389-users August 2006

389-users@lists.fedoraproject.org

61 participants
71 discussions

[Fedora-directory-users] Anonymous bind with restrictive ACIs
by Adams, Samuel D Contr AFRL/HEDR 23 Aug '06

23 Aug '06

Does anyone know what the minimum set of attributes are that need to be anonymously readable and still allow the OpenLDAP PAM client to authenticate? I tried to lock it down to only allow username, but that was too restrictive. Now I just have it restricting only the userPassword, but I thing there is room for further tightening. Sam Adams General Dynamics - Information Technology Phone: 210.536.5945

3 2

[Fedora-directory-users] FDS hangs
by Saravana Kumar 23 Aug '06

23 Aug '06

Hi, I am running FDS in one of my servers. It serves authinfo(username & password) and automount info to about 50 clients. During peak hours(when the number of connections to the server are high) it is very difficult to operate in the client machines and the server fails to respond. Then i end up in hard rebooting the server. After reboot slapd would not start(i have scripts to start fds and fds-admin). I have to run ./setup/setup again to start the fds-admin. Can some one tell me why is this happenning? Is it a bug? The only error i see in the slapd logs is this: 17/Aug/2006:15:18:15 +051800] - Listening for new connections again [17/Aug/2006:15:18:15 +051800] - Not listening for new connections - too many fds open Thanks in advance for any pointers. --- SK

2 5

[Fedora-directory-users] Binaries to fix memory leak for RHEL4 i386 (32 bit)
by Rich Megginson 22 Aug '06

22 Aug '06

The following tarball contains the nspr/nss .so and .chk files needed to address the memory leak for RHEL4 i386: Instructions: 1) stop-slapd 2) download and unpack http://directory.fedora.redhat.com/download/nspr-4.6.2-nss-3.11.1-RHEL4-i38… into /opt/fedora-ds/bin/slapd/lib 3) start-slapd 4) stop-admin 5) same as step 2 in bin/admin/lib 6) start-admin You can also replace the other copies of nspr/nss elsewhere in /opt/fedora-ds, but this memory leak won't affect command line apps.

1 0

[Fedora-directory-users] Binaries to fix memory leak for RHEL4 x86_64
by Rich Megginson 21 Aug '06

21 Aug '06

The following tarball contains the nspr/nss .so and .chk files needed to address the memory leak for RHEL4 x86_64. Instructions: 1) stop-slapd 2) download and unpack http://directory.fedora.redhat.com/download/nspr-4.6.2-nss-3.11.1-RHEL4-x86… into /opt/fedora-ds/bin/slapd/lib 3) start-slapd 4) stop-admin 5) same as step 2 in bin/admin/lib 6) start-admin You can also replace the other copies of nspr/nss elsewhere in /opt/fedora-ds, but this memory leak won't affect command line apps.

2 2

[Fedora-directory-users] leak
by Jason Russler 21 Aug '06

21 Aug '06

I've seen one recent mention on this list about leaks in the directory server but I have a ns-slapd process that grows by dozens of megabytes a day. At least once a week I restart the directory server after it eats up ~90% of the system memory. Right now it's a 1.2G process and it sure isn't cached data because there are not that many entries in this thing. I don't recall the issue being this extreme when I first set it up. Cold the leak be associated with replication or some other subsystem not active in a fresh install? -- Jason Russler Helix Systems, NIH, DHHS

6 10

[Fedora-directory-users] TLS authentication
by Adams, Samuel D Contr AFRL/HEDR 21 Aug '06

