[Fedora-directory-users] Bug in the console
by Jeff Applewhite
Hi All,
There appears to be a bug in the console such that new schema changes do not
appear until the console is restarted.
Here's what I did -- you should be able to reproduce it.
Created a custom objectclass (a child of inetOrgPerson) and some custom
optional attributes associated with it, then tried to add the objectclass to
a user except the new custom objectclass does not appear in the scrollable
list when I go into advanced view and attempt to add it to the
abjectclasses. Once I restart the console all is well. Has anyone seen
this or similar problems before?
--
Jeff Applewhite
Systems Administration Lead
P (919) 287-7392
M (919) 491-4161
jeff.applewhite(a)motricity.com
NOTICE: This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Motricity. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.
18 years
RE: [Fedora-directory-users]: SSL directory server gateway, one-button SSL Certs (slapd + Admin Server) generation script
by Tay, Gary
I couldn't find setupssl.sh anywhere on the HowTo SSL link.
Anyway, I have written cr_ssl_certs.sh which works for both FDS and
SUN-ONE DS, and this script will create also the Admin Server SSL Cert
(the same as slapd), once you have used Admin Console to enable SSL for
Admin Server at "Encryption" TAB, you would see a few .conf files
including console.conf get updated at $SERVER_ROOT/admin-serv/config,
the rest is history.
Note that it is not a MUST to create different CA Certs for different
FDS Servers, they are so for testing purposes only, for production
usage, you would most likely purchase signed SSL Server Certs for your
different FDS Servers
HTH.
Gary
Content of cr_ssl_certs.sh
#! /bin/sh
#
# cr_ssl_certs.sh - This script works for either Fedora or SUN-ONE DS
#
# Gary Tay
#
# 1) Make sure 'root' is used to run this script
# 2) Make sure /home/ldap/dirmgr.pwd contains password of cn=Direcyory
Manager
#
#set -vx
IS_ROOT_UID=`id | grep "uid=0(root)"`
if [ ! -n "$IS_ROOT_UID" ]; then
echo "Please run this script as root"
exit 1
fi
chmod 700 $0
if [ ! -f /home/ldap/dirmgr.pwd ]; then
echo "Please setup /home/ldap/dirmgr.pwd."
exit 1
else
chmod 600 /home/ldap/dirmgr.pwd
fi
# Pls customize the followings
HOST=`hostname`
DOMAIN="example.com"
BASEDN="dc=example,dc=com"
FQDN="$HOST.$DOMAIN"
ORG="Example Companies"
LOCALITY="NewYork City"
STATE="NewYork"
COUNTRY="US"
# Uncomment for Fedora/RedHat Directory Server
SERVER_ROOT="/opt/fedora-ds"
# Uncomment for SUN-ONE/Java System Directory Server
#SERVER_ROOT="/var/Sun/mps"
if [ "$SERVER_ROOT" = "/opt/fedora-ds" ]; then
LD_LIBRARY_PATH=$SERVER_ROOT/lib:$SERVER_ROOT/shared/lib
SLAPD_OWNER="ldap"
SLAPD_GROUP="ldap"
TAR_CVF="tar -Pcvf"
TAR_XVF="tar -Pxvf"
fi
if [ "$SERVER_ROOT" = "/var/Sun/mps" ]; then
LD_LIBRARY_PATH=$SERVER_ROOT/lib
SLAPD_OWNER="root"
SLAPD_GROUP="root"
TAR_CVF="tar -cvf"
TAR_XVF="tar -xvf"
fi
export LD_LIBRARY_PATH
PATH=$SERVER_ROOT/shared/bin:$PATH; export PATH
echo "Please shutdown slapd and Admin Server and perform a tar backup"
echo "and db2ldif backup of currently working system, and restart them
again."
echo "Example of tar command: $TAR_CVF /var/tmp/ds_backup.tar
$SERVER_ROOT"
echo "When you are ready, answer Yes and press Enter to continue."
echo "Press Ctrl-C to cancel."
read READY
[ "$READY" != "Yes" ] && exit 1
echo "Enter an UNIQUE SERIAL NUMBER for CA Cert."
echo "Eg: 1000 for ldap1, 2000 for ldap2, 3000 for ldap3, etc..."
read UNIQUE_SN_CA
echo "Enter an UNIQUE SERIAL NUMBER for LDAP Server Cert."
echo "Eg: 1001 for ldap1, 1002 for ldap2, 1003 for ldap3."
read UNIQUE_SN_LDAP
cd $SERVER_ROOT/alias
echo "Backing up existing *.db (if any) to backup_$$."
mkdir -p backup_$$ >/dev/null 2>/dev/null
cp -p *.db backup_$$ >/dev/null 2>/dev/null
/bin/rm -f *.db >/dev/null 2>/dev/null
echo "secretpwd" >pwdfile.txt
chmod 600 pwdfile.txt
echo "dsadasdasdasdadasdasdasdasdsadfwerwerjfdksdjfksdlfhjsdk"
>noise.txt
echo "Creating new security key3.db/cert8.db pair."
../shared/bin/certutil -N -d . -f pwdfile.txt
echo "Generating encryption key."
../shared/bin/certutil -G -d . -z noise.txt -f pwdfile.txt
echo "Generating self-signed CA certificate."
../shared/bin/certutil -S -n "CA certificate" \
-s "cn=CAcert $HOST" -x \
-t "CT,," -m $UNIQUE_SN_CA -v 120 -d . -z noise.txt -f pwdfile.txt
echo "Generating self-signed Server certificate."
