November 2008 - 389-users - Fedora mailing-lists

[Fedora-directory-users] Sudo in directory server
by Erling Ringen Elvsrud 13 Jan '09

13 Jan '09

I try to add the schema for sudoers from README.LDAP in the srpm-file of sudo-1.6.8p12. I assume the iPlanet-version will work best, but get this problem when I restart directory server: [root@testserver schema]# service dirsrv restart Shutting down dirsrv: testserver... [ OK ] Starting dirsrv: testserver...[27/Nov/2008:10:37:31 +0100] - Entry "cn=schema attributeTypes: ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseE" required attribute "objectclass" missing [ OK ] [root@testserver schema]# cat 99sudoers.ldif dn: cn=schema attributeTypes: ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseE xactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' ) attributeTypes: ( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseEx actIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' ) attributeTypes: ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Command(s) to be executed by sudo' EQUALITY caseExactIA5Match S YNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' ) attributeTypes: ( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1 .3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' ) attributeTypes: ( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Options(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1 .3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' ) objectClasses: ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top STRUCTURAL DESC 'Sudoer Entries' MUST ( cn ) MAY ( sudoUser $ sud oHost $ sudoCommand $ sudoRunAs $ sudoOption $ description ) X-ORIGIN 'SUDO' ) Any help to get the schema for sudo correctly added is appreciated. Thanks, Erling

10 12

[Fedora-directory-users] Ubuntu not enforcing password policies
by John A. Sullivan III 03 Dec '08

03 Dec '08

Hello, all. We're continuing to dive ever deeper into DS. Our thanks to the developers for such a powerful product. Our integration with the RedHat family has gone well but now we're working on Ubuntu. Most is working well but we are finding Ubuntu is not enforcing password policies. For example, we require a user to change their password after a reset. When a user logs into a RedHat system, they are prompted for the change. However, Ubuntu just lets them right in again and again with the same reset password. Any pointers on what to look for to fix this in our configuration before we scour the world for a solution? We've already done quite a bit of googling. We've tried enabling pam_lookup_policy but that didn't work. /etc/pam.d/common-password reads: password requisite pam_cracklib.so retry=3 minlen=8 difok=3 password [success=2 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512 password [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass # here's the fallback if no module succeeds password requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around password required pam_permit.so We've also tried disabling that last pam_permit.so. That didn't help. Where should we look? Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan(a)opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society

2 6

[Fedora-directory-users] DSGW problem - browser user tries to change password
by John A. Sullivan III 02 Dec '08

02 Dec '08

Hello, all. As explained in the last email, we do not allow anonymous browsing but have a specific user with limited rights browsing the tree to find users' identities for logging into DSGW. We also have a policy that users must change their passwords after a reset. We have a test user sue.sutter. We reset her password and then had her attempt to login to DSGW. Sure enough, she was told she needed to changed her password and was given the option to do so. However, the attempt failed with the below error messages: Editing sue.sutter... Sending changes to the directory server... An error occurred while contacting the LDAP server. (Insufficient access - Insufficient 'write' privilege to the 'userPassword' attribute of entry 'uid=sue.sutter,ou=users,o=a0000-0006,o=internal,dc=ssiservices,dc=biz'. ) You do not have sufficient privileges to perform the operation. That seemed very strange because when we test changing passwords using her posix account, it works just fine. We then gave the browsing user (not sue.sutter) full rights to the tree and, lo and behold, it worked: Giving the directory browser user all rights allowed a successful password change. It appears the browsing user is the one attempting to change the user's password and not the user. Is that the way it's supposed to be? I certainly would not want a browse only utility user able to change user passwords. Perhaps I am missing something. Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan(a)opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society

2 2

[Fedora-directory-users] Many DSGW authentication problems
by John A. Sullivan III 02 Dec '08

02 Dec '08

I'm finding several weird issues with DSGW authentication which make it very difficult for our users to use. Not to complain - great DS - but we're experiencing some problems. We do not allow anonymous browsing of the tree. Each client has a user who has rights to search only their portion of the tree for possible DSGW logins. The ACI, place on the root, is thus: (target = "ldap:///ou=Users,($dn),o=Internal,dc=ssiservices,dc=biz")(targetattr = "uid || st || sn || ou || name || entrydn || dn || dc || objectClass || cn || o || l || c || givenName") (version 3.0;acl "Client DSGW Lister";allow (search,read)(userdn = "ldap:///uid=*dsgwlister,[$dn],o=sysaccounts,dc=ssiservices,dc=biz");) We have an example test user named sue.sutter. The full dn is uid=sue.sutter,ou=users,o=a0000-0006,o=internal,dc=ssiservices,dc=biz The first step is to go the authentication page where we read: "The first step in authenticating to the directory is identifying yourself." This is why we created a user with rights to browse for other users and defined it with a binddnfile entry. That part is working fine. If I enter sue.sutter, it does not find her directly but rather offers a list with a single hyperlinked choice. That's the first problem (a problem for anyone with a "." in their uid). The query has replaced the "." with a space: filter="(&(objectClass=person)(|(sn=sue sutter)(cn=sue sutter))) I tried surrounding it with quotes and escaping it with a back slash but the quote was interpreted literally and the back slash gave the same results as the period alone. Is this a bug, a configuration error, or just the way it's supposed to be? If the latter, this is very user unfriendly. A techie might understand escape characters or special encoding but not an everyday user. It wouldn't be so bad if they could simply click on the hyperlink and be allowed to login. However, the hyperlink does not work. Mousing over gives: javascript:authSubmit('uid%3Dsue.sutter%2Cou%3DUsers%2Co%3Da0000-0006% 2Co%3DInternal%2Cdc%3Dssiservices%2Cdc%3Dbiz');%20onMouseOver= but it goes nowhere. A packet trace shows no packets coming from the browser to the DS. What might we have configured incorrectly to cause this? We see the same thing in Konqueror as we see in Firefox3 all running on fully patched Ubuntu 8.0.4. Hmmm . . . this is getting long. I'll put the other problem into another email. Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan(a)opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society

2 2

[Fedora-directory-users] Re: fedora ds migration error
by Eric 01 Dec '08

01 Dec '08

there is /var/run/dirsrv on my system and there is dsgw/cookies in it. why server fails to start? Date: Wed, 26 Nov 2008 08:25:31 -0700 From: Rich Megginson <rmeggins(a)redhat.com> Subject: Re: [Fedora-directory-users] Re: error in yum fedora-ds To: "General discussion list for the Fedora Directory server project." <fedora-directory-users(a)redhat.com> Message-ID: <492D6A6B.2080802(a)redhat.com> Content-Type: text/plain; charset="iso-8859-1" Eric wrote: > I used :rpm --import > 'http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xA7B02652' > <http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xA7B02652%27> > and the problem solved. I installed fedora-ds then used > /usr/sbin/migrate-ds-admin.pl for migration from fedora ds-1.0.4. > I stoped slapd-instance before this. it faild in start server: mkdir /var/run/dirsrv make sure that directory is writable by your directory server user > > /usr/sbin/migrate-ds-admin.pl General.ConfigDirectoryAdminPwd=mypassword > Beginning migration of Directory and Administration servers from > /opt/fedora-ds . . . > Beginning migration of directory server instances in /opt/fedora-ds . . . > Your new DS instance 'slapd-ldap' was successfully created. > Server failed to start !!! Please check errors log for problems > Beginning migration of Administration server from /opt/fedora-ds . . . > Creating Admin Server files and directories . . . > Updating the configuration for the httpd engine . . . > Starting admin server . . . > The admin server was successfully started. > Registering the directory server instances with the configuration > directory server . . . > Directory and Administration servers migration is complete. Please > check output and log files for details. > Exiting . . . > > what is wrong? now the slapd in /opt/fedora-ds doesn't work too!

2 1

[Fedora-directory-users] fedora-idm-console error
by Eric 30 Nov '08

30 Nov '08

Hi, I have migrated from fedora-ds 1.0.4 on the same system. when I stoped admin and slapd in /opt/fedora-ds. in starting fedora-idm-console I use the port that I had from installing fedora-ds 1.0.4. it has this error: cannot connect to the directory server netscape.ldap.LDAPException:error result(32); no such object.

1 0

[Fedora-directory-users] Script for populating posix attributes after syncing users from AD
by Kenneth Holter 28 Nov '08

28 Nov '08

Hi. We're setting up RHDS to sync users from AD, and are in need of a script for populating the users with posix attributes (and other relevant ones). Does anyone already have this kind of script, and are willing to share it? Regards, Kenneth Holter

2 2

[Fedora-directory-users] Command line created posix user shows posix disabled in console
by John A. Sullivan III 26 Nov '08

