August 2008 - 389-users - Fedora Mailing-Lists

[Fedora-directory-users] ObjectClass PosixGroup + UID/GID auto-generation

by Kashif Ali

Hello All, After spending a long weekend, configuring Fedora-DS to have central autentication + Central home dirs, I now have two issues which I would like to know if anyone can help me with. 1) Currently when adding a new user, I have to manually goto advanced options and add a value called posixgroup to the object class, this is so that groupID have a name and you dont see the error GroupID name not found when logging onto a box. Is there anyway to update the default user template, so that, when you enable posixaccount, posixgroup objectclass is automatically added? thus removing the manual process? 2) Is there anyway to get the directory server generate UNIQUE UID/GID based on last uid created. Ideally I would like the range to start from 5000 and finish at 8000. The automatic procedure would just use the next available uid/gid in the list, again removing the need for the user to check and make sure the id is unique. any help with either of these issues would be much appreciated. Regards Kashif

15 years, 8 months

5
7
0 / 0

[Fedora-directory-users] new user entry starts with uid=

by ben.van.veen＠planet.nl

Hi, Fedora-ds 1.0.4. New User entry in the directory will have a RDN starting with uid= . I would like to change that to cn= Know that in de advanced properties one can change the Naming Attribute, but I want it to be cn= on creation of a new entry. Where can I change those default setting(s). Thnx

15 years, 8 months

2
1
0 / 0

[Fedora-directory-users] can I ditch the gui?

by Russell Miller

Hi all, OK, I run a moderate sized LDAP system that I inherited. It's been broken to one degree or another for literally years and it's my task to fix it. I've already upgraded every single server to redhat-ds 8, and am in the process of nailing down a few bugs that we have never been able to address. Not being able to change expired passwords, etc. I would like to integrate setup with, say puppet. I would like to be able to say "OK, here's a host, let's build a working LDAP setup, *without human intervention*.". It seems to be impossible. Many steps I can't do except for through the GUI, the SSL key setup (which I can do via command line using certutil though it doesn't seem to be documented and I don't know yet how to do a request) is very awkward, and basically setting up a new server is currently an intensely manual process. I don't like this. I would like a command like utility of some kind where I can do everything the admin gui can do - turning options on and off, etc. And I would like just one tool, not having to go around to all sorts of different places and change entries here and there. I know it can be done because the gui does it. How about making it admin friendly? Or am I missing something and it's already there? Thanks, --Russell

15 years, 8 months

2
1
0 / 0

[Fedora-directory-users] administeratly prohibit

by Zahra Bahar

Hi all, A radius server is working with fedora DS. radius sends authentication packets, but ldap server doesn't accept and sends administeratly prohibit reply. should be radius server introduced in ldap server?if yes,where?

15 years, 8 months

1
1
0 / 0

[Fedora-directory-users] Re: Fedora-directory-users Digest, Vol 39, Issue 12

by Mike Carroll

I'm sorry if I am screwing up my reply to your comment, but this is the first time I've gotten involved with a mailing list before. To your comment Rob I think adding this in would be a really cool feature. Ever since that article showed up in bigadmin about integrating mod_nss into Apache it has created a lot of buzz within the department of defense because of the OCSP plug-in. The DoD currently has the largest PKI implementation in the world and key component is efficient, and easy, OCSP checking which mod_nss has the capability of doing (on paper at least: I still haven't gotten it to work in my dev enviornment) without dropping some cash to Tumbleweed and Corestreet. However, alot of the servers (and especially desktop users) have to route their http traffic through a proxy server in order to go outside the network enclave. So I can definitly see the need for the ability to proxy OCSP traffic. Also, on a side note...but where you the one who responded to my support question to Red Hat on this...they gave me the same answer :) Mike Carroll wrote: > I've currently configured mod_nss-1.0.7 to replace mod_ssl in apache > 2.2.9 and there is a configuration paramater nss.conf, > NSSOCSPDefaultURL, where you can specfic the URL for an ocsp server. In > order to route traffic out-bound from the server we have to route all > http traffic through a proxy server. However, the documentation has > been vague on this point and looking at mod_ocsp.c doesn't give me a lot > of hope eaither (Although I am not a C coder). So my question is it > possible to route OCSP trafficfrom mod_nss through an http proxy server? > if so how? Unfortunately, no. Right now mod_nss relies on the built-in NSS OCSP client which is relatively feature-poor. I had worked on curl integration at one point long ago but never got it to to a point where I was satisfied with its quality. I can see about reviving this code, if I can find it, to see what state it is in, perhaps as an experimental feature. rob -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature Url : https://www.redhat.com/archives/fedora-directory-users/attachments/200808...

