December 2009 - 389-users - Fedora Mailing-Lists

by Alan McKay

Hey folks, The HOWTO refers to a script that is at the end of a dead link http://directory.fedoraproject.org/wiki/Howto:MultiMasterReplication And the Red Hat docs tell me to do something that causes an error. http://www.redhat.com/docs/manuals/dir-server/8.1/admin/Creating_the_Supp... The final entry should resemble Example 8.1, “Example Supplier Bind DN Entry”. dn: cn=replication manager,cn=config objectClass: inetorgperson objectClass: person objectClass: top cn: replication manager sn: RM userPassword: password passwordExpirationTime: 20380119031407Z [root@sandbox2 ~]# /etc/init.d/dirsrv start Starting dirsrv: sandbox2...[03/Dec/2009:16:31:30 -0500] - Entry "cn=replication manager,cn=config " has unknown object class "inetorgperson " (remove the trailing space) [03/Dec/2009:16:31:30 -0500] - Entry "cn=replication manager,cn=config " has unknown object class "person " (remove the trailing space) [03/Dec/2009:16:31:30 -0500] - Entry "cn=replication manager,cn=config " has unknown object class "top " (remove the trailing space) [ OK ] And clearly I do not know enough about LDAP at this point to know what the heck I'm doing here :-) Both of my servers are set up with custom install but mostly defaults. Help me Obi-Wan, you are my only hope :-) BTW, I did order the O'Reilly LDAP book that everyone recommends - it shipped today. -- “Don't eat anything you've ever seen advertised on TV” - Michael Pollan, author of "In Defense of Food"

14 years

4
22
0 / 0

# of master-master servers - do I need 4?

by Alan McKay

Hey folks, I keep seeing reference to 4 servers in all the docs. Is that a magic # of some sort? i.e. Do I need to have 4? Or can I have 2 or 3? What I want to do is this : - get main server set up here in the office - get backup set up in office - get another set up at remote site, on other end of VPN - remove backup in office So basically - have 2, then 3, then 2 again. Seems reasonable to me, but what do I know? I want to have the office backup just for redundancy because it could be a few months before I can get other things in place to have this going at the remote site. But I really want to roll out ASAP in the office now that I have the basics going (minus replication) thanks, -Alan -- “Don't eat anything you've ever seen advertised on TV” - Michael Pollan, author of "In Defense of Food"

14 years

2
1
0 / 0

CoS imports slow

by Edward "koko" Konetzko

I have a set of CoS objects I am importing in and their add times are extremely slow about 1 a second. There are about 500k objects in the directory currently and its broken down in a hierarchical format. A simple ASCII drawing would be. ou=top | - ou=First | + ou=Second | + cn=Final This is representation of the data but for ease of explanation this should work. There are lots of "First" object and they have the possibility of lots of "second" objects. Its the also the same for "Second" object they could have a lot of "Final" objects. The idea is to use CoS at the First and Second level to reduce the amount look ups and redundant data as final objects need some info from the second objects and first objects. Hopefully I explained that in a way it is easy to understand. My question is are CoS objects not supposed to be used this way? Also are lots of CoS objects used in a hierarchical tree this way bad? Is there a way to make these imports faster? And last am I just doing something completely wrong and there is a better way that I should work to my end goal. Thanks Edward

14 years

2
4
0 / 0

allowing only certain users to log into Linux boxen

by Alan McKay

Hey folks, I finally have this thing running - and I love it so far! I have basic Linux login working, as well as Apache auth. Those are my 2 primary concerns so I think I'm ready to start to roll this bad boy out. And one password to unite them all!!! Bwa, ha, ha, ha! Anyway, I digress :-) I checked in here http://directory.fedoraproject.org/wiki/Documentation#Howtos and do not see a recipe for what I want to do. However, when I read through the Red Hat guides it looks to me like this is possible. I'm just not sure how to do it. I want to have a Group A and Server X, and a rule that says "Only people from Group A can log into Server X". And of course the intent is that who is in Group A could change on a day to day basis (I'm thinking - access to our production environment) Where can I find a recipe for that? thanks! -Alan -- “Don't eat anything you've ever seen advertised on TV” - Michael Pollan, author of "In Defense of Food"

14 years

3
3
0 / 0

i know it is a wiki, but ...

