389-users September 2007

389-users@lists.fedoraproject.org

63 participants
46 discussions

[Fedora-directory-users] FDS and Samba3
by Raj Seenivasan 18 Sep '07

18 Sep '07

I have 2 questions to ask. I searched the list and couldn't find anything related... 1. Is there a way to setup samba and FDS on 2 different boxes and use FDS as the backend for samba? FDS wiki (http://directory.fedoraproject.org/wiki/Howto:Samba) has instructions to setup both samba and fds on the same box. What special steps needs to be done if on 2 different boxes? 2. I had setup samba+fds on a single box and password syncing works only one way. FDS --> Samba sync is not working. Passwords changed using smbpasswd gets synced with fds. Am I missing something? Thanks. CONFIDENTIALITY NOTICE: This email message and any attachments contain proprietary and privileged information of Roundbox, Inc., which are provided for the sole and confidential use of the intended recipients. Any review, use, disclosure or distribution of this information is restricted and must comply with the nondisclosure agreement between Roundbox, Inc. and you (or your company). All other uses are prohibited. If you are not an intended recipient, please contact the sender by reply email and promptly delete and otherwise destroy all copies of the message and its attachments.

3 4

[Fedora-directory-users] FDS and Solaris Client Question
by Jeremiah Coleman 18 Sep '07

18 Sep '07

I'm trying to set up a Solaris 10 client with FDS (all my linux clients are working beautifully), but authentication is acting very strange. Monitoring the net traffic, I can see the Solaris system bind, search for info about the username, get a normal response, but then it just unbinds. It never asks to authenticate a password. My configuration is below. Any help would be much appreciated. ldap_client_file: NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_SERVERS= fds1.wherever.com NS_LDAP_SEARCH_BASEDN= dc=wherever,dc=com NS_LDAP_AUTH= simple NS_LDAP_SEARCH_REF= TRUE NS_LDAP_SEARCH_SCOPE= one NS_LDAP_SEARCH_TIME= 30 NS_LDAP_CACHETTL= 43200 NS_LDAP_PROFILE= default NS_LDAP_CREDENTIAL_LEVEL= proxy NS_LDAP_SERVICE_SEARCH_DESC= passwd: ou=People,dc=wherever,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= group: ou=group,dc=wherever,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= shadow: ou=People,dc=wherever,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= netgroup: ou=netgroup,dc=wherever,dc=com?one NS_LDAP_BIND_TIME= 2 /etc/nsswitch.conf (note, I pulled ldap from networks, etc, since not all of that is configured on ldap as yet): # the following two lines obviate the "+" entry in /etc/passwd and /etc/group. passwd: files ldap group: files ldap shadow: files ldap # consult /etc "files" only if ldap is down. hosts: dns files ldap # Note that IPv4 addresses are searched for in all of the ipnodes databases # before searching the hosts databases. ipnodes: files networks: files protocols: files rpc: files ethers: files netmasks: files bootparams: files publickey: files netgroup: ldap automount: files ldap aliases: files ldap # for efficient getservbyname() avoid ldap services: files ldap printers: user files ldap auth_attr: files ldap prof_attr: files ldap project: files ldap tnrhtp: files ldap tnrhdb: files ldap /etc/pam.conf: # login service (explicit because of pam_dial_auth) # login auth required pam_ldap.so.1 login auth requisite pam_authtok_get.so.1 login auth required pam_dhkeys.so.1 login auth required pam_unix_cred.so.1 login auth required pam_unix_auth.so.1 login auth required pam_dial_auth.so.1 # # rlogin service (explicit because of pam_rhost_auth) # rlogin auth sufficient pam_ldap.so.1 rlogin auth sufficient pam_rhosts_auth.so.1 rlogin auth requisite pam_authtok_get.so.1 rlogin auth required pam_dhkeys.so.1 rlogin auth required pam_unix_cred.so.1 rlogin auth required pam_unix_auth.so.1 # Default definitions for Authentication management # Used when service name is not explicitly mentioned for authentication # other auth sufficient pam_ldap.so.1 other auth requisite pam_authtok_get.so.1 other auth required pam_dhkeys.so.1 other auth required pam_unix_cred.so.1 other auth required pam_unix_auth.so.1 # # passwd command (explicit because of a different authentication module) # passwd auth sufficient pam_ldap.so.1 passwd auth required pam_passwd_auth.so.1 # # cron service (explicit because of non-usage of pam_roles.so.1) # cron account required pam_unix_account.so.1 # # Default definition for Account management # Used when service name is not explicitly mentioned for account management # other account sufficient pam_ldap.so.1 other account requisite pam_roles.so.1 other account required pam_unix_account.so.1 # # Default definition for Session management # Used when service name is not explicitly mentioned for session management # other session sufficient pam_ldap.so.1 other session required pam_unix_session.so.1 # # Default definition for Password management # Used when service name is not explicitly mentioned for password management # other password required pam_dhkeys.so.1 other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 other password required pam_authtok_store.so.1 -- Jeremiah Coleman Systems Administrator C & C Technologies 337-261-0660 x3421 jay.coleman(a)cctechnol.com