15 years, 8 months

1
0
0 / 0

[Fedora-directory-users] mod_nss

by Mike Carroll

I've currently configured mod_nss-1.0.7 to replace mod_ssl in apache 2.2.9 and there is a configuration paramater nss.conf, NSSOCSPDefaultURL, where you can specfic the URL for an ocsp server. In order to route traffic out-bound from the server we have to route all http traffic through a proxy server. However, the documentation has been vague on this point and looking at mod_ocsp.c doesn't give me a lot of hope eaither (Although I am not a C coder). So my question is it possible to route OCSP trafficfrom mod_nss through an http proxy server? if so how? Thanks, Mike

15 years, 8 months

2
1
0 / 0

RE: [Fedora-directory-users] Unable to SSL with Windows Sync Agreement

by Groot, Mathijs de (IDT Competence Java)

Hi Sebastian, Thanks for your suggestion. I'm assuming that when the CA is trusted for Server and Client certificates (CT) the server certificates signed by that CA are automatically trusted peer as well. I have made the trust changes to the certificates and imported the third windows certificate as well, my (clean installed) windows Server has three certificates, the last one added is the domain certificate. the CA and Server certificates should be sufficient according to the manual. Red Hat Directory Server (gemeente.grep) # certutil -L -d . Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI gemeente_ds_ca_cert CTu,u,u gemeente_ds_server_cert u,u,u parijs_ca_cert CT,, parijs_domain_cert P,P,P parijs_server_cert P,P,P Windows Active Directory (parijs.gem) unchanged C:\Program Files\Red Hat Directory Password Synchronization>certutil -L -d . rhds_ds_ca_cert CT,C,C rhds_ds_server_cert Pu,Pu,Pu In the mean while, I've run some extra test to check the connectivity between the Red Hat and Windows Server, but all of the following test outputs the expected result of the query These search queries are executed from the Red Hat Directory Server. #/usr/lib64/mozldap/dapsearch -Z -P /etc/dirsrv/slapd-rhds/cert8.db -h adsync.parijs.gem -p 636 -D "CN=Administrator,CN=Users,DC=parijs,DC=gem" -w <pwd> -s base -b "dc=parijs,dc=gem" "objectclass=top" #/usr/lib64/mozldap/ldapsearch -x -ZZ -b 'dc=gemeente,dc=grep' -D "cn=Directory Manager" -w <pwd> '(objectclass=*)' # /usr/lib64/mozldap/ldapsearch -x -ZZ -h adsync.parijs.gem -b 'dc=parijs,dc=gem' -D "CN=Administrator,CN=Users,DC=parijs,DC=gem" -w <pwd> '(objectclass=*)' But there are still no outgoing tcp/ip packages from the Red Hat Directory Server when the new Windows Sync Agreement is configured and the message is shown that the Red Hat server is unable to contact Active Directory server. Problem summary: I can't get an SSL connection with the a new Windows Sync Agreement, from the Red Hat DS to the Windows AD server. Ldapsearch queries over SSL seems to work fine, But strangely enough there is not network traffic at all when the SSL connection is checked! (when clicking on next and the message "unable to contact Active Directory server, continue" appears). See emails below for more information. Does anyone has a suggestion how to trouble shoot this problem? Mathijs de Groot From: Sebastian Tabarce [mailto:blue_moon_ro@yahoo.com] Sent: donderdag 7 augustus 2008 20:23 To: Groot, Mathijs de (IDT Competence Java) Subject: RE: [Fedora-directory-users] Unable to SSL with Windows Sync Agreement Hi Mathijs, >From what you showed us, it seems that while RHDS is a trusted peer of Active Directory, Active Directory is not a trusted peer of RHDS. This might be a