389-users February 2009

389-users@lists.fedoraproject.org

46 participants
45 discussions

[Fedora-directory-users] password policy help
by Aaron Mills 24 Feb '09

24 Feb '09

Hi all, I¹m looking for some direction with regard to implementing password policy in unix authentication. I followed the ppolicy instructions here: http://directory.fedoraproject.org/wiki/Howto:PAM In the UI, I¹ve enabled password policy in the database, then on the relevant subtree. I¹ve enabled password aging, history, and alphanumeric standards. But it looks like Fedora DS is still letting me change my password to anything, and doesn¹t maintain a history. Clearly I¹m missing something. I¹ve checked out google and some of the list history to no avail. Is there another doc I should take a look at, or has anyone run into this? Thanks, -Aaron -- Aaron Mills Systems Administrator Return Path http://www.returnpath.net

2 2

[Fedora-directory-users] fdstools.pm - perl module for managing replication and encryption setup
by Ryan Braun [ADS] 24 Feb '09

24 Feb '09

Hey guys, I had been working on several scripts for fds to configure and monitor replication and encryption across several servers. Well I decided to move the guts of those scripts into a perl module called fdstools. What started as a NET::ldap/perl learning experience, evolved into this module. It's not near feature complete, but does work for setting up replication and configuring and enabling TLS/SSL on fds. And it's my first attempt at a perl module, so take it easy on me :) The TLS/SSL setup is just basically a glorified wrapper for certutil and pk12util, perl-ified. The replication setup is all done using ldap calls to the appropriate servers. There are 3 config files (2 that you need to edit). Default locations for all 3 are /etc/fdstools/ fdstools.conf - system wide defaults, file locations etc. repman.conf - root DN specifics options for replication serial - file to keep track of certs handed out, serial numbers on certs etc. (generally don't touch this file, you could break the serial number sequence when creating certs) Just put the fdstools.pm module and the 2 helper scripts (repman.pl and setup_ssl) in the same directory. You can do a perldoc fdstools from the same directory as the module to get some rudimentary docs. I like to think I'm comment heavy, so have a look at the code aswell for any details. My perldoc-fu is lacking. There are alot of options for the setup_ssl, so try running with -h to get help and -e for a list of examples. Hopefully it doesn't break any systems, but if it does make sure you have backups of your security databases and directory server aswell as dse.ldif. I used it to create a 2 server mmr setup with UserRoot and NetscapeRoot being replicated over SSL. If you want to replicate NetscapeRoot, you need to create the root suffex on the target server first. I've included an ldif to help with that. so just run ldapadd -x -h TARGETSERVER -D "cn=directory manager" -W -f ldif/ns.ldif Then run the repman.pl script but tell it to use an alternate config like so. my $blah = fdstools->new( prompt_bindpw => "1", config => /etc/fdstools/repman-ns.conf" ); Remember, if you are replicating NetscapeRoot, you need to install the second server using setup-ds.pl FIRST, then setup the replication agreements (and encryption if you want the agreement to be encrypted), initialize them, then run register-ds-admin.pl. Any questions/comments/complaints please let me know. md5sum fdstools.tar.bz2 39b18c773578d58ac75be65c3efaca48 fdstools.tar.bz2 Ryan Braun Informatics Operations Aviation and Defence Services Division Chief Information Officer Branch, Environment Canada CIV: (204) 833-2500x2625 CSN: 257-2625 FAX: (204) 833-2524 E-Mail: Ryan.Braun(a)ec.gc.ca

1 0

[Fedora-directory-users] Fedora DS/RH DS with Apache Jetspeed 2 Portal
by Lebing Xie 24 Feb '09

24 Feb '09

Hi, all We have Redhat Directory Server S V7.1 SP3 installed and planning to build a portal (based on jetspeed 2) which rely on this LDAP server. I checked jetspeed2 web page, only following LADP server are officially supported: - Apache DS <http://directory.apache.org/> - Open LDAP <http://www.openldap.org/> - Domino <http://www-306.ibm.com/software/lotus/> - Sun DS<http://www.sun.com/software/products/directory_srvr_ee/dir_srvr/index.xml> Anyone has the experience, whether our RHDS installation can work with jetspeed2, thanks in advance. Lebing