2 3

[Fedora-directory-users] Re: getting sh on RHAS5 to work with FDS.
by Howard Chu 18 Sep '07

18 Sep '07

> Date: Tue, 18 Sep 2007 08:39:55 -0600 > From: Richard Megginson <rmeggins(a)redhat.com> > Yes, very. > http://directory.fedoraproject.org/wiki/Howto:SSL#Basic_Steps > <quote> > > NOTE - *Do not use cn=server-cert for your server certificate*. In step > 7 of the linked instructions, it says to use certutil .... -s > cn=server-cert - this will cause clients to fail to validate the cert. > Instead, you must use the fully qualified domain name of your server > host as the value of the cn attribute in the subject DN. For example, if > your directory server hostname is foo.example.com, use Also look at the constraints in RFC4513, section 3.1.3. Use subjectAltName extensions to get more flexibility here. > > ../shared/bin/certutil -S -n "Server-Cert" -s cn=foo.example.com -c "CA certificate" \ > -t "u,u,u" -m 1001 -v 120 -d . -z noise.txt -f pwdfile.txt > > to generate your server cert. This is the minimum. You may wish to > provide your clients with more details about your server. For more > information, see RFC 1485 <http://www.ietf.org/rfc/rfc1485.txt>. You > could choose to specify the subject DN like this: > > ../shared/bin/certutil ... -s "cn=foo.example.com,ou=engineering,o=example corp,c=us" ... > > </quote> > > Note that this also means that if you use cn=foo.example.com, clients > must be able to resolve the server's IP address to "foo.example.com". If > you don't care/can't do this, then use TLS_REQCERT never in your > /etc/openldap/ldap.conf to make ldapsearch stop complaining. I highly > recommend you do not do this though. Agreed, bad idea. By the way, the OpenLDAP libraries never do a DNS lookup on the name you provide, so whether the name resolves or not doesn't matter. We expect the name passed in to exactly match the CN, or to match the subjectAltName. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

[Fedora-directory-users] question about certificate
by Elisa Pellegrini 18 Sep '07

18 Sep '07

Hi! I don't now if this is the right email address to ask my problem.. I'm using fedora Directory -server to implement ldap. The problem is about certificate: I create a certificate but is impossible to use that because the issuer's certificate is not recornize. How can i solve this problem?Whit console I fixed CA cert name and I edit trust. Is necessary to fix certmap mappingName issuerDN in certmap.conf file? I try to do this but nothing changed. Sorry for my bad english! Thanks! ------------------------------------------------------ Leggi GRATIS le tue mail con il telefonino i-mode di Wind http://i-mode.wind.it/ _______________________________________________ Like your solution? Hate it? Go to your software vendor's page at RHX - http://rhx.redhat.com - and tell us what you think! Help improve RHX. The RHX team is looking for your feedback with a short, 12 question survey: http://www.keysurvey.com/survey/162511/fa85/ ------------------------------------------------------ Leggi GRATIS le tue mail con il telefonino i-mode di Wind http://i-mode.wind.it/

2 1

[Fedora-directory-users] Password Expiration Warning notification
by Raj Seenivasan 18 Sep '07

18 Sep '07

Is there an option in FDS for password expiration warning message to go out via email? We have few applications that use FDS but none reports about the password expiration. SSH displays the warning but there are users who don't use ssh. Any help is highly appreciated. Thanks much. CONFIDENTIALITY NOTICE: This email message and any attachments contain proprietary and privileged information of Roundbox, Inc., which are provided for the sole and confidential use of the intended recipients. Any review, use, disclosure or distribution of this information is restricted and must comply with the nondisclosure agreement between Roundbox, Inc. and you (or your company). All other uses are prohibited. If you are not an intended recipient, please contact the sender by reply email and promptly delete and otherwise destroy all copies of the message and its attachments.

