389-users July 2012

389-users@lists.fedoraproject.org

39 participants
40 discussions

How to export CA certificate into client from server
by Fosiul alam 27 Jul '12

27 Jul '12

HI i have installed ssl certificate from bellow script https://github.com/richm/scripts/blob/master/setupssl2.sh it went fine. but I dont understand, how will i create Certificate file for the clients. according to documentation : http://directory.fedoraproject.org/wiki/Howto:SSL#Configure_LDAP_clients i need to expoert CA cert from ASCII which is cacert.asc , but dont understand how will i do that I have cacert.asc in /etc/dirsrv/slapd-instance directory but dont know how to export cert file into client /etc/openldap/cacerts/ I am trying this from last couple of day. can any one please help me .

2 1

please re-review bug id 588480
by Paul Robert Marino 24 Jul '12

24 Jul '12

I figured out how to reproduce the bug in https://bugzilla.redhat.com/show_bug.cgi?id=588480 Please re-review it it was closed as "works for me" but i found there was a vital piece of information missing to reproduce it I have just been able to reproduce it on RHEL 6.3 I've added the details on how to reproduce it to the ticket

1 0

dse.ldif errors with a reboot
by Ryan Palamara 23 Jul '12

23 Jul '12

I am having problems where I need to restore the dse.ldif everytime I reboot the server. Has anyone seen issues like this before and have any recommendations for where to start troubleshooting it? Thank you, Ryan Palamara ZAIS Group, LLC 2 Bridge Avenue, Suite 322 Red Bank, New Jersey 07701 Phone: (732) 450-7444 Ryan.palamara(a)zaisgroup.com<mailto:Ryan.palamara@zaisgroup.com> ________________________________ This e-mail message is intended only for the named recipient(s) above. It may contain confidential information. If you are not the intended recipient you are hereby notified that any dissemination, distribution or copying of this e-mail and any attachment(s) is strictly prohibited. If you have received this e-mail in error, please immediately notify the sender by replying to this e-mail and delete the message and any attachment(s) from your system. Thank you. This is not an offer (or solicitation of an offer) to buy/sell the securities/instruments mentioned or an official confirmation. This is not research and is not from ZAIS Group but it may refer to a research analyst/research report. Unless indicated, these views are the author's and may differ from those of ZAIS Group research or others in the Firm. We do not represent this is accurate or complete and we may not update this. Past performance is not indicative of future returns. IRS CIRCULAR 230 NOTICE:. To comply with requirements imposed by the IRS, we inform you that any U.S. federal tax advice contained herein (including any attachments), unless specifically stated otherwise, is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending any transaction or matter addressed herein to another party. Each taxpayer should seek advice based on the taxpayer's particular circumstances from an independent tax advisor. "ZAIS", "ZAIS Group" and "ZAIS Solutions" are trademarks of ZAIS Group, LLC.

3 6

Import Apple Open Directory Schema
by Bradly Swart 23 Jul '12

23 Jul '12

Hi List, I've just been put on a project requiring the migration of a clients Apple Open Directory setup to a virtualized Linux RedHat environment running 389 Directory Server. I have no prior LDAP experience, so this has been quite an adventure so far! In order to get this going I have copied the apple schema files, converted to ldif and put them into the /etc/dirsrv/slapd-ldap/schema All good! Now when I try and start the directory server up I get the following errors; [23/Jul/2012:14:35:32 +1000] - Entry "cn={6}apple" has unknown object class "olcSchemaConfig" [23/Jul/2012:14:35:32 +1000] - Entry "cn={5}apple_auxillary" has unknown object class "olcSchemaConfig" [23/Jul/2012:14:35:32 +1000] - Entry "cn={0}core" has unknown object class "olcSchemaConfig" [23/Jul/2012:14:35:32 +1000] - Entry "cn={1}cosine" has unknown object class "olcSchemaConfig" [23/Jul/2012:14:35:32 +1000] - Entry "cn={2}inetorgperson" has unknown object class "olcSchemaConfig" [23/Jul/2012:14:35:32 +1000] - Entry "cn={3}nis" has unknown object class "olcSchemaConfig" [23/Jul/2012:14:35:32 +1000] - Entry "cn={4}samba" has unknown object class "olcSchemaConfig" [23/Jul/2012:14:35:32 +1000] createprlistensockets - PR_Bind() on All Interfaces port 389 failed: Netscape Portable Runtime error -5966 (Access Denied.) Obviously it cannot find the object class definition / description, atlhough I'm not sure why, and have no idea where that should be. According to the blog posts and tutorials I have found they say to just copy the schema files in the relevant format and restart the server, none of them have come across this error. Something along the lines of this blog post: http://www.backupcentral.com/mr-backup-blog-mainmenu-47/13-mr-backup-blog/3… Hope someone can point me in the right direction with this one! 389-NOOB -- Bradly Swart Mobile: +61 44 706 8963 Skype: bradly.swart Twitter: @brad8711

