389-users March 2014

389-users@lists.fedoraproject.org

38 participants
42 discussions

DS 1.3.2.14 on Sparc: Authentication method not supported
by Carsten Grzemba 12 Mar '14

12 Mar '14

some tests later I stumble in this problem: [14/03/12:10:03:41] - [Setup] Info Could not authenticate as user 'uid=admin,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot' to server 'ldap://testcsw.contac.lan:389/o=NetscapeRoot'. Error: Authentication method not supported [14/03/12:10:03:41] - [Setup] Fatal Could not register the directory server with the configuration directory server. I found in the mail archive a similar thread for PPC: [389-users] Authentication method not supported (https://lists.fedoraproject.org/pipermail/389-users/2013-July/016073.html) was there a solution found or a ticket created? THX

2 1

Re: [389-users] problem on Sparc with DS 1.3.2: Skipping entry ... which has no parent
by Carsten Grzemba 12 Mar '14

12 Mar '14

Am 11.03.14 schrieb Rich Megginson <rmeggins(a)redhat.com>: > > > > > > On 03/11/2014 07:32 AM, Carsten Grzemba wrote: > > > > > > > > Am 11.03.14 schrieb Rich Megginson <rmeggins(a)redhat.com> <rmeggins(a)redhat.com>: > > > > > > > > > > > > > > > > > > On 03/11/2014 05:57 AM, Carsten Grzemba wrote: > > > > > > > > > > interessting: it is only on 32bit build. 64bit build on Solaris10 Sparc works as expected. > > > > > > > > > > > > > > I'm not sure. I guess we could try to reproduce on Fedora 32-bit. > > > > > > > > > > > > > > the Solaris10 i386 build works without problems, only on Sparc. > > > > Then I suspect the slapi_counter code . . . > > > > was there anything changed since 1.2.11.15? In 1.2.11.15 works also all fine. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > 389 users mailing list > > > > 389-users(a)lists.fedoraproject.org > > > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > 389 users mailing list > > 389-users(a)lists.fedoraproject.org > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > > > >

5 6

Issues with PAM Pass Through and pam_krb5 with sssd
by Trey Dockendorf 11 Mar '14

