July 2008 - 389-users - Fedora mailing-lists

[Fedora-directory-users] Recover directory database files when disk fills up!
by Howard Wilkinson 18 Nov '08

18 Nov '08

We had the disk with the directory database files fill up overnight, a rogue process :-[ Now the directory server will not start I get the following reported in the system logs. Jul 29 09:44:50 bastion ns-slapd: auxpropfunc error invalid parameter supplied Jul 29 09:44:50 bastion ns-slapd: sql_select option missing Jul 29 09:44:50 bastion ns-slapd: auxpropfunc error no mechanism available What can I do to recover the database so that I can start the server?

2 9

[Fedora-directory-users] Unable to SSL with Windows Sync Agreement
by Groot, Mathijs de (IDT Competence Java) 07 Aug '08

07 Aug '08

Hello everyone, I can use some help with setting up the Windows Sync. Ill give some context first, im trying to sync user, groups and passwords from a Windows 2003 server with Active Directory with a Red Hat enterprise 5, Red Hat Directory Server 8.0. It is a test environment with where I can access and configure the servers easily. But ive got some problems setting a new Windows Sync Agreement. It comes down to the following: I can't get an SSL connection with the a new Windows Sync Agreement, from the Red Hat DS to the Windows AD server. In the Windows Sync Server info screen I get the following message when clicking on next: "unable to contact Active Directory server, continue" (Windows Sync Server info screen located In the Directory Server Console -> Configuration tab -> Replication -> userRoot -> highlight the database -> Object -> New Windows Sync Agreement -> The second screen reads Windows Sync Server Info) But when I uncheck the checkbox "Using encrypted SSL connection" the connection works and the Windows AD server is reached. So this concludes (and ive tested) that the Windows Server and domain is reachable and the Bind DN is valid, and entered values are correct. The SSL connection seems to be setup correctly, the checks (ldapsearch query) described by the fedora manual outputs the correct result. Following: " http://directory.fedoraproject.org/wiki/Howto:WindowsSync Testing your Configuration Test to make sure you can talk SSL from Fedora Directory to AD This is how you test to verify that the Windows side SSL is enabled properly: ldapsearch -Z -P <RHDS-cert8.db> -h <AD/NT Hostname> -p <AD SSL port> -D "<sync manager user>" -w < sync manager password> -s <scope> -b "<AD base>" "<filter>" " My ldapsearch query: /usr/lib64/mozldap/dapsearch -Z -P /etc/dirsrv/slapd-<instance>/cert8.db -h compute.domain.com -p 636 -D "CN=Administrator,CN=Users,DC=domain,DC=com" -w <pwd> -s base -b "dc=domain,dc=com" "objectclass=top" But strangely enough there is not network traffic at all when the SSL connection is checked! (when clicking on next and the message "unable to contact Active Directory server, continue" appears) Ive done the following actions to make to monitor it: First I've disabled SELinux, in case that blocks something (just for testing). watch the tcp ip traffic with: tcpdump -nn -p port not ssh and ip host <Red Hat IP number> Here I can see that, when I don't use the SSL connection, there is traffic towards my Widows AD, but when ive check the SSL option, there is no traffic at all, nothing. As well when I look at the iptables: added an extra line: iptables -I OUTPUT 1 -d <Windows AD IP number> -j ACCEPT watch -d iptables -L -nv I see the same result, traffic when I don't use the SSL option and no traffic at all when the SSL option is checked. How can I get the message "unable to contact Active Directory server, continue" when there is no outgoing request from my Red Hat server. Ive made certificates at both sides (Windows and Red Hat) and exported and imported these certificated to the other server. Please advice on following steps I can take, what the problem can be and how it is possible that there is no traffic at all. Thanks in advanced. Matt Mathijs A. de Groot Consultant - Software Engineer _________________________________________ Logica - Releasing your potential George Hintzenweg 89 3068 AX Rotterdam Postbus 8566 3009 AN Rotterdam Nederland T: +31 (0) 10 253 7000 D: +31(0) 70 37 56627 E: math.de.groot(a)logica.com <mailto:math.de.groot@logica.com> www.logica.com <http://www.logica.com/> Logica Nederland B.V. Registered office in Amstelveen, The Netherlands Registration Number Chamber of Commerce: 33136004 This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 2

[Fedora-directory-users] SSL issue
by Dharmin Mandalia 05 Aug '08

05 Aug '08

Hello I am new to FDS, trying to configure Directory Server to use SSL, did few changes in Fedora Mgmt Console and now am getting below error msg :- # tail -f /var/log/dirsrv/admin-serv/error [Wed Jul 23 01:54:43 2008] [error] SSL_InheritMPServerSIDCache failed [Wed Jul 23 01:54:43 2008] [error] SSL Library Error: -8191 Library Failure [Wed Jul 23 01:54:44 2008] [notice] child pid 3884 exit signal Segmentation fault (11) [Wed Jul 23 01:54:45 2008] [error] SSL_InheritMPServerSIDCache failed [Wed Jul 23 01:54:45 2008] [error] SSL Library Error: -8191 Library Failure [Wed Jul 23 01:54:46 2008] [notice] child pid 3885 exit signal Segmentation fault (11) [Wed Jul 23 01:54:47 2008] [error] SSL_InheritMPServerSIDCache failed [Wed Jul 23 01:54:47 2008] [error] SSL Library Error: -8191 Library Failure [Wed Jul 23 01:54:48 2008] [notice] child pid 3886 exit signal Segmentation fault (11) [Wed Jul 23 01:54:49 2008] [error] SSL_InheritMPServerSIDCache failed [Wed Jul 23 01:54:49 2008] [error] SSL Library Error: -8191 Library Failure [Wed Jul 23 01:54:50 2008] [notice] child pid 3887 exit signal Segmentation fault (11) and when trying to login onto Fedora Mgmt Console, error I get is :- "Cannot login because of incorrect User ID" "Incorrect Password or Directory Problem " "java.io.IntruptedIOException: HTTP respose timeout" I know the username and password is correct. when run ps -ef nobody 3360 1 0 01:46 ? 00:00:02 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-matrix -i /var/run/dirs root 3873 1 0 01:54 ? 00:00:00 /usr/sbin/httpd.worker -k start -f /etc/dirsrv/admin-serv/httpd.conf root 3876 3873 0 01:54 ? 00:00:00 /usr/sbin/httpd.worker -k start -f /etc/dirsrv/admin-serv/httpd.conf matrix more /etc/redhat-release Fedora release 9 (Sulphur) matrix rpm -qa | egrep fedora-* fedora-ds-admin-1.1.5-1.fc9.i386 ffedora-ds-base-1.1.1-1.fc9.i386 fedora-ds-admin-console-1.1.1-3.fc9.noarch fedora-idm-console-1.1.1-2.fc9.i386 fedora-ds-1.1.1-3.fc9.i386 fedora-ds-console-1.1.1-3.fc9.noarch Any help on resolving the issue would be appreciated. Regards Dharmin _________________________________________________________________ Time for vacation? WIN what you need- enter now! http://www.gowindowslive.com/summergiveaway/?ocid=tag_jlyhm

4 3

[Fedora-directory-users] Passsync and Domain Controllers
by Mike Storvick 31 Jul '08

31 Jul '08

Hello All, I have successfully installed passsync on one of our domain controllers (32bit, the only one that would work) and only see changes of passwords being replicated from that single domain controller (not entirely useful because we hardly use that one for user changes etc.) Does this somehow need to be installed on ALL domain controllers that may processes the password change or is there some sort of replication problem between DC's? I change the password on any domain controller and it is reflected on our exchange outlook web access. Any insight is appreciated ,especially if you've had luck getting it to run on 64-bit Server 2003. Regards and thanks for your time, Michael Storvick - Network Administrator Textura Corporation 51 Sherwood Terrace Suite K Lake Bluff, IL 60044 Mobile: 847-204-7417 Office: 847-235-8470

1 0

[Fedora-directory-users] Announcing Fedora Directory Server version 1.1.1
by Rich Megginson 30 Jul '08

30 Jul '08

We are pleased to announce the release of Fedora Directory Server 1.1.1. This release is primarily a bug fix release, but does contain some new features, mostly to support freeIPA. Binary packages are available for Fedora 7, 8, 9, and rawhide. NOTE: Fedora 6/RHEL5 binaries are not yet available. They will be shortly. How to upgrade: yum upgrade fedora-ds-base No further setup should be required. This should restart the server - if not, a manual restart (service dirsrv restart) is required for the new code to take effect. * Release Notes - http://directory.fedoraproject.org/wiki/Release_Notes

2 2

[Fedora-directory-users] Sync AD users
by Peter Sørensen 30 Jul '08

30 Jul '08

Hi, I now have the fedora dirserver up and running on a RHES5 server. What i want to acomplish, is a way to have users replicated from Our AD servers. I need this because I want to add attributes concerning mail spam/virus management but still have the basic user attributes from the AD. I don't know anything about the AD and would like to keep it that way but I need som guidance on what to tell the people maintaining the AD on what to do. I don't need the password sync but only want a few user attributes like mail,proxyaddresses, cn, dn ... replicated. This should be a one way replication AD => FDS I have read the document concerning this but I'm still confused on what I need to do in the AD enviroment to get this up and running. Any other docs to read? Regards Peter Sorensen/University of Southern Denmark/mail: maspsr(a)sdu.dk