2 1

[Fedora-directory-users] OpenLDAP->FDS Migration
by Thorsten Scherf 24 Feb '09

24 Feb '09

Wondering if somebody recently did a migration from OpenLDAP to FDS and is willing to share experiences. Happy Day. Thorsten -- "Eternity is a very long time, especially towards the end." — Stephen Hawking

4 4

[Fedora-directory-users] Re:unique uid problem
by Eric 24 Feb '09

24 Feb '09

there is a radius server uses fedora-ds for authenticating. all users name are in fedora_ds. One attribute of users is uid, which I want to be unique. essage: 1 > Date: Sun, 22 Feb 2009 21:08:56 -0500 > From: "John A. Sullivan III" <jsullivan(a)opensourcedevel.com> > Subject: Re: [Fedora-directory-users] unique uid problem > To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> > Message-ID: > <1235354936.6456.2.camel(a)jaspav.missionsit.net.missionsit.net> > Content-Type: text/plain > > On Sun, 2009-02-22 at 12:18 +0330, Eric wrote: > > Hi, > > when I want to make a new user in fedora-ds using console, can't set > > the value that exists before for uid but when using command line for > > ldapadd,it adds replicated uid valiue. how should I set the command > > to check all the directory server for not adding replicated valiue for > > uid? > <snip> > I'm not sure I understand the question. Is the unique attribute plugin > what you are looking for? - John > -- > John A. Sullivan III > Open Source Development Corporation > > Street Preacher: Are you SAVED?????!!!!!! > Educated Skeptic: Saved from WHAT?????!!!!!! > Educated Believer: From our selfishness that hurts the ones we love > and condemns us to an eternity of hurting each other. > http://www.spiritualoutreach.com > Christianity that makes sense > > > > ------------------------------ > > Message: 2 > Date: Mon, 23 Feb 2009 12:08:01 +0100 > From: Roberto Polli <rpolli(a)babel.it> > Subject: Re: [Fedora-directory-users] unique uid problem > To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> > Message-ID: <200902231208.01500.rpolli(a)babel.it> > Content-Type: text/plain; charset="iso-8859-15" > > On Monday 23 February 2009 03:08:56 John A. Sullivan III wrote: > > > when I want to make a new user in fedora-ds using console, can't set > > > the value that exists before for uid but when using command line for > > > ldapadd,it adds replicated uid valiue. > which uid? > nsUniqueId or EntryUUID > > Peace, R. > -- > >

2 1

[Fedora-directory-users] FDS ldapi autobind problem
by Ivanov Andrey (M.) 23 Feb '09

