389-users September 2008

389-users@lists.fedoraproject.org

39 participants
43 discussions

[Fedora-directory-users] fds 1.1+ not setting nsslapd-instancedir on install?
by Ryan Braun [ADS] 11 Sep '08

11 Sep '08

Hey guys. I have some perl replication scripts (fdstool) that I developed on fds 1.0.4. On my first attempt to use them on a 1.1+ (in this particular case 1.1.2), the changelog object creation bails because the nsslapd-instancedir attribute in cn=config isn't set. ############################## # find the instance-dir ############################## $msg = $ldap->search ( base => "cn=config", scope => "base", filter => "(objectClass=*)", ); my $instance_dir = $msg->entry(0)->get_value("nsslapd-instancedir"); ends up as null as there isn't anything at said attribute. Also, shodan:/home/ryan/fdstools# ldapsearch -x -h yzxXXXX0 -D "cn=Directory Manager" -W -b "cn=config" "objectclass=*"|grep instancedir Enter LDAP Password: nsslapd-instancedir: shodan:/home/ryan/fdstools# ldapsearch -x -h yzxXXXX0 -D "cn=Directory Manager" -W -b "cn=config" "objectclass=*"|grep nsslapd-ldifdir Enter LDAP Password: nsslapd-ldifdir: /var/lib/dirsrv/slapd-yzxdmns0/ldif For now I'm useing nsslapd-ldifdir and just ~ s/\/ldif// to cut off the ldir directory, but am just confirming this behavior is intended. FWIW I built the packages myself, so it could very well be my own fault :P Ryan

2 5

[Fedora-directory-users] Encryption works, but odd entries in the error log on startup.
by Ryan Braun [ADS] 11 Sep '08

11 Sep '08

I had setup encryption on one of my test fds servers (1.1.2), generated a CAcert and a Server-Cert and turned on encryption. It all worked fine. I shut down fds, removed the Server-Cert and created a new Server-Cert with a few Subject Alt Name entries. I didn't import a p12 cert, I just used certutil to create a new cert in the database. I restarted the server and tested with ldapsearch -ZZ and it all still worked. When I had a look in the log recently, I noticed these entries everytime i restart the service. [11/Sep/2008:15:11:18 +0000] - Fedora-Directory/1.1.2 B2008.253.1749 starting up [11/Sep/2008:15:11:19 +0000] - attrcrypt_unwrap_key: failed to unwrap key for cipher AES [11/Sep/2008:15:11:19 +0000] - Failed to retrieve key for cipher AES in attrcrypt_cipher_init [11/Sep/2008:15:11:19 +0000] - Failed to initialize cipher AES in attrcrypt_init [11/Sep/2008:15:11:19 +0000] - attrcrypt_unwrap_key: failed to unwrap key for cipher AES [11/Sep/2008:15:11:19 +0000] - Failed to retrieve key for cipher AES in attrcrypt_cipher_init [11/Sep/2008:15:11:19 +0000] - Failed to initialize cipher AES in attrcrypt_init [11/Sep/2008:15:11:19 +0000] - slapd started. Listening on All Interfaces port 389 for LDAP requests [11/Sep/2008:15:11:19 +0000] - Listening on All Interfaces port 636 for LDAPS requests Looking back to when I first turned on encryption, I see [10/Sep/2008:19:41:20 +0000] - Fedora-Directory/1.1.2 B2008.253.1749 starting up [10/Sep/2008:19:41:20 +0000] - No symmetric key found for cipher AES in backend userRoot, attempting to create one... [10/Sep/2008:19:41:20 +0000] - Key for cipher AES successfully generated and stored [10/Sep/2008:19:41:20 +0000] - No symmetric key found for cipher 3DES in backend userRoot, attempting to create one... [10/Sep/2008:19:41:20 +0000] - Key for cipher 3DES successfully generated and stored [10/Sep/2008:19:41:20 +0000] - No symmetric key found for cipher AES in backend NetscapeRoot, attempting to create one... [10/Sep/2008:19:41:20 +0000] - Key for cipher AES successfully generated and stored [10/Sep/2008:19:41:20 +0000] - No symmetric key found for cipher 3DES in backend NetscapeRoot, attempting to create one... [10/Sep/2008:19:41:20 +0000] - Key for cipher 3DES successfully generated and stored [10/Sep/2008:19:41:20 +0000] - slapd started. Listening on All Interfaces port 389 for LDAP requests [10/Sep/2008:19:41:20 +0000] - Listening on All Interfaces port 636 for LDAPS requests So I'm wondering if I need to somehow reinit some of the encryption keys? Or maybe I missed a step for replacing a Server-Cert? But from the docs it looks like a straight forward turn off fds, remove old cert, create/import new cert (with same name), restart fds. Ryan

2 3

[Fedora-directory-users] Sudo and Ldap
by Kashif Ali 11 Sep '08

11 Sep '08

Hello all, I have successfully setup FDS on Centos 5.2, and manage to get users signing on without any issues. However if I edit the sudoers file to allow a group on ldap use sudo, the sudo command does not see the members of the group or I think the group itself? I have no idea why this is: if I run the command 'id' as the given user you can clear see the group memberships, however if I do: getent group linuxops I see: linuxops:*:6000: with no members??? however SSHD AllowGroups works? I have configured sshd to only allow members of the linxops group to login and this works fine? so my question is why is sudo behaving differently?