2 2

Re: [Fedora-directory-users] Error performing an internal search
by Mac.gp 29 Jul '08

29 Jul '08

>You need to pass in a valid value -- I'd suggest reading the >SLAPI_PLUGIN_IDENTITY value from the Slapi_PBlock which is passed to >your module's initialization function, and saving it (along with >whatever else you like) for future use as your SLAPI_PLUGIN_PRIVATE >value. >>The value that SLAPI_PLUGIN_IDENTITY has when your search function is >called is the one which was passed in by the module that initiated the >search. Your own module will be called (along with others) to satisfy >your internal searches, so to avoid recursion, you'll probably want to >compare the pointer value that the Slapi_PBlock contains when the >function is called to the value for your module, and then return early >if they're the same. > >HTH, > >NalinThanks so much, it works really good now! -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: VACANZA RELAX RICCIONE In centro: piscina, idromassaggio, bagno turco, solarium, massaggi e trattamenti Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=8140&d=20080729

1 0

[Fedora-directory-users] Re: Can't start Fedora DS server or connect to Admin Console
by Carol Gibbons 28 Jul '08

28 Jul '08

Thank you, Wolf! After pulling a listing of all files inside the tar of a previous days backup that was good/working - I was able to recreate the unique permissions (not root) for directories and files that your ldap user has to own. This is for Fedora DS 1.0.4. And the server and console now start. I'm listing them in case others get stumped on why neither the Fedora DS server nor the Admin Console will start and the logs don't give enough clues Your defined ldap user and group of same name have to own: /opt/fedora-ds/slapd-mail/ (just the directory level) /opt/fedora-ds/slapd-mail/config /opt/fedora-ds/slapd-mail/db/ /opt/fedora-ds/slapd-mail/locks/ /opt/fedora-ds/slapd-mail/confbak/ /opt/fedora-ds/slapd-mail/ldif/ /opt/fedora-ds/slapd-mail/logs/ /opt/fedora-ds/slapd-mail/bak /opt/fedora-ds/slapd-mail/dsml/ /opt/fedora-ds/alias/ /opt/fedora-ds/bin/slapd/authck/ /opt/fedora-ds/clients/dsgw/context/default.conf /opt/fedora-ds/admin-serv/config/ /opt/fedora-ds/shared/

1 0

[Fedora-directory-users] Error performing an internal search
by Mac.gp 28 Jul '08

28 Jul '08

Hello everyone. I'm trying to perform an internal search from a PRE_SEARCH plugin, but I get this error in the logs:allow_operation: component identity is NULLI think it has some trouble with the slapi_componentid. I declare it in my plugin with this:static Slapi_ComponentId * plugin_id = NULL;Am I doing something wrong? Any suggestion to resolve this?Thanks to all from now. -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: Impazzisci per Vasco? Scarica ora il mondo che vorrei sul cellulare Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=7750&d=20080728

2 1

[Fedora-directory-users] Can't start Fedora DS server or connect to Admin Console
by Carol Gibbons 28 Jul '08

28 Jul '08

Good morning, Our Fedora DS server has stopped working. I believe it's v1.0.4. I replaced the non-working fedora-ds with a backup of the directory from last week when it _was_ working. The /opt/fedora-ds/slapd-servername directory logs (error and access) provide no clues. But, the /fedora-ds/admin-serv/log/ states: [Mon Jul 28 02:17:34 2008] [warn] Unable to bind as LocalAdmin to populate LocalAdmin tasks into cache. [Mon Jul 28 02:17:34 2008] [crit] host_ip_init(): PSET failure: Failed to create PSET handle (pset error = ) Configuration Failed [Mon Jul 28 02:17:35 2008] [warn] Unable to bind as LocalAdmin to populate LocalAdmin tasks into cache. [Mon Jul 28 02:17:35 2008] [crit] host_ip_init(): PSET failure: Failed to create PSET handle (pset error = ) Configuration Failed I found one posting on the internet that says permissions could be the issue. http://osdir.com/ml/redhat.fedora.directory.user/2006-03/msg00037.html I set the files in /opt/fedora-ds/admin-serv/config/ to my admin user for files. But, that hasn't helped. I tried to do an ldapsearch from /opt/fedora-ds/shared/bin/ and that failed. Error said it couldn't locate the ldap database. I put this in: ldapsearch [-x] -b o=netscaperoot -D "cn=directory manager" -w password "objectclass=nsAdminConfig" dn Error: ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) Am I making sense at 4AM? Any help would be appreciated. I can't decide if this is a BIND, SSL, permissions, or what have you issue. Thanks for your help, Carol

2 2

[Fedora-directory-users] Can't start Fedora DS server or connect to Admin Console
by Carol Gibbons 28 Jul '08

28 Jul '08

Good morning, Our Fedora DS server has stopped working. I believe it's v1.0.4. I replaced the non-working fedora-ds with a backup of the directory from last week when it _was_ working. The /opt/fedora-ds/slapd-servername directory logs (error and access) provide no clues. But, the /fedora-ds/admin-serv/log/ states: [Mon Jul 28 02:17:34 2008] [warn] Unable to bind as LocalAdmin to populate LocalAdmin tasks into cache. [Mon Jul 28 02:17:34 2008] [crit] host_ip_init(): PSET failure: Failed to create PSET handle (pset error = ) Configuration Failed [Mon Jul 28 02:17:35 2008] [warn] Unable to bind as LocalAdmin to populate LocalAdmin tasks into cache. [Mon Jul 28 02:17:35 2008] [crit] host_ip_init(): PSET failure: Failed to create PSET handle (pset error = ) Configuration Failed I found one posting on the internet that says permissions could be the issue. http://osdir.com/ml/redhat.fedora.directory.user/2006-03/msg00037.html I set the files in /opt/fedora-ds/admin-serv/config/ to my admin user for files. But, that hasn't helped. I tried to do an ldapsearch from /opt/fedora-ds/shared/bin/ and that failed. Error said it couldn't locate the ldap database. I put this in: ldapsearch [-x] -b o=netscaperoot -D "cn=directory manager" -w password "objectclass=nsAdminConfig" dn Error: ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) Am I making sense at 4AM? Any help would be appreciated. I can't decide if this is a BIND, SSL, permissions, or what have you issue. Thanks for your help, Carol

