389-users July 2006

389-users@lists.fedoraproject.org

59 participants
75 discussions

[Fedora-directory-users] SNMP monitoring issues
by Philip Kime 27 Jul '06

27 Jul '06

The AgentX subagent config file is supposed to take a config line agentx-logdir I have set this but the agent still logs to the same dir at the config file is in (which is the default location) - any ideas? -- Philip Kime NOPS Systems Architect 310 401 0407

2 1

[Fedora-directory-users] SNMP monitoring
by Philip Kime 27 Jul '06

27 Jul '06

My knowledge of SNMP is only fair, bear with me ... I've set up the subagent for SNMP monitoring and can snmpwalk the rhds stuff, with the output below. I have a few questions though: 1. what is the ".389" suffix on the variables? Looks like the port number of the server? 2. If I query the DS, none of the counters change? 3. The dsIntTable part of the MIB has no entries (I tried with snmptable) - how does this get populated? 4. Do I need to do anything to "enable" SNMP on the servers? The checkbox mentioned in the docs doesn't exist but dse.ldif does have "nsSNMPEnabled: on" RHDS-MIB::dsAnonymousBinds.389 = Counter32: 0 RHDS-MIB::dsUnAuthBinds.389 = Counter32: 0 RHDS-MIB::dsSimpleAuthBinds.389 = Counter32: 21 RHDS-MIB::dsStrongAuthBinds.389 = Counter32: 0 RHDS-MIB::dsBindSecurityErrors.389 = Counter32: 0 RHDS-MIB::dsInOps.389 = Counter32: 306 RHDS-MIB::dsReadOps.389 = Counter32: 0 RHDS-MIB::dsCompareOps.389 = Counter32: 0 RHDS-MIB::dsAddEntryOps.389 = Counter32: 0 RHDS-MIB::dsRemoveEntryOps.389 = Counter32: 0 RHDS-MIB::dsModifyEntryOps.389 = Counter32: 53 RHDS-MIB::dsModifyRDNOps.389 = Counter32: 0 RHDS-MIB::dsListOps.389 = Counter32: 0 RHDS-MIB::dsSearchOps.389 = Counter32: 81 RHDS-MIB::dsOneLevelSearchOps.389 = Counter32: 6 RHDS-MIB::dsWholeSubtreeSearchOps.389 = Counter32: 7 RHDS-MIB::dsReferrals.389 = Counter32: 0 RHDS-MIB::dsChainings.389 = Counter32: 0 RHDS-MIB::dsSecurityErrors.389 = Counter32: 0 RHDS-MIB::dsErrors.389 = Counter32: 72 RHDS-MIB::dsMasterEntries.389 = Gauge32: 0 RHDS-MIB::dsCopyEntries.389 = Gauge32: 0 RHDS-MIB::dsCacheEntries.389 = Gauge32: 0 RHDS-MIB::dsCacheHits.389 = Counter32: 0 RHDS-MIB::dsSlaveHits.389 = Counter32: 0 -- Philip Kime NOPS Systems Architect 310 401 0407

2 1

[Fedora-directory-users] Question re: {KERBEROS} syntax
by Tom Ryan 27 Jul '06

27 Jul '06

I am in the midst of migrating from openldap to fedora ds. In openldap, I could specify the userpassword as {KERBEROS}kerberosprinc@REALM And openldap would utilize that for bind verification.. Is this possible under fedora ds? Would a plugin be required (is one currently available?) Thanks! Tom

3 33

[Fedora-directory-users] Plugin configuration
by Justin Crawford 26 Jul '06

26 Jul '06

Howdy- We use P-synch, a password synchronization tool. It has a plugin that works on Netscape and Sun LDAP servers, so I'm hoping it'll work with Fedora, and I'm testing that now. I have configured the plugin in dse.ldif as specified by the vendor (and as it has worked on SunOne). When I try to start the directory instance, I get an error right away: $ sudo ./start-slapd [26/Jul/2006:17:27:19 -0600] - Netscape Portable Runtime error -5977: /opt/fedora-ds/lib/passwdop.nsldap.linux.x86: cannot open shared object file: No such file or directory [26/Jul/2006:17:27:19 -0600] - Could not open library "/opt/fedora-ds/lib/passwdop.nsldap.linux.x86" for plugin Psynch Check Password [26/Jul/2006:17:27:19 -0600] - Unable to load plugin "cn=Psynch Check Password,cn=plugins,cn=config" But the file is there, and its real accessible: $ ls -l /opt/fedora-ds/lib/passwdop.nsldap.linux.x86 -rwxrwxrwx 1 ldap ldap 87127 Jul 26 17:25 /opt/fedora-ds/lib/passwdop.nsldap.linux.x86 So I'm trying to figure out what might cause this. 1. It's a 64-bit linux box, but the plugin binary is 32-bit? (I'd expect a different error) 2. The plugin is not working with the directory software? (I'd expect a different error) 3. There is a secret about installing Fedora plugins that my experience with SunOne hasn't taught me? 4. ?? Anyone have any great ideas? Thanks. Justin

