389-users April 2006

389-users@lists.fedoraproject.org

53 participants
82 discussions

[Fedora-directory-users] how to add client to the my domain
by Bharath Ramakrishna 10 Apr '06

10 Apr '06

hi , I am bharath . I have already installed and deployed the directory server,but i am not able to add my windows client to this domain and authenicate. I changed the domain name of my windows client to "testingczars.com" but it is not authenicating .Please tell me hoe to do this. -- Bharath Ramakrishna Network Admnistrator TestingCzars Phone: +91.80.26722100, +91.80.26727234 TeleFax: +91.80.26727234 Email: bharath(a)testingczars.com URL: www.testingczars.com This email may contain material that is confidential, privileged and/or attorney work product for the sole use of the intended recipient. Any review, reliance or distribution by others or forwarding without express permission is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies.

2 1

[Fedora-directory-users] Search optimization?
by Vsevolod (Simon) Ilyushchenko 10 Apr '06

10 Apr '06

Hi, I've noticed that FDS is significantly slower in answering queries than openldap. If I run 'ls -l /home' on the list of 64 home directories whose owners are all different, I get the list back in 1 second if I use openldap. Version 7 of FDS took 16 seconds, and FDS 1.0.2 takes 12 seconds. The docs mention increasing cache sides to improve performance, but my cache is set to 10 M, which seems to be large enough, and the timing does not improve if I run 'ls -l' repeatedly. Is there anything else I can tune? Thanks, Simon -- Simon (Vsevolod ILyushchenko) simonf(a)cshl.edu http://www.simonf.com "Think like a man of action, act like a man of thought." Henri Bergson

4 4

[Fedora-directory-users] Odd admin console problem
by Brian Moyles 09 Apr '06

09 Apr '06

We're in the process of evaluating FDS, but have run into a small problem. I'm forwarding X from the server back to my OS X box running Apple's X11. When I run startconsole, I get a half-drawn login window. I've tried a few different jvms from different vendors, no luck. http://mirrors.playboy.com/~bmoyles/fds-console.png I'm sure I'm missing something simple here... Any thoughts? Thanks for your time, Brian Moyles Sr. Systems Administrator Playboy Enterprises, Inc.

2 4

[Fedora-directory-users] Moving All Users to FDS
by Abdelrahman 07 Apr '06

07 Apr '06

Dear all, I want to migrate all my users (about 10000) from OpenLDAP to FDS. The problem is that I need to add a couple of fields to each user and set a default value for these fields! Is there a way to do that? Regards, Abdelrahman

2 1

RE: [Fedora-directory-users] Existing User Accounts
by Esquivel, Vicente 07 Apr '06

07 Apr '06

Thanks for the reply. I ran the scripts and was able to get all of the users imported into the Directory server. The only question is how do I get their email address into the Directory of the passwd and shadow file information? Thanks Vince > -----Original Message----- > From: fedora-directory-users-bounces(a)redhat.com > [mailto:fedora-directory-users-bounces@redhat.com] On Behalf > Of Oscar A. Valdez > Sent: Thursday, April 06, 2006 10:38 AM > To: General discussion list for the Fedora Directory server project. > Subject: Re: [Fedora-directory-users] Existing User Accounts > > El jue, 06-04-2006 a las 09:49 -0500, Esquivel, Vicente escribió: > > I have the Directory server up and running. My question is > how to get > > the user accounts from one of my servers into the > directory? I do not > > have an existing ldap or nis server, we are using local systems > > account creation and authentication. I did a search through the > > archives but wasn't able to come up with anything. Any > insight would > > be very helpful and appreciated. > > Try the Migration Tools from PADL software (they are also the > creators of the nss_ldap and pam_ldap modules): > > http://www.padl.com/OSS/MigrationTools.html > > You first have to edit migrate_base.pl for your > organization's naming context. The scripts migrate_passwd.pl, > migrate_group.pl, migrate_aliases.pl, etc., will do what > their names suggest. They output in ldif format to standard > output, so you can tweak the results before importing into > your DS server. > > After importing my existing users, I wrote my own script for > new user creation that generates the ldif stuff. > > -- > Oscar A. Valdez > > -- > Fedora-directory-users mailing list > Fedora-directory-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users >

3 2

RE: [Fedora-directory-users] Existing User Accounts
by Esquivel, Vicente 07 Apr '06

