurations. NOTE: changes will be saved to config/dse.ldif when slapd is shutdown modifying entry cn=encryption,cn=config ldap_modify: Type or value exists deleting cn=RSA,cn=encryption,cn=config adding new entry cn=RSA,cn=encryption,cn=config Creating a pin.txt for auto-starting of slapd. IMPORTANT NOTES: 1. How to check if SSL Configurations are done properly? You may view config/dse.ldif after shutting down slapd to verify all the required SSL configurations are there. 2. How to fix slapd startup issue due to mis-configuration of SSL? If for any reason slapd fails to start due to SSL issue, you may edit config/dse.ldif after shutting down slapd and revert back to non-SSL configs. i.e. set nsSSL3: off, nsslapd-security: off and then try to restart slapd.

1 0

RE: **Caution-External**: RE: [Fedora-directory-users]: SSL directory server gateway, one-button SSL Certs (slapd + Admin Server) generation script
by Tay, Gary 20 Apr '06

20 Apr '06

Sorry for being "blind", I found the script at the very first "This" word. May be "This" should be changed to "This setupssl.sh", just to help people like me. Gary -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Tay, Gary Sent: Thursday, April 20, 2006 4:46 PM To: General discussion list for the Fedora Directory server project. Subject: **Caution-External**: RE: [Fedora-directory-users]: SSL directory server gateway,one-button SSL Certs (slapd + Admin Server) generation script I couldn't find setupssl.sh anywhere on the HowTo SSL link. Anyway, I have written cr_ssl_certs.sh which works for both FDS and SUN-ONE DS, and this script will create also the Admin Server SSL Cert (the same as slapd), once you have used Admin Console to enable SSL for Admin Server at "Encryption" TAB, you would see a few .conf files including console.conf get updated at $SERVER_ROOT/admin-serv/config, the rest is history. Note that it is not a MUST to create different CA Certs for different FDS Servers, they are so for testing purposes only, for production usage, you would most likely purchase signed SSL Server Certs for your different FDS Servers HTH. Gary Content of cr_ssl_certs.sh #! /bin/sh # # cr_ssl_certs.sh - This script works for either Fedora or SUN-ONE DS # # Gary Tay # # 1) Make sure 'root' is used to run this script # 2) Make sure /home/ldap/dirmgr.pwd contains password of cn=Direcyory Manager # #set -vx IS_ROOT_UID=`id | grep "uid=0(root)"` if [ ! -n "$IS_ROOT_UID" ]; then echo "Please run this script as root" exit 1 fi chmod 700 $0 if [ ! -f /home/ldap/dirmgr.pwd ]; then echo "Please setup /home/ldap/dirmgr.pwd." exit 1 else chmod 600 /home/ldap/dirmgr.pwd fi # Pls customize the followings HOST=`hostname` DOMAIN="example.com" BASEDN="dc=example,dc=com" FQDN="$HOST.$DOMAIN" ORG="Example Companies" LOCALITY="NewYork City" STATE="NewYork" COUNTRY="US" # Uncomment for Fedora/RedHat Directory Server SERVER_ROOT="/opt/fedora-ds" # Uncomment for SUN-ONE/Java System Directory Server #SERVER_ROOT="/var/Sun/mps" if [ "$SERVER_ROOT" = "/opt/fedora-ds" ]; then LD_LIBRARY_PATH=$SERVER_ROOT/lib:$SERVER_ROOT/shared/lib SLAPD_OWNER="ldap" SLAPD_GROUP="ldap" TAR_CVF="tar -Pcvf" TAR_XVF="tar -Pxvf" fi if [ "$SERVER_ROOT" = "/var/Sun/mps" ]; then LD_LIBRARY_PATH=$SERVER_ROOT/lib SLAPD_OWNER="root" SLAPD_GROUP="root" TAR_CVF="tar -cvf" TAR_XVF="tar -xvf" fi export LD_LIBRARY_PATH PATH=$SERVER_ROOT/shared/bin:$PATH; export PATH echo "Please shutdown slapd and Admin Server and perform a tar backup" echo "and db2ldif backup of currently working system, and restart them again." echo "Example of tar command: $TAR_CVF /var/tmp/ds_backup.tar $SERVER_ROOT" echo "When you are ready, answer Yes and press