26 Nov '08

I've created a bash script to add ds entries for new clients as we bring them on board. It automatically creates their user accounts which include the posixaccount object class (as well as account (to allow the host attribute) and posixgroup (to allow gidnumber for personal groups)). They appear to be created fine. Users can login, change passwords, etc. However, when I view the user in the idm-console, the posix attributes are present but the enable checkbox is unchecked and the attributes are greyed out and uneditable. If I click the enable check box, the fields are enabled but when I attempt to save the change I get an error: Cannot save to directory server: netscape.ldap.LDAPException: error result(1): Operations error I would not doubt this is because it's trying to add a posixaccount value to objectclass when one already exists. In any event, if I enable posix and change an attribute, I get the same error. However, if I go to the advanced page instead, and change a posix attribute there, the change saves perfectly fine. Any idea what is happening and what I've done wrong? In case more information is needed, here are some of the gory details. There are attribute uniqueness constraints. uidnumber and gidnumber are globally unique. uid and cn are unique within an ou within an o - fairly granular. I did try disabling the global constraints but to no avail. By the way, those users with NT attributes show up fine with the NT User enabled check box checked. Here is a typical LDIF entry: dn: uid=userx,ou=Users,ou=Internal,o=a0000-0002,dc=ssiservices,dc=biz changetype: add objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson objectclass: posixaccount objectclass: account objectclass: posixgroup uid: userx cn: userx userpassword: ea4cb9eedc uidnumber: 2001 gidnumber: 2001 homedirectory: /data/users/userx loginshell: /bin/sh givenname: John A. sn: Sullivan III mail: userx(a)somecompany.biz telephonenumber: +1 (207) 999-9999 I can't imagine it is significant but, just in case, here is the LDIF creation from the script: The input syntax is: uid|givenname|sn|emailuser(no domain)|phone|location|W|"|" delimited attribute=value pairs UIDNUMBERS[$counter]=${CIDU} PWS=$(echo ${CIDU}${FIRST} | md5sum) PWS=${PWS:0:10} echo -e "${FIRST} ${PWS}\n\n" >> ${CID}.temp TEMPS="dn: uid=${FIRST},${USUFFIX}\n${ADDPERSON}uid: ${FIRST}\ncn: ${FIRST}\nuserpassword: ${PWS}\nuidnumber: ${CIDU}\ngidnumber: ${CIDU}\nhomedirectory: /data/users/${FIRST}\nloginshell: /bin/sh\n" c=0 for var in ${REST} do if [ -n "${var}" ]; then case ${c} in 0) TEMPS="${TEMPS}givenname: ${var}\n";; 1) TEMPS="${TEMPS}sn: ${var}\n";; 2) TEMPS="${TEMPS}mail: ${var}${EDOMAIN}\n";; 3) TEMPS="${TEMPS}telephonenumber: ${var}\n";; 4) TEMPS="${TEMPS}physicaldeliveryofficename: ${var}\n";; 5) TEMPS="${TEMPS}${ADDWIN}ntuserdomainid: ${FIRST}\nntusercreatenewaccount: true\nntuserdeleteaccount: true\n";; *) var=${var/=/: } TEMPS="${TEMPS}${var}\n";; esac fi ((c = c + 1)) done TEMPS="${TEMPS}\n" echo -e ${TEMPS} >> ${LDIF} ((counter = counter + 1)) ((CIDU = CIDU + 1)) Here are some of the variable definitions: BASE="dc=ssiservices,dc=biz" NEWO="o=${CID},${BASE}" SYSACCOUNTS="ou=SysAccounts,${NEWO}" USUFFIX="ou=Users,ou=Internal,${NEWO}" ADDS="changetype: add\n" TOPS="${ADDS}objectclass: top\n" ADDO="${TOPS}objectclass: organization\n" ADDOU="${TOPS}objectclass: organizationalUnit\n" ADDSYSPERSON="${TOPS}objectclass: person\nobjectclass: organizationalPerson\nobjectclass: inetOrgPerson\n" ADDPERSON="${ADDSYSPERSON}objectclass: posixaccount\nobjectclass: account\nobjectclass: posixgroup\n" ADDGROUP="${TOPS}objectclass: groupofuniquenames\nobjectclass: posixgroup\n" ADDWIN="objectclass: ntuser\n" What is going on? Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan(a)opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society

2 3

[Fedora-directory-users] Re: error in yum fedora-ds
by Eric 26 Nov '08

26 Nov '08

yes,I use fc6. I got the key from rpm --import http://archives.fedoraproject.org/pub/archive/fedora/linux/core/6/i386/os/ and then I did: yum in stall fedora-ds ,but there is the same problem!! 1- in above link there are RPM-GPG-KEY-fedora <http://archives.fedoraproject.org/pub/archive/fedora/linux/core/6/i386/os/R…> and some other keys which one should I use? only RPM-GPG-KEY-fedora<http://archives.fedoraproject.org/pub/archive/fedora/linux/core/6/i386/os/R…> ? 2- in http://directory.fedoraproject.org/wiki/Download ,in addition of the key problem, there are some problems for centos5 . should I do those too? for example: yum install svrcore mozldap perl-Mozilla-LDAP libicu <http://archives.fedoraproject.org/pub/archive/fedora/linux/core/6/i386/os/R…>

2 2

[Fedora-directory-users] mod_nss OCSP failover to CRL
by sg4all 25 Nov '08

25 Nov '08

Hi, I'm trying to set up a apache webserver with mod_nss. When available, OCSP should be used to verify the validity of the certificate. When the OCSP is unavailable, CRLs are used. I installed the CRLS, and configured everything. (My nss.conf is included in this message). When I comment out "NSSOCSP On": it validates the certificates using CRL correctly. When "NSSOCSP on" is used, it validates the certificates using OCSP correctly. However, when NSSOCSP is enabled, but I make the OCSP server unavailable (e.g. by putting an extra entry in /etc/hosts), a request takes a long time (I guess mod_nss tries a few times to get to the OCSP) and eventually fails. Is what I want supported? If so, does anyone have a clue what I do wrong? I tried this on CentOS5. I tried this configuration file on 2 versions of mod_nss. First using version 1.0.3-4.el5 which is installed using 'yum install mod_nss'. I also tried it on version 1.0.8 (which I built from source) thanks! My nss.conf file: # # This is the Apache server configuration file providing SSL support using. # the mod_nss plugin. It contains the configuration directives to instruct # the server how to serve pages over an https connection. # # Do NOT simply read the instructions in here without understanding # what they do. They're here only as hints or reminders. If you are unsure # consult the online docs. You have been warned. # LoadModule nss_module modules/libmodnss.so # # When we also provide SSL we have to listen to the # standard HTTP port (see above) and to the HTTPS port # # Note: Configurations that use IPv6 but not IPv4-mapped addresses need two # Listen directives: "Listen [::]:443" and "Listen 0.0.0.0:443" # Listen 443 ## ## SSL Global Context ## ## All SSL configuration in this context applies both to ## the main server and all SSL-enabled virtual hosts. ## # # Some MIME-types for downloading Certificates and CRLs # AddType application/x-x509-ca-cert .crt AddType application/x-pkcs7-crl .crl # Pass Phrase Dialog: # Configure the pass phrase gathering process. # The filtering dialog program (`builtin' is a internal # terminal dialog) has to provide the pass phrase on stdout. NSSPassPhraseDialog builtin # Pass Phrase Helper: # This helper program stores the token password pins between # restarts of Apache. NSSPassPhraseHelper /usr/sbin/nss_pcache # Configure the SSL Session Cache. # NSSSessionCacheSize is the number of entries in the cache. # NSSSessionCacheTimeout is the SSL2 session timeout (in seconds). # NSSSession3CacheTimeout is the SSL3/TLS session timeout (in seconds). NSSSessionCacheSize 10000 NSSSessionCacheTimeout 100 NSSSession3CacheTimeout 86400 # # Pseudo Random Number Generator (PRNG): # Configure one or more sources to seed the PRNG of the SSL library. # The seed data should be of good random quality. # WARNING! On some platforms /dev/random blocks if not enough entropy # is available. Those platforms usually also provide a non-blocking # device, /dev/urandom, which may be used instead. # # This does not support seeding the RNG with each connection. NSSRandomSeed startup builtin #NSSRandomSeed startup file:/dev/random 512 #NSSRandomSeed startup file:/dev/urandom 512 ## ## SSL Virtual Host Context ## <VirtualHost _default_:443> # General setup for the virtual host #DocumentRoot "/etc/httpd/htdocs" #ServerName www.example.com:443 #ServerAdmin you(a)example.com # Use separate log files for the SSL virtual host; note that LogLevel # is not inherited from httpd.conf. #ErrorLog /etc/httpd/logs/nss_error_log #TransferLog /etc/httpd/logs/nss_access_log LogLevel debug # SSL Engine Switch: # Enable/Disable SSL for this virtual host. NSSEngine on # SSL Cipher Suite: # List the ciphers that the client is permitted to negotiate. # See the mod_nss documentation for a complete list. # SSL 3 ciphers. SSL 2 is disabled by default. NSSCipherSuite +rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha #NSSCipherSuite -ALL:SSLv3+HIGH:-aNULL # SSL 3 ciphers + ECC ciphers. SSL 2 is disabled by default. # # Comment out the NSSCipherSuite line above and use the one below if you have # ECC enabled NSS and mod_nss and want to use Elliptical Curve Cryptography #NSSCipherSuite +rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha,-ecdh_ecdsa_null_sha,+ecdh_ecdsa_rc4_128_sha,+ecdh_ecdsa_3des_sha,+ecdh_ecdsa_aes_128_sha,+ecdh_ecdsa_aes_256_sha,-ecdhe_ecdsa_null_sha,+ecdhe_ecdsa_rc4_128_sha,+ecdhe_ecdsa_3des_sha,+ecdhe_ecdsa_aes_128_sha,+ecdhe_ecdsa_aes_256_sha,-ecdh_rsa_null_sha,+ecdh_rsa_128_sha,+ecdh_rsa_3des_sha,+ecdh_rsa_aes_128_sha,+ecdh_rsa_aes_256_sha,-echde_rsa_null,+ecdhe_rsa_rc4_128_sha,+ecdhe_rsa_3des_sha,+ecdhe_rsa_aes_128_sha,+ecdhe_rsa_aes_256_sha #NSSProtocol SSLv3,TLSv1 NSSProtocol -ALL +SSLv3 +TLSv1 # SSL Certificate Nickname: # The nickname of the RSA server certificate you are going to use. NSSNickname Server-Cert # SSL Certificate Nickname: # The nickname of the ECC server certificate you are going to use, if you # have an ECC-enabled version of NSS and mod_nss #NSSECCNickname Server-Cert-ecc # Server Certificate Database: # The NSS security database directory that holds the certificates and # keys. The database consists of 3 files: cert8.db, key3.db and secmod.db. # Provide the directory that these files exist. NSSCertificateDatabase /etc/httpd/alias # Database Prefix: # In order to be able to store multiple NSS databases in one directory # they need unique names. This option sets the database prefix used for # cert8.db and key3.db. #NSSDBPrefix my-prefix- # Client Authentication (Type): # Client certificate verification type. Types are none, optional and # require. NSSVerifyClient require # # Online Certificate Status Protocol (OCSP). # Verify that certificates have not been revoked before accepting them. NSSOCSP On # Access Control: # With SSLRequire you can do per-directory access control based # on arbitrary complex boolean expressions containing server # variable checks and other lookup directives. The syntax is a # mixture between C and Perl. See the mod_nss documentation # for more details. #<Location /> #NSSRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \ # and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ # and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \ # and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \ # and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \ # or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/ #</Location> # SSL Engine Options: # Set various options for the SSL engine. # o FakeBasicAuth: # Translate the client X.509 into a Basic Authorisation. This means that # the standard Auth/DBMAuth methods can be used for access control. The # user name is the `one line' version of the client's X.509 certificate. # Note that no password is obtained from the user. Every entry in the user # file needs this password: `xxj31ZMTZzkVA'. # o ExportCertData: # This exports two additional environment variables: SSL_CLIENT_CERT and # SSL_SERVER_CERT. These contain the PEM-encoded certificates of the # server (always existing) and the client (only existing when client # authentication is used). This can be used to import the certificates # into CGI scripts. # o StdEnvVars: # This exports the standard SSL/TLS related `SSL_*' environment variables. # Per default this exportation is switched off for performance reasons, # because the extraction step is an expensive operation and is usually # useless for serving static content. So one usually enables the # exportation for CGI and SSI requests only. # o StrictRequire: # This denies access when "NSSRequireSSL" or "NSSRequire" applied even # under a "Satisfy any" situation, i.e. when it applies access is denied # and no other module can change it. # o OptRenegotiate: # This enables optimized SSL connection renegotiation handling when SSL # directives are used in per-directory context. NSSOptions +FakeBasicAuth +ExportCertData +StrictRequire ##<Files ~ "\.(cgi|shtml|phtml|php3?)$"> # NSSOptions +StdEnvVars #</Files> #<Directory "/var/www/cgi-bin"> # NSSOptions +StdEnvVars #</Directory> # Per-Server Logging: # The home of a custom SSL log file. Use this when you want a # compact non-error SSL logfile on a virtual host basis. #CustomLog /home/rcrit/redhat/apache/logs/ssl_request_log \ # "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" </VirtualHost> <Location "/"> NSSRequireSSL </Location>

