389-users September 2007

389-users@lists.fedoraproject.org

63 participants
46 discussions

[Fedora-directory-users] Email and LDAP
by Trever L. Adams 26 Sep '07

26 Sep '07

I am very sorry if this is an easy question to answer. I have tried OpenLDAP and FDS several times. I just can't seem to get it to do what I want. I am trying to setup a directory server for my folks (may expand to the entire family). Basically, I would like the following features: * Global directory where all common contacts are stored * Private directories where all private/non-common contacts are stored The above terminology may not match common LDAP terminology. They are using Thunderbird on more than one computer in Windows and Linux, hence the desire to get it out of the Thunderbird and into an LDAP server. I would love it if I could have authentication be against an Active Directory (which I may be moving them too soon), but this is not necessary. How do I do access control for write to the private directories? How do I do control on the global? How do I even get it working? I am sorry, as I said, I have read many howtos and just can't seem to get anywhere. I am not stupid, but I am ignorant when it comes to LDAP. Thank you for any help. Trever Adams

1 0

[Fedora-directory-users] Disabling SASL
by David Partridge 25 Sep '07

25 Sep '07

How do you disable SASL if there is no requirement to support? David Partridge Lead Engineer DoD Joint Enerprise Directory Server

1 0

[Fedora-directory-users] posixaccount and shadowlastchange
by Victor Hugo dos Santos 25 Sep '07

25 Sep '07

Hello, Linux authentication based in FDS work fine, i log in the system for ssh and all users is in the FDS directory. cool !!! but, i need use police security account for users (for example, in 60 days this users need change the password or can't use the same password 3 times consecutive). but the FDS dont work with shadow parameters, i run "getent passwd" and look all users (local and in FDS) but I run "getent shadow" and only show the local account, none account in the FDS. how is possible manage the security police from posixaccount and more important, that for users continue being one transparent process. URL ?? manual ?? docs ?? others ?? thanks -- -- Victor Hugo dos Santos Linux Counter #224399

3 4

[Fedora-directory-users] slapd_poll timed out error
by Scott Belnap 24 Sep '07

24 Sep '07

Can someone tell me what this error message means or how to resolve it? [24/Sep/2007:09:08:21 -1000] - slapd_poll(255) timed out [24/Sep/2007:09:23:04 -1000] - slapd_poll(249) timed out [24/Sep/2007:09:27:21 -1000] - slapd_poll(248) timed out Thanks.

1 0

[Fedora-directory-users] question about SSL configuration with IP takeover HA setup
by Ryan Braun 21 Sep '07

21 Sep '07

Hey guys, installed FDS on a couple debian servers this week and am liking it so far. I have a couple questions regarding SSL/TLS setup with servers setup for IP takeover type HA setup. Keep in mind I have some experience with the LDAP side of things, it's the ssl and all the different certs and whatnot that keeps me up at night. Essentially what I'm looking at is a 4 way multimaster setup, ending up with 2 HA pairs of servers. call them eastldap and westldap. I've implemented the east side in my test lab and have it replicating and can pull any user info I need off the directory no problem. so eastldap0.test.com ip 192.168.0.11 eastldap1.test.com ip 192.168.0.12 and the virtual interface on whichever machine is master would be eastldap.test.com ip 192.168.0.10 and then the exact same setup with the last 2 westldap0.test.com ip 192.168.1.11 westldap1.test.com ip 192.168.1.12 westldap.test.com ip 192.168.1.10 Once everything is setup and running clients would be primarily only connecting to either virtual interface west/eastldap using TLS over port 389 and the 4 masters replicating with encryption (not sure but I imagine this takes place on ldaps port). I followed the instructions on the howto:ssl page and created a cert located on eastldap0. But instead of using the eastldap0.test.com as the cn, I used eastldap.test.com. Cert installed ok, made sure eastldap0 was the HA master and restarted fds. When I copied over the cacert to a linux client, I can run searches using ldapsearch -ZZ -h eastldap.test.com. Server logs and wire sniffs confirm everything is coming back encrypted. It seems to be behaving as expected, when I try ldapsearch -ZZ -h eastldap0.test.com, it pukes with error 11 additional info: TLS: hostname does not match CN in peer certificate, which is right as the name in the cert is eastldap.test.com. So it would appear I'm on my way, I just am not sure about what certs I need now, and how to add them properly. I would think I need at the very least eastldap0 - eastldap0.test.com cert - eastldap.test.com cert eastldap1 - eastldap1.test.com cert - eastldap.test.com cert westldap0 - westldap0.test.com cert - westldap.test.com cert westldap1 - westldap1.test.com cert - westldap.test.com cert I'm just not sure if that is the proper way to go about it. Also, I would like to have the clients to be able to have all the cacerts to be able to communicate with all virtual and physical address' if need be. Later on, I would be adding probably 5 or 6 consumer read only replicas inbetween the suppliers and the clients, but one must walk before they run I guess :) Long post I know, just trying to make sure I get all the important stuff out there. Be kind if I was using the incorrect terminology for the certs/cacerts :) Ryan PS. anyone have a good SSL for dummies reference that lays out what the heck is going on with SSL (pems,keys,certs,cacerts etc)

3 7

[Fedora-directory-users] Good afternoon .... 1st post by the new guy
by lance raymond 21 Sep '07

21 Sep '07

OK, so not sure how big this list is, but I hope to get better response then on the fedora forums. I will start this on a high/basic level to make sure i am headed in the right direction, We want a central database of users, so naturally I looked at openldap. It's not a 1-2-3 as much as Fedora's directory services seems. So I have installed it on a fedora machine, added my company DN, as well as a few test users. Now I setup my fc7 desktop to look @ him as an ldap server, pointed to that IP and saved. Tried to ssh in as a user not on the local machine but in the directory service thinking he would look to the DS server and authenticate, but it fails. So the high level question is, that is how it's supposed to work right? I used a windows ldap browser and connected, fetched the DN from a dropdown it found (confirming it's running, and has the right context) but couldn't browse the tree (I don't know if DS let's you view the tree via a basic ldap browser) But if the above is the case, there is a lot of reading but no clear cut client setup connect like this. There are pages of tree, scheme, etc. We are a small group 15 people but have 50+ servers, so it would be nice to have a single login place, so any help, step in the right direction will be appreciated. I tried openldap, was able to browse the tree, but the same result when I tried to ssh in as my test user. So I guess I am interested if people are really using this or sticking with another ldap solution. Thanks.