Enter to continue." echo "Press Ctrl-C to cancel." read READY [ "$READY" != "Yes" ] && exit 1 echo "Enter an UNIQUE SERIAL NUMBER for CA Cert." echo "Eg: 1000 for ldap1, 2000 for ldap2, 3000 for ldap3, etc..." read UNIQUE_SN_CA echo "Enter an UNIQUE SERIAL NUMBER for LDAP Server Cert." echo "Eg: 1001 for ldap1, 1002 for ldap2, 1003 for ldap3." read UNIQUE_SN_LDAP cd $SERVER_ROOT/alias echo "Backing up existing *.db (if any) to backup_$$." mkdir -p backup_$$ >/dev/null 2>/dev/null cp -p *.db backup_$$ >/dev/null 2>/dev/null /bin/rm -f *.db >/dev/null 2>/dev/null echo "secretpwd" >pwdfile.txt chmod 600 pwdfile.txt echo "dsadasdasdasdadasdasdasdasdsadfwerwerjfdksdjfksdlfhjsdk" >noise.txt echo "Creating new security key3.db/cert8.db pair." ../shared/bin/certutil -N -d . -f pwdfile.txt echo "Generating encryption key." ../shared/bin/certutil -G -d . -z noise.txt -f pwdfile.txt echo "Generating self-signed CA certificate." ../shared/bin/certutil -S -n "CA certificate" \ -s "cn=CAcert $HOST" -x \ -t "CT,," -m $UNIQUE_SN_CA -v 120 -d . -z noise.txt -f pwdfile.txt echo "Generating self-signed Server certificate." ../shared/bin/certutil -S -n "Server-Cert" \ -s "cn=$FQDN,O=$ORG,L=$LOCALITY,ST=$STATE,C=$COUNTRY" -c "CA certificate" \ -t "u,u,u" -m $UNIQUE_SN_LDAP -v 120 -d . -z noise.txt -f pwdfile.txt echo "Renaming and linking modified security DBs." mv -f key3.db slapd-$HOST-key3.db mv -f cert8.db slapd-$HOST-cert8.db ln -s slapd-$HOST-key3.db key3.db ln -s slapd-$HOST-cert8.db cert8.db echo "Setting the correct ownership of security DBs" chown $SLAPD_OWNER:$SLAPD_GROUP *.db echo "Self-signed CA and SSL Server certs generated." echo "" echo "The following commands are OPTIONAL." echo "They are for backing up CA and Server Certs in PK12 format." echo "" echo "---Start of OPTIONAL commands---" cat <<EOF >optional_cmds.txt ../shared/bin/pk12util -d . -P slapd-$HOST- -o cacert.pfx -n "CA certificate" ../shared/bin/pk12util -d . -P slapd-$HOST- -o servercert.pfx -n "Server-Cert" EOF cat optional_cmds.txt echo "---End of OPTIONAL commands---" echo "" # echo "Enabling SSL." echo "NOTE: changes will be saved to config/dse.ldif when slapd is shutdown" cat <<EOF >/tmp/ssl_enable.ldif dn: cn=encryption,cn=config changetype: modify replace: nsSSL3 nsSSL3: on - replace: nsSSLClientAuth nsSSLClientAuth: allowed dn: cn=config changetype: modify add: nsslapd-security nsslapd-security: on EOF if [ "$SERVER_ROOT" = "/opt/fedora-ds" ]; then cat <<EOF >>/tmp/ssl_enable.ldif dn: cn=config replace: nsslapd-ssl-check-hostname nsslapd-ssl-check-hostname: off EOF fi ../shared/bin/ldapmodify -D "cn=Directory Manager" -w `cat /home/ldap/dirmgr.pwd` -f /tmp/ssl_enable.ldif [ $? -eq 0 ] && \ echo "Enabling SSL in cn=encryption,cn=config and cn=config done." [ $? -ne 0 ] && \ echo "Enabling SSL in cn=encryption,cn=config and cn=config failed." # cat <<EOF >/tmp/add_ssl_configs.ldif dn: cn=encryption,cn=config changetype: modify add: nsSSL3Ciphers nsSSL3Ciphers: -rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5, +rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_sha,+fortezz a, +fortezza_rc4_128_sha,+fortezza_null,+tls_rsa_export1024_with_rc4_56_sha , +tls_rsa_export1024_with_des_cbc_sha - add: nsKeyfile nsKeyfile: alias/slapd-$HOST-key3.db - add: nsCertfile nsCertfile: alias/slapd-$HOST-cert8.db EOF ../shared/bin/ldapmodify -D "cn=Directory Manager" -w `cat /home/ldap/dirmgr.pwd` -f /tmp/add_ssl_configs.ldif [ $? -eq 0 ] && echo "Adding SSL configs in cn=encryption,cn=config done." [ $? -ne 0 ] && echo "Adding SSL configs in cn=encryption,cn=config failed." # cat <<EOF >/tmp/addRSA.ldif dn: cn=RSA,cn=encryption,cn=config objectclass: