389-users December 2013

389-users@lists.fedoraproject.org

17 participants
33 discussions

"Re:Binding Directory Manager as default Bind when using SSL/TLS certificate (please help)"
by Fosiul alam 30 Dec '13

30 Dec '13

Hi Thanks for reply. Anonymous bind looks on to me from dse.ldif nsslapd-allow-anonymous-access: on Bellow is the result : I get result with this :------ /usr/bin/ldapsearch -xZZ -D 'cn=Directory Manager' -w 'xxxx' -b 'dc=fosiul,dc=lan' But No result with :----- ------------------------------- /usr/bin/ldapsearch -xZZ -D 'cn=Directory Manager' -b 'dc=fosiul,dc=lan' example : [root@test ~]# /usr/bin/ldapsearch -xZZ -D 'cn=Directory Manager' -b 'dc=fosiul,dc=lan' # extended LDIF # # LDAPv3 # base <dc=fosiul,dc=lan> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 3 result: 0 Success # numResponses: 1 Kind Regards

2 1

Binding Directory Manager as default Bind when using SSL/TLS certificate (please help)
by Fosiul alam 30 Dec '13

30 Dec '13

Hi All, I refer to my this question https://lists.fedoraproject.org/pipermail/389-users/2013-December/016572.ht… I have setup fedora 389 Directory server to use SSL/TLS and i can perfom search by using /usr/bin/ldapsearch -xZZ -D 'cn=Directory Manager' -w 'xxxxx' -b 'dc=fosiul,dc=lan' but when I am trying with this /usr/bin/ldapsearch -xZZ -b 'dc=fosiul,dc=lan' it does not return any thing. which means, I need to bind cn=Directory Manager with default ldapsearch , when i am searching by ssl/tls the default bindDirectory should be cn=Directory Manager but dont understand, which option do i need edit in dse.ldif for this. Can any one please pleaes help me , I am just stuck on this now . Many many thanks for this

2 1

Re: [389-users] ldap authenticaion is not getting correct information (SSL/TLS) (all files, logs included- please give me light on this)
by Fosiul alam 29 Dec '13

29 Dec '13

Hi Thanks for the quick Reply. I was thinking that same that some where its missing the Bind dn and I can conferm that, its working with definning binddn and bindpw in ldap.conf but , I confiered this before and I never had to define binddn and bindpw in any where in ldap.conf and as you said that for production its not appropriate. which mean, something i have missed while configuring direcotory server, I guess, I will have to tell Directory server to bind annonomouse search with cn=Directory Manager or something like this. but currnelty its not cliking on my head. Any further help will really appreciate. Kind Regards

2 1

Re: [389-users] ldap authenticaion is not getting correct information (SSL/TLS) (all files, logs included- please give me light on this)
by Fosiul alam 29 Dec '13

29 Dec '13

1 0

ldap authenticaion is not getting correct information (SSL/TLS) (all files, logs included- please give me light on this)
by Fosiul alam 29 Dec '13

