Re: [Fedora-directory-users] MD5 for password hashes
by Del
Hi,
I did some digging on this issue. I suspect I have found a bug
in Fedora Directory Server handling the importing of MD5 passwords,
either that or the current download versions don't support MD5.
The results are as follows:
--
Run this command on OpenLDAP to set a user's password:
ldappasswd -x -D 'uid=root,ou=People,dc=babel,dc=com,dc=au' -W -S
'uid=del,ou=People,dc=babel,dc=com,dc=au'
Do a simple ldapsearch as that user, to verify that the password is correct:
ldapsearch -x -D 'uid=del,ou=People,dc=babel,dc=com,dc=au' -W 'uid=del'
If you have set your OpenLDAP permissions to be relatively transparent,
the above ldapsearch will show a base64 representation of your password
hash. It looks like this:
userPassword:: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa=
You can un-base64 this hash with the following simple perl script:
#!/usr/bin/perl
#
# Usage: $0 string
#
use MIME::Base64;
my $data = $ARGV[0];
print("Input string is " . $data . "n");
$decoded = decode_base64($data);
print("Decoded string is " . $decoded . "n");
You will see that the password contains the prefix {MD5}, which looks
like this:
Decoded string is {MD5}asdfasdfasdfasdfasdf==
Import your OpenLDAP directory into Fedora Directory Server. I used
LdapImport for this although I also tried it with ldif2db.
What happens during the process of LdapImport is:
* Passwords of type {CRYPT} are transferred across OK to the
FedoraDirectoryServer.
* Passwords of type {MD5} appear in the FedoraDirectoryServer as strings
beginning with {SSHA}. This can be verified by examining the directory
using GQ or a similar LDAP tool, while bound as "cn=Directory Manager".
* Attempts to authenticate with the original password now fail.
* Attempting to authenticate as the full MD5 string (i.e. use the hash
string '{MD5}asdfasdf...==' as extracted from the OpenLDAP server as the
password for Fedora Directory Server) in fact works.
I expect that what has happened is that Fedora Directory Server has
failed to recognise the {MD5} at the beginning of the string as a valid
hash mechanism and re-encoded the entire string as an SSHA hash.
I see that on the FDS wiki there is mention of MD5 hashing support
being added on June 15th. I have fedora-ds-7.1-2.RHEL4 installed from
the RPM I downloaded from the FDS web site. How do I verify that this
version should have the MD5 support, or do I need a more recent version?
--
Del
17 years, 10 months
[Fedora-directory-users] Re: help for building FDS
by speedy zinc
Whoa, your replies already showed up in the archive,
and I haven't received yet. What kind of email server
does yahoo have???
Anyway, following Rob's suggestion, I did the patch,
and it can get pass that issue.
Rich, I have perl in my path (perl v5.8.3), but I
don't think the build script actually generated the
files oiddata.h/c. Both files are there, but the last
modify time seems to date back to 2002-01-04. And the
oidgen.perl is there too.