1 0

[Fedora-directory-users] error in yum fedora-ds
by Eric 25 Nov '08

25 Nov '08

Hi I tried yum install fedora-ds. all parts installed but at the last: warning: rpmts_HdrFromFdno: Header V3 DSA signature: NOKEY, key ID 1ac70ce6 Importing GPG key 0x1AC70CE6 "Fedora Project < fedora-extras(a)fedoraproject.org>" Is this ok [y/N]: y warning: rpmts_HdrFromFdno: Header V3 DSA signature: NOKEY, key ID a7b02652 Public key for fedora-ds-1.1.2-1.fc6.i386.rpm is not installed hwo acn I install it?

3 3

[Fedora-directory-users] Re: Windows sync: how do you populate the posixUser attributes?
by Erling Ringen Elvsrud 25 Nov '08

25 Nov '08

I have managed to make Windows sync work and have one user synced from AD in my directory. The posixUser-attributes are still empty. How do you populate those attributes in an effective way? If I have an empty directory, and the users alredy exists in AD I have been thinking of this manual approach: 1. Perform a full re-sync from AD. 2. Export all the users in directory server in a LDIF-file and with scripts populate the needed attributes like uid, shell, home, etc. 3. Write the changes back in directory server. For new users, if not too many, perform the needed changes manually. What do you think? Is it possible to do this automatically with Windows Sync or do I have to use approaches like I described? Thanks, Erling

3 12

[Fedora-directory-users] RE: userPassword
by Dharmin Mandalia 24 Nov '08

24 Nov '08

Hello Rich Megginson Thanks... without "" am able to login. Regards Dharmin Re: [Fedora-directory-users] userPassword Rich Megginson Mon, 24 Nov 2008 07:26:56 -0800 Dharmin Mandalia wrote: >> Hi >> >> I used below script to assign password(123.com) to user test1 account >> which has no password assigned and it does assign the password, when >> try to login as user test1 with password 123.com, am unable to login. >> Assigned passwords to few test accounts using below script and same >> issue unable to login. >> # ./script test1 123.com >> ######### START ###################################### >> #!/bin/ksh -x >> uid=$1 ; password=$2 >> PASSWD=`slappasswd -v -h {SSHA} -s "$password"` >> >> ldapmodify -x -D "cn=Directory Manager" -w `cat /tmp/p` << >> ALLDONE >> dn: uid=$uid,ou=People, dc=trust, dc=co, dc=uk >> changetype: modify >> add: userpassword >> userpassword: "$PASSWD" >> ALLDONE >> ######### END #################### >> >> When I export the database do see the the userPassword entry as :- >> userPassword: {SSHA}Q7B+QFu2iRXxH8Ys8bfW/i3O0HrjSKfwbZHn4A== >> > Have you tried it without the quotes in the here document? I think the > quotes may be interpreted literally in here documents. e.g. > userpassword: $PASSWD > >> In the script I also tried PASSWD=123.com , still the same , unable to >> login. >> >> Any helpers to why above script assigns the password but unable to >> login and what should I do so am able to login. >> >> Thanks >> >> Regards >> Dharmin >> >> >>

1 0

[Fedora-directory-users] FDS silent setup: Could not find user "admin" in the server 'ldap://ldap.testdomain.local:389/o=NetscapeRoot. Error: No such object
by forn 24 Nov '08

24 Nov '08

Hello. I'm trying to automate FDS installation. I provide the .inf file with required parameters to setup-ds-admin.pl script. In particular, ConfigDirectoryAdminID=admin. Directory server installs fine, but admin server fails with "Could not find user "admin" in the server 'ldap://ldap.testdomain.local:389/o=NetscapeRoot. Error: No such object" error. Looking in slapd log, there is no such object, indeed. It just not getting created. If I use setup-ds-admin scipt manually, all is ok. I also tried to provide ConfigDirectoryAdminID from command line (found this method somewhere in CentOS mailing lists). "setup-ds-admin.pl -s -f fds.inf General.ConfigDirectoryAdminID=admin" results in the very same error. The system is Fedora 9 i386 and FDS version is 1.1.3, if i if of any interest. I'd be grateful for any assistance.

2 1

[Fedora-directory-users] userPassword
by Dharmin Mandalia 24 Nov '08

24 Nov '08

Hi I used below script to assign password(123.com) to user test1 account which has no password assigned and it does assign the password, when try to login as user test1 with password 123.com, am unable to login. Assigned passwords to few test accounts using below script and same issue unable to login. # ./script test1 123.com ######### START ###################################### #!/bin/ksh -x uid=$1 ; password=$2 PASSWD=`slappasswd -v -h {SSHA} -s "$password"` ldapmodify -x -D "cn=Directory Manager" -w `cat /tmp/p` << ALLDONE dn: uid=$uid,ou=People, dc=trust, dc=co, dc=uk changetype: modify add: userpassword userpassword: "$PASSWD" ALLDONE ######### END #################### When I export the database do see the the userPassword entry as :- userPassword: {SSHA}Q7B+QFu2iRXxH8Ys8bfW/i3O0HrjSKfwbZHn4A== In the script I also tried PASSWD=123.com , still the same , unable to login. Any helpers to why above script assigns the password but unable to login and what should I do so am able to login. Thanks Regards Dharmin

2 1

[Fedora-directory-users] LDAP authentication against SAMBA?
by Seppel 21 Nov '08

21 Nov '08

Hi Fedora Directory User Group, I am Carsten from Cologne, Germany. I am searching for a solution where i can import all my ActiveDirectory Users to LDAP. If one of this "Imported" users try to authenticate via LDAP this request should be done against the real AD password. I don`t want install something on the ActiveDirectory! -> NoPAssSync! I found a lot of solution where samba is able to authenticate against LDAP. Is there a possibility that LDAP authenticate against SAMBA -> ActiveDirectory. I found the PassThrough PAM Plugin, would it be possible to combine that with SAMBA PAM? Thanks for any Input. Best regards carsten -- Sensationsangebot nur bis 30.11: GMX FreeDSL - Telefonanschluss + DSL für nur 16,37 Euro/mtl.!* http://dsl.gmx.de/?ac=OM.AD.PD003K11308T4569a

1 0

[Fedora-directory-users] posixgroup name lookups
by John A. Sullivan III 21 Nov '08

21 Nov '08

Hello, all. We're trying to move all our user access control to DS including file system rights management and thus group management. We've hit a few problems and would like to share how we've gotten around them both for documentation and so someone with more experience can tell us if we are going about this the wrong way. The first problem we hit was the various hosts could not resolve the gidnumber to a name: -sh-3.2$ id -gn id: cannot find name for group ID 2000 2000 We noticed in the access query that the hosts were looking for posixgroups: SRCH base="dc=ssiservices,dc=biz" scope=2 filter="(&(objectClass=posixGroup)(gidNumber=2000))" attrs="cn userPassword memberUid uniqueMember gidNumber" The problem comes with user's initial groups which are typically named after the uid. Since we had not created these explicitly as DS groups but rather simply assigned the gidnumber in the posixaccount's gidnumber attribute, there was no posixgroup to seek. I suppose the ideal way to address this is the change the query to look for a posixgroup or a posixaccount. I do not see how one does this. Instead, we added posixgroup as an objectclass to the users. Is this a reasonable way to go about this? Then we hit our next problem. The user's initial group is usually the same as their uid, e.g., user bsmith belongs to group bsmith. However, the query is looking for cn rather than uid. I suppose this is because a posixgroup, as opposed to a user, does not have a uid but does have a cn. This turned up as a problem where we wanted to control the umask in bashrc which uses logic such as: if [ $UID -gt 99 ] && [ "`id -gn`" = "`id -un`" ]; then umask 002 id -un would return bsmith but id -gn would return something like Brian Smith. Thus, we will need to make it a user creation procedure to override the cn to be the same as the uid rather than FirstName LastName. Is this the correct approach? Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan(a)opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society

4 15

[Fedora-directory-users] Question about upgrading
by Ryan Manikowski 21 Nov '08

21 Nov '08

Long time fedora-ds user here with a few questions about upgrading and hoping knowledgeable folks can provide some feedback. I am currently running Fedora DS on Centos 4.7 and Centos 5 servers. All servers run v1.0.1. 1) Can the Centos 4 machines running v1.0.1 upgrade to the latest v1.1.3 without any problems? 2) Is v1.1.3 even supported on Centos 4? Are there rpm's for it? 3) When upgrading Fedora DS versions, must they all be upgraded simultaneously? 4) Say one server is running v1.0.1 and another server is running 1.1.3, can data be replicated from a v1.0.1 server to a v1.1.3 server? How about vice-a-versa? 3 of our 4 Fedora DS servers can be upgraded to run Centos 5 w/ Fedora DS v1.1.3 but we'd like to keep one server running Centos 4.7 for the time being due to legacy software requirements. -- Ryan Manikowski System Administrator 2ergo Americas Inc. :703.677.8499: www.2ergo.com Arlington, Virginia This message (including attachments) is confidential and may be legally privileged. The content and views expressed are those of the sender and not necessarily the 2ergo Group. If you are not the intended recipient, you must not disclose, copy or use any part of it. Please delete all copies immediately and notify the sender. 2ergo Americas Inc. was formerly known as Proteus Inc.