reason for RHDS to not even try to establish a sync with AD. Other then this, I have no other ideas for now. I'm not an experimented RHDS admin, but maybe others will be of more help. Good luck, Sebastian --- On Thu, 8/7/08, Groot, Mathijs de (IDT Competence Java) <math.de.groot(a)logica.com> wrote: From: Groot, Mathijs de (IDT Competence Java) <math.de.groot(a)logica.com> Subject: RE: [Fedora-directory-users] Unable to SSL with Windows Sync Agreement To: blue_moon_ro(a)yahoo.com, "General discussion list for the Fedora Directory server project." <fedora-directory-users(a)redhat.com> Date: Thursday, August 7, 2008, 5:19 PM Hi Sebastian, Thanks for your reply. We've created the CA and Server certificates on Red Hat Directory Server (like described in: http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_SSL-Using_ certutil.html <http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_SSL-Using _certutil.html> ) And created a server certificate on the Windows Server (http://support.microsoft.com/kb/931351 <http://support.microsoft.com/kb/931351> ) The CA and Server certificates are exchanged between the both Servers and are trusted, like the certutil output shows: On the Red Hat Directory (rhds.grep): # certutil -L -d . Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI rhds_ds_ca_cert CTu,u,u parijs_server_cert ,, rhds_server_cert u,u,u parijs_ca_cert CT,, on the Windows Active Directory (parijs.gem): C:\Program Files\Red Hat Directory Password Synchronization>certutil -L -d . rhds_ds_ca_cert CT,C,C rhds_ds_server_cert Pu,Pu,Pu And the ldapsearch in the command line from the Red Hat server over SSL works with the use of the certificate database, the following command returns entries of Windows Active Directory: /usr/lib64/mozldap/ldapsearch -Z -P /etc/dirsrv/slapd-rhds/cert8.db -h adsync.parijs.gem -p 636 -D "CN=Administrator,CN=Users,DC=parijs,DC=gem" -w - -s base -b "dc=parijs,dc=gem" "objectclass=top" Note that I'm using a Red Hat Enterprise 64 bits version and a Windows 2003 32bits. Do you've got any suggestions why there are no outgoing tcp/ip packages from the Red hat Directory Server when the new Windows Sync Agreement is configured and the message is shown that the Red Hat server is unable to contact Active Directory server? Mathijs From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Sebastian Tabarce Sent: donderdag 7 augustus 2008 15:03 To: General discussion list for the Fedora Directory server project. Subject: Re: [Fedora-directory-users] Unable to SSL with Windows Sync Agreement Mathisj, If I'm not mistaking, in order for the two servers to be able to talk with each other, they need to have certificates signed by Certificate Authorities recognized by the two servers (meaning, the certificates of these root CAs must be installed on the two servers). Even more straightforward is to generate certificate requests for both servers and get them signed by the same root CA. --- On Thu, 7/31/08, Groot, Mathijs de (IDT Competence Java) <math.de.groot(a)logica.com> wrote: From: Groot, Mathijs de (IDT Competence Java) <math.de.groot(a)logica.com> Subject: [Fedora-directory-users] Unable to SSL with Windows Sync Agreement To: fedora-directory-users(a)redhat.com Date: Thursday, July 31, 2008, 12:18 PM Hello everyone, I can use some help with setting up the Windows Sync. Ill give some context first, im trying to sync user, groups and passwords from a Windows 2003 server with Active Directory with a Red Hat enterprise 5, Red Hat Directory Server 8.0. It is a test