389-users October 2011

389-users@lists.fedoraproject.org

28 participants
25 discussions

Views, Filtered roles and CoS
by Colin Panisset 06 Oct '11

06 Oct '11

I have a pretty flat DIT, with all users currently under ou=people,dc=example,dc=com; these user objects also have posixAccount attributes, of which loginShell is one. What I'm trying to achieve is to be able to set a "default" loginShell to be a restricted shell (/bin/rbash) for developers, but allow that to be a non-restricted shell on systems which are development hosts. As an example, on a production host I'd like: $ ldapsearch -x "(uid=devuser)" uid loginshell to return: dn: cn=Dev User,ou=People,dc=example,dc=com loginShell: /bin/rbash uid: devuser while on a development host, I'd like the same search to return dn: cn=Dev User,ou=People,dc=example,dc=com loginShell: /bin/bash uid: devuser I thought I might be able to achieve this by creating a view called ou=Developers,dc=example,dc=com and using that as a base DN on the development boxes, then applying a CoS within the view to override the loginShell attribute, but then the CoS ends up being applied to the original entry too. Is there any way that I could: - have a CoS apply based on client system attributes, like IP address/hostname? - have a CoS which applies to a view that *doesn't* affect the original object? - perhaps make use of cosPriority through two different views, so as to have ou=Development,... and ou=Production,... (but that would be answered by the previous option anyway)? Is there some other clever way to achieve what I'd like? I'd really like to avoid maintaining 2 separate DITs for the same set of users. -- C.

3 6

Failed to convert DN uid=<username> to RDN
by Aleksey Mykhailov 06 Oct '11

06 Oct '11

Hello, I have fresh installed 389 directory server on RHEL6 from EPEL and rmeggins repo supplier - an old NetscapeDirectory server 4.12 consumer - 389 directory server Version 1.2.9.9 **consumer userRoot database is Updatable by a 4.x Replica it works fine , my clients not experience any problems but in logs I see a lot these messages: [06/Oct/2011:12:41:59 +0300] _entry_set_tombstone_rdn - Failed to convert DN uid=<username> to RDN [06/Oct/2011:12:41:59 +0300] id2entry - str2entry returned NULL for id 1363, string="rdn" [06/Oct/2011:12:41:59 +0300] _entry_set_tombstone_rdn - Failed to convert DN uid=<username> to RDN [06/Oct/2011:12:41:59 +0300] id2entry - str2entry returned NULL for id 1364, string="rdn" I've tried to reinitialize consumer , but this didn't help ..

1 0

Odd SSL Issues
by Craig T 06 Oct '11

06 Oct '11

Hi, Setup: Fedora 15 x64 * 389-admin-1.1.23-1.fc15.x86_64 * 389-admin-console-1.1.8-1.fc15.noarch * 389-admin-console-doc-1.1.8-1.fc15.noarch * 389-adminutil-1.1.14-1.fc15.x86_64 * 389-console-1.1.7-1.fc15.noarch * 389-ds-1.2.2-1.fc15.noarch * 389-ds-base-1.2.9.10-2.fc15.x86_64 * 389-ds-base-libs-1.2.9.10-2.fc15.x86_64 * 389-ds-console-1.2.6-1.fc15.noarch * 389-ds-console-doc-1.2.6-1.fc15.noarch * 389-dsgw-1.1.7-2.fc15.x86_64 Disclaimer: I'm pretty new to 389 Directory Server so this might be a simple question. Goal: I am attempting to install a CA & server certificate, which I have signed by my own openssl CA. My Steps: After using the 389 Console to generate my certificate request, I was then able to sign it with my openssl CA and install the cert (plus CA cert) into the 389 Directory Server without issue. I then choose the; - "Enable SSL for this server" option and selected the security device and server cert "server-crt2". - I checked the CA cert and it showed that there was no broken links in the certification paths. Issue: After restarting Directory Server, I was surprised to see the following error; ----------------------------------------------------------------------------------------- [04/Oct/2011:17:39:09 +1100] - SSL alert: Security Initialization: Can't find certificate (server-cert2) for family cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8174 - security library: bad database.) [04/Oct/2011:17:39:09 +1100] - SSL alert: Security Initialization: Unable to retrieve private key for cert server-cert2 of family cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8174 - security library: bad database.) [04/Oct/2011:17:39:09 +1100] - SSL failure: None of the cipher are valid [04/Oct/2011:17:39:09 +1100] - ERROR: SSL Initialization phase 2 Failed. ----------------------------------------------------------------------------------------- I feel like I must be missing something pretty obvious, any suggestions? cya Craig

2 2

passsync - ldap error in queryusername
by Aaron Hagopian 04 Oct '11

04 Oct '11

Recently this message started to show up on our windows domain controller in the passsync log file: ... 09/29/11 14:38:50: Ldap error in QueryUsername 1: Operations error 09/29/11 14:39:54: Ldap error in QueryUsername 1: Operations error 09/29/11 14:42:02: Ldap error in QueryUsername 1: Operations error 09/29/11 14:46:18: Ldap error in QueryUsername 1: Operations error ... Happen fairly sporadically but password changes from this machine are also being abandoned while on others no issues. This is our only 2008 domain controller as the moment but it was working on this machine and another 2008 DC (that was de-commissioned) previously. Thanks, Aaron Hagopian

2 3

Start TLS request accepted. Server willing to negotiate SSL
by David Hoskinson 04 Oct '11

04 Oct '11

While attempting to change a directory password I keep getting this message... [root@xxx ~]# ldappasswd -x -ZZ -D "cn=directory manager" -w "mypass" uid=se253264,ou=people,dc=xxx,dc=cle=dc=us" -a "oldpass" -s "newpass" ldap_start_tls: Connect error (-11) additional info: Start TLS request accepted.Server willing to negotiate SSL. In researching this I found to add -d1 for additional debugging information and found this probably relevant TLS: could not load client CA list (file:`',dir:`/etc/openldap/cacerts/cacert.asc'). TLS: error:0200A014:system library:opendir:Not a directory ssl_cert.c:816 TLS: error:140D7002:SSL routines:SSL_add_dir_cert_subjects_to_stack:system lib ssl_cert.c:818 ldap_perror I do have the following in my /etc/ldap.conf file ssl yes tls_cacertdir /etc/openldap/cacerts TLS_REQCERT allow pam_password exop And the cacert.asc does exist in that directory. This is the cacert.asc that was created during setup of this machine using the setupssl.sh script and I copied it to the requested directory. I am not seeing anything additional on the HowtoSSL page and realize that TLS is necessary for the password change function. Thanks for any help you may have. I am also under the impression I am supposed to copy the cacert.asc to each client machine so they can authenticate against the cert. is this true also? David Hoskinson | DATATRAK International Systems Engineer Mayfield Heights, Ohio, USA +1.440.443.0082 x 124 (p) | +1.216.280.5457 (m) david.hoskinson(a)datatrak.net<mailto:david.hoskinson@datatrak.net> | www.datatrak.net<http://www.datatrak.net/>

2 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users October 2011