11 Mar '14

I have one 389 DS server successfully using PAM Pass through that goes to a pam.d file that uses pam_krb5 for auth. I've setup a new system and am now unable to get the pass through to work. The second system is identical except it's updated to EL 6.5 while working system is EL 6.4. The second system that's not working is using SSSD instead of the PADL stack. When performing either ldapsearch using my account for bind, or performing SSH login to a client configured in SSSD with 389DS as the LDAP server, I get these errors in /var/log/dirsrv/slapd-ldap01/errors [11/Mar/2014:11:33:31 -0500] pam_passthru-plugin - Error from PAM during pam_authenticate (7: Authentication failure) [11/Mar/2014:11:33:31 -0500] pam_passthru-plugin - Invalid PAM password for user id [treydock], bind DN [uid=treydock,ou=people,dc=org,dc=domain,dc=edu] Then these are in /var/log/secure Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: default/local realm 'DOMAIN.EDU' Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: configured realm 'DOMAIN.EDU' Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: debug Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flags: forwardable not proxiable Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no ignore_afs Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no null_afs Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: cred_session Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: user_check Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no krb4_convert Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: krb4_convert_524 Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: krb4_use_as_req Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: will try previously set password first Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: will let libkrb5 ask questions Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no use_shmem Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no external Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: no multiple_ccaches Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: validate Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: flag: warn Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: ticket lifetime: 86400s (1d,0h,0m,0s) Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: renewable lifetime: 86400s (1d,0h,0m,0s) Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: minimum uid: 500 Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: banner: Kerberos 5 Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: ccache dir: /tmp Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: ccname template: FILE:%d/krb5cc_%U_XXXXXX Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: keytab: FILE:/etc/krb5.keytab Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: token strategy: v4,524,2b,rxk5 Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: called to authenticate 'treydock', realm 'DOMAIN.EDU' Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: error resolving user name 'treydock' to uid/gid pair Mar 11 11:33:30 ldap01 ns-slapd: pam_krb5[32169]: error getting information about 'treydock' Mar 11 11:33:30 ldap01 ns-slapd: pam_unix(ldapserver:auth): check pass; user unknown Mar 11 11:33:30 ldap01 ns-slapd: pam_unix(ldapserver:auth): authentication failure; logname= uid=99 euid=99 tty= ruser= rhost= # cat /etc/krb5.conf [libdefaults] default_realm = DOMAIN.EDU default_tkt_enctypes = aes256-cts-hmac-sha1-96 des3-hmac-sha1 default_tgs_enctypes = aes256-cts-hmac-sha1-96 des3-hmac-sha1 clockskew = 300 [realms] DOMAIN.EDU = { kdc = kerberos-3.domain.edu:88 kdc = kerberos-1.domain.edu:88 kdc = kerberos-2.domain.edu:88 admin_server = kerberos-master.domain.edu:749 default_domain = domain.edu } [domain_realm] domain.edu = DOMAIN.EDU .domain.edu = DOMAIN.EDU [appdefaults] pam = { ticket_lifetime = 1d renew_lifetime = 1d forwardable = true krb4_convert = false proxiable = false retain_after_close = false minimum_uid = 500 debug = true } # cat /etc/pam.d/ldapserver auth required pam_env.so auth sufficient pam_krb5.so use_first_pass debug auth sufficient pam_unix.so nullok try_first_pass auth required pam_deny.so account include password-auth password include password-auth session include password-auth # cat /etc/pam.d/password-auth #%PAM-1.0 # Managed by puppet - do not modify! auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_sss.so use_first_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so # cat /etc/sssd/sssd.conf # Managed by puppet - do not modify [sssd] config_file_version = 2 debug_level = 0x02F0 reconnection_retries = 3 sbus_timeout = 30 services = nss,pam,sudo domains = LDAP [nss] debug_level = 0x02F0 reconnection_retries = 3 filter_groups = root,wheel filter_users = root [pam] debug_level = 0x02F0 reconnection_retries = 3 offline_credentials_expiration = 0 [sudo] [domain/LDAP] debug_level = 0x02F0 cache_credentials = TRUE entry_cache_timeout = 6000 enumerate = TRUE id_provider = ldap auth_provider = ldap chpass_provider = ldap access_provider = ldap sudo_provider = ldap ldap_uri = ldap://ldap01.org.domain.edu ldap_search_base = dc=org,dc=domain,dc=edu ldap_network_timeout = 3 ldap_tls_reqcert = demand ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.internal.crt ldap_schema = rfc2307bis ldap_id_use_start_tls = TRUE ldap_chpass_update_last_change = TRUE ldap_group_member = uniquemember ldap_group_object_class = posixGroup ldap_group_name = cn ldap_pwd_policy = none ldap_account_expire_policy = 389ds ldap_access_order = filter,expire ldap_access_filter = (objectclass=posixaccount) ldap_sudo_search_base = ou=sudoers,dc=org,dc=domain,dc=edu PAM pass through config: # PAM Pass Through Auth, plugins, config dn: cn=PAM Pass Through Auth,cn=plugins,cn=config objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject objectClass: pamConfig cn: PAM Pass Through Auth nsslapd-pluginPath: libpam-passthru-plugin nsslapd-pluginInitfunc: pam_passthruauth_init nsslapd-pluginType: preoperation nsslapd-pluginEnabled: on nsslapd-pluginloadglobal: true nsslapd-plugin-depends-on-type: database pamMissingSuffix: ALLOW pamExcludeSuffix: cn=config pamIDMapMethod: ENTRY pamIDAttr: tamuEduPersonNetID pamFallback: TRUE pamSecure: TRUE pamService: ldapserver nsslapd-pluginId: pam_passthruauth nsslapd-pluginVersion: 1.2.11.15 nsslapd-pluginVendor: 389 Project nsslapd-pluginDescription: PAM pass through authentication plugin pamIncludeSuffix: ou=People,dc=org,dc=domain,dc=edu pamFilter: (&(objectClass=tamuPerson)(tamuEduPersonNetID=*)) tamuPerson and tamuEduPersonNetID schema additions (from /etc/dirsrv/slapd-ldap01/schema/99user.ldif): objectclasses: ( 1.3.6.1.4.1.4391.1.0 NAME 'tamuPerson' DESC '' SUP top STRUCTURAL MAY tamuEduPersonNetID X-ORIGIN 'user defined' ) attributetypes: ( 1.3.6.1.4.1.4391.0.13 NAME 'tamuEduPersonNetID' DESC 'NetID (login username)' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE X-ORIGIN 'user defined' ) My account: # treydock, People, org.domain.edu dn: uid=treydock,ou=People,dc=org,dc=domain,dc=edu uid: treydock gidNumber: 999 mail: treydock(a)domain.edu sn: Dockendorf cn: Trey Dockendorf givenName: Trey tamuEduPersonNetID: treydock loginShell: /bin/bash homeDirectory: /home/treydock objectClass: inetOrgPerson objectClass: inetuser objectClass: organizationalPerson objectClass: person objectClass: posixAccount objectClass: tamuPerson objectClass: top uidNumber: 1380 Thanks - Trey