1 0

[Fedora-directory-users] Install on RHES5 fails
by Peter Sørensen 28 Jul '08

28 Jul '08

Hi, I have just joined this list to try and solve an install problem. The reason to try the fedora directory server is, that I have to make some synconisation against Our Active Directory so users gets created/deleted according to this. But at the same time I need additional attributes on each user. I only have read acces to AD. To the problem: I'm running RHES 5 on 64 bit. I followed the install requirements in here: http://directory.fedoraproject.org/wiki/Download Everything works until: ---------------------------------------BELOW OUTPUT FROM INSTALL---------------------------- # yum install fedora-ds Loading "security" plugin Loading "rhnplugin" plugin rhel-x86_64-server-5 100% |=========================| 1.4 kB 00:00 dirsrv-noarch 100% |=========================| 951 B 00:00 idmcommon 100% |=========================| 951 B 00:00 idmcommon-noarch 100% |=========================| 951 B 00:00 dirsrv 100% |=========================| 951 B 00:00 Setting up Install Process Parsing package install arguments Resolving Dependencies --> Running transaction check ---> Package fedora-ds.x86_64 0:1.1.0-3.fc6 set to be updated --> Processing Dependency: fedora-idm-console for package: fedora-ds --> Processing Dependency: fedora-admin-console for package: fedora-ds --> Processing Dependency: fedora-ds-admin for package: fedora-ds --> Processing Dependency: idm-console-framework for package: fedora-ds --> Processing Dependency: fedora-ds-console for package: fedora-ds --> Processing Dependency: fedora-ds-base for package: fedora-ds Running --> transaction check ---> Package fedora-ds-admin.x86_64 0:1.1.2-2.fc6 set to be updated --> Processing Dependency: mod_nss for package: fedora-ds-admin ---> Package fedora-ds-console.noarch 0:1.1.1-2.fc6 set to be updated ---> Package fedora-ds-base.x86_64 0:1.1.1-1.fc6 set to be updated --> Processing Dependency: mozldap-tools for package: fedora-ds-base --> Processing Dependency: cyrus-sasl-gssapi for package: fedora-ds-base --> Processing Dependency: cyrus-sasl-md5 for package: fedora-ds-base ---> Package fedora-admin-console.noarch 0:1.1.0-4.fc6 set to be updated ---> Package idm-console-framework.noarch 0:1.1.1-2.fc6 set to be ---> updated --> Processing Dependency: ldapjdk for package: idm-console-framework ---> Package fedora-idm-console.x86_64 0:1.1.1-1.fc6 set to be updated --> Running transaction check ---> Package ldapjdk.x86_64 0:4.18-2jpp.3.el5 set to be updated Package ---> mozldap-tools.x86_64 0:6.0.5-1.el5 set to be updated Package ---> cyrus-sasl-gssapi.x86_64 0:2.1.22-4 set to be updated Package ---> cyrus-sasl-md5.x86_64 0:2.1.22-4 set to be updated Package ---> mod_nss.x86_64 0:1.0.3-4.el5 set to be updated --> Finished Dependency Resolution Dependencies Resolved ============================================================================= Package Arch Version Repository Size ============================================================================= Installing: fedora-ds x86_64 1.1.0-3.fc6 dirsrv 3.1 k Installing for dependencies: cyrus-sasl-gssapi x86_64 2.1.22-4 rhel-x86_64-server-5 29 k cyrus-sasl-md5 x86_64 2.1.22-4 rhel-x86_64-server-5 46 k fedora-admin-console noarch 1.1.0-4.fc6 dirsrv-noarch 229 k fedora-ds-admin x86_64 1.1.2-2.fc6 dirsrv 362 k fedora-ds-base x86_64 1.1.1-1.fc6 dirsrv 1.6 M fedora-ds-console noarch 1.1.1-2.fc6 dirsrv-noarch 1.3 M fedora-idm-console x86_64 1.1.1-1.fc6 idmcommon 48 k idm-console-framework noarch 1.1.1-2.fc6 idmcommon-noarch 1.0 M ldapjdk x86_64 4.18-2jpp.3.el5 rhel-x86_64-server-5 907 k mod_nss x86_64 1.0.3-4.el5 rhel-x86_64-server-5 81 k mozldap-tools x86_64 6.0.5-1.el5 rhel-x86_64-server-5 146 k Transaction Summary ============================================================================= Install 12 Package(s) Update 0 Package(s) Remove 0 Package(s) Total download size: 5.8 M Is this ok [y/N]: y Downloading Packages: warning: rpmts_HdrFromFdno: Header V3 DSA signature: NOKEY, key ID a7b02652 Public key for fedora-ds-base-1.1.1-1.fc6.x86_64.rpm is not installed ------------------------------------------END OUTPUT-------------------------------------- I have tried to install the key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xA7B0265 but this fails when using rpm --import with error: mykeyfile: import read failed(0) What am I missing? Regards Peter Sorensen/Universoty of Southern Denmark/mail: maspsr(a)sdu.dk

2 2

[Fedora-directory-users] Wiki Update: PAM HowTo
by Aly Dharshi 26 Jul '08

26 Jul '08

Hello Folks, I ran into problems this week with getting a RHEL5U2 server to chat with an LDAP server where your uids are less than 500 in LDAP. RHEL assumes that 500 should be the min # for uids. Check out how to solve that in the wiki. Thanks. Cheers, Aly. -- Aly S.P Dharshi aly.dharshi(a)telus.net Got TELUS TV ? http://www.telus.com/tv or 310-MYTV

1 0

[Fedora-directory-users] TLS Issue
by Dharmin Mandalia 26 Jul '08

26 Jul '08

Hello commented out "ssl start_tls" and added "ssl on" , in ldap.conf file get below errors in /var/log/secure file :- Jul 24 15:55:40 matrix sshd[2480]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=matrix.trues.co.uk user=test1 Jul 24 15:55:40 matrix sshd[2480]: pam_ldap: ldap_simple_bind Can't contact LDAP server Jul 24 15:55:40 matrix sshd[2480]: pam_ldap: reconnecting to LDAP server... Jul 24 15:55:40 matrix sshd[2480]: pam_ldap: ldap_simple_bind Can't contact LDAP server Jul 24 15:55:42 matrix sshd[2480]: Failed password for test1 from 192.168.1.129 port 59436 ssh2 where the server matrix is FDS what I did was from FDS "ssh matrix.trues.co.uk -l test1" where test1 users exists in ldap dir Regards Dharmin Hi, Can you check What happens if you specify ssl start_tls instead of "ssl on" Regards Niranjan On Thu, Jul 24, 2008 at 9:29 PM, Dharmin Mandalia wrote: > > Hello Nalin and all > > I just added "ssl on" to below /etc/ldap.conf file and get below error > msg in var/log/secure file :- > > > sshd[6212]: pam_unix(sshd:session): session closed for user test1 > sshd[6248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 > euid=0 tty=ssh ruser= rhost=192.168.1.1 user=test1 > sshd[6248]: Accepted password for test1 from 192.168.1.1 port 47171 ssh2 > sshd[6248]: pam_unix(sshd:session): session opened for user test1 by > (uid=0) > sshd[6248]: pam_unix(sshd:session): session closed for user test1 > sshd[6284]: pam_unix(sshd:auth): authentication failure; logname= uid=0 > euid=0 tty=ssh ruser= rhost=192.168.1.1 user=test1 > sshd[6284]: pam_ldap: ldap_simple_bind Can't contact LDAP server > shd[6284]: pam_ldap: reconnecting to LDAP server... > sshd[6284]: pam_ldap: ldap_simple_bind Can't contact LDAP server > sshd[6284]: Failed password for test1 from 192.168.1.1 port 47172 ssh2 > > With "ssl on" in ldap.conf, am unable to login via ssh > > any helpers please... > > regards > Dharmin > > > > ---------------------------------------- >> Date: Thu, 24 Jul 2008 11:26:46 -0400 >> From: [EMAIL PROTECTED] >> To: [EMAIL PROTECTED] >> CC: fedora-directory-users(a)redhat.com >> Subject: Re: [Fedora-directory-users] TLS Issue >> >> On Thu, Jul 24, 2008 at 03:11:59PM +0000, Dharmin Mandalia wrote: >>> I've enabled TLS and am getting below error msg's in /var/log/secure > file on Fedora 9, which is my newly configured FDS , if disable TLS , am > able to ssh onto the FDS server and with TLS enabled unable to login via > ssh. >> [snip] >>> sshd[5487]: nss_ldap: could not search LDAP server - Server is > unavailable >> [snip] >>> /etc/ldap.conf file on Fedora 9, (FDS server ) shows as :- >> [snip] >>> ssl start_tls >>> tls_checkpeer yes >>> tls_cacertfile /etc/openldap/cacerts/cacert.asc >>> pam_password md5 >>> uri ldap://127.0.0.1/ >>> tls_cacertdir /etc/openldap/cacerts >> >> If you're using SSL or TLS, the LDAP client library is going to compare >> the names in the certificate that the server uses against the value that >> was given in the client's configuration (in this case "127.0.0.1"), and >> it looks like they're not matching up here. >> >> Typically the certificate uses an actual hostname as a "CN" value in its >> subject, so you'd need to specify the server URI using a hostname rather >> than an IP address to make sure that they match. >> >> If that's not what's going on here, please post a copy of the >> certificate that the server's using so that we can have a look. >> >> HTH, >> >> Nalin > _________________________________________________________________ Use video conversation to talk face-to-face with Windows Live Messenger. http://www.windowslive.com/messenger/connect_your_way.html?ocid=TXT_TAGLM_W…

2 1

[Fedora-directory-users] Problem with the synchronization agreement
by ken oh 25 Jul '08

25 Jul '08

Hi everybody, I'm at the Windows Sync Server Info screen, I have completed all the fields. And when I click next, I got the message "Unable to contact Active Directory server, continue ?" using the ssl connection or not. >From each side, I ping and I use a nslookup command to verify if the domain name is correct; and everything is ok. So I would like to know if someone can help me with what goes wrong, thanks. This is my Windows Sync Server Info screen, if that can help : http://img291.imageshack.us/img291/4323/sync2ur5.jpg _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

