January 2014 - 389-users - Fedora mailing-lists

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

multi-valued nsAccountLock
by Pierre ROUDIER 10 Jul '15

10 Jul '15

Hi all, RedHat DS's doc states that the nsAccountLock attribute is multi-valued [1]. Some tests with 389ds led me to think it's also true for 389ds. I cannot think of any reason explaining why it would have to be multi-valued. Do you have any idea? Thank you. [1] https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server…

3 2

changelog
by Denise Cosso 16 Apr '15

16 Apr '15

Hi, How to modify the attribute nsslapd-encryptionalgorithm in Centos? Thanks, Denise Stop Master servers and set nsslapd-encryptionalgorithm. The allowed value is AES or 3DES. dn: cn=changelog5,cn=config [...] nsslapd-encryptionalgorithm: AES --- Em ter, 4/6/13, Rich Megginson <rmeggins(a)redhat.com> escreveu: De: Rich Megginson <rmeggins(a)redhat.com> Assunto: Re: [389-users] changelog Para: "Denise Cosso" <guanaes51(a)yahoo.com.br> Data: Terça-feira, 4 de Junho de 2013, 16:34 On 06/04/2013 01:26 PM, Denise Cosso wrote: Hi, Rich CentOS release 6.3 (Final) 389-ds-base-libs-1.2.10.2-20.el6_3.x86_64 389-ds-1.2.2-1.el6.noarch 389-dsgw-1.1.10-1.el6.x86_64 389-ds-console-1.2.6-1.el6.noarch 389-ds-console-doc-1.2.6-1.el6.noarch 389-ds-base-1.2.10.2-20.el6_3.x86_64 As far as replication goes - you will need to use a security layer (SSL, TLS, or GSSAPI) to protect the clear text password on the wire As far as encrypting it in the changelog - not sure Denise --- Em ter, 4/6/13, Rich Megginson <rmeggins(a)redhat.com> escreveu: De: Rich Megginson <rmeggins(a)redhat.com> Assunto: Re: [389-users] changelog Para: "General discussion list for the 389 Directory server project." <389-users(a)lists.fedoraproject.org> Cc: "Denise Cosso" <guanaes51(a)yahoo.com.br> Data: Terça-feira, 4 de Junho de 2013, 16:11 On 06/04/2013 12:39 PM, Denise Cosso wrote: Hi, Description of problem: When a userPassword is changed in a server with changelog, the hashed password is logged and also a cleartext pseudo-attribute version. It looks like this: change:: replace: userPassword userPassword: {SHA256}vqtiN2LHdrEUOJUKu+IBVqAVFsAlvFw+11kD/Q== - replace: unhashed#user#password unhashed#user#password: secret12 This unhashed version is used in winsync where the cleartext version of the password must be written to the AD. Now if the DS is involved in replication with another DS, the change will be replayed exactly as it is logged to the other DS replicas, including the cleartext pseudo-attribute password. What platform? What version of 389-ds-base are you using? thanks, Denise -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

2 2

389 Master - Master Replication
by Santos Ramirez 03 Oct '14

03 Oct '14

Good Morning, We have a master - master replication agreement. When we initialize the replication it works perfectly we can see changes to a test user we have set up go up and down from the two servers. However at some point the replication stops and we cannot get replication to start once again. The only way we can get replication to start once again is to recreate the replication agreement and then it fails again. Can anyone please point us in a direction. I am relatively new to 389 so any help would be greatly appreciated. Santos U. Ramirez Linux Systems Administrator National DCP, LLC 150 Depot Street Bellingham, Ma. 02019 Phone: 508-422-3089 Fax: 508-422-3866 Santos.Ramirez(a)natdcp.com<mailto:Santos.Ramirez@natdcp.com> This email and any attachments are intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, do not copy or forward to any unauthorized persons, permanently delete the original and notify the sender by replying to this email.

