389-users November 2008

389-users@lists.fedoraproject.org

43 participants
59 discussions

[Fedora-directory-users] error in yum fedora-ds
by Eric 25 Nov '08

25 Nov '08

Hi I tried yum install fedora-ds. all parts installed but at the last: warning: rpmts_HdrFromFdno: Header V3 DSA signature: NOKEY, key ID 1ac70ce6 Importing GPG key 0x1AC70CE6 "Fedora Project < fedora-extras(a)fedoraproject.org>" Is this ok [y/N]: y warning: rpmts_HdrFromFdno: Header V3 DSA signature: NOKEY, key ID a7b02652 Public key for fedora-ds-1.1.2-1.fc6.i386.rpm is not installed hwo acn I install it?

3 3

[Fedora-directory-users] Re: Windows sync: how do you populate the posixUser attributes?
by Erling Ringen Elvsrud 25 Nov '08

25 Nov '08

I have managed to make Windows sync work and have one user synced from AD in my directory. The posixUser-attributes are still empty. How do you populate those attributes in an effective way? If I have an empty directory, and the users alredy exists in AD I have been thinking of this manual approach: 1. Perform a full re-sync from AD. 2. Export all the users in directory server in a LDIF-file and with scripts populate the needed attributes like uid, shell, home, etc. 3. Write the changes back in directory server. For new users, if not too many, perform the needed changes manually. What do you think? Is it possible to do this automatically with Windows Sync or do I have to use approaches like I described? Thanks, Erling

3 12

[Fedora-directory-users] RE: userPassword
by Dharmin Mandalia 24 Nov '08

24 Nov '08

Hello Rich Megginson Thanks... without "" am able to login. Regards Dharmin Re: [Fedora-directory-users] userPassword Rich Megginson Mon, 24 Nov 2008 07:26:56 -0800 Dharmin Mandalia wrote: >> Hi >> >> I used below script to assign password(123.com) to user test1 account >> which has no password assigned and it does assign the password, when >> try to login as user test1 with password 123.com, am unable to login. >> Assigned passwords to few test accounts using below script and same >> issue unable to login. >> # ./script test1 123.com >> ######### START ###################################### >> #!/bin/ksh -x >> uid=$1 ; password=$2 >> PASSWD=`slappasswd -v -h {SSHA} -s "$password"` >> >> ldapmodify -x -D "cn=Directory Manager" -w `cat /tmp/p` << >> ALLDONE >> dn: uid=$uid,ou=People, dc=trust, dc=co, dc=uk >> changetype: modify >> add: userpassword >> userpassword: "$PASSWD" >> ALLDONE >> ######### END #################### >> >> When I export the database do see the the userPassword entry as :- >> userPassword: {SSHA}Q7B+QFu2iRXxH8Ys8bfW/i3O0HrjSKfwbZHn4A== >> > Have you tried it without the quotes in the here document? I think the > quotes may be interpreted literally in here documents. e.g. > userpassword: $PASSWD > >> In the script I also tried PASSWD=123.com , still the same , unable to >> login. >> >> Any helpers to why above script assigns the password but unable to >> login and what should I do so am able to login. >> >> Thanks >> >> Regards >> Dharmin >> >> >>

1 0

[Fedora-directory-users] FDS silent setup: Could not find user "admin" in the server 'ldap://ldap.testdomain.local:389/o=NetscapeRoot. Error: No such object
by forn 24 Nov '08

24 Nov '08

Hello. I'm trying to automate FDS installation. I provide the .inf file with required parameters to setup-ds-admin.pl script. In particular, ConfigDirectoryAdminID=admin. Directory server installs fine, but admin server fails with "Could not find user "admin" in the server 'ldap://ldap.testdomain.local:389/o=NetscapeRoot. Error: No such object" error. Looking in slapd log, there is no such object, indeed. It just not getting created. If I use setup-ds-admin scipt manually, all is ok. I also tried to provide ConfigDirectoryAdminID from command line (found this method somewhere in CentOS mailing lists). "setup-ds-admin.pl -s -f fds.inf General.ConfigDirectoryAdminID=admin" results in the very same error. The system is Fedora 9 i386 and FDS version is 1.1.3, if i if of any interest. I'd be grateful for any assistance.

