September 2007 - 389-users - Fedora mailing-lists

[Fedora-directory-users] Centos5 does not install
by Maurizio Marini 28 Feb '08

28 Feb '08

As stated clearly here: http://www.mail-archive.com/fedora-directory-users@redhat.com/msg02579.html linux distro should be support apache 2.0 not 2.2 m.

3 3

[Fedora-directory-users] samba + PDC + FDS
by Satish Patel 06 Nov '07

06 Nov '07

dear all it is possible to implement samba as PDC + FDS and it will give fully functionality like Win 2003 DC ?? Regards $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- Forgot the famous last words? Access your message archive online. Click here.

2 1

[Fedora-directory-users] How can you monitor replication?
by Ian Meyer 02 Oct '07

02 Oct '07

Hello, We have a decent sized env. (1 master, 16 slaves in different datacenters across the world) and we're trying to find a way to effectively monitor the status of replication. When was the last update? How many changes were made? How long did it take from start to finish? I know you can get most of this information from the gui, but we need to tie it in to our monitoring application. Is this information stored in a db anywhere? In ldap itself? Any insight would be appreciated. Thanks in advance! - Ian

4 4

[Fedora-directory-users] glibc errors
by Bjorn Oglefjorn 29 Sep '07

29 Sep '07

I am trying to track down the cause of some errors that have been occurring on a number of our servers using LDAP. We have noticed that when a certain LDAP group exceeds 65 users we begin seeing glibc errors for users in the group. Users that are not in the group do not exhibit this behavior. We have seen this issue on machines running Centos 4.5 x86 & x86_64 with glibc-2.3.4-2.36 and RH4 x86_64 running glibc-2.3.4-2.25. We are running Fedora Directory Server 1.0.4 on Centos 4.5. We have added a 3rd FDS slave and turned up debugging but have not seen anything that appears to be relevant in the logs on the 3rd slave. This problem is not a 65 user limit as we have other groups with well over 65 members that do not display this behavior. We also created a new group with identical users and it did not display this problem. 1) With 66 users in the massweb group [root@megalon ~]# getent group massweb *** glibc detected *** free(): invalid next size (normal): 0x09a225b0 *** Aborted 2) After removing any user from the massweb group to reduce the total members to 65 [root@megalon ~]# getent group massweb massweb:x:3016:afaxon,ashairza,ccrump,jhorowit,mmarum,morendai,usmall,adroffne,afaxon,amurphre,aoliver,ayellipe,bdonohue,bdunn,beckert,blarsen,bwphilli,catanis,ccrump,chaynes,clyons,cwong,dbarber,dmuse,dnicol,edougher,egallant,ekubosia,evizcain,feeddrop,gtulonen,halokush,hbraverm,jbartus,jbrown,jhobbs,jking,jlederma,jpecora,jthayer,kbalbedi,kbeam,kginn,mbuonfig,mcrawfor,mlarsen,mlong,mwalsh,osedano,proche,prondeau,pweinber,rhorriga,rkersey,rskutins,sasaro,sbrodeur,sculver,smoriart,support,swestenh,tbaltimo,torgelfi,usmall,vvalenti Has anyone encountered a similar problem? Any suggestions would be most welcome. Best regards

4 3

[Fedora-directory-users] libatomic.o missing; Solaris 8 Build
by Jason 28 Sep '07

28 Sep '07

hello, I'm trying to compile FDS 1.0.4 on a 280R running Solaris 8. After getting all of the prerequisites installed (gnu make, apr, ant, sun workshop compiler, etc) I started following the directions located here: http://www.directory.fedora.redhat.com/wiki/Building#External_Requirements I created my ldap directory, and downloaded the mozilla components tarball linked. I successfully compiled NSS via 'gmake nss_build all' I successfully compiled SVRCORE Next, I attempted to compile LDAPSDK (mozilla/directory/c-sdk) but I get a File not found error when it tries to link libatomic.o. About the only thing I've been able to learn from a few hours of google is that it appears that libatomic.o should come from NSPR, which, in theory, was compiled during the gmake nss_build_all according to the build documentation. Unfortunately, I cannot find libatomic.o anywhere on the system. Is there a way to get past this problem? Am I crazy for expecting this to compile on solaris even though solaris support is listed? Is there a better build guide I should be following? I've copied the compile errors below, in case it helps anyone see what's going on. Any help that can be provided is greatly appreciated! ~Jason ======= making ./libldap60.so gcc -shared -Wl,-soname -Wl,libldap60.so -f libatomic.so -o libldap60.so./abandon.o ./add.o ./bind.o ./cache.o ./charray.o ./charset.o ./compare.o ./compat.o ./control.o ./countvalues.o ./delete.o ./disptmpl.o ./dsparse.o ./error.o ./extendop.o ./free.o ./freevalues.o ./friendly.o ./getattr.o ./getdn.o ./getdxbyname.o ./getentry.o ./getfilter.o ./getoption.o ./getvalues.o ./memcache.o ./message.o ./modify.o ./open.o ./os-ip.o./proxyauthctrl.o ./psearch.o ./pwmodext.o ./referral.o ./regex.o ./rename.o ./request.o ./reslist.o ./result.o ./saslbind.o ./sbind.o ./search.o ./setoption.o ./sort.o ./sortctrl.o ./srchpref.o ./tmplout.o ./ufn.o ./unbind.o ./unescape.o ./url.o ./utf8.o ./vlistctrl.o ./saslio.o -L../../../../../dist/lib -llber60 gcc: libatomic.so: No such file or directory gmake[3]: *** [libldap60.so] Error 1 gmake[3]: Leaving directory `/root/ldap/mozilla/directory/c-sdk/ldap/libraries/libldap' gmake[2]: *** [export] Error 2

3 3

[Fedora-directory-users] fds vs passsync vs AD
by Paolo Barbato 28 Sep '07

28 Sep '07

Hi all! I've succesfully installed fds and passync msi on windows AD. I admit that some probem have arisen since documentation is a bit poor on SSL part, especially on AD, but then finally I was able to make things works. I'm facing an odd problem that I'm not able to understand, but probably already discussed on the list. I'm able to take in sync password in AD and FDS when I change password from AD, but not viceversa. Really from Windows event log things seem go right: it tell me that pasword has been succesfully updated (passwd is issued from linux). But that stored password is somewhat different . Could be an encryption problem ? Any hints ? Regards, Paolo. -- ------------------------------------------------------------------------------------------------ Paolo Barbato email: mailto:paolo.barbato@igi.cnr.it Network Administrator phone: (39-049)-829-5097 (39-049)-829-5000 Corso Stati Uniti,4 www: http://www.igi.cnr.it 35127 Camin-Padova PGP: http://www.igi.cnr.it/wwwpgp/rfx_paolo_barbato.pgp ITALY JabberID: rfx_paolo_barbato(a)messenger.efda.org ------------------------------------------------------------------------------------------------