2 1

[Fedora-directory-users] Dynamic groups not supplying posixgroup membership
by John A. Sullivan III 21 Nov '08

21 Nov '08

Hello, all. We have a multi-tenant set up where each client has a group which contains all their internal users. We thought we would save time by creating a dynamic group using a filter such as: ldap:///ou=internal,ou=users,dc=X,dc=com,dc=ssiservices, dc=biz??sub?(&(objectclass=person)(uid=*)) This appears to work and adequately populates the group. However, when the user logs in to a Linux system, the Linux system queries for group membership. We are noticing that we do not get any results when using dynamic groups. If we make the same group managed, we see the group membership. Notice these two records from the access log (truncated because of screen scraping): filter="(&(objectClass=posixGroup)(|(memberUid=te.kee)(uniqueMember=uid=te.kee,ou=internal,ou=Users,dc=ebc-co,dc=com,dc=ssiservices,dc= RESULT err=0 tag=101 nentries=1 etime=0 N.B. we have an entry. This used managed groups. When we change to dynamic groups, we see this: filter="(&(objectClass=posixGroup)(|(memberUid=te.kee)(uniqueMember=uid=te.kee,ou=internal,ou=Users,dc=ebc-co,dc=com,dc=ssiservices,dc RESULT err=0 tag=101 nentries=0 etime=0 N.B. no entries! Have we done something wrong? Is this a bug or is it the way it is supposed to work? Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan(a)opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society

2 1

[Fedora-directory-users] synchronize fedora with Lotus Domino and MS Active directory
by Hugo Hendriks 20 Nov '08

20 Nov '08

Hi, I have a brief question. I'm not really experienced in the whole LDAP field but I was trying to figure out if the following setup is possible. I have 2 different directory servers...a Lotus Notes/Domino server and a Active Directory server. Can we use Fedora as a central LDAP server and is it possible to easily synchronize/replicate the Fedora server with the Notes and AD server? I tried to find some documentation about this but only found http://directory.fedoraproject.org/wiki/Howto:WindowsSync so I guess synchronization with AD is covered but is this also possible with Notes? It also seems quite technical....are there perhaps certain tools which makes this more easy for you? Much thanks is advance! Best Regards, Hugo

2 5

[Fedora-directory-users] Replicate o=NetscapeRoot database
by Hugo Etievant 19 Nov '08

19 Nov '08

hello, - I have installed 2 Directory servers, the second (DS2) is registered on the first (DS1). - I have installed multi master replication between the both (DS1 and DS2) for user data on userRoot database. Here, that is working. - Finally, I try to configure multi master replication for o=NetscapeRoot database between 2 DS with the same way of conventional replication, after copying o=NetscapeRoot database from DS1 to DS2. Replication work, but Administration Server of DS2 refuse to start on the replica of NetscapeRoot. The Admin Guide is not clear about NetscapeRoot replication (8.14. Replicating o=NetscapeRoot for Administration Server Failover http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_Replication-R… ) It exists a way with GUI Console to configure replication for o=NetscapeRoot on existing architecture ? Who have experimented this point ? regards -- * Hugo Étiévant ***

3 6

[Fedora-directory-users] dbverify
by Dan Lannom 18 Nov '08

18 Nov '08

I plan to migrate to fds from SunOne 5.2 and so I want to validate the system. I'm currently running version 1.1.3-2 of the directory on RHEL 5.2. When I do searches against the server everything seems to work fine, but When I run /usr/lib/dirsrv/slapd-{{hostname}}/dbverify, with the server off, it fails with errors like: [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 2 [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 8 [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 11 [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 14 ... [28/Oct/2008:10:52:16 -0400] - libdb: /var/lib/dirsrv/slapd-hume/db/{{SUFFIX}}/{{attribute}}.db4: DB_VERIFY_BAD: Database verification failed [28/Oct/2008:10:52:16 -0400] DB verify - verify failed(-30975): /var/lib/dirsrv/slapd-{{hostname}}/db/userdata/{{attribute}}.db4 reindexing does not change anything and I find the same errors for both i386 and x86_64 and the errors are almost identical for the master and the slaves. Since I can find any evidence of the indexes identified as corrupted not working I wonder why dbverify is generating these errors. Thanks for any help, Dan Lannom UM-Dearborn

2 2

[Fedora-directory-users] [ioggstream] peculiar deploy of fedorads
by Roberto Polli 18 Nov '08

18 Nov '08

Hi all, I'm planning a mid-size deploy of fedora-ds. let's call the units of this deploy "island" islands are independent, data must be physically isolated betwen them * an island represent a scalable, multi-mastered deploy of fedora-ds made of 6+ nodes * I have more islands: island1, island2, .. * one island contains many mailDomain (foo.it, foo.net, foo.com) * a mailDomain is hosted on one island: if foo.it is on island1, it won't be on island2 * each island has its own services accessing ldap There's one Rule-Them-All (RTA) island with shared services. Services on the "RTA" must access all ldap using the same search for all the island ex. ldapsearch -h ruleThemAll "(mail=foo(a)bar.com)" should find the user independently on which island it is. question: how will you implement this requirements trying to limit the overhead? (somebody told me about a VirtualDS but I'd like to do it with FDS..) Peace, R.

1 0

[Fedora-directory-users] Windows Sync and Active Directory password complexity policies
by Hugo Etievant 18 Nov '08

18 Nov '08

hello, The admin Guid says that : "Make sure that the Active Directory password complexity policies are enabled so that the *Password Sync* service will run. Run |secpol.msc|, and select *Security Settings*, then *Account Policies*, and *Password Policy*. Make sure that |Password must meet complexity requirements| is selected. " ( cf http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Windows_Sync-Configuri… ) I done the installation same as required. But after a week, I have reconfigured Active Directory and unactivate the "|Password must meet complexity requirements|" attribute. Windows Sync continue to work without problem : new very simple password (for example, password identical to login) are synchronized between AD and FDS. Why the Admin Guide says this attribute is mandatory ? The facts show that it is not ! Is it a bug ? The |complexity requirements are too much complicated for my users (and are no configurable), i must unactivate it.| Regards -- * Hugo Étiévant *

2 1

[Fedora-directory-users] Recover directory database files when disk fills up!
by Howard Wilkinson 18 Nov '08

18 Nov '08

We had the disk with the directory database files fill up overnight, a rogue process :-[ Now the directory server will not start I get the following reported in the system logs. Jul 29 09:44:50 bastion ns-slapd: auxpropfunc error invalid parameter supplied Jul 29 09:44:50 bastion ns-slapd: sql_select option missing Jul 29 09:44:50 bastion ns-slapd: auxpropfunc error no mechanism available What can I do to recover the database so that I can start the server?

2 9

[Fedora-directory-users] Personal Address book In FDS
by stupid stupid 18 Nov '08

18 Nov '08

Hello, I am new to FDS and LDAP world. I have installed FDS on a server and would like to use it for Address book lookup. The address book look up is working from different mail clients, but I wanted to know how to allow users to add their own Personal Address book entries to the Fedora DS. Please help. Thanks

1 1

[Fedora-directory-users] ACI deny matching with macros
by John A. Sullivan III 17 Nov '08

17 Nov '08

Hello, all. This post is a follow up to an IRC chat with Rich Megginson and others. Rich, I did not report the problem as a bug because upon several more hours of testing, it does not appear to be a conflict between userdn and roledn permissions. Rather, it appears to be a wildcard globbing issue. To bring the everyone else up to speed, in a multi-tenant environment, we have an allow ACI to permit clients to administer their own portion of the tree. However, their portions of the tree also contain some system type accounts used to by the host to enable certain client functions. These should not be viewable by the client admins so there is an ACI to deny access to these. We also want to use macros to create a single ACI at the root which will apply to all clients rather than creating ACIs for each client. To grant client access, we create a role at the top of their tree named ldapadmins and assign it to the appropriate client admins. We create a root level ACI as follows: (targetattr = "*") (target = "ldap:///($dn),dc=ssiservices, dc=biz") (version 3.0;acl "Client Administrators";allow (all)(roledn = "ldap:///cn=ldapadmins,[$dn],dc=ssiservices,dc=biz");) It works fine. The tree looks something like this: root /com /client1 /Users /Internal /Contacts /SysAccounts No one would have access to SysAccounts except client ldapadmins from the above ACI. We don't want that so we create the following ACI to deny access to SysAccounts: (targetattr = "*") (target = "ldap:///ou=sysaccounts,($dn),dc=ssiservices,dc=biz") (version 3.0;acl "Protect sysaccounts";deny (all)(userdn = "ldap:///uid=*,ou=users,[$dn],dc=ssiservices,dc=biz");) We had contemplated (targetattr = "*") (target = "ldap:///ou=sysaccounts,($dn),dc=ssiservices,dc=biz") (version 3.0;acl "Protect sysaccounts";deny (all)(userdn = "ldap:///uid=*[$dn],dc=ssiservices,dc=biz");) but did not want to take the chance that the SysAccounts uses could not see themselves. Let's say we have a client admin at uid=terry,ou=internal,ou=users,dc=client1,dc=com,dc=ssiservices,dc=biz. The * after uid and with no comma before ou=users should match anything in users including "uid=terry,ou=internal,". It doesn't. The deny rule is not applied to Terry. If I change the ACI to: (targetattr = "*") (target = "ldap:///ou=sysaccounts,($dn),dc=ssiservices,dc=biz") (version 3.0;acl "Protect sysaccounts";deny (all)(userdn = "ldap:///uid=*ou=internal,ou=users,[$dn],dc=ssiservices,dc=biz");) it still fails. However, if I change it to: (targetattr = "*") (target = "ldap:///ou=sysaccounts,($dn),dc=ssiservices,dc=biz") (version 3.0;acl "Protect sysaccounts";deny (all)(userdn = "ldap:///uid=*,ou=internal,ou=users,[$dn],dc=ssiservices,dc=biz");) it works. The deny matches Terry and is enforced. This seems to be an explicit contradiction of the documentation. http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_Access_Contro… userdn = "ldap:///uid=*,dc=example,dc=com"; The bind rule is evaluated to be true if the user binds to the directory using any distinguished name of the specified pattern. For example, both of the following bind DNs would be evaluated to be true: uid=ssarette,dc=example,dc=com uid=tjaz,ou=Accounting,dc=example,dc=com Are we doing something wrong or is this just a mismatch between code and docs? Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan(a)opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society