4 14

[Fedora-directory-users] mod_cgi or mod_cgid for adminserver?
by PGNet 09 Sep '08

09 Sep '08

Per docs @ http://directory.fedoraproject.org/wiki/AdminServer, "Admin Server is ... formerly based on the Netscape Enterprise Server but has been ported to use the Apache 2.x webserver using the Worker model (multi-threaded mode, not multi process)." I've installed as prereq, httpd2 -V | grep MPM Server MPM: Worker -D APACHE_MPM_DIR="server/mpm/worker" Per, "Apache Module mod_cgid" (http://httpd.apache.org/docs/2.2/mod/mod_cgid.html(, "This module (mod_cgid) is used by default instead of mod_cgi whenever a multi-threaded MPM is selected during the compilation process. At the user level, this module is identical in configuration and operation to mod_cgi. The only exception is the additional directive ScriptSock which gives the name of the socket to use for communication with the cgi daemon." In FedoraDS' install of adminserver, mod_cgi is loaded (and fails @exec, as it's not installed by default), @ #144 /etc/dirsrv/admin-serv/httpd.conf LoadModule cgi_module /usr/lib64/apache2-worker/mod_cgi.so and, also references mod_cgid.c, @ #392 /etc/dirsrv/admin-serv/httpd.conf <IfModule mod_cgid.c> ... </IfModule> which will never hit as mod_cgid is not @ LoadModule. Should mod_cgi, then, be loaded for FedoraDS use, or mod_cgid? Thanks.

1 0

[Fedora-directory-users] missing "console.conf" in headless FedoraDS install
by PGNet 09 Sep '08

09 Sep '08

I'm building & installing FedoraDS on a headless server. For the moment, remote management via shell login is fine; no graphical consoles required. I've built/installed from cvs source FedoraDirSvr_1_1_2 ldapserver adminutil_1_1_7 adminutil mod_nss108 mod_nss FedoraDirSrvAdmin_1_1_6 adminserver FedoraDirSrvAdmin_1_1_6 mod_admserv FedoraDirSrvAdmin_1_1_6 mod_restartd @ Setup exec of, setup-ds-admin.pl I get, Creating directory server . . . Your new DS instance 'FedoraDS' was successfully created. Creating the configuration directory server . . . Beginning Admin Server creation . . . Creating Admin Server files and directories . . . Updating adm.conf . . . Updating admpw . . . Registering admin server with the configuration directory server . . . Updating adm.conf with information from configuration directory server . . . Updating the configuration for the httpd engine . . . Error opening /etc/dirsrv/admin-serv/console.conf: No such file or directoryCould not update the httpd engine configuration. Failed to create and configure the admin server Exiting . . . Log file is '/tmp/setup4lZetX.log' And, checking, ls -1 /etc/dirsrv/admin-serv/ adm.conf admpw cert8.db key3.db local.conf secmod.db Is 'console.conf', in fact, required for console-less operation? If so, where's it originate? Have I missed a required install, perhaps "FedoraConsoleFramework_1_1_2"? If not, where can I fix the dependency? Remove @ #174: } else { # set up directory server instance to be managed by the console/adminserver $setup->msg('create_subds'); if (!createSubDSNoConn($setup->{inf}, \@errs)) { $setup->msg($FATAL, @errs); $setup->msg($FATAL, 'error_create_configds'); $setup->doExit(1); from "setup-ds-admin.pl"? A preference setting somewhere? Thanks.

1 0

[Fedora-directory-users] email clients
by Malcolm Amir Hussain-Gambles 08 Sep '08

08 Sep '08

Just wondering what email clients people use for address books. I've tried evolution, but it seems completely unstable for ldap, I've had no choice but to revert to people using thunderbird. (this is the fc9 version) Thunderbird is stable but lacks features. Claws is probably the best, but doesn't have that corporate feel like evolution. Are most people using outlook? Cheers, Malcolm

2 2

[Fedora-directory-users] LDAP Error with sync agreement using ssl
by steve nguyen 08 Sep '08

08 Sep '08

Hi everybody, I have created two sync agreement in FDS. I've got an error message with the one using ssl : "LDAP error: Can't contact LDAP server. Error Code 81. The second sync agreement without ssl works. I think this error should come from a certificate that I've create. To create my certificate on Fedora I've used the second script from the fds wiki. I want to know another thing : I selected a single master in the replica role column. If I choose multiple master, will the sync happen from both side : ad and fds ? ps : escuse me for my bad english. _________________________________________________________________ Contrôlez les personnes autorisées à parler à vos enfants sur MSN / Windows Live Messenger ! http://www.windowslive.fr/controleparental/default.asp

3 5

[Fedora-directory-users] Can't connect to Redhat AS5 by 'telnet' !!!
by 김정곤 08 Sep '08

08 Sep '08

Hi everyone. I have a problem. I am using FDS-1.0.4, and have Linux machines, Redhat AS4 and Redhat AS5. But I can’t connect to Redhat AS5 machine by telnet. but I can connect to the machine by ‘su’ using. Redhat AS4 machine has no any problem. Did you have a experience? Would you please help me? Thanks

2 1

[Fedora-directory-users] multiple groups in the admin console
by Mike Zupan 06 Sep '08

06 Sep '08

I am wondering how I add a posix account to multiple group id's. I really can only do this in the admin console. I can't seem to figure it out. I setup the new posixgroup as Full Name: mailgrp gidnumber: 809 Thanks Mike

2 1

[Fedora-directory-users] Export the Windows Agreement in LDIF format
by Mister Anonyme 05 Sep '08

05 Sep '08

Hi, The subject says it all, I'm wondering if it's possible to export a Windows Agreement in LDIF format so I can install a new Directory Server automatically next time. Thank you. _________________________________________________________________

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users September 2008