29 Dec '13

Hi, I need some help urgnelty.. as no idea why its acting funy. as far I belive, I have setup ldap server properly in test environment, but actiting wired.. no idea why ... example [root@test ~]# id tuser id: tuser: No such user bellow command shows the correct info : [root@test ~]# /usr/bin/ldapsearch -xZZ -D 'cn=Directory Manager' -w 'xxxxx' -b 'dc=fosiul,dc=lan' # extended LDIF # # LDAPv3 # base <dc=fosiul,dc=lan> with scope subtree # filter: (objectclass=*) # requesting: ALL # # fosiul.lan dn: dc=fosiul,dc=lan dc: fosiul objectClass: domain objectClass: top # uk, fosiul.lan dn: l=uk,dc=fosiul,dc=lan l: uk objectClass: locality objectClass: top # groups, uk, fosiul.lan dn: ou=groups,l=uk,dc=fosiul,dc=lan ou: groups objectClass: organizationalUnit objectClass: top # users, uk, fosiul.lan dn: ou=users,l=uk,dc=fosiul,dc=lan ou: users objectClass: organizationalUnit objectClass: top # IT, groups, uk, fosiul.lan dn: cn=IT,ou=groups,l=uk,dc=fosiul,dc=lan gidNumber: 3001 objectClass: posixGroup objectClass: top uniqueMember: uid=fosiula,ou=users,l=uk,dc=fosiul,dc=lan cn: IT # tuser, users, uk, fosiul.lan dn: uid=tuser,ou=users,l=uk,dc=fosiul,dc=lan givenName: Tuser sn: User uidNumber: 2001 gidNumber: 3001 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetorgperson objectClass: posixAccount cn: test User homeDirectory: /home/tuser userPassword:: e1NTSEF9cGlZclc1NjBaOXdtSGxkdVVKcGJ3TUhHZjN4eG55a2lUQUxhSVE9PQ= = uid: tuser # search result search: 3 result: 0 Success # numResponses: 7 # numEntries: 6 My : /etc/ldap.conf ------------------------------------ [root@test ~]# cat /etc/ldap.conf # @(#)$Id: ldap.conf,v 1.38 2006/05/15 08:13:31 lukeh Exp $ # # This config is managed by puppet, all changes will be reverted base dc=fosiul,dc=lan bind_policy soft # Search timelimit #timelimit 30 timelimit 1 # Bind/connect timelimit #bind_timelimit 30 bind_timelimit 1 #idle_timelimit 3600 idle_timelimit 1 bind_timeout 1 nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon uri ldap://puppet-1.fosiul.lan ssl start_tls tls_cacertfile /etc/openldap/cacerts/CRT.crt pam_password md5 pam_groupdn cn=IT,ou=groups,l=uk,dc=fosiul,dc=lan pam_member_attribute uniqueMember tls_cacertdir /etc/openldap/cacerts my /etc/openldap/ldap.conf : ------------------------------------ # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never URI ldap://puppet-1.fosiul.lan/ BASE dc=fosiul,dc=lan TLS_CACERTDIR /etc/openldap/cacerts tls_cacertfile /etc/openldap/cacerts/CRT.crt The Log From ldap server for bellow command --------------------------------------------------------------------- [root@test ~]# id tuser id: tuser: No such user [root@test ~]# [29/Dec/2013:14:49:14 +0000] conn=111 op=3 UNBIND [29/Dec/2013:14:49:14 +0000] conn=111 op=3 fd=76 closed - U1 [29/Dec/2013:14:49:14 +0000] conn=115 fd=76 slot=76 connection from 192.168.0.40 to 192.168.0.35 [29/Dec/2013:14:49:14 +0000] conn=115 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [29/Dec/2013:14:49:14 +0000] conn=115 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [29/Dec/2013:14:49:14 +0000] conn=115 SSL 256-bit AES [29/Dec/2013:14:49:14 +0000] conn=115 op=1 BIND dn="" method=128 version=3 [29/Dec/2013:14:49:14 +0000] conn=115 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [29/Dec/2013:14:49:14 +0000] conn=115 op=2 SRCH base="dc=fosiul,dc=lan" scope=2 filter="(&(objectClass=posixAccount)(uid=tuser))" attrs="uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass" [29/Dec/2013:14:49:14 +0000] conn=115 op=2 RESULT err=0 tag=101 nentries=0 etime=0

2 1

Can any one pleaese help me to install this patch ?? (Urgent Request)
by Fosiul alam 28 Dec '13

28 Dec '13

Hi I am using bellow version of rpm idm-console-framework-1.1.7-2.el6.noarch and I need to generate 2048 bit CSR via 389 console. Bellow link is showing a patch, but dont understand how to install it. https://fedorahosted.org/389/ticket/362 Can any one please show me some light on this ?? Thanks

2 1

How to create CA into PEM format
by Fosiul alam 27 Dec '13

27 Dec '13

Hi, I have created the certificate by using "https://raw.github.com/richm/scripts/master/setupssl2.sh" and it working fine, But I need to get the CA certificate in pem format which will have to in /etc/openldap/cacertificate directory as I get this when trying to setup ldap authentiation To connect to a LDAP server with TLS │ │ protocol enabled you need a CA certificate │ │ which signed your server's certificate. │ │ Copy the certificate in the PEM format to │ │ the '/etc/openldap/cacerts' directory. │ │ Then press OK. Can any one pleaese tel me, how will i get the certificate ?? Please advise.

2 1

Re: [389-users] How to Allow UniqueMember to add under PosiGroup (UniqueueMemberof Plugins)
by Fosiul alam 25 Dec '13

25 Dec '13

Extra info : While looking at net I got this http://directory.fedoraproject.org/wiki?title=MemberOf_Multiple_Grouping_En… dn: cn=MemberOf Plugin,cn=plugins,cn=config ... memberofgroupattr: member memberofgroupattr: uniqueMember memberofattr: memberOf But still it does not allow to add uniqueMember under posixgroup . I was looking at "Uniquegropunames" which allow uniquemember but it does not allow gidNumber. Bascially I want to have a group which will have gidnumber also will be able to add UniqueMember in their So a Group : TestGroup it will have attributes like uid=testuser,ou=Users,dc=testdomain,dc=lan gidNumber=3001 How Can i achive this ?? I know it can be done.. but dont understand how please help me out here.

1 0

How to Allow UniqueMember to add under PosiGroup (UniqueueMemberof Plugins)
by Fosiul alam 25 Dec '13

25 Dec '13

Hi, I have installed this test ldap and I am trying to add UniqueMember under a PosixGroup but its saying, i am not allowed bellow is error: "according to the schema attribute uniqueMember is not allowed" I guess, I need to add UniqueueMemberof plugins, But dont understande the Syntax. Can any one please help me with the syntax. Kind Regards