3 9

Upgraded 389-admin rpms and now I can't start dirsrv-admin
by Groten, Ryan 19 Mar '14

19 Mar '14

Just upgraded my packages from: 389-ds-console-1.2.6-1.el5 389-console-1.1.7-1.el5 389-ds-console-doc-1.2.6-1.el5 389-admin-console-1.1.8-1.el5 389-admin-console-doc-1.1.8-1.el5 389-ds-base-1.2.9.9-1.el5 389-dsgw-1.1.7-2.el5 389-adminutil-1.1.14-1.el5 389-admin-1.1.23-1.el5 389-ds-base-libs-1.2.9.9-1.el5 To: 389-ds-console-1.2.6-1.el5 389-console-1.1.7-3.el5 389-ds-console-doc-1.2.6-1.el5 389-adminutil-1.1.19-1.el5 389-admin-console-1.1.8-1.el5 389-admin-1.1.29-1.el5 389-admin-console-doc-1.1.8-1.el5 389-dsgw-1.1.11-1.el5 389-ds-base-1.2.11.25-1.el5 389-ds-base-libs-1.2.11.25-1.el5 +perl-NetAddr-IP.x86_64 0:4.027-5.el5 +perl-Socket6.x86_64 0:0.19-3.fc6 After that I ran "setup-ds-admin.pl -u". Now I'm having problems starting dirsrv-admin: # service dirsrv-admin start Starting dirsrv-admin: httpd.worker: Syntax error on line 136 of /etc/dirsrv/admin-serv/httpd.conf: Cannot load /usr/lib64/dirsrv/modules/mod_admserv.so into server: /usr/lib64/libadminutil.so.0: undefined symbol: ldap_explode Server failed to start !!! Please check errors log for problems [FAILED] # cat /etc/redhat-release Red Hat Enterprise Linux Server release 5.9 (Tikanga) I checked any error logs I could think of but found nothing. Thanks in advance for the help! Ryan ________________________________ This communication, including any attached documentation, is intended only for the person or entity to which it is addressed, and may contain confidential, personal and/or privileged information. Any unauthorized disclosure, copying, or taking action on the contents is strictly prohibited. If you have received this message in error, please contact us immediately so we may correct our records. Please then delete or destroy the original transmission and any subsequent reply.

3 4

How to specify number of hashing iterations for a password
by Richard Mixon 18 Feb '14

18 Feb '14

During the bind process is there anyway to tell 389 directory server to hash a plaintext password n (multiple) times before trying to compare to what is stored? I am trying to implement something similar to what's described in this article: http://www.stormpath.com/blog/strong-password-hashing-apache-shiro Our plan was to to use SSHA256 to hash the passwords around 200,000 times before storing. This would at least slow down any cracking attempts should someone get access to our directory. I've read through the documentation on the Red Hat Directory Server site, including the "Plug-in Guide". Under "5.8 Checking Passwords" it refers to calling function "slapi_pw_find_sv()" - looking at the doc for this function it does not look like hashing multiple times is supported. Is there some means of doing this that is not obvious to me? I can certainly do it by re-writing the security plugins for the various servers (Tomcat, PHP Wordpress, etc) such that they hash the plaintext password n minus 1 times before issuing the bind - but was hoping not to do that. I'm relatively new to 389 directory server, but so far quite happy to have moved to it from another directory server. Thank you - Richard -- Richard Mixon Custom Computer Creations, L.L.C. mobile: (480) 577-6834 office: (480) 614-3442 email: rnmixon(a)CustCo.biz <mailto:rnmixon@CustCo.biz> Microsoft Partner ID: 1263725 The messages and documents transmitted with this notice contain confidential information belonging to the sender. If you are not the intended recipient of this information, you are hereby notified that any disclosure, copying, distribution or use of the information is strictly prohibited. If you have received this transmission in error, please notify the sender immediately.

4 8

db2index on RHDS 9.1
by Paul Whitney 31 Jan '14

31 Jan '14

We are trying to reindex RHDS 9.1 after importing an updated index. Services were stopped. Started the /usr/lib64/dirsrv/slapd-instance/db2index. Reindex starts but then consistently reports: Processed 300,000 entries ( pass 1) Processed 300,000 entries ( pass 2) and keeps repeating that sequence with same amount of entries. How long does it usually take to complete the process and is there a limit or issue with this feature? This happened once before and system was left overnight performing indexing only to still processing with new passes. We ended up breaking the process and just reinitializing the server. Thank you, Paul M. Whitney E-mail: paul.whitney(a)mac.com

4 8

Exporting Index from an Instance
by Paul Whitney 30 Jan '14

30 Jan '14

Is there a way to export the Index of a directory server with the intent of importing into another server? Paul M. Whitney E-mail: paul.whitney(a)mac.com Cell: 410.493.9448