environment with where I can access and configure the servers easily. But ive got some problems setting a new Windows Sync Agreement. It comes down to the following: I can't get an SSL connection with the a new Windows Sync Agreement, from the Red Hat DS to the Windows AD server. In the Windows Sync Server info screen I get the following message when clicking on next: "unable to contact Active Directory server, continue" (Windows Sync Server info screen located In the Directory Server Console -> Configuration tab -> Replication -> userRoot -> highlight the database -> Object -> New Windows Sync Agreement -> The second screen reads Windows Sync Server Info) But when I uncheck the checkbox "Using encrypted SSL connection" the connection works and the Windows AD server is reached. So this concludes (and ive tested) that the Windows Server and domain is reachable and the Bind DN is valid, and entered values are correct. The SSL connection seems to be setup correctly, the checks (ldapsearch query) described by the fedora manual outputs the correct result. Following: " http://directory.fedoraproject.org/wiki/Howto:WindowsSync Testing your Configuration Test to make sure you can talk SSL from Fedora Directory to AD This is how you test to verify that the Windows side SSL is enabled properly: ldapsearch -Z -P <RHDS-cert8.db> -h <AD/NT Hostname> -p <AD SSL port> -D "<sync manager user>" -w < sync manager password> -s <scope> -b "<AD base>" "<filter>" " My ldapsearch query: /usr/lib64/mozldap/dapsearch -Z -P /etc/dirsrv/slapd-<instance>/cert8.db -h compute.domain.com -p 636 -D "CN=Administrator,CN=Users,DC=domain,DC=com" -w <pwd> -s base -b "dc=domain,dc=com" "objectclass=top" But strangely enough there is not network traffic at all when the SSL connection is checked! (when clicking on next and the message "unable to contact Active Directory server, continue" appears) Ive done the following actions to make to monitor it: First I've disabled SELinux, in case that blocks something (just for testing). watch the tcp ip traffic with: tcpdump -nn -p port not ssh and ip host <Red Hat IP number> Here I can see that, when I don't use the SSL connection, there is traffic towards my Widows AD, but when ive check the SSL option, there is no traffic at all, nothing. As well when I look at the iptables: added an extra line: iptables -I OUTPUT 1 -d <Windows AD IP number> -j ACCEPT watch -d iptables -L -nv I see the same result, traffic when I don't use the SSL option and no traffic at all when the SSL option is checked. How can I get the message "unable to contact Active Directory server, continue" when there is no outgoing request from my Red Hat server. Ive made certificates at both sides (Windows and Red Hat) and exported and imported these certificated to the other server. Please advice on following steps I can take, what the problem can be and how it is possible that there is no traffic at all. Thanks in advanced. Matt Mathijs A. de Groot Consultant - Software Engineer _________________________________________ Logica - Releasing your potential George Hintzenweg 89 3068 AX Rotterdam Postbus 8566 3009 AN Rotterdam Nederland T: +31 (0) 10 253 7000 D: +31(0) 70 37 56627 E: math.de.groot(a)logica.com <mailto:math.de.groot@logica.com> www.logica.com <http://www.logica.com/> Logica Nederland B.V. Registered office in Amstelveen, The Netherlands Registration Number Chamber of Commerce: 33136004 This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you. -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