../shared/bin/certutil -S -n "Server-Cert" \
-s "cn=$FQDN,O=$ORG,L=$LOCALITY,ST=$STATE,C=$COUNTRY" -c "CA
certificate" \
-t "u,u,u" -m $UNIQUE_SN_LDAP -v 120 -d . -z noise.txt -f pwdfile.txt
echo "Renaming and linking modified security DBs."
mv -f key3.db slapd-$HOST-key3.db
mv -f cert8.db slapd-$HOST-cert8.db
ln -s slapd-$HOST-key3.db key3.db
ln -s slapd-$HOST-cert8.db cert8.db
echo "Setting the correct ownership of security DBs"
chown $SLAPD_OWNER:$SLAPD_GROUP *.db
echo "Self-signed CA and SSL Server certs generated."
echo ""
echo "The following commands are OPTIONAL."
echo "They are for backing up CA and Server Certs in PK12 format."
echo ""
echo "---Start of OPTIONAL commands---"
cat <<EOF >optional_cmds.txt
../shared/bin/pk12util -d . -P slapd-$HOST- -o cacert.pfx -n "CA
certificate"
../shared/bin/pk12util -d . -P slapd-$HOST- -o servercert.pfx -n
"Server-Cert"
EOF
cat optional_cmds.txt
echo "---End of OPTIONAL commands---"
echo ""
#
echo "Enabling SSL."
echo "NOTE: changes will be saved to config/dse.ldif when slapd is
shutdown"
cat <<EOF >/tmp/ssl_enable.ldif
dn: cn=encryption,cn=config
changetype: modify
replace: nsSSL3
nsSSL3: on
-
replace: nsSSLClientAuth
nsSSLClientAuth: allowed
dn: cn=config
changetype: modify
add: nsslapd-security
nsslapd-security: on
EOF
if [ "$SERVER_ROOT" = "/opt/fedora-ds" ]; then
cat <<EOF >>/tmp/ssl_enable.ldif
dn: cn=config
replace: nsslapd-ssl-check-hostname
nsslapd-ssl-check-hostname: off
EOF
fi
../shared/bin/ldapmodify -D "cn=Directory Manager" -w `cat
/home/ldap/dirmgr.pwd` -f /tmp/ssl_enable.ldif
[ $? -eq 0 ] && \
echo "Enabling SSL in cn=encryption,cn=config and cn=config done."
[ $? -ne 0 ] && \
echo "Enabling SSL in cn=encryption,cn=config and cn=config failed."
#
cat <<EOF >/tmp/add_ssl_configs.ldif
dn: cn=encryption,cn=config
changetype: modify
add: nsSSL3Ciphers
nsSSL3Ciphers:
-rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5,
+rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_sha,+fortezz
a,
+fortezza_rc4_128_sha,+fortezza_null,+tls_rsa_export1024_with_rc4_56_sha
,
+tls_rsa_export1024_with_des_cbc_sha
-
add: nsKeyfile
nsKeyfile: alias/slapd-$HOST-key3.db
-
add: nsCertfile
nsCertfile: alias/slapd-$HOST-cert8.db
EOF
../shared/bin/ldapmodify -D "cn=Directory Manager" -w `cat
/home/ldap/dirmgr.pwd` -f /tmp/add_ssl_configs.ldif
[ $? -eq 0 ] && echo "Adding SSL configs in cn=encryption,cn=config
done."
[ $? -ne 0 ] && echo "Adding SSL configs in cn=encryption,cn=config
failed."
#
cat <<EOF >/tmp/addRSA.ldif
dn: cn=RSA,cn=encryption,cn=config
objectclass: top
objectclass: nsEncryptionModule
cn: RSA
nsSSLPersonalitySSL: Server-Cert
nsSSLToken: internal (software)
nsSSLActivation: on
EOF
../shared/bin/ldapmodify -a -c -D "cn=Directory Manager" -w `cat
/home/ldap/dirmgr.pwd` -f /tmp/addRSA.ldif
[ $? -eq 0 ] && echo "Adding cn=RSA,cn=encryption,cn=config done."
[ $? -ne 0 ] && echo "Adding cn=RSA,cn=encryption,cn=config failed."
#
echo "Creating a pin.txt for auto-starting of slapd."
echo "Internal (Software) Token:`cat pwdfile.txt`" >slapd-$HOST-pin.txt
chown $SLAPD_OWNER:$SLAPD_GROUP slapd-$HOST-pin.txt
chmod 400 slapd-$HOST-pin.txt
echo "Exporting the CA Cert in ASCII format or DER format"
../shared/bin/certutil -L -d . -P slapd-$HOST- -n "CA certificate" \
-a > cacert.asc
../shared/bin/certutil -L -d . -P slapd-$HOST- -n "CA certificate" \
-r > cacert.der
echo "Copying Server-Cert to Admin Server for Admin Server SSL
connection."
cp slapd-$HOST-key3.db admin-serv-$HOST-key3.db
cp slapd-$HOST-cert8.db admin-serv-$HOST-cert8.db
echo "Setting the correct ownership of Admin Server security DBs"
chown $SLAPD_OWNER:$SLAPD_GROUP admin-serv-$HOST-*.db
echo "Remember to enable SSL in Admin Server later."
echo "Remember to select 'Server-Cert' as the Certificate and click OK."
echo "Remember to restart Admin Server after that."
echo "Creating a pin.txt for auto-starting of Admin Server."
echo "`cat pwdfile.txt`" >admin-serv-$HOST-pin.txt
chown $SLAPD_OWNER:$SLAPD_GROUP admin-serv-$HOST-pin.txt
chmod 400 admin-serv-$HOST-pin.txt
echo "Patching start-admin and creating start-admin.auto."
if [ "$SERVER_ROOT" = "/opt/fedora-ds" ]; then
sed -e \
'/^\$HTTPD/s/$/
\<"$SERVER_ROOT"\/alias\/admin-serv-`hostname`-pin.txt/' \
$SERVER_ROOT/start-admin >$SERVER_ROOT/start-admin.auto
fi
if [ "$SERVER_ROOT" = "/var/Sun/mps" ]; then
sed -e \
'/uxwdog/s/$/
\<"$SERVER_ROOT"\/alias\/admin-serv-`hostname`-pin.txt/' \
$SERVER_ROOT/start-admin >$SERVER_ROOT/start-admin.auto
fi
chmod 755 $SERVER_ROOT/start-admin.auto
echo "Please use $SERVER_ROOT/start-admin.auto in rc3.d as autostart
script."
echo ""
echo "IMPORTANT NOTES:"
echo ""
echo "1. How to check if SSL Configurations are done properly?"
echo "You may view config/dse.ldif after shutting down slapd"
echo "to verify all the required SSL configurations are there."
echo ""
echo "2. How to fix slapd startup issue due to mis-configuration of
SSL?"
echo "If for any reason slapd fails to start due to SSL issue,"
echo "you may edit config/dse.ldif after shutting down slapd"
echo "and revert back to non-SSL configs."
echo "i.e. set nsSSL3: off, nsSSLActivation: off and nsslapd-security:
off"
echo "and then try to restart slapd."
echo ""
echo "3. How to fix Admin Server login issue due to mis-configuration of
SSL?"
echo "If for any reason Admin Server login fails and you wish to give
up,"
echo "simply stop slapd and admin-serv and restore using the tar backup"
echo "i.e. rm -f $SERVER_ROOT/alias/*.db;$TAR_XVF
/var/tmp/ds_backup.tar"
echo ""
===Sample Run===
# ./cr_ssl_certs.sh
Please shutdown slapd and Admin Server and perform a tar backup
and db2ldif backup of currently working system, and restart them again.