1 0

Re: [389-users] 389-users Digest, Vol 103, Issue 15
by Fosiul alam 24 Dec '13

24 Dec '13

Hi Thanks, yes, it works fine now I had to stop the script before it was asking the password then turn on ssl from Gui interface this tricks works for me Thanks On 24 December 2013 12:00, <389-users-request(a)lists.fedoraproject.org> wrote: > Send 389-users mailing list submissions to > 389-users(a)lists.fedoraproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://admin.fedoraproject.org/mailman/listinfo/389-users > or, via email, send a message with subject or body 'help' to > 389-users-request(a)lists.fedoraproject.org > > You can reach the person managing the list at > 389-users-owner(a)lists.fedoraproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of 389-users digest..." > > > Today's Topics: > > 1. Unable to open 389 Console after running setupssl2.sh > (fosiul alam) > 2. Re: Unable to open 389 Console after running setupssl2.sh > (Predrag Zecevic [Unix Systems Administrator]) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 24 Dec 2013 09:23:19 +0000 > From: fosiul alam <expertalert(a)gmail.com> > To: 389-users(a)lists.fedoraproject.org > Subject: [389-users] Unable to open 389 Console after running > setupssl2.sh > Message-ID: > <CAOf__1PuVTb2JyL8thcpm8-eQwWJtqR8aakBETWRP3c5o5CF_A(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi > I would really appreciated if any one can help me out here. > > I have installed fedora directory server > > 389-dsgw-1.1.10-1.el6.x86_64 > 389-ds-base-1.2.9.14-1.el6.x86_64 > 389-ds-console-doc-1.2.6-1.el6.noarch > 389-ds-base-libs-1.2.9.14-1.el6.x86_64 > 389-ds-console-1.2.6-1.el6.noarch > 389-ds-1.2.2-1.el6.noarch > > the problem: > as soon as i ran bellow script, its executes fine witout any issues. > https://github.com/richm/scripts/blob/master/setupssl2.sh > > dirsrv-admin, dirsrv is running, > but i cant connect to console > > > I am trying with > > username : admin/cn=Directory Manager > http://ldapserver:9830 > > also https://ldapserver:9830 > > but no luck > > Dont understand why its failling to open 389. > > Thanks for your help. > > > ------------------------------ > > Message: 2 > Date: Tue, 24 Dec 2013 11:31:47 +0100 > From: "Predrag Zecevic [Unix Systems Administrator]" > <predrag.zecevic(a)2e-systems.com> > To: "General discussion list for the 389 Directory server project." > <389-users(a)lists.fedoraproject.org> > Subject: Re: [389-users] Unable to open 389 Console after running > setupssl2.sh > Message-ID: <52B96293.8090205(a)2e-systems.com> > Content-Type: text/plain; charset=UTF-8; format=flowed > > Hi, > > maybe you have started (only) secure ldap port (TCP 636) **before** your > console was configured to use it? > > Can you verify (look into logs, /var/log/dirsrv/slapd-NAME/access and > /var/log/dirsrv/admin-serv/{error,access}) that you ldap server is using > both unsecure and secure connection? > > You cannot use port 389 if it was disabled ("nsslapd-port: 0" in output > below): > $ sudo grep -E "nsslapd-port|nsslapd-secureport" > /etc/dirsrv/slapd-NAME/dse.ldif > nsslapd-port: 0 > nsslapd-secureport: 636 > > > Regards. > > On 12/24/13 10:23 AM, fosiul alam wrote: >> Hi >> I would really appreciated if any one can help me out here. >> >> I have installed fedora directory server >> >> 389-dsgw-1.1.10-1.el6.x86_64 >> 389-ds-base-1.2.9.14-1.el6.x86_64 >> 389-ds-console-doc-1.2.6-1.el6.noarch >> 389-ds-base-libs-1.2.9.14-1.el6.x86_64 >> 389-ds-console-1.2.6-1.el6.noarch >> 389-ds-1.2.2-1.el6.noarch >> >> the problem: >> as soon as i ran bellow script, its executes fine witout any issues. >> https://github.com/richm/scripts/blob/master/setupssl2.sh >> >> dirsrv-admin, dirsrv is running, >> but i cant connect to console >> >> >> I am trying with >> >> username : admin/cn=Directory Manager >> http://ldapserver:9830 >> >> also https://ldapserver:9830 >> >> but no luck >> >> Dont understand why its failling to open 389. >> >> Thanks for your help. >> -- >> 389 users mailing list >> 389-users(a)lists.fedoraproject.org >> https://admin.fedoraproject.org/mailman/listinfo/389-users >> > > -- > Predrag Zečević, Technical Support Analyst, 2e Systems GmbH > > Telephone: +49 6196 9505 815, Facsimile: +49 6196 9505 894 > Mobile: +49 174 3109 288, Skype: predrag.zecevic > E-mail: predrag.zecevic(a)2e-systems.com > > Headquarter: 2e Systems GmbH, Königsteiner Str. 87, > 65812 Bad Soden am Taunus, Germany > Company registration: Amtsgericht Königstein (Germany), HRB 7303 > Managing director: Phil Douglas > > http://www.2e-systems.com/ - Making your business fly! > > [***]===--- > I want EARS! I want two ROUND BLACK EARS to make me feel warm 'n secure!! > > > ------------------------------ > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users > > End of 389-users Digest, Vol 103, Issue 15 > ******************************************

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users December 2013