389-users April 2006

389-users@lists.fedoraproject.org

53 participants
82 discussions

[Fedora-directory-users] How interhangeable are ldap server?
by Mont Rothstein 14 Apr '06

14 Apr '06

We have a windows app that uses an LDAP server for authentication. For our clients that don't already have an LDAP server we provide FDS. However many of our clients already have an LDAP server (AD, Novell, IBM, Oracle). How interchangeable are LDAP servers? Are we likely to be able to just talk to any server, or will we need custom code for each? In addition to authentication we plan to create and assign roles, and possibly use a small custom schema. Any information or pointers to information on this would be appreciated. I couldn't find anything via Google. Thanks, -Mont

4 6

[Fedora-directory-users] import schema from openldap : syntax oid problem
by Mikael Kermorgant 14 Apr '06

14 Apr '06

Hello, I've converted a schema from openldap ( http://www.cru.fr/ldap/supann/schema/supann.schema) which causes this error when starting fds : # /opt/fedora-ds/slapd-afed/start-slapd [13/Apr/2006:14:17:09 +0200] dse - The entry cn=schema in file /opt/fedora-ds/slapd-afed/config/schema/98supann.ldif is invalid, error code 21 (Invalid syntax) - attribute type supannCivilite: Unknown attribute syntax OID "1.3.6.1.4.1.1466.115.121.1.44" [13/Apr/2006:14:17:09 +0200] dse - Please edit the file to correct the reported problems and then restart the server. It seems to be related to rfc2252<http://src.doc.ic.ac.uk/computing/internet/rfc/rfc2252.txt>. Do you know a workaround for this situation ? Thanks in advance, -- Mikael Kermorgant

2 2

[Fedora-directory-users] Another one-button script - rebuild_fds.sh
by Tay, Gary 13 Apr '06