23 Feb '09

Hi, When i'm trying to connect to FDS (built from today's cvs) by ldapi as a root (on RHEL5.2) i have the following error message : ldapsearch -Y EXTERNAL -H ldapi://%2fLocal%2fdirsrv%2fvar%2frun%2fslapd-dmz.socket -b "dc=id,dc=polytechnique,dc=edu" uid=toto SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Inappropriate authentication (48) additional info: SASL EXTERNAL bind requires an SSL connection the access log : [23/Feb/2009:15:22:38 +0100] conn=1 fd=128 slot=128 connection from localhost to localhost [23/Feb/2009:15:22:38 +0100] conn=1 op=0 BIND dn="" method=sasl version=3 mech=EXTERNAL [23/Feb/2009:15:22:38 +0100] conn=1 op=0 RESULT err=48 tag=97 nentries=0 etime=0.003000 [23/Feb/2009:15:22:38 +0100] conn=1 op=-1 fd=128 closed - B1 the dse.ldif lines: nsslapd-ldapifilepath: /Local/dirsrv/var/run/slapd-dmz.socket nsslapd-ldapilisten: on nsslapd-ldapiautobind: on nsslapd-ldapimaprootdn: cn=Directory Manager Simple bind is ok (ldapsearch -x -H ldapi://%2fLocal%2fdirsrv%2fvar%2frun%2fslapd-dmz.socket -b "dc=id,dc=polytechnique,dc=edu" uid=toto) access log : [23/Feb/2009:15:26:11 +0100] conn=3 fd=128 slot=128 connection from localhost to localhost [23/Feb/2009:15:26:12 +0100] conn=3 op=0 BIND dn="" method=128 version=3 [23/Feb/2009:15:26:12 +0100] conn=3 op=0 RESULT err=0 tag=97 nentries=0 etime=0.001000 dn="" [23/Feb/2009:15:26:12 +0100] conn=3 op=1 SRCH base="dc=id,dc=polytechnique,dc=edu" scope=2 filter="(uid=toto)" attrs=ALL [23/Feb/2009:15:26:12 +0100] conn=3 op=1 RESULT err=0 tag=101 nentries=1 etime=0.003000 [23/Feb/2009:15:26:12 +0100] conn=3 op=2 UNBIND [23/Feb/2009:15:26:12 +0100] conn=3 op=2 fd=128 closed - U1 What am i doing wrong in the first case (with EXTERNAL mechanism)? :) Thank you!

1 0

[Fedora-directory-users] unique uid problem
by Eric 23 Feb '09

23 Feb '09

Hi, when I want to make a new user in fedora-ds using console, can't set the value that exists before for uid but when using command line for ldapadd,it adds replicated uid valiue. how should I set the command to check all the directory server for not adding replicated valiue for uid?

3 2

[Fedora-directory-users] schema replication
by Jan-Frode Myklebust 20 Feb '09

20 Feb '09

We just had a bit of a scary situation.. We have two multimaster replicating directory servers (server1 and server2), with a few schema modifications residing in 99user.ldif. dc=example, dc=com: server1 <---> server2 Then we wanted to make these two directory servers be consumers of another directory on server3, which has another set of schema modifications in 99user.ldif. The result was that server1 and server2 dropped all their modifications to 99user.ldif, and started using a 99.ldif identical to server3. Resulting in lots of problems with unknown object classes in their original directory tree.. o=ISP, o=example, c=NO server3 (single master) / \ server1 server2 (consumers) Which makes me wonder what the correct way of handling local schema modifications are. Should we be creating our own 99my_classes.ldif, instead of storing them in 99user.ldif ? -jf

3 3

[Fedora-directory-users] Installing 2 MMR servers, and the aci's don't match after everything is setup
by Ryan Braun [ADS] 19 Feb '09