Example of tar command: tar -cvf /var/tmp/ds_backup.tar /var/Sun/mps
When you are ready, answer Yes and press Enter to continue.
Press Ctrl-C to cancel.
Yes
Enter an UNIQUE SERIAL NUMBER for CA Cert.
Eg: 1000 for ldap1, 2000 for ldap2, 3000 for ldap3, etc...
1000
Enter an UNIQUE SERIAL NUMBER for LDAP Server Cert.
Eg: 1001 for ldap1, 1002 for ldap2, 1003 for ldap3.
1001
Backing up existing *.db (if any) to backup_24872.
Creating new security key3.db/cert8.db pair.
Generating encryption key.
Generating key. This may take a few moments...
Generating self-signed CA certificate.
Generating key. This may take a few moments...
Generating self-signed Server certificate.
Generating key. This may take a few moments...
Renaming and linking modified security DBs.
Setting the correct ownership of security DBs
Self-signed CA and SSL Server certs generated.
The following commands are OPTIONAL.
They are for backing up CA and Server Certs in PK12 format.
---Start of OPTIONAL commands---
../shared/bin/pk12util -d . -P slapd-ldap1- -o cacert.pfx -n "CA
certificate"
../shared/bin/pk12util -d . -P slapd-ldap1- -o servercert.pfx -n
"Server-Cert"
---End of OPTIONAL commands---
Enabling SSL.
NOTE: changes will be saved to config/dse.ldif when slapd is shutdown
modifying entry cn=encryption,cn=config
modifying entry cn=config
Enabling SSL in cn=encryption,cn=config and cn=config done.
modifying entry cn=encryption,cn=config
Adding SSL configs in cn=encryption,cn=config done.
adding new entry cn=RSA,cn=encryption,cn=config
Adding cn=RSA,cn=encryption,cn=config done.
Creating a pin.txt for auto-starting of slapd.
Exporting the CA Cert in ASCII format or DER format
Copying Server-Cert to Admin Server for Admin Server SSL connection.
Setting the correct ownership of Admin Server security DBs
Remember to enable SSL in Admin Server later.
Remember to select 'Server-Cert' as the Certificate and click OK.
Remember to restart Admin Server after that.
Creating a pin.txt for auto-starting of Admin Server.
Patching start-admin and creating start-admin.auto.
Please use /var/Sun/mps/start-admin.auto in rc3.d as autostart script.
IMPORTANT NOTES:
1. How to check if SSL Configurations are done properly?
You may view config/dse.ldif after shutting down slapd
to verify all the required SSL configurations are there.
2. How to fix slapd startup issue due to mis-configuration of SSL?
If for any reason slapd fails to start due to SSL issue,
you may edit config/dse.ldif after shutting down slapd
and revert back to non-SSL configs.
i.e. set nsSSL3: off, nsSSLActivation: off and nsslapd-security: off
and then try to restart slapd.
3. How to fix Admin Server login issue due to mis-configuration of SSL?
If for any reason Admin Server login fails and you wish to give up,
simply stop slapd and admin-serv and restore using the tar backup
i.e. rm -f /var/Sun/mps/alias/*.db;tar -xvf /var/tmp/ds_backup.tar
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com
[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Jason
Russler
Sent: Thursday, April 20, 2006 4:15 AM
To: General discussion list for the Fedora Directory server project.
Subject: [Fedora-directory-users] SSL directory server gateway
Hi all,
I'm pretty uncertain about the best way to go about configuring the
admin server to use SSL (FDS1.0.2) . All of the docs I'm finding are
pretty shaky. Ultimately, I want users to manage their passwords and
info via the web-based Directory Server Gateway over SSL. This would
appear to be the same thing as enabling SSL for the admin server. The
setupssl.sh script provided by the SSL howto, generates the keys/certs
for the admin server and imports them into the appropriate cert db (I
guess, I've performed the process by hand as well, based on RedHat's
docs and the script itself). This would imply to me that the admin
console would find the generated certs and present them in the admin
server's console (under the Configuration -> Encryption tab) in much the
same way that it does in the directory server's console. I can't tell
if something that's suppose to work isn't or if I'm misunderstanding
something. I'd like to know before I try to generate new SSL
certificates and import them.
Thanks much,
Jason
--
Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
18 years
[Fedora-directory-users] Centos with Fedora Directory Server
by Hariharan R
Hai,
I have installed CentOS 4.3 in my system.
I have two mode to boot my system,one is CentOS General mode and the
other one is CentOS smp mode.
Actually i want to test Fedora Directory Server 7.1 with CentOS SMP mode.
Fedora Directory Server 7.1 is running perfectly in CentOS General mode.
If i try to run the Fedora Directory Server 7.1 in CentOS4.3 SMP mode it
was not running.That is, there is some problem in starting the Admin
server.It seems to start the admin server but it is not actually.
Is there is any option or suggestion to make Fedora Directory Server 7.1
working in CentOS 4.3 SMP mode.
Pls advice me.
---
Thanks,
Hariharan.R
18 years
RE: **Caution-External**: [Fedora-directory-users] Automated script for complementing SSLHowTo
by Tay, Gary
Version 2 of this script has been renamed cr_ssl_certs.sh and works for
both FDS and SUN-ONE DS, check it out at:
https://www.redhat.com/archives/fedora-directory-users/2006-April/msg001
45.html
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com
[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Tay,
Gary
Sent: Wednesday, April 12, 2006 6:20 PM
To: fedora-directory-users(a)redhat.com
Subject: **Caution-External**: [Fedora-directory-users]
Automated script for complementing SSLHowTo
FDS Folks,
I wrote this script for the benefits of all.