top objectclass: nsEncryptionModule cn: RSA nsSSLPersonalitySSL: Server-Cert nsSSLToken: internal (software) nsSSLActivation: on EOF ../shared/bin/ldapmodify -a -c -D "cn=Directory Manager" -w `cat /home/ldap/dirmgr.pwd` -f /tmp/addRSA.ldif [ $? -eq 0 ] && echo "Adding cn=RSA,cn=encryption,cn=config done." [ $? -ne 0 ] && echo "Adding cn=RSA,cn=encryption,cn=config failed." # echo "Creating a pin.txt for auto-starting of slapd." echo "Internal (Software) Token:`cat pwdfile.txt`" >slapd-$HOST-pin.txt chown $SLAPD_OWNER:$SLAPD_GROUP slapd-$HOST-pin.txt chmod 400 slapd-$HOST-pin.txt echo "Exporting the CA Cert in ASCII format or DER format" ../shared/bin/certutil -L -d . -P slapd-$HOST- -n "CA certificate" \ -a > cacert.asc ../shared/bin/certutil -L -d . -P slapd-$HOST- -n "CA certificate" \ -r > cacert.der echo "Copying Server-Cert to Admin Server for Admin Server SSL connection." cp slapd-$HOST-key3.db admin-serv-$HOST-key3.db cp slapd-$HOST-cert8.db admin-serv-$HOST-cert8.db echo "Setting the correct ownership of Admin Server security DBs" chown $SLAPD_OWNER:$SLAPD_GROUP admin-serv-$HOST-*.db echo "Remember to enable SSL in Admin Server later." echo "Remember to select 'Server-Cert' as the Certificate and click OK." echo "Remember to restart Admin Server after that." echo "Creating a pin.txt for auto-starting of Admin Server." echo "`cat pwdfile.txt`" >admin-serv-$HOST-pin.txt chown $SLAPD_OWNER:$SLAPD_GROUP admin-serv-$HOST-pin.txt chmod 400 admin-serv-$HOST-pin.txt echo "Patching start-admin and creating start-admin.auto." if [ "$SERVER_ROOT" = "/opt/fedora-ds" ]; then sed -e \ '/^\$HTTPD/s/$/ \<"$SERVER_ROOT"\/alias\/admin-serv-`hostname`-pin.txt/' \ $SERVER_ROOT/start-admin >$SERVER_ROOT/start-admin.auto fi if [ "$SERVER_ROOT" = "/var/Sun/mps" ]; then sed -e \ '/uxwdog/s/$/ \<"$SERVER_ROOT"\/alias\/admin-serv-`hostname`-pin.txt/' \ $SERVER_ROOT/start-admin >$SERVER_ROOT/start-admin.auto fi chmod 755 $SERVER_ROOT/start-admin.auto echo "Please use $SERVER_ROOT/start-admin.auto in rc3.d as autostart script." echo "" echo "IMPORTANT NOTES:" echo "" echo "1. How to check if SSL Configurations are done properly?" echo "You may view config/dse.ldif after shutting down slapd" echo "to verify all the required SSL configurations are there." echo "" echo "2. How to fix slapd startup issue due to mis-configuration of SSL?" echo "If for any reason slapd fails to start due to SSL issue," echo "you may edit config/dse.ldif after shutting down slapd" echo "and revert back to non-SSL configs." echo "i.e. set nsSSL3: off, nsSSLActivation: off and nsslapd-security: off" echo "and then try to restart slapd." echo "" echo "3. How to fix Admin Server login issue due to mis-configuration of SSL?" echo "If for any reason Admin Server login fails and you wish to give up," echo "simply stop slapd and admin-serv and restore using the tar backup" echo "i.e. rm -f $SERVER_ROOT/alias/*.db;$TAR_XVF /var/tmp/ds_backup.tar" echo "" ===Sample Run=== # ./cr_ssl_certs.sh Please shutdown slapd and Admin Server and perform a tar backup and db2ldif backup of currently working system, and restart them again. Example of tar command: tar -cvf /var/tmp/ds_backup.tar /var/Sun/mps When you are ready, answer Yes and press Enter to continue. Press Ctrl-C to cancel. Yes Enter an UNIQUE SERIAL NUMBER for CA Cert. Eg: 1000 for ldap1, 2000 for ldap2, 3000 for ldap3, etc... 1000 Enter an UNIQUE SERIAL NUMBER for LDAP Server Cert. Eg: 1001 for ldap1, 1002 for ldap2, 1003 for ldap3. 