Now, I'm getting a new problem:
rm -f .libs/client.lo
cc -DHAVE_CONFIG_H -I. -I. -I.. -I../include
-I../plugins -I../include
-I/tmp/fedora-ds-build/include
-I/tmp/fedora-ds-build/include
-I/tmp/fedora-ds-build/include -Wall -W
-I/tmp/fedora-ds-build/include
-L/tmp/fedora-ds-build/lib -O2 -pipe
-I/tmp/fedora-ds-build/include
-L/tmp/fedora-ds-build/lib -O2 -pipe
-I/tmp/fedora-ds-build/include
-L/tmp/fedora-ds-build/lib -O2 -pipe -MT client.lo -MD
-MP -MF .deps/client.Tpo -c client.c -fPIC -DPIC -o
.libs/client.lo
client.c:64: error: static declaration of
'global_callbacks' follows non-static declaration
saslint.h:112: error: previous declaration of
'global_callbacks' was here
make[4]: *** [client.lo] Error 1
make[4]: Leaving directory
`/home/csp/redhat/dsbuild/ds/cyrus-sasl/work/cyrus-sasl-2.1.20/lib'
make[3]: *** [all-recursive] Error 1
make[3]: Leaving directory
`/home/csp/redhat/dsbuild/ds/cyrus-sasl/work/cyrus-sasl-2.1.20'
make[2]: *** [all] Error 2
make[2]: Leaving directory
`/home/csp/redhat/dsbuild/ds/cyrus-sasl/work/cyrus-sasl-2.1.20'
make[1]: *** [build-work/cyrus-sasl-2.1.20/Makefile]
Error 2
make[1]: Leaving directory
`/home/csp/redhat/dsbuild/ds/cyrus-sasl'
make: *** [dep-../../ds/cyrus-sasl] Error 2
:(
thx
sz
__________________________________
Yahoo! Mail - PC Magazine Editors' Choice 2005
http://mail.yahoo.com
17 years, 10 months
[Fedora-directory-users] AD sync
by Darjo Gregoric
Hi,
I have a problem with AD sync. I have established synchronization without
SSL and works fine, but when I use SSL, connection is not established and I
receive error:
Simple bind failed, LDAP sdk error 81 (Can't contact LDAP server), Netscape
Portable Runtime error -8179 (Peer's Certificate issuer is not recognized.)
AD machine name is suzy.
I have exported CA and imported it on Directory server.
Certutil -L -d . gives:
CA certificate CTu,u,u
suzy CT,,
Server-Cert u,u,u
Did i miss something?
Is there any HOW TO for this type of configuration?
Regards
Darjo
17 years, 11 months
[Fedora-directory-users] Fedora Management Console 7.0
by Anthony Gabila
Hi,
Not quite sure how to solve this problem, I'm trying to add a user via
Fedora Management Console,
but I am not able to log in to my Win2k Pro machine using that username.
I manage to get around this problem by entering the command "smbpasswd -a
testuser"
I was wondering if I could skip this extra step by doing all these in the
Management Console app?
agabila
17 years, 11 months
[Fedora-directory-users] openlda client and fedora-ds
by Enrico Valsecchi
Dear All,
I'm install with your help my fedora-ds.
Many thanks!
Well, into my linux box are installed openldapclient,
and I want browse my ldap dir content.
O.K., i type:
ldapsearch -L -b "dc=chiccomara,dc=org" -W "(objectclass=*)"
LDAP server request a password.
I type LDAP password, and result is:
SASL/EXTERNAL authentication started
ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
additional info: SASL(-4): no mechanism available:
Where is a problem?
Many thanks,
Enrico Valsecchi
17 years, 11 months
[Fedora-directory-users] openlda client and fedora-ds
by Enrico Valsecchi
Dear All,
I'm install with your help my fedora-ds.
Many thanks!
Well, into my linux box are installed openldapclient,
and I want browse my ldap dir content.
O.K., i type:
ldapsearch -L -b "dc=chiccomara,dc=org" -W "(objectclass=*)"
LDAP server request a password.
I type LDAP password, and result is:
SASL/EXTERNAL authentication started
ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
additional info: SASL(-4): no mechanism available:
Where is a problem?
Many thanks,
Enrico Valsecchi
17 years, 11 months
[Fedora-directory-users] Aboout Winsync
by joe
Hi!
I followed the steps of Red Hat document to implement Windows 2000 sync
with FDS. After my "initial re-synchronization" process was done, I
checked my directory tree.
I saw some entries like "cn=Domain Admins, ou=People, dc=example,
dc=com", and it contained "Members/Static Group - uid=Administrator, ,
ou=People, dc=example, dc=com"
in its properties. But I could not find the real entry dn named
"uid=Administrator, , ou=People, dc=example, dc=com" in my ds tree. Is
it the correct result? Or I did
something wrong with configuration. Please tell me how to fix the
problem. Thanks a lot.
