[Fedora-directory-users] Issue with fine-grained password policy
by Ian Meyer
Hello all,
I set up FDS 1.0.2 on a server and got everything configured and
imported etc etc.. things
work great, I can authenticate against it, make updates.. but I can
not get our linux
clients to warn me about changing my password, expiration, length,
etc.. I followed the instructions on
http://www.redhat.com/docs/manuals/dir-server/ag/7.1/password.html#1074672
to set up a global config, and a user config. Is there anything on the
client side for PAM that needs to be configured? I've been pouring
over this for a couple of days now so I may just be blind to a small
detail I may have missed. Any help/insight would be appreciated.
Thanks in advance,
Ian
17 years, 6 months
[Fedora-directory-users] WindowsSync password not synced when changed via ldapmodify
by Jeff Gamsby
I came across this problem today.
When changing passwords from the Fedora console, it works and syncs
across to AD.
When changing passwords using 'passwd', it does not sync until
pam_password is changed to ssha in ldap.conf. Then it syncs fine.
When changing passwords via ldapmodify in SSHA form, passwords do not sync.
Has anyone experienced this behavior?
Does anyone have a solution?
I'd like to change passwords via a PHP web interface.
Thanks,
Jeff
17 years, 6 months
[Fedora-directory-users] Management Console : class loader error FC6
by Steven Truong
Hi, all. I am a newbie with FD and eager to install it with FC6. I
tried to install Fedora Directory on FC6 but when I used the console
and clicked on Administration Server I got error. The error is
"Failed to install a local copy of admserv10.jar or one of its
supporting files: admserv10.jar not found at
http://uranus.mydomain.com:7777/"
I also got similar error when I clicked on Directory Server but with
different file name.
I actually installed Java based on this instruction:
http://jpackage.org/installation.php
1. Download jdk_1_5_0.09-linux.i586-rpm.bin -------> installed it
2. Download ftp://jpackage.hmdc.harvard.edu/JPackage/1.7/generic/RPMS.non-free/java-1...
and then installed this file
Did i miss any steps here? I guess there must be something wrong with
my java installation.
I installed fedore-ds-1.0.2-1.FC5.i386.opt.rpm and things went without
any error.
I then ran /opt/fedora-ds/setup/setup and then at the end
./startconsole -u admin -a http://uranus.mydomain.com:7777/
My SELINUX=disable and there is no package for
xorg-x11-deprecated-libs to be installed from yum.
/usr/bin/java -vesion
java version "1.5.0_09"
Java (TM) 2 Runtime Environment, Standard Edition (build 1.5.0_09-b03)
Java HotSpot(TM) Client VM (build 1.5.0_09-b03, mixed mode, sharing)
Please help as I would like to know what went wrong or if I missed something.
Thank you.
17 years, 6 months
[Fedora-directory-users] how to set up Fedora Ds on a multinetwork host
by Sergey Ivanov
Hi,
I have installed Fedora Directory Server or a machine, which belongs to
2 different networks. One is local network with 192.168. prefix, and
other is a real IP I've got from Internet Service provider.
I want to have Directory Server, listening to both interfaces, with SSL
certificates. How can I set up Directory Server to use different
certificates for different IP addresses (and different hostnames)? Is it
possible?
I have not find the answer in documentation and in the internet. I tried
to set up another Directory Server instance on the same host, but also I
failed, because it refuses to share the same port number, and to bind to
that port only on one of IP addresses.
Please, help me.
With best regards,
Sergey Ivanov.
17 years, 6 months
Re: [Fedora-directory-users]modify userPassword via perl-ldap?
by Jo De Troy
Hello,
thanks for all the info.
I've tried adding {crypt} in front of the password but now I get
invalid syntax for userPassword.
Here's what exactly I do, it must be something stupid ...
$password = "{crypt}".$hashedpwd;
$mesg=$ldap->modify($dn,
changes => [
replace => [
'userPassword' => [ $password ]
]] );
Thanks again,
Jo
17 years, 6 months
[Fedora-directory-users] getent group not working WindowsSync
by Jeff Gamsby
I have setup WindowsSync which works fine, but it seems that in order for LDAP groups to sync they must live in ou=People. This works fine on the Windows side, but not on the Linux side. 'getent group' only returns local groups. I am thinking that I can add an entry to /etc/ldap.conf to fix this but when I change nss_base_group ou=People, it doesn't work. I'm not sure what I'm doing wrong, is this the right way to do this?
Thanks,
Jeff G.
17 years, 6 months
[Fedora-directory-users] Can add with GUI, not with ldapmodify
by Kyle Tucker
Hi,
New clean installation of Fedora DS 1.0.2 on FC5. I
added a first user with the admin console, exported it to see
its attributes and made a template to add a new user via LDIF
like below. If I try to add it with ldapmodify, I get this:
ldapmodify -x -a -W -D "cn=Manager,dc=testdom,dc=net" -h \
localhost -f addtester.ldif
Enter LDAP Password:
ldap_bind: No such object (32)
matched DN: dc=testdom,dc=net
If import the exact same LDIF file with the admin console, it
goes right in and all the attributes are fine.
Any ideas? Thanks.
dn: uid=tester, ou=People, dc=testdom,dc=net
changetype: add
objectClass: top
objectClass: person objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: posixAccount
ou: People cn: Tony Tester
sn: Tester
givenName: Tony
uid: tester telephoneNumber: 603-555-1212
loginShell: /bin/sh
gidNumber: 100
uidNumber: 503 mail: tester(a)testdom.net
gecos: Tony Tester
homeDirectory: /usr/local/home/tester
userPassword: {SSHA}yYUVdAn95yDfzbIK92SuL0jK0cCnU//A
--
- Kyle
---------------------------------------------
kylet(a)panix.com http://www.panix.com/~kylet
---------------------------------------------
17 years, 6 months
[Fedora-directory-users] Re: pam_ldap doesn't follow referrals
by Philip Kime
> This is a shot in the dark,
> but have you tried specifying:
> pam_password exop
> ..in /etc/ldap.conf?
> I suggest this because you mention ldappasswd seems to do the job, and
> ldappasswd uses the password change extended operation to do its work.
Good shot! It works now. Many thanks - I had looked at exop but for some
reason didn't try it ...
PK
17 years, 6 months
[Fedora-directory-users] pam_ldap doesn't follow referrals
by Philip Kime
Any pointers welcome. This is on RHEL4 and FDS 1.0.2. pam_ldap moans
about referrals when the first LDAP server in ldap.conf is a
consumer-only. No problem if it's talking to a read-write master.
# passwd test
Changing password for user test.
Enter login(LDAP) password:
New UNIX password:
Retype new UNIX password:
LDAP password information update failed: Referral
I tried nss_ldap-226 and nss-ldap-253 which comes with an updated
pam_ldap. I have
referrals yes
in ldap.conf
I can do a manual ldappasswd update to the consumer and it works,
presumably referring to a writable master ok (thought I can't see
anything about referrals in the ldappasswd debugging output, nor nothing
in the master logs).
PK
--
Philip Kime
NOPS Systems Architect
310 401 0407
17 years, 6 months