15 years, 8 months

1
0
0 / 0

[Fedora-directory-users] Configuring an objectclass for all children

by James Roman

I am relatively new to setting up directory servers. I would like all accounts in one of my OUs to be configured with the radiusprofile object class, and with some default attributes set. I thought this might be possible with a Class of Service, but it seems to be stubling on assigning the objectclass, so no attributes are assigned. I tried setting up a pointer object class with no luck. Is there a trick to setting this up for an objectclass or is there a better way of reaching my objective? -- James D. Roman Sr. Network Administrator Science Systems and Application, Inc. Phone: 301-867-2101

15 years, 8 months

2
1
0 / 0

[Fedora-directory-users] Unable to SSL with Windows Sync Agreement

by Groot, Mathijs de (IDT Competence Java)

Hello everyone, I can use some help with setting up the Windows Sync. Ill give some context first, im trying to sync user, groups and passwords from a Windows 2003 server with Active Directory with a Red Hat enterprise 5, Red Hat Directory Server 8.0. It is a test environment with where I can access and configure the servers easily. But ive got some problems setting a new Windows Sync Agreement. It comes down to the following: I can't get an SSL connection with the a new Windows Sync Agreement, from the Red Hat DS to the Windows AD server. In the Windows Sync Server info screen I get the following message when clicking on next: "unable to contact Active Directory server, continue" (Windows Sync Server info screen located In the Directory Server Console -> Configuration tab -> Replication -> userRoot -> highlight the database -> Object -> New Windows Sync Agreement -> The second screen reads Windows Sync Server Info) But when I uncheck the checkbox "Using encrypted SSL connection" the connection works and the Windows AD server is reached. So this concludes (and ive tested) that the Windows Server and domain is reachable and the Bind DN is valid, and entered values are correct. The SSL connection seems to be setup correctly, the checks (ldapsearch query) described by the fedora manual outputs the correct result. Following: " http://directory.fedoraproject.org/wiki/Howto:WindowsSync Testing your Configuration Test to make sure you can talk SSL from Fedora Directory to AD This is how you test to verify that the Windows side SSL is enabled properly: ldapsearch -Z -P <RHDS-cert8.db> -h <AD/NT Hostname> -p <AD SSL port> -D "<sync manager user>" -w < sync manager password> -s <scope> -b "<AD base>" "<filter>" " My ldapsearch query: /usr/lib64/mozldap/dapsearch -Z -P /etc/dirsrv/slapd-<instance>/cert8.db -h compute.domain.com -p 636 -D "CN=Administrator,CN=Users,DC=domain,DC=com" -w <pwd> -s base -b "dc=domain,dc=com" "objectclass=top" But strangely enough there is not network traffic at all when the SSL connection is checked! (when clicking on next and the message "unable to contact Active Directory server, continue" appears) Ive done the following actions to make to monitor it: First I've disabled SELinux, in case that blocks something (just for testing). watch the tcp ip traffic with: tcpdump -nn -p port not ssh and ip host <Red Hat IP number> Here I can see that, when I don't use the SSL connection, there is traffic towards my Widows AD, but when ive check the SSL option, there is no traffic at all, nothing. As well when I look at the iptables: added an extra line: iptables -I OUTPUT 1 -d <Windows AD IP number> -j ACCEPT watch -d iptables -L -nv I see the same result, traffic when I don't use the SSL option and no traffic at all when the SSL option is checked. How can I get the message "unable to contact Active Directory server, continue" when there is no outgoing request from my Red Hat server. Ive made certificates at both sides (Windows and Red Hat) and exported and imported these certificated to the other server. Please advice on following steps I can take, what the problem can be and how it is possible that there is no traffic at all. Thanks in advanced. Matt Mathijs A. de Groot Consultant - Software Engineer _________________________________________ Logica - Releasing your potential George Hintzenweg 89 3068 AX Rotterdam Postbus 8566 3009 AN Rotterdam Nederland T: +31 (0) 10 253 7000 D: +31(0) 70 37 56627 E: math.de.groot(a)logica.com <mailto:math.de.groot@logica.com> www.logica.com <http://www.logica.com/> Logica Nederland B.V. Registered office in Amstelveen, The Netherlands Registration Number Chamber of Commerce: 33136004 This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

15 years, 8 months

2
2
0 / 0

[Fedora-directory-users] Limiting Directory Manager (nsslapd-rootdn) by source host (e.g. 127.0.0.1)?

by Aleksander Adamowski

Hi! The Direcroty Manager account (the one whose DN is specified in dse.ldif as nsslapd-rootdn) is a dangerously privileged account. Access control does not apply to this user and compromising its DN and password gives full control over the directory server. Therefore, it would be desirable to limit this user's bind access based on some additional criteria, in addition to the knowledge of the password. Limits based on the source host (e.g. localhost) and time of day (e.g. only work hours) would be very useful. Is there a way to limit Directory Manager binds based on those criteria in Fedora Directory Server? Note that in OpenLDAP this is possible using the following ACL: access to dn.base="cn=Manager,o=Example" by peername.regex=127\.0\.0\.1 auth by users none by anonymous none This ACL however requires creating a concrete LDAP entry that corresponds to rootdn, setting a userPassword in taht entry, and leaving the rootpw in OpenLDAP configuration undefined. This way the concrete userPassword is used when binding and is subject to that ACL which only allows access from connections that origin from 127.0.0.1. More details in this post on OpenLDAP mailing list: http://www.openldap.org/lists/openldap-software/200711/msg00342.html -- Best Regards, Aleksander Adamowski GG#: 274614 ICQ UIN: 19780575 http://olo.org.pl

15 years, 8 months

2
2
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users August 2008