by Alan McKay

... I'm going to ask anyway. I've got an internal wiki page in my company right now with details on how I've set up our new Centos-DS server. There is nothing like this currently on your wiki - short and sweet explanation that will probably work for 90%+ of small organisations like mine. I'd like to stick it in your wiki someplace too, but would like your permission as well as a suggestion on where. Maybe as a HOWTO? Cookie-cutter for SMB? -- “Don't eat anything you've ever seen advertised on TV” - Michael Pollan, author of "In Defense of Food"

14 years

2
2
0 / 0

Directory Server Gateway (was: change PW?)

by Alan McKay

OK, I'm going to just shoot this out to the list as I go along and discover things - hope follks don't mind. But it is an easy if clumsy way to document this for the next person to come along. If anyone can recommend a doc that will get me through this on Centos, please do On Centos I've found /usr/share/dirsrv/html as well as /usr/share/dirsrv/data I look in the latter and there seem to be interesting things that I'd like to show up in http://sandbox1:9830/ But they do not. BTW, when I go to that URL it immediately forwards me to : http://sandbox1:9830/dist/download If I cd to the HTML dir above and then do : [root@sandbox1 html]# ln -s ../data/admserv_dsgw.html . And refresh my web browser, I now get a new item showing up in that page. Directory Server Gateway Search for and edit directory entries. This appears to be what I am looking for, but when I cilck it I go to a location which does not exist : http://sandbox1:9830/clients/dsgw/bin/lang?context=dsgw Doing the following also puts more entries on the web page, but none of the links work [root@sandbox1 html]# ln -s ../data/admserv_orgchart.html . [root@sandbox1 html]# ln -s ../data/admserv_phonebook.html . On Thu, Dec 3, 2009 at 11:30 AM, Alan McKay <alan.mckay(a)gmail.com> wrote: > Hmmm, it seems that Centos-DS does not have this : > > http://directory.fedoraproject.org/wiki/WebApps_Install > > # Install the Directory Server Gateway package. > yum install fedora-ds-dsgw > # Run the setup-ds-dsgw script to set up the default instances of the > Directory Server Gateway, Directory Express, Org Chart, and Admin > Express. The setup-ds-dsgw script is in the /usr/sbin directory. > setup-ds-dsgw > > > [root@sandbox1 dirsrv]# yum search centos-ds > Loaded plugins: fastestmirror, priorities > Loading mirror speeds from cached hostfile > * addons: mirror.csclub.uwaterloo.ca > * extras: mirror.csclub.uwaterloo.ca > ============================================================== > Matched: centos-ds > =============================================================== > centos-ds.x86_64 : CentOS Directory, Administration, and Console Suite > centos-ds-admin.x86_64 : CentOS Administration Server (admin) > centos-ds-base.x86_64 : CentOS Directory Server (base) > centos-ds-base-devel.x86_64 : Development libraries for CentOS Directory Server > centos-ds-console.noarch : CentOS Directory Server Management Console > > Although it does have a directory with the HTML and other files : > [root@sandbox1 dirsrv]# pwd > /usr/share/dirsrv > > This is not what I see when I got to http://myserver:9830/ > > I'll keep poking around, but am sending this in case anyone out there > already knows how to do this on Centos. > > I'll start over on the Red Hat docs now ... > > cheers, > -Alan > > -- > “Don't eat anything you've ever seen advertised on TV” > - Michael Pollan, author of "In Defense of Food" > -- “Don't eat anything you've ever seen advertised on TV” - Michael Pollan, author of "In Defense of Food"

14 years

2
4
0 / 0

how does user change PW?

by Alan McKay

OK, I've got auth figured out for Linux login. This is a good thing. A very good thing! Now, if a user does "passwd" on the Linux box, I see that it updates their LDAP password. Another very good thing! But I'm going to have non-Linux users too. I'm not adventurous enough at this point to set up a WIndows NT domain or anything like that for the windows users, so I'll just do local-login for them at the moment. But they will still have to go to websites and such which ask them to authenticate. I don't yet have apache LDAP auth working, but I'm sure it will prove to be reasonably easy. Once I get that done, I'll need a way for these users to change the passwords. In a pinch I guess I could ask them to download putty and SSH into a Linux box. But that just seems ugly. Is there a good web-based plugin for this that I can just grab "off-the-shelf" without having to roll my own? -- “Don't eat anything you've ever seen advertised on TV” - Michael Pollan, author of "In Defense of Food"

14 years

3
7
0 / 0

Is there Linked Attributes configuration and usage documentation available?