5 9

[Fedora-directory-users] Active Directory Password Question
by Dusty Herrman 27 Sep '07

27 Sep '07

I work for a University where Microsoft and Unix/Linux products are both heavily present. We currently have both MS Active Directory servers and OpenLDAP servers. We are currently looking at upgraded both of these technologies. Currently we store all the user's passwords in LDAP (encrypted). Using the "Windows Sync" feature of Fedora DS, is there a way to push the encrypted passwords into Active Directory? Or is it only a AD -> LDAP password push? Thanks in advance, Dusty Herrman KEAS Authentication/Directory Engineer Kansas State University djh5983(a)k-state.edu

3 2

[Fedora-directory-users] white space at the end of attributes that refuses to go away
by Edward Capriolo 27 Sep '07

27 Sep '07

I am having an issue that may be related to multi-master replication, or it may be related to a non viewable ascii value in an attribute. We have a custom schema. We have a multivalued attribute departalloweddomain this attribute has three values inside it. "a.com" "b.com " "c.com " My goal is to remove the trailing white space. Which may be a space or a weird character. I have tried deleting the individual values and re-adding them. I attempted to delete the entire attribute and re-add. The value keeps appearing like so. "b.com " Any ideas on how to clean this up. We do thousands of add and remove operations a day and this has happened a few times.

6 11

[Fedora-directory-users] Dynamic Groups and PAM/NSS _ldap
by Rubin 27 Sep '07

27 Sep '07

Hi Group, A while ago there was a discussion here about dynamic groups and the fact that the client(s) needs to handle this. I've been working with RHDS in combination with HP's LDAP-UX, where the client side of LDAP-UX does something smart to get dynamic groups working as posix groups, which is really really cool. Essentially, you get dynamic posix groups and a getent group (or grget on hp-ux) return the group including all dynamic (memberURL) and static (memberuid) members of a group. I'm trying to get a conclusive answer about if this is possible under linux. I thought pam_member_attribute would come to the rescue in this case, but that does not seem to work. So: is it possible to have dynamic members in a posix group under linux using nss_ldap and pam_ldap so a "getent group" returns dynamic members? If not, is there somebody working on it? or maybe even a commercial tool/add-on? Kind regards, Rubin.

1 0

[Fedora-directory-users] Five-way MMR
by Kimmo Koivisto 26 Sep '07

26 Sep '07

Hello I have five servers with FDS 1.0.4 and I would like to use multimaster replication in those servers. I know that there is some kind of limit for the number of servers in MMR, four servers is the maximun if I remember correctly. So, can I add replication agreements to five servers, is there a hardcoded limit for four servers or what? What happends if I add those agreements? Regards, Kimmo Koivisto

2 1

[Fedora-directory-users] Email and LDAP
by Trever L. Adams 26 Sep '07

26 Sep '07

I am very sorry if this is an easy question to answer. I have tried OpenLDAP and FDS several times. I just can't seem to get it to do what I want. I am trying to setup a directory server for my folks (may expand to the entire family). Basically, I would like the following features: * Global directory where all common contacts are stored * Private directories where all private/non-common contacts are stored The above terminology may not match common LDAP terminology. They are using Thunderbird on more than one computer in Windows and Linux, hence the desire to get it out of the Thunderbird and into an LDAP server. I would love it if I could have authentication be against an Active Directory (which I may be moving them too soon), but this is not necessary. How do I do access control for write to the private directories? How do I do control on the global? How do I even get it working? I am sorry, as I said, I have read many howtos and just can't seem to get anywhere. I am not stupid, but I am ignorant when it comes to LDAP. Thank you for any help. Trever Adams

1 0

[Fedora-directory-users] Disabling SASL
by David Partridge 25 Sep '07

25 Sep '07

How do you disable SASL if there is no requirement to support? David Partridge Lead Engineer DoD Joint Enerprise Directory Server

1 0

[Fedora-directory-users] posixaccount and shadowlastchange
by Victor Hugo dos Santos 25 Sep '07

25 Sep '07

Hello, Linux authentication based in FDS work fine, i log in the system for ssh and all users is in the FDS directory. cool !!! but, i need use police security account for users (for example, in 60 days this users need change the password or can't use the same password 3 times consecutive). but the FDS dont work with shadow parameters, i run "getent passwd" and look all users (local and in FDS) but I run "getent shadow" and only show the local account, none account in the FDS. how is possible manage the security police from posixaccount and more important, that for users continue being one transparent process. URL ?? manual ?? docs ?? others ?? thanks -- -- Victor Hugo dos Santos Linux Counter #224399

3 4

[Fedora-directory-users] slapd_poll timed out error
by Scott Belnap 24 Sep '07

24 Sep '07

Can someone tell me what this error message means or how to resolve it? [24/Sep/2007:09:08:21 -1000] - slapd_poll(255) timed out [24/Sep/2007:09:23:04 -1000] - slapd_poll(249) timed out [24/Sep/2007:09:27:21 -1000] - slapd_poll(248) timed out Thanks.

1 0

[Fedora-directory-users] question about SSL configuration with IP takeover HA setup
by Ryan Braun 21 Sep '07