3 3

[Fedora-directory-users] TLS Issue
by Dharmin Mandalia 24 Jul '08

24 Jul '08

Hi I've enabled TLS and am getting below error msg's in /var/log/secure file on Fedora 9, which is my newly configured FDS , if disable TLS , am able to ssh onto the FDS server and with TLS enabled unable to login via ssh. sshd[5487]: nss_ldap: could not search LDAP server - Server is unavailable sshd[5487]: Invalid user test3 from 192.168.1.1 sshd[5488]: input_userauth_request: invalid user test3 sshd[5487]: nss_ldap: could not search LDAP server - Server is unavailable sshd[5487]: pam_unix(sshd:auth): check pass; user unknown sshd[5487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.1 sshd[5487]: nss_ldap: could not search LDAP server - Server is unavailable sshd[5487]: pam_succeed_if(sshd:auth): error retrieving information about user test3 sshd[5487]: Failed password for invalid user test3 from 192.168.1.1 port 38489 ssh2 /etc/ldap.conf file on Fedora 9, (FDS server ) shows as :- base dc=true,dc=co,dc=uk timelimit 30 bind_timelimit 30 bind_policy soft nss_reconnect_tries 2 idle_timelimit 3600 pam_filter objectclass=posixAccount nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm,polk ituser ssl start_tls tls_checkpeer yes tls_cacertfile /etc/openldap/cacerts/cacert.asc pam_password md5 uri ldap://127.0.0.1/ tls_cacertdir /etc/openldap/cacerts # authconfig --test caching is disabled nss_files is always enabled nss_compat is disabled nss_db is disabled nss_hesiod is disabled hesiod LHS = "" hesiod RHS = "" nss_ldap is enabled LDAP+TLS is enabled LDAP server = "ldap://127.0.0.1/" LDAP base DN = "dc=true,dc=co,dc=uk" """" """""" pam_ldap is enabled LDAP+TLS is enabled LDAP server = "ldap://127.0.0.1/" LDAP base DN = "dc=true,dc=co,dc=uk" "" """ """ "" pam_cracklib is enabled (try_first_pass retry=3) pam_passwdqc is disabled () pam_access is disabled () pam_mkhomedir is disabled () Always authorize local users is disabled () Authenticate system accounts against network services is disabled Please advice on how to resolve, so am able to ssh onto FDS server running TLS. I've already run setupssl2.sh script from Thanks in advance.. Regards Dharmin _________________________________________________________________ Keep your kids safer online with Windows Live Family Safety. http://www.windowslive.com/family_safety/overview.html?ocid=TXT_TAGLM_WL_fa…

3 4

[Fedora-directory-users] fedora-idm-console connecting remotely to fedora ds 1.0.4
by Craig Swanson 23 Jul '08

23 Jul '08

I have installed fedora-idm-console on a fedora 9 workstation. I would like to run the console to connect remotely to a fedora ds 1.0.4 server. After logging in to the console, The Servers and Applications tab is empty. Launching fedora-idm-console -D 9 shows that the console is looking for entries under cn=user, cn=DefaultObjectClassesContainer,ou=1.1, ou=admin, ou=Global Preferences, ou=midwest-tool.com, o=NetscapeRoot. Can the console be configured to point to the existing ou=1.0 entries? Must I copy the entries under ou=1.0 to ou=1.1 for GlobalPreferences and UserPreferences? I noted that upon logging in via the console, several ou=1.1 entries were created under ou=midwest-tool.com, o=NetscapeRoot. Here is the debug output from a fedora-idm-console session. Thank you, Craig Swanson java.util.prefs.userRoot=/h/craigs/.fedora-idm-console java.runtime.name=OpenJDK Runtime Environment sun.boot.library.path=/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/amd64 java.vm.version=1.6.0-b09 java.vm.vendor=Sun Microsystems Inc. java.vendor.url=http://java.sun.com/ path.separator=: java.vm.name=OpenJDK 64-Bit Server VM file.encoding.pkg=sun.io sun.java.launcher=SUN_STANDARD user.country=US sun.os.patch.level=unknown java.vm.specification.name=Java Virtual Machine Specification user.dir=/h/craigs java.runtime.version=1.6.0-b09 java.awt.graphicsenv=sun.awt.X11GraphicsEnvironment java.endorsed.dirs=/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/endorsed os.arch=amd64 java.io.tmpdir=/tmp line.separator= java.vm.specification.vendor=Sun Microsystems Inc. os.name=Linux sun.jnu.encoding=UTF-8 java.library.path=/usr/lib64 java.specification.name=Java Platform API Specification java.class.version=50.0 sun.management.compiler=HotSpot 64-Bit Server Compiler os.version=2.6.25.10-86.fc9.x86_64 user.home=/h/craigs user.zoneinfo.dir=/usr/share/javazi user.timezone=America/Detroit java.awt.printerjob=sun.print.PSPrinterJob file.encoding=UTF-8 java.specification.version=1.6 java.class.path=/usr/lib/java/jss4.jar:/usr/share/java/ldapjdk.jar:/usr/share/java/idm-console-base.jar:/usr/share/java/idm-console-mcc.jar:/usr/share/java/idm-console-mcc_en.jar:/usr/share/java/idm-console-nmclf.jar:/usr/share/java/idm-console-nmclf_en.jar:/usr/share/java/fedora-idm-console-1.1.1_en.jar user.name=craigs java.vm.specification.version=1.0 java.home=/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre sun.arch.data.model=64 java.util.prefs.systemRoot=/h/craigs/.fedora-idm-console user.language=en java.specification.vendor=Sun Microsystems Inc. java.vm.info=mixed mode java.version=1.6.0 java.ext.dirs=/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/ext:/usr/java/packages/lib/ext sun.boot.class.path=/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/resources.jar:/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/rt.jar:/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/sunrsasign.jar:/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/jsse.jar:/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/jce.jar:/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/charsets.jar:/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/classes java.vendor=Sun Microsystems Inc. file.separator=/ java.vendor.url.bug=http://java.sun.com/cgi-bin/bugreport.cgi sun.io.unicode.encoding=UnicodeLittle sun.cpu.endian=little sun.desktop=gnome sun.cpu.isalist= Fedora-Management-Console/1.1.1 B2008.025.2031 RemoteImage: NOT found in cache loader527532737:com/netscape/management/nmclf/icons/Error.gif RemoteImage: Create RemoteImage cache for loader527532737 RemoteImage: NOT found in cache loader527532737:com/netscape/management/nmclf/icons/Inform.gif RemoteImage: NOT found in cache loader527532737:com/netscape/management/nmclf/icons/Warn.gif RemoteImage: NOT found in cache loader527532737:com/netscape/management/nmclf/icons/Question.gif ResourceSet: NOT found in cache loader527532737:com.netscape.management.client.components.components RemoteImage: NOT found in cache loader527532737:com/netscape/management/client/theme/images/logo16.gif RemoteImage: NOT found in cache loader527532737:com/netscape/management/client/theme/images/login.gif ResourceSet: NOT found in cache loader527532737:com.netscape.management.client.util.default ResourceSet: found in cache loader527532737:com.netscape.management.client.util.default JButtonFactory: button width = 54 JButtonFactory: button height = 18 JButtonFactory: button width = 54 JButtonFactory: button height = 18 JButtonFactory: button width = 90 JButtonFactory: button height = 18 JButtonFactory: button width = 90 JButtonFactory: button height = 18 JButtonFactory: button width = 72 JButtonFactory: button height = 18 JButtonFactory: button width = 72 JButtonFactory: button height = 18 JButtonFactory: button width = 54 JButtonFactory: button height = 18 JButtonFactory: button width = 90 JButtonFactory: button width = 72 ResourceSet: found in cache loader527532737:com.netscape.management.client.util.default CommManager> New CommRecord (https://punch.midwest-tool.com:64000/admin-serv/authenticate) ResourceSet: found in cache loader527532737:com.netscape.management.client.theme.theme ResourceSet: NOT found in cache loader527532737:com.netscape.management.client.comm.HttpsChannel CREATE JSS SSLSocket This certificate is a trusted server Certificate [ [ Version: V3 Subject: CN=punch.midwest-tool.com Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4 Key: org.mozilla.jss.pkcs11.PK11RSAPublicKey@74122d9c Validity: [From: Tue Mar 20 12:47:16 EDT 2007, To: Mon Mar 20 12:47:16 EDT 2017] Issuer: CN=CAcert SerialNumber: [ 03e9] ] Algorithm: [MD5withRSA] Signature: 0000: 0A FA 95 47 E7 03 33 CD 5F 74 D2 E0 C1 95 54 67 ...G..3._t....Tg 0010: A4 D8 2C EF 5D F9 FF 20 CB 36 7C CB A0 4D 41 F5 ..,.].. .6...MA. 0020: 88 B6 33 FB FF A5 20 D0 78 74 B7 19 10 7A 04 F2 ..3... .xt...z.. 0030: 41 36 DC 22 4A A6 08 E3 F3 73 20 27 F3 A9 A6 95 A6."J....s '.... 0040: 66 90 93 A3 95 14 94 5F 4F 26 52 6B 07 86 6F C1 f......_O&Rk..o. 0050: 4D E4 E9 96 86 71 0B 65 1B D2 E1 D8 C1 E4 C7 1F M....q.e........ 0060: B2 D8 E9 4F 1B 1F 7C A2 C1 E9 11 59 87 23 83 BA ...O.......Y.#.. 0070: 9D DD 71 50 D7 14 B4 D7 A0 4C 90 89 86 71 BB C1 ..qP.....L...q.. ] ResourceSet: NOT found in cache loader527532737:com.netscape.management.client.security.ServerAuthResource JButtonFactory: button width = 90 JButtonFactory: button height = 18 JButtonFactory: button width = 90 JButtonFactory: button height = 18 JButtonFactory: button width = 144 JButtonFactory: button height = 18 JButtonFactory: button width = 72 JButtonFactory: button height = 18 JButtonFactory: button width = 72 JButtonFactory: button height = 18 JButtonFactory: button width = 90 JButtonFactory: button height = 18 JButtonFactory: button width = 90 JButtonFactory: button width = 72 JButtonFactory: button width = 54 JButtonFactory: button height = 18 JButtonFactory: button width = 54 JButtonFactory: button height = 18 JButtonFactory: button width = 54 JButtonFactory: button height = 18 JButtonFactory: button width = 90 JButtonFactory: button height = 18 JButtonFactory: button width = 90 JButtonFactory: button height = 18 ResourceSet: NOT found in cache loader527532737:com.netscape.management.client.security.securityResource ViewCertificateDialog.extractNameFromDN: dn = CN=punch.midwest-tool.com ViewCertificateDialog.extractNameFromDN RDN: CN=punch.midwest-tool.com ViewCertificateDialog.extractNameFromDN: dn = CN=CAcert ViewCertificateDialog.extractNameFromDN RDN: CN=CAcert ResourceSet: found in cache loader527532737:com.netscape.management.client.security.securityResource RemoteImage: NOT found in cache loader527532737:com/netscape/management/client/components/images/checkHeader.gif RemoteImage: NOT found in cache loader527532737:com/netscape/management/client/components/images/ascending.gif RemoteImage: NOT found in cache loader527532737:com/netscape/management/client/components/images/descending.gif {SUBJECT_DN=CN=punch.midwest-tool.com, SUBJECT={CN=punch.midwest-tool.com}, SERIAL=1001, AFTERDATE=Mon Mar 20 12:47:16 2017, ISSUER={CN=CAcert}, SIGNATURE=MD5withRSA, BEFOREDATE=Tue Mar 20 12:47:16 2007, KEYTYPE=RSA, REASONS={}, VERSION=3, ISSUER_DN=CN=CAcert} https://punch.midwest-tool.com:64000/[0:0] open> Ready https://punch.midwest-tool.com:64000/[0:0] accept> https://punch.midwest-tool.com:64000/admin-serv/authenticate https://punch.midwest-tool.com:64000/[0:0] send> GET \ https://punch.midwest-tool.com:64000/[0:0] send> /admin-serv/authenticate \ https://punch.midwest-tool.com:64000/[0:0] send> HTTP/1.0 https://punch.midwest-tool.com:64000/[0:0] send> Host: punch.midwest-tool.com:64000 https://punch.midwest-tool.com:64000/[0:0] send> Connection: Keep-Alive https://punch.midwest-tool.com:64000/[0:0] send> User-Agent: Fedora-Management-Console/1.1.1 https://punch.midwest-tool.com:64000/[0:0] send> Accept-Language: en https://punch.midwest-tool.com:64000/[0:0] send> Authorization: Basic \ https://punch.midwest-tool.com:64000/[0:0] send> YWRtaW46bXRkN3BhZGw0 \ https://punch.midwest-tool.com:64000/[0:0] send> https://punch.midwest-tool.com:64000/[0:0] send> https://punch.midwest-tool.com:64000/[0:0] recv> HTTP/1.1 200 OK https://punch.midwest-tool.com:64000/[0:0] recv> Date: Wed, 23 Jul 2008 14:28:53 GMT https://punch.midwest-tool.com:64000/[0:0] recv> Server: Apache/2.2 HttpChannel.invoke: admin version = 2.2 https://punch.midwest-tool.com:64000/[0:0] recv> Admin-Server: Fedora-Administrator/1.0.3 HttpChannel.invoke: admin version = 1.0.3 https://punch.midwest-tool.com:64000/[0:0] recv> Content-Length: 381 https://punch.midwest-tool.com:64000/[0:0] recv> Connection: close https://punch.midwest-tool.com:64000/[0:0] recv> Content-Type: text/html https://punch.midwest-tool.com:64000/[0:0] recv> https://punch.midwest-tool.com:64000/[0:0] recv> Reading 381 bytes... https://punch.midwest-tool.com:64000/[0:0] recv> 381 bytes read Console.replyHandler: adminVersion = 1.0.3 Console: Cannot open: cn=user, cn=DefaultObjectClassesContainer,ou=1.1, ou=admin, ou=Global Preferences, ou=midwest-tool.com, o=NetscapeRoot Console: Cannot open cn=group, cn=DefaultObjectClassesContainer,ou=1.1, ou=admin, ou=Global Preferences, ou=midwest-tool.com, o=NetscapeRoot Console: Cannot open cn=OU, cn=DefaultObjectClassesContainer,ou=1.1, ou=admin, ou=Global Preferences, ou=midwest-tool.com, o=NetscapeRoot Console: Cannot open cn=ResourceEditorExtension,ou=1.1, ou=admin, ou=Global Preferences, ou=midwest-tool.com, o=NetscapeRoot ResourceSet: NOT found in cache loader527532737:com.netscape.management.client.topology.topology ResourceSet: found in cache loader527532737:com.netscape.management.client.topology.topology ResourceSet: found in cache loader527532737:com.netscape.management.client.theme.theme RemoteImage: found in cache loader527532737:com/netscape/management/client/theme/images/logo16.gif RemoteImage: NOT found in cache loader527532737:com/netscape/management/client/theme/images/ConsoleBanner.gif RemoteImage: NOT found in cache loader527532737:com/netscape/management/client/images/warn16.gif ResourceSet: NOT found in cache loader527532737:com.netscape.management.client.default UIPermissions: TopologyEditing yes Cannot open: cn=topologyplugin,ou=1.1, ou=admin, ou=Global Preferences, ou=midwest-tool.com, o=NetscapeRoot ResourceSet: found in cache loader527532737:com.netscape.management.client.topology.topology ResourceSet: found in cache loader527532737:com.netscape.management.client.default ResourceSet: found in cache loader527532737:com.netscape.management.client.topology.topology ResourceSet: found in cache loader527532737:com.netscape.management.client.topology.topology UIPermissions: CustomViewEditing yes ResourceSet: found in cache loader527532737:com.netscape.management.client.default ResourceSet: found in cache loader527532737:com.netscape.management.client.theme.theme ResourceSet: found in cache loader527532737:com.netscape.management.client.default UIPermissions: UGTabVisibility yes UIPermissions: UGEditing yes ResourceSet: found in cache loader527532737:com.netscape.management.client.topology.topology TRACE ConsoleInfo.clone: tracking cloning of ConsoleInfo for performance tuning Cannot load custom views, error code= 32 <dn=cn=CustomView,ou=1.1, ou=admin, ou=Global Preferences, ou=midwest-tool.com, o=NetscapeRoot> pub defaultView=null user defaultView= RemoteImage: NOT found in cache loader527532737:com/netscape/management/client/images/secure.gif https://punch.midwest-tool.com:64000/[0:0] close i/o stream https://punch.midwest-tool.com:64000/[0:0] close socket https://punch.midwest-tool.com:64000/[0:0] close> Closed ResourceSet: found in cache loader527532737:com.netscape.management.client.util.default ResourceSet: found in cache loader527532737:com.netscape.management.client.util.default