1 0

[Fedora-directory-users] DSGW user authorization problem
by Lev Dudko 17 Nov '08

17 Nov '08

Dear Directory server experts, could you help me, please, to solve the problem with DSGW authorization. I have successfully setup FDS on Fedora 9 with setup-ds-admin.pl setup ssl with the help of script from this page: http://www.linuxmail.info/fedora-directory-server-setup-howto-centos-5/ and run setup-ds-dsgw Now, the directory server works, administration server works and I can configure everything in DS and Admin server with console fedora-idm-console -a https://localhost:9830 ldap and ldaps ports are open and accept requests. I can point my browser to https://localhost:9830 and use DSGW to search successfully, but I can not do authorization, when I try to authorize as some user (normal user, Directory Manager or admin) I got the error: Authentication Failed Authentication failed because the password you supplied is incorrect. Please click the Retry button and try again. If you have forgotten the password for this entry, a directory administrator must reset the password for you. Of course, I am sure that the password is correct. There are no so much useful information in the log files. The executable /usr/lib64/dirsrv/dsgw-cgi-bin/doauth do this authorization. I have read available documentation rather careful, but did not find the answer. Looks like one of the solution is to use binddnfile directive with special text file, but it looks strange for me that it is impossible to use normal authorization in LDAP with DSGW. Have I missed something during the configuration or forgot to add some special ACL? Lev

2 7

[Fedora-directory-users] Error generating certificate-signing request
by Christopher Waltham 17 Nov '08

17 Nov '08

I'm having trouble generating a CSR on a pair of new DS 1.1.3 installs. I get this error message: "An error has occured. Unable to convert DN to certificate name. -----BEGIN NEW CERTIFICATE REQUEST-----" " (There is actually nothing listed under the "BEGIN NEW CERTIFICATE REQUEST" part). This is my DN of the request: CN="falls", OU="Information Technology",O="Bowdoin College",L="Brunswick",ST="Maine",C="US". I found this thread: http://www.linux-archive.org/fedora-directory/160707-error-creating-certifi… online and tried the suggestion, i.e. removing the " quotes in the DN. After that, the request was generated successfully -- however, I don't think that this is good behavior.. has anyone seen this issue before? Chris

1 0

[Fedora-directory-users] "Server failed to start !!!" when installing FDS 1.1.3 in RHEL5.2
by Christopher Waltham 17 Nov '08

17 Nov '08

I'm using RHEL5.2 (i386) and installing RPMs from the FDS repository that's mentioned on the FDS wiki. But I'm having trouble configuring FDS 1.1.3 due to errors that I believe are related to permissions on / var/run/dirsrv. Before installing DS, here are the permission on /var/run/dirsrv: [root@falls ~]# ls -ald /var/run/dirsrv drwxr-xr-x 3 root root 4096 Nov 14 09:24 /var/run/dirsrv When finishing the end of setup-ds-admin.pl, I see these messages: Are you ready to set up your servers? [yes]: Creating directory server . . . Server failed to start !!! Please check errors log for problems Possible timeout starting server: timeout=1226673415 now=1226673416 Could not start the directory server using command '/usr/lib/dirsrv/ slapd-falls/start-slapd'. The last line from the error log was '[14/ Nov/2008:09:26:55 -0500] - Fedora-Directory/1.1.3 B2008.269.157 starting up '. Error: Unknown error 256 Error: Could not create directory server instance 'falls'. Exiting . . . Log file is '/tmp/setupblsNWZ.log' There is nothing else of relevance in either /tmp/setupblsNWZ.log or / var/log/dirsrv/slapd-falls/errors If I try and start the directory server after the installation failed, I get this error: [root@falls ~]# /etc/init.d/dirsrv start Starting dirsrv: falls... [FAILED] *** Warning: 1 instance(s) failed to start If I manually chmod & chown the /var/run/dirsrv directory, it will start: [root@falls ~]# chmod 770 /var/run/dirsrv && chown nobody:nobody /var/ run/dirsrv [root@falls ~]# /etc/init.d/dirsrv start Starting dirsrv: falls... [ OK ] However, because the setup-ds-admin.pl process never completed, the admin server hasn't been configured (and I don't want to have to do that by hand). Note that I am using nobody:nobody in the FDS installer when asked who I want to run the services as. When I manually ( chmod 770 /var/run/dirsrv && chown nobody:nobody / var/run/dirsrv ) *before* I run setup-ds-admin.pl I get this error: [08/11/14:09:00:33] - [Setup] Info Are you ready to set up your servers? [08/11/14:09:00:34] - [Setup] Info yes [08/11/14:09:00:34] - [Setup] Info Creating directory server . . . [08/11/14:09:00:36] - [Setup] Info Your new DS instance 'ldap' was successfully created. [08/11/14:09:00:36] - [Setup] Info Creating the configuration directory server . . . [08/11/14:09:00:36] - [Setup] Fatal The suffix 'o=NetscapeRoot' already exists. Config entry DN 'cn="o=NetscapeRoot",cn=mapping tree,cn=config'. [08/11/14:09:00:36] - [Setup] Fatal Failed to create the configuration directory server [08/11/14:09:00:36] - [Setup] Fatal Exiting . . . Any thoughts? This is getting pretty frustrating :-\ Thanks, Chris

3 13

[Fedora-directory-users] DSGW user authorization problem
by Lev Dudko 16 Nov '08

16 Nov '08

Dear Directory server experts, could you help me, please, to solve the problem with DSGW authorization. I have successfully setup FDS on Fedora 9 with setup-ds-admin.pl setup ssl with the help of script from this page: http://www.linuxmail.info/fedora-directory-server-setup-howto-centos-5/ run setup-ds-dsgw Now, the directory server works, administration server works and I can configure everything in DS and Admin server with console fedora-idm-console -a https://localhost:9830 I can point my browser to https://localhost:9830 and use DSGW to search successfully, but I can not do authorization, when I try to authorize as some user (normal user, Directory Manager or admin) I got the error: Authentication Failed Authentication failed because the password you supplied is incorrect. Please click the Retry button and try again. If you have forgotten the password for this entry, a directory administrator must reset the password for you. Of course, I am sure that the password is correct. There are no so much useful information in the log files. The executable /usr/lib64/dirsrv/dsgw-cgi-bin/doauth do this authorization. I have read available documentation rather careful, but did not find the answer. Looks like one of the solution is to use binddnfile directive with special text file, but it looks strange for me that it is impossible to use normal authorization in LDAP with DSGW. Do I missed something during the configuration or forgot to add some special ACL? Lev

1 0

[Fedora-directory-users] Restored dirsrv on another system but now it does not return any entries for queries
by Richard Sharpe 16 Nov '08

16 Nov '08

Hi, I was trying to move our dirsrv to another machine, so I installed Fedora-DS on the new server, backed up the original machine, restored it on the new server, which seemed to go OK. If I do "ldapsearch -x '*'" on the new server, I seem to get the correct results, however, if I do 'getent passwd' I do not get any entries from dirsrv. I grabbed packet captures from doing 'getent passwd' where LDAP points at the original dirsrv server and the new one (boy, I knew that all that work I did on Ethereal would come in handy one day) and the difference is that against the original dirsrv server I get back all the posixAccount (or something) entries, but against the new dirsrv server, I get back zero entries. However, the queries are the same. The log file on the new dirsrv server also says zero entries returned. What have I forgotten? I haven't yet switched on lots of debugging to find out what is wrong on the new server, but I guess that is the next step if no one can think of something obvious I have done wrong. -- Regards, Richard Sharpe

1 1

[Fedora-directory-users] Unable to access server group
by Matt Adams 15 Nov '08

15 Nov '08

Folks: We recently changed the name of our LDAP server. We had a domain name change so ldaphost.subdomain.example.org effectively became ldaphost.new.subdomain.example.org) I changed every instance of subdomain.example.org throughout the Fedora DS configuration files and LDAP tree under o=NetscapeRoot. Everything appears to run okay: the directory server and admin server start up, answer queries and none of the integrated applications have had any trouble with this change. The only problem seems to be that I cannot access either the admin server or directory server through the Fedora management console. The "Server Group" entry under our administrative domain & host is empty (e.g., Administrative Server & Directory Server refuse to show up like they used to). Does anyone have any idea what might be happening here? I cannot find any errors that stand out in the logs. FWIW, we are running 1.0.4. Thanks in advance, Matt -- Matt Adams Development & Network Services Cypress Interactive http://cypressinteractive.com, http://edsuite.com

1 1

[Fedora-directory-users] Personal Address book In FDS
by stupid stupid 14 Nov '08

14 Nov '08

Hello, I am new to FDS and LDAP world. I have installed FDS on a server and would like to use it for Address book lookup. The address book look up is working from different mail clients, but I wanted to know how to allow users to add their own Personal Address book entries to the Fedora DS. Please help. Thanks

1 1

[Fedora-directory-users] surgery on existing directory
by Graham Seaman 14 Nov '08

14 Nov '08

Hi, I have an existing populated directory supporting a live application. The next development version will have some fairly large scale changes - changes to schema, objectClasses, attribute names and attribute values - but I can't lose the actual data we already have. The approach I've been trying is: 1. Use db2ldif to dump the groups and users (the only bit of the data which is 'mine') from the live directory on the live system: /usr/lib/dirsrv/slapd-flame/db2ldif -U -n userRoot -a /opt/backups/original.ldif -s "dc=lse,dc=ac,dc=uk" -s "ou=My Groups" -s "ou=My Users" 2. Edit the ldif file with the changes I need 3. Load the ldif file into a new fedora directory on my development system with ldif2db.pl: /usr/lib/dirsrv/slapd-dam/ldif2db.pl -D "cn=directory manager" -w MYPASS -n userRoot -s "dc=lse,dc=ac,dc=uk" -s "ou=New Groups" -s "ou=New Users" -i /opt/backups/new.ldif ldif2db.pl terminates almost immediately, clearly without having read most of the file. The fedora log shows: [14/Nov/2008:11:35:54 +0000] conn=2 op=1 ADD dn="cn=import_2008_11_14_11_35_55, cn=import, cn=tasks, cn=config" [14/Nov/2008:11:35:54 +0000] conn=2 op=1 RESULT err=0 tag=105 nentries=0 etime=0 If I repeat the operation I get 'operation error'; and if I try to access the directory, it appears to be completely empty. So, two questions: - is this a reasonable way to go about this task, or are there other tools I should use? - any suggestions for debugging? Thanks Graham

2 2

[Fedora-directory-users] I can not write dse.ldif file
by Hugo Etievant 14 Nov '08