1 1

Non-contiguous attribute values
by Timothy Pollard 11 Mar '14

11 Mar '14

Hi, We received this strange error a few hours ago for one of our DNS entries: [10/Mar/2014:15:56:01 +0000] - str2entry_fast: Error. Non-contiguous attribute values for tXTRecord [10/Mar/2014:15:56:01 +0000] - Entry "relativeDomainName=testingstatus,zoneName=OURORG.com,dc=DNS,o=Internet" required attribute "objectclass" missing This is a monitor DNS entry that we update every four minutes to verify that our Replication is working across the board, so that next error repeats every four minutes as we try to update the entry. The entry looks like it's had everything except for the tXTRecord field deleted as well. Fortunately it's a testing entry, so we can easily rebuild it manually. This error occurred a few minutes after a bad restart which required a changelog regenerate, so that may be related. Anyone know what might cause this? -- TimP [http://blog.timp.com.au] [http://resume.timp.com.au]

2 10

Re: [389-users] problem on Sparc with DS 1.3.2: Skipping entry ... which has no parent
by Carsten Grzemba 11 Mar '14

11 Mar '14

Am 11.03.14 schrieb Rich Megginson <rmeggins(a)redhat.com>: > > > > > > On 03/11/2014 05:57 AM, Carsten Grzemba wrote: > > > > interessting: it is only on 32bit build. 64bit build on Solaris10 Sparc works as expected. > > > > > > I'm not sure. I guess we could try to reproduce on Fedora 32-bit. > > > > the Solaris10 i386 build works without problems, only on Sparc. > > > > > > > > > > -- > > 389 users mailing list > > 389-users(a)lists.fedoraproject.org > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > > > >

2 1

Re: [389-users] problem on Sparc with DS 1.3.2: Skipping entry ... which has no parent
by Carsten Grzemba 11 Mar '14

11 Mar '14

interessting: it is only on 32bit build. 64bit build on Solaris10 Sparc works as expected.

2 1

help with cert expired
by Maurizio Marini 11 Mar '14

11 Mar '14

Hello I have this very old installation: 389-ds-1.1.3-5.fc12.noarch 389-ds-console-doc-1.2.0-5.fc12.noarch 389-ds-base-1.2.5-1.fc12.i686 389-ds-console-1.2.0-5.fc12.noarch 389-console-1.1.3-5.fc12.noarch 389-admin-console-1.1.4-2.fc12.noarch 389-dsgw-1.1.4-1.fc12.i686 389-admin-console-doc-1.1.4-2.fc12.noarch 389-adminutil-1.1.8-4.fc12.i686 389-admin-1.1.10-1.fc12.i686 into an old FC12. Now certs under /etc/httpd/alias are expired Certificate: Data: Version: 3 (0x2) Serial Number: 3 (0x3) Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption Issuer: "CN=Certificate Shack,O=example.com,C=US" Validity: Not Before: Mon Mar 01 10:50:54 2010 Not After : Sat Mar 01 10:50:54 2014 Subject: "CN=localhost4.localdomain4,O=example.com,C=US" and I have this error into log: [error] SSL Library Error: -8181 Certificate has expired the it suggests to " Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the prob lem can be resolved." I did, and it works. Now I wonder how can I renew that expired cert. I have googled around but I have not found any simple to re-create the cert. I find this http://directory.fedoraproject.org/wiki/Howto:SSL but it is not so easy to regenerate an expired certificate. Is there something simpler? Can you help me? My best rgards Maurizio