2 1

[Fedora-directory-users] How to find when a client use anonymous bind using a plugin
by Mac.gp 22 Jul '08

22 Jul '08

Hello everyone. I need to intercept when a client try to bind with an anonymous bind to my ds. I wrote a simple plugin and registered it as pre-bind plugin, but it is executed with every kind of bind methods unless than anonymous one. So I assume that pre-bind plugins aren't executed with an anonymous bind. So, is there a way to find from a plugin when a client uses the anonymous bind? Thanks from now -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: EmailBlog: news, curiosità, tendenze dalla rete ... e le tue opinioni! Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=8138&d=20080722

2 1

[Fedora-directory-users] mmr.pl for Fedora DS 1.1
by James 22 Jul '08

22 Jul '08

Hi All, I'm about to set up a Fedora DS 1.1 instance, but I'm unable to find the "new" mmr.pl script. Every link I've found which purports to have the script seems to be broken. Can someone point me at this script? Thanks, ~James -- James Bushey Software Engineer Soleo Communications (585) 641-4300 x0050

3 2

[Fedora-directory-users] Malchow, Sören is out of the office.
by Sören Malchow 21 Jul '08

21 Jul '08

I will be out of the office starting 08.07.2008 and will not return until 28.07.2008. Please contact Guenther Kreuzpaintner ( guenther.kreuzpaintner(a)interone.de ) instead

1 0

[Fedora-directory-users] Re: Fedora DS Installation
by Gene Poole 21 Jul '08

21 Jul '08

Rich Megginson wrote: > > Can you describe exactly what you are trying to do? > > Not directly with RPM. The Fedora DS RPMs we provide are not > relocateable. They abide by the FHS - > http://directory.fedoraproject.org/wiki/FHS_Packaging > > If you want to build it from source, you can provide a specific prefix > or use the default prefix /opt/fedora-ds. > > There may be other ways to achieve what you want to do. Please provide > more details. > If you remember older releases came as tar balls which allowed me to determine where I wanted the software and create a file system ahead of time. Since it started using RPMs, I can no longer build a server and create all of the file systems ahead of time, because how will I know if they decide to move it next week? next month? next year? Thanks, Gene Poole

2 1

[Fedora-directory-users] Fedora DS Installation
by Gene Poole 21 Jul '08

21 Jul '08

I would like to install the latest release of Fedora Directory Server onto a specific filesystem. Does anyone know how this can be done? Is it possible using RPM? Thanks, Gene Poole

2 1

[Fedora-directory-users] password sync documentation
by omight 17 Jul '08

17 Jul '08

Hi, I'm trying to follow the documentation to setup synchronisation to windows active directory. >From the documentation: http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Windows_Sync-Configuri… [quote] 2. Create a new cert8.db and key.db using certutil.exe on the Password Sync machine. certutil.exe -d . -N ln -s slapd-serverID-cert8.db cert8.db ln -s slapd-serverID-key3.db key3.db [/quote] If I execute that in a new directory: # certutil.exe -d . -N # ln -s slapd-rhds-cert8.db cert8.db ln: creating symbolic link `cert8.db' to `slapd-rhds-cert8.db': File exists I don't follow why the ln -s should be executed? Why not start with part 3: On the Directory Server, export the server certificate using pk12util. pk12util -d . -o servercert.pfx -n Server-Cert Because SSL is already configured on this linux machine, so I guess I can use the server-cert from that cert8.db? Can someone clarify/confirm this? Thanks!