14 Nov '08

hello, When I do some updates in the content of the dse.ldif file for an instance (/etc/dirsrv/slapd-instance/), my file is rewrited and restored back to the previous version automatically by FDS without my permission ! How can I ensure durability of my updates for this config file ? regards -- * Hugo Étiévant *

2 1

[Fedora-directory-users] Frequency of sync windows
by Hugo Etievant 13 Nov '08

13 Nov '08

hello, The admin manual say : "Synchronization occurs every five minutes. However, an incremental update can be done manually if there are changes that need synchronized immediately." ( http://www.redhat.com/docs/manuals/dir-server/ag/8.0/ Windows_Sync-Using_Windows_Sync.html ) But my tests show that the synchro of users accounts, passwords and attributes of entries is being in real time between FDS and Active Directory without forcing "receive and send update" action in Fedora IDM Console ! What are the real rules and frequencies of synchronization ? How can we change those parameters ? regards -- * Hugo Étiévant ***

4 4

[Fedora-directory-users] Errors when a full re-sync is initiated in Windows Sync. Could temp. changes in binding-user rights be the cause?
by Erling Ringen Elvsrud 13 Nov '08

13 Nov '08

When right clicking on the win-sync agreement and selecting initiate full re-synchronization I get these errors in /var/log/dirsrv/slapd-xyz/errors: "[10/Nov/2008:08:05:52 +0100] NSMMReplicationPlugin - changelog program - libdb: txn_checkpoint: failed to flush the buffer cache No such file or directory [10/Nov/2008:08:05:53 +0100] NSMMReplicationPlugin - changelog program - libdb: 26fdcb82-912411dd-8d71b7a1-43daa7e9_48e5d6030000ffff0000.db4: unable to flush: No such file or directory [10/Nov/2008:08:05:53 +0100] NSMMReplicationPlugin - changelog program - libdb: txn_checkpoint: failed to flush the buffer cache No such file or directory [10/Nov/2008:08:05:53 +0100] NSMMReplicationPlugin - changelog program - libdb: 26fdcb82-912411dd-8d71b7a1-43daa7e9_48e5d6030000ffff0000.db4: unable to flush: No such file or directory [10/Nov/2008:08:05:53 +0100] NSMMReplicationPlugin - changelog program - libdb: txn_checkpoint: failed to flush the buffer cache No such file or directory" A dialog box also appears with the following text: "An error occured during the consumer initialization The error received by the replica is '12 Total update aborted: Replication agreement for agmnt=xyz can not be updated while the replica is disabled (if the suffix is disabled you must enable it then restart the server for replication to take place).'. To check the initialization status, go to the 'status' tab and click on 'Replication status' in the left pane. The status of the initialization appears in the right pane." Before the problems occured we temporarily disabled "domain admins" rights for the user WIndows Sync uses to bind to AD. While the binding-user only had read acess for the suffix we wanted to sync with we started a full re-sync (with the errors above). The dirsrv was also restarted. We have re-enabled "domain admins" rights for the binding-user but the errors still appear. The directory server is searchable and seems to work exept for syncing. Could it be that the temporary changes in rights for the binding-user could have caused this? Also, is it absolutely needed to have domain admin rights for the binding-user RHDS uses to connect to AD? We do not want to write any changes back to AD and those attributes synced with Windows sync will not be changed anyway. Thanks, Erling

2 3

[Fedora-directory-users] Unable to create certificate request if O=Example, Inc.
by mallapadi niranjan 12 Nov '08

12 Nov '08

Hi all I have Fedora Directory Server installed on F9 box (fedora-ds-base-1.1.3-2.fc9.x86_64). Due to sum bug i guess , i am unable to create the certificate request through Console that is Directory Server->Manager Certificates-> Request -> Request Certificate Manually. In the Server Name:dhcp7-92.example.com Organization: Example, Inc. City/Locality: Raleigh State/Province: North Carolina Country/Region: US United States Click on Show DN and i remove all the double quotes and my DN looks as below CN="dhcp7-92.example.com, O=Example, Inc., L=Raleigh, ST=North Carolina, C=US When i click on Next it says "Unable to convert DN to certificate name So i tried with certutil command. $cd /etc/dirsrv/slapd-dhcp7-92/ $certutil -R -s "C=US, ST=North Carolina, L=Raleigh, O=Example, Inc., CN= dhcp7-92.example.com" -o mycert.req -d . I got the below output certutil -s: improperly formatted name: "C=US, ST=North Carolina, L=Raleigh, O=Example, Inc., CN=dhcp7-92.pnq.redhat.com" Now if i modify it as "certutil -R -s "C=US, ST=North Carolina, L=Raleigh, O=Example, CN=dhcp7-92.pnq.redhat.com" -o mycert.req -d ." it works. The same with the console i.e If Organization title is modified from "Example, Inc. " to "Example" it works. So the space and period symbol in (Example, Inc.) is an issue ? But this doesn't happen when i create certifcate requests with openssl commands. Regards Niranjan

2 1

[Fedora-directory-users] PassSync : Windows Active Directory remember my last 2 passwords
by Hugo Etievant 12 Nov '08

12 Nov '08

hello, I discovered a strange behavior with Active Directory LDAP protocol ! My config : - an Active Directory on MS Windows Server 2003 SP2 + PassSync service - a Fedora Directory Server 1.1.3 + Replication Agreement for Windows synchronization Bidirectional synchronization of accounts is running, it is OKAY. When an administrator reset an user password with Administration Server Console, this user can connects him to Windows LDAP with the new password choosed by administrator (the sync of password is OK), But this user can also uses the previous password (big surprise) ! => both are accepted by Windows LDAP : the last and the previous password !!! How that can be possible ???! And how to stop this strange behavior ? User connexions are made with ldapsearch command : /usr/lib/mozldap/ldapsearch -h adfds -P /etc/dirsrv/slapd-fds3/ -m /etc/dirsrv/slapd-fds3/ -D "cn=Gontran Bonheur,cn=Users,dc=example,dc=fr" -b "cn=Users,dc=example,dc=fr" -w - "(cn=Gontran Bonheur)" dn This request accepts the new and the previous passwords !!!!!! If I force "Send and Receive Updates Now" in the Console, the behavior does not change. If my user uses Windows login banner, this behavior doesn't appear. Regards. -- * Hugo Étiévant ***

3 3

[Fedora-directory-users] Removing attributes from Active Directory on sync
by Jeff Williams 11 Nov '08

11 Nov '08

Hello, I'm trying to create a AD<->FDS sync Our AD has the following layout: uid=myuser,Ou=User,OU=CompanyGroup,dc=ourADdomain,dc=com While our LDAP structure has the following layout: uid=myuser,ou=people,dc=ldapdomain,dc=com How can I make sure that the users from the AD ou=user,ou=CompanyGroup,dc=ouraddomain,dc=com are placed in the ou=people,dc=ldapdomain,dc=com container? I'm not sure how to consistently remove the excessive AD attribute? Thanks, Jeff Williams

2 3

[Fedora-directory-users] Windows sync: Synchronization of group membership
by Erling Ringen Elvsrud 11 Nov '08

11 Nov '08

Hello list, According to the RHDS Administration Guide in the chapter on Windows Sync(page 531): "The membership of groups is synchronized with the constraint that only those members that are also within the scope of the agreement are propagated" (note that I did not read this before the test) I have tried the following: In AD I have: ou=LinuxUsers ou=LinuxGroups I have configured two separate synchronization agreements in RHDS, one that populate ou=People from ou=LinuxUsers in AD and one that populate ou=Groups from ou=LinuxGroups in AD. The synchronization works, and after it is complete I use ldapsearch on ou=Groups in RHDS and ou=LinuxGroups in AD and the member-attributes is indeed missing on the RHDS side. So, in order to keep group-membership I need to synchronize the parent ou of both users and groups. So something like ou=LinuxUsers,ou=Linux, dc=... and ou=LinuxGroups, ou=Linux, dc=... must be created in AD, and in the synchronization agreement I will sync ou=Linux and get both users and groups. The alternative is to synchronize with the current parrent of LinuxUsers and LinuxGruops. Is this correct? Do you know why this "limitation" exists? Thanks Erling

2 1

[Fedora-directory-users] Coolkey
by Zach Casper 10 Nov '08

10 Nov '08

I'm currently attempting to use the Coolkey applet but we are not Gemalto users/developers. Does a version exist in a CAP file versus the IJC built Java Card applet or Does a non-Cyberflex dependent src exist? I don't believe that SDK is available but non-the-less it was still a "for fee" piece. Where is the true Open Source non-dependent Coolkey solution? We have already been using MUSCLE and others but I understand Coolkey has matured from v0.9.1 and current MUSCLE is at v0.9.8 Zach

1 0

[Fedora-directory-users] remote connection to console
by Eric 10 Nov '08

10 Nov '08

Hi, there was a fedora ds version 1.0.4. admin had a remote console via an intermadiate machine using ssh tunnel. fedora-ds folder was destroyed then I replaced it with a copy of fedora-ds folder from another installation. the server works well but the admin hasn't remote console. the ssh file that worked before is: ssh -L 389:ldap server IP:389 -L 8080:ldap server IP:port of fedora-ds installation -l admin intermadiate _machine _IP I only changed the port number of fedora-ds installation with new port number. shuld I change another thing?