19 Feb '09

Hey guys, I'm setting up 2 mmr servers, and am wondering why the aci's on both machines don't end up being the same. All of the replication and configuring of the servers has been done in perl and NOT the console. Here is the process I used when setting up the servers. I'm using custom built packages on etch. ii fedora-ds-admin 1.1.6 Fedora Administration Server (admin) ii fedora-ds-admin-console 1.1.2 Fedora Admin Server Management Console ii fedora-ds-base 1.1.3 Fedora Directory Server (base) ii fedora-ds-console 1.1.2 Fedora Directory Server Management Console ii mozldap 6.0.5 Mozilla LDAP C SDK ii mozldap-dev 6.0.5 Mozilla LDAP C SDK ii mozldap-tools 6.0.5 Mozilla LDAP C SDK ii ldapsdk 4.17-4 Enables applications to manage information s ii perldap 1.5.2 PerLDAP is a set of modules written in Perl ii libadminutil 1.1.7 Utility library for directory server adminis ii libsvrcore 4.0.4 Secure PIN handling using NSS crypto ii libapache2-mod-nss 1.0.8 mod_nss is an SSL provider derived from the 1. install mmr1 server using setup-ds-admin.pl 2. install mmr2 server using setup-ds.pl 3. configure ssl/tls on each machine and confirm ldapsearchs etc are encrypted. 4. create root suffix o=netscaperoot on mmr2. 5. enable mmr replication of userroot on both mmr1 and mmr2 6. init UserRoot replication agreement on mmr1. 7. enable mmr replication of o=netscaperoot on both mmr1 and mmr2. 8. init NetscapeRoot replication agreement on mmr1. 9. run register-ds-admin.pl on mmr2 At this point, I can confirm that encryption is working over both machines, all replication agreements are over SSL and are working as expected. admin server is running on both machines, and both servers are accessible from each admin-server instance. So I opened up the console, and opened up a session to each server and thats when I noticed the different amount of aci's on each server on mmr1. o=NetscapeRoot has 5 acis' UserRoot has 6 cn=schema has 4 cn=monitor has 1 cn=config has 3 on mmr2. o=NetscapeRoot has 5 acis' UserRoot has 6 cn=schema has 1 cn=monitor has 1 cn=config has 0 So I'm wondering, if mmr2 server is missing those aci's because of the different install procedure of running setup-ds.pl first, then register-ds-admin.pl Here are the aci's in question mmr1 - cn=schema # schema dn: cn=schema aci: (target="ldap:///cn=schema")(targetattr !="aci")(version 3.0;acl "anonymo us, no acis"; allow (read, search, compare) userdn = "ldap:///anyone";) aci: (targetattr="*")(version 3.0; acl "Configuration Administrators Group"; a llow (all) groupdn="ldap:///cn=Configuration Administrators, ou=Groups, ou=To pologyManagement, o=NetscapeRoot";) aci: (targetattr="*")(version 3.0; acl "Configuration Administrator"; allow (a ll) userdn="ldap:///uid=admin,ou=Administrators, ou=TopologyManagement, o=Net scapeRoot";) aci: (targetattr = "*")(version 3.0; acl "SIE Group"; allow (all) groupdn = "l dap:///cn=slapd-xxxdmns0, cn=Fedora Directory Server, cn=Server Group, cn=xxx dmns0.xxx.xx.xx.xx, ou=xxx.xx.xx.ca, o=NetscapeRoot";) mmr2 - cn=schema # schema dn: cn=schema aci: (target="ldap:///cn=schema")(targetattr !="aci")(version 3.0;acl "anonymo us, no acis"; allow (read, search, compare) userdn = "ldap:///anyone";) mmr1 - cn=config dn: cn=config aci: (targetattr="*")(version 3.0; acl "Configuration Administrators Group"; a llow (all) groupdn="ldap:///cn=Configuration Administrators, ou=Groups, ou=To pologyManagement, o=NetscapeRoot";) aci: (targetattr="*")(version 3.0; acl "Configuration Administrator"; allow (a ll) userdn="ldap:///uid=admin, ou=Administrators, ou=TopologyManagement, o=Ne tscapeRoot";) aci: (targetattr = "*")(version 3.0; acl "SIE Group"; allow (all) groupdn = "l dap:///cn=slapd-xxxdmns0, cn=Fedora Directory Server, cn=Server Group, cn=xxx dmns0.xxx.xx.xx.ca, ou=xxx.xx.xx.ca, o=NetscapeRoot";) mmr2 - cn=config none.

2 2

[Fedora-directory-users] Problems with multimaster replication configuration
by Rocio Quirantes 19 Feb '09

