active directory password sync
by Ldap Tester
I have two 389 servers, one under fedora 12 and one under fedora 11.
They have the following packages:
389-admin-1.1.9-1.fc12.x86_64
389-admin-console-1.1.4-2.fc12.noarch
389-admin-console-doc-1.1.4-2.fc12.noarch
389-adminutil-1.1.8-4.fc12.x86_64
389-console-1.1.3-5.fc12.noarch
389-ds-1.1.3-5.fc12.noarch
389-ds-base-1.2.5-1.fc12.x86_64
389-ds-base-devel-1.2.5-1.fc12.x86_64
389-ds-console-1.2.0-5.fc12.noarch
389-ds-console-doc-1.2.0-5.fc12.noarch
389-dsgw-1.1.4-1.fc12.x86_64
389-admin-1.1.8-4.fc11.x86_64
389-admin-console-1.1.4-1.fc11.noarch
389-admin-console-doc-1.1.4-1.fc11.noarch
389-adminutil-1.1.8-3.fc11.x86_64
389-console-1.1.3-4.fc11.noarch
389-ds-1.1.3-4.fc11.noarch
389-ds-base-1.2.5-1.fc11.x86_64
389-ds-base-devel-1.2.5-1.fc11.x86_64
389-ds-console-1.2.0-4.fc11.noarch
389-ds-console-doc-1.2.0-4.fc11.noarch
389-dsgw-1.1.4-1.fc11.x86_64
There are set up as multi masters.
I also have a windows 2003 Active Directory server.
I have password sync'ing set up between the AD and the fedora 12 389 server.
This has been working for several years.
I have recently noticed a problem that may have existed for some time now,
maybe always.
If I change a user password via windows, everything works as expected.
The password changes on windows and both fedora machines.
If I change a user password via the fedora 12 machine,
the one that has the sync agreement with the windows machine,
again, everything works as expected,
The password changes on windows and both fedora machines.
However, if I change a user password via the fedora 11 machine,
the one that does not have the sync agreement with the windows machine,
then, the password changes on both fedora machines,
but NOT on the windows machine.
This is not how it is supposed to work, right?
I have looked at all sorts of logs, and still have now clue as to the
problem.
(I do not believe it is a fedora 11 versus fedora 12 problem.)
Does anybody have any ideas?
14 years, 3 months
Administer the 389 Server through Windows?
by Ajeet S Raina
Hello Guys,
I have setup 389 Server by running setup-ds-admin.pl which installed both
the admin and directory server.I have kept the Linux Installation minimal
due to which I dont have X Windows running. All I want is access and
administer through Windows.
is there any interface tool for Windows through which I can administer the
389 Server running on centOS linux?
14 years, 3 months
Password Policy not working?
by Ajeet S Raina
Guys, I have 389-DS server running under MMR environment.I am using script
to add users as shown below:
the Users.ldif seems like this one:
dn: uid=ram,ou=People,dc=im,dc=sap,dc=com
changetype: add
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: posixAccount
cn: ram M
gecos: ram
sn: ram
givenName: ram M
uidNumber: magic
gidNumber: 1002
userPassword: {clear}redhat
loginShell: /bin/bash
homeDirectory: /home/ram
And its adding successfully.
Now When I try to setup a Password Policy through Console it is not taking
effect.
For Example: I tried selecting Allow User change password after reset.
Save it.
nd try logging into client machine, it doesnt work.
Its Logging in the user but not asking to change password.
14 years, 3 months
389 DS Client Login Access Error
by Ajeet S Raina
I have setup 389-DS Client which is facing issue to login.
All I did is:
1.Run authconfig-tui
Selected LDAP, MD5 Password
next Screen >> [*] TLS
ldap://389-supplier.sap.com:636
BASE DN: dc=im,dc=sap,dc=com
Tried to login but it is not able to see any screen
I tried disabling
#ssl start_tls
And Now it does allow login asking for password.
But When I provide pasword it throws me out of putty.
My 389-Supplier is on 636 port and I wonder what could be the issue.
Pls Suggest?
I checked with /var/log/secure:
[root@389-ds cacerts]# tail -f /var/log/secure
Jan 26 19:24:51 localhost sshd[3816]: fatal: Access denied for user nitesh
by PAM account configuration
Jan 26 19:24:51 localhost sshd[3815]: Failed password for itesh from
10.210.52.245 port 3025 ssh2
Jan 26 19:27:00 localhost sshd[3817]: reverse mapping checking getaddrinfo
for vpn-delm-52-245.sapient.com failed - POSSIBLE BREAK-IN ATTEMPT!
Jan 26 19:27:03 localhost sshd[3817]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.210.52.245
user=ajrain
Jan 26 19:27:03 localhost sshd[3818]: fatal: Access denied for user ajrain
by PAM account configuration
Jan 26 19:27:03 localhost sshd[3817]: Failed password for ajrain from
10.210.52.245 port 3028 ssh2
Jan 26 19:28:01 localhost sshd[3823]: reverse mapping checking getaddrinfo
for vpn-delm-52-245.sapient.com failed - POSSIBLE BREAK-IN ATTEMPT!
Jan 26 19:28:04 localhost sshd[3823]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.210.52.245
user=ajrain
Jan 26 19:28:04 localhost sshd[3824]: fatal: Access denied for user ajrain
by PAM account configuration
Jan 26 19:28:04 localhost sshd[3823]: Failed password for ajrain from
10.210.52.245 port 3029 ssh2
14 years, 3 months
Which is the correct Certificate ?
by Ajeet S Raina
Hello Guys,
I am confused with setting up of 389-DS Client. All I want to know is which
certificate I need to copy to LDAP CLient.
All I tried searching for :
On 389-DS Server:
[root@389-supplier ~]# find / -name cacert.asc
/etc/dirsrv/slapd-389-supplier/cacert.asc
Is this the Correct certifcate I need to copy to clients'
/etc/openldap/cacert/ directory.
If yes, then i tried putting it to remote LDAP Client but it showed me the
error while authconfig-tui:
I selected LDAP >> [*] TLS Server: ldap://<>:636 Base DN
[root@389-Client cacerts]# authconfig-tui
unable to load certificate
4053:error:0906D06C:PEM routines:PEM_read_bio:no start
line:pem_lib.c:647:Expecting: TRUSTED CERTIFICATE
Stopping nscd: [FAILED]
Starting nscd: [ OK ]
[root@389-ds cacerts]#
[root@389-ds cacerts]#
14 years, 3 months
excessive clock skew. Error Code: 2
by Ajeet S Raina
Guys,
I have constructed Master to Master Replication on my CentOS.
Master1: 389-supplier.sap.com
Master2:389-consumer.sap.com
The Replication was setup through mmr.pl script downloaded from 389-DS
official website,
Things seems to be working fine. If I construct any User under Supplier
Machine it does shows at consumer end too.
But I have bene regularly seeing these logs error:
Incremental update has failed and requires administrator actionSystem error.
Error Code: -1
Replication error acquiring replica: excessive clock skew. Error Code: 2
The Output has been taken from consumer Management Console.
Same error at Supplier end too.
Please Suggest.
14 years, 3 months
IP Address change
by Mister Anonyme
Hi,
Soon, we'll change ip adresses on multi-master LDAP servers.
I'm wondering if there are configuration files that we should change ip adress in LDAP configuration ?
Also, is the replication system (master->slave) will be affected even if we use hostnames only ?
Thank you!
_________________________________________________________________
Reinvent how you stay in touch with the new Windows Live Messenger.
http://go.microsoft.com/?linkid=9706116
14 years, 3 months