21 Sep '07

Hey guys, installed FDS on a couple debian servers this week and am liking it so far. I have a couple questions regarding SSL/TLS setup with servers setup for IP takeover type HA setup. Keep in mind I have some experience with the LDAP side of things, it's the ssl and all the different certs and whatnot that keeps me up at night. Essentially what I'm looking at is a 4 way multimaster setup, ending up with 2 HA pairs of servers. call them eastldap and westldap. I've implemented the east side in my test lab and have it replicating and can pull any user info I need off the directory no problem. so eastldap0.test.com ip 192.168.0.11 eastldap1.test.com ip 192.168.0.12 and the virtual interface on whichever machine is master would be eastldap.test.com ip 192.168.0.10 and then the exact same setup with the last 2 westldap0.test.com ip 192.168.1.11 westldap1.test.com ip 192.168.1.12 westldap.test.com ip 192.168.1.10 Once everything is setup and running clients would be primarily only connecting to either virtual interface west/eastldap using TLS over port 389 and the 4 masters replicating with encryption (not sure but I imagine this takes place on ldaps port). I followed the instructions on the howto:ssl page and created a cert located on eastldap0. But instead of using the eastldap0.test.com as the cn, I used eastldap.test.com. Cert installed ok, made sure eastldap0 was the HA master and restarted fds. When I copied over the cacert to a linux client, I can run searches using ldapsearch -ZZ -h eastldap.test.com. Server logs and wire sniffs confirm everything is coming back encrypted. It seems to be behaving as expected, when I try ldapsearch -ZZ -h eastldap0.test.com, it pukes with error 11 additional info: TLS: hostname does not match CN in peer certificate, which is right as the name in the cert is eastldap.test.com. So it would appear I'm on my way, I just am not sure about what certs I need now, and how to add them properly. I would think I need at the very least eastldap0 - eastldap0.test.com cert - eastldap.test.com cert eastldap1 - eastldap1.test.com cert - eastldap.test.com cert westldap0 - westldap0.test.com cert - westldap.test.com cert westldap1 - westldap1.test.com cert - westldap.test.com cert I'm just not sure if that is the proper way to go about it. Also, I would like to have the clients to be able to have all the cacerts to be able to communicate with all virtual and physical address' if need be. Later on, I would be adding probably 5 or 6 consumer read only replicas inbetween the suppliers and the clients, but one must walk before they run I guess :) Long post I know, just trying to make sure I get all the important stuff out there. Be kind if I was using the incorrect terminology for the certs/cacerts :) Ryan PS. anyone have a good SSL for dummies reference that lays out what the heck is going on with SSL (pems,keys,certs,cacerts etc)

3 7

[Fedora-directory-users] Good afternoon .... 1st post by the new guy
by lance raymond 21 Sep '07

21 Sep '07

OK, so not sure how big this list is, but I hope to get better response then on the fedora forums. I will start this on a high/basic level to make sure i am headed in the right direction, We want a central database of users, so naturally I looked at openldap. It's not a 1-2-3 as much as Fedora's directory services seems. So I have installed it on a fedora machine, added my company DN, as well as a few test users. Now I setup my fc7 desktop to look @ him as an ldap server, pointed to that IP and saved. Tried to ssh in as a user not on the local machine but in the directory service thinking he would look to the DS server and authenticate, but it fails. So the high level question is, that is how it's supposed to work right? I used a windows ldap browser and connected, fetched the DN from a dropdown it found (confirming it's running, and has the right context) but couldn't browse the tree (I don't know if DS let's you view the tree via a basic ldap browser) But if the above is the case, there is a lot of reading but no clear cut client setup connect like this. There are pages of tree, scheme, etc. We are a small group 15 people but have 50+ servers, so it would be nice to have a single login place, so any help, step in the right direction will be appreciated. I tried openldap, was able to browse the tree, but the same result when I tried to ssh in as my test user. So I guess I am interested if people are really using this or sticking with another ldap solution. Thanks.

1 0

[Fedora-directory-users] Unknown attribute syntax OID
by James Deuchar 21 Sep '07

21 Sep '07

Hi, I'm trying to create some custom schema via 99user.ldif using: attributeTypes: ( 1.3.6.1.4.1.24813.1.10 NAME 'cmDateOfBirth' DESC 'Date of birth (format YYYYMMDD, only numeric chars)' EQUALITY numericStringMatch SUBSTR numericsNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 SINGLE-VALUE X-ORIGIN 'user defined' ) I'm getting the following error when starting up slapd: # ./start-slapd [21/Sep/2007:11:30:05 +0100] dse - The entry cn=schema in file /opt/fedora-ds/slapd-master01/config/schema/99user.ldif is invalid, error code 21 (Invalid syntax) - attribute type cmDateOfBirth: Unknown attribute syntax OID "1.3.6.1.4.1.1466.115.121.1.36" [21/Sep/2007:11:30:05 +0100] dse - Please edit the file to correct the reported problems and then restart the server As far as I can tell from RFC2252 this should be ok?: Numeric String Y 1.3.6.1.4.1.1466.115.121.1.36 Any ideas? Thanks, James As far as I can tell from RFC2252 this should be ok? _________________________________________________________________ The next generation of MSN Hotmail has arrived - Windows Live Hotmail http://www.newhotmail.co.uk

2 1

[Fedora-directory-users] acls problem
by Gabriele Di Giambelardini 20 Sep '07

20 Sep '07

HI to all, I have a problem with some acls needed from a mail client to visit a address book. I need to restrict for anonymous user, the fileds ( attributes ) he can see. other solution may be, negate to anonymous user access to the ldap and create an specific user for address book, or use the same mail user also for address book. Some body can help me: for restrict accesso to anonymous user? for deny access to ldap for anonymous user? set the right permission for the same user used for mail login?? Thanks, excuse me in advance for my english.

2 3

[Fedora-directory-users] failover works but very slow.
by Hai Wu 19 Sep '07

19 Sep '07

Hi, We are using fedora 1.0.4, When the first ldap server dies and does not ping, the clients can still bind to second server but it is very slow to do anything on clients, opening a terminal or listing a dir takes a few seconds. I find when ldap service is down on the first server but server it still up and pingable, there is no delay on clients at all, so I have the workaround to set up a eth0:0 on second ldap server(or any other machine) to assume the IP of the first ldap server when first ldap server does not ping. Please see our /etc/ldap.conf and /etc/openldap/ldap.conf , we have only Rhel 3 and 4 clients. Any idea how to fix this? Thanks Mark /etc/ldap.conf host 1.1.1.1 2.2.2.2 port 636 ldap_version 3 base o=unix,dc=company,dc=com scope sub timelimit 5 bind_timelimit 3 pam_filter objectclass=posixAccount pam_login_attribute uid pam_member_attribute memberUid pam_password crypt idle_timelimit 3600 /etc/openldap/ldap.conf BASE o=unix,dc=company,dc=com HOST 1.1.1.1 2.2.2.2 PORT 636 SIZELIMIT 0 TIMELIMIT 0

3 7

re: [Fedora-directory-users] Directory Server capabilities
by Howard Chu 19 Sep '07