07 Apr '06

Ok I am a total newbie to the Directory so bear with me. Do you accomplish this by going to the configuration tab then selecting schema? Vince > -----Original Message----- > From: fedora-directory-users-bounces(a)redhat.com > [mailto:fedora-directory-users-bounces@redhat.com] On Behalf > Of George Holbert > Sent: Friday, April 07, 2006 3:22 PM > To: General discussion list for the Fedora Directory server project. > Subject: Re: [Fedora-directory-users] Existing User Accounts > > The usual attribute for email addresses is "mail". > You may need to add another objectclass (like inetOrgPerson) > to your objects in order for the mail attribute to be available. > > Esquivel, Vicente wrote: > > Thanks for the reply. > > > > I ran the scripts and was able to get all of the users > imported into the Directory server. The only question is how > do I get their email address into the Directory of the passwd > and shadow file information? > > > > Thanks > > Vince > > > > > >> -----Original Message----- > >> From: fedora-directory-users-bounces(a)redhat.com > >> [mailto:fedora-directory-users-bounces@redhat.com] On > Behalf Of Oscar > >> A. Valdez > >> Sent: Thursday, April 06, 2006 10:38 AM > >> To: General discussion list for the Fedora Directory > server project. > >> Subject: Re: [Fedora-directory-users] Existing User Accounts > >> > >> El jue, 06-04-2006 a las 09:49 -0500, Esquivel, Vicente escribió: > >> > >>> I have the Directory server up and running. My question is > >>> > >> how to get > >> > >>> the user accounts from one of my servers into the > >>> > >> directory? I do not > >> > >>> have an existing ldap or nis server, we are using local systems > >>> account creation and authentication. I did a search through the > >>> archives but wasn't able to come up with anything. Any > >>> > >> insight would > >> > >>> be very helpful and appreciated. > >>> > >> Try the Migration Tools from PADL software (they are also the > >> creators of the nss_ldap and pam_ldap modules): > >> > >> http://www.padl.com/OSS/MigrationTools.html > >> > >> You first have to edit migrate_base.pl for your > organization's naming > >> context. The scripts migrate_passwd.pl, migrate_group.pl, > >> migrate_aliases.pl, etc., will do what their names suggest. They > >> output in ldif format to standard output, so you can tweak the > >> results before importing into your DS server. > >> > >> After importing my existing users, I wrote my own script > for new user > >> creation that generates the ldif stuff. > >> > >> -- > >> Oscar A. Valdez > >> > >> -- > >> Fedora-directory-users mailing list > >> Fedora-directory-users(a)redhat.com > >> https://www.redhat.com/mailman/listinfo/fedora-directory-users > >> > >> > > > > -- > > Fedora-directory-users mailing list > > Fedora-directory-users(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > > > > > > > -- > Fedora-directory-users mailing list > Fedora-directory-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users >

2 1

[Fedora-directory-users] Dovecot and FDS
by Oscar A. Valdez 07 Apr '06

07 Apr '06

The Howto at http://directory.fedora.redhat.com/wiki/Howto:Dovecot is really very skimpy (two lines that refer you offsite, to a Howto based on OpenLDAP). I spent most of yesterday banging my head, making dovecot authenticate against FDS. The mail server on which dovecot is installed has the nss_ldap and pam_ldap packages installed, and /etc/dovecot.conf has the following two lines: auth_userdb = ldap /etc/dovecot-ldap.conf auth_passdb = pam In other words, dovecot should use LDAP to access the user database, but PAM for authentication. This part is working, since users authenticate and get their mails through dovecot. /etc/dovecot-ldap.conf contains the following: hosts = 192.168.0.2 ldap_version = 3 base = ou=People, dc=duraflex, dc=com, dc=sv deref = never scope = subtree user_attrs = uid,homeDirectory,,,uidNumber,gidNumber user_filter = (&(objectClass=posixAccount)(uid=%u)) I haven't specified a dn or dnpass, since all I need is that dovecot perform an anonymous query for the uid, homeDirectory, uidNumber and gidNumber fields of its users, which are publically viewable. However, my FDS server's access log has entries like these: conn=3266227 fd=138 slot=138 connection from 192.168.0.100 to 192.168.0.2 conn=3266227 op=0 BIND dn="" method=128 version=3 conn=3266227 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="" conn=3266227 op=1 SRCH base="ou=People,dc=duraflex,dc=com,dc=sv" scope=1 filter="(&(objectClass=posixAccount)(uid=dovecot))" attrs=ALL conn=3266227 op=1 RESULT err=0 tag=101 nentries=0 etime=0 conn=3266227 op=2 SRCH base="ou=Groups,dc=duraflex,dc=com,dc=sv" scope=1 filter="(&(objectClass=posixGroup)(memberUid=dovecot))" attrs="gidNumber" conn=3266227 op=2 RESULT err=0 tag=101 nentries=0 etime=0 conn=3266227 op=-1 fd=138 closed - B1 Dovecot tries binding with an empty dn, fails, the queries FDS for a user or group called dovecot (which don't exist on the DS), and fails. Is there a way to tell dovecot to query anonymously? -- Oscar A. Valdez