3 2

[Fedora-directory-users] Single master or multiple master for Active Directory Sync
by ken oh 17 Jul '08

17 Jul '08

Hello everybody, I would like to know what's the best replica role option between single master and multiple master when you configure the database for an Active Directory sync. I've got another question : Is it possible to synchronize AD and FDS if AD is in native mode ? _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

[Fedora-directory-users] Configuration Directory Server failover
by Mister Anonyme 16 Jul '08

16 Jul '08

Hi, I installed and configured many LDAP servers in a multi-master environment. Work very well. Now, I want to do a failover of the Configuration Directory Server between two masters, just in case. I tried to follow the instructions right here: http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_Replication-R… It's just as clear as a mud... I would really like to have an real-life scenario example to help me because I'm struggling to configure it and it doesn't work at all. For example, the step 1 instruct us to create a file.inf and 4 ldif files: 0.- file.inf FullMachineName = MY FULL HOSTNAME AdminDomain = MY DOMAIN NAME SuiteSpotUserID = nobody SuiteSpotGroup = nobody ConfigDirectoryLdapURL = ldap://MY FULL HOSTNAME:389/o=NetscapeRoot ConfigDirectoryAdminID = admin ConfigDirectoryAdminPwd = MY PASSWORD [admin] ServerAdminID = admin ServerAdminPwd = MY PASSWORD SysUser = nobody ServerIpAddress = MY SERVER IP ADDRESS Port = 9830 [slapd] InstallLdifFile = suggest ServerIdentifier = MY SERVER HOSTNAME ServerPort = 389 AddOrgEntries = Yes RootDN = cn=Directory Manager RootDNPwd = MY DS PASSWORD SlapdConfigForMC = yes Suffix = dc=EXAMPLE, dc=NET UseExistingMC = 0 AddSampleEntries = Yes ConfigFile = repluser.ldif ConfigFile = changelog.ldif ConfigFile = replica.ldif ConfigFile = replagreement.ldif 1.- repluser.ldif dn: cn=replication manager,cn=config changetype: add objectClass: inetorgperson objectClass: person objectClass: top cn: replication manager sn: RM userPassword: MY ENCRYPTED PASSWORD passwordExpirationTime: 20380119031407Z 2.- changelog.ldif dn: cn=changelog5,cn=config changetype: add objectclass: top objectclass: extensibleObject cn: changelog5 nsslapd-changelogdir: /var/lib/dirsrv/slapd-MYINSTANCE/changelogdb 3.- replica.ldif dn: cn=replica,cn="o=NetscapeRoot",cn=mapping tree,cn=config changetype: add objectclass: top objectclass: nsds5replica objectclass: extensibleObject cn: replica nsds5replicaroot: o=NetscapeRoot nsds5replicaid: 1 nsds5replicatype: 3 nsds5flags: 1 nsds5ReplicaPurgeDelay: 604800 nsds5ReplicaBindDN: cn=replication manager,cn=config 4.- replagreement.ldid dn: cn=replication_netscaperoot,cn=replica,cn="o=Netscaperoot",cn=mapping tree,cn=config changetype: add objectclass: top objectclass: nsds5replicationagreement cn: replication_netscaperoot nsds5replicahost: SECONDARY LDAP SERVER HOSTNAME nsds5replicaport: 389 nsds5ReplicaBindDN: cn=replication manager nsds5replicabindmethod: SIMPLE nsds5replicaroot: o=Netscaperoot description: replication netscaperoot nsds5replicacredentials: ENCRYPTEDPASSWORD nsds5BeginReplicaRefresh: start Then, I ran: /usr/sbin/setup-ds-admin.pl -s -f file.inf It went without errors. And then... I don't see any replica nor replica agreement. Even the user "cn=replication manager,cn=config' doesn't appear in the console. So, I'm wondering if any of you has succeeded to configure a replication/failover of o=NetscapeRoot ? If yes, I would be greatly appreciated if you could put your examples in real-life scenaro, it would help me alot. Thank you very much! _________________________________________________________________ Find hidden words, unscramble celebrity names, or try the ultimate crossword puzzle with Live Search Games. Play now! http://g.msn.ca/ca55/212

2 1

[Fedora-directory-users] replication spam
by Luke Bigum 15 Jul '08

15 Jul '08

Hi guys, has anyone come across this error before? It starts about a minute after restarting the directory server and repeats every second. [15/Jul/2008:17:03:05 +1000] NSMMReplicationPlugin - changelog program - libdb: f9d40083-1dd111b2-b30d81db-66a20000_48337401000000010000.db4: unable to flush: No such file or directory [15/Jul/2008:17:03:05 +1000] NSMMReplicationPlugin - changelog program - libdb: txn_checkpoint: failed to flush the buffer cache No such file or directory It's only seen with replication debug logging on, however I don't want to disable this logging as it's helping me catch an MMR bug: https://bugzilla.redhat.com/show_bug.cgi?id=442170 On that note, any word on when the fix for https://bugzilla.redhat.com/show_bug.cgi?id=442170 is getting officially released? Thanks, -Luke -- Luke Bigum Systems Administrator iseek Communications Pty Ltd Excellence in business data solutions ph 1300 661 668 fax 1300 661 540 www.iseek.com.au<http://www.iseek.com.au/>

2 1

[Fedora-directory-users] Fedora DS Installation
by Gene Poole 15 Jul '08

15 Jul '08

I would like to install the latest release of Fedora Directory Server onto a specific filesystem. Does anyone know how this can be done? Is it possible using RPM? TIA, Gene Poole

3 2

[Fedora-directory-users] Creating backup LDAP server.
by John Oliver 15 Jul '08

15 Jul '08

One of the projects on my plate is to have a working backup of an existing fedora-ds server. I installed fedora-ds under CentOS 5.2 and copied over the files that result from ns-slapd db2archive from the existing server to the new machine. First off, I know nothing about LDAP or fedora-ds in particular :-) After looking at the existing server and what I had after installing on the new server, I decided that running /usr/sbin/setup-ds-admin.pl was probably necessary. I went through, answering the questions as best I could (and figuring that the answers would be overwritten when I restored the backup). I got this: [08/07/10:10:18:52] - [Setup] Info Are you ready to set up your servers? [08/07/10:10:18:56] - [Setup] Info yes [08/07/10:10:18:56] - [Setup] Info Creating directory server . . . [08/07/10:10:18:59] - [Setup] Info Your new DS instance 'unix-services2' was suc cessfully created. [08/07/10:10:18:59] - [Setup] Info Creating the configuration directory server . . . [08/07/10:10:22:08] - [Setup] Fatal Error: failed to open an LDAP connection to host 'unix-services2.my.domain.com.com' port '389' as user 'cn=Directory Ma nager'. Error: unknown. [08/07/10:10:22:08] - [Setup] Fatal Failed to create the configuration directory server [08/07/10:10:22:08] - [Setup] Fatal Exiting . . . Log file is '/tmp/setupVSpvCl.log Yes, that's two ".com"s No idea why. So, I stop the dirsrv process and try: [root@localhost ~]# ns-slapd archive2db -D /etc/dirsrv/slapd-unix-services2 -a /var/lib/dirsrv/slapd-unix-services2/in [10/Jul/2008:11:05:39 -0700] - ERROR: target server has no NetscapeRoot configured [10/Jul/2008:11:05:39 -0700] - archive2db: Failed to read backup file set. Either the directory specified doesn't exist, or it exists but doesn't contain a valid backup set, or file permissions prevent the server reading the backup set. error=53 (Invalid request descriptor) I have no idea what a NetscapeRoot is, why I would want one, or how I'd get it. Googling didn't help me... I found many references to "-0 netscaperoot", but that seems to be in reference to /etc/dirsrv/admin-serv/adm.conf which does not exist on my new server. What is the easiest way for me to do this? Can I simply copy adm.conf (and other files? Which ones?) from the existing server? Or is there some mysterious problem about why the setup script couldn't contact the LDAP server which is to blame? -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

