389-users June 2011

389-users@lists.fedoraproject.org

38 participants
45 discussions

Re: [389-users] win sync error
by solarflow99 21 Jun '11

21 Jun '11

I'm using self signed certs, did I miss something? Probably. There are many steps involved in getting winsync to use TLS/SSL >> to talk to AD, and getting AD PassSync to use TLS/SSL to talk to DS. Which >> > > From the Docs listed online: > http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.1/html/Adminis… > > and I went over everything else I could possibly find too. It seems in the > case of self signed certificates, the windows CA has to exported as a .cer > file, and imported in 389 with: certutil -d . -A -n "AD Cert" -t "CTu,u,u" > -i ad-cert.cer >

1 0

win sync error
by solarflow99 21 Jun '11

21 Jun '11

I have setup a windows sync agreement, and have followed the instructions, however I am seeing this error, even when I do an ldapsearch command from the 389 server: ldap_simple_bind: Can't contact LDAP server SSL error -8179 (Peer's Certificate issuer is not recognized.) I'm using self signed certs, did I miss something?

2 1

389 DS 1.2.2 - nsaimpresence object class problem
by Martin Stiborský 21 Jun '11

21 Jun '11

Hello, I'd like to ask you for help. I'm experiencing exactly same problem as is described here: https://bugzilla.redhat.com/show_bug.cgi?id=553636 As we are using 389 LDAP server in version 1.2.2 (released 2009?), is there any help for me? Really thanks for any hint. -- S pozdravem Martin Stiborský Jabber: stibi(a)njs.netlab.cz

2 1

Re: [389-users] Multimaster replication query
by s.varadha rajan 21 Jun '11

21 Jun '11

Hi, Thanks for the reply.that's ok.but if i create one new user in supplier side,it's not replicating to consumer side.i think ubuntu 10.04 LTS supports fedora-ds 1.1.x and dont have updated ppa links. for this case, shall i upgrade the latest version, will give the solution? After upgrade, how can i migrate my existing data. or give me a solution for this. Regards, Varad On Tue, Jun 14, 2011 at 8:26 PM, Rich Megginson <rmeggins(a)redhat.com> wrote: > On 06/14/2011 08:23 AM, s.varadha rajan wrote: > > Hi, > > I followed the procedure to configure "multi-master replication" as per > http://directory.fedoraproject.org/wiki/Howto:MultiMasterReplication. but > i got an error as > > *From consumer side:* > > 14/Jun/2011:19:25:41 +051800] NSMMReplicationPlugin - > multimaster_be_state_change: replica o=netscaperoot is coming online; > enabling replication > [14/Jun/2011:19:25:41 +051800] NSMMReplicationPlugin - replica_reload_ruv: > Warning: new data for replica o=netscaperoot does not match the data in the > changelog. > Recreating the changelog file. This could affect replication with > replica's consumers in which case the consumers should be reinitialized. > > This is not an error. It just means the consumer has been initialized with > data from the master, and it had old data (probably from setup) which was > wiped out. > > > *From Supplier side:* > > [14/Jun/2011:19:26:12 +051800] NSMMReplicationPlugin - Beginning total > update of replica "agmt="cn="Replication from varad.xxx.xxx.com port 389 > to sam.xxx.xxx.com port 389"" (sam:389)". > [14/Jun/2011:19:26:15 +051800] NSMMReplicationPlugin - Finished total > update of replica "agmt="cn="Replication from varad.xxx.xxx.com port 389 > to sam.xxx.xxx.com port 389"" (sam:389)". Sent 120 entries. > > > We are using the OS-Ubuntu 10.04. I searched in google and got the some > result in "https://bugzilla.redhat.com/show_bug.cgi?id=388021". but i dont > know how to fix this.Please help on this. > > Regards, > Varad > > > > > > > > > On Mon, May 30, 2011 at 12:27 PM, s.varadha rajan <rajanvaradhu(a)gmail.com> > wrote: > > > > Hi, > > > > Thanks for the reply.I will try and update you further. > > > > Regards, > > Varad > > > > > > > > On Fri, May 27, 2011 at 8:30 PM, Rich Megginson <rmeggins(a)redhat.com> > wrote: > >> > >> On 05/27/2011 12:11 AM, s.varadha rajan wrote: > >> > >> Hi, > >> > >> Can i get any update on my below query ? > >> > >> Regards, > >> Varad > >> > >> On Tue, May 24, 2011 at 6:17 PM, s.varadha rajan < > rajanvaradhu(a)gmail.com> wrote: > >>> > >>> Hi, > >>> We are using Ubuntu 10.04 server OS and all the web applications are > running on that.We have already implemented fedora-ds for ldap auth.now we > are planning to go some up-gradation.kindly let me know the following, > >>> 1.How to migrate running fedora-ds server to another server ? > >>> 2.i have taken all the user/group+etc in ldif format.is it enough for > migration or any other db (/var/lib/dirsrv/slapd-<instance>) also need to > bacup ? > >> > >> LDIF should be fine. > >>> > >>> if any procedure please share with me ? how to import/export .ldif file > >> > >> /usr/lib[64]/dirsrv/slapd-INSTNAME/db2ldif - export database to ldif > >> /usr/lib[64]/dirsrv/slapd-INSTNAME/ldif2db - import database from ldif > >>> > >>> 3.in our setup,one server is in public network.so i am planning to do > replication through "ldaps", i.e local server to public server replication > through highly secure how to ? > >> > >> Not exactly, but there is plenty of documentation - see > http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html-single/… > >>> > >>> Please help me on the above topics. > >>> Regards, > >>> Varad > >> > >> -- > >> 389 users mailing list > >> 389-users(a)lists.fedoraproject.org > >> https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > >

2 7

sshd/pam_ldap not honoring passwordMustChange
by David Barr 20 Jun '11

20 Jun '11

I know this is outside the scope of the 389 list, but my Google-fu is failing me on this one. If I change the password to the account on the LDAP server and verify "passwordmustchange: on," I can ssh in to the test host with the new password all day long, and never get asked to change it. I'm hoping someone has seen a document recently that they could link to. I've seen the "PAM Configuration for LDAP Client Systems" page on the wiki. That deals more with setting password expiration, though. Thanks! David -- David - Offbeat http://dafydd.livejournal.com dafydd - Online http://pgp.mit.edu/ Battalion 4 - Black Rock City Emergency Services Department Integrity*Commitment*Communication*Support

2 2

EL6 389-ds-base now available from repos.fedorapeople.org
by Rich Megginson 20 Jun '11

20 Jun '11

Since 389-ds-base is now in RHEL6 (as of RHEL6.1), we had to remove it from EPEL6. We still want to make more recent/testing/experimental versions available, though, so we are using http://fedoraproject.org/wiki/Fedorapeople_Repos for this purpose. In order to install the EPEL6 version, download http://repos.fedorapeople.org/repos/rmeggins/389-ds-base/epel-389-ds-base.r… and put it in the /etc/yum.repos.d directory. Then you should be able to install 389-ds-base or 389-ds as any other EPEL package. See http://directory.fedoraproject.org/wiki/Download#RHEL6.2FEPEL6 for more information.

1 0

About Kerberos and dirsrv
by Gioachino Bartolotta 16 Jun '11

16 Jun '11

Hi all, I have a problem in setup kerberos with 389 and I tried to do using the documents available on 389 site and RedHat. I followed everything, but I am unable to get the initial ticket from kerberos. Have I to add these records as I have always done with openldap?? dn: ou=KerberosPrincipals,ou=Users,dc=domain ou: KerberosPrincipals objectClass: top objectClass: organizationalUnit dn: krb5PrincipalName=ldapmaster/admin@DOMAN,ou=KerberosPrincipals,ou=Users,dc=domain objectClass: top objectClass: person objectClass: krb5Principal objectClass: krb5KDCEntry krb5PrincipalName: ldapmaster/admin@DOMAIN krb5KeyVersionNumber: 1 krb5MaxLife: 86400 krb5MaxRenew: 604800 krb5KDCFlags: 126 cn: ldapmaster/admin@domain sn: ldapmaster/admin@domain userPassword: {MD5}5S2YxFmBmhF3WTbY37t5KQ== Thanks -- ------------------------------------------- Gioachino Bartolotta

4 8

saslauthd won't work
by Gioachino Bartolotta 15 Jun '11

15 Jun '11

Hi! Just a little problem about saslauthd with 389. When I try to execute: ldapsearch -d 1 -D "cn=Directory Manager" -h dirsrv01.dominio -w secret -ZZ '(uid=u01209)' it returns ldap_sasl_interactive_bind_s: server supports: EXTERNAL GSSAPI PLAIN LOGIN CRAM-MD5 ANONYMOUS DIGEST-MD5 ldap_int_sasl_bind: EXTERNAL GSSAPI PLAIN LOGIN CRAM-MD5 ANONYMOUS DIGEST-MD5 ldap_int_sasl_open: host=dirsrv01.dominio SASL/EXTERNAL authentication started ldap_perror ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: I configured /etc/sysconfig/saslauthd in this way ------------------------- # Directory in which to place saslauthd's listening socket, pid file, and so # on. This directory must already exist. SOCKETDIR=/var/run/saslauthd # Mechanism to use when checking passwords. Run "saslauthd -v" to get a list # of which mechanism your installation was compiled with the ablity to use. # MECH=pam MECH=ldap START=yes # Additional flags to pass to saslauthd on the command line. See saslauthd(8) # for the list of accepted flags. FLAGS= --------------------------------------------------- What it's wrong?? This is the configuration of /etc/openldap/ldap.conf ------------------------------------------ #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never URI ldap://dirsrv01.dominio/ BASE dc=dominio TLS_CACERTDIR /etc/openldap/cacerts TLS_REQCERT allow ssl tls_start --------------------------------------------------------- Any Idea? Regards -- ------------------------------------------- Gioachino Bartolotta ICQ #: 9103167 MSN Messenger: astraroth(a)email.it Yahoo & Skype: gioachino_bartolotta