Regards
Joe Yu
17 years, 11 months
[Fedora-directory-users] Using 'localhost' for configuration directory
by George Holbert
If each directory server in an environment will be acting as its own
configuration directory (i.e., for o=NetscapeRoot stuff), is it ok to
just use 'localhost' as the value for the configuration directory
server? Or, is it better/required to use the FQDN of the public network
interface (e.g., ldaphost.example.com)?
Thanks,
-- George
17 years, 11 months
[Fedora-directory-users] Very NewBye
by Enrico Valsecchi
Dear All,
I'm a very newbye user of fedora-directory ....
To start, I have a big problem!
:-(
Well, I have downloaded and installed from rpm package.
O.K., I'm creat a .inf file, wit this content:
[General]
FullMachineName= localhost.localdomain
SuiteSpotUserID= ldap
ServerRoot= /opt/ldapserver
[slapd]
ServerPort= 389
ServerIdentifier= localhost
Suffix= dc=localhost,dc=localdomain
RootDN= cn=Directory Manager
RootDNPwd= password
and I'm go to /opt/fedora-ds/bin/slapd/admin/bin.
Run perl ds_newinst.pl my_new_inf_file
O.K., Perl script run and at console I retry this message:
CGI /opt/ldapserver/bin/slapd/admin/bin/ds_newinst failed with 1: here is the
output:
Content-type: text/plain
error:could not create server localhost - Could not
write /opt/ldapserver/bin/slapd/admin/scripts/template-ldif2db.pl
to /opt/ldapserver/slapd-localhost/ldif2db.pl (No such file or director).
NMC_Status: 1
Error: could not run /opt/ldapserver/bin/slapd/admin/bin/ds_newinst: 1
Error: Could not create new directory server instance
User "nobody" are o.k. into my system, and permission /opt/ldapserver is
nobody.root with write permission on user, group and read to all
Some people have a solutions?
Many thanks,
Enrico
17 years, 11 months
[Fedora-directory-users] libdb problem on setup
by Chad Elwartowski
I'm trying to install the Fedora Directory and run into errors after
executing the setup program.
I'm running Redhat Linux:
%uname -a
Linux myhostname 2.6.9-5.ELsmp #1 SMP Wed Jan 5 19:30:39 EST 2005 i686 i686
i386 GNU/Linux
I've downloaded the rpm: fedora-ds-7.1-2.RHEL4.i386.opt.rpm and installed
it (rpm -iv ...).
I cd into /opt/fedora-ds and run: ./setup/setup
After entering my information in any of the three installation levels I get
the error:
- Fedora-Directory/7.1 B2005.146.2010 starting up
- libdb: unable to initialize mutex: Function not implemented
- libdb: /opt/fedora-ds/slapd-myhostname/db/__db.001: unable to initialize
environment lock: Function not implemented
- start: Failed to init database, err=38 Function not implemented
etc...(I can't cut and paste into email so I'd have to type the rest, which
is quite a bit)
I've gone the route of re-installing the RPM then running the perl
ds_newinst.pl /opt/fedora-ds/setup/install.inf (with the install.inf edited
for my settings)
That resulted in a "Success", but then looking in the fedora logs it shows
the same error above as far as the libdb:...
Neither allow me to get access using startconsole.
My LD_LIBRARY_PATH includes /opt/fedora-ds/lib
My PATH includes /opt/fedora-ds/bin/base/jre/bin
My CLASSPATH includes
/opt/fedora-ds/bin/base/jre/bin:/opt/fedora-ds/java:/opt/fedora-ds/java/jars:/opt/fedora-ds/bin/base/jre/lib:/opt/fedora-ds/bin/base/jre/lib/ext:/opt/fedora-ds/bin/base/jre/bin/classic
My JAVA_HOME is /opt/fedora-ds/java
Can anyone point me in the right direction to get past this problem?
Thanks,
Chad
17 years, 11 months