4 4

[Fedora-directory-users] One way replication FROM Active Directory
by Chris 18 Sep '07

18 Sep '07

Has anyone done this? If so, please, please point me to relevant and complete documentation. -- Best regards, Chris Registerd Linux user number 448639

1 0

[Fedora-directory-users] help....unable to start fedora server
by bikas gurung 18 Sep '07

18 Sep '07

Hi all, I'm certainly in deep s*&#t now. I just updated my file-server with new updates and patches and tried to reboot it; but it hanged: reason - Kernel Panic. So I had to shutdown the system manually and had to run 'fsck' manually afterwards. Everything seemed to run well afterwards. But today evening I found that I was not able to connect my pc to file-server. When I checked, it turns out that 'slapd' daemon wasn't started at all. I manually tried to start the server using the scripts (in /rc.d/init.d ) but got an error. Here's an error logged in log file: Fedora-Directory/1.0.2 B2006.060.1928 isec-file:636 (/opt/fedora-ds/slapd-isec-file) [17/Sep/2007:20:52:06 -0500] - Fedora-Directory/1.0.2 B2006.060.1928starting up [17/Sep/2007:20:52:06 -0500] - Detected Disorderly Shutdown last time Directory Server was running, recovering database. [17/Sep/2007:20:52:06 -0500] - libdb: Ignoring log file: /opt/fedora-ds/slapd-isec-file/db/log.0000000206: magic number 0, not 40988 [17/Sep/2007:20:52:06 -0500] - libdb: Invalid log file: log.0000000206: Invalid argument [17/Sep/2007:20:52:06 -0500] - libdb: PANIC: Invalid argument [17/Sep/2007:20:52:06 -0500] - libdb: PANIC: DB_RUNRECOVERY: Fatal error, run database recovery [17/Sep/2007:20:52:06 -0500] - Database Recovery Process FAILED. The database is not recoverable. err=-30978: DB_RUNRECOVERY: Fatal error, run database recovery [17/Sep/2007:20:52:06 -0500] - Please make sure there is enough disk space for dbcache (10485760 bytes) and db region files [17/Sep/2007:20:52:06 -0500] - start: Failed to init database, err=-30978 DB_RUNRECOVERY: Fatal error, run database recovery [17/Sep/2007:20:52:06 -0500] - Failed to start database plugin ldbm database [17/Sep/2007:20:52:06 -0500] - WARNING: ldbm instance userRoot already exists [17/Sep/2007:20:52:06 -0500] - WARNING: ldbm instance NetscapeRoot already exists [17/Sep/2007:20:52:06 -0500] binder-based resource limits - nsLookThroughLimit: parameter error (slapi_reslimit_register() already registered) [17/Sep/2007:20:52:06 -0500] - start: Resource limit registration failed [17/Sep/2007:20:52:06 -0500] - Failed to start database plugin ldbm database [17/Sep/2007:20:52:06 -0500] - Error: Failed to resolve plugin dependencies [17/Sep/2007:20:52:06 -0500] - Error: preoperation plugin 7-bit check is not started [17/Sep/2007:20:52:06 -0500] - Error: accesscontrol plugin ACL Plugin is not started [17/Sep/2007:20:52:06 -0500] - Error: preoperation plugin ACL preoperation is not started [17/Sep/2007:20:52:06 -0500] - Error: postoperation plugin Class of Service is not started [17/Sep/2007:20:52:06 -0500] - Error: preoperation plugin HTTP Client is not started [17/Sep/2007:20:52:06 -0500] - Error: database plugin ldbm database is not started [17/Sep/2007:20:52:06 -0500] - Error: object plugin Legacy Replication Plugin is not started [17/Sep/2007:20:52:06 -0500] - Error: object plugin Multimaster Replication Plugin is not started [17/Sep/2007:20:52:06 -0500] - Error: postoperation plugin Roles Plugin is not started [17/Sep/2007:20:52:06 -0500] - Error: object plugin Views is not started As all the client machines depend upon this server for authentication and as weekend is still far away, I'm in big trouble now. I'm quite clueless what to do and would really appreciate any kind of help. And no, unfortunately I don't have a backup to fall back to . Thanking you in advance bikas