3 2

problem on Sparc with DS 1.3.2: Skipping entry ... which has no parent
by Carsten Grzemba 11 Mar '14

11 Mar '14

If I try to setup an DS1.3.2.13 DS intance on Solaris10 Sparc I got a error on setup-ds-admin.pl: ... +Entry cn=PD Managers,ou=groups,dc=contac,dc=lan is added +changeOwnerMode: changed mode of /tmp/ldifuO_wjV.ldif to 440 +changeOwnerMode: changed ownership of /tmp/ldifuO_wjV.ldif to user 389 group 389 +importing data ... [11/Mar/2014:09:26:40 +0100] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database [11/Mar/2014:09:26:40 +0100] - check_and_set_import_cache: pagesize: 8192, pages: 262144, procpages: 2640 [11/Mar/2014:09:26:40 +0100] - Import allocates 838856KB import cache. [11/Mar/2014:09:26:40 +0100] - import userRoot: Beginning import job... [11/Mar/2014:09:26:40 +0100] - import userRoot: Index buffering enabled with bucket size 100 [11/Mar/2014:09:26:41 +0100] - import userRoot: Processing file "/tmp/ldifuO_wjV.ldif" [11/Mar/2014:09:26:41 +0100] - import userRoot: Finished scanning file "/tmp/ldifuO_wjV.ldif" (9 entries) [11/Mar/2014:09:26:41 +0100] - import userRoot: WARNING: Skipping entry "dc=example,dc=lan" which has no parent, ending at line 17 of file "/tmp/ldifuO_wjV.ldif"[11/Mar/2014:09:26:41 +0100] entryrdn-index - _entryrdn_index_read: Suffix "dc=example,dc=lan" not found: Successful return: 0(0) ... a lot of such errors following and the userRoot db or base db is not setup correctly. I have tried the patch: https://fedorahosted.org/389/attachment/ticket/47734 without success. Your help is greatly appreciated.

1 0

multi-master changelog, tombstone entries
by Vesa Alho 10 Mar '14

10 Mar '14

Hi, 1. replication changelog I've been running multi-master replication setup for a while and realised hadn't configured expiration (changelog max age). Now my changelog file is rather big and I would like get size down. I'm planning to delete changelog and start with a fresh one following these instructions: https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server… But since I have two multi-master servers, I was wondering what is the best way to start with a fresh changelog? Guide says I need to re-initialize consumers again, but if both multi-master servers get new data during replication is off, I'm worried I get into trouble when trying to get replication running again. In case there is a risk, I rather keep the current state. 2. Tombstone entries I was reading this: https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server… => I noticed that at least in 1.2.11.25 value nsDS5ReplicaTombstonePurgeInterval is not set at all. I guess because it depends on environment? But is there a reason why it's not directly visible in Console => Configuration => Replication (on the same page as changelog max age)? Just saying I would not have noticed tombstone purging unless reading administration guide carefully. -Vesa

2 1

Importing Pre-Hashed Passwords
by Steven Crothers 10 Mar '14

10 Mar '14

Hello, I'm trying to accomplish a poor mans replication from OpenDS from Oracle/Sun. Basically the logic is as follows: OpenDS is attached to our corporate IDM. User is managed in OpenDS. User updates information in OpenDS. OpenDS read-replica is updated in our local read-slave. Python script notices there was a change in our local read-slave. Script isolates the change from our read-slave and sends the DNs to sync to my 389 (FreeIPA) server. FreeIPA replica receives input over the network from notification agent which includes DNs. DNs attributes are re-organized (OpenDS doesn't use anything logical, all 100% custom attributes/objectclasses). DNs with re-organized attributes are inserted/updated in 389 server (FreeIPA), minus the updated SSHA password hash. I get an error saying that adding pre-encoded passwords isn't allowed. But, that makes me say "How the hell do you import an LDIF" backup, and frankly, I can't find anything on the subject (albeit, I admittedly didn't quite know how to search this issue either). I've never seen a server not accept pre-encoded password hashes (or at least I don't recall this specific error in OpenDS/LDAP), so my question is, how can I store the SSHA password hash from OpenDS in my 389server (FreeIPA) server? Steven Crothers steven.crothers(a)gmail.com

2 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users March 2014