by Sean Brady

Hello All, I have 389 up and running, and had some questions on Linked Attributes. I found this http://directory.fedoraproject.org/wiki/Linked_Attributes_Design but that is the extent of the documentation that I have found. Does anyone know of any additional documentation that you can point me to? I am unclear on exactly how to configure Linked Attributes properly, and how to use them. Specifically, which ldif file would I need to modify to create a linked attribute? Would that be dse.ldif, or one of the ldif's in the schema sub-folder (/etc/dirsrv/slapd-<instance_name>/schema)? What else would I need to know to configure a linked attribute? What do I need to know about it's usage? Once I have the details I can post some documentation back to the community- there is nothing in the RedHat Directory Server on this plugin as of yet that I have seen. I don't think that this can be done through the GUI at this time... Thanks in advance for the community's help. SB

14 years

2
3
0 / 0

Re: [389-users] OK, so how do I use this thing?

by Prashanth Sundaram

On 12/1/09 6:40 PM, "Alan McKay" <alan.mckay(a)gmail.com> wrote: >> Take a look at documentation here: >> http://directory.fedoraproject.org/wiki/Documentation > > I'll go through that again, thanks. I went through it a week ago but > did not find anything too useful, but I'm further along now and a week > is a long time when you are just starting out. It will take time to learn LDAP as it is a huge topic. Here's a book I would recommend: LDAP System Administration by Gerald Carter(O'Reilly Publication) > >> To authenticate linux users, you will have to configure you client hosts >> to ldap server by configuring /etc/ldap.conf >> Which can be done using GUI/cmdline via authconfig-tui/authconfig --help > > Aha, this gives me a tidbit of what I'm looking for! Enough to > probably find some good results with man pages and google! Thanks! Google for "How to setup LDAP authentication" and there is ton of info. > >> Look at Administration Guide >> http://www.redhat.com/docs/manuals/dir-server/8.1/admin/index.html > > This I spent most of my day on today and as mentioned there is nothing > really there for me on how to get cilents working against this. Sure, > lots of great detail on setting up every aspect of the server and > stuff I'll have to come back to (e.g. multi-master replication, > password expiry and such), but not a single thing in the whole guide > on "here is how you get client XYZ to work with LDAP" Again, setting up simple (basic) LDAP authentication is configuring ldap.conf and nsswitch.conf . But it is not sufficient, you have to make changes here and there to meet all your requirements > >> Do they need local accounts too? >> Local accounts are needed for root and other service accounts > > Cool > >> Local disks? >> Not sure what this means > > If you do not have a local account, then where does your home dir come > from? Must come from a network disk, no? But what if I want local > disk, but authenticate through LDAP? Can I do that too? And if there > is no local user, how do I chown files on the drive to that user? Having a homer Directory is irrespective of where the account lives. You definitely need a local disk where you OS is installed, unless you are using Virtual machine and SAN storage. You can set PAM Module to create homedir on login and change to it.(authconfig --enablemkhomedir) http://www.mail-archive.com/seawolf-list@redhat.com/msg03331.html > >> What about website? Wikis? All currently using htpasswd. How do I >> convert those? >> For websites, you can refer to Apache authentication via LDAP > > Will do - thanks! -Prashanth

14 years

2
3
0 / 0

About the 389 ds install error on CentOS i686

by 馬小布

Hi,all: Today I want to install the 389 directory server ,but I don't connect the network,so I can't install it via yum command . So i install it via install some rpm packages of the 389-ds from the" http://directory.fedoraproject.org/yum/dirsrv-testing/fedora/6/i386/RPMS/" and run the "rpm -ivh xxx" in my terminal . But when I run "setup-ds-admin.pl" ,the screen displays the following error: [root@foo bin]# setup-ds-admin.pl Can't locate Mozilla/LDAP/Conn.pm in @INC (@INC contains: /usr/lib/dirsrv/perl /usr/local/lib/perl5/site_ perl/5.11.1/i686-linux /usr/local/lib/perl5/site_perl/5.11.1 /usr/local/lib/perl5/5.11.1/i686-linux /usr/local/lib/perl5/5.11.1 .) at /usr/lib/dirsrv/perl/Setup.pm line 62. BEGIN failed--compilation aborted at /usr/lib/dirsrv/perl/Setup.pm line 62. Compilation failed in require at /usr/sbin/setup-ds-admin.pl line 24. BEGIN failed--compilation aborted at /usr/sbin/setup-ds-admin.pl line 24. Maybe is it the perl version error? BTM , my perl version is perl -5.11.1 I search the Internet for a long time , but have no useful information about it ~ Could someone help me ? Thanks in advance ~

14 years

3
5
0 / 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users December 2009