1 0

[Fedora-directory-users] Unknown attribute syntax OID
by James Deuchar 21 Sep '07

21 Sep '07

Hi, I'm trying to create some custom schema via 99user.ldif using: attributeTypes: ( 1.3.6.1.4.1.24813.1.10 NAME 'cmDateOfBirth' DESC 'Date of birth (format YYYYMMDD, only numeric chars)' EQUALITY numericStringMatch SUBSTR numericsNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 SINGLE-VALUE X-ORIGIN 'user defined' ) I'm getting the following error when starting up slapd: # ./start-slapd [21/Sep/2007:11:30:05 +0100] dse - The entry cn=schema in file /opt/fedora-ds/slapd-master01/config/schema/99user.ldif is invalid, error code 21 (Invalid syntax) - attribute type cmDateOfBirth: Unknown attribute syntax OID "1.3.6.1.4.1.1466.115.121.1.36" [21/Sep/2007:11:30:05 +0100] dse - Please edit the file to correct the reported problems and then restart the server As far as I can tell from RFC2252 this should be ok?: Numeric String Y 1.3.6.1.4.1.1466.115.121.1.36 Any ideas? Thanks, James As far as I can tell from RFC2252 this should be ok? _________________________________________________________________ The next generation of MSN Hotmail has arrived - Windows Live Hotmail http://www.newhotmail.co.uk

2 1

[Fedora-directory-users] acls problem
by Gabriele Di Giambelardini 20 Sep '07

20 Sep '07

HI to all, I have a problem with some acls needed from a mail client to visit a address book. I need to restrict for anonymous user, the fileds ( attributes ) he can see. other solution may be, negate to anonymous user access to the ldap and create an specific user for address book, or use the same mail user also for address book. Some body can help me: for restrict accesso to anonymous user? for deny access to ldap for anonymous user? set the right permission for the same user used for mail login?? Thanks, excuse me in advance for my english.

2 3

[Fedora-directory-users] failover works but very slow.
by Hai Wu 19 Sep '07

19 Sep '07

Hi, We are using fedora 1.0.4, When the first ldap server dies and does not ping, the clients can still bind to second server but it is very slow to do anything on clients, opening a terminal or listing a dir takes a few seconds. I find when ldap service is down on the first server but server it still up and pingable, there is no delay on clients at all, so I have the workaround to set up a eth0:0 on second ldap server(or any other machine) to assume the IP of the first ldap server when first ldap server does not ping. Please see our /etc/ldap.conf and /etc/openldap/ldap.conf , we have only Rhel 3 and 4 clients. Any idea how to fix this? Thanks Mark /etc/ldap.conf host 1.1.1.1 2.2.2.2 port 636 ldap_version 3 base o=unix,dc=company,dc=com scope sub timelimit 5 bind_timelimit 3 pam_filter objectclass=posixAccount pam_login_attribute uid pam_member_attribute memberUid pam_password crypt idle_timelimit 3600 /etc/openldap/ldap.conf BASE o=unix,dc=company,dc=com HOST 1.1.1.1 2.2.2.2 PORT 636 SIZELIMIT 0 TIMELIMIT 0

3 7

re: [Fedora-directory-users] Directory Server capabilities
by Howard Chu 19 Sep '07

19 Sep '07

> From: "Clowser, Jeff (Contractor)" <jeff_clowser fanniemae com> > Date: Fri, 14 Sep 2007 14:58:53 -0400 > I have a question about capabilities in the Fedora/RH Directory server: > > First, can it do dynamic groups as Novell eDirectory does (or is there any > effort to add this): > http://support.novell.com/techcenter/articles/ana20020405.html Just fyi, the Novell guys have also published this spec as an Internet Draft. http://tools.ietf.org/html/draft-haripriya-dynamicgroup-02 The spec is full of flaws, however, as discussed here: http://www.openldap.org/lists/ietf-ldapext/200702/threads.html If this approach to dynamic groups is of interest to you, you should probably get involved in the discussion and give some feedback. > Basically, it's similar to the groupofURL's that is supported by the RH/Sun > directory server, but when the group is retrieved, dn's for entries that > match the ldap url dynamic criteria is returned added to the uniquemember > attribute, and you can do searches/compares on the uniquemember attribute > that includes dynamic members. Note that uniqueMember is a useless attribute in LDAP. Likewise the NameAndOptionalUID syntax (which is the syntax of uniqueMember) is totally misused in LDAP and should be avoided by modern software. > I realise there are some significant performance considerations with this, > but for modest use, it would really be useful. (FWIW, I asked a similar > question when FDS first was released, but didn't have another product to > point to as a comparable implementation at the time. Haven't looked at FDS > for a while, so I'm hoping some things might have changed :) ) As a footnote, OpenLDAP supports some of the less controversial features of dynamic groups and has for quite some time already... -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

6 12

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users September 2007