19 Feb '09

Hello, I'm trying to configure multimaster replication with two servers, and I get a permission error when the supplier tries to send the copie to the consumer. This is the error I get: supplier: ldap1 -> NSMMReplicationPlugin - agmt="cn=ldap1" (ldap2:636): Unable to acquire replica: permission denied. The bind dn "cn=replication manager,cn=config" does not have permission to supply replication updates to the replica. Will retry later. consumer: ldap2 -> NSMMReplicationPlugin - conn=245 op=3 replica="dc=example,dc=es": Unable to acquire replica: error: permission denied The other wa: supplier: ldap2 -> NSMMReplicationPlugin - agmt="cn=ldap2" (ldap1:636): Unable to acquire replica: permission denied. The bind dn "cn=replication manager,cn=config" does not have permission to supply replication updates to the replica. Will retry later. consumer: ldap1 -> NSMMReplicationPlugin - conn=32 op=3 replica="dc=example,dc=es": Unable to acquire replica: error: permission denied I have follow the configuration manual from red hat to configure the multimaster from: http://www.redhat.com/docs/manuals/dir-server/ag/replicat.htm#74262 This is my configuration: dn: cn=replication manager,cn=config objectClass: person objectClass: top cn: replication manager sn: RM userPassword: {SSHA} XXX passwordExpirationTime: 20380119031407Z modifiersName: uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoo t modifyTimestamp: 20090217141706Z dn: cn=legacy consumer,cn=replication,cn=config objectClass: top objectClass: extensibleObject cn: legacy consumer nsslapd-legacy-updatedn: cn=replication manager,cn=config creatorsName: uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot modifiersName: uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoo t createTimestamp: 20090216083802Z modifyTimestamp: 20090216100926Z nsslapd-legacy-updatepw: {SHA} xxx dn: cn=replica,cn="dc=example,dc=es",cn=mapping tree, cn=config objectClass: nsDS5Replica objectClass: top nsDS5ReplicaRoot: dc=example,dc=es nsDS5ReplicaType: 3 nsDS5Flags: 1 nsDS5ReplicaId: 1 nsds5ReplicaPurgeDelay: 604800 cn: replica creatorsName: uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot modifiersName: cn=Multimaster Replication Plugin,cn=plugins,cn=config createTimestamp: 20090217095448Z modifyTimestamp: 20090218092048Z nsState:: AQAAANnSm0kAAAAAAAAAAAEAAAA= nsDS5ReplicaName: 000df382-1dd211b2-a7f6fad4-efd80000 nsDS5ReplicaBindDN: cn=replication manager,cn=config numSubordinates: 1 dn: cn=ldap1, cn=replica, cn="dc=example,dc=es", cn=mapping tree, cn=config objectClass: top objectClass: nsDS5ReplicationAgreement description: Replicacion multimaster entre ldap1 y ldap2 cn: ldap1 nsDS5ReplicaRoot: dc=example,dc=es nsDS5ReplicaHost: ldap2.example.es nsDS5ReplicaPort: 636 nsDS5ReplicaBindDN: cn=replication manager,cn=config nsDS5ReplicaTransportInfo: SSL nsDS5ReplicaBindMethod: SIMPLE nsDS5ReplicaCredentials: {DES} xxxx creatorsName: uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot modifiersName: uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoo t createTimestamp: 20090217100103Z modifyTimestamp: 20090218103445Z dn: cn=ldap2, cn=replica, cn="dc=example,dc=es", cn=mapping tree, cn=config objectClass: top objectClass: nsDS5ReplicationAgreement description: Replicacion multimaster entre ldap2 y ldap1 cn: ldap1 nsDS5ReplicaRoot: dc=example,dc=es nsDS5ReplicaHost: ldap1.example.es nsDS5ReplicaPort: 636 nsDS5ReplicaBindDN: cn=replication manager,cn=config nsDS5ReplicaTransportInfo: SSL nsDS5ReplicaBindMethod: SIMPLE nsDS5ReplicaCredentials: {DES} xxxx creatorsName: uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot modifiersName: uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot createTimestamp: 20090217100103Z modifyTimestamp: 20090218103445Z I can see where the error is, I hope you can help me Thank you -- Rocio Quirantes Rodal Área de Seguridad Informática Centro Informático Científico de Andalucía (CICA) Avda. Reina Mercedes s/n - 41012 - Sevilla (Spain) Tfno.: +34 955 056 648 / +34 955 056 600 / FAX: +34 955 056 650 Consejería de Innovación, Ciencia y Empresa Junta de Andalucía -------------------------------------------------- Este mensaje esta firmado digitalmente. Para poder reconocer la firma desde su cliente debera tener instalado el certificado raiz de la CA del CICA en el mismo. Puede descargarlo desde: http://pki.cica.es/cacert/ --------------------------------------------------

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users February 2009