2 1

SQLite certutil databases for 389-ds?
by David Barr 29 Jan '14

29 Jan '14

Good Morning, In setting up my 389-ds instance for SSL, the dirsrv instance doesn’t appear to recognize cert9.db or key4.db, the SQLite NSS database formats. Did I miss a setting? Is 389-ds restricted to cert8.db/key3.db? A quick search of the 389-ds wiki didn’t help; Google returns a lot of noise and not much signal. # service dirsrv start Starting dirsrv: ds01...[27/Jan/2014:21:28:12 -0800] SSL Initialization - Warning: certificate DB file cert8.db nor cert7.db exists in [/etc/dirsrv/slapd-ds01] - SSL initialization will likely fail [27/Jan/2014:21:28:12 -0800] SSL Initialization - Warning: key DB file /etc/dirsrv/slapd-ds01/key3.db does not exist - SSL initialization will likely fail [27/Jan/2014:21:28:12 -0800] - SSL alert: Security Initialization: Unable to authenticate (Netscape Portable Runtime error -8192 - An I/O error occurred during security authorization.) [27/Jan/2014:21:28:12 -0800] - ERROR: SSL Initialization Failed. Thanks! David -- David - Offbeat http://dafydd.livejournal.com dafydd - Online http://pgp.mit.edu/ Battalion 4 - Black Rock City Emergency Services Department Integrity*Commitment*Communication*Support ----5----1----5----2----5----3----5----4----5----5----5----6----5----7-- Rene Descartes walks into his neighborhood watering hole. The publican sees him and asks, "Will you have your usual, sir?" Descartes ponders a moment and replies, "I think not." And promptly disappears...

2 2

Reset Password as Root if User Forgets Password
by Chaudhari, Rohit K. 28 Jan '14

28 Jan '14

Hello, I need to be able to reset a LDAP user's password if they forget it with the user root. But when I try the "passwd" command as root for a LDAP user, I get the following: (as root) passwd tuser Changing password for user tuser. Password reset by root is not supported. passwd: Authentication token manipulation error. I am using sssd as the LDAP authentication mechanism tool, to be specific. Does anyone have a solution to dealing with this issue of resetting a LDAP user's password if they forgot it? Thanks, Rohit From: <Chaudhari>, "Rohit K. Chaudhari" <rohit.chaudhari(a)jhuapl.edu<mailto:rohit.chaudhari@jhuapl.edu>> Date: Tuesday, January 21, 2014 3:29 PM To: "General discussion list for the 389 Directory server project." <389-users(a)lists.fedoraproject.org<mailto:389-users@lists.fedoraproject.org>> Subject: using passwd with 389 Hello, I want to be able to use the Unix "passwd" command to reset a LDAP user's password from the command line. However, I keep getting an authentication token manipulation error whenever I try to reset the password using that command. What do I need to do in the 389 DS or on Unix in order to get this command to work? Thanks, Rohit

4 8

Naming conflict on hub/consumer
by Colin Tulloch 22 Jan '14

22 Jan '14

Hi All - We had a bundle of problems with our MM/consumer setup. Ran of out FDs on the consumers, had the slapd process on a master die, etc. We're getting things back up and running properly, but having some replication issues now. We've got it mostly cleaned up - the masters are in sync, and all consumers but 1 hub. However, 1 hub has 3 naming conflicts on an entry. How can we resolve these? Since it's read-only, the normal documented processes won't work of course. The non-conflicted entry isn't receiving updates from the masters. We use the directory for PKI, and the entry contains a CRL that is going to expire - not good. Do we need to just wait, and the actual entry will get updated at some point? With the errors we had, it seemed to take a long time for the directories to replicate around and catch up.