19 Sep '07

> From: "Clowser, Jeff (Contractor)" <jeff_clowser fanniemae com> > Date: Fri, 14 Sep 2007 14:58:53 -0400 > I have a question about capabilities in the Fedora/RH Directory server: > > First, can it do dynamic groups as Novell eDirectory does (or is there any > effort to add this): > http://support.novell.com/techcenter/articles/ana20020405.html Just fyi, the Novell guys have also published this spec as an Internet Draft. http://tools.ietf.org/html/draft-haripriya-dynamicgroup-02 The spec is full of flaws, however, as discussed here: http://www.openldap.org/lists/ietf-ldapext/200702/threads.html If this approach to dynamic groups is of interest to you, you should probably get involved in the discussion and give some feedback. > Basically, it's similar to the groupofURL's that is supported by the RH/Sun > directory server, but when the group is retrieved, dn's for entries that > match the ldap url dynamic criteria is returned added to the uniquemember > attribute, and you can do searches/compares on the uniquemember attribute > that includes dynamic members. Note that uniqueMember is a useless attribute in LDAP. Likewise the NameAndOptionalUID syntax (which is the syntax of uniqueMember) is totally misused in LDAP and should be avoided by modern software. > I realise there are some significant performance considerations with this, > but for modest use, it would really be useful. (FWIW, I asked a similar > question when FDS first was released, but didn't have another product to > point to as a comparable implementation at the time. Haven't looked at FDS > for a while, so I'm hoping some things might have changed :) ) As a footnote, OpenLDAP supports some of the less controversial features of dynamic groups and has for quite some time already... -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

6 12

[Fedora-directory-users] FDS and Samba3
by Raj Seenivasan 18 Sep '07

18 Sep '07

I have 2 questions to ask. I searched the list and couldn't find anything related... 1. Is there a way to setup samba and FDS on 2 different boxes and use FDS as the backend for samba? FDS wiki (http://directory.fedoraproject.org/wiki/Howto:Samba) has instructions to setup both samba and fds on the same box. What special steps needs to be done if on 2 different boxes? 2. I had setup samba+fds on a single box and password syncing works only one way. FDS --> Samba sync is not working. Passwords changed using smbpasswd gets synced with fds. Am I missing something? Thanks. CONFIDENTIALITY NOTICE: This email message and any attachments contain proprietary and privileged information of Roundbox, Inc., which are provided for the sole and confidential use of the intended recipients. Any review, use, disclosure or distribution of this information is restricted and must comply with the nondisclosure agreement between Roundbox, Inc. and you (or your company). All other uses are prohibited. If you are not an intended recipient, please contact the sender by reply email and promptly delete and otherwise destroy all copies of the message and its attachments.

3 4

[Fedora-directory-users] FDS and Solaris Client Question
by Jeremiah Coleman 18 Sep '07

18 Sep '07

I'm trying to set up a Solaris 10 client with FDS (all my linux clients are working beautifully), but authentication is acting very strange. Monitoring the net traffic, I can see the Solaris system bind, search for info about the username, get a normal response, but then it just unbinds. It never asks to authenticate a password. My configuration is below. Any help would be much appreciated. ldap_client_file: NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_SERVERS= fds1.wherever.com NS_LDAP_SEARCH_BASEDN= dc=wherever,dc=com NS_LDAP_AUTH= simple NS_LDAP_SEARCH_REF= TRUE NS_LDAP_SEARCH_SCOPE= one NS_LDAP_SEARCH_TIME= 30 NS_LDAP_CACHETTL= 43200 NS_LDAP_PROFILE= default NS_LDAP_CREDENTIAL_LEVEL= proxy NS_LDAP_SERVICE_SEARCH_DESC= passwd: ou=People,dc=wherever,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= group: ou=group,dc=wherever,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= shadow: ou=People,dc=wherever,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= netgroup: ou=netgroup,dc=wherever,dc=com?one NS_LDAP_BIND_TIME= 2 /etc/nsswitch.conf (note, I pulled ldap from networks, etc, since not all of that is configured on ldap as yet): # the following two lines obviate the "+" entry in /etc/passwd and /etc/group. passwd: files ldap group: files ldap shadow: files ldap # consult /etc "files" only if ldap is down. hosts: dns files ldap # Note that IPv4 addresses are searched for in all of the ipnodes databases # before searching the hosts databases. ipnodes: files networks: files protocols: files rpc: files ethers: files netmasks: files bootparams: files publickey: files netgroup: ldap automount: files ldap aliases: files ldap # for efficient getservbyname() avoid ldap services: files ldap printers: user files ldap auth_attr: files ldap prof_attr: files ldap project: files ldap tnrhtp: files ldap tnrhdb: files ldap /etc/pam.conf: # login service (explicit because of pam_dial_auth) # login auth required pam_ldap.so.1 login auth requisite pam_authtok_get.so.1 login auth required pam_dhkeys.so.1 login auth required pam_unix_cred.so.1 login auth required pam_unix_auth.so.1 login auth required pam_dial_auth.so.1 # # rlogin service (explicit because of pam_rhost_auth) # rlogin auth sufficient pam_ldap.so.1 rlogin auth sufficient pam_rhosts_auth.so.1 rlogin auth requisite pam_authtok_get.so.1 rlogin auth required pam_dhkeys.so.1 rlogin auth required pam_unix_cred.so.1 rlogin auth required pam_unix_auth.so.1 # Default definitions for Authentication management # Used when service name is not explicitly mentioned for authentication # other auth sufficient pam_ldap.so.1 other auth requisite pam_authtok_get.so.1 other auth required pam_dhkeys.so.1 other auth required pam_unix_cred.so.1 other auth required pam_unix_auth.so.1 # # passwd command (explicit because of a different authentication module) # passwd auth sufficient pam_ldap.so.1 passwd auth required pam_passwd_auth.so.1 # # cron service (explicit because of non-usage of pam_roles.so.1) # cron account required pam_unix_account.so.1 # # Default definition for Account management # Used when service name is not explicitly mentioned for account management # other account sufficient pam_ldap.so.1 other account requisite pam_roles.so.1 other account required pam_unix_account.so.1 # # Default definition for Session management # Used when service name is not explicitly mentioned for session management # other session sufficient pam_ldap.so.1 other session required pam_unix_session.so.1 # # Default definition for Password management # Used when service name is not explicitly mentioned for password management # other password required pam_dhkeys.so.1 other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 other password required pam_authtok_store.so.1 -- Jeremiah Coleman Systems Administrator C & C Technologies 337-261-0660 x3421 jay.coleman(a)cctechnol.com

2 3

[Fedora-directory-users] Re: getting sh on RHAS5 to work with FDS.
by Howard Chu 18 Sep '07