Gary
Content of cr_ssl_certs_fds1ldap.sh
#! /bin/sh
#
# cr_ssl_certs_fds1ldap.sh
#
# 1) Make sure 'root' is used to run this script
# 2) Make sure /home/ldap/dirmgr.pwd contains password of
cn=Direcyory Manager
#
#set -vx
IS_ROOT_UID=`id | grep "uid=0(root)"`
if [ ! -n "$IS_ROOT_UID" ]; then
echo "Please run this script as root"
exit 1
fi
if [ ! -f /home/ldap/dirmgr.pwd ]; then
echo "Please setup /home/ldap/dirmgr.pwd."
exit 1
else
chmod 600 /home/ldap/dirmgr.pwd
fi
# Pls customize the followings
HOST="ldap1"
DOMAIN="example.com"
BASEDN="dc=example,dc=com"
FQDN="$HOST.$DOMAIN"
ORG="Example Companies"
LOCALITY="NewYork City"
STATE="NewYork"
COUNTRY="US"
SLAPD_OWNER="nobody"
SLAPD_GROUP="nobody"
FDS1_PATH=/opt/fedora-ds
LD_LIBRARY_PATH=$FDS1_PATH/shared/lib:$FDS1_PATH/lib
export LD_LIBRARY_PATH
PATH=$FDS1_PATH/shared/bin:$PATH; export PATH
cd $FDS1_PATH/alias
DOW=`date | cut -d' ' -f1`
echo "Backing up existing *.db (if any) to backup_$DOW."
mkdir -p backup_$DOW >/dev/null 2>/dev/null
cp -p *.db backup_$DOW >/dev/null 2>/dev/null
/bin/rm -f *.db >/dev/null 2>/dev/null
echo "secretpwd" >pwdfile.txt
chmod 600 pwdfile.txt
echo "dsadasdasdasdadasdasdasdasdsadfwerwerjfdksdjfksdlfhjsdk"
>noise.txt
echo "Creating new security key3.db/cert8.db pair."
../shared/bin/certutil -N -d . -f pwdfile.txt
echo "Generating encryption key."
../shared/bin/certutil -G -d . -z noise.txt -f pwdfile.txt
echo "Generating self-signed CA certificate."
../shared/bin/certutil -S -n "CA certificate" -s "cn=CAcert" -x
\
-t "CT,," -m 1000 -v 120 -d . -z noise.txt -f pwdfile.txt
echo "Generating self-signed Server certificate."
../shared/bin/certutil -S -n "Server-Cert" -s \
"cn=$FQDN,O=$ORG,L=$LOCALITY,ST=$STATE,C=$COUNTRY" -c "CA
certificate" \
-t "u,u,u" -m 1001 -v 120 -d . -z noise.txt -f pwdfile.txt
echo "Renaming and linking modified security DBs."
mv -f key3.db slapd-$HOST-key3.db
mv -f cert8.db slapd-$HOST-cert8.db
ln -s slapd-$HOST-key3.db key3.db
ln -s slapd-$HOST-cert8.db cert8.db
echo "Setting the correct ownership of security DBs"
chown $SLAPD_OWNER:$SLAPD_GROUP *.db
echo "Self-signed CA and SSL Server certs generated."
echo ""
echo "The following commands are OPTIONAL."
echo "They are for backing up CA and Server Certs in PK12
format,"
echo "exporting the CA Cert in ASCII format or DER format, and"
echo "importing the CA Cert into the Admin Server"
echo ""
echo "---Start of OPTIONAL commands---"
cat <<EOF >optional_cmds.txt
../shared/bin/pk12util -d . -P slapd-$HOST- -o cacert.pfx -n "CA
certificate"
../shared/bin/pk12util -d . -P slapd-$HOST- -o servercert.pfx -n
"Server-Cert"
../shared/bin/certutil -L -d . -P slapd-$HOST- -n "CA
certificate" \
-a > cacert.asc
../shared/bin/certutil -L -d . -P slapd-$HOST- -n "CA
certificate" \
-r > cacert.der
../shared/bin/certutil -A -d . -P admin-serv-$HOST- -n "CA
certificate" \
-t "CT,," -a -i cacert.asc
EOF
cat optional_cmds.txt
echo "---End of OPTIONAL commands---"
echo ""
echo "Modifying server SSL configurations."
echo "NOTE: changes will be saved to config/dse.ldif when slapd
is shutdown"
cat <<EOF >/tmp/ssl_enable.ldif
dn: cn=encryption,cn=config
changetype: modify
replace: nsSSL3
nsSSL3: on
-
replace: nsSSLClientAuth
nsSSLClientAuth: allowed
-
add: nsSSL3Ciphers
nsSSL3Ciphers:
-rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5,
+rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_sha,+fortezz
a,
+fortezza_rc4_128_sha,+fortezza_null,+tls_rsa_export1024_with_rc4_56_sha
,
+tls_rsa_export1024_with_des_cbc_sha
-
add: nsKeyfile
nsKeyfile: alias/slapd-$HOST-key3.db
-
add: nsCertfile
nsCertfile: alias/slapd-$HOST-cert8.db
dn: cn=config
changetype: modify
add: nsslapd-security
nsslapd-security: on
-
replace: nsslapd-ssl-check-hostname
nsslapd-ssl-check-hostname: off
EOF
../shared/bin/ldapmodify -D "cn=Directory Manager" -w `cat
/home/ldap/dirmgr.pwd` -f /tmp/ssl_enable.ldif
cat <<EOF >/tmp/delRSA.ldif
cn=RSA,cn=encryption,cn=config
EOF
../shared/bin/ldapdelete -c -D "cn=Directory Manager" -w `cat
/home/ldap/dirmgr.pwd` -f /tmp/delRSA.ldif
[ $? -eq 0 ] && echo "deleting cn=RSA,cn=encryption,cn=config"
cat <<EOF >/tmp/addRSA.ldif
dn: cn=RSA,cn=encryption,cn=config
objectclass: top
objectclass: nsEncryptionModule
cn: RSA
nsSSLPersonalitySSL: Server-Cert
nsSSLToken: internal (software)
nsSSLActivation: on
EOF
../shared/bin/ldapmodify -a -c -D "cn=Directory Manager" -w `cat
/home/ldap/dirmgr.pwd` -f /tmp/addRSA.ldif
echo "Creating a pin.txt for auto-starting of slapd."
echo "Internal (Software) Token:`cat pwdfile.txt`"
>slapd-$HOST-pin.txt
chown $SLAPD_OWNER:$SLAPD_GROUP slapd-$HOST-pin.txt
chmod 400 slapd-$HOST-pin.txt
echo ""
echo "IMPORTANT NOTES:"
echo ""
echo "1. How to check if SSL Configurations are done properly?"
echo "You may view config/dse.ldif after shutting down slapd"
echo "to verify all the required SSL configurations are there."
echo ""
echo "2. How to fix slapd startup issue due to mis-configuration
of SSL?"
echo "If for any reason slapd fails to start due to SSL issue,"
echo "you may edit config/dse.ldif after shutting down slapd"
echo "and revert back to non-SSL configs."
echo "i.e. set nsSSL3: off, nsslapd-security: off"
echo "and then try to restart slapd."
echo ""
=======Sample run.
