389-users September 2009

389-users@lists.fedoraproject.org

33 participants
35 discussions

Re: [389-users] PAM PTA partially working
by Prashanth Sundaram 22 Sep '09

22 Sep '09

The account in /etc/passwd.. Prashanth Sundaram wrote: > > Yes, it works when there is a matching local user account. do you mean an account in /etc/passwd? or an account in LDAP? > ------------------------------------------------------------------------ > > -- > 389 users mailing list > 389-users redhat com > https://www.redhat.com/mailman/listinfo/fedora-directory-users >

3 4

Re: [389-users] PAM PTA partially working
by Prashanth Sundaram 22 Sep '09

22 Sep '09

Yes, it works when there is a matching local user account.

2 1

PAM PTA partially working
by Prashanth Sundaram 22 Sep '09

22 Sep '09

Hello, PS: I am sorry to paste such big error log. I spend some time tweaking around the PAM PTA plug-in, so i can authenticate users against Active Directory. I configured the PAM PTA plug-in, krb5.conf, /etc/pam.d/ldapserver for kerberos authentication against AD. So to begin with I had only one user in 389-ds which is same as the local account name(uid=psundaram) on the DS. With all the configuration set, I was able to get the ldapsearch working for this user. Even when I change the password on the AD side, I can use the new password to show ldif results. [root@centos-lin ~]# ldapsearch -h centos-lin.fedorads.net -b "dc=fedorads,dc=net" -D "uid=psundaram,ou=People,dc=fedorads,dc=net" -W -x [root@centos-lin ~]# less/var/log/dirsrv/slapd-centos-lin/errors/ [21/Sep/2009:18:08:30 -0400] NSACLPlugin - #### conn=2 op=1 binddn="" [21/Sep/2009:18:08:30 -0400] NSACLPlugin - conn=2 op=1 (main): Deny search on entry(cn=change-sie-password,cn=commands,cn=admin-s erv-centos-lin,cn=389 administration server,cn=server group,cn=centos-lin.fedorads.net,ou=fedorads.net,o=netscaperoot).attr(nsExe cRef) to anonymous: no aci matched the subject by aci(16): aciname= "SIE Group (centos-lin)", acidn="o=netscaperoot" [21/Sep/2009:22:13:44 -0400] NSACLPlugin - #### conn=3 op=1 binddn="uid=psundaram,ou=people,dc=fedorads,dc=net" [21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (main): Allow search on entry(dc=fedorads,dc=net).attr(objectClass) to uid =psundaram,ou=people,dc=fedorads,dc=net: allowed by aci(2): aciname= "Enable anonymous access", acidn="dc=fedorads,dc=net" [21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (main): Allow read on entry(dc=fedorads,dc=net).attr(objectClass) to uid=p sundaram,ou=people,dc=fedorads,dc=net: allowed by aci(2): aciname= "Enable anonymous access", acidn="dc=fedorads,dc=net" [21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (main): Allow read on entry(dc=fedorads,dc=net).attr(objectClass) to uid=p sundaram,ou=people,dc=fedorads,dc=net: cached allow by aci(2) [21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (main): Allow read on entry(dc=fedorads,dc=net).attr(dc) to uid=psundaram, ou=people,dc=fedorads,dc=net: cached allow by aci(2) [21/Sep/2009:22:13:44 -0400] NSACLPlugin - #### conn=3 op=1 binddn="uid=psundaram,ou=people,dc=fedorads,dc=net" [21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (main): Allow search on entry(cn=directory administrators,dc=fedorads,dc=n et).attr(objectClass) to uid=psundaram,ou=people,dc=fedorads,dc=net: cached context/parent allow [21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (on entry): Allow read on entry(cn=directory administrators,dc=fedorads,dc =net).attr(NULL) to uid=psundaram,ou=people,dc=fedorads,dc=net: cached context/parent allow [21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (on attr): Allow read on entry(cn=directory administrators,dc=fedorads,dc= net).attr(objectClass) to uid=psundaram,ou=people,dc=fedorads,dc=net: cached context/parent allow [21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (main): Allow read on entry(cn=directory administrators,dc=fedorads,dc=net ).attr(cn) to uid=psundaram,ou=people,dc=fedorads,dc=net: cached allow by aci(2) [21/Sep/2009:22:13:44 -0400] NSACLPlugin - #### conn=3 op=1 binddn="uid=psundaram,ou=people,dc=fedorads,dc=net" [21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (main): Allow search on entry(ou=groups,dc=fedorads,dc=net).attr(objectCla ss) to uid=psundaram,ou=people,dc=fedorads,dc=net: cached context/parent allow [21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (on entry): Allow read on entry(ou=groups,dc=fedorads,dc=net).attr(NULL) t o uid=psundaram,ou=people,dc=fedorads,dc=net: cached context/parent allow [21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (main): Allow read on entry(ou=groups,dc=fedorads,dc=net).attr(objectClass ) to uid=psundaram,ou=people,dc=fedorads,dc=net: cached allow by aci(2) But when I created another account, uid=tjordan which exists in AD as well (but does not have a local acount like above user) the authentication fails. [root@centos-lin ~]# ldapsearch -h centos-lin.fedorads.net -b "dc=fedorads,dc=net" -D "uid=tjordan,ou=People,dc=fedorads,dc=net" -W -x Enter LDAP Password: ldap_bind: Operations error (1) additional info: Unknown PAM error [Permission denied] for user id [tjordan], bind DN [uid=tjordan,ou=people,dc=fedorads,dc=net] less /var/log/dirsrv/slapd-centos-lin/errors [21/Sep/2009:22:36:48 -0400] pam_passthru-plugin - Error from PAM during pam_authenticate (6: Permission denied) [21/Sep/2009:22:36:48 -0400] pam_passthru-plugin - Unknown PAM error [Permission denied] for user id [tjordan], bind DN [uid=tjor dan,ou=people,dc=fedorads,dc=net] >From what I see, there is something related to anonymous bind, but I am not sure what that is. Can someone help me understand what the problem is and how can I fix, If you know? Here is my PAM PTA dn: cn=PAM Pass Through Auth,cn=plugins,cn=config cn: PAM Pass Through Auth nsslapd-pluginPath: libpam-passthru-plugin nsslapd-pluginInitfunc: pam_passthruauth_init nsslapd-pluginType: preoperation nsslapd-pluginEnabled: on nsslapd-pluginloadglobal: true nsslapd-plugin-depends-on-type: database pamMissingSuffix: ALLOW pamExcludeSuffix: cn=config pamExcludeSuffix: o=NetscapeRoot pamIDMapMethod: RDN pamIDAttr: notUsedWithRDNMethod pamFallback: FALSE pamSecure: FALSE pamService: ldapserver nsslapd-pluginId: pam_passthruauth nsslapd-pluginVersion: 1.2.2 nsslapd-pluginVendor: 389 Project nsslapd-pluginDescription: PAM pass through authentication plugin modifiersName: cn=directory manager modifyTimestamp: 20090921225438Z Thanks, Prashanth