3 2

Re: [389-users] saslauthd won't work
by Rich Megginson 15 Jun '11

15 Jun '11

On 06/15/2011 09:45 AM, Gioachino Bartolotta wrote: > Hi, > > no, I don't wanna use saslauthd with kerberos, but just authenticate > users against ldap using tls or ssl ... > Tried to configure samba using ldaps --- and it didn't work. > > smbd[10001]: Failed to issue the StartTLS instruction: Operations error > > Any Idea?? > > Thank you! > > 2011/6/15 Rich Megginson<rmeggins(a)redhat.com>: >> On 06/15/2011 07:02 AM, Gioachino Bartolotta wrote: >>> Hi! >>> >>> Just a little problem about saslauthd with 389. >>> When I try to execute: >>> >>> ldapsearch -d 1 -D "cn=Directory Manager" -h dirsrv01.dominio -w >>> secret -ZZ '(uid=u01209)' >>> >>> it returns >>> >>> ldap_sasl_interactive_bind_s: server supports: EXTERNAL GSSAPI PLAIN >>> LOGIN CRAM-MD5 ANONYMOUS DIGEST-MD5 >>> ldap_int_sasl_bind: EXTERNAL GSSAPI PLAIN LOGIN CRAM-MD5 ANONYMOUS >>> DIGEST-MD5 >>> ldap_int_sasl_open: host=dirsrv01.dominio >>> SASL/EXTERNAL authentication started >>> ldap_perror >>> ldap_sasl_interactive_bind_s: Unknown authentication method (-6) >>> additional info: SASL(-4): no mechanism available: You did not specify the -x option - are you trying to use some form of SASL auth, or are you trying to use simple (i.e userDN/password) auth? If the latter, you have to specify the -x option. >>> >>> I configured /etc/sysconfig/saslauthd in this way >>> ------------------------- >>> # Directory in which to place saslauthd's listening socket, pid file, and >>> so >>> # on. This directory must already exist. >>> SOCKETDIR=/var/run/saslauthd >>> >>> # Mechanism to use when checking passwords. Run "saslauthd -v" to get a >>> list >>> # of which mechanism your installation was compiled with the ablity to >>> use. >>> # MECH=pam >>> MECH=ldap >>> START=yes >>> # Additional flags to pass to saslauthd on the command line. See >>> saslauthd(8) >>> # for the list of accepted flags. >>> FLAGS= >>> --------------------------------------------------- >>> >>> What it's wrong?? >> I'm not sure. What are you using saslauthd for? Are you trying to allow >> clients to use simple bind with their Kerberos passwords, rather than use >> the password in the LDAP server? If so, then you should use 389 with the >> PAM Pass-Through Auth plugin, and setup pam_krb5. >>> This is the configuration of /etc/openldap/ldap.conf >>> ------------------------------------------ >>> #SIZELIMIT 12 >>> #TIMELIMIT 15 >>> #DEREF never >>> URI ldap://dirsrv01.dominio/ >>> BASE dc=dominio >>> TLS_CACERTDIR /etc/openldap/cacerts >>> TLS_REQCERT allow >>> ssl tls_start >>> --------------------------------------------------------- >>> >>> Any Idea? >>> >>> Regards >> > >

1 0

ldap proxy and entry-based chaining: writing a plugin?
by Roberto Polli 15 Jun '11

15 Jun '11

Hi all, just a question. Does 389 provide a proxy functionality that can be used to identify immediately the right server to match? In case it's not supported, is it possible to develop a 389 plugin to manage it? Once developed, are you interested in merge that feature in the 389 upstream? Imagine the following configuration: U - user P - ldap proxy with two chained server: * R1- real server 1 * R2 - real server 2 Actually when U issue a search, on P forwards it on both the chained server. I'd like to know if there's a plugin or some sort of dynamic configuration that can be used to redirect the search directly on the right server using some further information provided (eg. regex & co). Here's a standard use case. 1- DIT: o=company, ou=italy, { dc=domain1.it, dc=domain2.it, dc=domain3.it} o=company, ou=france, { dc=domain1.fr, dc=domain2.fr, dc=domain3.fr} 2- Each county is managed by one cluster. The proxy is configured with two dblink/chain: ou=italy ->cluster1 ou=france->cluster2 3- the search is done on the proxy using one attribute "mail=user(a)domain1.it" 4- I'd like that all domain matching .it$ are searched first on cluster1, and conversely if matching .fr$ on cluster2 Obviously if you're interested I'll clarify. Peace, R. -- Roberto Polli Project Manager Babel S.r.l. - http://www.babel.it T: +39.06.9826.9651 M: +39.340.6522736 F: +39.06.9826.9680 P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma) CONFIDENZIALE: Questo messaggio ed i suoi allegati sono di carattere confidenziale per i destinatari in indirizzo. E' vietato l'inoltro non autorizzato a destinatari diversi da quelli indicati nel messaggio originale. Se ricevuto per errore, l'uso del contenuto e' proibito; si prega di comunicarlo al mittente e cancellarlo immediatamente.

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users June 2011