# ./cr_ssl_certs_fds1ldap.sh
Backing up existing *.db (if any) to backup_Wed.
Creating new security key3.db/cert8.db pair.
Generating encryption key.
Generating key. This may take a few moments...
Generating self-signed CA certificate.
Generating key. This may take a few moments...
Generating self-signed Server certificate.
Generating key. This may take a few moments...
Renaming and linking modified security DBs.
Setting the correct ownership of security DBs
Self-signed CA and SSL Server certs generated.
The following commands are OPTIONAL.
They are for backing up CA and Server Certs in PK12 format,
exporting the CA Cert in ASCII format or DER format, and
importing the CA Cert into the Admin Server
---Start of OPTIONAL commands---
../shared/bin/pk12util -d . -P slapd-nj1net200plmon- -o
cacert.pfx -n "CA certificate"
../shared/bin/pk12util -d . -P slapd-nj1net200plmon- -o
servercert.pfx -n "Server-Cert"
../shared/bin/certutil -L -d . -P slapd-nj1net200plmon- -n "CA
certificate" -a > cacert.asc
../shared/bin/certutil -L -d . -P slapd-nj1net200plmon- -n "CA
certificate" -r > cacert.der
../shared/bin/certutil -A -d . -P admin-serv-nj1net200plmon- -n
"CA certificate" -t "CT,," -a -i cacert.asc
---End of OPTIONAL commands---
Modifying server SSL configurations.
NOTE: changes will be saved to config/dse.ldif when slapd is
shutdown
modifying entry cn=encryption,cn=config
ldap_modify: Type or value exists
deleting cn=RSA,cn=encryption,cn=config
adding new entry cn=RSA,cn=encryption,cn=config
Creating a pin.txt for auto-starting of slapd.
IMPORTANT NOTES:
1. How to check if SSL Configurations are done properly?
You may view config/dse.ldif after shutting down slapd
to verify all the required SSL configurations are there.
2. How to fix slapd startup issue due to mis-configuration of
SSL?
If for any reason slapd fails to start due to SSL issue,
you may edit config/dse.ldif after shutting down slapd
and revert back to non-SSL configs.
i.e. set nsSSL3: off, nsslapd-security: off
and then try to restart slapd.
18 years
RE: **Caution-External**: RE: [Fedora-directory-users]: SSL directory server gateway, one-button SSL Certs (slapd + Admin Server) generation script
by Tay, Gary
Sorry for being "blind", I found the script at the very first "This"
word. May be "This" should be changed to "This setupssl.sh", just to
help people like me.
Gary
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com
[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Tay,
Gary
Sent: Thursday, April 20, 2006 4:46 PM
To: General discussion list for the Fedora Directory server project.
Subject: **Caution-External**: RE: [Fedora-directory-users]: SSL
directory server gateway,one-button SSL Certs (slapd + Admin Server)
generation script
I couldn't find setupssl.sh anywhere on the HowTo SSL link.
Anyway, I have written cr_ssl_certs.sh which works for both FDS and
SUN-ONE DS, and this script will create also the Admin Server SSL Cert
(the same as slapd), once you have used Admin Console to enable SSL for
Admin Server at "Encryption" TAB, you would see a few .conf files
including console.conf get updated at $SERVER_ROOT/admin-serv/config,
the rest is history.
Note that it is not a MUST to create different CA Certs for different
FDS Servers, they are so for testing purposes only, for production
usage, you would most likely purchase signed SSL Server Certs for your
different FDS Servers
HTH.
Gary
Content of cr_ssl_certs.sh
#! /bin/sh
#
# cr_ssl_certs.sh - This script works for either Fedora or SUN-ONE DS #
# Gary Tay # # 1) Make sure 'root' is used to run this script # 2) Make
sure /home/ldap/dirmgr.pwd contains password of cn=Direcyory Manager #
#set -vx IS_ROOT_UID=`id | grep "uid=0(root)"` if [ ! -n "$IS_ROOT_UID"
]; then
echo "Please run this script as root"
exit 1
fi
chmod 700 $0
if [ ! -f /home/ldap/dirmgr.pwd ]; then
echo "Please setup /home/ldap/dirmgr.pwd."
exit 1
else
chmod 600 /home/ldap/dirmgr.pwd
fi
# Pls customize the followings
HOST=`hostname`
DOMAIN="example.com"
BASEDN="dc=example,dc=com"
FQDN="$HOST.$DOMAIN"
ORG="Example Companies"
LOCALITY="NewYork City"
STATE="NewYork"
COUNTRY="US"
# Uncomment for Fedora/RedHat Directory Server
SERVER_ROOT="/opt/fedora-ds" # Uncomment for SUN-ONE/Java System
Directory Server #SERVER_ROOT="/var/Sun/mps" if [ "$SERVER_ROOT" =
"/opt/fedora-ds" ]; then
LD_LIBRARY_PATH=$SERVER_ROOT/lib:$SERVER_ROOT/shared/lib
SLAPD_OWNER="ldap"
SLAPD_GROUP="ldap"
TAR_CVF="tar -Pcvf"
TAR_XVF="tar -Pxvf"
fi
if [ "$SERVER_ROOT" = "/var/Sun/mps" ]; then
LD_LIBRARY_PATH=$SERVER_ROOT/lib
SLAPD_OWNER="root"
SLAPD_GROUP="root"
TAR_CVF="tar -cvf"
TAR_XVF="tar -xvf"
fi
export LD_LIBRARY_PATH
PATH=$SERVER_ROOT/shared/bin:$PATH; export PATH
echo "Please shutdown slapd and Admin Server and perform a tar backup"
echo "and db2ldif backup of currently working system, and restart them
again." echo "Example of tar command: $TAR_CVF /var/tmp/ds_backup.tar
$SERVER_ROOT" echo "When you are ready, answer Yes and press Enter to
continue." echo "Press Ctrl-C to cancel." read READY [ "$READY" != "Yes"
] && exit 1 echo "Enter an UNIQUE SERIAL NUMBER for CA Cert." echo "Eg:
1000 for ldap1, 2000 for ldap2, 3000 for ldap3, etc..." read
UNIQUE_SN_CA echo "Enter an UNIQUE SERIAL NUMBER for LDAP Server Cert."