13 Apr '06

FDS Folks, Another automated script from me. Gary > #! /bin/sh > # > # rebuild_fds.sh - ReBuild Fedora Directory Server > # > # Gary Tay > # > # NOTE: This script will rebuild a FDS Server compatible with BOTH > # RedHat and Solaris LDAP Clients > # > # 1) Make sure 'root' is used to run this script > # 2) Make sure /home/ldap/dirmgr.pwd contains password of cn=Direcyory > Manager > # > #set -vx > IS_ROOT_UID=`id | grep "uid=0(root)"` > if [ ! -n "$IS_ROOT_UID" ]; then > echo "Please run this script as root" > exit 1 > fi > if [ ! -f /home/ldap/dirmgr.pwd ]; then > echo "Please setup /home/ldap/dirmgr.pwd." > exit 1 > else > chmod 600 /home/ldap/dirmgr.pwd > fi > # Pls customize the followings > FDS1_PATH=/opt/fedora-ds > HOST=ldap1 > DOMAIN="example.com" > BASEDN="dc=example,dc=com" > SLAPD_OWNER=nobody > SLAPD_GROUP=nobody > LD_LIBRARY_PATH=$FDS1_PATH/shared/lib:$FDS1_PATH/lib > export LD_LIBRARY_PATH > PATH=$FDS1_PATH/shared/bin:$PATH; export PATH > echo "ASSUMPTION: This script assumes that you have performed" > echo "'rpm -e' and then 'rpm -ivh' to reinstall Fedora Directory > Server" > echo "and you have re-run the setup program" > echo "ns-slapd should be running" > echo "Press [Ctrl-C] to abort, enter [Yes] to continue..." > read a_key > [ "$a_key" != "Yes" ] && exit 1 > # Load schemas > cat <<EOF >/tmp/61DUAConfigProfile.ldif > dn: cn=schema > attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.0 NAME 'defaultServerList' > DESC 'Default LDAP server host address used by a DUA' EQUALITY > caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) > attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.1 NAME 'defaultSearchBase' > DESC 'Default LDAP base DN used by a DUA' EQUALITY > distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 > SINGLE-VALUE ) > attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.2 NAME 'preferredServerList' > DESC 'Preferred LDAP server host addresses to be used by a DUA' > EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > SINGLE-VALUE ) > attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.3 NAME 'searchTimeLimit' DESC > 'Maximum time in seconds a DUA should allow for a search to complete' > EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 > SINGLE-VALUE ) > attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.4 NAME 'bindTimeLimit' DESC > 'Maximum time in seconds a DUA should allow for the bind operation to > complete' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 > SINGLE-VALUE ) > attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.5 NAME 'followReferrals' DESC > 'Tells DUA if it should follow referrals returned by a DSA search > result' EQUALITY caseIgnoreIA5Match SYNTAX > 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) > attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.6 NAME 'authenticationMethod' > DESC 'A keystring which identifies the type of authentication method > used to contact the DSA' EQUALITY caseIgnoreMatch SYNTAX > 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) > attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.7 NAME 'profileTTL' DESC > 'Time to live, in seconds, before a client DUA should re-read this > configuration profile' EQUALITY integerMatch SYNTAX > 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) > attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.14 NAME > 'serviceSearchDescriptor' DESC 'LDAP search descriptor list used by a > DUA' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) > attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.9 NAME 'attributeMap' DESC > 'Attribute mappings used by a DUA' EQUALITY caseIgnoreIA5Match SYNTAX > 1.3.6.1.4.1.1466.115.121.1.26 ) > attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.10 NAME 'credentialLevel' > DESC 'Identifies type of credentials a DUA should use when binding to > the LDAP server' EQUALITY caseIgnoreIA5Match SYNTAX > 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) > attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.11 NAME 'objectclassMap' DESC > 'Objectclass mappings used by a DUA' EQUALITY caseIgnoreIA5Match > SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) > attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.12 NAME 'defaultSearchScope' > DESC 'Default search scope used by a DUA' EQUALITY caseIgnoreIA5Match > SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) > attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.13 NAME > 'serviceCredentialLevel' DESC 'Identifies type of credentials a DUA > should use when binding to the LDAP server for a specific service' > EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) > attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.15 NAME > 'serviceAuthenticationMethod' DESC 'Authentication method used by a > service of the DUA' EQUALITY caseIgnoreMatch SYNTAX > 1.3.6.1.4.1.1466.115.121.1.15 ) > objectClasses: ( 1.3.6.1.4.1.11.1.3.1.2.4 NAME 'DUAConfigProfile' SUP > top STRUCTURAL DESC 'Abstraction of a base configuration for a DUA' > MUST ( cn ) MAY ( defaultServerList $ preferredServerList $ > defaultSearchBase $ defaultSearchScope $ searchTimeLimit $ > bindTimeLimit $ credentialLevel $ authenticationMethod $ > followReferrals $ serviceSearchDescriptor $ serviceCredentialLevel $ > serviceAuthenticationMethod $ objectclassMap $ attributeMap $ > profileTTL ) ) > EOF > cat <<EOF >/tmp/62nisDomain.ldif > dn: cn=schema > attributeTypes: ( 1.3.6.1.1.1.1.30 NAME 'nisDomain' DESC 'NIS domain' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) > objectClasses: ( 1.3.6.1.1.1.2.15 NAME 'nisDomainObject' SUP top > STRUCTURAL MUST nisDomain X-ORIGIN 'user defined' ) > EOF > /bin/cp -f /tmp/61DUAConfigProfile.ldif > $FDS1_PATH/slapd-$HOST/config/schema > /bin/cp -f /tmp/62nisDomain.ldif $FDS1_PATH/slapd-$HOST/config/schema > chown $SLAPD_OWNER:$SLAPD_GROUP > $FDS1_PATH/slapd-$HOST/config/schema/61DUAConfigProfile.ldif > chown $SLAPD_OWNER:$SLAPD_GROUP > $FDS1_PATH/slapd-$HOST/config/schema/62nisDomain.ldif > $FDS1_PATH/slapd-$HOST/stop-slapd > $FDS1_PATH/slapd-$HOST/start-slapd > # Add nisDomainObject > cat <<EOF >/tmp/add_nisDomainObject.ldif > dn: $BASEDN > changetype: modify > add: objectclass > objectclass: nisdomainobject > - > replace: nisdomain > nisdomain: $DOMAIN > > EOF > ldapmodify -D "cn=Directory Manager" -w `cat /home/ldap/dirmgr.pwd` -f > /tmp/add_nisDomainObject.ldif > # Add two ACIs > cat <<EOF >/tmp/add_two_ACIs.ldif > dn: $BASEDN > changetype: modify > add: aci > aci: (targetattr = > "cn||uid||uidNumber||gidNumber||homeDirectory||shadowLastChange||shado > wMin||shadowMax||shadowWarning||shadowInactive||shadowExpire||shadowFl > ag||memberUid")(version 3.0; acl > LDAP_Naming_Services_deny_write_access;deny (write) userdn = > "ldap:///self";) > - > add: aci > aci: (target="ldap:///$BASEDN")(targetattr="userPassword")(version > 3.0; acl LDAP_Naming_Services_proxy_password_read; allow > (compare,search) userdn = "ldap:///cn=proxyagent,ou=profile,$BASEDN";) > > EOF > ldapmodify -D "cn=Directory Manager" -w `cat /home/ldap/dirmgr.pwd` -f > /tmp/add_two_ACIs.ldif > # Modify default password storage scheme > cat <<EOF >/tmp/mod_passwordStorageScheme.ldif > dn: cn=config > changetype: modify > replace: passwordStorageScheme > passwordStorageScheme: CRYPT > EOF > ldapmodify -D "cn=Directory Manager" -w `cat /home/ldap/dirmgr.pwd` -f > /tmp/mod_passwordStorageScheme.ldif > # Create ou=group, proxyAgent and ldapclient profiles > cat <<EOF >/tmp/People.ldif > dn: uid=gtay, ou=People, $BASEDN > givenName: Gary > sn: Tay > loginShell: /bin/bash > uidNumber: 6167 > gidNumber: 102 > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: inetorgperson > objectClass: posixAccount > objectClass: shadowAccount > uid: gtay > cn: Gary Tay > homeDirectory: /home/gtay > userPassword: {CRYPT}U8bo2twhJ9Kkg > > dn: uid=tuser, ou=People, $BASEDN > givenName: Test > sn: User > loginShell: /bin/bash > uidNumber: 9999 > gidNumber: 102 > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: inetorgperson > objectClass: posixAccount > objectClass: shadowAccount > uid: tuser > cn: Test User > homeDirectory: /home/tuser > userPassword: {SHA}MWxHz/4F3kXGXlfK4EvIJUo2C2U= > > EOF > $FDS1_PATH/shared/bin/ldapmodify -a -c -D "cn=Directory Manager" -w > `cat /home/ldap/dirmgr.pwd` -f /tmp/People.ldif > cat <<EOF >/tmp/group_and_other_OUs.ldif > dn: ou=group,$BASEDN > objectClass: organizationalUnit > objectClass: top > ou: group > > dn: cn=Users,ou=group,$BASEDN > cn: Users > gidNumber: 102 > objectClass: top > objectClass: posixGroup > memberUid: gtay > memberUid: tuser > > dn: ou=netgroup,$BASEDN > objectClass: organizationalUnit > objectClass: top > ou: netgroup > > dn: ou=sudoers,$BASEDN > objectClass: organizationalUnit > objectClass: top > ou: sudoers > > EOF > $FDS1_PATH/shared/bin/ldapmodify -a -c -D "cn=Directory Manager" -w > `cat /home/ldap/dirmgr.pwd` -f /tmp/group_and_other_OUs.ldif > cat <<EOF >/tmp/proxyAgent_and_profiles.ldif > dn: ou=profile,$BASEDN > objectClass: top > objectClass: organizationalUnit > ou: profile > > dn: cn=proxyAgent,ou=profile,$BASEDN > objectClass: top > objectClass: person > cn: proxyAgent > sn: proxyAgent > userPassword: {CRYPT}l14aeXtphVSUg > > dn: cn=default,ou=profile,$BASEDN > objectClass: top > objectClass: DUAConfigProfile > defaultServerList: $HOST.$DOMAIN > defaultSearchBase: $BASEDN > authenticationMethod: simple > followReferrals: TRUE > defaultSearchScope: one > searchTimeLimit: 30 > profileTTL: 43200 > cn: default > credentialLevel: proxy > bindTimeLimit: 2 > serviceSearchDescriptor: passwd: ou=People,$BASEDN?one > serviceSearchDescriptor: group: ou=group,$BASEDN?one > serviceSearchDescriptor: shadow: ou=People,$BASEDN?one > serviceSearchDescriptor: netgroup: ou=netgroup,$BASEDN?one > serviceSearchDescriptor: sudoers: ou=sudoers,$BASEDN?one > > dn: cn=tls_profile,ou=profile,$BASEDN > ObjectClass: top > ObjectClass: DUAConfigProfile > defaultServerList: $HOST.$DOMAIN > defaultSearchBase: $BASEDN > authenticationMethod: tls:simple > followReferrals: FALSE > defaultSearchScope: one > searchTimeLimit: 30 > profileTTL: 43200 > bindTimeLimit: 10 > cn: tls_profile > credentialLevel: proxy > serviceSearchDescriptor: passwd: ou=People,$BASEDN?one > serviceSearchDescriptor: group: ou=group,$BASEDN?one > serviceSearchDescriptor: shadow: ou=People,$BASEDN?one > serviceSearchDescriptor: netgroup: ou=netgroup,$BASEDN?one > serviceSearchDescriptor: sudoers: ou=sudoers,$BASEDN?one > > EOF > $FDS1_PATH/shared/bin/ldapmodify -a -c -D "cn=Directory Manager" -w > `cat /home/ldap/dirmgr.pwd` -f /tmp/proxyAgent_and_profiles.ldif > echo "Rebuild done." > > ===Sample Run=== > > # ./rebuild_fds.sh > ASSUMPTION: This script assumes that you have performed > 'rpm -e' and then 'rpm -ivh' to reinstall Fedora Directory Server > and you have re-run the setup program > ns-slapd should be running > Press [Ctrl-C] to abort, enter [Yes] to continue... > Yes > modifying entry dc=example,dc=com > > modifying entry dc=example,dc=com > ldap_modify: Type or value exists > > modifying entry cn=config > > adding new entry uid=gtay, ou=People, dc=example,dc=com > > adding new entry uid=tuser, ou=People, dc=example,dc=com > > adding new entry ou=group,dc=example,dc=com > > adding new entry cn=Users,ou=group,dc=example,dc=com > > adding new entry ou=netgroup,dc=example,dc=com > > adding new entry ou=sudoers,dc=example,dc=com > > adding new entry ou=profile,dc=example,dc=com > > adding new entry cn=proxyAgent,ou=profile,dc=example,dc=com > > adding new entry cn=default,ou=profile,dc=example,dc=com > > adding new entry cn=tls_profile,ou=profile,dc=example,dc=com > > Rebuild done.