1 0

Re: [Fedora-directory-users] Exporting the Fedora DS certificate
by Rusch Philipp pru09 10 Nov '08

10 Nov '08

Hi, Thank you for your help. I am using fedora-ds 1.0.4-1 (RH4). I need both, the certificate and the key. Rgds Phru

1 0

[Fedora-directory-users] PassSync : Windows Active Directory remember my last 2 passwords
by Vipul Ramani 07 Nov '08

07 Nov '08

Well It is not FDS problem - this is something MS changed in win2003 http://support.microsoft.com/?kbid=906305 -- Regards Vipul Ramani

1 0

[Fedora-directory-users] Exporting the Fedora DS certificate
by Rusch Philipp pru09 07 Nov '08

07 Nov '08

Hi together, I have successfully set up my directory server. For a disaster tolerant topology I want to load balance the two servers over a F5 LTM load balancer. My problem is, that I have tried to export the certificate ( I have a self generated one ) without a result. The load balancer could only read certificates in pem format. So, if anyone of you know what type of certificate the DS uses let me know about it ;-) The certificate was generated with the gencert.sh script which is available under http://github.com/richm/scripts/tree/master%2Fsetupssl.sh?raw=true I don't know very much about the SSL stuff so I am not sure If I have tried the right tools/commands. Which one is the certificate the slapd-yourhost-cert8.db or is it only stored in there? Thank you in advance! Cheers phru

3 2

Re: [Fedora-directory-users] Exporting the Fedora DS certificate
by Rusch Philipp pru09 07 Nov '08

07 Nov '08

I had the same issue exporting my certificate in pkcs12 format to import it to the radius part of my authentification server. Indeed, there are two certificates in the pkcs12 file for chaining with root certificat, you must specify to write options to extract only the good one (or edit the pem on you own to cut off the bad one). # certutil -d . -L # pk12util -d . -o ldap-server.pk12 -n «certificate name » # pk12util -d /etc/dirsrv/slapd-server/ -i ldap-server.pk12 -n «certificat name» # openssl pcks12 -clcerts : no client certificate -cacerts : no CA certificate I think the option -cacerts will fix your issue as it fixed mine. In fact, it's a bug with poor implementations of pem file reading (like freeradius does). Hope it would help. Regards. -- Nicolas CAREL Service Commun Informatique Chef de service Tel : 04 72 76 61 43 - e-mail : nicolas carel inrp fr <mailto:nicolas%20carel%20inrp%20fr> Institut National de Recherche Pédagogique <http://www.inrp.fr/> 19 allée de Fontenay - B.P. 17424 - 69347 LYON CEDEX 07 Standard : 04 72 76 61 00 - Télécopie : 04 72 76 61 10 Attachment: smime.p7s <https://www.redhat.com/archives/fedora-directory-users/2008-November/p7sg6w…> Description: S/MIME Cryptographic Signature Hi, Thank you for your help. I am using fedora-ds 1.0.4-1 (RH4). When I try to run the certutil -d . -L command there is no output or certificate available?! Where is the mistake? /opt/fedora-ds/alias /opt/fedora-ds/shared/bin/certutil -d . -L In the directory /opt/fedora-ds/alias I have the following files: admin-serv-host-cert8.db admin-serv-host-key3.db adminserver.p12 cacert.asc cert8.db gencert.sh key3.db libnssckbi.so noise.txt password.conf pwdfile.txt secmod.db slapd-host-cert8.db slapd- host -cert8.db.bak slapd- host -key3.db slapd- host -key3.db.bak slapd- host -pin.txt The secured LDAP connection from a client to the server is working properly, therefore I think the certificates are installed right. Thank you in advance Regards Phru

1 0

[Fedora-directory-users] Exporting the Fedora DS certificate
by Rusch Philipp pru09 06 Nov '08

06 Nov '08

Hi together, I have successfully set up my directory server. For a disaster tolerant topology I want to load balance the two servers over a F5 LTM load balancer. My problem is, that I have tried to export the certificate ( I have a self generated one ) without a result. The load balancer could only read certificates in pem format. So, if anyone of you know what type of certificate the DS uses let me know about it ;-) The certificate was generated with the gencert.sh script which is available under http://github.com/richm/scripts/tree/master%2Fsetupssl.sh?raw=true I don't know very much about the SSL stuff so I am not sure If I have tried the right tools/commands. Which one is the certificate the slapd-yourhost-cert8.db or is it only stored in there? Thank you in advance! Cheers phru

1 0

[Fedora-directory-users] Discussion about "Configuration DS" & "User DS" settings in Admin Server Console
by Hugo Etievant 06 Nov '08

06 Nov '08

hello, In the general "Configuration" tab of "Administration Server" Console, what differences between connexion settings in "User DS" and "Configuration DS" tabs ? Theses settings are redundant, no ? "User DS" settings are used by Administration Server to be connected to the Directory Server configuration database (netscapeRoot). But what additional information is supplied by "Configuration DS" ??? bye -- * Hugo Étiévant ***

2 1

[Fedora-directory-users] Re: WinSync userAccountControl bug (was Fedora-directory-users Digest, Vol 42, Issue 4)
by John Dickinson 06 Nov '08

06 Nov '08

Rich Megginson <rmeggins(a)redhat.com> wrote: > Howard Chu wrote: >>> Date: Tue, 04 Nov 2008 08:13:08 -0700 >>> From: Rich Megginson<rmeggins(a)redhat.com> >> >>> John Dickinson wrote: >>>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins(a)redhat.com> >>>> wrote: >> >>>> create user in AD userAccountControl: 512 >>>> (Normal) >>>> create user in Fedora DS (console) userAccountControl: 546 >>>> (Normal + >>>> PASSWD_NOTREQ + ACCOUNTDISABLE) >>>> >>>> Would there be anything wrong with Fedora DS just forcing >>>> userAccountControl = 512? Or are more options needed in the user >>>> creation dialog? >>> I'm not sure. 1.1.3 included a "fix" for userAccountControl. The >>> way >>> it works now is this: >>> add new AD entry over LDAP - no userAccountControl attribute is >>> present, >>> so it must use some sort of AD default value >>> read the new AD entry - get the userAccountControl value >>> set AD entry userAccountControl |= 0x200 # 512 == normal account) >>> >>> So you might try a simple test - add a new AD entry over LDAP >>> outside of >>> windows sync - see what the default userAccountControl value is - >>> I'm >>> guessing that adding a new AD entry without specifying >>> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE >> >> Yes, users created via LDAP are disabled unless you explicitly >> provide >> the userAccountControl attribute (with proper flags) in the LDAP Add >> operation. I tripped over this myself the first time I loaded up a >> test database in AD. (It also gave me a Fine Opportunity to time how >> long it took to LDAP Modify all of the users in my test database. >> ugh...) >> > Then this is a bug in the winsync code. In the ADD case, it should > just > force userAccountControl to the Normal value. In the MOD case, it > should |= the value. John, can you open a bug about this issue? > Thanks. Done - https://bugzilla.redhat.com/show_bug.cgi?id=470224 There are other values of userAccountControl that an administrator might want to set when creating users. One example is DONT_EXPIRE_PASSWORD - so is there a need for the userAccountControl flags to be configurable on a create user dialog such as that in fedora-idm-console or phpldapadmin rather than hard coded? John P.S. Sorry about the totally useless subject line earlier in this thread.

2 1

[Fedora-directory-users] enforcing ssl
by Graham Seaman 06 Nov '08

06 Nov '08

Hi, I'm trying to set up Fedora DS to be accessible only with SSL. My DS is on a standalone remote server, with most ports firewalled. If I open ports 389 and 636, I can run ldapsearch ok using SSL (the access log shows 'SSL connection.. using 256-bit AES') but I can also choose not to use SSL and still make queries. If I close port 389, I can't connect to the server with or without SSL - I just get 'ldap_start_tls: Can't contact LDAP server (-1)'. This is even if I explicitly specify port 636, not just relying on the '-Z' flag for ldapsearch. Is it possible to close down non-SSL access? (I am not using the admin server, so this needs to be through manual configuration) Thanks for any advice Graham

2 3

[Fedora-directory-users] How to configure Multimaster Replication - doubts with the documentation
by Morenisco 05 Nov '08

05 Nov '08

Hi, I worked by almost a year with OID (Oracle Internet Directory), and now I would like to learn Fedora Directory Server with multimaster replication. I'm reviewing the existing documentation and I found information related to multimaster replication in the URL: http://directory.fedoraproject.org/wiki/Howto:MultiMasterReplication But I have the following doubt: In the requeriments I understand that I need three scripts; the old-mmr.pl, the newer mmr.pl and the modified mmr.pl. Then, really I need to apply these three scritps, or just I can use the newer mmr.pl script if I want to use the standard ports? Thanks a lot. -- Morenisco. Centro de Difusión del Software Libre. http://www.cdsl.cl Blog: http://morenisco.belvil.eu

2 1

[Fedora-directory-users] Problems migrating from libdb-4.4 to libdb-4.7
by Vitaly Kuznetsov 05 Nov '08

05 Nov '08

Hello! I'm trying to build Fedora-DS for ALT Linux project with new libdb-4.7. Old instances use libdb-4.4. I have some problems with data migration. FDS with db4.7 does not want to read old (db4.4) data with errors. I tried to delete logs and do db_upgrade - without success. New instances work fine. Fedora DS versions (old and new) are both 1.1.3. Errors: [05/Nov/2008:13:56:37 +0300] - Fedora-Directory/1.1.3 B2008.310.1047 starting up [05/Nov/2008:13:56:37 +0300] - Clean up db environment and start from archive. [05/Nov/2008:13:56:37 +0300] - libdb: Program version 4.7 doesn't match environment version 4.4 [05/Nov/2008:13:56:37 +0300] - libdb: Program version 4.7 doesn't match environment version 4.4 [05/Nov/2008:13:56:37 +0300] - Deleting log file: (/var/lib/fedora-ds/slapd-ldap1/db/log.0000000001) [05/Nov/2008:13:56:37 +0300] - Deleting log file: (/var/lib/fedora-ds/slapd-ldap1/db/log.0000000147) [05/Nov/2008:13:56:38 +0300] - attrcrypt_unwrap_key: failed to unwrap key for cipher AES [05/Nov/2008:13:56:38 +0300] - Failed to retrieve key for cipher AES in attrcrypt_cipher_init [05/Nov/2008:13:56:38 +0300] - Failed to initialize cipher AES in attrcrypt_init [05/Nov/2008:13:56:38 +0300] - libdb: file userRoot/id2entry.db4 has LSN 134/2584752, past end of log at 1/140 [05/Nov/2008:13:56:38 +0300] - libdb: Commonly caused by moving a database from one database environment [05/Nov/2008:13:56:38 +0300] - libdb: to another without clearing the database LSNs, or by removing all of [05/Nov/2008:13:56:38 +0300] - libdb: the log files from a database environment [05/Nov/2008:13:56:38 +0300] - libdb: /var/lib/fedora-ds/slapd-ldap1/db/userRoot/id2entry.db4: unexpected file type or format [05/Nov/2008:13:56:38 +0300] - dbp->open("userRoot/id2entry.db4") failed: Invalid argument (22) [05/Nov/2008:13:56:38 +0300] - dblayer_instance_start fail: Invalid argument (22) [05/Nov/2008:13:56:38 +0300] - attrcrypt_unwrap_key: failed to unwrap key for cipher AES [05/Nov/2008:13:56:38 +0300] - Failed to retrieve key for cipher AES in attrcrypt_cipher_init [05/Nov/2008:13:56:38 +0300] - Failed to initialize cipher AES in attrcrypt_init [05/Nov/2008:13:56:38 +0300] - libdb: file NetscapeRoot/id2entry.db4 has LSN 1/3096357, past end of log at 1/140 [05/Nov/2008:13:56:38 +0300] - libdb: Commonly caused by moving a database from one database environment [05/Nov/2008:13:56:38 +0300] - libdb: to another without clearing the database LSNs, or by removing all of [05/Nov/2008:13:56:38 +0300] - libdb: the log files from a database environment [05/Nov/2008:13:56:38 +0300] - libdb: /var/lib/fedora-ds/slapd-ldap1/db/NetscapeRoot/id2entry.db4: unexpected file type or format [05/Nov/2008:13:56:38 +0300] - dbp->open("NetscapeRoot/id2entry.db4") failed: Invalid argument (22) [05/Nov/2008:13:56:38 +0300] - dblayer_instance_start fail: Invalid argument (22) [05/Nov/2008:13:56:38 +0300] - start: Failed to start databases, err=22 Invalid argument [05/Nov/2008:13:56:38 +0300] - Failed to allocate 10000000 byte dbcache. Please reduce nsslapd-cache-autosize and Restart the server. [05/Nov/2008:13:56:38 +0300] - Failed to start database plugin ldbm database [05/Nov/2008:13:56:38 +0300] - WARNING: ldbm instance userRoot already exists [05/Nov/2008:13:56:38 +0300] - WARNING: ldbm instance NetscapeRoot already exists [05/Nov/2008:13:56:38 +0300] binder-based resource limits - nsLookThroughLimit: parameter error (slapi_reslimit_register() already registered) [05/Nov/2008:13:56:38 +0300] - start: Resource limit registration failed [05/Nov/2008:13:56:38 +0300] - Failed to start database plugin ldbm database [05/Nov/2008:13:56:38 +0300] - Error: Failed to resolve plugin dependencies [05/Nov/2008:13:56:38 +0300] - Error: preoperation plugin 7-bit check is not started [05/Nov/2008:13:56:38 +0300] - Error: accesscontrol plugin ACL Plugin is not started [05/Nov/2008:13:56:38 +0300] - Error: preoperation plugin ACL preoperation is not started Any ideas?