echo "Eg: 1001 for ldap1, 1002 for ldap2, 1003 for ldap3." read
UNIQUE_SN_LDAP cd $SERVER_ROOT/alias echo "Backing up existing *.db (if
any) to backup_$$." mkdir -p backup_$$ >/dev/null 2>/dev/null cp -p *.db
backup_$$ >/dev/null 2>/dev/null /bin/rm -f *.db >/dev/null 2>/dev/null
echo "secretpwd" >pwdfile.txt chmod 600 pwdfile.txt echo
"dsadasdasdasdadasdasdasdasdsadfwerwerjfdksdjfksdlfhjsdk"
>noise.txt
echo "Creating new security key3.db/cert8.db pair."
../shared/bin/certutil -N -d . -f pwdfile.txt echo "Generating
encryption key." ../shared/bin/certutil -G -d . -z noise.txt -f
pwdfile.txt echo "Generating self-signed CA certificate."
../shared/bin/certutil -S -n "CA certificate" \
-s "cn=CAcert $HOST" -x \
-t "CT,," -m $UNIQUE_SN_CA -v 120 -d . -z noise.txt -f pwdfile.txt
echo "Generating self-signed Server certificate." ../shared/bin/certutil
-S -n "Server-Cert" \
-s "cn=$FQDN,O=$ORG,L=$LOCALITY,ST=$STATE,C=$COUNTRY" -c "CA
certificate" \
-t "u,u,u" -m $UNIQUE_SN_LDAP -v 120 -d . -z noise.txt -f pwdfile.txt
echo "Renaming and linking modified security DBs." mv -f key3.db
slapd-$HOST-key3.db mv -f cert8.db slapd-$HOST-cert8.db ln -s
slapd-$HOST-key3.db key3.db ln -s slapd-$HOST-cert8.db cert8.db echo
"Setting the correct ownership of security DBs" chown
$SLAPD_OWNER:$SLAPD_GROUP *.db echo "Self-signed CA and SSL Server certs
generated." echo "" echo "The following commands are OPTIONAL." echo
"They are for backing up CA and Server Certs in PK12 format." echo ""
echo "---Start of OPTIONAL commands---" cat <<EOF >optional_cmds.txt
../shared/bin/pk12util -d . -P slapd-$HOST- -o cacert.pfx -n "CA
certificate" ../shared/bin/pk12util -d . -P slapd-$HOST- -o
servercert.pfx -n "Server-Cert" EOF cat optional_cmds.txt echo "---End
of OPTIONAL commands---" echo "" # echo "Enabling SSL." echo "NOTE:
changes will be saved to config/dse.ldif when slapd is shutdown" cat
<<EOF >/tmp/ssl_enable.ldif
dn: cn=encryption,cn=config
changetype: modify
replace: nsSSL3
nsSSL3: on
-
replace: nsSSLClientAuth
nsSSLClientAuth: allowed
dn: cn=config
changetype: modify
add: nsslapd-security
nsslapd-security: on
EOF
if [ "$SERVER_ROOT" = "/opt/fedora-ds" ]; then
cat <<EOF >>/tmp/ssl_enable.ldif
dn: cn=config
replace: nsslapd-ssl-check-hostname
nsslapd-ssl-check-hostname: off
EOF
fi
../shared/bin/ldapmodify -D "cn=Directory Manager" -w `cat
/home/ldap/dirmgr.pwd` -f /tmp/ssl_enable.ldif [ $? -eq 0 ] && \
echo "Enabling SSL in cn=encryption,cn=config and cn=config done." [
$? -ne 0 ] && \
echo "Enabling SSL in cn=encryption,cn=config and cn=config failed."