3 2

ldclt derefAliases: derefAlways
by Alexey.I.Larin＠gmail.com 23 Jul '12

23 Jul '12

Hello, How can I set option derefAlways for aliases using ldclt utility? I sow "deref=[deref:attr]" but I did not catch how to use it. Alexey Larin

2 1

Re: [389-users] Stumped - SSL works for auth, sudo, etc, but fails for ldap user cronjobs
by Carsten Grzemba 20 Jul '12

20 Jul '12

Hi, what kind of certificate do you use, selfsigned? Are the certificates signed by the same CA? Am 18.07.12, schrieb David Nguyen <d_k_nguyen(a)yahoo.com>: > Hi all, > > I have a strange one. My current setup is working perfectly. client1 > is able to connect to ldap-server1 via SSL and everything is working > correctly. I then had a need to add another ldap server (ldap-server2) > as a multi-master replica and everything is working (user auth, sudo > via ldap users, ldapsearch, openssl, etc) except cronjobs for users > served out of ldap fail to run. > > I can see this in the error log on ldap-server2: > > [18/Jul/2012:11:18:00 -0700] - PR_Recv for connection 467 returns > -12195 (Peer does not recognize and trust the CA that issued your > certificate.) > > If I set /etc/ldap.conf to not use SSL (URI ldap://fqdn vs URI > ldaps://fqdn:636), the cronjobs fire just fine. > > So it appears as though there is an SSL cert issue, but I'm stumped > because all of the other services that use ldap on client1 work except > cron jobs (root cron fires fine as expected since nsswitch is set to > files then ldap). > > If I replace the URI string in /etc/ldap.conf to point at > ldap-server1, cron starts working. > > Both ldap-server1 and ldap-server2 are using running the same OS and > kernel version (RHEL5) as well as the same version of 389 DS > (389-ds-1.2.1-1.el5). > > Any ideas as to what could be causing this problem? Here is the > /etc/ldap.conf on client1 if it matters: > > ====== begin /etc/ldap.conf ======= > URI ldaps://ops-ldap006.svale.netledger.com:636 > base dc=netsuite,dc=com > > timelimit 10 > bind_policy soft > nss_reconnect_tries 3 > bind_timelimit 6 > idle_timelimit 30 > sudoers_base ou=SUDOers,dc=netsuite,dc=com > sudoers_debug 0 > > ##ssl start_tls > TLS_CACERT /etc/openldap/cacerts/ca.crt > TLS_CACERTFILE /etc/openldap/cacerts/ca.crt > TLS_REQCERT demand > pam_lookup_policy yes > pam_password exop > > nss_initgroups_ignoreusers root,named,avahi,haldaemon,dbus,gdm,postfix,puppet > > ====== end /etc/ldap.conf ======= > > > > > Thanks in advance, > David > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users > -- Carsten Grzemba

2 2

Keep the schema or change it?
by Gary Algier 19 Jul '12

19 Jul '12

Hi, I am in the process of migrating from Sun's DS 5.2 to DS 389 and I have compared the schemata. I see some differences and I wonder as to the best way to handle them. In general is it better to change the 389 schema and then always have to "fix" it with each new release or change my Sun clients somehow (this seems to border on the philosophical)? As an example, there is the Automount schema. On Sun's systems, they expect something schema like this: objectClasses: ( 1.3.6.1.1.1.2.17 NAME 'automount' MUST ( automountKey $ automountInformation ) MAY description ...) with the 389 schema looking like this: objectclasses: ( 1.3.6.1.1.1.2.17 NAME 'automount' MUST ( cn $ automountInformation ) MAY description ...) In other words, the lookup key matched against the user's login for home directories would be "automountKey" for Sun, and "cn" for 389. I notice that my Linux clients work fine with a Sun DS so they seem to be using "automountKey". (Or are they looking for either?). I also see differences in the objectClass automountMap. Linux does not seem to work with a Sun-style autmountMap. If I just dump my Sun DS and load it into the 389 DS do I want to overwrite the schema? Should I only load the non-conflicting entries? If the 389 schema is the "right" schema, will Linux stop working some day when they conform? Is there a way to have both? I have about 500 mixed Sun and Linux clients and I want to minimize the reconfiguration on the day that I switch DS. -- Gary Algier, WB2FWZ gaa at ulticom.com +1 856 787 2758 Ulticom Inc., 1020 Briggs Rd, Mt. Laurel, NJ 08054 Fax:+1 856 866 2033 Nielsen's First Law of Computer Manuals: People don't read documentation voluntarily.