21 Aug '06

Basically I am trying to use FDS for LDAP authentication for centralized authentication on my Linux network and a need to make sure that it is secure. I figured that enabling TLS for authentication would be a good start. I read the Red Hat Directory Server administrator guide chapter on TLS and followed the howto at http://directory.fedora.redhat.com/wiki/Howto:SSL. It looks like I have TLS enabled because I can get my Linux clients using the OpenLDAP PAM module to authenticate with TLS enabled, but my LDAP server will also let them authenticate without TLS! If someone authenticates without TLS, does that mean that their login credentials are being passed in the clear? How do I make the FDS to only allow TLS authentication? My basic goal is to make this secure. I also have two medium vulnerabilities the keep popping up with ISS that I need to resolve but can't seem to find the proper configuration in the admin console. " LDAP NullBind: LDAP anonymous access to directory The NULL bind entry allows a user to access the Lightweight Directory Access Protocol (LDAP) directory anonymously. An attacker could take advantage of the NULL bind entry to anonymously view files on the LDAP director. Remedy: Disable the NULL bind entry or control the entry with Access Control Lists (ACLs). References:" --and-- " LDAP Schema: LDAP schema information gathering An attacker could access the Lightweight Directory Access Protocol (LDAP) schema to gain information about the LDAP server. The LDAP server dumps its schema, which can show all necessary attributes needed for an object, including hidden or non-readable attributes. An attacker could use this information to access directory listings and plan further attacks. Remedy: Disable the cn=schema entry or allow only authorized users to view the entry. References:" Any recommendations on any of these points would be helpful... Thanks, Sam Adams General Dynamics - Information Technology

4 10

[Fedora-directory-users] Fetching nsAccountLock?
by Josh Kelley 21 Aug '06

21 Aug '06

I have some Perl scripts for enabling and disabling that I'm trying to update for FDS, and I'm havint trouble retrieving the nsAccountLock attribute. I'm assuming that it's not being returned because it's an operational attribute; I can use it for search criteria, but I haven't figured out any way to retrieve it. Any pointers? Thanks. Josh Kelley

2 2

[Fedora-directory-users] binding to the LDAP
by Adams, Samuel D Contr AFRL/HEDR 21 Aug '06

21 Aug '06

I have been tweaking my ACIs on my directory server, and I more or less feel good about its security posture except for one thing, it is still allowing unencrypted authentication. My clients are configured to use TLS for authentication which is good, but if I turn off TLS on the client, it still can authenticate which is bad. Assuming everything is configured properly on the client, this works, but I would feel better if my LDAP wouldn't even let a client bind if it is not using TLS. Can I do this through an ACI or some other setting on the server? Sam Adams General Dynamics - Information Technology Phone: 210.536.5945

3 2

[Fedora-directory-users] RE: Biulding an RPM without the Java
by Eric Brown 18 Aug '06

18 Aug '06

Thanks, that worked just fine.

1 0

[Fedora-directory-users] Biulding an RPM without the Java Components
by Eric Brown 18 Aug '06

18 Aug '06

I have been trying to build with the dsbuild package and the BUILD_RPM and NOJAVA flags, but I get the following errors when it gets to building the Mission Control Console: === Packaging Mission Control Console Apps ====== cd mcc; gmake BUILD_OPT=1 NO_MOCHA=1 NO_JAVA=1 NSPR_BASENAME=libnspr4 USE_PTHREADS=1 SECURITY=domestic BUILD_MODE=ext BUILD_MODULE=SETUP_MCC -w gmake[3]: Entering directory `/home/erbrow/dsbuild-fds102/ds/adminserver/work/fedora-adminserver-1.0.2/mcc' rm -rf ../built/domestic/mcc/dist/Linux2.6 rm -rf ../built/domestic/mcc/dist/Other-UNIX mkdir -p ../built/domestic/mcc/dist/Linux2.6 # Combine the client zip files from base and admin cd ../built/package/Linux2.6_x86_glibc_PTH_OPT.OBJ/base/unzipped/client; \ tar cvf ../../../../../domestic/mcc/dist/Linux2.6/uxmcc.tar * /bin/sh: line 0: cd: ../built/package/Linux2.6_x86_glibc_PTH_OPT.OBJ/base/unzipped/client: No such file or directory tar: ../../../../../domestic/mcc/dist/Linux2.6/uxmcc.tar: Cannot open: No such file or directory tar: Error is not recoverable: exiting now gmake[3]: *** [all] Error 2 gmake[3]: Leaving directory `/home/erbrow/dsbuild-fds102/ds/adminserver/work/fedora-adminserver-1.0.2/mcc' make[2]: *** [pkgMcc] Error 2 make[2]: Leaving directory `/home/erbrow/dsbuild-fds102/ds/adminserver/work/fedora-adminserver-1.0.2' make[1]: *** [build-work/fedora-adminserver-1.0.2/Makefile] Error 2 make[1]: Leaving directory `/home/erbrow/dsbuild-fds102/ds/adminserver' make: *** [dep-../../ds/adminserver] Error 2 Has anyone built the rpm without the java components?

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users August 2006