# cat <<EOF >/tmp/add_ssl_configs.ldif
dn: cn=encryption,cn=config
changetype: modify
add: nsSSL3Ciphers
nsSSL3Ciphers:
-rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5,
+rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_sha,+fortezz
a,
+fortezza_rc4_128_sha,+fortezza_null,+tls_rsa_export1024_with_rc4_56_sha
,
+tls_rsa_export1024_with_des_cbc_sha
-
add: nsKeyfile
nsKeyfile: alias/slapd-$HOST-key3.db
-
add: nsCertfile
nsCertfile: alias/slapd-$HOST-cert8.db
EOF
../shared/bin/ldapmodify -D "cn=Directory Manager" -w `cat
/home/ldap/dirmgr.pwd` -f /tmp/add_ssl_configs.ldif [ $? -eq 0 ] && echo
"Adding SSL configs in cn=encryption,cn=config done." [ $? -ne 0 ] &&
echo "Adding SSL configs in cn=encryption,cn=config failed." # cat <<EOF
>/tmp/addRSA.ldif
dn: cn=RSA,cn=encryption,cn=config
objectclass: top
objectclass: nsEncryptionModule
cn: RSA
nsSSLPersonalitySSL: Server-Cert
nsSSLToken: internal (software)
nsSSLActivation: on
EOF
../shared/bin/ldapmodify -a -c -D "cn=Directory Manager" -w `cat
/home/ldap/dirmgr.pwd` -f /tmp/addRSA.ldif [ $? -eq 0 ] && echo "Adding
cn=RSA,cn=encryption,cn=config done." [ $? -ne 0 ] && echo "Adding
cn=RSA,cn=encryption,cn=config failed." # echo "Creating a pin.txt for
auto-starting of slapd." echo "Internal (Software) Token:`cat
pwdfile.txt`" >slapd-$HOST-pin.txt chown $SLAPD_OWNER:$SLAPD_GROUP
slapd-$HOST-pin.txt chmod 400 slapd-$HOST-pin.txt echo "Exporting the CA
Cert in ASCII format or DER format" ../shared/bin/certutil -L -d . -P
slapd-$HOST- -n "CA certificate" \
-a > cacert.asc
../shared/bin/certutil -L -d . -P slapd-$HOST- -n "CA certificate" \
-r > cacert.der
echo "Copying Server-Cert to Admin Server for Admin Server SSL
connection." cp slapd-$HOST-key3.db admin-serv-$HOST-key3.db cp
slapd-$HOST-cert8.db admin-serv-$HOST-cert8.db echo "Setting the correct
ownership of Admin Server security DBs" chown $SLAPD_OWNER:$SLAPD_GROUP
admin-serv-$HOST-*.db echo "Remember to enable SSL in Admin Server
later." echo "Remember to select 'Server-Cert' as the Certificate and
click OK." echo "Remember to restart Admin Server after that." echo
"Creating a pin.txt for auto-starting of Admin Server." echo "`cat
pwdfile.txt`" >admin-serv-$HOST-pin.txt chown $SLAPD_OWNER:$SLAPD_GROUP
admin-serv-$HOST-pin.txt chmod 400 admin-serv-$HOST-pin.txt echo
"Patching start-admin and creating start-admin.auto." if [
"$SERVER_ROOT" = "/opt/fedora-ds" ]; then sed -e \
'/^\$HTTPD/s/$/
\<"$SERVER_ROOT"\/alias\/admin-serv-`hostname`-pin.txt/' \
$SERVER_ROOT/start-admin >$SERVER_ROOT/start-admin.auto
fi
if [ "$SERVER_ROOT" = "/var/Sun/mps" ]; then
sed -e \
'/uxwdog/s/$/
\<"$SERVER_ROOT"\/alias\/admin-serv-`hostname`-pin.txt/' \
$SERVER_ROOT/start-admin >$SERVER_ROOT/start-admin.auto
fi
chmod 755 $SERVER_ROOT/start-admin.auto
echo "Please use $SERVER_ROOT/start-admin.auto in rc3.d as autostart
script." echo "" echo "IMPORTANT NOTES:" echo "" echo "1. How to check
if SSL Configurations are done properly?" echo "You may view
config/dse.ldif after shutting down slapd" echo "to verify all the
required SSL configurations are there." echo "" echo "2. How to fix
slapd startup issue due to mis-configuration of SSL?" echo "If for any
reason slapd fails to start due to SSL issue," echo "you may edit
config/dse.ldif after shutting down slapd" echo "and revert back to
non-SSL configs." echo "i.e. set nsSSL3: off, nsSSLActivation: off and
nsslapd-security: off" echo "and then try to restart slapd." echo ""
echo "3. How to fix Admin Server login issue due to mis-configuration of
SSL?" echo "If for any reason Admin Server login fails and you wish to
give up," echo "simply stop slapd and admin-serv and restore using the
tar backup" echo "i.e. rm -f $SERVER_ROOT/alias/*.db;$TAR_XVF
/var/tmp/ds_backup.tar" echo ""
===Sample Run===
# ./cr_ssl_certs.sh
Please shutdown slapd and Admin Server and perform a tar backup and
db2ldif backup of currently working system, and restart them again.
Example of tar command: tar -cvf /var/tmp/ds_backup.tar /var/Sun/mps
When you are ready, answer Yes and press Enter to continue. Press Ctrl-C
to cancel. Yes Enter an UNIQUE SERIAL NUMBER for CA Cert.
Eg: 1000 for ldap1, 2000 for ldap2, 3000 for ldap3, etc...
1000
Enter an UNIQUE SERIAL NUMBER for LDAP Server Cert.
Eg: 1001 for ldap1, 1002 for ldap2, 1003 for ldap3.
1001
Backing up existing *.db (if any) to backup_24872.
Creating new security key3.db/cert8.db pair.
Generating encryption key.
Generating key. This may take a few moments...
Generating self-signed CA certificate.
Generating key. This may take a few moments...
Generating self-signed Server certificate.
Generating key. This may take a few moments...
Renaming and linking modified security DBs.
Setting the correct ownership of security DBs
Self-signed CA and SSL Server certs generated.
The following commands are OPTIONAL.
They are for backing up CA and Server Certs in PK12 format.
---Start of OPTIONAL commands---
../shared/bin/pk12util -d . -P slapd-ldap1- -o cacert.pfx -n "CA
certificate" ../shared/bin/pk12util -d . -P slapd-ldap1- -o
servercert.pfx -n "Server-Cert" ---End of OPTIONAL commands---
Enabling SSL.
NOTE: changes will be saved to config/dse.ldif when slapd is shutdown
modifying entry cn=encryption,cn=config
modifying entry cn=config
Enabling SSL in cn=encryption,cn=config and cn=config done. modifying
entry cn=encryption,cn=config
Adding SSL configs in cn=encryption,cn=config done.
adding new entry cn=RSA,cn=encryption,cn=config
Adding cn=RSA,cn=encryption,cn=config done.
Creating a pin.txt for auto-starting of slapd.
Exporting the CA Cert in ASCII format or DER format
Copying Server-Cert to Admin Server for Admin Server SSL connection.
Setting the correct ownership of Admin Server security DBs Remember to
enable SSL in Admin Server later. Remember to select 'Server-Cert' as
the Certificate and click OK. Remember to restart Admin Server after
that. Creating a pin.txt for auto-starting of Admin Server. Patching
start-admin and creating start-admin.auto. Please use
/var/Sun/mps/start-admin.auto in rc3.d as autostart script.
IMPORTANT NOTES:
1. How to check if SSL Configurations are done properly?
You may view config/dse.ldif after shutting down slapd
to verify all the required SSL configurations are there.
2. How to fix slapd startup issue due to mis-configuration of SSL? If
for any reason slapd fails to start due to SSL issue, you may edit
config/dse.ldif after shutting down slapd and revert back to non-SSL
configs. i.e. set nsSSL3: off, nsSSLActivation: off and
nsslapd-security: off and then try to restart slapd.