2 18

Deleting home folders when deleting ldap users
by Chaudhari, Rohit K. 22 Jan '14

22 Jan '14

Hello, I'm using JNDI and Java to delete LDAP users, but when I delete them, their home folders stay on the Desktop. How do I get these to delete as well without creating a separate script? Is there a toggle in LDAP to make this happen? Secondly, if a user has multiple home folders scattered across multiple systems, how do you clear away all those home folders when deleting a LDAP user on one central machine linked to all those multiple systems? Thanks On 1/22/14 3:26 PM, "Paul Robert Marino" <prmarino1(a)gmail.com> wrote: >your SSL cert or your DNS is bad. TLS requires full forward and revers >lookup of the C name for the host to match one of the host names in >the SSL cert. > > > >On Wed, Jan 22, 2014 at 3:08 PM, Chaudhari, Rohit K. ><Rohit.Chaudhari(a)jhuapl.edu> wrote: >> I'm not using kerberos. The other suggestion about using ldappasswd led >> to the error: >> >> ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) >> Additional info: TLS: hostname does not match CN in peer certificate >> >> Is there a way to create a JNDI equivalent command so that I could add a >> checkbox to a Java GUI that basically toggles the "force password change >> after reset" checkbox built into the password policy in 389? >> >> On 1/22/14 10:49 AM, "Paul Robert Marino" <prmarino1(a)gmail.com> wrote: >> >>>sorry thats not possible. >>>If you are using Kerberos then you can do it via the kadmin command. >>>If not then you have to use one of several other tools like the admin >>>console or ldapmodify for example. >>> >>> >>>On Wed, Jan 22, 2014 at 9:06 AM, Chaudhari, Rohit K. >>><Rohit.Chaudhari(a)jhuapl.edu> wrote: >>>> Hello, >>>> >>>> I need to be able to reset a LDAP user's password if they forget it >>>>with the >>>> user root. But when I try the "passwd" command as root for a LDAP >>>>user, I >>>> get the following: >>>> >>>> (as root) >>>> passwd tuser >>>> Changing password for user tuser. >>>> Password reset by root is not supported. >>>> passwd: Authentication token manipulation error. >>>> >>>> I am using sssd as the LDAP authentication mechanism tool, to be >>>>specific. >>>> Does anyone have a solution to dealing with this issue of resetting a >>>>LDAP >>>> user's password if they forgot it? >>>> >>>> Thanks, >>>> >>>> Rohit >>>> >>>> From: <Chaudhari>, "Rohit K. Chaudhari" <rohit.chaudhari(a)jhuapl.edu> >>>> Date: Tuesday, January 21, 2014 3:29 PM >>>> To: "General discussion list for the 389 Directory server project." >>>> <389-users(a)lists.fedoraproject.org> >>>> Subject: using passwd with 389 >>>> >>>> Hello, >>>> >>>> I want to be able to use the Unix "passwd" command to reset a LDAP >>>>user's >>>> password from the command line. However, I keep getting an >>>>authentication >>>> token manipulation error whenever I try to reset the password using >>>>that >>>> command. What do I need to do in the 389 DS or on Unix in order to >>>>get >>>>this >>>> command to work? >>>> >>>> Thanks, >>>> >>>> Rohit >>>> >>>> -- >>>> 389 users mailing list >>>> 389-users(a)lists.fedoraproject.org >>>> https://admin.fedoraproject.org/mailman/listinfo/389-users >>>-- >>>389 users mailing list >>>389-users(a)lists.fedoraproject.org >>>https://admin.fedoraproject.org/mailman/listinfo/389-users >> >> -- >> 389 users mailing list >> 389-users(a)lists.fedoraproject.org >> https://admin.fedoraproject.org/mailman/listinfo/389-users >-- >389 users mailing list >389-users(a)lists.fedoraproject.org >https://admin.fedoraproject.org/mailman/listinfo/389-users

1 0

using passwd with 389
by Chaudhari, Rohit K. 21 Jan '14

21 Jan '14

Hello, I want to be able to use the Unix "passwd" command to reset a LDAP user's password from the command line. However, I keep getting an authentication token manipulation error whenever I try to reset the password using that command. What do I need to do in the 389 DS or on Unix in order to get this command to work? Thanks, Rohit

3 2

Replication error
by Diego Woitasen 21 Jan '14

21 Jan '14

Hi, I have a replication error with 389DS. If I try a full resync, replication works. But if I modify something after that, it fails. The only lines that I see in the logs are: [20/Jan/2014:21:12:50 -0300] - _csngen_adjust_local_time: gen state before 52ddb8ec0001:1390262479:0:29 [20/Jan/2014:21:12:50 -0300] - _csngen_adjust_local_time: gen state after 52ddbb9f0000:1390263170:0:29 [20/Jan/2014:21:12:50 -0300] NSMMReplicationPlugin - ruv_add_csn_inprogress: successfully inserted csn 52ddbb9f000000630000 into pending list [20/Jan/2014:21:12:50 -0300] NSMMReplicationPlugin - Purged state information from entry uid=zzj,ou=People,ou=branch,ou=branches,dc=site,dc=ar up to CSN 52d47e6b000000630000 [20/Jan/2014:21:12:50 -0300] NSMMReplicationPlugin - ruv_update_ruv: successfully committed csn 52ddbb9f000000630000 [20/Jan/2014:21:12:50 -0300] NSMMReplicationPlugin - agmt="cn=main to cmald" (ldap:389): State: stop_fatal_error -> stop_fatal_error Not very helpful for me. The last line shows an error, but it's not very descriptive. What can I do to debug this? Or do you have a hint? Regards, Diego -- Diego Woitasen Linux and Open Source solutions architect at www.vhgroup.net