3 2

[Fedora-directory-users] ssh login fail
by Steven Jones 17 Sep '07

17 Sep '07

Hi, I am trying to get a RHEL4 box to LDAP authenticate against FDS (also on RHEL4) and failing..... In the logs (messages) I have, Sep 10 13:30:52 vuwunicvfwall02 sshd(pam_unix)[2284]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=vuwunicvadmin02.res.vuw.ac.nz user=jonesst1 Sep 10 13:30:52 vuwunicvfwall02 sshd[2284]: pam_ldap: ldap_simple_bind Can't contact LDAP server Sep 10 13:30:52 vuwunicvfwall02 sshd[2284]: pam_ldap: ldap_simple_bind Can't contact LDAP server Sep 10 13:31:05 vuwunicvfwall02 sshd(pam_unix)[2284]: 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=vuwunicvadmin02.res.vuw.ac.nz user=jonesst1 Any ideas why? And how to fix? Also is there a way to search the archive for this list? When I do a, ldapsearch -x -h 130.195.87.249 -b dc=vuw,dc=ac,dc=nz "(ou=Users)" The server replies so FDS appears to be running OK.... Also is there a way to search the archive for this list? I have tried Googling with no luck... regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272

5 68

[Fedora-directory-users] FDS and OpenLDAP integration
by Matteo Angelino 17 Sep '07

17 Sep '07

Hello, in my organization I have a master ldap server based on openLDAP. Now I have installed a new ldap server (slave) based on Fedora Directory Server. The openLDAP server have a replica directive in the cenfiguration file to replicate the modify to FDS server. Modify entry that exist on master server work fine. The problem in the insert of e new user into the master server. When I try to insert e new user from the followind ldif, i see an error in the insert. testuser.ldif: dn: uid=testuser, dc=studenti, dc=unipmn,dc=it givenName: TEST postalCode: 1920 objectClass: top objectClass: person objectClass: inetOrgPerson objectClass: posixAccount userPassword:: e21kNX0rcmM3V2xoeE9QcnZLc0MvdlJtRlZnPT0= mail: roberto.pinna(a)studenti.unipmn.it uid: testuser uidNumber: 6763578 cn: TEST USER carLicense: PNNRRT73B26A182A loginShell: /bin/bash gidNumber: 100 homeDirectory: /home/test sn: TEST Error from FDS error log: Entry "uid=testuser,dc=studenti,dc=unipmn,dc=it" -- attribute "structuralobjectclass" not allowed Error from slurpd (on master openLDAP server): Error: ldap_add_s failed adding DN "uid=testuser,dc=studenti,dc=unipmn,dc=it": attribute "structuralobjectclass" not allowed Information from reject file of the surpd: ERROR:: T2JqZWN0IGNsYXNzIHZpb2xhdGlvbjogYXR0cmlidXRlICJzdHJ1Y3R1cmFsb2JqZWN0Y2 xhc3MiIG5vdCBhbGxvd2VkCg== replica: db.mfn.unipmn.it:389 time: 1189156318.0 dn: uid=testuser,dc=studenti,dc=unipmn,dc=it changetype: add givenName: TEST postalCode: 1920 objectClass: top objectClass: person objectClass: inetOrgPerson objectClass: posixAccount userPassword:: e21kNX0rcmM3V2xoeE9QcnZLc0MvdlJtRlZnPT0= uid: testuser mail: roberto.pinna(a)studenti.unipmn.it uidNumber: 6763578 cn: TEST USER carLicense: PNNRRT73B26A182A loginShell: /bin/bash gidNumber: 100 homeDirectory: /home/test sn: TEST structuralObjectClass: inetOrgPerson entryUUID: 21363b50-f16e-102b-96d1-e14b33466425 creatorsName: cn=manager,dc=unipmn,dc=it createTimestamp: 20070907091157Z entryCSN: 20070907091157Z#000000#00#000000 modifiersName: cn=manager,dc=unipmn,dc=it modifyTimestamp: 20070907091157Z I have see that the structuralobjectclass is not defined in the attributes available in FDS.... how can resolve the probem? Thank's in advance -------------------------------------------------------------- Matteo Angelino Dipartimento di Informatica Via Bellini 25\G 15100 Alessandria ITALY Tel: +39 0131 360375 Email: matteo.angelino(a)mfn.unipmn.it --------------------------------------------------------------

4 12

[Fedora-directory-users] samba + Directory server + windows client
by Satish Patel 17 Sep '07

17 Sep '07

Dear all I am going to implement Intranet server on my organization i m very intreseted on FDS now thing is that my users on windows client and i am installing samba 4.0 as a PDC. so is it possible i can create group policy or network controll through FDS + samba PDC means i dont want to give access of Network to a specific user or not give access of telnet command or something like that which is possible on windows 2003 PDC it will support all policy on OpenSource Setup ??? Regards satish patel $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- Why delete messages? Unlimited storage is just a click away.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users September 2007