18 Sep '07

> Date: Tue, 18 Sep 2007 08:39:55 -0600 > From: Richard Megginson <rmeggins(a)redhat.com> > Yes, very. > http://directory.fedoraproject.org/wiki/Howto:SSL#Basic_Steps > <quote> > > NOTE - *Do not use cn=server-cert for your server certificate*. In step > 7 of the linked instructions, it says to use certutil .... -s > cn=server-cert - this will cause clients to fail to validate the cert. > Instead, you must use the fully qualified domain name of your server > host as the value of the cn attribute in the subject DN. For example, if > your directory server hostname is foo.example.com, use Also look at the constraints in RFC4513, section 3.1.3. Use subjectAltName extensions to get more flexibility here. > > ../shared/bin/certutil -S -n "Server-Cert" -s cn=foo.example.com -c "CA certificate" \ > -t "u,u,u" -m 1001 -v 120 -d . -z noise.txt -f pwdfile.txt > > to generate your server cert. This is the minimum. You may wish to > provide your clients with more details about your server. For more > information, see RFC 1485 <http://www.ietf.org/rfc/rfc1485.txt>. You > could choose to specify the subject DN like this: > > ../shared/bin/certutil ... -s "cn=foo.example.com,ou=engineering,o=example corp,c=us" ... > > </quote> > > Note that this also means that if you use cn=foo.example.com, clients > must be able to resolve the server's IP address to "foo.example.com". If > you don't care/can't do this, then use TLS_REQCERT never in your > /etc/openldap/ldap.conf to make ldapsearch stop complaining. I highly > recommend you do not do this though. Agreed, bad idea. By the way, the OpenLDAP libraries never do a DNS lookup on the name you provide, so whether the name resolves or not doesn't matter. We expect the name passed in to exactly match the CN, or to match the subjectAltName. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

[Fedora-directory-users] question about certificate
by Elisa Pellegrini 18 Sep '07

18 Sep '07

Hi! I don't now if this is the right email address to ask my problem.. I'm using fedora Directory -server to implement ldap. The problem is about certificate: I create a certificate but is impossible to use that because the issuer's certificate is not recornize. How can i solve this problem?Whit console I fixed CA cert name and I edit trust. Is necessary to fix certmap mappingName issuerDN in certmap.conf file? I try to do this but nothing changed. Sorry for my bad english! Thanks! ------------------------------------------------------ Leggi GRATIS le tue mail con il telefonino i-mode di Wind http://i-mode.wind.it/ _______________________________________________ Like your solution? Hate it? Go to your software vendor's page at RHX - http://rhx.redhat.com - and tell us what you think! Help improve RHX. The RHX team is looking for your feedback with a short, 12 question survey: http://www.keysurvey.com/survey/162511/fa85/ ------------------------------------------------------ Leggi GRATIS le tue mail con il telefonino i-mode di Wind http://i-mode.wind.it/

2 1

[Fedora-directory-users] Password Expiration Warning notification
by Raj Seenivasan 18 Sep '07

18 Sep '07

Is there an option in FDS for password expiration warning message to go out via email? We have few applications that use FDS but none reports about the password expiration. SSH displays the warning but there are users who don't use ssh. Any help is highly appreciated. Thanks much. CONFIDENTIALITY NOTICE: This email message and any attachments contain proprietary and privileged information of Roundbox, Inc., which are provided for the sole and confidential use of the intended recipients. Any review, use, disclosure or distribution of this information is restricted and must comply with the nondisclosure agreement between Roundbox, Inc. and you (or your company). All other uses are prohibited. If you are not an intended recipient, please contact the sender by reply email and promptly delete and otherwise destroy all copies of the message and its attachments.

4 4

[Fedora-directory-users] One way replication FROM Active Directory
by Chris 18 Sep '07

18 Sep '07

Has anyone done this? If so, please, please point me to relevant and complete documentation. -- Best regards, Chris Registerd Linux user number 448639

1 0

[Fedora-directory-users] help....unable to start fedora server
by bikas gurung 18 Sep '07

18 Sep '07

Hi all, I'm certainly in deep s*&#t now. I just updated my file-server with new updates and patches and tried to reboot it; but it hanged: reason - Kernel Panic. So I had to shutdown the system manually and had to run 'fsck' manually afterwards. Everything seemed to run well afterwards. But today evening I found that I was not able to connect my pc to file-server. When I checked, it turns out that 'slapd' daemon wasn't started at all. I manually tried to start the server using the scripts (in /rc.d/init.d ) but got an error. Here's an error logged in log file: Fedora-Directory/1.0.2 B2006.060.1928 isec-file:636 (/opt/fedora-ds/slapd-isec-file) [17/Sep/2007:20:52:06 -0500] - Fedora-Directory/1.0.2 B2006.060.1928starting up [17/Sep/2007:20:52:06 -0500] - Detected Disorderly Shutdown last time Directory Server was running, recovering database. [17/Sep/2007:20:52:06 -0500] - libdb: Ignoring log file: /opt/fedora-ds/slapd-isec-file/db/log.0000000206: magic number 0, not 40988 [17/Sep/2007:20:52:06 -0500] - libdb: Invalid log file: log.0000000206: Invalid argument [17/Sep/2007:20:52:06 -0500] - libdb: PANIC: Invalid argument [17/Sep/2007:20:52:06 -0500] - libdb: PANIC: DB_RUNRECOVERY: Fatal error, run database recovery [17/Sep/2007:20:52:06 -0500] - Database Recovery Process FAILED. The database is not recoverable. err=-30978: DB_RUNRECOVERY: Fatal error, run database recovery [17/Sep/2007:20:52:06 -0500] - Please make sure there is enough disk space for dbcache (10485760 bytes) and db region files [17/Sep/2007:20:52:06 -0500] - start: Failed to init database, err=-30978 DB_RUNRECOVERY: Fatal error, run database recovery [17/Sep/2007:20:52:06 -0500] - Failed to start database plugin ldbm database [17/Sep/2007:20:52:06 -0500] - WARNING: ldbm instance userRoot already exists [17/Sep/2007:20:52:06 -0500] - WARNING: ldbm instance NetscapeRoot already exists [17/Sep/2007:20:52:06 -0500] binder-based resource limits - nsLookThroughLimit: parameter error (slapi_reslimit_register() already registered) [17/Sep/2007:20:52:06 -0500] - start: Resource limit registration failed [17/Sep/2007:20:52:06 -0500] - Failed to start database plugin ldbm database [17/Sep/2007:20:52:06 -0500] - Error: Failed to resolve plugin dependencies [17/Sep/2007:20:52:06 -0500] - Error: preoperation plugin 7-bit check is not started [17/Sep/2007:20:52:06 -0500] - Error: accesscontrol plugin ACL Plugin is not started [17/Sep/2007:20:52:06 -0500] - Error: preoperation plugin ACL preoperation is not started [17/Sep/2007:20:52:06 -0500] - Error: postoperation plugin Class of Service is not started [17/Sep/2007:20:52:06 -0500] - Error: preoperation plugin HTTP Client is not started [17/Sep/2007:20:52:06 -0500] - Error: database plugin ldbm database is not started [17/Sep/2007:20:52:06 -0500] - Error: object plugin Legacy Replication Plugin is not started [17/Sep/2007:20:52:06 -0500] - Error: object plugin Multimaster Replication Plugin is not started [17/Sep/2007:20:52:06 -0500] - Error: postoperation plugin Roles Plugin is not started [17/Sep/2007:20:52:06 -0500] - Error: object plugin Views is not started As all the client machines depend upon this server for authentication and as weekend is still far away, I'm in big trouble now. I'm quite clueless what to do and would really appreciate any kind of help. And no, unfortunately I don't have a backup to fall back to . Thanking you in advance bikas