2 1

[Fedora-directory-users] Re:Re: Fedora-directory-users Digest, Vol 42, Issue 3
by Eric 05 Nov '08

05 Nov '08

oh I take a mistake, my ds is version 1.0.4, my question is 1.How can I remove a role from ds by using db or related files? I don't have console and my command part has error too. 2. I want to use last versions of fedora ds, I have backup of my fedora ds version 1.0.4, can I install last version on another system ( not upgrade this version) and then restore this backup? ( I saw that the directory of ds version 1.1 are differ from 1.0) On Mon, Nov 3, 2008 at 8:30 PM, <fedora-directory-users-request(a)redhat.com>wrote: > Send Fedora-directory-users mailing list submissions to > fedora-directory-users(a)redhat.com > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.redhat.com/mailman/listinfo/fedora-directory-users > or, via email, send a message with subject or body 'help' to > fedora-directory-users-request(a)redhat.com > > You can reach the person managing the list at > fedora-directory-users-owner(a)redhat.com > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Fedora-directory-users digest..." > > > Today's Topics: > > 1. Re: removing an entry using fedora-ds folder (Rich Megginson) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 03 Nov 2008 09:35:35 -0700 > From: Rich Megginson <rmeggins(a)redhat.com> > Subject: Re: [Fedora-directory-users] removing an entry using > fedora-ds folder > To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> > Message-ID: <490F2857.7050804(a)redhat.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Eric wrote: > > Hi, > > I use fedora-ds 4.0. > ? What version is that? > rpm -qi fedora-ds-base > > I had a view part.I made a Role in a wrong part ( under the another > > role) after that my ds hanged. > Check your directory server error log. > > slapd and admin are running but I cant open console to remove that > > wrong. when I want to use command line it can't. the error massage is: > > ldap_bind: Can't contact LDAP server (-1) > Are you sure slapd is running? > > how can I solve the problem? > > ------------------------------------------------------------------------ > > > > -- > > Fedora-directory-users mailing list > > Fedora-directory-users(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > > > > > ------------------------------ > > -- > Fedora-directory-users mailing list > Fedora-directory-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > > End of Fedora-directory-users Digest, Vol 42, Issue 3 > ***************************************************** >

2 1

[Fedora-directory-users] Re: Fedora-directory-users Digest, Vol 42, Issue 4
by Howard Chu 04 Nov '08

04 Nov '08

> Date: Tue, 04 Nov 2008 08:13:08 -0700 > From: Rich Megginson<rmeggins(a)redhat.com> > John Dickinson wrote: >> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins(a)redhat.com> wrote: >> create user in AD userAccountControl: 512 (Normal) >> create user in Fedora DS (console) userAccountControl: 546 (Normal + >> PASSWD_NOTREQ + ACCOUNTDISABLE) >> >> Would there be anything wrong with Fedora DS just forcing >> userAccountControl = 512? Or are more options needed in the user >> creation dialog? > I'm not sure. 1.1.3 included a "fix" for userAccountControl. The way > it works now is this: > add new AD entry over LDAP - no userAccountControl attribute is present, > so it must use some sort of AD default value > read the new AD entry - get the userAccountControl value > set AD entry userAccountControl |= 0x200 # 512 == normal account) > > So you might try a simple test - add a new AD entry over LDAP outside of > windows sync - see what the default userAccountControl value is - I'm > guessing that adding a new AD entry without specifying > userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE Yes, users created via LDAP are disabled unless you explicitly provide the userAccountControl attribute (with proper flags) in the LDAP Add operation. I tripped over this myself the first time I loaded up a test database in AD. (It also gave me a Fine Opportunity to time how long it took to LDAP Modify all of the users in my test database. ugh...) -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 3

[Fedora-directory-users] Re: Fedora-directory-users Digest, Vol 41, Issue 24
by John Dickinson 04 Nov '08

04 Nov '08

On 30 Oct 2008, at 16:00, Rich Megginson <rmeggins(a)redhat.com> wrote: > John Dickinson wrote: >> Hi, >> >> I am testing what happens when you create a new user and sync it to >> AD. Using Fedora DS 1.1.3 and AD 2003 R2 SP2. >> >> If I use the console to create a new user and tick the Enable NT User >> Attributes, Create New NT Account etc the new user appears in AD but >> is disabled. >> >> Looking at the code it seems that send_accountcontrol_modify() gets >> the userAccountControl settings from AD adds 0x0200 (Normal Account) >> and sends it back. >> >> Looking at the traffic between Fedora DS and AD it appears that >> Fedora >> DS is getting ACCOUNTDISABLE in userAccountControl from AD. >> >> Should FedoraDS be unsetting ACCOUNTDISABLE or should AD not be >> setting it in the first place? If it is a problem with AD then can >> anyone point me to where I tell it to do the right thing? > Does AD have some sort of setting that tells it to disable new > accounts? Not that I know about. But I am no windows expert. > What happens if you create new accounts directly in AD? When you create a new user in windows there is a tick box to disable the account but it is not ticked by default and the user is created in an enabled state. I see the following when: - Both Windows and Fedora DS set to enforce no password complexity constraints - Windows sync agreement and password sync working - When creating a user in AD only one option is selected by default - user must change password at next login. - The following options are not ticked by default: -- User cannot change password -- Password never expires -- Account is disabled create user in AD userAccountControl: 512 (Normal) create user in Fedora DS (console) userAccountControl: 546 (Normal + PASSWD_NOTREQ + ACCOUNTDISABLE) Would there be anything wrong with Fedora DS just forcing userAccountControl = 512? Or are more options needed in the user creation dialog? John

2 1

[Fedora-directory-users] removing an entry using fedora-ds folder
by Eric 03 Nov '08

03 Nov '08

Hi, I use fedora-ds 4.0. I had a view part.I made a Role in a wrong part ( under the another role) after that my ds hanged. slapd and admin are running but I cant open console to remove that wrong. when I want to use command line it can't. the error massage is: ldap_bind: Can't contact LDAP server (-1) how can I solve the problem?

2 1

Re: [Fedora-directory-users] dbverify
by Howard Chu 02 Nov '08

02 Nov '08

fedora-directory-users-request(a)redhat.com wrote: > Date: Fri, 31 Oct 2008 13:41:46 -0400 > From: Dan Lannom<dlannom(a)umd.umich.edu> > I've done exhaustive verification of equality and presence indexes for > my directory to verify that ldap is working properly so I'm going to > treat dbverify as buggy for now. dbverify is certainly not buggy. Most likely you're running on a Little-Endian machine, and FDS is not canonicalizing its keys into Big-Endian format. (Instead it must be using a custom key comparison function internally.) Since dbverify only uses the default key comparison function, it will see the keys as being out of order (even though they're in correct order according to FDS's custom function). > I can't find any pattern in my data to explain what the bug is though. > 22 of the 45 indexes are affected > syntaxes are oid,directorystring,ia5string,integer and telephonenumber > index types are either e,ep,eps or aeps > > I'll fill out a bug report later tonight, > > Dan Lannom > > I wrote in my earlier email: >> I plan to migrate to fds from SunOne 5.2 and so I want to validate the >> system. >> I'm currently running version 1.1.3-2 of the directory on RHEL 5.2. >> >> When I do searches against the server everything seems to work fine, but >> When I run /usr/lib/dirsrv/slapd-{{hostname}}/dbverify, with the >> server off, it fails with >> errors like: >> [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 2 >> [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 8 >> [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at >> entry 11 >> [28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at >> entry 14 >> ... >> [28/Oct/2008:10:52:16 -0400] - libdb: >> /var/lib/dirsrv/slapd-hume/db/{{SUFFIX}}/{{attribute}}.db4: >> DB_VERIFY_BAD: Database verification failed >> [28/Oct/2008:10:52:16 -0400] DB verify - verify failed(-30975): >> /var/lib/dirsrv/slapd-{{hostname}}/db/userdata/{{attribute}}.db4 >> >> reindexing does not change anything and I find the same errors for >> both i386 and x86_64 and the errors are almost identical for the >> master and the slaves. >> >> Since I can find any evidence of the indexes identified as corrupted >> not working I wonder why dbverify is generating these errors. >> >> Thanks for any help, >> >> Dan Lannom >> UM-Dearborn -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2008