389-users November 2012

389-users@lists.fedoraproject.org

37 participants
33 discussions

Question about 389-ds and Solaris
by Jean-Francois Saucier 14 Nov '12

14 Nov '12

Hi everyone, I just installed 389-ds on Fedora and have a problem with Solaris clients. Everything works well on the Linux side (Fedora, CentOS and RHEL clients works fine). On the Solaris side, I got everything to work too (pam, ssh, getent passwd, getent group, ldaplist -l paswd, ldaplist -l group, etc). I used the native Solaris ldapclient tool to make everything work. The problem I have is with the Group attribute. In 389-ds, the group are created with the objectClass "groupofuniquenames" and the members are listed with the attribute "uniqueMember". I manually add the objectClass "posixgroup" to allow the group to be visible on the client. With this configuration, everything work fine in Linux. In Solaris, I can see the group with "getent group" but there are no member. What I have found is that Solaris need it's member to be in the "memberUid" attribute and not in the "uniqueMember" attribute. Also, I found that while uniqueMember require a full qualification (uid=jeff,ou=people,dc=test,dc=com), the memberUid just require the uid (jeff). What should I do to make this work easy on Solaris? Adding the memberUid by hand is not an option because it's sure there will be a difference between the uniqueMember and memberUid list in some point in time. Thank you! -- Jean-Francois Saucier (djf_jeff) GPG key : 0xA9E6E953

1 0

excluding attributes/objectclasses belonging to a specific schema from export to ldif
by Timo Ballin 14 Nov '12

14 Nov '12

Hy, I have only limited knowledge about ldap and desperately trying to keep sings simple: I am trying to set up a replication from OpenLDAP to an external 389-LDAP. To get started I have done a manual LDIF export. On the external LDAP I only need the inetOrgPerson class/attributes. I really want to avoid importing/replicating the "auxiliary" samba Account Information. of course I could write a bash/perl script for a "filter" ... but I dont like the idea of it - maintaining another script. since I would switch the internal OpenLDAP to a 389-LDAP perhaps there is a better way to separate these information? With kind regards Timo Ballin

1 0

Re: [389-users] Password + anything works ?
by Dan Lavu 13 Nov '12

13 Nov '12

In regards to a password policy? Just 389 or are you using winsync with AD? Because the password policy from AD does not transfer over. Also they are some extra steps if you want to setup an OU based password policy but if you just do it for the entire directory through ‘configuration’ it works with no issues. Dan *From:* Ali Jawad <ali.jawad(a)splendor.net> *Sent:* November 12, 2012 6:00 AM *To:* General discussion list for the 389 Directory server project. *Subject:* [389-users] Password + anything works ? Hi I just noticed that you can use the password+ANYLetters and it will work, I.e. if the password is xyz xyz99 or xyzABC will work as well, is this a misconfiguration on my part or a bug ? Regards * * -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

6 15

Nested group and ssh login against 389-dir
by thomas 12 Nov '12

12 Nov '12

Hello, I have an issue when I try to authenticate my openssh against 389-dir when using nested groups. If I add an user to one group only there aren't issues, but if I use nested groups it doesn't work ! This is the log I copied from 389-dir server : [12/Nov/2012:23:05:03 +0100] conn=147 fd=81 slot=81 SSL connection from 192.168.xxx.117 to 192.168.xxx.216 [12/Nov/2012:23:05:03 +0100] conn=147 SSL 256-bit AES [12/Nov/2012:23:05:03 +0100] conn=147 op=0 BIND dn="uid=binduser,cn=config" method=128 version=3 [12/Nov/2012:23:05:03 +0100] conn=147 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=binduser,cn=config" [12/Nov/2012:23:05:03 +0100] conn=147 op=1 SRCH base="dc=xxxx,dc=local" scope=2 filter="(uid=demo)" attrs=ALL [12/Nov/2012:23:05:03 +0100] conn=147 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [12/Nov/2012:23:05:03 +0100] conn=147 op=2 BIND dn="uid=demo,ou=IT_Operation,ou=Company,dc=xxxx,dc=local" method=128 version=3 [12/Nov/2012:23:05:03 +0100] conn=147 op=2 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=demo,ou=it_operation,ou=company,dc=xxxx,dc=local" [12/Nov/2012:23:05:03 +0100] conn=147 op=3 BIND dn="uid=binduser,cn=config" method=128 version=3 [12/Nov/2012:23:05:03 +0100] conn=147 op=3 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=binduser,cn=config" [12/Nov/2012:23:05:03 +0100] conn=147 op=4 CMP dn="cn=lin17_access,ou=production,ou=hosts,dc=xxxx,dc=local" attr="uniquemember" [12/Nov/2012:23:05:03 +0100] conn=147 op=4 RESULT err=16 tag=111 nentries=0 etime=0 [12/Nov/2012:23:05:05 +0100] conn=147 op=5 UNBIND This is my /etc/ldap.conf : host 389-svr01.xxxx.local 389-svr02.xxxx.local port 636 base dc=xxxx,dc=local pam_password md5 ssl yes tls_cacertdir /etc/openldap/cacerts tls_checkpeer no bind_policy soft bind_timelimit 15 timelimit 15 pam_groupdn cn=lin17_access,ou=production,ou=hosts,dc=xxxx,dc=local ldap_version 3 binddn uid=binduser,cn=config bindpw yyyy Can you help me please ? My desire is to create groups where only some people can log on certain servers. Regards .