1 0

[Fedora-directory-users] Startconsole issues on Windows
by Ken Morehouse 12 Apr '06

12 Apr '06

Hello all. I just recently installed Fedora Directory Server v1.0.2-1. I'm able to get the startconsole script to start up without an issue on the RedHat server, but have been having considerable issues trying to get the code to run on my workstation. I get lost with Java pretty easily, and this is most likely user error, but I can't seem to get a resolution. Any help will be greatly appreciated. If I could get the Java to load, I can work through any connectivity to the admin server. Here are some of the details of my attempts. 1) Tried to run ./startconsole -D on the server, but only get "Fedora-Management-Console/1.0 B2006.060.198" on stdout. 2) Used the HOWTO at http://directory.fedora.redhat.com/wiki/Howto:WindowsConsole to build the fedora folder and script on my XP workstation. 3) No SSL setup on the server until the basics are working. 4) When running the batch file on my machine, I get the following error. "Exception in thread "main" java.lang.NoClassDefFoundError: /com/netscape/management/client/console/Console" - Output from java -version on my workstation: java version "1.5.0_06" Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_06-b05) Java HotSpot(TM) Client VM (build 1.5.0_06-b05, mixed mode) - Contents of my batch file @echo off set PATH=c:\fedora\lib\jss;c:\fedora\java;c:\fedora\lib;c:\program files\Java\jre1.5.0_06\bin;%PATH% "C:\Program files\Java\jre1.5.0_06\bin\java" -ms8m -mx64m -cp .;.\java\fedora-nmclf-1.0.jar;.\java\fedora-base.jar;.\java\ldapjdk.jar;.\ja va\fedora-mcc-1.0.jar;.\java\fedora-nmclf-1.0_en.jar;.\java\fedora-mcc-1.0_e n.jar;.\java\jss3.jar; -Djava.library.path=c:\fedora\lib -Djava.util.prefs.systemRoot=.\.java -Djava.util.prefs.userRoot= .com.netscape.management.client.console.Console -D -a http://adminsserver:port - Contents of my c:\fedora\java directory 04/12/2006 10:24 AM 37,364 fedora-base-1.0.jar 04/12/2006 10:24 AM 1,004,998 fedora-mcc-1.0.jar 04/12/2006 10:24 AM 109,407 fedora-mcc-1.0_en.jar 04/12/2006 10:24 AM 26,242 fedora-nmclf-1.0.jar 04/12/2006 10:24 AM 10,306 fedora-nmclf-1.0_en.jar 04/12/2006 09:26 AM <DIR> html 04/12/2006 09:26 AM <DIR> jars 04/12/2006 10:24 AM 611,431 jss3.jar 04/12/2006 10:24 AM 264,659 ldapjdk.jar - Contents of my c:\fedora\lib directory 04/12/2006 10:24 AM 123,480 acl-plugin.so 04/12/2006 10:24 AM 17,824 attr-unique-plugin.so 04/12/2006 10:24 AM 74,160 chainingdb-plugin.so 04/12/2006 10:24 AM 33,612 cos-plugin.so 04/12/2006 10:24 AM 9,488 des-plugin.so 04/12/2006 10:24 AM 23,808 http-client-plugin.so 04/11/2006 04:20 PM <DIR> jss 04/12/2006 10:24 AM 379,800 libback-ldbm.so 04/12/2006 10:24 AM 174,613 libjss3.so 04/12/2006 10:24 AM 22,536 liblcoll.so 04/12/2006 10:24 AM 13,036 passthru-plugin.so 04/12/2006 09:26 AM <DIR> perl 04/12/2006 10:24 AM 18,980 pwdstorage-plugin.so 04/12/2006 10:24 AM 16,956 referint-plugin.so 04/12/2006 10:24 AM 387,172 replication-plugin.so 04/12/2006 10:24 AM 32,384 retrocl-plugin.so 04/12/2006 10:24 AM 24,512 roles-plugin.so 04/12/2006 10:24 AM 7,432 statechange-plugin.so 04/12/2006 10:24 AM 24,736 syntax-plugin.so 04/12/2006 10:24 AM 15,736 views-plugin.so