2 1

[Fedora-directory-users] passync log entries
by Brian Smith 26 Jul '06

26 Jul '06

What do these messages mean in the passync log, the services starts up and I see 1 successful auth on the directory server but all i get is this in the passync log: 07/26/06 14:19:10: PassSync service started 07/26/06 14:19:10: Failed to load entries from file 07/26/06 14:19:12: Password list is empty. Waiting for passhook event if i change a password or add a user, nothing happens. Thanks in advance Brian

2 1

[Fedora-directory-users] Dos issue in fedora directory server
by Tom Ryan 26 Jul '06

26 Jul '06

I have noticed that I can crash fds remotely pretty easily.. I have pam_passthru setup (obvious to those reading my recent emails).. Anyway, if I run the following from a remote system Ldapsearch -x uid=anything -H ldaps://fds-server -x -W -D uid=+ And enter anything for a password, It goes away.. Here's a strace of the pid poll([{fd=22, events=POLLIN}, {fd=6, events=POLLIN}, {fd=7, events=POLLIN}], 3, 250) = 0 gettimeofday({1153945615, 879597}, NULL) = 0 poll([{fd=22, events=POLLIN}, {fd=6, events=POLLIN}, {fd=7, events=POLLIN, revents=POLLIN}], 3, 250) = 1 accept(7, {sa_family=AF_INET6, sin6_port=htons(51128), inet_pton(AF_INET6, "::ffff:CLIENTIP", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 24 fcntl64(24, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(24, F_SETFL, O_RDWR|O_NONBLOCK) = 0 brk(0x88cf000) = 0x88cf000 fcntl64(24, F_DUPFD, 64) = 64 close(24) = 0 setsockopt(64, SOL_TCP, TCP_NODELAY, [0], 4) = 0 getsockname(64, {sa_family=AF_INET6, sin6_port=htons(636), inet_pton(AF_INET6, "::ffff:FDSSERVERIP", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1267, ...}) = 0 getpeername(7, 0xbfecf5c0, [108]) = -1 ENOTCONN (Transport endpoint is not connected) gettimeofday({1153945615, 974890}, NULL) = 0 poll([{fd=22, events=POLLIN}, {fd=6, events=POLLIN}, {fd=7, events=POLLIN}, {fd=64, events=POLLIN, revents=POLLIN}], 4, 250) = 1 futex(0x8613a78, FUTEX_WAKE, 1) = 1 getpeername(7, 0xbfecf5c0, [108]) = -1 ENOTCONN (Transport endpoint is not connected) gettimeofday({1153945615, 978689}, NULL) = 0 poll([{fd=22, events=POLLIN, revents=POLLIN}, {fd=6, events=POLLIN}, {fd=7, events=POLLIN}], 3, 250) = 1 read(22, "\0", 200) = 1 getpeername(7, 0xbfecf5c0, [108]) = -1 ENOTCONN (Transport endpoint is not connected) gettimeofday({1153945615, 992926}, NULL) = 0 poll([{fd=22, events=POLLIN}, {fd=6, events=POLLIN}, {fd=7, events=POLLIN}, {fd=64, events=POLLIN}], 4, 250) = -1 EINTR (Interrupted system call) +++ killed by SIGSEGV +++ Process 20095 detached Bummer..

1 0

[Fedora-directory-users] Password Policy enforcement mechanism question
by Lebsack, Eliot 26 Jul '06

26 Jul '06

Good morning. I have been playing with FDS 1.0.2 for some time, and have been successful in getting the Directory Server to enforce password policy by toggling the "nsslapd-pwpolicy-local" flag to "on", then establishing a local policy for my "ou=People" subtree. This enforcement appears to work only when I change the password for a user through the Fedora Management Console interface when I'm logged in as the Directory Manager (cn=Directory Manager). When I attempt to change the "userPassword" attribute for my test user via perl's Net::LDAP library using the smbldap-tools scripts (smbldap-passwd), smbldap-passwd takes the cleartext of the new password, and hashes it using SSHA. This hashed text (ciphertext) is then used to replace the "userPassword" attribute for the user in a subsequent LDAP bind operation. This process effectively bypasses the password policy defined for the user's subtree. Is there a way (through Perl or Java) to supply the cleartext to the server through SSL/TLS, and have it apply the password policy on the cleartext before the server hashes the cleartext? Regards, Eliot ====================================== Eliot Lebsack Lead Communications Engineer The MITRE Corporation Bedford, MA