1001 Backing up existing *.db (if any) to backup_24872. Creating new security key3.db/cert8.db pair. Generating encryption key. Generating key. This may take a few moments... Generating self-signed CA certificate. Generating key. This may take a few moments... Generating self-signed Server certificate. Generating key. This may take a few moments... Renaming and linking modified security DBs. Setting the correct ownership of security DBs Self-signed CA and SSL Server certs generated. The following commands are OPTIONAL. They are for backing up CA and Server Certs in PK12 format. ---Start of OPTIONAL commands--- ../shared/bin/pk12util -d . -P slapd-ldap1- -o cacert.pfx -n "CA certificate" ../shared/bin/pk12util -d . -P slapd-ldap1- -o servercert.pfx -n "Server-Cert" ---End of OPTIONAL commands--- Enabling SSL. NOTE: changes will be saved to config/dse.ldif when slapd is shutdown modifying entry cn=encryption,cn=config modifying entry cn=config Enabling SSL in cn=encryption,cn=config and cn=config done. modifying entry cn=encryption,cn=config Adding SSL configs in cn=encryption,cn=config done. adding new entry cn=RSA,cn=encryption,cn=config Adding cn=RSA,cn=encryption,cn=config done. Creating a pin.txt for auto-starting of slapd. Exporting the CA Cert in ASCII format or DER format Copying Server-Cert to Admin Server for Admin Server SSL connection. Setting the correct ownership of Admin Server security DBs Remember to enable SSL in Admin Server later. Remember to select 'Server-Cert' as the Certificate and click OK. Remember to restart Admin Server after that. Creating a pin.txt for auto-starting of Admin Server. Patching start-admin and creating start-admin.auto. Please use /var/Sun/mps/start-admin.auto in rc3.d as autostart script. IMPORTANT NOTES: 1. How to check if SSL Configurations are done properly? You may view config/dse.ldif after shutting down slapd to verify all the required SSL configurations are there. 2. How to fix slapd startup issue due to mis-configuration of SSL? If for any reason slapd fails to start due to SSL issue, you may edit config/dse.ldif after shutting down slapd and revert back to non-SSL configs. i.e. set nsSSL3: off, nsSSLActivation: off and nsslapd-security: off and then try to restart slapd. 3. How to fix Admin Server login issue due to mis-configuration of SSL? If for any reason Admin Server login fails and you wish to give up, simply stop slapd and admin-serv and restore using the tar backup i.e. rm -f /var/Sun/mps/alias/*.db;tar -xvf /var/tmp/ds_backup.tar -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Jason Russler Sent: Thursday, April 20, 2006 4:15 AM To: General discussion list for the Fedora Directory server project. Subject: [Fedora-directory-users] SSL directory server gateway Hi all, I'm pretty uncertain about the best way to go about configuring the admin server to use SSL (FDS1.0.2) . All of the docs I'm finding are pretty shaky. Ultimately, I want users to manage their passwords and info via the web-based Directory Server Gateway over SSL. This would appear to be the same thing as enabling SSL for the admin server. The setupssl.sh script provided by the SSL howto, generates the keys/certs for the admin server and imports them into the appropriate cert db (I guess, I've performed the process by hand as well, based on RedHat's docs and the script itself). This would imply to me that the admin console would find the generated certs and present them in the admin server's console (under the Configuration -> Encryption tab) in much the same way that it does in the directory server's console. I can't tell if something that's suppose to work isn't or if I'm misunderstanding something. I'd like to know before I try to generate new SSL certificates and import them. Thanks much, Jason -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