2 2

[Fedora-directory-users] mass delete : size limit problem
by Mikael Kermorgant 12 Apr '06

12 Apr '06

Hello, I'd like to run a script that deletes everything from ou=People (~ 5000 users). The problem is that I first run a search and the result size is limited by the server. Increasing thiis limit would surely work but I don't find it very elegant. Do you see another solution ? Thanks in advance, -- Mikael Kermorgant PS : My script does the following : retrieveAttributes = [ "entrydn" ] searchFilter = "(uid=*)" ldap_result_id = l.search(baseDN, searchScope, searchFilter, retrieveAttributes) while 1: result_type, result_data = l.result(ldap_result_id, 0) if (result_data == []): break else: if result_type == ldap.RES_SEARCH_ENTRY: print result_data[0][1]['entrydn'][0] + ' deleted' l.delete_s(result_data[0][1]['entrydn'][0])

3 2

[Fedora-directory-users] OS Migration
by Jim Summers 12 Apr '06

12 Apr '06

Hello List, I am closing in on my target date to switch over to FDS. On my test machines I have been running with FC4. I need to re-install the operating system and when I do I will have to use RHEL4. My plan was to shutdown the DS. Then make a tarball of /opt/fedora-ds and several other directories. Next re-install with RHEL4 Drop in my iptables Install fedora-ds and verify the OS / performance settings. Then extract my fedora-ds tarball and then hold my breath and start the DS service(s) and presto all is well??? Does this sound like a feasible approach? I am a little unsure if it will break any of my configured ssl stuff. Which is a basic self-signed scenario using the /opt/fedora-ds/shared/bin/certutil for the key generation. TIA -- Jim Summers School of Computer Science-University of Oklahoma -------------------------------------------------

3 5

[Fedora-directory-users] Are these messages in errors log critical?
by Tay, Gary 12 Apr '06

12 Apr '06

I have managed to setup SSL config and started slapd, the followings appear in errors log, may I know if they are critical errors? Gary [12/Apr/2006:05:58:12 -0400] - Fedora-Directory/1.0.2 B2006.060.1925 starting up [12/Apr/2006:05:58:12 -0400] - attrcrypt_unwrap_key: failed to unwrap key for ci pher AES [12/Apr/2006:05:58:12 -0400] - Failed to retrieve key for cipher AES in attrcryp t_cipher_init [12/Apr/2006:05:58:12 -0400] - Failed to initialize cipher AES in attrcrypt_init [12/Apr/2006:05:58:12 -0400] - attrcrypt_unwrap_key: failed to unwrap key for ci pher AES [12/Apr/2006:05:58:12 -0400] - Failed to retrieve key for cipher AES in attrcryp t_cipher_init [12/Apr/2006:05:58:12 -0400] - Failed to initialize cipher AES in attrcrypt_init [12/Apr/2006:05:58:12 -0400] - slapd started. Listening on All Interfaces port 389 for LDAP requests [12/Apr/2006:05:58:12 -0400] - Listening on All Interfaces port 636 for LDAPS re quests