3. How to fix Admin Server login issue due to mis-configuration of SSL?
If for any reason Admin Server login fails and you wish to give up,
simply stop slapd and admin-serv and restore using the tar backup i.e.
rm -f /var/Sun/mps/alias/*.db;tar -xvf /var/tmp/ds_backup.tar
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com
[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Jason
Russler
Sent: Thursday, April 20, 2006 4:15 AM
To: General discussion list for the Fedora Directory server project.
Subject: [Fedora-directory-users] SSL directory server gateway
Hi all,
I'm pretty uncertain about the best way to go about configuring the
admin server to use SSL (FDS1.0.2) . All of the docs I'm finding are
pretty shaky. Ultimately, I want users to manage their passwords and
info via the web-based Directory Server Gateway over SSL. This would
appear to be the same thing as enabling SSL for the admin server. The
setupssl.sh script provided by the SSL howto, generates the keys/certs
for the admin server and imports them into the appropriate cert db (I
guess, I've performed the process by hand as well, based on RedHat's
docs and the script itself). This would imply to me that the admin
console would find the generated certs and present them in the admin
server's console (under the Configuration -> Encryption tab) in much the
same way that it does in the directory server's console. I can't tell
if something that's suppose to work isn't or if I'm misunderstanding
something. I'd like to know before I try to generate new SSL
certificates and import them.
Thanks much,
Jason
--
Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
--
Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
18 years
RE: [Fedora-directory-users] Exporting MD5 Hash from FD-DS into/etc/shadow
by DeMarco, Dennis
I had some time to play with this. I do not believe it can be done
easily unless another password storage mechanism is made as a plug-in.
The GNU-MD5 password format for /etc/shadow I believe is:
$1$, followed by an 8 character salt, $, 22 character hash.
Seems like something that could be very useful though. I have some
servers in which are considered super 'production' not in LDAP but liked
to export users from LDAP to make /etc/passwd/shadows.
- Dennis
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com
[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Howard
Chu
Sent: Wednesday, April 19, 2006 4:05 PM
To: fedora-directory-users(a)redhat.com
Subject: Re: [Fedora-directory-users] Exporting MD5 Hash from FD-DS
into/etc/shadow
fedora-directory-users-request(a)redhat.com wrote:
> Date: Tue, 18 Apr 2006 20:14:31 +0300
> From: Mike Jackson <mj(a)sci.fi>
>
> dennis(a)demarco.com wrote:
>
>> I would like to export the MD5 hash from the Fedora directory user's
>> password attribute into /etc/shadow of a Linux machine not in LDAP
>> (Redhat).
>>
>> It appears this isn't working, is there a way for me to do this? Not
all
>> machines are using ldap but I would like to export from ldap.
>>
>
>
> Hi,
> I haven't tried this, but here's an idea just off the top of my head
> which _might_ work:
>
>
> 1. take away the {MD5} from the string
>
> 2. base64 decode the rest of the string
>
> 3. convert the string to hex
>
> 4. put the $1$ at the front of the hex string
>
> 5. put the whole string into the password field in /etc/shadow and
test
>
>
> If that works, you could write a perl script to automate the
procedure.
> And report back to the list as well :-)
>
>
No, the password field is not in hex, it uses the same 6-bit encoding
that DES crypt() uses, which is different from base64. base64 uses the
characters [A-Z][a-z][0-9]+/ while crypt uses the characters
./[0-9][A-Z][a-z] (in those exact orders).
--
-- Howard Chu
Chief Architect, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc
OpenLDAP Core Team http://www.openldap.org/project/
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
This message (including any attachments)
contains confidential information intended for a
specific individual and purpose, and is protected
by law. If you are not the intended recipient, you
should delete this message. Any disclosure,
copying, or distribution of this message, or the
taking of any action based on it, is strictly
prohibited.
18 years
Re: [Fedora-directory-users] Exporting MD5 Hash from FD-DS into /etc/shadow
by Howard Chu
fedora-directory-users-request(a)redhat.com wrote:
> Date: Tue, 18 Apr 2006 20:14:31 +0300
> From: Mike Jackson <mj(a)sci.fi>
>
> dennis(a)demarco.com wrote:
>
>> I would like to export the MD5 hash from the Fedora directory user's
>> password attribute into /etc/shadow of a Linux machine not in LDAP
>> (Redhat).
>>
>> It appears this isn't working, is there a way for me to do this? Not all
>> machines are using ldap but I would like to export from ldap.
>>
>
>
> Hi,
> I haven't tried this, but here's an idea just off the top of my head
> which _might_ work:
>
>
> 1. take away the {MD5} from the string
>
> 2. base64 decode the rest of the string
>
> 3. convert the string to hex
>
> 4. put the $1$ at the front of the hex string
>
> 5. put the whole string into the password field in /etc/shadow and test
>
>
> If that works, you could write a perl script to automate the procedure.
> And report back to the list as well :-)
>
>
No, the password field is not in hex, it uses the same 6-bit encoding
that DES crypt() uses, which is different from base64. base64 uses the
characters [A-Z][a-z][0-9]+/ while crypt uses the characters
./[0-9][A-Z][a-z] (in those exact orders).
--
-- Howard Chu
Chief Architect, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc
OpenLDAP Core Team http://www.openldap.org/project/
18 years
Re: [Fedora-directory-users] upperlimit on uidNumber
by Mike Jackson
> I was wondering if there is an upper limit on the uid or the gidNumber in
> fds.
> Or is there a limit on OS level? Does anyone know what it is? Is this
> different between the RedHat releases?
> Is it different from other Unixes?
I have personally loaded 10 million user accounts into FDS as a performance test (on a measly 2.4Ghz P4 machine with 512MB of RAM), and it worked just fine; not sure how many it could theoretically hold.
The linux kernel has officially had support for 32-bit uidnumbers since kernel v2.4, so the maximum user id number is 4294967295, or approximately 4.3 billion. This is the same on any distribution using kernel 2.4 or newer. I am not sure about UNIX...
--
mike
18 years
[Fedora-directory-users] upperlimit on uidNumber
by Jo De Troy
Hello,
I was wondering if there is an upper limit on the uid or the gidNumber in
fds.
Or is there a limit on OS level? Does anyone know what it is? Is this
different between the RedHat releases?
Is it different from other Unixes?
Thanks in advance,
Jo
18 years