1 0

[Fedora-directory-users] PassSync sync password errors
by Jeff Gamsby 25 Jul '06

25 Jul '06

I am testing out the PassSync program, but the FDS logs throw an error when trying to sync the passwords. Can anyone translate this for me please? [24/Jul/2006:09:48:15 -0700] NSMMReplicationPlugin - agmt="cn=FDS Sync" (fds:636): windows_replay_update: Looking at modify operation local dn="uid=user,ou=people,dc=ldap,dc=example,dc=com" (ours,user,not group) [24/Jul/2006:09:48:15 -0700] NSMMReplicationPlugin - agmt="cn=FDS Sync" (fds:636): windows_replay_update: Processing modify operation local dn="uid=user,ou=people,dc=ldap,dc=example,dc=com" remote dn="<GUID=21d434b17f592a4db7a6d5aa4b3a030e>" [24/Jul/2006:09:48:15 -0700] NSMMReplicationPlugin - agmt="cn=FDS Sync" (fds:636): Received result code 32 (0000208D: NameErr: DSID-031001A8, problem 2001 (NO_OBJECT), data 0, best match of: '' ) for modify operation [24/Jul/2006:09:48:15 -0700] NSMMReplicationPlugin - agmt="cn=FDS Sync" (fds:636): windows_replay_update: update password returned 1 [24/Jul/2006:09:48:15 -0700] NSMMReplicationPlugin - agmt="cn=FDS Sync" (fds:636): Consumer failed to replay change (uniqueid bfad6881-1dd111b2-8033cdea-25db0000, CSN 44c4f9e7000000010000): No such object. Skipping. [24/Jul/2006:09:48:15 -0700] agmt="cn=FDS Sync" (fds:636) - load=1 rec=2 csn=44c4f9e7000100010000 [24/Jul/2006:09:48:15 -0700] NSMMReplicationPlugin - agmt="cn=FDS Sync" (fds:636): windows_replay_update: Looking at modify operation local dn="uid=user,ou=people,dc=ldap,dc=example,dc=com" (ours,user,not group) [24/Jul/2006:09:48:15 -0700] NSMMReplicationPlugin - agmt="cn=FDS Sync" (fds:636): windows_replay_update: Processing modify operation local dn="uid=user,ou=people,dc=ldap,dc=example,dc=com" remote dn="<GUID=21d434b17f592a4db7a6d5aa4b3a030e>" [24/Jul/2006:09:48:15 -0700] agmt="cn=FDS Sync" (fds:636) - clcache_load_buffer: rc=-30990 [24/Jul/2006:09:48:15 -0700] NSMMReplicationPlugin - agmt="cn=FDS Sync" (fds:636): No more updates to send (cl5GetNextOperationToReplay) Thank you, Jeff G.

2 1

Re: [Fedora-directory-users] Fedora Directory server on Windows XP.Can it be done?
by Eugene M Liberman 25 Jul '06

25 Jul '06

Richard, Is it possible to get the build files to use as a template for this new build? Thank you for good news and such a quick response! Gene Liberman Richard Megginson <rmeggins(a)redhat.com> Sent by: fedora-directory-users-bounces(a)redhat.com 07/25/2006 04:04 PM Please respond to "General discussion list for the Fedora Directory server project." To: "General discussion list for the Fedora Directory server project." <fedora-directory-users(a)redhat.com> cc: Subject: Re: [Fedora-directory-users] Fedora Directory server on Windows XP. Can it be done? Eugene M Liberman wrote: > > I am trying to build FDS on the Windows XP platform. Can it be done? > Has somebody done it? Yes, about 18 months ago, and not since. The Windows port has rotted quite a bit. You can probably do it, but it will take a couple of weeks or more. > > > Thank you in advance, > > Gene Liberman > ------------------------------------------------------------------------ > > -- > Fedora-directory-users mailing list > Fedora-directory-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users > -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users << Attachment clipped: smime.p7s (4356 bytes ) >>

2 1

[Fedora-directory-users] Fedora Directory server on Windows XP. Can it be done?
by Eugene M Liberman 25 Jul '06

25 Jul '06

I am trying to build FDS on the Windows XP platform. Can it be done? Has somebody done it? Thank you in advance, Gene Liberman

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users July 2006