2 2

Only username as bind dn
by Paolo Barbato 20 Jan '14

20 Jan '14

Hi 389-users, I'm testing last released 389 dirsrv on a rhel 6.5. I've deployed a PAM passthrough, since I have a central repository for credentials, and it works. I guess if it would be possible to use a simple username or it's mandatory use syntax like uid=myuser (or cn=..) as bind dn. ldapsearch -v -LLL -Hldaps://my389 -b"dc=myDC" -D "uid=myUser" -W -x works ldapsearch -v -LLL -Hldaps://my389 -b"dc=myDC" -D "myUser" -W -x doesn't work ldap_bind: No such object (32) additional info: Bind DN [myUser] is invalid or not found So the question is if would be possible rewrite in some way the bind dn before syntax check. Regards, Paolo. ------------------------------------------------------------------------------------------------ Paolo Barbato Consorzio RFX corso Stati Uniti,4 Network Administrator phone: +39 049 8295097 fax: +39 049 8700718 ------------------------------------------------------------------------------------------------

5 10

The admin server: failed to get a socket for 0.0.0.0
by Jan Tomasek 19 Jan '14

19 Jan '14

Hello, I'm trying to install new LDAP server and facing strange errors: > [14/01/15:04:47:03] - [Setup] Info Updating the configuration for the httpd engine . . . > [14/01/15:04:47:03] - [Setup] Warning Error: command 'getsebool httpd_can_connect_ldap' failed - output [getsebool: SELinux is disabled] error [][14/01/15:04:47:03] - [Setup] Info Starting admin server . . . > [14/01/15:04:47:13] - [Setup] Info output: Starting dirsrv-admin: > [14/01/15:04:47:13] - [Setup] Info output: [Wed Jan 15 04:47:03 2014] [crit] (22)Invalid argument: alloc_listener: failed to get a socket for 0.0.0.0 > [14/01/15:04:47:13] - [Setup] Info output: Syntax error on line 87 of /etc/dirsrv/admin-serv/console.conf: > [14/01/15:04:47:13] - [Setup] Info output: Listen setup failed > [14/01/15:04:47:13] - [Setup] Info output: Server failed to start !!! Please check errors log for problems > [14/01/15:04:47:13] - [Setup] Info output: ESC[60G[ESC[0;31mFAILEDESC[0;39m] > [14/01/15:04:47:13] - [Setup] Info The admin server was successfully started. > [14/01/15:04:47:13] - [Setup] Info Admin server was successfully created, configured, and started. > [14/01/15:04:47:13] - [Setup] Success Exiting . . . I have found bug 377: https://fedorahosted.org/389/ticket/377 which seems to be fixed in 1.1.36 but sadly it's not available yet in repositories: > [root@ldap21shadow ~]# yum list installed |grep 389 > 389-admin.x86_64 1.1.35-1.el6 @epel > 389-admin-console.noarch 1.1.8-1.el6 @epel > 389-admin-console-doc.noarch 1.1.8-1.el6 @epel > 389-adminutil.x86_64 1.1.19-1.el6 @epel > 389-console.noarch 1.1.7-1.el6 @epel > 389-ds.noarch 1.2.2-1.el6 @epel > 389-ds-base.x86_64 1.2.11.15-31.el6_5 @updates > 389-ds-base-libs.x86_64 1.2.11.15-31.el6_5 @updates > 389-ds-console.noarch 1.2.6-1.el6 @epel > 389-ds-console-doc.noarch 1.2.6-1.el6 @epel > 389-dsgw.x86_64 1.1.11-1.el6 @epel I've tried workaround described there by rmeggins. Output is very similar, only warning about getsebool is gone: > Creating directory server . . . > /usr/sbin/semanage: SELinux policy is not managed or store cannot be accessed. > /usr/sbin/semanage: SELinux policy is not managed or store cannot be accessed. > Your new DS instance 'ldap21shadow' was successfully created. > Creating the configuration directory server . . . > Beginning Admin Server creation . . . > Creating Admin Server files and directories . . . > Updating adm.conf . . . > Updating admpw . . . > Registering admin server with the configuration directory server . . . > Updating adm.conf with information from configuration directory server . . . > Updating the configuration for the httpd engine . . . > /usr/sbin/semanage: SELinux policy is not managed or store cannot be accessed. > /usr/sbin/semanage: SELinux policy is not managed or store cannot be accessed. > Starting admin server . . . > output: Starting dirsrv-admin: > output: [Wed Jan 15 05:11:22 2014] [crit] (22)Invalid argument: alloc_listener: failed to get a socket for 0.0.0.0 > output: Syntax error on line 87 of /etc/dirsrv/admin-serv/console.conf: > output: Listen setup failed > output: Server failed to start !!! Please check errors log for problems > output: [FAILED] > The admin server was successfully started. > Admin server was successfully created, configured, and started. > Exiting . . . > Log file is '/tmp/setup3KfWko.log' The console.conf is equal to to configuration on my other servers: > [root@ldap21shadow ~]# head -87 /etc/dirsrv/admin-serv/console.conf | tail -5 > # e.g. "Listen 12.34.56.78:80" > # > # To allow connections to IPv6 addresses add "Listen [::]:80" > # > Listen 0.0.0.0:9830 I've tried Listen 9830 Listen [::]:9830 Listen 127.0.0.1: 9830 Still the same errors: > [root@ldap21shadow ~]# /etc/init.d/dirsrv-admin start > Starting dirsrv-admin: > [Wed Jan 15 05:29:55 2014] [crit] (22)Invalid argument: alloc_listener: failed to get a socket for 0.0.0.0 > Syntax error on line 87 of /etc/dirsrv/admin-serv/console.conf: > Listen setup failed Any suggestions? Thanks! -- ----------------------- Jan Tomasek aka Semik http://www.tomasek.cz/