1 0

Password + anything works ?
by Ali Jawad 12 Nov '12

12 Nov '12

Hi I just noticed that you can use the password+ANYLetters and it will work, I.e. if the password is xyz xyz99 or xyzABC will work as well, is this a misconfiguration on my part or a bug ? Regards * *

1 0

Sync with AD
by Andreas Kekkou 09 Nov '12

09 Nov '12

Hi all, I'm currently running CentOS DS 8.1(CDS) in multi-master mode with two servers. Recently I've decided to sync with Active Directory. 389 Password Sync utility has been installed on all Windows Domain Controllers and it is configured to communicate with the same CDS server. Sync is working, and password changes are sent from Windows to CDS. Any password change in the LDAP environment is sync between the two CDS, but is only sent to the Windows if the change is performed on the CDS with the Windows Sync Agreement. Also in the error log I get the following errors: [09/Nov/2012:08:13:49 +0200] - add value "20120228131234.0Z" to attribute type "dscorepropagationdata" in entry "CN=..." failed: duplicate new value [09/Nov/2012:10:38:50 +0200] - add value "20120228131028.0Z" to attribute type "dscorepropagationdata" in entry "CN=..." failed: duplicate new value [09/Nov/2012:10:38:53 +0200] - add value "20120228131028.0Z" to attribute type "dscorepropagationdata" in entry "CN=..." failed: duplicate new value [09/Nov/2012:11:43:53 +0200] - add value "20120228131234.0Z" to attribute type "dscorepropagationdata" in entry "CN=..." failed: duplicate new value [09/Nov/2012:12:48:53 +0200] - add value "20120228131028.0Z" to attribute type "dscorepropagationdata" in entry "CN=..." failed: duplicate new value [09/Nov/2012:12:48:53 +0200] - add value "20120228131028.0Z" to attribute type "dscorepropagationdata" in entry "CN=..." failed: duplicate new value [09/Nov/2012:13:08:53 +0200] - add value "20120228131028.0Z" to attribute type "dscorepropagationdata" in entry "CN=..." failed: duplicate new value [09/Nov/2012:13:08:53 +0200] - add value "20120228131028.0Z" to attribute type "dscorepropagationdata" in entry "CN=..." failed: duplicate new value The dots after CN represent actual users. Any idea how this can be resolved? Andreas

2 1

Re: [389-users] samba+ldap
by Dan Lavu 09 Nov '12

09 Nov '12

I also found the samba/ldap docs lacking, when I first tried to setup this up. Then I turned around and configured Kerberos/AD with samba and used Kerberos auth for my Linux machines. Now that I’ve done quite a few 389 implementations and going through that doc again, it’s makes sense to me. What part are you having trouble with? Dan *From:* upen <upendra.gandhi(a)gmail.com> *Sent:* November 8, 2012 5:33 PM *To:* General discussion list for the 389 Directory server project. *Subject:* [389-users] samba+ldap Hello, I am trying to setup Samba with existing 389-ds on the same server. Following http://directory.fedoraproject.org/wiki/Howto:Samba didn't help. Does anyone know if there is any other useful updated document for this purpose? Thanks. -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

2 4

samba+ldap
by upen 09 Nov '12

09 Nov '12

Hello, I am trying to setup Samba with existing 389-ds on the same server. Following http://directory.fedoraproject.org/wiki/Howto:Samba didn't help. Does anyone know if there is any other useful updated document for this purpose? Thanks.