2 1

[Fedora-directory-users] Automated script for complementing SSL HowTo
by Tay, Gary 12 Apr '06

12 Apr '06

FDS Folks, I wrote this script for the benefits of all. Gary > Content of cr_ssl_certs_fds1ldap.sh > > #! /bin/sh > # > # cr_ssl_certs_fds1ldap.sh > # > # 1) Make sure 'root' is used to run this script > # 2) Make sure /home/ldap/dirmgr.pwd contains password of cn=Direcyory > Manager > # > #set -vx > IS_ROOT_UID=`id | grep "uid=0(root)"` > if [ ! -n "$IS_ROOT_UID" ]; then > echo "Please run this script as root" > exit 1 > fi > if [ ! -f /home/ldap/dirmgr.pwd ]; then > echo "Please setup /home/ldap/dirmgr.pwd." > exit 1 > else > chmod 600 /home/ldap/dirmgr.pwd > fi > # Pls customize the followings > HOST="ldap1" > DOMAIN="example.com" > BASEDN="dc=example,dc=com" > FQDN="$HOST.$DOMAIN" > ORG="Example Companies" > LOCALITY="NewYork City" > STATE="NewYork" > COUNTRY="US" > SLAPD_OWNER="nobody" > SLAPD_GROUP="nobody" > FDS1_PATH=/opt/fedora-ds > LD_LIBRARY_PATH=$FDS1_PATH/shared/lib:$FDS1_PATH/lib > export LD_LIBRARY_PATH > PATH=$FDS1_PATH/shared/bin:$PATH; export PATH > cd $FDS1_PATH/alias > DOW=`date | cut -d' ' -f1` > echo "Backing up existing *.db (if any) to backup_$DOW." > mkdir -p backup_$DOW >/dev/null 2>/dev/null > cp -p *.db backup_$DOW >/dev/null 2>/dev/null > /bin/rm -f *.db >/dev/null 2>/dev/null > echo "secretpwd" >pwdfile.txt > chmod 600 pwdfile.txt > echo "dsadasdasdasdadasdasdasdasdsadfwerwerjfdksdjfksdlfhjsdk" > >noise.txt > echo "Creating new security key3.db/cert8.db pair." > ../shared/bin/certutil -N -d . -f pwdfile.txt > echo "Generating encryption key." > ../shared/bin/certutil -G -d . -z noise.txt -f pwdfile.txt > echo "Generating self-signed CA certificate." > ../shared/bin/certutil -S -n "CA certificate" -s "cn=CAcert" -x \ > -t "CT,," -m 1000 -v 120 -d . -z noise.txt -f pwdfile.txt > echo "Generating self-signed Server certificate." > ../shared/bin/certutil -S -n "Server-Cert" -s \ > "cn=$FQDN,O=$ORG,L=$LOCALITY,ST=$STATE,C=$COUNTRY" -c "CA > certificate" \ > -t "u,u,u" -m 1001 -v 120 -d . -z noise.txt -f pwdfile.txt > echo "Renaming and linking modified security DBs." > mv -f key3.db slapd-$HOST-key3.db > mv -f cert8.db slapd-$HOST-cert8.db > ln -s slapd-$HOST-key3.db key3.db > ln -s slapd-$HOST-cert8.db cert8.db > echo "Setting the correct ownership of security DBs" > chown $SLAPD_OWNER:$SLAPD_GROUP *.db > echo "Self-signed CA and SSL Server certs generated." > echo "" > echo "The following commands are OPTIONAL." > echo "They are for backing up CA and Server Certs in PK12 format," > echo "exporting the CA Cert in ASCII format or DER format, and" > echo "importing the CA Cert into the Admin Server" > echo "" > echo "---Start of OPTIONAL commands---" > cat <<EOF >optional_cmds.txt > ../shared/bin/pk12util -d . -P slapd-$HOST- -o cacert.pfx -n "CA > certificate" > ../shared/bin/pk12util -d . -P slapd-$HOST- -o servercert.pfx -n > "Server-Cert" > ../shared/bin/certutil -L -d . -P slapd-$HOST- -n "CA certificate" \ > -a > cacert.asc > ../shared/bin/certutil -L -d . -P slapd-$HOST- -n "CA certificate" \ > -r > cacert.der > ../shared/bin/certutil -A -d . -P admin-serv-$HOST- -n "CA > certificate" \ > -t "CT,," -a -i cacert.asc > EOF > cat optional_cmds.txt > echo "---End of OPTIONAL commands---" > echo "" > echo "Modifying server SSL configurations." > echo "NOTE: changes will be saved to config/dse.ldif when slapd is > shutdown" > cat <<EOF >/tmp/ssl_enable.ldif > dn: cn=encryption,cn=config > changetype: modify > replace: nsSSL3 > nsSSL3: on > - > replace: nsSSLClientAuth > nsSSLClientAuth: allowed > - > add: nsSSL3Ciphers > nsSSL3Ciphers: > -rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5, > > +rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_sha,+forte > zza, > > +fortezza_rc4_128_sha,+fortezza_null,+tls_rsa_export1024_with_rc4_56_s > ha, > +tls_rsa_export1024_with_des_cbc_sha > - > add: nsKeyfile > nsKeyfile: alias/slapd-$HOST-key3.db > - > add: nsCertfile > nsCertfile: alias/slapd-$HOST-cert8.db > > dn: cn=config > changetype: modify > add: nsslapd-security > nsslapd-security: on > - > replace: nsslapd-ssl-check-hostname > nsslapd-ssl-check-hostname: off > > EOF > ../shared/bin/ldapmodify -D "cn=Directory Manager" -w `cat > /home/ldap/dirmgr.pwd` -f /tmp/ssl_enable.ldif > cat <<EOF >/tmp/delRSA.ldif > cn=RSA,cn=encryption,cn=config > > EOF > ../shared/bin/ldapdelete -c -D "cn=Directory Manager" -w `cat > /home/ldap/dirmgr.pwd` -f /tmp/delRSA.ldif > [ $? -eq 0 ] && echo "deleting cn=RSA,cn=encryption,cn=config" > cat <<EOF >/tmp/addRSA.ldif > dn: cn=RSA,cn=encryption,cn=config > objectclass: top > objectclass: nsEncryptionModule > cn: RSA > nsSSLPersonalitySSL: Server-Cert > nsSSLToken: internal (software) > nsSSLActivation: on > > EOF > ../shared/bin/ldapmodify -a -c -D "cn=Directory Manager" -w `cat > /home/ldap/dirmgr.pwd` -f /tmp/addRSA.ldif > echo "Creating a pin.txt for auto-starting of slapd." > echo "Internal (Software) Token:`cat pwdfile.txt`" > >slapd-$HOST-pin.txt > chown $SLAPD_OWNER:$SLAPD_GROUP slapd-$HOST-pin.txt > chmod 400 slapd-$HOST-pin.txt > echo "" > echo "IMPORTANT NOTES:" > echo "" > echo "1. How to check if SSL Configurations are done properly?" > echo "You may view config/dse.ldif after shutting down slapd" > echo "to verify all the required SSL configurations are there." > echo "" > echo "2. How to fix slapd startup issue due to mis-configuration of > SSL?" > echo "If for any reason slapd fails to start due to SSL issue," > echo "you may edit config/dse.ldif after shutting down slapd" > echo "and revert back to non-SSL configs." > echo "i.e. set nsSSL3: off, nsslapd-security: off" > echo "and then try to restart slapd." > echo "" > > =======Sample run. > > # ./cr_ssl_certs_fds1ldap.sh > Backing up existing *.db (if any) to backup_Wed. > Creating new security key3.db/cert8.db pair. > Generating encryption key. > > > Generating key. This may take a few moments... > > Generating self-signed CA certificate. > > > Generating key. This may take a few moments... > > Generating self-signed Server certificate. > > > Generating key. This may take a few moments... > > Renaming and linking modified security DBs. > Setting the correct ownership of security DBs > Self-signed CA and SSL Server certs generated. > > The following commands are OPTIONAL. > They are for backing up CA and Server Certs in PK12 format, > exporting the CA Cert in ASCII format or DER format, and > importing the CA Cert into the Admin Server > > ---Start of OPTIONAL commands--- > ../shared/bin/pk12util -d . -P slapd-nj1net200plmon- -o cacert.pfx -n > "CA certificate" > ../shared/bin/pk12util -d . -P slapd-nj1net200plmon- -o servercert.pfx > -n "Server-Cert" > ../shared/bin/certutil -L -d . -P slapd-nj1net200plmon- -n "CA > certificate" -a > cacert.asc > ../shared/bin/certutil -L -d . -P slapd-nj1net200plmon- -n "CA > certificate" -r > cacert.der > ../shared/bin/certutil -A -d . -P admin-serv-nj1net200plmon- -n "CA > certificate" -t "CT,," -a -i cacert.asc > ---End of OPTIONAL commands--- > > Modifying server SSL configurations. > NOTE: changes will be saved to config/dse.ldif when slapd is shutdown > modifying entry cn=encryption,cn=config > ldap_modify: Type or value exists > > deleting cn=RSA,cn=encryption,cn=config > adding new entry cn=RSA,cn=encryption,cn=config > > Creating a pin.txt for auto-starting of slapd. > > IMPORTANT NOTES: > > 1. How to check if SSL Configurations are done properly? > You may view config/dse.ldif after shutting down slapd > to verify all the required SSL configurations are there. > > 2. How to fix slapd startup issue due to mis-configuration of SSL? > If for any reason slapd fails to start due to SSL issue, > you may edit config/dse.ldif after shutting down slapd > and revert back to non-SSL configs. > i.e. set nsSSL3: off, nsslapd-security: off > and then try to restart slapd. > >