4 7

non-unique UID
by Elizabeth Jones 19 Jan '14

19 Jan '14

I'm trying to scrub our LDAP data - we imported existing data from an old sun LDAP to our current 389 DS. I just noticed that there are 5 accounts in our LDAP that all have the same UID - I didn't think that was possible? Elizabeth J

2 1

Password synchronisation beetween openldap and AD 2008 R2
by Louis-Marie Plumel 16 Jan '14

16 Jan '14

Hello, Actually , i work with openldap. I've installed an AD 2008 R2.My challenge is to work with both and synchronise LDAP and AD 2008 R2. After a long research on the web, i don't find any information about howto synchronise passwords . That's why i come here to see if with 389 DS it's possible or not. Thank you for your help. -- Louis-Marie Plumel louismarie.plumel(a)gmail.com

6 12

Trigger on modify
by Deas, Jim 15 Jan '14

15 Jan '14

Is there a way to have 389-DS trigger a script when a group is modified? I.E. update posix members on changes to static and dynamic groups? JD

2 1

ACI warnings in error log
by Chris Chatfield 13 Jan '14

13 Jan '14

Hi, I'm seeing a similar situation as was described in the mailing list message "errors log - NSACLPlugin - acllas__client_match_URL:" from Feb 2013. The final result of this was a suggestion to file a ticket. As far as I can see this wasn't done. Should I do this (for my scenario)? On to my case. I'm getting messages like this in my errors log (Centos 6.5, 389DS 1.2.11.15): NSACLPlugin - acllas__client_match_URL: url [ldap:///gcUID=0001ab51,o=Teamphone.com??sub?(objectclass=gcsubscriber)] scope is subtree but dn [gcUID=0001ab51,o=Teamphone.com] is not a suffix of [cn=tp manager,ou=configuration,o=teamphone.com] There are acis at the o=teamphone.com subtree which allow administrators access to the whole tree. There are acis at the gcUID=0001ab51,o=Teamphone.com subtree which allow gcsubscriber entries within that tree to have limited access to the subtree. Note that we have extended the schema such that gcsubscribers extend person, amongst other things. I do not believe this makes any difference to the problem. The message happens on a connection bound to cn=tp manager,ou=configuration,o=teamphone.com (an administrator) when it searches within the subtree gcUID=0001ab51,o=Teamphone.com. It seems the acis at gcUID=0001ab51,o=Teamphone.com are being evaluated in the context of this administrator. In this case the administrator does not match the aci's userdn url path. This is deliberate as this aci is concerned with gcsubscriber access, not admin access. Other acis higher up give the correct admin access. So in summary, I think this logging should be downgraded from SLAPI_LOG_FATAL to SLAPI_LOG_ACL for the "acllas__client_match_URL: url [%s] scope is subtree but dn [%s] is not a suffix of [%s]\n" message (and I guess similarly for the onelevel/base scopes too). I notice that the git comment suggested that these lines were debugging. Would that be the right approach? We're moving away from the Sun/Oracle 5.2 directory server, and this aci is behaving quietly there. Many thanks, Chris