3 2

[Fedora-directory-users] ssh login fail
by Steven Jones 17 Sep '07

17 Sep '07

Hi, I am trying to get a RHEL4 box to LDAP authenticate against FDS (also on RHEL4) and failing..... In the logs (messages) I have, Sep 10 13:30:52 vuwunicvfwall02 sshd(pam_unix)[2284]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=vuwunicvadmin02.res.vuw.ac.nz user=jonesst1 Sep 10 13:30:52 vuwunicvfwall02 sshd[2284]: pam_ldap: ldap_simple_bind Can't contact LDAP server Sep 10 13:30:52 vuwunicvfwall02 sshd[2284]: pam_ldap: ldap_simple_bind Can't contact LDAP server Sep 10 13:31:05 vuwunicvfwall02 sshd(pam_unix)[2284]: 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=vuwunicvadmin02.res.vuw.ac.nz user=jonesst1 Any ideas why? And how to fix? Also is there a way to search the archive for this list? When I do a, ldapsearch -x -h 130.195.87.249 -b dc=vuw,dc=ac,dc=nz "(ou=Users)" The server replies so FDS appears to be running OK.... Also is there a way to search the archive for this list? I have tried Googling with no luck... regards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272

5 68

[Fedora-directory-users] FDS and OpenLDAP integration
by Matteo Angelino 17 Sep '07

17 Sep '07

Hello, in my organization I have a master ldap server based on openLDAP. Now I have installed a new ldap server (slave) based on Fedora Directory Server. The openLDAP server have a replica directive in the cenfiguration file to replicate the modify to FDS server. Modify entry that exist on master server work fine. The problem in the insert of e new user into the master server. When I try to insert e new user from the followind ldif, i see an error in the insert. testuser.ldif: dn: uid=testuser, dc=studenti, dc=unipmn,dc=it givenName: TEST postalCode: 1920 objectClass: top objectClass: person objectClass: inetOrgPerson objectClass: posixAccount userPassword:: e21kNX0rcmM3V2xoeE9QcnZLc0MvdlJtRlZnPT0= mail: roberto.pinna(a)studenti.unipmn.it uid: testuser uidNumber: 6763578 cn: TEST USER carLicense: PNNRRT73B26A182A loginShell: /bin/bash gidNumber: 100 homeDirectory: /home/test sn: TEST Error from FDS error log: Entry "uid=testuser,dc=studenti,dc=unipmn,dc=it" -- attribute "structuralobjectclass" not allowed Error from slurpd (on master openLDAP server): Error: ldap_add_s failed adding DN "uid=testuser,dc=studenti,dc=unipmn,dc=it": attribute "structuralobjectclass" not allowed Information from reject file of the surpd: ERROR:: T2JqZWN0IGNsYXNzIHZpb2xhdGlvbjogYXR0cmlidXRlICJzdHJ1Y3R1cmFsb2JqZWN0Y2 xhc3MiIG5vdCBhbGxvd2VkCg== replica: db.mfn.unipmn.it:389 time: 1189156318.0 dn: uid=testuser,dc=studenti,dc=unipmn,dc=it changetype: add givenName: TEST postalCode: 1920 objectClass: top objectClass: person objectClass: inetOrgPerson objectClass: posixAccount userPassword:: e21kNX0rcmM3V2xoeE9QcnZLc0MvdlJtRlZnPT0= uid: testuser mail: roberto.pinna(a)studenti.unipmn.it uidNumber: 6763578 cn: TEST USER carLicense: PNNRRT73B26A182A loginShell: /bin/bash gidNumber: 100 homeDirectory: /home/test sn: TEST structuralObjectClass: inetOrgPerson entryUUID: 21363b50-f16e-102b-96d1-e14b33466425 creatorsName: cn=manager,dc=unipmn,dc=it createTimestamp: 20070907091157Z entryCSN: 20070907091157Z#000000#00#000000 modifiersName: cn=manager,dc=unipmn,dc=it modifyTimestamp: 20070907091157Z I have see that the structuralobjectclass is not defined in the attributes available in FDS.... how can resolve the probem? Thank's in advance -------------------------------------------------------------- Matteo Angelino Dipartimento di Informatica Via Bellini 25\G 15100 Alessandria ITALY Tel: +39 0131 360375 Email: matteo.angelino(a)mfn.unipmn.it --------------------------------------------------------------

4 12

[Fedora-directory-users] samba + Directory server + windows client
by Satish Patel 17 Sep '07

17 Sep '07

Dear all I am going to implement Intranet server on my organization i m very intreseted on FDS now thing is that my users on windows client and i am installing samba 4.0 as a PDC. so is it possible i can create group policy or network controll through FDS + samba PDC means i dont want to give access of Network to a specific user or not give access of telnet command or something like that which is possible on windows 2003 PDC it will support all policy on OpenSource Setup ??? Regards satish patel $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- Why delete messages? Unlimited storage is just a click away.

1 0

RE: [Fedora-directory-users] Debian client to FDS howto
by Howard Chu 14 Sep '07

14 Sep '07

> Date: Fri, 14 Sep 2007 15:27:01 +1200 > From: "Steven Jones" <Steven.Jones(a)vuw.ac.nz> > Cool....nothing like an explanation of why not to do things. > > Of course lacking any documentation at all....I'm left with > experimentation. If you're lacking documentation, perhaps you should complain to your distro packager. On my system (OpenSUSE) I see: viola:~/OD/hobj/tests> man pam_ldap Reformatting pam_ldap(5), please wait... viola:~/OD/hobj/tests> man nss_ldap Reformatting nss_ldap(5), please wait... viola:~/OD/hobj/tests> man ldap.conf Reformatting ldap.conf(5), please wait... ... -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

[Fedora-directory-users] Directory Server capabilities
by Clowser, Jeff 14 Sep '07