2 1

[Fedora-directory-users] userPassword
by Dharmin Mandalia 24 Nov '08

24 Nov '08

Hi I used below script to assign password(123.com) to user test1 account which has no password assigned and it does assign the password, when try to login as user test1 with password 123.com, am unable to login. Assigned passwords to few test accounts using below script and same issue unable to login. # ./script test1 123.com ######### START ###################################### #!/bin/ksh -x uid=$1 ; password=$2 PASSWD=`slappasswd -v -h {SSHA} -s "$password"` ldapmodify -x -D "cn=Directory Manager" -w `cat /tmp/p` << ALLDONE dn: uid=$uid,ou=People, dc=trust, dc=co, dc=uk changetype: modify add: userpassword userpassword: "$PASSWD" ALLDONE ######### END #################### When I export the database do see the the userPassword entry as :- userPassword: {SSHA}Q7B+QFu2iRXxH8Ys8bfW/i3O0HrjSKfwbZHn4A== In the script I also tried PASSWD=123.com , still the same , unable to login. Any helpers to why above script assigns the password but unable to login and what should I do so am able to login. Thanks Regards Dharmin

2 1

[Fedora-directory-users] LDAP authentication against SAMBA?
by Seppel 21 Nov '08

21 Nov '08

Hi Fedora Directory User Group, I am Carsten from Cologne, Germany. I am searching for a solution where i can import all my ActiveDirectory Users to LDAP. If one of this "Imported" users try to authenticate via LDAP this request should be done against the real AD password. I don`t want install something on the ActiveDirectory! -> NoPAssSync! I found a lot of solution where samba is able to authenticate against LDAP. Is there a possibility that LDAP authenticate against SAMBA -> ActiveDirectory. I found the PassThrough PAM Plugin, would it be possible to combine that with SAMBA PAM? Thanks for any Input. Best regards carsten -- Sensationsangebot nur bis 30.11: GMX FreeDSL - Telefonanschluss + DSL für nur 16,37 Euro/mtl.!* http://dsl.gmx.de/?ac=OM.AD.PD003K11308T4569a

1 0

[Fedora-directory-users] posixgroup name lookups
by John A. Sullivan III 21 Nov '08

21 Nov '08

Hello, all. We're trying to move all our user access control to DS including file system rights management and thus group management. We've hit a few problems and would like to share how we've gotten around them both for documentation and so someone with more experience can tell us if we are going about this the wrong way. The first problem we hit was the various hosts could not resolve the gidnumber to a name: -sh-3.2$ id -gn id: cannot find name for group ID 2000 2000 We noticed in the access query that the hosts were looking for posixgroups: SRCH base="dc=ssiservices,dc=biz" scope=2 filter="(&(objectClass=posixGroup)(gidNumber=2000))" attrs="cn userPassword memberUid uniqueMember gidNumber" The problem comes with user's initial groups which are typically named after the uid. Since we had not created these explicitly as DS groups but rather simply assigned the gidnumber in the posixaccount's gidnumber attribute, there was no posixgroup to seek. I suppose the ideal way to address this is the change the query to look for a posixgroup or a posixaccount. I do not see how one does this. Instead, we added posixgroup as an objectclass to the users. Is this a reasonable way to go about this? Then we hit our next problem. The user's initial group is usually the same as their uid, e.g., user bsmith belongs to group bsmith. However, the query is looking for cn rather than uid. I suppose this is because a posixgroup, as opposed to a user, does not have a uid but does have a cn. This turned up as a problem where we wanted to control the umask in bashrc which uses logic such as: if [ $UID -gt 99 ] && [ "`id -gn`" = "`id -un`" ]; then umask 002 id -un would return bsmith but id -gn would return something like Brian Smith. Thus, we will need to make it a user creation procedure to override the cn to be the same as the uid rather than FirstName LastName. Is this the correct approach? Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan(a)opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society