3 4

find the password encryption hash from the command line?
by Elizabeth Jones 12 Jan '14

12 Jan '14

Is there an ldap command that I can use to determine what encryption is being used for the passwords in my 389 DS? Elizabeth J

2 1

want a guaranteed income for working at home?
by Muhammad Khan 12 Jan '14

12 Jan '14

free work at home info pack looking to work at home? want a guaranteed income for working at home? visit us today and get your free work at home info pack (http://tinyurl.com/3gce3ot) ids (11659)

1 0

Re: [389-users] SSH Public keys
by s.oreilly 10 Jan '14

10 Jan '14

I have configured this. I will see if I can find my notes and post them on here! Sean O'Reilly On Thu 09/01/14 4:59 PM , "Conor O'Callaghan" brioscaibriste(a)gmail.com sent: > Hi all, > > I'm just wondering if anyone has experience storing public keys in 389 > directory server to allow a user to login using an ssh-key rather than a > password? I am running the server on Ubuntu 13.10 and the client is Ubuntu > 12.04. > > Thanks all, > > Conor > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users [1] > > > Links: > ------ > [1] > http://webmail.internetters.co.uk/parse.php?redirect=https://admin.fedorapr > oject.org/mailman/listinfo/389-users >

7 9

SSH Public keys
by Conor O'Callaghan 09 Jan '14

09 Jan '14

Hi all, I'm just wondering if anyone has experience storing public keys in 389 directory server to allow a user to login using an ssh-key rather than a password? I am running the server on Ubuntu 13.10 and the client is Ubuntu 12.04. Thanks all, Conor

1 0

Upgraded to RHDS 9.1 but Console is Still Looking for 9.0 JAR
by Paul Whitney 08 Jan '14

08 Jan '14

Hi, I recently updated RHDS 9.0 servers to 9.1. I am getting mixed results with the update. Steps taken: 1. Stop all dirsrv and dirsrv-admin services 2. Executed yum localupdate *.rpm 3. After the yum completes. Execute setup-ds.pl --debug --update (no errors generated, status is databases updated successfully. 4. Reinstall openldap (based on RHBA-2013-0778). 5. Reboot system. (I do this because restarting the dirsrv-admin service still generates the NSS error in the error log, but with a reboot it does not.) 6. connect to system and see jars have not loaded. I select Admin and an error states I do not have 9.0jar and cannot install. I checked the master and it no longer has the 9.0 jar, but rather the 9.1 But for some reason the admin server is still looking for 9.0 jars. I tried to change the /etc/dirsv/admin-serv/local.conf file to look like a working 9.1 local.conf file, but it seems that file is ignored. Looking for ideas on what else I can do "upgrade" the directory server. Paul M. Whitney E-mail: paul.whitney(a)mac.com