14 Sep '07

I have a question about capabilities in the Fedora/RH Directory server: First, can it do dynamic groups as Novell eDirectory does (or is there any effort to add this): http://support.novell.com/techcenter/articles/ana20020405.html Basically, it's similar to the groupofURL's that is supported by the RH/Sun directory server, but when the group is retrieved, dn's for entries that match the ldap url dynamic criteria is returned added to the uniquemember attribute, and you can do searches/compares on the uniquemember attribute that includes dynamic members. I realise there are some significant performance considerations with this, but for modest use, it would really be useful. (FWIW, I asked a similar question when FDS first was released, but didn't have another product to point to as a comparable implementation at the time. Haven't looked at FDS for a while, so I'm hoping some things might have changed :) ) Second, can it log to syslog (or some centralized logging facility), rather than local files? I run a load balanced cluster with ~20 Sun Directory server machines in it, and troubleshooting things in access/error logs is a real pain because I have to look at 20 machines to find which server the connection went to so I can find the correct log entries to find out what's going on. Has RH added other options to logging to log to syslog-ng, etc so that we can create one consolidated set of logs? Thanks, - Jeff

1 0

re: [Fedora-directory-users] Debian client to FDS howto
by Howard Chu 13 Sep '07

13 Sep '07

> Date: Fri, 14 Sep 2007 08:45:01 +1200 > From: "Steven Jones" <Steven.Jones(a)vuw.ac.nz> > I have written the below, if it is helpful/correct by all means place it > on FDS wiki. > > > Debian client setup > > Important notes > > There would seem to be at least 2 places (if not three) containing > information for ldap. In order to make Debian 4 work I have deleted 2 > and sym linked. It is possible on patching Debian that these files maybe > restored and LDAP authentication will no longer work. Never symlink the pam/nss_ldap config files with the OpenLDAP libldap config file. There's a reason all of these things are in separate config files - they each have distinct syntaxes. You don't know what you're doing, and you have no guarantees that any particular version of a given library won't barf all over the keywords it doesn't recognize. > There may well be an official method to setup Debian but I have not been > able to locate one via Google. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

[Fedora-directory-users] Fedora DS 1.0.4 build on Solaris 10?
by Scott Ding 13 Sep '07

13 Sep '07

Has anyone built Fedora DS 1.0.4 on Solaris 10 (SPARC 32bit)?

3 6

Re: [Fedora-directory-users] FDS schema
by Matthias Dieter Wallnöfer 13 Sep '07

13 Sep '07

> No. The obsolete schema will be gone with the next release. It's > already been removed from CVS HEAD. But if I look in the HEAD branch (http://cvs.fedora.redhat.com/viewcvs/?root=dirsec&only_with_tag=HEAD <http://cvs.fedora.redhat.com/viewcvs/?root=dirsec&only_with_tag=HEAD>) and change to ldapserver/ldap/schema (http://cvs.fedora.redhat.com/viewcvs/ldapserver/ldap/schema/?root=dirsec&on… <http://cvs.fedora.redhat.com/viewcvs/ldapserver/ldap/schema/?root=dirsec&on…>) I see them again. Is this alright? Matthias

2 1

RE: [Fedora-directory-users] Fedora DS 1.0.4 build on Solaris 10?
by Scott Ding 12 Sep '07

12 Sep '07

I got the FDS installed on Solaris 10 by calling ds_newinst.pl with a inf file. However, when I tried to start the FDS, I got the following error. It looks like I did not set up SSL correctly. Can anyone help? [11/Sep/2007:16:05:13 -0700] - SSL alert: Security Initialization: NSS initialization failed (Netscape Portable Runtime error -8174 - security library: bad database.): path: /home/dings/fds/alias/, certdb prefix: slapd-lsctsol06-, keydb prefix: slapd-lsctsol06-. [11/Sep/2007:16:05:13 -0700] - ERROR: NSS Initialization Failed. -----Original Message----- From: Scott Ding Sent: Tuesday, September 11, 2007 2:50 PM To: General discussion list for the Fedora Directory server project. Subject: RE: [Fedora-directory-users] Fedora DS 1.0.4 build on Solaris 10? Rob, We got the FDS compiled on Solaris 10 with NET-SNMP 5.4.1. The compiled result contains the following files: LICENSE.txt README.txt disktune slapd.tar.gz After I untar slapd.tar.gz, I got the following: alias manual shared bin - slapd - admin - server - install - property -lib lib plugins I checked the Installation Guide. The instructions are based on RedHat. Are there any installation instructions based on Solaris? Regards, Scott -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Rob Crittenden Sent: Tuesday, September 11, 2007 7:25 AM To: General discussion list for the Fedora Directory server project. Subject: Re: [Fedora-directory-users] Fedora DS 1.0.4 build on Solaris 10? Scott Ding wrote: > Has anyone built Fedora DS 1.0.4 on Solaris 10 (SPARC 32bit)? > In theory this should work ok. I spent a little time many months ago to try to build it on Solaris 10 x86 and nearly got there before running out of time and I never got back to it because I needed to reclaim the disk space :-( I would recommend the manual build process defined at http://directory.fedoraproject.org/wiki/Building . I would avoid the "one-step build" because I suspect this is going to be very iterative and while the auto-fetching is nice developing in that environment just adds another layer of pain. It is possible to build on Solaris with gcc, the trick is figuring out the magic to tell the various components to use it. I think things like NSS, NSPR and FDS itself use the env variable NS_USE_GCC. Set that to 1 and give it a go. There may be other tweaks required. And note that the manual instructions just cover the server itself. For console, the plugins, etc there is more to do. rob

4 8

[Fedora-directory-users] FDS crash - happened after adding views
by Dave Augustus 12 Sep '07

12 Sep '07

Hello all, On Centos 5 x86_64, we have fedora-ds-1.0.4-1.FC6.x86_64 installed. We are in the painful process of migrating from OpenLDAP to FDS. After adding around 40 views. The server crashed and won't restart. Running slapd-server -d 1 provides no clues until the last statement: [11/Sep/2007:16:42:33 -0500] views-plugin - <-- views_cache_build_view_list ./start-slapd: line 33: 14540 Segmentation fault ./ns-slapd - D /opt/fedora-ds/slapd-ldap1-server1 -i /opt/fedora-ds/slapd-ldap1- server1/logs/pid -w $STARTPIDFILE "$@" Is there a limit to views? The changelog shows that it has been around for awhile. How do I recover? I have an ldif export but if I import the data with these views will I run into the same problems? Thanks, Dave

2 4

[Fedora-directory-users] FDS schema
by Matthias Dieter Wallnöfer 12 Sep '07

12 Sep '07

Hi all! On a FDS installation I notice many installed schema files that are used by the old Netscape or SUN enterprise services (50ns-*). I think they aren't necessary for many environments and shouldn't be installed by default anymore. For the next release I would propose an advanced option for this issue. Would this be possible or is there a special reason for keeping them? Matthias