4 20

[Fedora-directory-users] Accessing Management Console
by John Oliver 15 Jul '08

15 Jul '08

fedora-idm-console asks me for User ID and Password (which I should have), but wants an "Administration URL" as well. So far, nothing is working. I've tried http://localhost/ http://localhost:9830 and my FQDN as well as FQDN:9830 None work. What does it want? I've tried against two servers that I can access 9830 via a web browser. It always says: Cannot connect to the Admin Server "http:/" The URL is not correct or the server is not running It says it just like that... "http:/" Almost like it cannot read past six characters. -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

4 3

[Fedora-directory-users] Question on monitoring authorization
by Chun Tat David Chu 14 Jul '08

14 Jul '08

Hi all, I've a question on monitoring authorization. When a user without sufficient privileges and perform a search request on the LDAP, the user will receive an empty result from the LDAP. I followed the instruction from the Red hat Directory Server Administrator's Guide and set the access mode to 777 to log all read, write and execute commands. When I look at the log of an unauthorize user, all I see is the following [07/Jul/2008:11:08:37 -0400] conn=42 op=81 SRCH base="ou=sandbox,ou=my_test,dc=example,dc=com" scope=1 filter="(objectClass=*)" attrs="objectClass javaClassName" [07/Jul/2008:11:08:37 -0400] conn=42 op=81 RESULT err=0 tag=101 nentries=0 etime=0 The log doesn't indicate any authorization error. I was wondering if there's additional settings that I can set on Fedora DS so I can easily tell if a user is not authorize to perform a search operation on the LDAP. Thanks! - David

2 2

[Fedora-directory-users] Question about setting a Password Policy from the Command Line
by Eric Brown 10 Jul '08

10 Jul '08

I am trying to create an LDIF for importing a default password policy for my FDS server that I can quickly import after I start it. I was looking through the Adminstrator's Guide and it seems to be missing some fields that are defined in the objectclass for password policy. I was just wondering if the Admin guide was correct and has all of the defined attributes for the policy there and defined, or if these extra ones are also valid and have documentation associated with them. I am using the 1.0.4 version of FDS and I would guess that they online guides have been updated for the newer versions, but I didn't expect to see this much of a difference. Attributes from the Admin Guide: passwordGraceLimit passwordMustChange passwordChange passwordExp passwordMaxAge passwordWarning passwordCheckSyntax passwordMinLength passwordMinAge passwordHistory passwordInHistory passwordStorageScheme Attributes from the 00core.ldif schema definition of the password policy objectclass: passwordMaxAge passwordExp passwordMinLength passwordKeepHistory passwordInHistory passwordChange passwordWarning passwordLockout passwordMaxFailure passwordResetDuration passwordUnlock passwordLockoutDuration passwordCheckSyntax passwordMustChange passwordStorageScheme passwordMinAge passwordResetFailureCount passwordGraceLimit passwordMinDigits passwordMinAlphas passwordMinUppers passwordMinLowers passwordMinSpecials passwordMin8bit passwordMaxRepeats passwordMinCategories passwordMinTokenLength Just need to know which list is really valid, and I need the documentation or at least explanations of the fields that I can use in my version. Thanks in advance. Eric

2 2

[Fedora-directory-users] altServer
by Del 10 Jul '08

10 Jul '08

Hi, Is there any plan to support the altServer attribute in the root DSE of a Fedora Directory Server? By that I mean that the server should advertise its list of replicas (currently buried under cn=replica,cn="BASEDN",cn=mapping tree,cn=config for each base DN) in the root DSE using the altServer attribute? This would make it easier to build resilient clients that automatically knew where to reconnect to if the primary server went down. -- Del Babel Com Australia http://www.babel.com.au/ ph: 02 9966 9476 fax: 02 9906 2864

2 1

[Fedora-directory-users] Using Console, posixGroups
by Hendry, Chris 08 Jul '08

08 Jul '08

Sorry if this has been asked before. I'm using FDS to authenticate Linux and Mac. Mac uses the LDAP Mappings: RFC 2307, thus to get what groups a users is a part of, it looks at the attribute memberUid from posixGroup Class. When using the console to create a group, by default, it uses the attribute uniquemember from the groupOfUniquNames class. Thus I have to add the posixGroup class manually using the advance button. Also, to modify users of a group, I can not simply use the memberof window, must use the advanced button to modify the memberUid attribute. This does not make much sense. Adding a group should be like adding a User, where you have a window to enable Posix attributes. Any ideas on getting the console to handle the posixGroup class? Chris

2 1

[Fedora-directory-users] Malchow, Sören is out of the office.
by Sören Malchow 08 Jul '08

08 Jul '08

I will be out of the office starting 08.07.2008 and will not return until 28.07.2008. Please contact Guenther Kreuzpaintner ( guenther.kreuzpaintner(a)interone.de ) instead

1 0

[Fedora-directory-users] Re: Case Sensitive Lookup and Searching (Mike C)
by Howard Chu 08 Jul '08

08 Jul '08

> Date: Tue, 8 Jul 2008 10:16:09 +1200 > From: "Mike C"<smith.not.western(a)gmail.com> > I agree, my schema (and data) are terrible. It's an artifact from > openldap not being as conforming as fds. Ahem. OpenLDAP conforms perfectly to the LDAPv3 spec here. The behavior you're seeing with FDS is due to the fact that the FDS code base doesn't have full LDAPv3 schema support. Rich's reference to ces and cis is an artifact of the way the old UMich LDAPv2 code kludged schemas, and his mention of "case sensitive syntax" is archaic. In X.500 and LDAPv3, string syntaxes have no case sensitivity property at all; case sensitivity is determined solely by the matching rules in the schema definition of the attribute using the syntax. The only difference between IA5String and DirectoryString syntax is the range of legal characters that may be contained in the string (DirectoryString accomodates the entire Unicode set in UTF8 encoding, IA5String only allows 7 bit ASCII). > My main concern is that sanitizing my repository would require > changing usernames for a hundred odd external users, something I wish > to avoid. But given how memberUid's case sensitivity is nullified when > part of a dn, migration it is. In a true LDAP/X.500 server, DN evaluation obeys all of the schema rules of the individual attributes in each RDN composing the DN. E.g. in OpenLDAP, memberUid is case-sensitive whether it's being used in a RDN or anywhere else. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

[Fedora-directory-users] Samba/FDS Integration upgrade steps?
by Ken Marsh 08 Jul '08

08 Jul '08

I am planning an upgrade on a supported RHES4 server from Samba 3.0.10-1.4E to 3.0.25b or the latest in the RHN update stream. I currently have Samba authentication integrated with AD through FDS 1.0.1-4, only because FDS 1.1 doesn't run on RHES4. I have single sign-on but not integrated password changes for Windows XP Domain users. Every Samba+FDS user currently has objectClass attribute sambasamaccount, and attributes sambaSID, sambaAcctFlags, sAMAccountName, sambaLMPassword and sambaNTPassword. According to Red Hat support (who cannot help me much because they only support OpenLDAP), there is a "schema change" and a script to convert the schema, however they did not know where the script was or its name. I also noticed during an attempt to upgrade that the SambaSID has changed format in 3.0.25b so I suppose I have to change that attribute value for every user. Can someone name the conversion script and lay out the steps that it will take to get me from 3.0.10-1.4E to 3.0.25b/later while maintaining AD integration? If it involves upgrading to FDS1.1, I can handle that, but I'd rather do one thing at a time. If there are any side benefits (like single password change) I'd also like to know. Thanks, Ken.