1 0

Re: [Fedora-directory-users] Re: SubjectAltName how does it work?
by Alex aka Magobin 11 Apr '06

11 Apr '06

Hi, today, I'm trying to solve ssl issue to comunicate from DS Fedora to both client and another DS server for replication..after many test, with your help I catched up this point: I'm always in alias directory. Create my CA database: # ../shared/bin/certutil -N -d . Make my self CA: # ../shared/bin/certutil -S -d . -n 'CA Certificate' -s 'cn=CAcert' -x -t CTu,CTu,CTu -g 1024 -m 1 -v 120 -2 -1 -5 Create server key and certificate for server1: # ../shared/bin/certutil -R -d . -s "cn=nodo1,dc=domain,dc=example,dc=com" -o tmpcertreq -g 1024 # ../shares/bin/certutil -C -d . -c "CA Certificate" -i tmpcertreq -o tmpcert.der -m 3 -v 12 -1 -5 -8 domain.example.com # ../shared/bin/certutil -A -d . -n nodo1.domain.example.com -t u,u,u -i tmpcert.der #rm -f tmpcert.der tmpcertreq Create server key and certificate for server2: # ../shared/bin/certutil -R -d . -s "cn=nodo2,dc=domain,dc=example,dc=com" -o tmpcertreq -g 1024 # ../shares/bin/certutil -C -d . -c "CA Certificate" -i tmpcertreq -o tmpcert.der -m 4 -v 12 -1 -5 -8 domain.example.com # ../shared/bin/certutil -A -d . -n Alt-Cert -t u,u,u -i tmpcert.der #rm -f tmpcert.der tmpcertreq After that I copy database on server 2 and rename it to match with correct server...finally I enable ssl encrypt on both servers and I try to establish Multi Master Replication via mmr.pl script...so: ./mmr.pl --host1 nodo1.domain.example.com --host2 nodo2.domain.example.com --host1_id 1 --host2_id 2 --bindpw secret --repmanpw secret --create --with-ssl unfortunately consulting logs I find: NSMMReplicationPlugin - agmt="cn="Replication to nodo2.domain.example.com"" (nodo2:636): Simple bind failed, LDAP sdk error 91 (Can't connect to the LDAP server), Netscape Portable Runtime error -5961 (TCP connection reset by peer.) It's incredible that when I find solution for something, at the same time I find problem in another point :-) Thanks in advance for support Alex

4 12

[Fedora-directory-users] storing RSA public keys in FDS
by Susan 11 Apr '06

11 Apr '06

Hi, all. This may be slightly off topic but here goes anyway. I've a small client/server app in perl that publishes msgs in multicast, cleartext. There's now a concern about replay attacks, so we need to encrypt every msg and maybe sign it. (Crypt::RSA, I'm thinking) Since there's only 1 server but a large number of clients, I'm thinking of storing clients' public keys in FDS, where the server can retrieve them. Has anybody successfully implemented this? I know I can install OpenPGP Key Server and use that but I don't want to have another directory when FDS is working fine already. Thank you. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users April 2006