1 0

RE: [Fedora-directory-users] Exporting MD5 Hash from FD-DS into/etc/shadow
by DeMarco, Dennis 19 Apr '06

19 Apr '06

I had some time to play with this. I do not believe it can be done easily unless another password storage mechanism is made as a plug-in. The GNU-MD5 password format for /etc/shadow I believe is: $1$, followed by an 8 character salt, $, 22 character hash. Seems like something that could be very useful though. I have some servers in which are considered super 'production' not in LDAP but liked to export users from LDAP to make /etc/passwd/shadows. - Dennis -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Howard Chu Sent: Wednesday, April 19, 2006 4:05 PM To: fedora-directory-users(a)redhat.com Subject: Re: [Fedora-directory-users] Exporting MD5 Hash from FD-DS into/etc/shadow fedora-directory-users-request(a)redhat.com wrote: > Date: Tue, 18 Apr 2006 20:14:31 +0300 > From: Mike Jackson <mj(a)sci.fi> > > dennis(a)demarco.com wrote: > >> I would like to export the MD5 hash from the Fedora directory user's >> password attribute into /etc/shadow of a Linux machine not in LDAP >> (Redhat). >> >> It appears this isn't working, is there a way for me to do this? Not all >> machines are using ldap but I would like to export from ldap. >> > > > Hi, > I haven't tried this, but here's an idea just off the top of my head > which _might_ work: > > > 1. take away the {MD5} from the string > > 2. base64 decode the rest of the string > > 3. convert the string to hex > > 4. put the $1$ at the front of the hex string > > 5. put the whole string into the password field in /etc/shadow and test > > > If that works, you could write a perl script to automate the procedure. > And report back to the list as well :-) > > No, the password field is not in hex, it uses the same 6-bit encoding that DES crypt() uses, which is different from base64. base64 uses the characters [A-Z][a-z][0-9]+/ while crypt uses the characters ./[0-9][A-Z][a-z] (in those exact orders). -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/ -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message. Any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited.

2 1

Re: [Fedora-directory-users] Exporting MD5 Hash from FD-DS into /etc/shadow
by Howard Chu 19 Apr '06

19 Apr '06

fedora-directory-users-request(a)redhat.com wrote: > Date: Tue, 18 Apr 2006 20:14:31 +0300 > From: Mike Jackson <mj(a)sci.fi> > > dennis(a)demarco.com wrote: > >> I would like to export the MD5 hash from the Fedora directory user's >> password attribute into /etc/shadow of a Linux machine not in LDAP >> (Redhat). >> >> It appears this isn't working, is there a way for me to do this? Not all >> machines are using ldap but I would like to export from ldap. >> > > > Hi, > I haven't tried this, but here's an idea just off the top of my head > which _might_ work: > > > 1. take away the {MD5} from the string > > 2. base64 decode the rest of the string > > 3. convert the string to hex > > 4. put the $1$ at the front of the hex string > > 5. put the whole string into the password field in /etc/shadow and test > > > If that works, you could write a perl script to automate the procedure. > And report back to the list as well :-) > > No, the password field is not in hex, it uses the same 6-bit encoding that DES crypt() uses, which is different from base64. base64 uses the characters [A-Z][a-z][0-9]+/ while crypt uses the characters ./[0-9][A-Z][a-z] (in those exact orders). -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

1 0

Re: [Fedora-directory-users] upperlimit on uidNumber
by Mike Jackson 19 Apr '06

19 Apr '06

> http://kbase.redhat.com/faq/FAQ_80_6231.shtm Aha, they are stored as signed integers, so the actual number is in the 2 billion range... For some reason, I just assumed that they would be unsigned integers. Thanks for the pointer! -- mike

2 1

Re: [Fedora-directory-users] upperlimit on uidNumber
by Mike Jackson 19 Apr '06

19 Apr '06

> I was wondering if there is an upper limit on the uid or the gidNumber in > fds. > Or is there a limit on OS level? Does anyone know what it is? Is this > different between the RedHat releases? > Is it different from other Unixes? I have personally loaded 10 million user accounts into FDS as a performance test (on a measly 2.4Ghz P4 machine with 512MB of RAM), and it worked just fine; not sure how many it could theoretically hold. The linux kernel has officially had support for 32-bit uidnumbers since kernel v2.4, so the maximum user id number is 4294967295, or approximately 4.3 billion. This is the same on any distribution using kernel 2.4 or newer. I am not sure about UNIX... -- mike

2 1

[Fedora-directory-users] upperlimit on uidNumber
by Jo De Troy 19 Apr '06

19 Apr '06

Hello, I was wondering if there is an upper limit on the uid or the gidNumber in fds. Or is there a limit on OS level? Does anyone know what it is? Is this different between the RedHat releases? Is it different from other Unixes? Thanks in advance, Jo

1 0

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users April 2006