4 15

[Fedora-directory-users] Question about upgrading
by Ryan Manikowski 21 Nov '08

21 Nov '08

Long time fedora-ds user here with a few questions about upgrading and hoping knowledgeable folks can provide some feedback. I am currently running Fedora DS on Centos 4.7 and Centos 5 servers. All servers run v1.0.1. 1) Can the Centos 4 machines running v1.0.1 upgrade to the latest v1.1.3 without any problems? 2) Is v1.1.3 even supported on Centos 4? Are there rpm's for it? 3) When upgrading Fedora DS versions, must they all be upgraded simultaneously? 4) Say one server is running v1.0.1 and another server is running 1.1.3, can data be replicated from a v1.0.1 server to a v1.1.3 server? How about vice-a-versa? 3 of our 4 Fedora DS servers can be upgraded to run Centos 5 w/ Fedora DS v1.1.3 but we'd like to keep one server running Centos 4.7 for the time being due to legacy software requirements. -- Ryan Manikowski System Administrator 2ergo Americas Inc. :703.677.8499: www.2ergo.com Arlington, Virginia This message (including attachments) is confidential and may be legally privileged. The content and views expressed are those of the sender and not necessarily the 2ergo Group. If you are not the intended recipient, you must not disclose, copy or use any part of it. Please delete all copies immediately and notify the sender. 2ergo Americas Inc. was formerly known as Proteus Inc.

2 1

[Fedora-directory-users] Dynamic groups not supplying posixgroup membership
by John A. Sullivan III 21 Nov '08

21 Nov '08

Hello, all. We have a multi-tenant set up where each client has a group which contains all their internal users. We thought we would save time by creating a dynamic group using a filter such as: ldap:///ou=internal,ou=users,dc=X,dc=com,dc=ssiservices, dc=biz??sub?(&(objectclass=person)(uid=*)) This appears to work and adequately populates the group. However, when the user logs in to a Linux system, the Linux system queries for group membership. We are noticing that we do not get any results when using dynamic groups. If we make the same group managed, we see the group membership. Notice these two records from the access log (truncated because of screen scraping): filter="(&(objectClass=posixGroup)(|(memberUid=te.kee)(uniqueMember=uid=te.kee,ou=internal,ou=Users,dc=ebc-co,dc=com,dc=ssiservices,dc= RESULT err=0 tag=101 nentries=1 etime=0 N.B. we have an entry. This used managed groups. When we change to dynamic groups, we see this: filter="(&(objectClass=posixGroup)(|(memberUid=te.kee)(uniqueMember=uid=te.kee,ou=internal,ou=Users,dc=ebc-co,dc=com,dc=ssiservices,dc RESULT err=0 tag=101 nentries=0 etime=0 N.B. no entries! Have we done something wrong? Is this a bug or is it the way it is supposed to work? Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan(a)opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society

2 1

[Fedora-directory-users] synchronize fedora with Lotus Domino and MS Active directory
by Hugo Hendriks 20 Nov '08

20 Nov '08

Hi, I have a brief question. I'm not really experienced in the whole LDAP field but I was trying to figure out if the following setup is possible. I have 2 different directory servers...a Lotus Notes/Domino server and a Active Directory server. Can we use Fedora as a central LDAP server and is it possible to easily synchronize/replicate the Fedora server with the Notes and AD server? I tried to find some documentation about this but only found http://directory.fedoraproject.org/wiki/Howto:WindowsSync so I guess synchronization with AD is covered but is this also possible with Notes? It also seems quite technical....are there perhaps certain tools which makes this more easy for you? Much thanks is advance! Best Regards, Hugo

2 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2008