2 1

Stumped - SSL works for auth, sudo, etc, but fails for ldap user cronjobs
by David Nguyen 18 Jul '12

18 Jul '12

Hi all, I have a strange one. My current setup is working perfectly. client1 is able to connect to ldap-server1 via SSL and everything is working correctly. I then had a need to add another ldap server (ldap-server2) as a multi-master replica and everything is working (user auth, sudo via ldap users, ldapsearch, openssl, etc) except cronjobs for users served out of ldap fail to run. I can see this in the error log on ldap-server2: [18/Jul/2012:11:18:00 -0700] - PR_Recv for connection 467 returns -12195 (Peer does not recognize and trust the CA that issued your certificate.) If I set /etc/ldap.conf to not use SSL (URI ldap://fqdn vs URI ldaps://fqdn:636), the cronjobs fire just fine. So it appears as though there is an SSL cert issue, but I'm stumped because all of the other services that use ldap on client1 work except cron jobs (root cron fires fine as expected since nsswitch is set to files then ldap). If I replace the URI string in /etc/ldap.conf to point at ldap-server1, cron starts working. Both ldap-server1 and ldap-server2 are using running the same OS and kernel version (RHEL5) as well as the same version of 389 DS (389-ds-1.2.1-1.el5). Any ideas as to what could be causing this problem? Here is the /etc/ldap.conf on client1 if it matters: ====== begin /etc/ldap.conf ======= URI ldaps://ops-ldap006.svale.netledger.com:636 base dc=netsuite,dc=com timelimit 10 bind_policy soft nss_reconnect_tries 3 bind_timelimit 6 idle_timelimit 30 sudoers_base ou=SUDOers,dc=netsuite,dc=com sudoers_debug 0 ##ssl start_tls TLS_CACERT /etc/openldap/cacerts/ca.crt TLS_CACERTFILE /etc/openldap/cacerts/ca.crt TLS_REQCERT demand pam_lookup_policy yes pam_password exop nss_initgroups_ignoreusers root,named,avahi,haldaemon,dbus,gdm,postfix,puppet ====== end /etc/ldap.conf ======= Thanks in advance, David

1 0

Ldap authentication to multiple samba servers
by David Hoskinson 18 Jul '12

18 Jul '12

We are using 389 directory server authentication for our single samba server. We would like to add additional samba servers to the mix while still using the single ldap server. Is this possible. I know I had to make a administrative connection between the samba server and the ldap server when I originally set it up and it created a "domain" or samba object, I am not sure what the proper term is. I am guessing that under the directory tab, under my domain I will see an object for each machine. Is this correct? Thanks for the help. David Hoskinson | DATATRAK Systems Engineer Mayfield Heights, Ohio, USA +1.440.443.0082 x 124 (p) | +1.319.471.3689 (m) david.hoskinson(a)datatrak.net<mailto:david.hoskinson@datatrak.net> | www.datatrak.net<http://www.datatrak.net/>

1 0

Deactivating accounts
by harry.devine＠faa.gov 18 Jul '12

18 Jul '12

We have several users who no longer need access, but may in the future, so we have set them to be Inactive in their profile. However, we noticed that these accounts have re-activated themselves and those users could log back in if they wanted to. How do we make accounts that we specifically make inactive by pressing the Inactivate button stay that way? We are using the following 389 versions on CentOS 5.7 64-bit: 389-ds-base-1.2.9.9-1.el5 389-admin-1.1.29-1.el5 389-ds-console-1.2.6-1.el5 389-adminutil-1.1.15-1.el5 389-admin-console-1.1.8-1.el5 389-ds-console-doc-1.2.6-1.el5 389-ds-base-libs-1.2.9.9-1.el5 389-dsgw-1.1.9-1.el5 389-console-1.1.7-3.el5 389-admin-console-doc-1.1.8-1.el5 389-ds-1.2.1-1.el5 Thanks for any help! Harry

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users July 2012