2 1

Tunning
by Emmanuel BILLOT 21 Sep '09

21 Sep '09

Hi, I'm searching for a best practive documentation about tunning DB, like nsslapd-lookthroughlimit nsslapd-sizelimit Our DIT contains 20 000 entries, what parameters can we use and how for having a best configured dirsrv ? RG, -- ========================================== Emmanuel BILLOT IRD - Orléans Délégation aux Systèmes d'Information (DSI) tél : 02 38 49 95 88 ==========================================

3 2

SASL mapping question
by Prashanth Sundaram 21 Sep '09

21 Sep '09

Dear All, I have few questions related to SASL mapping in 389-ds. I am using Windows AD as kerberos server and here¹s the tree in both 389-ds and AD. In Active Directory: Users are located in different OU¹s like FullTime, PartTime, Contractors etc. example: ou=FullTime, OU=Users, OU=CompanyName,DC=ADDomain,DC=com In 389-DS Users are located only in one OU example: ou=People,DC=ldapdomain,DC=com <<<<<<<<Questions>>>>>>> 1. Is my SASL mapping correct? nsSaslMapRegexString: \(.*\)(a)ldapdomain.com nsSaslFilterTemplate: (objectclass=user) nsSaslBaseDNTemplate: sAMAccountName=\1,ou=Users,ou=CompanyName,dc=ADDomain,dc=com 2. Since users are in sub-ou in ADDomain, do I have to create separate SASL mapping for each out? If, so then how will the 389-ds know if the user is in PartTime OU and not in FullTime OU. 3. How many SASL mapping should I have? By default I see 4 listed, should I remove all others? I have read the RFCs which correspond but not sure why I need them. Thanks, Prashanth