2 1

[Fedora-directory-users] Case Sensitive Lookup and Searching
by Mike C 07 Jul '08

07 Jul '08

Hi, I'm running Fedora-Directory/1.0.2 B2006.111.2147, and talking to it via a Java App. Previously the app was talking to an OpenLDAP 2.3.x server. My problem is with this: Object o = ctx.lookup("memberUid=steves,ou=People"); In OpenLDAP, it returns the correct user (steves). In FDS, it returns the wrong user, 'Steves'. Yes, unfortunately our data is like that, where case sensitivity is important. In fact, as a side issue, when we import the data from ldif into FDS, the ldif2db process ignores duplicate entries (i.e. steves was inserted, but Steves ignored as it was considered a duplicate). ldif2db Error: import company: WARNING: Skipping duplicate entry "memberUid=steves,ou=People,o=company.com" As you might imagine, I'd like to get it so both ldif2db and lookups are case sensitive. However, it seems like ldapsearch is case sensitive. # ./ldapsearch -h 127.0.0.1 -b "o=company.com" memberUid=steves # ./ldapsearch -h 127.0.0.1 -b "o=company.com" memberUid=Steves version: 1 dn: memberUid=Steves,ou=People,o=company.com personalTitle: Mr etc... So, the question goes, what am I missing? I've even tried changing the definition of memberUid in config/schema/10rfc2307.ldif to use attributeTypes: ( 1.3.6.1.1.1.1.12 NAME 'memberUid' DESC 'Standard LDAP attribute type' EQUALITY caseExactIA5Match SUBSTRINGS caseExactIA5SubstringsMatch SYNTAX 'IA5String' ) Ideas? Thanks, Mike

4 12

[Fedora-directory-users] active directory synchronization info
by omight 07 Jul '08

07 Jul '08

Hi List, Does fedora-ds only synchronize users, groups and passwords with active directory? So it's not possible to synchronize other objects? Is it possible to synchronize all objects between active directory and linux directory software? Which product do you recommend? thanks heaps, Omight

1 0

[Fedora-directory-users] A multi-master disaster
by Edward Capriolo 07 Jul '08

07 Jul '08

Sorry for the funny title. I THINK* this may be a bug of multi-master replication agreement created from the Windows Version of the Console Tool but I was hoping someone could shed some light on this. I have set up multi master replication before and did not run into this issue. I go about the normal process described in the documentation to setup a multi-master replication agreement for only one suffix of my directory server. dc_edops_dc_com. Enable changelog Select multi-master replication Give each server a unique id I initialize the side of the connection with data. (I also have tried using ldif to get both sides in sync before the transfer. ) On the side I initialize from I get these messages in the error log. [02/Jul/2008:18:25:19 -0400] - import dc_edops_dc_com: Workers finished; cleaning up... [02/Jul/2008:18:25:19 -0400] - import dc_edops_dc_com: Workers cleaned up. [02/Jul/2008:18:25:19 -0400] - import dc_edops_dc_com: Cleaning up producer thread... [02/Jul/2008:18:25:19 -0400] - import dc_edops_dc_com: Indexing complete. Post-processing... [02/Jul/2008:18:25:19 -0400] - import dc_edops_dc_com: Flushing caches... [02/Jul/2008:18:25:19 -0400] - import dc_edops_dc_com: Closing files... [02/Jul/2008:18:25:19 -0400] - import dc_edops_dc_com: Import complete. Processed 42 entries in 2 seconds. (21.00 entries/sec) [02/Jul/2008:18:25:19 -0400] NSMMReplicationPlugin - multimaster_be_state_change: replica dc=edops,dc=com is coming online; enabling replication [02/Jul/2008:18:25:20 -0400] NSMMReplicationPlugin - repl_set_mtn_referrals: could not set referrals for replica dc=edops,dc=com : 32 At this point actually multi-master replication is enabled, but the B side of the connection has some strange referral to the A side. When I connect to side B of the replication it seems like there is one more level there. Does anyone understand why this simple setup would not be working?

2 3

[Fedora-directory-users] Question about setting a Password Policy from the Command Line
by Eric Brown 07 Jul '08

07 Jul '08

I am trying to create an LDIF for importing a default password policy for my FDS server that I can quickly import after I start it. I was looking through the Adminstrator's Guide and it seems to be missing some fields that are defined in the objectclass for password policy. I was just wondering if the Admin guide was correct and has all of the defined attributes for the policy there and defined, or if these extra ones are also valid and have documentation associated with them. I am using the 1.0.4 version of FDS and I would guess that they online guides have been updated for the newer versions, but I didn't expect to see this much of a difference. Attributes from the Admin Guide: passwordGraceLimit passwordMustChange passwordChange passwordExp passwordMaxAge passwordWarning passwordCheckSyntax passwordMinLength passwordMinAge passwordHistory passwordInHistory passwordStorageScheme Attributes from the 00core.ldif schema definition of the password policy objectclass: passwordMaxAge passwordExp passwordMinLength passwordKeepHistory passwordInHistory passwordChange passwordWarning passwordLockout passwordMaxFailure passwordResetDuration passwordUnlock passwordLockoutDuration passwordCheckSyntax passwordMustChange passwordStorageScheme passwordMinAge passwordResetFailureCount passwordGraceLimit passwordMinDigits passwordMinAlphas passwordMinUppers passwordMinLowers passwordMinSpecials passwordMin8bit passwordMaxRepeats passwordMinCategories passwordMinTokenLength Just need to know which list is really valid, and I need the documentation or at least explanations of the fields that I can use in my version. Thanks in advance. Eric

1 0

[Fedora-directory-users] Scheduled Resync with Windows Sync?
by Glenn 07 Jul '08

07 Jul '08

It is difficult to know when a full resynchronization is necessary for a given Windows Sync agreement. I would like to be able to start a full resync from a cron script. Is this possible, or is there any other way to schedule a full resync to run periodically without human intervention? We are using Fedora Directory 1.04 on Red Hat EL4, synchronizing with Active Directory running on Windows 2003 Server. Thanks. -G.

3 4

[Fedora-directory-users] Slapd Crash and wont start up again
by Jim Summers 06 Jul '08

06 Jul '08

Hello All, Had a power outage this morning. When the system came back up the slapd would not start. I found the following in the error log: Fedora-Directory/1.0.2 B2006.060.1928 landin.cs.ou.edu:636 (/opt/fedora-ds/slapd-landin) [04/Jul/2008:16:17:37 -0500] - Entry "cn=SNMP,cn=config" -- attribute "nsSNMPName" not allowed [04/Jul/2008:16:17:37 -0500] - Entry "cn=SNMP,cn=config" -- attribute "nsSNMPName" not allowed [04/Jul/2008:16:17:37 -0500] - Fedora-Directory/1.0.2 B2006.060.1928 starting up [04/Jul/2008:16:17:37 -0500] - ERROR: Database version mismatch (expecting 'Netscape-ldbm/7.0' but found 'nsibleObject' in directory /opt/fedora-ds/slapd-landin/db) [04/Jul/2008:16:17:37 -0500] - start: db version is not supported [04/Jul/2008:16:17:37 -0500] - Failed to start database plugin ldbm database [04/Jul/2008:16:17:37 -0500] - WARNING: ldbm instance userRoot already exists [04/Jul/2008:16:17:37 -0500] - WARNING: ldbm instance NetscapeRoot already exists Any ideas on how I can fix this? This is a replica and fortunately the master is ok. Would it be possible to simply copy the db directory from the master and drop it on this replica? Happy Fourth! TIA -- Jim Summers Computer Science - University of Oklahoma

2 2

[Fedora-directory-users] Windows to linux migration [PassSync.msi for 64 bit windows2003 ]
by lingu 03 Jul '08

03 Jul '08

HI, I am trying to migrate from windows to linux. For that i am integrating existing windows 2003 R2 64 BIT standard edition running ADS with Redhat Directory Server 8.0 runnning on RHEL5 for user/group and password sync.I followed the step gfeiven in fedora wiki and i sucessfully synced the users but password sync is not happening.In passync log its telling* "unable to load password entries from file" Since i am using 64 bit windows edition but rhds8.0 is running on 32 bit edition.May be the passSync.msi comes along with 32bit edition works only with 32 bit windows or if any 64 bit version of PassSync.msi is available.Plz help me this is very urgent for me. Regards lingu *

3 2

[Fedora-directory-users] howto create the sync manager ?
by ken oh 03 Jul '08

03 Jul '08

I've read the 8.3 chapter from the red hat guide I've tried to create the sync manager by adding the following lines in the dse.ldif : dn: cn=sync manager,cn=config objectClass: inetorgperson objectClass: person objectClass: top cn: sync manager sn: RM userPassword: password passwordExpirationTime: 20380119031407Z And when I restart the directory server I've got this error message : Entry "cn=sync manager,cn=config " has unknown object class "inetorgperson " (remove the trailing space) [12/Jun/2008:20:47:33 +0200] - Entry "cn=sync manager,cn=config " has unknown object class "person " (remove the trailing space) [12/Jun/2008:20:47:33 +0200] - Entry "cn=sync manager,cn=config " has unknown object class "top " (remove the trailing space) So I would like to know what I'm doing wrong and what should I do to create the sync manager, please. thanks _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

3 3

[Fedora-directory-users] PassSync.msi for 64 bit windows2003
by lingu 02 Jul '08

02 Jul '08

HI, Iam trying to migrate from windows to linux for that i am integrating existing windows 2003 R2

1 0

[Fedora-directory-users] Why there is no rpm for 1.1.1?
by DANIEL CRISTIAN CRUZ 01 Jul '08

01 Jul '08

Hi all, I asked a week ago about the missing packages. Why there is no package there yet? I got a server dying at random, and said to my sponsors that a project from Redhat would be stable and we could get updates when needed. If there is no plan to build these packages, why there is no warning on the first page? Using a package with a serious bug in which any search could stop your server is insane. There is no maintainer for the repository? Regards, -- <span style="color: #000080">Daniel Cristian Cruz </span>Administrador de Banco de Dados Direção Regional - Núcleo de Tecnologia da Informação SENAI - SC Telefone: 48-3239-1422 (ramal 1422)

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users July 2008