2 1

[Fedora-directory-users] Active directory users sync with Fedora DS
by Peter Santiago 10 Sep '07

10 Sep '07

Hi everyone, Among the features of Fedora DS that interest me is the Active Directory user and group synchronization. However I still haven't found any documentation that could help in making use of this feature. Can someone point out how to implement this especially syncing users from ADS to a newly installed FDS. Thanks, -- Peter Santiago peters(a)psinergybbs.com My website: www.psinergybbs.com My spamtrap address: r34987y(a)psinergybbs.com ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

3 2

[Fedora-directory-users] MMR: Directory updates on same object
by Reinhard Nappert 07 Sep '07

07 Sep '07

I have a working Multi-Master Replication setup with two masters (Fedora Directory Server 1.0.4). The setup works fine as long as I do not update the same object via both Masters. When the later happens (application driven), one of the Master crashes. This server does not generate a core dump, nor can I find any unusual in the access and error log files. I am pretty sure that it has to do something with the conflict resolution, but I am stuck now. Did anybody experience a similar behavior? Thanks, -Reinhard

2 7

[Fedora-directory-users] cleint problems with ssl and tls
by Marco Strullato 07 Sep '07

07 Sep '07

Hi all! I have a problem with ldap and ssl: I set up the fedora directory server with ssl following this link: http://directory.fedoraproject.org/wiki/Howto:SSL The problem is client authentication: I mean when I do an ldapsearch I get "SSL connection already established" but I don't have any other connection to between client and server (check with netstat). What do you suggest me? Thanks Marco logs from the FDS server are: [07/Sep/2007:10:04:09 +0200] conn=10 fd=68 slot=68 SSL connection from <ip_src> to <ip_dst> [07/Sep/2007:10:04:09 +0200] conn=10 SSL 256-bit AES [07/Sep/2007:10:04:09 +0200] conn=10 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [07/Sep/2007:10:04:09 +0200] conn=10 op=0 RESULT err=1 tag=120 nentries=0 etime=0 [07/Sep/2007:10:04:09 +0200] conn=10 op=-1 fd=68 closed - B1 from client: ldap_create ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP ldaps_vm02_admin:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying <ip_server>:636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 0, subject: /C=IT/O=<......> TLS certificate verification: depth: 0, err: 0, subject: /C=IT/O=<......> TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read finished A ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush: 31 bytes to sd 3 ldap_result ld 0x80bc048 msgid 1 ldap_chkResponseList ld 0x80bc048 msgid 1 all 1 ldap_chkResponseList returns ld 0x80bc048 NULL wait4msg ld 0x80bc048 msgid 1 (infinite timeout) wait4msg continue ld 0x80bc048 msgid 1 all 1 ** ld 0x80bc048 Connections: * host: ldaps_vm02_admin port: 636 (default) refcnt: 2 status: Connected last used: Fri Sep 7 10:05:20 2007 ** ld 0x80bc048 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 0x80bc048 Response Queue: Empty ldap_chkResponseList ld 0x80bc048 msgid 1 all 1 ldap_chkResponseList returns ld 0x80bc048 NULL ldap_int_select read1msg: ld 0x80bc048 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 71 contents: read1msg: ld 0x80bc048 msgid 1 message type extended-result ber_scanf fmt ({eaa) ber: read1msg: ld 0x80bc048 0 new referrals read1msg: mark request completed, ld 0x80bc048 msgid 1 request done: ld 0x80bc048 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eaa) ber: ber_scanf fmt (a) ber: ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (x) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_perror ldap_start_tls: Operations error (1) additional info: SSL connection already established

3 4

[Fedora-directory-users] FDS 1.0.4 and DNS host filter based ACIs
by Peter Reuterås 07 Sep '07

07 Sep '07

Hi I have a problem with ACIs on FDS 1.0.4. After uppgrading a server from FDS 1.0.2 to 1.0.4 "DNS host filter" based ACIs stopped working. We can still use IP based ACIs for IPv4 access but not "DNS host filter". FDS is running on a Red Hat Enterprise Linux 4.0 server. Anybody else seen this problem? /Peter -- =========================================================================== Peter Reuterås Tel +46 8 7909558 SE-100 44 Stockholm, Sweden

2 1

[Fedora-directory-users] FDS & NIS sync.
by Andreas Kekkou 06 Sep '07

06 Sep '07

Hi all, We are in the process of migrating our NIS domain to FDS and for some time we have to run both systems. Since the current version of FDS does not generates UIDs automatically, we are thinking of creating any new accounts to NIS and export all info every night in ldif format. What command/software I have to use in order to import the ldif file to FDS? Please bear in mind that we want to update the existing user info and create any new users that might exist in the ldif file. Regards, Andreas

2 1

[Fedora-directory-users] error logging in first time
by Bob Wooden 05 Sep '07

05 Sep '07

I am new to Fedora Directory Server, but six or seven years linux user. I have built a Fedora Core 6, selected the "web server" option on build and installed the FDS 1.0.4 version. Located java and adjusted the symbolic link. Did my FDS setup/setup and set all the defaults. When I perform the ./startconsole command (within the fedora-ds directory, I get the following error message: Cannot connect to the Admin Server "http://******.***.***:43766" The URL is not correct or the server is not running. I have searched the mailing list archive and I am unable to locate any reference to this error message. What do I do now?

3 8

[Fedora-directory-users] deletion problem - multi-master
by Sam Smith 05 Sep '07

05 Sep '07

I have two masters and three replicas. Master A works fine - I can add, modify, delete, and the changes replicate OK. Except that Master B cannot delete, either directly at the console, via the command line, or via replication from master A. It can add and modify just fine, and those changes replicate to the other master and the replicas. But it can't delete. The error message is simply LDAP OPERATIONS ERROR Thanks for any help. Sam Smith

2 6

[Fedora-directory-users] Directory size (/var/opt/netscape/server7)
by Rubin 05 Sep '07

05 Sep '07

Hi All, A question of curiosity: i've set up a small ldap server (no slaves or multimaster stuff) with about 50 users. I made a backup of the server7 directory (/var/opt/netscape/server7) before I changed anything and started hacking away. now, a couple of months later everything is working very well and i'm asked to migrate the server. I just made a new backup of the server7 directory and to my amazement it is 10x as big. It started out at 139m, and it is now 1.2g! So the question is: What is taking up so much space when there are only 50 posixAccounts and 2 posixGroups? For the record, I know this is not the way to backup a rhds server, I'm reading about how to do a backup or dump "the right way" as we speak ;-) Grtz, Rubin.

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users September 2007