1 0

389-ds-1.2.jar console error
by Eric 21 Sep '09

21 Sep '09

Hi I had fedora-ds-1.1.3 installed on a vps centos 5.3. Its console was opened from another centos 5. I have upgraded system centos 5 and know it opens console with this error: failed to install a local copy of 389-ds-1.2.jar. I didn't change anything on my server. What happend?

1 0

Problems with password syntax checking: invalid password syntax
by Kenneth Holter 18 Sep '09

18 Sep '09

Hi all. I'm running Red Hat Directory Server 8.1.0, and are having some problems with password syntax checking. When I don't enable the syntax checking, everything works fine. But when I enable it it seems to discard even pretty strong passwords. In the example belov I've configured password syntax checking like this: - Password minimum length: 8 - Minimum required character categories: 1 - Minimum token length: 3 (btw, don't know why I need to set this) The new password I try to change to has two digits, four lower case letters, one uppercase letter, and one special character. So it should be far more complicated that the above settings call for. This is the output: #### Output start [root@server ~]# ssh kenneth@localhost kenneth@localhost's password: You are required to change your LDAP password immediately. Last login: Fri Sep 18 16:37:26 2009 from localhost.localdomain Welcome to the server! WARNING: Your password has expired. You must change your password now and login again! Changing password for user kenneth. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Constraint violation invalid password syntax - passwords with storage scheme are not allowed passwd: Permission denied Connection to localhost closed. ##### Output end So basically what I'm wondering about is exactly which constraint I'm violating. In other words, what does the "password with storage scheme are not allowed" tell me? Best regards, Kenneth Holter

2 1

Error in passsync service : "No entries yet"
by Hugo Etievant 16 Sep '09

16 Sep '09

hello, My actual architecture : - two 389DS server (version 1.1.3) on Fedora8 32bits - two Active Directory on Windows Server 2003 Standard edition 32bits domain controler (AD servers are both synchronized with "Active Directory Intrasite Replication") In january 2009, multimaster replication protocol was enabled between two 389DS, and a passync service installed in only one AD with one replication agreement between the AD server and one 389DS. Password synchronization is successful. In september 2009, a second AD server is installed with passync service and a second replication agreement between one 389DS and the second AD. But Password synchronization does not work with the second AD. passsync.log : 09/09/09 15:04:44: PassSync service initialized 09/09/09 15:04:44: PassSync service running 09/09/09 15:04:45: No entries yet 09/09/09 15:12:40: No entries yet 09/09/09 15:26:33: No entries yet 09/09/09 15:35:02: No entries yet "No entries yet" error message occure for each user password change on AD. 389DS can't catch windows password change. my architecture schema : 389DS n°1 ^----MMR-------------------> 389DS n°2 ^----Win-Sync-Agreement---> (passsync) AD n°1 ^----Win-Sync-Agreement---> (passsync) AD n°2 How can i resolve this problem, please ? regards -- * Hugo Étiévant *

2 3

389-DS install problem on CentOS
by Michel Urvoy 16 Sep '09

16 Sep '09

Hi, I have tried to install 389-ds-base 1.2.2-1.el5 (i386) on CentOS from dirsrv repos, but the public key is missing. I get : Public key for 389-ds-base-1.2.2-1.el5.i386.rpm is not installed. >From where can I get the key?

2 1

Syncing Active/Inactive status through Windows Sync
by Jonas Courteau 16 Sep '09

16 Sep '09

Hello all: I've currently got Active Directory (on Windows 2003) syncing nicely with DS, but I'm noticing that the AD Disabled/Enabled status is not syncing with the DS Active/Inactive status. Looking though all the docs, I don't see any mention that it SHOULD sync, especially seeing as it's not in the table of synced items in the Windows Sync chapter of the manual. However, I have seen a few posts out and about on the Internet that imply that the status does sync over, but nothing definitive. Anyone able to provide the final word on if this is supposed to work or not? Thanks! Jonas Courteau

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users September 2009