2 3

DS+SSL Start up Errors...
by David Barr 06 Jan '14

06 Jan '14

Good Morning! I’m working my way through http://directory.fedoraproject.org/wiki/Howto:SSL trying to create the certificates with OpenSSL, and then get them added to the NSS database. Most of that is fine. It’s only at the end that the directory server refuses to start, with these errors: ### SSL alert: Security Initialization: Unable to authenticate (Netscape Portable Runtime error -8192 - An I/O error occurred during security authorization.) ERROR: SSL Initialization Failed. ### Here’s what I’m going through. These commands are cut/pasted out of a script, so you’ll see my variable substitution. As far as that goes, these commands all return without error. (For what it’s worth, once everything works, I plan to post the script as an alternative to setupssl.sh and setupssl2.sh.) ### Private Key: openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:$PRIVATE_RSA_BITS -outform PEM -out $F_PRIVATE_KEY ### CA Certificate: openssl req -new -x509 -extensions v3_ca -key $F_PRIVATE_KEY -days $CERT_CA_EXPIRE \ -subj $CERT_CA_SUBJ -out $F_CERT_CA ### Host Certificate Request: openssl req -new -nodes -key $F_PRIVATE_KEY -days $HOST_CERT_EXPIRE -subj $CERT_CA_SUBJ \ -out $F_CERT_REQ ### Self-sign the Request: openssl ca -keyfile $F_PRIVATE_KEY -selfsign -days $HOST_CERT_EXPIRE -in $F_CERT_REQ \ -out $F_HOST_CERT ### Create a password file to use with creating and populating the certificate database: echo $PASSWORD > $F_PW_FILE chown nobody:nobody $F_PW_FILE chmod u+r,u-wxs,g-rwxs,o-rwxt $F_PW_FILE ### Create the pin.txt file for NSPR: echo "Internal (Software) Token:$PASSWORD" > $F_PINFILE chown nobody:nobody $F_PINFILE chmod u+r,u-wxs,g-rwxs,o-rwxt $F_PINFILE ### Adapt the host certificate to PKCS12 format: openssl pkcs12 -export -in $F_HOST_CERT -inkey $F_PRIVATE_KEY -out $F_HOST_PKCS \ -passout file:${F_PW_FILE} -name "${PKCS_CERT_NAME}" ### Create the certificate database: certutil -N -d sql:$D_INSTANCE_VAR -f $F_PW_FILE ### Import the host certificate: pk12util -v -i $F_HOST_PKCS -d sql:$D_INSTANCE_VAR -k $F_PW_FILE -w $F_PW_FILE ### Import the CA certificate: certutil -A -d sql:$D_INSTANCE_VAR -n "Local CA Certificate" -t CT,, -a -i $F_CERT_CA -f $F_PW_FILE ### List the certificates (This returns both certificates in good order): certutil -L -d sql:$D_INSTANCE_VAR ### Finally, the LDAP modifications (I also set up the “MemberOf” plugin, here. That’s been redacted for clarity.): ldapmodify -x -h localhost -D "cn=Directory Manager" -w $PASSWORD <<EOT dn: cn=config changeType: modify replace: passwordStorageScheme passwordStorageScheme: SSHA512 - add: nsslapd-security nsslapd-security: on - replace: nsslapd-ssl-check-hostname nsslapd-ssl-check-hostname: off dn: cn=encryption,cn=config changetype: modify replace: nsSSL3 nsSSL3: on - replace: nsSSLClientAuth nsSSLClientAuth: allowed - add: nsSSL3Ciphers nsSSL3Ciphers: -rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5, +rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_sha,+fortezza, +fortezza_rc4_128_sha,+fortezza_null,+tls_rsa_export1024_with_rc4_56_sha, +tls_rsa_export1024_with_des_cbc_sha,-rc4,-rc4export,-rc2,-rc2export,-des, -desede3 dn: cn=RSA,cn=encryption,cn=config changetype: add objectclass: top objectclass: nsEncryptionModule cn: RSA nsSSLPersonalitySSL: Server-Cert nsSSLToken: internal (software) nsSSLActivation: on EOT After that, `service restart dirsrv ${INSTANCE}`, as nobody:nobody, returns the errors I showed at the top of this message. Thoughts? Thanks! David -- David - Offbeat http://dafydd.livejournal.com dafydd - Online http://pgp.mit.edu/ Battalion 4 - Black Rock City Emergency Services Department Integrity*Commitment*Communication*Support ----5----1----5----2----5----3----5----4----5----5----5----6----5----7-- Pavlov walks into a bar. The phone rings and he says, "Damn! I forgot to feed the dog!"

2 1

389DS UUID with Apple calendarserver
by Oliver Werner 06 Jan '14

06 Jan '14

hello guys, I use OpenLDAP and would like to upgrade to 389DS In OpenLDAP a field entryUUID exists what I use on my Apple calendar server. It has the format of the GUID XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX. In 389DS I have only found the nsUniqueID field with XXXXXXX -XXXXXXXX-XXXXXXXX-XXXXXXXX Format. If there is an attribute in 389DS for using the GUID Format? Thank you for your help Sincerely yours Oliver

2 1

Re: [389-users] "Re:Binding Directory Manager as default Bind when using SSL/TLS certificate (please help)"
by Fosiul alam 01 Jan '14

01 Jan '14

Hi Predrag I just realized that from server itself i can do search without providing BindDN and password. But Cant do this from client.... example bellow from Server itself [root@puppet-1 slapd-puppet-1]# ldapsearch -xZZZ # extended LDIF # # LDAPv3 # base <dc=fosiul,dc=lan> (default) with scope subtree # filter: (objectclass=*) # requesting: ALL # # fosiul.lan dn: dc=fosiul,dc=lan dc: fosiul objectClass: domain objectClass: top # groups, fosiul.lan dn: ou=groups,dc=fosiul,dc=lan ou: groups objectClass: organizationalUnit objectClass: top # search result search: 3 result: 0 Success # numResponses: 3 # numEntries: 2 [root@puppet-1 slapd-puppet-1]# So, looks like there is a restriction from Client anonymous search .. Any idea where to look at ??

3 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users January 2014