2 1

Re: [389-users] 389-users Digest, Vol 90, Issue 3
by albert.solaris 08 Nov '12

08 Nov '12

On 11/06/2012 07:00 AM, 389-users-request(a)lists.fedoraproject.org wrote: > Send 389-users mailing list submissions to > 389-users(a)lists.fedoraproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://admin.fedoraproject.org/mailman/listinfo/389-users > or, via email, send a message with subject or body 'help' to > 389-users-request(a)lists.fedoraproject.org > > You can reach the person managing the list at > 389-users-owner(a)lists.fedoraproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of 389-users digest..." > > > Today's Topics: > > 1. Re: 389-users Digest, Vol 90, Issue 2 (albert.solaris) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 05 Nov 2012 12:05:13 -0500 > From: "albert.solaris" <albert.solaris(a)gmail.com> > To: 389-users(a)lists.fedoraproject.org > Subject: Re: [389-users] 389-users Digest, Vol 90, Issue 2 > Message-ID: <5097F1C9.4070009(a)gmail.com> > Content-Type: text/plain; charset=UTF-8; format=flowed > > On 11/02/2012 08:00 AM, 389-users-request(a)lists.fedoraproject.org wrote: >> Send 389-users mailing list submissions to >> 389-users(a)lists.fedoraproject.org >> >> To subscribe or unsubscribe via the World Wide Web, visit >> https://admin.fedoraproject.org/mailman/listinfo/389-users >> or, via email, send a message with subject or body 'help' to >> 389-users-request(a)lists.fedoraproject.org >> >> You can reach the person managing the list at >> 389-users-owner(a)lists.fedoraproject.org >> >> When replying, please edit your Subject line so it is more specific >> than "Re: Contents of 389-users digest..." >> >> >> Today's Topics: >> >> 1. LDAP authentication related - CANNOT change password by >> running passwd on clients (albert.solaris) >> 2. Re: LDAP authentication related - CANNOT change password by >> running passwd on clients (Dan Lavu) >> 3. Re: LDAP authentication related - CANNOT change password by >> running passwd on clients (Grzegorz Dwornicki) >> >> >> ---------------------------------------------------------------------- >> >> Message: 1 >> Date: Thu, 01 Nov 2012 16:02:39 -0400 >> From: "albert.solaris" <albert.solaris(a)gmail.com> >> To: 389 Mail list <389-users(a)lists.fedoraproject.org> >> Subject: [389-users] LDAP authentication related - CANNOT change >> password by running passwd on clients >> Message-ID: <5092D55F.8020001(a)gmail.com> >> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" >> >> I am stuck in the 389 DS implementation, hope someone could help me out. >> >> My situation is that I am trying to establish a cute enterprise >> environment with VMWorkstation and CentOS. All guest OSs are CentOS6.3 >> based. So far I have got DNS, DHCP, Gateway, File server worked >> perfectly; However, the 389 LDAP server here, Hmm... I would say it is >> partially working. And this is also where you come in. >> >> What does it mean by 'partially working' exactly? Let me tell you. >> >> What happened here is that I've installed and configured 389 DS without >> SSL/TLS enable, migrated local users on my file server to the LDAP >> already. Now, from my DHCP clients, also LDAP clients, I can retrieve >> information within the LDAP server by running ldapsearch, I can even >> change to regular users (i.e. user1/user2/.../user10 created on the file >> server) with Autofs home directory mounted automatically. Somehow, I >> cannot change password by running passwd command. >> >> Here is what I got when changing. >> [root@dhcpclient sssd]# /su - user1/ >> [user1@dhcpclient ~]$ >> [user1@dhcpclient ~]$ /passwd/ >> Changing password for user user1. >> Current Password: >> passwd: Authentication token manipulation error >> [user1@dhcpclient ~]$ >> >> I am new to Linux, so have no idea about the reason behind that. Is it >> a LDAP acl issue, or sssd configuration issue, or security pam issue, or >> whatever else. >> >> If you could help me out, that would be great. Please let me know if >> you want any configuration files from me. I don't want to attach >> everything here to scare you. >>

1 0

Is there any paramter to configure replication retry time in case of fail over
by Divya Ravikumar 08 Nov '12

08 Nov '12

Hi all, I have a redundant multi-master setup in which master A and master B are both primary and redundant to each other. When B goes down A tries to reconnect to B for replication. This replication retry time increases with the number of attempts it tries to retry. Is there any way to control this retry time? Regards, Divya.R

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2012