2 3

[Fedora-directory-users] Re: Hostname does not match CN
by Howard Chu 07 Apr '06

07 Apr '06

> Date: Tue, 04 Apr 2006 11:30:30 -0700 > From: "George Holbert" <gholbert(a)broadcom.com> > > >> Does Directory Server support the subjectAltName extension on SSL certs? >> >> > > Yes, the NSS toolkit which Directory Server uses can handle these certs. > > The next question is, do your SSL-enabled LDAP clients support these certs? > I need to support both Solaris and RedHat Linux LDAP name service > clients (i.e., passwd, group, automount, etc.). I've found that: > - Solaris clients can handle wildcard certs. RHEL 3 clients can't. > - RHEL 3 clients can handle subjectAltName certs. Solaris clients can't. > > So, while the server can present either of these cert types, your > clients' limitations will also influence how you sign your certs. > > Someone should file a bug report with Sun then, since LDAP RFC2830 defines support for subjectAltName and not for wildcard certs. The LDAPbis specifications will be pretty much the same here. I.e., Sun's LDAP library is not LDAPv3 compliant. RHEL uses OpenLDAP libraries, which are fully LDAPv3 compliant. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

5 7

[Fedora-directory-users] Schema Conversion (again).
by Robert r. Sanders 06 Apr '06

06 Apr '06

We're trying to get the Zimbra Collaboration Suite to talk to a Fedora Directory Server (Zimbra by default uses its own version of OpenLDAP). Zimbra includes LDAP schema files, and we've tried to use Mike Jackson's schema migration tool ol-schema-migrate.pl as well as the ol2rhds.pl script. The problem appears to be that the schema in question makes heavy use of the OpenLDAP OID Macros (see http://www.openldap.org/doc/admin23/schema.html , the "OID Macros" section at the bottom of the page). Does anyone know of any tools which would help? A sample of the original schema is: objectIdentifier ZimbraRoot 1.3.6.1.4.1.19348 objectIdentifier ZimbraLDAP ZimbraRoot:2 ... objectIdentifier ZimbraAttrType ZimbraLDAP:1 ... objectIdentifier zimbraComponentAvailable ZimbraAttrType:242 ... attributetype ( zimbraComponentAvailable NAME 'zimbraComponentAvailable' DESC 'Names of additonal components that have been installed' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{64} ) The complete schema can be viewed at - http://cvs.zimbra.com:8080/viewrep/~raw,r=1.48/zimbra_main/ZimbraServer/con… My understanding is that OpenLDAP knows to replace the "attributetype ( zimbraComponentAvailable" with "attributetype ( 1.3.6.1.4.1.19348.2.242" (or something similar). The referenced perl scripts output: attributeTypes: ( zimbraComponentAvailable NAME 'zimbraComponentAvailable' DESC 'Names of additonal components that have been installed' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{64} ) which fails to load properly as the symbolic name "zimbraComponentAvailable" is not replaced by the actual value. Anyway, any help would be very appreciated. Thanks, -- Robert r. Sanders Chief Technologist iPOV (334) 821-5412 www.ipov.net

3 2

[Fedora-directory-users] Mac OS X Client authenticating against Fedora Directory Server
by Jim Summers 06 Apr '06

06 Apr '06

Hello List, I am following up on a thread that was initiated by David Schibeci a few weeks back. He was trying to configure os/x machines to authenticate against fds. I to will have to authenticate some os/x machines when I migrate over to fds. So I thought I should test it out. Unfortunately I was not able to get it to work. All I am seeing in the system.log file are entries such as: DSOpenNode(): dsOpenDirNode("/LDAPv3/ipaddress") == -14002 DSGetCurrentConfigInfo(): dsGetRecordEntry() == -14061 Not to informative. Any ideas or suggestions will be greatly appreciated. Thanks -- Jim Summers School of Computer Science-University of Oklahoma -------------------------------------------------

2 3

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users April 2006